[BUG] Desktop GUI session delete removes only the registry entry — plaintext transcript remains on disk (indefinitely if `cleanupPeriodDays` is raised)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Deleting a session in the Desktop app removes only the app's registry entry (%APPDATA%\Claude\claude-code-sessions\...\local_*.json).

The session's full plaintext transcript at %USERPROFILE%\.claude\projects\<project-slug>\<session-id>.jsonl stays on disk, together with its companion folders (subagents/, tool-results/).
Nothing in the UI indicates the delete is pointer-only.

The transcript contains the entire conversation: every message, tool call, and tool result, including file contents and command output that passed through tools.
A session the user believes deleted is therefore still fully readable on disk.

Interaction with retention: with the default cleanupPeriodDays: 30 the leftover transcript survives up to a month.
Users who raise that setting to keep long-lived sessions (the docs suggest 3650 for long retention) keep their "deleted" sessions indefinitely - that means long retention and true deletion are currently mutually exclusive.

Scale on my machine: 79 of 96 transcripts (357 MB out of 502 MB under ~/.claude/projects/) belonged to sessions that no longer exist in the app — invisible and unmanageable from Claude Code.

What Should Happen?

Deleting a session should delete its data, or say clearly that it doesn't.

Any of the following would be correct behavior:

• GUI delete also removes the transcript and companion folders (directly, or via a checkbox in the confirm dialog).
• The delete confirmation states that conversation data stays on disk until the retention sweep, and exactly where (and again, better UX should also suggest cleanup at the same time).
• The app surfaces transcripts that have no registry entry, so they can be reviewed and removed from the the app UI.

Error Messages/Logs

Steps to Reproduce

1. In the Desktop app (Code tab), start a session in any project and send a message.
2. Find its transcript: %USERPROFILE%\.claude\projects\<project-slug>\<session-id>.jsonl
3. Delete the session from the GUI (session menu → Delete).
4. Check %APPDATA%\Claude\claude-code-sessions\: the session's local_*.json is gone and the session no longer appears in the app.
5. Check the path from step 2, the .jsonl transcript is still there, fully readable.

Verified today with a ~2 MB session: registry entry removed instantly, transcript untouched.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.237 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

Related open issues

These cover the same registry/transcript mismatch from other directions, so they are context, not duplicates:

• #59736, #81907: registry entries lost while transcripts remain on disk
• #62959, #59248, #46621: the retention sweep deletes transcripts that the sidebar still lists
• #67201: the server-side copy is not removed on local delete

This report is specifically about the GUI Delete action being pointer-only.

Related observation

While auditing, I found one un-archived session whose registry entry has "cliSessionId": null, even though the app still displays the session.
Its transcript matches the uuid inside the entry's sessionId field instead.
Any tooling that maps sessions to transcripts via cliSessionId will misclassify that transcript as orphaned.
Can file this separately if useful.