feat(spec)!: remove dead enable.trash/mru capability flags (#2377 close-out, ADR-0049)

[os-zhuang]

Final slice of #2377 (ADR-0049 enforce-or-remove), following #2402 and #3176. Removes the last two dead entries in the object liveness ledger: enable.trash and enable.mru.

Why these two are the worst kind of dead prop

Both parsed and defaulted to true with no runtime consumer: every delete has always been a hard delete (no recycle bin exists), and MRU tracking was never implemented. A default-true flag promising recoverability is an actively dangerous false affordance — first-party objects were authoring trash: false // Never soft-delete audit logs in the belief that a soft-delete existed to opt out of, and the API skill taught agents that DELETE is "soft-delete if trash enabled". Since object.softDelete was already removed in #3176 with a hard-delete migration note, keeping enable.trash had the schema telling two contradictory stories.

Changes

• ObjectCapabilities is now .strict() (pattern of the tenancy block, [spec] Remove tenancy.strategy + tenancy.crossTenantAccess at the next major — no requirement (owner decision) #2763): the retired trash/mru reject with the upgrade prescription via a new CAPABILITIES_RETIRED_KEY_GUIDANCE map, and unknown keys/typos fail loudly instead of stripping silently (Object-level workflows: [...] (and any unknown ObjectSchema key) is silently stripped at build — no error/warning (ADR-0032 'no silent failure', metadata layer) #1535). Strict immediately proved its worth by catching two latent bugs: sys_secret and sys_setting_audit authored a never-existent enable.audit flag (silently stripped until now).
• ~46 first-party object definitions drop their inert trash:/mru: lines (platform-objects, plugin-security/audit/approvals/sharing, metadata-core, service-realtime, examples/app-todo). Three spec test fixtures also carried the stale feedEnabled key (real flag: feeds) — fixed, and now guarded by the strict parse.
• Liveness ledger: both entries deleted (removal precedent: tags/recordName); the README count table's object row now shows 0 dead. Studio object.form.ts drops both authoring-form rows.
• Docs/skills stop advertising a recycle bin / MRU tracking (concepts/metadata-driven, data-modeling/objects, data-modeling/schema-design, protocol/objectql/schema, data + API skills). The API skill's common-mistakes section now states the real contract: DELETE is a hard delete; use per-field trackHistory or a lifecycle policy for recoverability.
• Generated reference docs regenerated (gen:schema + gen:docs); api-surface.json verified unchanged (no public exports were removed).

Migration

Delete any enable.trash / enable.mru keys from object metadata — they never changed behavior. ObjectSchema.create() / ObjectCapabilities.parse() now reject them with this prescription in the error. A real recycle bin or MRU feature, if built, returns as a live enforced flag (#1893 prune-or-build).

Versioning

Breaking spec-surface change, versioned as a minor changeset per the launch-window policy (fixed-group monorepo; precedent #2402/#3176).

Verification

• Spec suite 6820 passed (256 files) incl. new retired-key rejection tests; liveness gate ✓; check:api-surface ✓; check:docs ✓ (254 generated files in sync)
• CLI 442 passed (liveness author-warn lint repointed at enable.searchable)
• All touched packages green: platform-objects, metadata-core, plugin-audit/security/approvals/sharing, service-realtime, example-todo
• Repo-wide scans: no remaining trash:/mru: set-sites, no other unknown enable keys

Note: the initial CI runs on this PR failed at workflow startup (3s, no logs) — a repo-wide Actions outage affecting every branch since ~20:57 UTC, not this diff; will re-run once Actions recover.

Closes #2377

🤖 Generated with Claude Code

https://claude.ai/code/session_01RRCHNGhKw8uVhA3ghXKDpA

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 22, 2026 9:16pm