diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5ad8e1c..6104501 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   so anyone relying on the old behaviour must add rules — or start the server
   with an explicit `--mode`. `--sandbox` also applies now; it did not before.
 
+### ✨ Added
+
+- **`thread/delete`** — the protocol could list, fork and archive threads but not
+  delete one, so the desktop deleted session files through Tauri instead. The
+  app-server is the single owner of thread storage; a client removing files
+  behind it can pull the ground out from under an open writer. Served under the
+  existing `threadManagement` capability, with the local writer kept as the
+  fallback for a sidecar too old to know the method.
+
 ### 🔒 Security
 
 - **A sub-agent did not inherit the file contract.** The `Task` delegation
@@ -42,6 +51,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### 🐛 Fixed
 
+- **The desktop sidebar was a second reader of the session directory.** Archive
+  and delete went through Tauri while the protocol served the same threads, and
+  the list did too — `window.deepcode.sessions.list()` had preferred the
+  protocol since #231, but `Sidebar.tsx` bypassed the shim and called
+  `listSessions()` directly. All three now go through the owner, and deleting a
+  thread removes both its protocol snapshot and its canonical session
+  projection: `list` reads both, so removing one left the row reappearing on the
+  next refresh as an empty session that could not be opened.
+- `deleteSession` refuses a session id that is not a single path segment, before
+  removing anything. It ends in a recursive delete of `<root>/<id>`, and `..` —
+  the id that resolves to the directory _above_ the sessions root — is spelled
+  entirely in characters an id may legitimately contain, so the character-class
+  check both it and the thread store relied on admitted it. Every in-tree caller
+  validates first; a delete this destructive should not depend on that.
 - **`Grep` over a single file no longer prefixes every line with a colon.**
   ripgrep omits the filename when the search path is one _file_ — there is
   nothing to disambiguate — so its `--null` output carries no NUL, and rejoining
diff --git a/apps/desktop/src/components/Sidebar.tsx b/apps/desktop/src/components/Sidebar.tsx
index 0955756..744ffcc 100644
--- a/apps/desktop/src/components/Sidebar.tsx
+++ b/apps/desktop/src/components/Sidebar.tsx
@@ -6,13 +6,7 @@
 
 import { useCallback, useEffect, useState, type JSX } from 'react';
 import { projectName } from '../lib/project.js';
-import {
-  listSessions,
-  sessionArchive,
-  sessionDelete,
-  sessionSetTitle,
-  type SessionMeta,
-} from '../lib/tauri-api.js';
+import { sessionSetTitle } from '../lib/tauri-api.js';
 import { BrandMark } from './BrandMark.js';
 
 interface SidebarProps {
@@ -28,6 +22,20 @@ interface SidebarProps {
   onSessionRemoved?: (id: string) => void;
 }
 
+/**
+ * One row, as the app-server describes it.
+ *
+ * The sidebar used to read the session directory through Tauri while
+ * `window.deepcode.sessions.list()` read the same directory through the
+ * protocol — two readers of one directory, each with its own row shape and its
+ * own sort. This is the one the owner of that storage returns.
+ */
+interface SessionRow {
+  id: string;
+  title?: string;
+  updatedAtSecs: number;
+}
+
 type Bucket = 'Today' | 'Yesterday' | 'Earlier';
 
 function bucketFor(updatedAtSecs: number, nowSecs: number): Bucket {
@@ -53,7 +61,7 @@ export function Sidebar({
   onSwitchProject,
   onSessionRemoved,
 }: SidebarProps): JSX.Element {
-  const [sessions, setSessions] = useState<SessionMeta[]>([]);
+  const [sessions, setSessions] = useState<SessionRow[]>([]);
   const [now, setNow] = useState<number>(Math.floor(Date.now() / 1000));
   // Inline rename: which session is being edited + its draft title.
   const [editingId, setEditingId] = useState<string | null>(null);
@@ -61,8 +69,17 @@ export function Sidebar({
   const [query, setQuery] = useState('');
 
   const reload = useCallback(() => {
-    void listSessions()
-      .then(setSessions)
+    void window.deepcode.sessions
+      .list()
+      .then((rows) =>
+        setSessions(
+          rows.map((row) => ({
+            id: row.id,
+            title: row.title,
+            updatedAtSecs: Math.floor(new Date(row.updatedAt).getTime() / 1000),
+          })),
+        ),
+      )
       .catch(() => setSessions([]));
   }, []);
 
