@@ -2,7 +2,7 @@
 
 ## 0.20.0 — native development (unreleased)
 
-- Native development: reviewed CLI rescue for missing worktrees restores retained
+- Native development: reviewed CLI and desktop rescue for missing worktrees restores retained
   commits into a new checkout while preserving the original branch, index and
   registration; missing uncommitted files are not reconstructed.
 
 
@@ -57,9 +57,9 @@ the existing React visual design. This document tracks engineering acceptance;
   separate managed branch, preserved source edits, private recovery records and
   CLI inventory, desktop Settings controls and reviewed clean removal that retains
   branches and commits.
-  CLI rescue restores a missing checkout’s retained commit into a separate
-  checkout while preserving original recovery metadata. Dirty-state transfer,
-  desktop recovery, damaged-path repair and reviewed return of changes remain open.
+  CLI and desktop rescue restore a missing checkout’s retained commit into a
+  separate checkout while preserving original recovery metadata. Dirty-state
+  transfer, damaged-path repair and reviewed return of changes remain open.
 
 The Rust workspace is being introduced alongside the Python release. Existing
 features remain acceptance requirements; an unimplemented native feature must
 
@@ -288,8 +288,21 @@ are byte-for-byte unchanged, and the original branch, registration and moved
 files remain. The native executable passes 18 CLI scenario groups / 32 scripted
 model requests, including recovery preview, stale-hash rejection and restoration.
 Clippy and the native build pass. This restores committed work only; automatic
-reconstruction of missing uncommitted files is not claimed. Desktop rescue and
-damaged-path repair remain open.
+reconstruction of missing uncommitted files is not claimed. Damaged-path repair
+remains open; desktop rescue is verified separately below.
+
+## Desktop recovery review
+
+Settings exposes the missing-checkout recovery review and an explicit restore
+button. The UI regression verifies displayed-source binding, focused review,
+visible uncommitted-file limitations, exact hash submission and review clearing
+after stale-state rejection. All 24 UI tests and seven browser scenarios pass.
+The real native-window probe moves a disposable checkout away, reviews recovery,
+restores into a new checkout, verifies committed file contents and checks the
+original record and branch remain intact. Light, dark and compact accessibility
+reports have zero violations, and the captured recovery screen is inspected.
+The test waits for the persisted `ready` state before inspecting checkout files;
+a `creating` recovery record intentionally precedes Git's filesystem writes.
 
