[AustinKelsay]

Summary

Organization Brain admins can permanently delete a retired Brain from the dashboard or fbrain brain delete. Previously, deleting its folders left an empty Brain in everyone's list. The CLI release version is 0.9.0.

preview exact Brain, server, counts and state digest
  → explicit confirmation signed by the admin's own key
  → atomic authority, state and active-mount recheck
  → remove owned content and access; retain receipt and retired-ID marker

Organization Brains only; Personal Brains and non-admins are refused. Active cross-Brain mounts block deletion and identify what must be disconnected. Stale previews cannot be confirmed, exact retries return the original receipt, and older clients cannot recreate a retired ID. Deleted Working Trees stop syncing while preserving local files and unsynced paths. A server override cannot stop a tree bound to another server.

The dashboard signs with the account's Hosted Device key. Accepted UI limitation: the existing list follows the selected Agent's access; an admin whose Agent cannot see a Brain uses the CLI. No account-wide browser, trash, undo, restore UI or retention-policy change.

Evidence

• Before: the empty Brain remained visible after Folder deletion. After: the built CLI, file-backed server, real Hosted Device and dashboard browser flow delete a synthetic V1 while preserving the other synthetic Brains' encrypted exports byte-for-byte.
• The receipt-loss P2 is fixed at a94a1f1: invalid-UTF-8 Markdown or invalid local Agent State cannot suppress confirmed server success. The receipt survives with a separate bookkeeping warning and preserved local files. CLI library 269 passed, 2 existing ignored; real-process deletion suite 5 passed, including checksum-verified released fbrain 0.8.0, supervisor stop, server override, and isolated restore.
• Store/server full suites passed 154/149. Fable independently reproduced deletion tests and an older server reopening the new database: surviving Brains remained usable and retired-ID reuse stayed blocked.
• Fable 5.1 approved the combined deletion, names and people integration at 64f9c62c, with no blocking/high/medium findings. Root applied the small deletion copy/error fixes in this PR; the final combined content passed 19 focused unit/real-hosted-route tests, 4 browser tests, project typecheck, lint, production build and the real combined composition proof. The proof covers stale previews after invite/revoke/removal, private aliases, authoritative keys, stale-tab refusals and old-client non-resurrection.
• The combined proof uses real Core/Postgres, Brain server, Hosted Device, production dashboard, Runner-rendered Caddy, packaged Hermes and CLI. WorkOS provider, Agent key pin, Core Hermes-access grant and Chat are fixtures. It does not qualify production or live OAuth.
• Formatting, strict clippy, source-structure, Brain API/language and skills checks passed on the implementation. CI passed at the current head a992859c, including the required CI gate and every listed job: Rust, dashboard, Hermes, Brain acceptance, Nix service packages, devfinity and repository checks.

The original review defect is resolved and the reviewer confirmed source review passes. The formal GitHub changes-requested review remains in place and must be reconciled through the normal review process.

Merge Danger

Door: one-way for a confirmed deletion.

Blast Radius: Brain.

Deletion removes the selected Brain's owned data, history and access. Retired mount references naming it and their derived counters are cleaned up; other Brains' content, members, keys and records remain intact. A minimal permanent audience of npubs enables private terminal notices.

Landing order: #1126 → #1128 → #1127. The release coordinator is qualifying a scoped application source on retained production generation 6a923870; whole-main qualification does not authorize bringing unrelated trial-archive migrations into production.

Deploy the new Brain server and Hosted Device before deletion clients; Core before the names dashboard; qualify the Runtime image before enabling people controls. Use immutable CI artifacts, named backups, full hosted recovery gates, canonical pre/post status and disposable canaries. Publish fbrain/v0.9.0 only after green main CI and service verification.

SCHEMA_V31 is additive. The tested older server reopens it and blocks retired-ID reuse, but loses the new routes and 410 notices. Binary rollback does not restore deleted content. Restore pre-deletion backups onto an empty isolated target; the feature's Brain database/admin-key drill does not replace the full Hosted Recovery Set gate.

