Stack/graceful deletion/01 foundation

[dzdidi]

Summary

Part 1 of the graceful-deletion stack.

Establishes the invariants required before content-lock deletion can safely begin:

• requires a bounded deadline_hours in Paykit payment criteria;
• adds durable creator-scoped guarded-path ownership;
• reserves all guarded paths atomically before publishing a content lock;
• rejects competing ownership without leaving partial reservations;
• compensates reservations when publication fails;
• documents the intended graceful-deletion lifecycle and Paykit boundary.

These prerequisites ensure deletion can freeze a finite set of payment obligations and an unambiguous set of guarded resources.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Contract changes:

• Paykit payment criteria now require a valid deadline_hours.
• Conflicting creator publication returns content_lock_path_conflict.
• SDK/WASM policy validation reflects the closed payment contract.
• Migration 0010_content_lock_ownership.sql adds durable guarded-path ownership.

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

This intermediate slice was not independently rerun after restacking onto codex/bitkit-local-e2e-fixes; its isolated CI result should be recorded before merge.

Documentation

Updated:

• README.md
• docs/API.md
• docs/ADRs/0020-locks-paykit-v1-integration-boundary.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The documentation defines the payment deadline, path-ownership, and graceful-deletion prerequisites used by later stack parts.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.