 ## Desktop worktree controls
 
 
@@ -91,5 +91,11 @@ missing commit, unavailable registration or stale review blocks rescue. A locked
 worktree may be on an unavailable device; inspect its location before unlocking.
 Trust and writable/idle source requirements also apply. Open and trust the new
 checkout explicitly. The original record remains in the active inventory until
-its underlying checkout is repaired and reviewed for removal. Dedicated desktop
-rescue controls and automatic repair of damaged paths remain open.
+its underlying checkout is repaired and reviewed for removal. Automatic repair of damaged paths remains open.
+
+In **Settings → Worktrees**, choose **Review missing checkout** for the affected
+record. The focused review shows its missing path, retained branch and exact
+commit, together with the uncommitted-file limitation. **Restore in new worktree**
+creates the separate checkout; **Cancel recovery** closes the review without
+changes. Errors clear stale reviews. Use **Open worktree** on the newly listed
+checkout to enter the usual project trust flow.
@@ -5,7 +5,7 @@ import { createServer } from "node:http";
 import { spawn, execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { createWriteStream } from "node:fs";
-import { mkdtemp, mkdir, readFile, writeFile, readlink, readdir, rm } from "node:fs/promises";
+import { mkdtemp, mkdir, readFile, writeFile, readlink, readdir, rm, rename } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
@@ -29,6 +29,7 @@ const profile = path.join(scratch, "profile");
 const defaultProfile = process.env.SHADOW_NATIVE_DEFAULT_PROFILE === "1";
 const profileArgs = defaultProfile ? [] : ["--profile",profile];
 const configDirectory = path.join(profile,defaultProfile ? "config/shadow-agent" : "config");
+const dataDirectory = path.join(profile,defaultProfile ? "data/shadow-agent" : "data");
 const stateDirectory = path.join(profile,defaultProfile ? "state/shadow-agent" : "state");
 const nativeEnv = {...process.env, TMPDIR: path.join(scratch,"images"), ...(defaultProfile ? {
   XDG_CONFIG_HOME: path.join(profile,"config"), XDG_DATA_HOME: path.join(profile,"data"), XDG_STATE_HOME: path.join(profile,"state"),
@@ -332,7 +333,7 @@ try {
   await clickButton("Worktrees");
   await until("Worktree creation ready",()=>execute("return [...document.querySelectorAll('button')].some(b=>b.textContent==='Create worktree' && !b.disabled)"));
   await clickButton("Create worktree");
-  const worktree=await until("Managed worktree created",async()=>(await api("GET","/api/worktrees")).worktrees[0]);
+  const worktree=await until("Managed worktree created",async()=>(await api("GET","/api/worktrees")).worktrees.find(w=>w.state==="ready"));
   assert.equal(await readFile(path.join(worktree.path,"README.md"),"utf8"),"# Native desktop test\nA disposable workspace.\n");
   await until("Worktree open button",()=>execute("return [...document.querySelectorAll('button')].some(b=>b.textContent==='Open worktree'&&!b.disabled)"));await clickButton("Open worktree");
   await until("Explicit worktree trust",()=>execute("return [...document.querySelectorAll('h2')].some(e=>e.textContent==='Trust this folder?')"));await clickButton("Cancel");
@@ -344,6 +345,25 @@ try {
   await wd("POST", `/session/${session}/window/rect`,{width:1380,height:920});
   await clickButton("Remove clean worktree");await until("Managed worktree removed",async()=>!(await api("GET","/api/worktrees")).worktrees.length);
   assert.equal((await promisify(execFile)("git",["rev-parse",worktree.branch],{cwd:project})).stdout.trim(),worktree.base_commit);
+  await until("Recovery fixture creation ready",()=>execute("return [...document.querySelectorAll('button')].some(b=>b.textContent==='Create worktree'&&!b.disabled)"));
+  await clickButton("Create worktree");
+  const missingWorktree=await until("Recovery fixture created",async()=>(await api("GET","/api/worktrees")).worktrees.find(w=>w.state==="ready"));
+  const originalRecord=path.join(dataDirectory,"managed-worktrees/records",`${missingWorktree.id}.json`);
+  const originalRecordBytes=await readFile(originalRecord,"utf8");
+  await rename(missingWorktree.path,path.join(scratch,"saved-recovery-checkout"));
+  await until("Recovery review ready",()=>execute("return [...document.querySelectorAll('button')].some(b=>b.textContent==='Review missing checkout'&&!b.disabled)"));
+  await clickButton("Review missing checkout");
+  await until("Recovery review focused",()=>execute("return document.activeElement?.getAttribute('aria-label')==='Review worktree recovery'"));
