amadan
docs: spec catches up with the rulings — no console trash form, no routes on restore
§5 named a "console form" among the trash doors; there is no such thing and there was never meant to be — trash is CLI and console-API only, and the browser's surface is the Trash page, which restores and purges what is already trashed. A browser-side "move to trash" button is a possible follow-up, not part of this branch. §5 and §9 also now name the route-drop as a place the production flag is checked, which it is as of this branch. §9's first test bullet still promised "restore → routes return", which the 01569c3 ruling reversed and §3 already records: restore un-hides the app, and routing comes back only via `carlos add`.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+14
−7
docs/superpowers/specs/2026-08-04-deletion-policy-design.md+14 −7
diff --git a/docs/superpowers/specs/2026-08-04-deletion-policy-design.md b/docs/superpowers/specs/2026-08-04-deletion-policy-design.md| index 2e855bd5a..eb79f05a1 100644 |
| --- a/docs/superpowers/specs/2026-08-04-deletion-policy-design.md |
| +++ b/docs/superpowers/specs/2026-08-04-deletion-policy-design.md |
| @@ -148,9 +148,14 @@ passkey step-up, 72-hour box-side hold). Turn production off, then trash. |
| Deletion adds **zero new protection machinery**; the production flag's |
| ceremony is the deletion ceremony. |
| -The check reads the flag via `GetProduction` at every gate that can start a |
| -trash (CLI headless, console API, console form) and again in the auto-purge |
| -pass (§7). An **unreadable flag fails toward refusal** — same direction as |
| +The check reads the flag via `GetProduction` at both gates that can start a |
| +trash — the console API (`carlos apps delete` signed in) and the headless |
| +bucket path (`carlos apps delete` with a signing key) — and again in the |
| +auto-purge pass (§7) and in reconcile's route-drop (§3). There is no console |
| +*form* that trashes: the browser's surface is the Trash page, which restores |
| +and purges what is already trashed. A browser-side "move to trash" button is |
| +a possible follow-up, not part of this branch. An **unreadable flag fails |
| +toward refusal** — same direction as |
| bake.go, where unreadable fails toward baking: when the bucket cannot say |
| "not production", the platform acts as if it had said "production". |
| @@ -276,10 +281,12 @@ headless — while this console was down). |
| ## 9. Testing |
| -- Marker round-trip: trash → routes drop on next reconcile; restore → routes |
| - return; purge → keys gone, marker last, row gone, name reclaimable. |
| -- Production refusals at all three trash doors, plus the unreadable-flag |
| - refusal (a store whose `Get` fails must refuse, not proceed). |
| +- Marker round-trip: trash → routes drop on next reconcile; restore → app |
| + un-hides; routes return only via `carlos add`; purge → keys gone, marker |
| + last, row gone, name reclaimable. |
| +- Production refusals at both trash doors, in the auto-purge pass, and in |
| + reconcile's route-drop, plus the unreadable-flag refusal at each (a store |
| + whose `Get` fails must refuse, not proceed). |
| - Auto-purge: under-30-days untouched; restore racing the pass loses nothing |
| (marker re-read); malformed marker skipped and logged; half-purged app |
| (marker present, keys partially gone) finishes on the next pass. |