data-model.md drift: prune's abandoned deletions, the released 2→3 migration, abandon/land actor authority

[dichovsky]

Three passages in docs/design/data-model.md no longer match the Store:

• Prune scope: the doc says prune "deletes only completed Tasks older than the cutoff" (and docs/design/cli-contract.md says "tasks_deleted counts the deleted completed Tasks"), but src/store/maintenance.ts:155-180 deletes (status = 'completed' AND completed_at < ?) OR (status = 'abandoned' AND abandoned_at < ?). The contract even contradicts itself — its crew prune command section correctly says "completed or abandoned", as does the src/cli.ts help text.
• Migration catalogue: the released-migrations narrative covers 1→2 then jumps to 3→4, omitting the released fromVersion: 2, toVersion: 3 migration in src/store/schema.ts:647-755 (the destructive rebuild of tasks/task_events for the abandoned status), even though the doc's own overview mentions what v3 added.
• Actor authority: the Tasks invariants state requeue authority but not abandon/land authority. Code enforces both: land requires creator or reviewer (src/store/tasks.ts:724-726); abandon requires creator/reviewer or — when both are archived — the active plain operator identity (src/store/tasks.ts:652-660).

Impact: the doc that must move "together" with schema changes understates what a destructive command deletes, skips a released migration's mechanics, and hides a store-level authorization invariant.

Acceptance: the prune passages (data-model.md and the cli-contract.md tasks_deleted line) include abandoned Tasks by abandoned_at; the 2→3 step joins the migration narrative; the abandon/land actor rules (including the operator fallback) join the invariants.

[dichovsky]

Triage: re-verified against main @ d311767. Confirmed as-is — all three passages reproduce, and the Store is the authoritative side of each.

1. Prune scope. docs/design/data-model.md:499-500 still says prune "deletes only completed Tasks older than the cutoff (completed_at < now − seconds, strict <)", and docs/design/cli-contract.md:586 still says "tasks_deleted counts the deleted completed Tasks". The Store deletes both statuses: ELIGIBLE_TASKS at src/store/maintenance.ts:155-157 and the DELETE FROM tasks at src/store/maintenance.ts:178-186 are each (status = 'completed' AND completed_at < ?) OR (status = 'abandoned' AND abandoned_at < ?). The contract's self-contradiction is as filed: cli-contract.md:431-434 correctly says "completed or abandoned … (measured by completed_at and abandoned_at respectively)", matching src/cli.ts:570,572.
2. Migration catalogue. The narrative at data-model.md:465-486 walks 1 -> 2, then jumps straight to 3 -> 4, 4 -> 5, 5 -> 6, 6 -> 7 — the released fromVersion: 2, toVersion: 3 step at src/store/schema.ts:656-757 is the only one with no entry, despite the overview at data-model.md:36-39 already crediting v3 with abandoned_at.
3. Actor authority. The Tasks invariants state requeue authority (data-model.md:350-352) but neither abandon nor land. Code enforces both: src/store/tasks.ts:724-726 refuses land unless the actor is creator or reviewer; src/store/tasks.ts:652-660 refuses abandon on the same test, with a fallback that admits the active plain operator identity only when creator and reviewer are both archived (isActiveOperator, src/store/tasks.ts:209-218, requires id operator, Role operator, platform_id IS NULL). That fallback is FR-E22 (docs/design/srs.md:439-444).

One delta against the body (noted here, body left as written): the abandon fallback is narrower than "the active plain operator identity" suggests on its own — isActiveOperator also requires status = 'active', and a row merely holding the id operator with a different Role or platform is refused. The invariant needs to say so, or it will read as a weaker rule than the code enforces.

Verdict: IMPLEMENT.

• Blast radius — docs/design/data-model.md and docs/design/cli-contract.md only. Nothing under src/, tests/, bin/, or web/, so no module boundary in CLAUDE.md is crossed and no runtime behavior moves. tests/unit/docs-facts.test.ts extracts the Participant roster, schema version, command surface, and ADR index — not prose about prune scope, migration mechanics, or invariants — so no drift guard is touched. docs/ is not in package.json's files; nothing reaches the published tarball.
• Reversibility — a text revert across two files. No migration, no schema change, no published artifact. Note specifically that documenting the 2 -> 3 step is describing already-released code: CURRENT_SCHEMA_VERSION stays 7, no SchemaMigration is added, and no migration test changes — this is not the "a schema change is never isolated" case, because there is no schema change.
• Contract impact — corrective at authority level 3 (CLI contract and data model). Both are brought up to the Store and to level 2, which already requires the wider behavior: FR-E24 (srs.md:455-457) for abandoned-Task retention by abandonedAt, FR-E22 (srs.md:439-444) for the abandon operator fallback. No accepted ADR, FR-*/NFR-* id, CLI grammar, or State Store schema changes, and no requirement is added or renumbered. Per docs/README.md's authority order, the level-3 restatements are the bug, not the code.

Explicitly out of scope, tracked separately:

• FR-K02 (srs.md:707-709) still says prune deletes "only … completed Tasks", contradicting FR-E24 without the in-place amendment marker this SRS uses elsewhere (precedent: FR-U34, srs.md:879). That is a level-2 defect this issue's body does not raise and its Acceptance does not cover — filed as Docs: FR-K02 says prune deletes only completed Tasks, which FR-E24 and the Store contradict #55.
• The wider CLI-contract drift (doctor finding codes, resume_result, ui --json opener, implies-launch flags, error-code scopes) — CLI contract drift: doctor finding codes, resume_result, ui --json opener, implies-launch flags, error-code scopes #28. This change touches only the tasks_deleted sentence and leaves the rest for CLI contract drift: doctor finding codes, resume_result, ui --json opener, implies-launch flags, error-code scopes #28.

---

Generated by Claude Code