feat: Phase 17 — Recycle Bin

.planning/REQUIREMENTS.md

@@ -130,6 +130,14 @@ Requirements for production release. Each maps to roadmap phases 12+.
 - [x] **VER-04**: Version retention policy enforced (max versions per file, configurable)
 - [x] **VER-05**: Version storage counted against user quota
 
+### Recycle Bin
+
+- [x] **BIN-01**: Deleting a file or folder moves it to a recycle bin instead of permanently removing it; the item remains recoverable
+- [x] **BIN-02**: User can browse bin contents and restore any item to its original folder location (or root if parent was deleted)
+- [x] **BIN-03**: User can manually empty the entire bin or permanently delete individual items to free storage quota
+- [x] **BIN-04**: Bin items are automatically purged after the retention period expires (default 30 days)
+- [x] **BIN-05**: Storage consumed by bin items counts against the user's quota; emptying the bin reclaims space immediately
+
 ### Advanced Sync
 
 - [x] **SYNC-04**: Client detects conflicts via IPNS sequence number mismatch before publishing

.planning/ROADMAP.md

@@ -64,7 +64,7 @@ See `.planning/archive/m1-ROADMAP.md` for full M1 phase details and plan lists.
 - [x] **Phase 15: Link Sharing** - Shareable file links for non-users with URL-fragment decryption keys -- COMPLETE 2026-02-23
 - [x] **Phase 15.1: Client-Side Search** - Encrypted search index in IndexedDB with incremental updates (INSERTED) -- COMPLETE 2026-02-24
 - [x] **Phase 16: Advanced Sync** - Conflict detection via optimistic concurrency on IPNS folder publishes -- COMPLETE 2026-03-03
-- [ ] **Phase 17: Recycle Bin** - Soft-delete with time-limited retention, file/folder recovery, and manual bin emptying
+- [x] **Phase 17: Recycle Bin** - Soft-delete with time-limited retention, file/folder recovery, and manual bin emptying -- COMPLETE 2026-03-04
 
 ### Milestone 3: Encrypted Productivity Suite (Planned)
 
@@ -470,8 +470,8 @@ Plans:
 
 **Goal**: Deleted files and folders are moved to a recycle bin with time-limited retention instead of being permanently destroyed. Users can recover items to their original vault location and manually empty the bin to free storage space.
 **Depends on**: Phase 16 (Advanced Sync complete, conflict detection ensures safe delete/restore operations)
-**Requirements**: TBD
-**Research flag**: NEEDS assessment -- client-side bin metadata design (encrypted bin index on IPFS/IPNS), retention policy enforcement, restore-to-original-path resolution, quota accounting for bin contents
+**Requirements**: BIN-01, BIN-02, BIN-03, BIN-04, BIN-05
+**Research flag**: COMPLETE -- encrypted bin IPNS record (ECIES + HKDF), client-side retention enforcement, restore-to-original-path resolution, desktop FUSE soft-delete via IPC researched
 **Success Criteria** (what must be TRUE):
 
 1. Deleting a file or folder moves it to a recycle bin instead of permanently removing it; the item remains recoverable
@@ -480,7 +480,15 @@ Plans:
 4. Bin items are automatically purged after the retention period expires (e.g., 30 days)
 5. Storage consumed by bin items counts against the user's quota; emptying the bin reclaims space immediately
 
-**Plans**: TBD
+**Plans:** 5 plans
+
+Plans:
+
+- [x] 17-01-PLAN.md — Crypto bin module (types, HKDF IPNS derivation, ECIES encrypt/decrypt, schema validation) + API retention config endpoint
+- [x] 17-02-PLAN.md — Bin store + bin service (initialize, add, restore, permanent delete, empty, purge) + delete flow rewired to soft-delete + useAuth bin init
+- [x] 17-03-PLAN.md — Bin UI (BinPage, BinBrowser, sidebar nav, context menu, multi-select, restore, permanent delete, empty bin)
+- [x] 17-04-PLAN.md — Desktop FUSE bin integration (Rust bin crypto module, HKDF derivation, ECIES encrypt/decrypt, bin entry creation in handle_unlink/handle_rmdir)
+- [x] 17-05-PLAN.md — E2E test suites: Playwright web recycle bin workflow + desktop-e2e FUSE delete-to-bin recovery scripts
 