@@ -92,7 +109,7 @@ export function Sidebar({
 
   async function handleArchive(id: string): Promise<void> {
     try {
-      await sessionArchive(id);
+      await window.deepcode.sessions.archive({ id });
       if (id === activeSessionId) onSessionRemoved?.(id);
       reload();
     } catch {
@@ -105,7 +122,7 @@ export function Sidebar({
       return;
     }
     try {
-      await sessionDelete(id);
+      await window.deepcode.sessions.delete({ id });
       if (id === activeSessionId) onSessionRemoved?.(id);
       reload();
     } catch {
@@ -119,13 +136,13 @@ export function Sidebar({
         (s) => (s.title || '').toLowerCase().includes(q) || s.id.toLowerCase().includes(q),
       )
     : sessions;
-  const grouped: Record<Bucket, SessionMeta[]> = {
+  const grouped: Record<Bucket, SessionRow[]> = {
     Today: [],
     Yesterday: [],
     Earlier: [],
   };
   for (const s of visible) {
-    grouped[bucketFor(s.updated_at_secs, now)].push(s);
+    grouped[bucketFor(s.updatedAtSecs, now)].push(s);
   }
 
   return (
@@ -227,7 +244,7 @@ export function Sidebar({
                 ) : (
                   <span className="label">{s.title?.trim() ? s.title : shortTitle(s.id)}</span>
                 )}
-                <span className="meta">{relTime(s.updated_at_secs, now)}</span>
+                <span className="meta">{relTime(s.updatedAtSecs, now)}</span>
                 {editingId !== s.id && (
                   <span className="row-actions">
                     <button
diff --git a/apps/desktop/src/lib/protocol-agent.test.ts b/apps/desktop/src/lib/protocol-agent.test.ts
index 805a9d4..2e0c8d4 100644
--- a/apps/desktop/src/lib/protocol-agent.test.ts
+++ b/apps/desktop/src/lib/protocol-agent.test.ts
@@ -318,3 +318,41 @@ describe('DesktopProtocolAgent', () => {
     });
   });
 });
+
+// The sidebar removed threads through Tauri while the protocol served
+// `thread/archive` — a second writer against storage the app-server owns.
+describe('thread removal', () => {
+  it('archives through the protocol', async () => {
+    const transport = new FakeTransport();
+    const agent = new DesktopProtocolAgent(transport, () => undefined);
+    expect(await agent.archiveThread('thread-1')).toBe(true);
+    expect(transport.requests).toContainEqual({
+      method: 'thread/archive',
+      params: { threadId: 'thread-1' },
+    });
+  });
+
+  it('deletes through the protocol', async () => {
+    const transport = new FakeTransport();
+    const agent = new DesktopProtocolAgent(transport, () => undefined);
+    expect(await agent.deleteThread('thread-1')).toBe(true);
+    expect(transport.requests).toContainEqual({
+      method: 'thread/delete',
+      params: { threadId: 'thread-1' },
+    });
+  });
+
+  it('reports false — not an exception — when the server cannot manage threads', async () => {
+    // The caller falls back to the local writer on false. Throwing would make a
+    // sidecar that predates the method look like a delete that failed.
+    const transport = new FakeTransport();
+    const original = transport.connect.bind(transport);
+    transport.connect = async () => {
+      const init = await original();
+      return { ...init, capabilities: { ...init.capabilities, threadManagement: false } };
+    };
+    const agent = new DesktopProtocolAgent(transport, () => undefined);
+    expect(await agent.deleteThread('thread-1')).toBe(false);
+    expect(transport.requests).toHaveLength(0);
+  });
+});
diff --git a/apps/desktop/src/lib/protocol-agent.ts b/apps/desktop/src/lib/protocol-agent.ts
index 1020015..c39dfbc 100644
--- a/apps/desktop/src/lib/protocol-agent.ts
+++ b/apps/desktop/src/lib/protocol-agent.ts
@@ -92,6 +92,13 @@ export class DesktopProtocolAgent {
     return true;
   }
 
