Recovery for older Adventure conversations

The forward native-deletion lifecycle preserves old unrecognized conversations. An account can therefore still reach the 16-conversation limit with no matching Adventure left in Saves. Increasing the quota postpones that failure; automatic pruning would discard player history without a choice.

Add Past conversations to the existing Saves UI. Load it only on request, only for the current save owner, and only from the main menu. Show date, last recorded level and a short conversation excerpt. Forget requires a separate confirmation which explains that conversations on older device-only saves are affected too; game progress is not deleted. Display content with textContent, never HTML.

The authenticated server lists only that account's live campaign notebooks. Exclude every campaign referenced by either cloud edition or current local metadata. Malformed saved metadata fails closed. Legacy shared memory is never eligible. Forget rechecks those references under the same account transaction lock as saves and creation, and uses the displayed notebook revision in the retirement update. A newly attached save or a newer conversation prevents the deletion. The existing empty revision -1 marker blocks delayed replies and recreation. Preserve all other conversations and all game saves.

The UI discards responses after closing, account changes, save conflicts or leaving the menu. It never retries a destructive action automatically. Offline or failed requests leave records intact; an acknowledged retirement can be retried safely. Capacity errors point to Saves / Past conversations. No model generation, provider credential access, schema migration or native engine change is required.

Verify a full 16-row account regains capacity after explicitly forgetting one unlinked conversation, while linked saves, other accounts, legacy memory, concurrent replies and newly attached saves remain protected. Exercise the browser confirmation, account changes and real local storage endpoint in EN desktop/ZH touch emulation. Then run the affected server suite, hosted build/ typecheck, existing web suite and the repository release checks before shipping.

Verification

The implementation follows that contract. The account storage regression fails before implementation and passes after; the route likewise starts at 404 and passes after registration. An oversized-body check caught a swallowed body-limit exception (422 instead of 413); the handler now preserves the limit response. Unknown notebook formats explicitly report an unavailable preview rather than claiming the history is empty.

All 520 affected NPC/save checks pass, with the final preview-label follow-up passing its three focused storage/route checks. Hosted build and typecheck pass; 730 game web checks pass. The first OSS check exposed the new hosted route in the local export after its hosted dependency had correctly been omitted. The manifest now excludes this route alongside the existing hosted NPC route; the corrected export verification passes (seven successful tasks).

The compiled browser client is candidate 6d71cd2c79, retaining native 1b2eff7514 and all artwork. EN desktop and ZH 844×390 touch-emulated journeys use the real route and save service with isolated PGlite storage. Both start at 16 records; test cancel, connection failure, explicit forgetting, protection of both cloud editions, safe literal excerpt rendering, regained capacity, creation of a new native Adventure and reload of both surviving profiles. Both pass with no page errors. No production conversation, provider call or account setting was changed by these checks. Browser evidence is in the game worktree under output/past-conversations/browser-v2/; server evidence is in this worktree's output/campaign-history/. Physical phone behavior remains unverified.

Publication is pending. Production verification must remain read-only for existing conversations; deleting a real player's record is not a QA step.