 ## Progress
 
@@ -532,7 +540,7 @@ Parallel phases:
 | 11. Windows Desktop         | M2        | 3/3            | Complete    | 2026-02-22 |
 | 11.3 Linux Desktop          | M2        | 3/3            | Complete    | 2026-02-28 |
 | 11.4 Cross-Platform E2E     | M2        | 3/3            | Complete    | 2026-02-28 |
-| 17. Recycle Bin             | M2        | 0/TBD          | Not started | -          |
+| 17. Recycle Bin             | M2        | 5/5            | Complete    | 2026-03-04 |
 | 18. Billing Infrastructure  | M3        | 0/TBD          | Not started | -          |
 | 19. Team Accounts           | M3        | 0/TBD          | Not started | -          |
 | 20. Document Editors        | M3        | 0/TBD          | Not started | -          |

.planning/STATE.md

@@ -5,24 +5,24 @@
 See: .planning/PROJECT.md (updated 2026-02-11)
 
 **Core value:** Zero-knowledge privacy - files encrypted client-side, server never sees plaintext
-**Current focus:** Milestone 2 -- Phase 16 COMPLETE (Advanced Sync)
+**Current focus:** Milestone 2 -- COMPLETE (all phases shipped)
 
 ## Current Position
 
-Phase: 16 (Advanced Sync) -- VERIFIED COMPLETE
+Phase: 17 (Recycle Bin) -- Complete
 Plan: 5 of 5
-Status: Phase verified (3/3 must-haves)
-Last activity: 2026-03-03 -- Phase 16 verified and complete
+Status: Phase complete (all plans executed)
+Last activity: 2026-03-04 -- Completed 17-05-PLAN.md
 
-Progress: [#########################] (M1 complete, M2 Phase 12 complete, Phase 12.2 complete, Phase 12.3 complete, Phase 12.3.1 complete, Phase 12.4 complete, Phase 12.5 complete, Phase 12.6 complete, Phase 12.1 complete, Phase 11.1: 7/7 COMPLETE, Phase 11.2: 3/3 COMPLETE, Phase 13: 5/5 COMPLETE, Phase 14: 6/6 COMPLETE, Phase 11: 3/3 COMPLETE, Phase 15: 4/4 COMPLETE, Phase 15.1: 3/3 COMPLETE, Phase 11.3: 3/3 COMPLETE, Phase 11.4: 3/3 COMPLETE, Phase 16: 5/5 COMPLETE)
+Progress: [#########################] (M1 complete, M2 Phase 12 complete, Phase 12.2 complete, Phase 12.3 complete, Phase 12.3.1 complete, Phase 12.4 complete, Phase 12.5 complete, Phase 12.6 complete, Phase 12.1 complete, Phase 11.1: 7/7 COMPLETE, Phase 11.2: 3/3 COMPLETE, Phase 13: 5/5 COMPLETE, Phase 14: 6/6 COMPLETE, Phase 11: 3/3 COMPLETE, Phase 15: 4/4 COMPLETE, Phase 15.1: 3/3 COMPLETE, Phase 11.3: 3/3 COMPLETE, Phase 11.4: 3/3 COMPLETE, Phase 16: 5/5 COMPLETE, Phase 17: 5/5 COMPLETE)
 
 ## Performance Metrics
 
 **Velocity:**
 
-- Total plans completed: 146
+- Total plans completed: 151
 - Average duration: 5.5 min
-- Total execution time: 15.5 hours
+- Total execution time: 16.0 hours
 
 **By Phase (M1 summary):**
 
@@ -47,10 +47,11 @@ Progress: [#########################] (M1 complete, M2 Phase 12 complete, Phase
 | M2 Phase 11.3   | 3/3   | 104 min | 34.7 min |
 | M2 Phase 11.4   | 3/3   | 20 min  | 6.7 min  |
 | M2 Phase 16     | 5/5   | 18 min  | 3.6 min  |
+| M2 Phase 17     | 5/5   | 35 min  | 7.0 min  |
 