+  async deleteThread(threadId: string): Promise<boolean> {
+    const initialized = await this.transport.connect();
+    if (!initialized.capabilities.threadManagement) return false;
+    await this.transport.request('thread/delete', { threadId });
+    return true;
+  }
+
   async resume(threadId: string): Promise<ThreadSnapshot> {
     await this.transport.connect();
     if (this.threadId && this.threadId !== threadId) {
@@ -387,6 +394,10 @@ export function archiveProtocolThread(threadId: string) {
   return defaultAgent.archiveThread(threadId);
 }
 
+export function deleteProtocolThread(threadId: string) {
+  return defaultAgent.deleteThread(threadId);
+}
+
 export function resumeProtocolThread(threadId: string) {
   return defaultAgent.resume(threadId);
 }
diff --git a/apps/desktop/src/lib/window-shim.ts b/apps/desktop/src/lib/window-shim.ts
index 23c0c35..92d41b8 100644
--- a/apps/desktop/src/lib/window-shim.ts
+++ b/apps/desktop/src/lib/window-shim.ts
@@ -8,6 +8,8 @@ import {
   abortProtocolTurn,
   answerProtocolRequest,
   approveProtocolRequest,
+  archiveProtocolThread,
+  deleteProtocolThread,
   getConfigDiagnostics,
   installProtocolAgentEmitter,
   listProtocolThreads,
@@ -23,6 +25,8 @@ import {
   loadSettingsFile,
   openUrl,
   saveCredentials,
+  sessionArchive,
+  sessionDelete,
   sessionRead,
 } from './tauri-api.js';
 