+  assert.ok(await execute("return document.querySelector('[aria-label=\"Review worktree recovery\"]').textContent.includes('Missing uncommitted files are not reconstructed')"));
+  await screenshot("worktree-recovery");await accessibility("worktree-recovery");
+  await execute("document.documentElement.dataset.theme='dark'");await accessibility("worktree-recovery-dark");await execute("document.documentElement.dataset.theme='light'");
+  await wd("POST", `/session/${session}/window/rect`,{width:620,height:850});await accessibility("worktree-recovery-compact");assert.equal(await execute("return document.documentElement.scrollWidth<=window.innerWidth+1"),true);
+  await wd("POST", `/session/${session}/window/rect`,{width:1380,height:920});
+  await clickButton("Restore in new worktree");
+  const restoredWorktree=await until("Committed work restored",async()=>(await api("GET","/api/worktrees")).worktrees.find(w=>w.id!==missingWorktree.id&&w.state==="ready"));
+  assert.equal(await readFile(path.join(restoredWorktree.path,"README.md"),"utf8"),"# Native desktop test\nA disposable workspace.\n");
+  assert.equal(await readFile(originalRecord,"utf8"),originalRecordBytes);
+  assert.equal((await promisify(execFile)("git",["rev-parse",missingWorktree.branch],{cwd:project})).stdout.trim(),missingWorktree.base_commit);
   await clickButton("Plugins");
   await until("Native plugin catalog",()=>execute("return !!document.querySelector('.plugin-settings')"));
   await clickButton("Review python-expert");
@@ -769,7 +789,7 @@ try {
   await until("Terminal cleanup", () => dead(child));
   await until("Background child cleanup", () => dead(backgroundChild));
   await until("Background process cleanup", () => dead(shutdownBackground.pid));
-  await writeFile(path.join(artifacts, "result.json"), JSON.stringify({ passed: true, version: version.version, runtime: version.runtime, modelRequests: requests, requestedModels, mcpCalls, mcpHttpCalls, queueRequests, checks: [...(defaultProfile ? ["repeated default-profile activation preserves the live window and its extraction"] : []), "native worktree creation, trust prompt, reviewed removal, retained branch and light/dark/compact accessibility",
+  await writeFile(path.join(artifacts, "result.json"), JSON.stringify({ passed: true, version: version.version, runtime: version.runtime, modelRequests: requests, requestedModels, mcpCalls, mcpHttpCalls, queueRequests, checks: [...(defaultProfile ? ["repeated default-profile activation preserves the live window and its extraction"] : []), "native worktree creation, trust prompt, reviewed removal, missing checkout rescue, preserved original metadata and light/dark/compact accessibility",
     "native built-in/custom plugin review and installation, separate hook activation, actual installed skill execution, removal with local edits preserved", "embedded interface", "Rust IPC", "native approval", "real file write and terminal verification", "durable reload", "queued follow-ups, project FIFO, cross-conversation cancellation, reload selection, model/mode snapshots and inherited results", "native routing controls and persisted model/fallback notices", "background start, live output, coexistence with tasks, stop, and child cleanup on quit", "model background tools, visible exact-command approvals, light/dark/compact approval accessibility, shared panel state and immediate stop cleanup", "selected skill execution, mode enforcement, provenance and durable command cards", "project inspection, native diagnostic cards and Health status distinctions", "task-note command persistence and goal approval after backend selection changes", "reviewed hook activation and disable in Settings, actual completion check, durable hook result", "shared CLI engine with independent project selection and background controls", "MCP registration, exact-argument approval, stdio and authenticated HTTP results, credential redaction, cleanup and removal", "cancellation", "compact layout", "native light/dark/compact/goals/routing/background/skills/hooks/mcp/mcp-http/inspection/diagnostics and queue accessibility", "goal creation, automatic milestone progression, verification, live transcript and pause", "managed native shutdown"] }, null, 2));
   console.log("Native desktop window passed: IPC, approval, file/terminal tools, routing, background processes, MCP, shared CLI isolation, replay, cancellation, layout, goals, accessibility, shutdown.");
 } catch (error) {
 
