FR-PLAT-AND-2 — Detect a lost tree permission without deleting rows #26

New Issue

2026-09-05T16:20:13Z

dtourolle commented

2026-09-05 16:20:13 +00:00

FR-PLAT-AND-2 — detect the loss of a granted tree permission and mark images offline rather than deleting rows. Unbuilt, and blocked rather than skipped.

Blocked on

#25 — there is no permission to lose until SAF exists.

Why it stays open

The failure this guards against is the worst kind the catalog can have: a revoked grant looks exactly like an empty folder, and an empty folder looks exactly like "delete these rows". The VFS placeholder work already established the principle for synced trees — never delete inside one, and let the null path enforce it. This is the same rule for a different loss.

Acceptance

A revoked or expired tree grant is detected rather than read as an empty tree.
Affected images are marked offline; no rows are removed.
Re-granting restores them without a rescan of everything.

See docs/outstanding.md §5.

**FR-PLAT-AND-2 — detect the loss of a granted tree permission and mark images offline rather than deleting rows.** Unbuilt, and **blocked rather than skipped**. ## Blocked on #25 — there is no permission to lose until SAF exists. ## Why it stays open The failure this guards against is the worst kind the catalog can have: a revoked grant looks exactly like an empty folder, and an empty folder looks exactly like "delete these rows". The VFS placeholder work already established the principle for synced trees — never delete inside one, and let the null path enforce it. This is the same rule for a different loss. ## Acceptance - [ ] A revoked or expired tree grant is detected rather than read as an empty tree. - [ ] Affected images are marked offline; **no rows are removed**. - [ ] Re-granting restores them without a rescan of everything. See `docs/outstanding.md` §5.