@@ -91,6 +95,27 @@ export function installTauriShim(): void {
           updatedAt: new Date(r.updated_at_secs * 1000).toISOString(),
         }));
       },
+      // Archive and delete follow list: the app-server owns thread storage and
+      // is its single writer, so a renderer removing files through Tauri is
+      // reaching around the owner — and for delete that can pull the ground out
+      // from under an open writer. The Tauri command stays as the fallback for a
+      // sidecar too old to serve the method, same as list.
+      async archive({ id }) {
+        try {
+          if (await archiveProtocolThread(id)) return;
+        } catch {
+          /* fall through to the local writer */
+        }
+        await sessionArchive(id);
+      },
+      async delete({ id }) {
+        try {
+          if (await deleteProtocolThread(id)) return;
+        } catch {
+          /* fall through to the local writer */
+        }
+        await sessionDelete(id);
+      },
       async resume({ id }) {
         // The snapshot carries every completed item — approvals, ask-user
         // exchanges, errors, review findings. The session projection keeps only
diff --git a/apps/desktop/src/preview-app.tsx b/apps/desktop/src/preview-app.tsx
index 46744b7..7cab05c 100644
--- a/apps/desktop/src/preview-app.tsx
+++ b/apps/desktop/src/preview-app.tsx
@@ -297,6 +297,13 @@ async function handleProtocolRequest(request: ProtocolRequest): Promise<void> {
       archivedThreads.add(String(request.params.threadId));
       await respond({ archived: true });
       break;
+    case 'thread/delete':
+      // The fixture cannot distinguish the two on its own storage, but the
+      // journey only needs the row to leave the list — what it is asserting is
+      // that the button reached the protocol at all.
+      archivedThreads.add(String(request.params.threadId));
+      await respond({ deleted: true });
+      break;
     case 'workspace/diff':
       await respond({
         repository: true,
diff --git a/apps/desktop/src/types/global.d.ts b/apps/desktop/src/types/global.d.ts
index 1a908da..5a69b54 100644
--- a/apps/desktop/src/types/global.d.ts
+++ b/apps/desktop/src/types/global.d.ts
@@ -58,6 +58,10 @@ export interface DeepCodeAPI {
     resume: (args: {
       id: string;
     }) => Promise<{ history: unknown[]; sessionId: string; thread?: unknown }>;
+    /** Move a thread out of the listing. Reversible on disk. */
+    archive: (args: { id: string }) => Promise<void>;
+    /** Irreversibly drop a thread and everything it owns. */
+    delete: (args: { id: string }) => Promise<void>;
   };
   plugins: {
     list: () => Promise<PluginRow[]>;
diff --git a/apps/server/src/server.ts b/apps/server/src/server.ts
index 3223fe9..3caa34f 100644
--- a/apps/server/src/server.ts
+++ b/apps/server/src/server.ts
@@ -239,6 +239,8 @@ export class AppServer {
         return this.lifecycle.forkThread(requiredId(request.params, 'threadId'), traceId);
       case 'thread/archive':
         return this.lifecycle.archiveThread(requiredId(request.params, 'threadId'));
+      case 'thread/delete':
+        return this.lifecycle.deleteThread(requiredId(request.params, 'threadId'));
       case 'turn/start':
         return this.startTurn(request.params, traceId);
       case 'turn/interrupt':
diff --git a/apps/server/src/store.test.ts b/apps/server/src/store.test.ts
index b608806..c24fe91 100644
--- a/apps/server/src/store.test.ts
+++ b/apps/server/src/store.test.ts
@@ -122,3 +122,57 @@ describe('CanonicalThreadStore', () => {
     await expect(store.load(meta.id)).resolves.toEqual(imported);
   });
 });
+
+describe('CanonicalThreadStore.delete', () => {
+  const thread = (id: string): ThreadSnapshot => ({
+    id,
+    cwd: '/workspace',
+    createdAt: '2026-08-01T00:00:00.000Z',
+    updatedAt: '2026-08-01T00:00:02.000Z',
+    turns: [
+      {
+        id: `${id}-turn-1`,
+        threadId: id,
+        status: 'completed',
+        startedAt: '2026-08-01T00:00:01.000Z',
+        completedAt: '2026-08-01T00:00:02.000Z',
+        items: [
+          {
+            id: `${id}-item-1`,
+            type: 'user_message',
+            payload: { text: 'hello', model: 'deepseek-chat' },
+            completedAt: '2026-08-01T00:00:01.000Z',
+          },
+        ],
+      },
+    ],
+  });
+
+  it('removes both representations, so the thread cannot come back', async () => {
+    // The snapshot and the canonical session projection share an id and are two
+    // views of one thing. `list` reads both, so removing one and leaving the
+    // other means the row reappears on the next refresh — as an empty session
+    // that cannot be opened.
+    const { store, sessions } = await fixture();
+    await store.save(thread('thread-del'));
+
+    expect(await store.load('thread-del')).not.toBeNull();
+    expect(await sessions.list()).toHaveLength(1);
+
+    await store.delete('thread-del');
+
+    expect(await store.load('thread-del')).toBeNull();
+    expect(await sessions.list()).toHaveLength(0);
+    expect(await store.list()).toHaveLength(0);
+  });
+
+  it('leaves other threads alone', async () => {
+    const { store } = await fixture();
+    await store.save(thread('thread-keep'));
+    await store.save(thread('thread-drop'));
+
+    await store.delete('thread-drop');
+
+    expect((await store.list()).map((t) => t.id)).toEqual(['thread-keep']);
+  });
+});
diff --git a/apps/server/src/store.ts b/apps/server/src/store.ts
index 6c509f7..32b47b6 100644
--- a/apps/server/src/store.ts
+++ b/apps/server/src/store.ts
@@ -1,4 +1,4 @@
-import { mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import process from 'node:process';
 