No deployment or production deletion has been performed. Linear remains unavailable because its connection requires reauthentication.

[github-actions]

Documentation census

This PR adds 0 new Markdown files and 105 lines of Markdown, and removes 0 Markdown files and 7 lines of Markdown.

Net documentation change: +98 lines.

Counts .md and .markdown files anywhere in the repo, case-insensitively. Lines include additions and deletions across all matching files; net change is additions minus deletions. Renamed files are not counted as new or removed. Advisory only; never a merge gate.

[alexlwn123]

Fail for now — one P2 failure-reporting defect in the confirmed CLI deletion path (inline). The server can permanently delete the Brain, then local Working Tree bookkeeping can suppress the accepted receipt and return only a local error.

Reviewed 084939f57dce6fac014b1f1408a246a394387396 against 534416b04fa62ddb5be922b067b98b8a1a1ba00b, tracing store transactions/schema retirement, signed server and hosted-device requests, CLI sync/receipt handling, and dashboard confirmation. git diff --check passed. The finding is source-traced, not runtime-reproduced: the required Nix environment fails before tool startup with bwrap: setting up uid map: Read-only file system. Consequently I could not run the focused Rust/dashboard tests, exercise the actual UI, capture screenshots, or verify mobile overflow. CI currently reports Brain acceptance and other completed checks passing; Rust workspace, Dashboard, Nix service packages and Nix static contracts remain pending. The new hosted-route/browser deletion proofs are opt-in via FC_BRAIN_DELETION_PROOF_BIN_DIR, which this CI workflow does not set, so a generic dashboard pass would not independently verify those flows.

[alexlwn123]

Pass on source review — the prior P2 receipt-loss finding is addressed at a94a1f1fb00254845fb6acff0483967c4bf38c13. No new actionable defect found in the seven-file repair delta from 084939f5.

Confirmed deletion now preserves success and the receipt in both JSON and text output when local discovery/scanning/state persistence fails, reporting a separate warning. Failed scanning no longer prevents a terminal marker when Agent State is writable; unsyncedPathsError preserves the incomplete-scan warning, defaults safely for existing state, and is shown by later terminal sync errors. The Brain/server binding check remains intact.

I inspected the two added real-process tests: invalid-UTF-8 Markdown checks JSON/text receipts, retained bytes, terminal state and offline sync refusal; invalid Agent State checks receipt plus warning without rewriting local state/files. These are source-reviewed tests, not independently executed results. git diff --check passed across the complete PR; the isolated checkout is clean. The prior Nix startup failure (bwrap: setting up uid map: Read-only file system) still blocks local Rust/dashboard execution; I did not retry or bypass it, or the denied CI-log download. Current-head substantive CI jobs are pending. Actual UI, screenshots/mobile overflow and opt-in hosted-route/browser execution remain unverified by this review; this repair changes no UI.

[alexlwn123]

Pass on source review — no new actionable finding at a992859ccefcead4ed43c56b16f5159082f16cce.

Reviewed the four-file delta from a94a1f1f: explicit spacing in the confirmation copy and readable stale/expired/generic 409 messages. I traced server conflict reasons through the hosted client, dashboard route and panel: HTTP 409 is preserved, active-mount details remain available, and a refused confirmation still requires a fresh preview before retrying. The added unit cases and browser assertions match the changed paths in source. The prior CLI receipt-loss fix is unchanged; its resolved finding is not repeated.

Full-PR git diff --check passed; applicable AGENTS guidance and the authoritative review skill were rechecked. I did not independently execute the tests or the changed UI: the previously observed Nix/bwrap UID-map restriction remains unresolved, and neither that operation nor the denied CI-log download was retried or bypassed. No genuine desktop/mobile screenshots were captured or uploaded, and mobile overflow remains unverified. Current-head CI is still in progress; author-reported combined integration results are not independent evidence from this review. Posting COMMENT with these coverage limits.