@@ -117,6 +117,13 @@ export type ManagedWorktree = {
   created_at: number;
   detail: string;
 };
+export type WorktreeRecovery = {
+  record: ManagedWorktree;
+  commit: string;
+  branch: string;
+  warning: string;
+  hash: string;
+};
 export type WorktreeInspection = {
   record: ManagedWorktree;
   head: string;
@@ -484,6 +491,17 @@ export const api = {
       workspace,
       id,
     }),
+  worktreeRecovery: (workspace: string, id: string) =>
+    send<WorktreeRecovery>("/api/worktrees/recovery", "POST", {
+      workspace,
+      id,
+    }),
+  restoreWorktree: (workspace: string, id: string, hash: string) =>
+    send<ManagedWorktree>("/api/worktrees/restore", "POST", {
+      workspace,
+      id,
+      hash,
+    }),
   removeWorktree: (workspace: string, id: string, hash: string) =>
     send<ManagedWorktree>("/api/worktrees/remove", "POST", {
       workspace,
 
@@ -15,6 +15,8 @@ vi.mock("../api", () => ({
     createWorktree: vi.fn(),
     inspectWorktree: vi.fn(),
     removeWorktree: vi.fn(),
+    worktreeRecovery: vi.fn(),
+    restoreWorktree: vi.fn(),
   },
 }));
 const record: ManagedWorktree = {
@@ -112,3 +114,36 @@ it("blocks dirty removal and clears a stale review after server rejection", asyn
     screen.queryByRole("region", { name: "Review worktree removal" }),
   ).toBeNull();
 });
+
+it("reviews recovery explicitly and rejects stale recovery without reuse", async () => {
+  vi.mocked(api.worktreeRecovery).mockResolvedValue({
+    record,
+    commit: "retained-commit",
+    branch: record.branch,
+    warning: "Missing uncommitted files are not reconstructed.",
+    hash: "recovery-hash",
+  });
+  vi.mocked(api.restoreWorktree).mockRejectedValue(
+    new Error("Recovery state changed"),
+  );
+  render(<WorktreeSettings onToast={vi.fn()} />);
+  fireEvent.click(await screen.findByText("Review missing checkout"));
+  const region = await screen.findByRole("region", {
+    name: "Review worktree recovery",
+  });
+  expect(document.activeElement).toBe(region);
+  expect(api.worktreeRecovery).toHaveBeenCalledWith("/source", "managed");
+  expect(api.restoreWorktree).not.toHaveBeenCalled();
+  await screen.findByText("Missing uncommitted files are not reconstructed.");
+  fireEvent.click(screen.getByText("Restore in new worktree"));
+  await screen.findByRole("alert");
+  expect(api.restoreWorktree).toHaveBeenCalledWith(
+    "/source",
+    "managed",
+    "recovery-hash",
+  );
+  expect(
+    screen.queryByRole("region", { name: "Review worktree recovery" }),
+  ).toBeNull();
+  expect(api.removeWorktree).not.toHaveBeenCalled();
+});
@@ -1,5 +1,10 @@
 import { useEffect, useLayoutEffect, useRef, useState } from "react";
-import { api, type ManagedWorktree, type WorktreeInspection } from "../api";
+import {
+  api,
+  type ManagedWorktree,
+  type WorktreeInspection,
+  type WorktreeRecovery,
+} from "../api";
 export function WorktreeSettings({
   onOpen,
   onToast,
@@ -14,6 +19,7 @@ export function WorktreeSettings({
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState("");
   const [review, setReview] = useState<WorktreeInspection | null>(null);
+  const [recovery, setRecovery] = useState<WorktreeRecovery | null>(null);
   const reviewRef = useRef<HTMLDivElement>(null);
   useEffect(() => {
     let live = true;
@@ -36,16 +42,17 @@ export function WorktreeSettings({
     };
   }, []);
   useLayoutEffect(() => {
-    if (review) {
+    if (review || recovery) {
       reviewRef.current?.scrollIntoView({ block: "nearest" });
       reviewRef.current?.focus({ preventScroll: true });
     }
-  }, [review]);
+  }, [review, recovery]);
   async function refresh() {
     const data = await api.worktrees();
     setWorkspace(data.workspace);
     setRecords(data.worktrees);
     setReview(null);
+    setRecovery(null);
   }
   async function perform(action: () => Promise<void>) {
     setBusy(true);
@@ -55,6 +62,7 @@ export function WorktreeSettings({
     } catch (e) {
       setError(String(e));
       setReview(null);
+      setRecovery(null);
     } finally {
       setBusy(false);
     }
@@ -139,17 +147,90 @@ export function WorktreeSettings({
                 className="ghost"
                 disabled={busy}
                 onClick={() =>
-                  void perform(async () =>
-                    setReview(await api.inspectWorktree(workspace, record.id)),
-                  )
+                  void perform(async () => {
+                    setRecovery(null);
+                    setReview(await api.inspectWorktree(workspace, record.id));
+                  })
                 }
               >
                 Inspect removal
               </button>
+              <button
+                type="button"
+                className="ghost"
+                disabled={busy}
+                onClick={() =>
+                  void perform(async () => {
+                    setReview(null);
+                    setRecovery(
+                      await api.worktreeRecovery(workspace, record.id),
+                    );
+                  })
+                }
+              >
+                Review missing checkout
+              </button>
             </div>
           </article>
         ))}
       </div>
+      {recovery && (
+        <div
+          className="worktree-review"
+          ref={reviewRef}
+          tabIndex={-1}
+          role="region"
+          aria-label="Review worktree recovery"
+        >
+          <h4>Recover committed work</h4>
+          <p className="hint">Missing checkout</p>
+          <code className="worktree-path">{recovery.record.path}</code>
+          <p>
+            Retained branch:{" "}
+            <strong>{recovery.branch || "Detached HEAD"}</strong>
+          </p>
+          <p>
+            Commit to restore:{" "}
+            <code className="worktree-path">{recovery.commit}</code>
+          </p>
+          <p>{recovery.warning}</p>
+          <p className="hint">
+            The new checkout will appear in this list. Open and trust it before
+            running tasks.
+          </p>
+          <div className="row">
+            <button
+              type="button"
+              className="ghost"
+              disabled={busy}
+              onClick={() => setRecovery(null)}
+            >
+              Cancel recovery
+            </button>
+            <button
+              type="button"
+              className="primary"
+              disabled={busy}
+              onClick={() =>
+                void perform(async () => {
+                  const restored = await api.restoreWorktree(
+                    workspace,
+                    recovery.record.id,
+                    recovery.hash,
+                  );
+                  await refresh();
+                  onToast(
+                    `Recovered committed work in ${restored.branch}`,
+                    "ok",
+                  );
+                })
+              }
+            >
+              Restore in new worktree
+            </button>
+          </div>
+        </div>
+      )}
       {review && (
         <div
           className="worktree-review"