@@ -9,6 +9,11 @@ import type { ThreadSnapshot, ThreadStore } from '@deepcode/protocol';
 import { historyFromThread } from './runtime-executor.js';
 
 function validThreadId(threadId: string): boolean {
+  // `.` and `..` are spelled entirely in characters an id may legitimately
+  // contain, so the class alone admits them. Harmless while every path built
+  // from an id had a suffix appended; not harmless now that `delete` reaches a
+  // recursive removal of `<root>/<id>`.
+  if (threadId === '.' || threadId === '..') return false;
   return /^[a-zA-Z0-9._-]+$/.test(threadId);
 }
 
@@ -64,6 +69,13 @@ export class FileThreadStore implements ThreadStore {
     await rename(path, join(target, `${threadId}.json`));
   }
 
+  async delete(threadId: string): Promise<void> {
+    // `force` so deleting an already-archived thread is not an error: the
+    // runtime has already established the thread exists, and failing here would
+    // leave the caller unable to finish a delete it can see the reason for.
+    await rm(this.pathFor(threadId), { force: true });
+  }
+
   private pathFor(threadId: string): string {
     if (!validThreadId(threadId)) throw new Error(`Invalid thread id: ${threadId}`);
     return join(this.directory, `${threadId}.json`);
@@ -124,6 +136,18 @@ export class CanonicalThreadStore implements ThreadStore {
   async archive(threadId: string): Promise<void> {
     await this.snapshots.archive(threadId);
   }
+
+  /**
+   * Drop both representations of a thread.
+   *
+   * The snapshot and the canonical session projection share an id and are two
+   * views of one thing, so removing one and leaving the other is how a deleted
+   * thread comes back in the next listing — the composite `list` reads both.
+   */
+  async delete(threadId: string): Promise<void> {
+    await this.snapshots.delete(threadId);
+    await this.sessions.delete(threadId);
+  }
 }
 
 function metaFromThread(thread: ThreadSnapshot): SessionMeta {
diff --git a/docs/THREE_WAY_REVIEW.md b/docs/THREE_WAY_REVIEW.md
index b908f25..985033c 100644
--- a/docs/THREE_WAY_REVIEW.md
+++ b/docs/THREE_WAY_REVIEW.md
@@ -287,8 +287,12 @@ AskUserQuestion、模式/模型/effort 下拉、Inspector、FilePanel（Source/D
 
 ### 仍未做
 
-- 桌面侧栏的 archive / delete 仍走 Tauri。`thread/archive` 已经服务，但按钮还没改用它——
-  这是"消除第二个读取者"的后半截。
+- ~~桌面侧栏的 archive / delete 仍走 Tauri。`thread/archive` 已经服务，但按钮还没改用它——
+  这是"消除第二个读取者"的后半截。~~
+  已做。顺带发现侧栏连**列表**都还在直连 Tauri：`window.deepcode.sessions.list()` 早就优先走
+  协议了，但 `Sidebar.tsx` 绕过 shim 直接 `listSessions()`——所以"第二个读取者"其实一直是三处
+  而不是两处。delete 协议侧原本没有方法，新增 `thread/delete`：app-server 是 thread 存储的
+  单一 owner，renderer 越过它删文件可能把正在写的 writer 的地板抽掉。
 - **Linux (bwrap) 侧只共享了 sandbox 模式解析，没有在 Linux 主机上做过 #226 那样的实测。**
 - 图片输入仍是空壳（有意保留：DeepSeek 无 vision 模型）。
 
diff --git a/packages/core/src/sessions/manager.ts b/packages/core/src/sessions/manager.ts
index 2ed5e05..9040666 100644
--- a/packages/core/src/sessions/manager.ts
+++ b/packages/core/src/sessions/manager.ts
@@ -5,6 +5,7 @@ import type { StoredMessage } from '../types.js';
 import {
   appendMessage,
   defaultSessionsDir,
+  deleteSession,
   listSessions as listSessionsLow,
   newSessionId,
   readMessages,
@@ -64,6 +65,10 @@ export class SessionManager {
     return listSessionsLow(this.root);
   }
 
