Merge remote-tracking branch 'origin/master' into worktree/preset-plane-fallout-p1

Only `docs/module-graph.*` conflicted; generated, so taken from master and
regenerated. `api-proxy.ts` auto-merged — this branch's history read
(`historySourceFor` / `presenterScopeFor` / `historyCutOf`, in that order)
is intact.

Hook bypassed as before: the staged-pairing check hands an archived note path
to `verify-translation-pairing`. The full-corpus gate passes.

packages/host/apiproxy/src/api-proxy.ts

@@ -42,6 +42,13 @@ import type {
   QueuedInboxItem, SessionSummary, SettingsNamespaceView, SubagentAddress, TaskView, ToolEventView,
   WorkspaceId, WorkspaceView,
 } from './api/index.ts'
+import {
+  sessionLogExportDeps,
+  sessionLogZipFilename,
+  streamSessionLogZip,
+  type SessionLogExportReady,
+} from './session-export.ts'
+import type { SessionRawArtifact } from '@deepseek-ai/dsh-session-persistence'
 import {
   SESSION_SEARCH_RESULT_LIMIT,
   SESSION_SEARCH_SNIPPET_MAX_CODE_POINTS,
@@ -3470,6 +3477,46 @@ export function createApiProxy(ctx: Context, defaults: ApiProxyDefaults): ApiPro
       },
     },
 
+    downloads: {
+      async sessionLog(request, signal) {
+        // Clean error path first: missing services answer 500 and a missing
+        // root artifact 404 before any zip byte is produced. The root content
+        // read here is reused as the first zip entry, so nothing is read twice.
+        const deps = sessionLogExportDeps(ctx)
+        if (deps.sessionQuery === undefined || deps.sessionPersistence === undefined || deps.attachments === undefined) {
+          return new Response(
+            'session log export is unavailable: missing session-query, session-persistence, or attachments service',
+            { status: 500 },
+          )
+        }
+        const ready: SessionLogExportReady = {
+          sessionQuery: deps.sessionQuery,
+          sessionPersistence: deps.sessionPersistence,
+          attachments: deps.attachments,
+        }
+        let root: SessionRawArtifact | undefined
+        try {
+          root = await deps.sessionPersistence.readRaw(request.sessionId, signal)
+        } catch {
+          // Backend read failure: answer 500 without echoing the error, which
+          // may carry absolute host paths into the browser error bar.
+          return new Response('session log export failed to read the stored artifact', { status: 500 })
+        }
+        if (root === undefined) {
+          return new Response('session not found', { status: 404 })
+        }
+        return new Response(
+          streamSessionLogZip(ready, root, request.sessionId, request.includeDescendants === true, signal),
+          {
+            headers: {
+              'content-type': 'application/zip',
+              'content-disposition': `attachment; filename="${sessionLogZipFilename(request.sessionId)}"`,
+            },
+          },
+        )
+      },
+    },
+
     respond(message: ClientResponse): Promise<RpcReceipt> {
       // Route by the echoed rpcId (the wire correlation): approvals first,
       // then questions — the two registries share one id space of UUIDs.