docs(skills): objectstack-api teaches the recycle bin a by-id delete keeps, not a hard delete

.changeset/api-skill-delete-recycle-bin.md

@@ -0,0 +1,8 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): objectstack-api no longer teaches that `DELETE` is a hard delete with no recycle bin: a by-id delete keeps a business object's rows in `sys_recycle_bin` (30 days by default; not `multi: true` deletes, platform rows or rows deleted before the bin existed), and nothing lists or restores it over the API yet; eval case 5 expects that teaching instead of a hard delete
+
+Clause-②: no
+Metadata-protocol: none

skills/objectstack-api/SKILL.md

@@ -45,7 +45,7 @@ GET    /api/v1/data/{object}          # List records (with filter, sort, paginat
 GET    /api/v1/data/{object}/:id      # Get single record
 POST   /api/v1/data/{object}          # Create record
 PATCH  /api/v1/data/{object}/:id      # Update record
-DELETE /api/v1/data/{object}/:id      # Delete record (hard delete)
+DELETE /api/v1/data/{object}/:id      # Delete record (business-object rows → recycle bin)
 POST   /api/v1/data/{object}/query    # Complex queries + aggregation (QueryAST in body)
 POST   /api/v1/data/{object}/batch    # Per-object batch operations
 POST   /api/v1/batch                  # Cross-object atomic batch
@@ -269,8 +269,8 @@ eight extra verbs are never declared in `apiMethods`:
 | `export` | `list` | `GET /data/{object}/export` |
 
 `history` (from `get` ∧ `trackHistory`) gates only. `restore` / `purge` never
-derive — the trash surface is retired. Declaring any derived verb in
-`apiMethods` is stripped at parse with a FROM → TO warning.
+derive: the recycle bin has no restore or purge door yet. Declaring any
+derived verb in `apiMethods` is stripped at parse with a FROM → TO warning.
 
 `POST /data/{object}/import` takes `mapping` as `{ Column: field }` or as
 `FieldMappingEntry[]` (`api/export.zod.ts`); only the entry form carries
@@ -408,10 +408,10 @@ keys mean the run produced none — never invent an empty.
    read. Sending neither skips the check; a mismatch answers **409
    `CONCURRENT_UPDATE`**; the quoted-empty entity-tag (`""`) is refused **400
    `VALIDATION_FAILED`**, not treated as omitted.
-2. **Assuming `DELETE` is recoverable.** ObjectStack `DELETE` is a hard
-   delete — there is no recycle bin.
-   For recoverability, use per-field `trackHistory` (audit
-   trail) or a `lifecycle` archive policy instead of custom soft-delete logic.
+2. **Treating `DELETE` as final or as restorable.** A by-id delete keeps a
+   business object's rows in the recycle bin (`sys_recycle_bin`, 30 days by
+   default; not `multi: true` deletes, platform rows or rows deleted before the
+   bin existed); nothing lists or restores it over the API yet. No soft-delete.
 
 ---
 

skills/objectstack-api/evals/endpoints-auth-routes.json

@@ -44,10 +44,10 @@
     {
       "id": 5,
       "prompt": "Lock the `invoice` object's API down to read, list, search and export; add a `/bulk` route for imports and a `restore` operation so deleted invoices can be undeleted.",
-      "expected_output": "Authors only the primitives: `apiMethods: ['get', 'list']` — `search` and `export` derive from `list` automatically and are never declared (a declared derived verb is stripped with a warning). Explains there is no `/bulk` route (batch writes go through `POST /api/v1/data/{object}/batch`) and that `restore` / `purge` never derive because DELETE is a hard delete; recoverability is per-field `trackHistory` or a `lifecycle` archive policy.",
+      "expected_output": "Authors only the primitives: `apiMethods: ['get', 'list']` — `search` and `export` derive from `list` automatically and are never declared (a declared derived verb is stripped with a warning). Explains there is no `/bulk` route (batch writes go through `POST /api/v1/data/{object}/batch`) and that `restore` / `purge` never derive: a by-id delete of a business object already keeps its rows in the recycle bin (`sys_recycle_bin`), but nothing lists or restores them over the API yet, so there is no restore operation to add and no custom soft-delete to build.",
       "files": [],
       "assertions": {
-        "must_contain": ["apiMethods", "/batch", "trackHistory", "lifecycle"],
+        "must_contain": ["apiMethods", "/batch", "sys_recycle_bin", "recycle bin"],
         "must_not_contain": ["'search'", "'restore'"]
       }
     },