+  async delete(sessionId: string): Promise<void> {
+    await deleteSession(this.root, sessionId);
+  }
+
   async snapshot(args: {
     sessionId: string;
     cwd: string;
diff --git a/packages/core/src/sessions/storage.test.ts b/packages/core/src/sessions/storage.test.ts
index 8580365..38d2d4a 100644
--- a/packages/core/src/sessions/storage.test.ts
+++ b/packages/core/src/sessions/storage.test.ts
@@ -1,9 +1,10 @@
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import {
   appendMessage,
+  deleteSession,
   listSessions,
   newSessionId,
   readMessages,
@@ -259,3 +260,56 @@ describe('session storage', () => {
     await expect(readFile(files.jsonlPath, 'utf8')).rejects.toThrow();
   });
 });
+
+// `deleteSession` ends in a recursive `rm` of `<root>/<id>`, so the id is a path
+// segment resolved from a string the caller received. AGENTS.md asks for
+// adversarial tests where a mistake destroys user work; this is that place.
+describe('deleteSession', () => {
+  let root: string;
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'deepcode-delete-'));
+  });
+  afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+  });
+
+  it('removes every file the session owns', async () => {
+    const id = newSessionId();
+    await writeMeta(root, { id, cwd: '/w', createdAt: 'x', updatedAt: 'x' });
+    await appendMessage(root, id, { role: 'user', content: [{ type: 'text', text: 'hi' }] });
+    const files = sessionFiles(root, id);
+
+    await deleteSession(root, id);
+
+    await expect(readFile(files.metaPath, 'utf8')).rejects.toThrow();
+    await expect(readFile(files.jsonlPath, 'utf8')).rejects.toThrow();
+    expect(await listSessions(root)).toHaveLength(0);
+  });
+
+  it('is not an error when the files are already gone', async () => {
+    await expect(deleteSession(root, newSessionId())).resolves.toBeUndefined();
+  });
+
+  it.each(['..', '.', '', '../..', 'a/b', '../escape'])(
+    'refuses the id %j instead of resolving it into a path',
+    async (id) => {
+      // `..` is the one that matters: it is spelled entirely in characters an
+      // id may legitimately contain, so a character-class check alone admits
+      // it — and `join(sessionsRoot, '..')` is the directory above it.
+      //
+      // The sessions root is nested deep enough that every id here still
+      // resolves inside `root`. Without that, a run with the guard removed
+      // walks `rm -rf` up out of the fixture and into the system temp
+      // directory — which is how this was confirmed, and not something a test
+      // should be able to do by accident.
+      const sessionsRoot = join(root, 'deep', 'deeper', 'sessions');
+      await mkdir(sessionsRoot, { recursive: true });
+      const guarded = join(root, 'keep-me.txt');
+      await writeFile(guarded, 'not mine to delete', 'utf8');
+
+      await expect(deleteSession(sessionsRoot, id)).rejects.toThrow(/invalid id/);
+
+      expect(await readFile(guarded, 'utf8')).toBe('not mine to delete');
+    },
+  );
+});
diff --git a/packages/core/src/sessions/storage.ts b/packages/core/src/sessions/storage.ts
index 5774739..830a6b2 100644
--- a/packages/core/src/sessions/storage.ts
+++ b/packages/core/src/sessions/storage.ts
@@ -68,6 +68,58 @@ export interface SessionFiles {
   snapshotsDir: string;
 }
 