 **Recent Trend:**
 
-- Last 5 plans: 10m, 5m, 2m, 10m, 4m
+- Last 5 plans: 4m, 7m, 9m, 7m, 5m
 - Trend: Stable
 
 Updated after each plan completion.
@@ -233,6 +234,15 @@ Recent decisions affecting current work:
 | PublishResult enum (Success/Conflict) returned by Rust publish_ipns    | 16-03     | Compiler enforces exhaustive match; no silent failure possible on conflict detection                                 |
 | merge_folder_children uses IPNS name as stable child key               | 16-03     | ipns_name for FolderEntry, file_meta_ipns_name for FilePointer; survives rename (same IPNS key, new name field)      |
 | OS notification for desktop conflict detection deferred                | 16-03     | AppHandle not easily accessible from background thread; tray status change visible to user; TODO for v2              |
+| Bin metadata uses ECIES (same as DeviceRegistry, not AES-GCM)          | 17-01     | Single user-scoped record, no per-record symmetric key to manage                                                     |
+| HKDF info cipherbox-recycle-bin-ipns-v1 for bin IPNS derivation        | 17-01     | Domain separation from vault and registry IPNS keys; same salt CipherBox-v1                                          |
+| GET /vault/config synchronous (no DB query)                            | 17-01     | Reads RECYCLE_BIN_RETENTION_DAYS from ConfigService with default 30                                                  |
+| addToBin fire-and-forget from delete flow                              | 17-02     | Folder metadata already updated; bin write is best-effort, non-blocking                                              |
+| Folder size 0 in bin entries (resolved on permanent delete)            | 17-02     | Avoids expensive IPNS resolution at delete time; CID cleanup resolves size lazily                                    |
+| Recursive parent restore max depth 5                                   | 17-02     | Prevents infinite loops when parent chain is deep; falls back to root                                                |
+| Inline generate_uuid_v4 in bin.rs (no uuid crate)                      | 17-04     | Same pattern as registry/mod.rs; avoid new dependency for simple function                                            |
+| Inline guess_mime_type mapping (no mime_guess crate)                   | 17-04     | Best-effort MIME for bin display; application/octet-stream fallback acceptable for unknown extensions                |
+| Bin IPNS conflict = log + preserve CID (no retry)                      | 17-04     | Fire-and-forget publish; data preserved via pinned CID; next delete or web session creates fresh bin state           |
 
 ### Pending Todos
 
@@ -309,17 +319,17 @@ Recent decisions affecting current work:
 - Phase 11.3 (Linux Desktop): COMPLETE -- 3/3 plans done (Rust platform support, packaging & CI, local UAT 18/18 pass)
 - Phase 11.4 (Cross-Platform E2E Testing): COMPLETE -- 3/3 plans done (CI debug artifacts + crypto vectors, FUSE/API test scripts, e2e-desktop.yml workflow)
 - Phase 16 (Advanced Sync): COMPLETE -- 5/5 plans done (API concurrency control, web sync service, desktop conflict handling, web E2E tests, desktop E2E tests)
-- Phase 17 (Recycle Bin): Not started -- needs planning
+- Phase 17 (Recycle Bin): COMPLETE -- 5/5 plans done (crypto, store/service, web UI, desktop FUSE, E2E testing)
 - Phase 22 (Nitro TEE): Moved to M3. NEEDS `/gsd:research-phase` -- Rust enclave, highest risk item
 
 ## Session Continuity
 
-Last session: 2026-03-03
-Stopped at: Phase 16 verified complete
+Last session: 2026-03-04
+Stopped at: Completed 17-05-PLAN.md (Phase 17 complete)
 Resume file: None
-Next: Phase 17 (Recycle Bin) -- needs planning
+Next: Phase 17 PR to main
 
 ---
 
 _State initialized: 2026-01-20_
-_Last updated: 2026-03-03 after Phase 16 verified complete (Advanced Sync)_
+_Last updated: 2026-03-04 after Plan 17-05 complete (E2E recycle bin tests)_