+/**
+ * A session id that is safe to interpolate into a path.
+ *
+ * `deleteSession` removes a whole directory recursively, so the id has to be a
+ * single path segment and cannot be a traversal. `..` is the one that matters:
+ * it is composed entirely of characters an id may legitimately contain, so a
+ * character-class check alone lets it through — and `join(root, '..')` is the
+ * parent of the sessions root.
+ */
+function validSessionId(sessionId: string): boolean {
+  return (
+    sessionId !== '' &&
+    sessionId !== '.' &&
+    sessionId !== '..' &&
+    /^[a-zA-Z0-9._-]+$/.test(sessionId)
+  );
+}
+
+/**
+ * Irreversibly remove every file belonging to one session.
+ *
+ * Both stream formats, the metadata sidecar, the writer lock and the snapshot
+ * directory. Leaving any of them behind is not a tidy half-delete: the listing
+ * reads the meta sidecar, so a session whose stream is gone but whose sidecar
+ * remains comes back as an empty row that cannot be opened.
+ *
+ * Missing files are not an error. The caller has already established that the
+ * session exists, and a delete that fails partway through because one of five
+ * paths was already gone leaves the user unable to finish it.
+ *
+ * A malformed id *is* an error, and is refused before anything is removed. The
+ * callers in-tree all validate first, so this can only fire on a programming
+ * mistake — which is exactly when a recursive delete resolved from an untrusted
+ * string must not proceed on the strength of somebody else having checked.
+ */
+export async function deleteSession(root: string, sessionId: string): Promise<void> {
+  if (!validSessionId(sessionId)) {
+    throw new Error(`Refusing to delete session with invalid id: ${JSON.stringify(sessionId)}`);
+  }
+  const files = sessionFiles(root, sessionId);
+  for (const path of [
+    files.jsonlPath,
+    files.legacyJsonlPath,
+    files.metaPath,
+    files.writerLockPath,
+  ]) {
+    await fs.rm(path, { force: true });
+  }
+  // The per-session directory holds snapshots, background-task logs and todos.
+  await fs.rm(join(root, sessionId), { recursive: true, force: true });
+}
+
 export function sessionFiles(root: string, sessionId: string): SessionFiles {
   return {
     metaPath: join(root, `${sessionId}.meta.json`),
diff --git a/packages/protocol/src/runtime.test.ts b/packages/protocol/src/runtime.test.ts
index e8efcbb..41d05a3 100644
--- a/packages/protocol/src/runtime.test.ts
+++ b/packages/protocol/src/runtime.test.ts
@@ -208,6 +208,29 @@ describe('thread management', () => {
     await expect(runtime.archiveThread('nope')).rejects.toThrow(/nope/);
   });
 
+  it('deletes a thread outright', async () => {
+    const runtime = deterministicRuntime(new MemoryThreadStore());
+    const thread = await runtime.startThread('/a');
+    expect(await runtime.deleteThread(thread.id)).toEqual({ deleted: true });
+    expect((await runtime.listThreads()).threads).toHaveLength(0);
+    // Archive hides, delete removes. Both drop out of the listing, so the
+    // listing alone cannot tell them apart — reading can.
+    expect(await runtime.readThread(thread.id)).toBeNull();
+    await expect(runtime.deleteThread(thread.id)).rejects.toThrow(/thread-/);
+  });
+
+  it('archive keeps the thread readable, delete does not', async () => {
+    const runtime = deterministicRuntime(new MemoryThreadStore());
+    const archived = await runtime.startThread('/a');
+    await runtime.archiveThread(archived.id);
+    expect(await runtime.readThread(archived.id)).not.toBeNull();
+  });
+
+  it('refuses to delete a thread that does not exist', async () => {
+    const runtime = deterministicRuntime(new MemoryThreadStore());
+    await expect(runtime.deleteThread('nope')).rejects.toThrow(/nope/);
+  });
+
   it('forks into a new thread and leaves the original alone', async () => {
     const runtime = deterministicRuntime(new MemoryThreadStore());
     const source = await runtime.startThread('/a');
@@ -241,5 +264,7 @@ describe('thread management', () => {
     expect(runtime.initialize().capabilities.threadManagement).toBe(false);
     await expect(runtime.listThreads()).rejects.toThrow(/cannot list/);
     await expect(runtime.archiveThread('x')).rejects.toThrow(/cannot archive/);
+    // A store that cannot delete says so rather than quietly archiving instead.
+    await expect(runtime.deleteThread('x')).rejects.toThrow(/cannot delete/);
   });
 });
diff --git a/packages/protocol/src/runtime.ts b/packages/protocol/src/runtime.ts
index df52081..d94c277 100644
--- a/packages/protocol/src/runtime.ts
+++ b/packages/protocol/src/runtime.ts
@@ -27,6 +27,16 @@ export interface ThreadStore {
    */
   list?(): Promise<ThreadSnapshot[]>;
   archive?(threadId: string): Promise<void>;
+  /**
+   * Optional: irreversibly drop a thread.
+   *
+   * Separate from `archive` because the two are different promises, and a store
+   * that can move a file is not necessarily one that should be asked to destroy
+   * it. A store without this leaves the call rejected rather than silently
+   * archiving instead — quietly downgrading a delete would be the worst way to
+   * be helpful about it.
+   */
+  delete?(threadId: string): Promise<void>;
 }
 
 export class MemoryThreadStore implements ThreadStore {
@@ -51,6 +61,11 @@ export class MemoryThreadStore implements ThreadStore {
   async archive(threadId: string): Promise<void> {
     this.archived.add(threadId);
   }
+
+  async delete(threadId: string): Promise<void> {
+    this.threads.delete(threadId);
+    this.archived.delete(threadId);
+  }
 }
 
 export interface ProtocolRuntimeOptions {
@@ -179,6 +194,22 @@ export class ProtocolRuntime {
     return { archived: true };
   }
 
+  /**
+   * Irreversibly drop a thread.
+   *
+   * Routed through the runtime rather than left to whoever holds a file handle:
+   * the app-server is the single owner of thread storage, and a client deleting
+   * files behind it can pull the ground out from under an open writer or leave
+   * the index pointing at something that is gone.
+   */
+  async deleteThread(threadId: string): Promise<{ deleted: boolean }> {
+    const remove = this.options.store.delete;
+    if (!remove) throw new ProtocolInvariantError('This store cannot delete threads');
+    await this.requireThread(threadId); // 404 rather than silently succeeding
+    await remove.call(this.options.store, threadId);
+    return { deleted: true };
+  }
+
   /**
    * Copy a thread into a new one, leaving the original untouched.
    *
diff --git a/packages/protocol/src/types.ts b/packages/protocol/src/types.ts
index 9a6922d..e0a5be7 100644
--- a/packages/protocol/src/types.ts
+++ b/packages/protocol/src/types.ts
@@ -158,9 +158,10 @@ export interface InitializeResult {
     /** Server streams `reasoning.delta` for models that emit reasoning. */
     reasoningDeltas: boolean;
     /**
-     * `thread/list`, `thread/fork` and `thread/archive` are served. Without
-     * these a client has to read the session directory itself, which is how the
-     * desktop ended up with two ways to see the same threads.
+     * `thread/list`, `thread/fork`, `thread/archive` and `thread/delete` are
+     * served. Without these a client has to read the session directory itself,
+     * which is how the desktop ended up with two ways to see the same threads —
+     * and, for delete, two ways to remove a file the app-server owns.
      */
     threadManagement: boolean;
     /**
@@ -304,6 +305,7 @@ export type ProtocolMethod =
   | 'thread/list'
   | 'thread/fork'
   | 'thread/archive'
+  | 'thread/delete'
   | 'turn/start'
   | 'turn/interrupt'
   | 'approval/respond'