Add typed Delete operation support

.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
       "name": "implementation-plugin",
       "source": "./",
       "description": "Run approved implementation programs one reviewable increment at a time.",
-      "version": "0.1.2"
+      "version": "0.1.3"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "implementation-plugin",
   "displayName": "Implementation Plugin",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Run approved implementation programs one reviewable increment at a time.",
   "repository": "https://github.com/CoveMB/implementation-plugin",
   "skills": "./skills/"

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "implementation-plugin",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Run approved implementation programs one reviewable increment at a time.",
   "skills": "./skills/"
 }

docs/installation.md

@@ -258,15 +258,15 @@ Claude Code 2.1.128 or later also accepts a local `.zip` archive through the
 same option:
 
 ```bash
-claude --plugin-dir /absolute/path/to/implementation-plugin-0.1.2.zip
+claude --plugin-dir /absolute/path/to/implementation-plugin-0.1.3.zip
 ```
 
 Neither command installs the plugin permanently. The archive must contain a
 valid plugin at its root. Claude Code 2.1.129 or later can also load a packaged
 `.zip` archive from a trusted URL for one session:
 
 ```bash
-claude --plugin-url https://example.com/implementation-plugin-0.1.2.zip
+claude --plugin-url https://example.com/implementation-plugin-0.1.3.zip
 ```
 
 This repository does not currently publish a `.zip` archive. Do not point

docs/maintainers.md

@@ -53,10 +53,12 @@ to reach installed users, update the synchronized package version deliberately
 and document the release. Do not bump versions merely to make local validation
 pass.
 
-Version `0.1.2` is the current package owner for typed continuation and blocked
-recovery. The frozen `tests/fixtures/program-bootstrap/v0.1.1/` tree remains
-historical compatibility evidence and must not be rewritten during a version
-sync.
+Version `0.1.3` is the current package owner for exact regular-file Delete,
+typed continuation, and blocked recovery. Synchronize the three manifest
+versions, validator constant, current archive examples, and exact test
+expectations without changing plugin identity or manifest field sets. The
+frozen `tests/fixtures/program-bootstrap/v0.1.1/` tree remains historical
+compatibility evidence and must not be rewritten during a version sync.
 
 ## Refresh platform instructions
 
@@ -157,6 +159,12 @@ consistent, reader-document links resolve, examples retain the expected command
 and invocation forms, forbidden package surfaces remain blocked, and the
 deterministic workflow contracts pass their unit tests.
 
+For 0.1.3, keep focused application-path coverage for descriptor-bound
+same-filesystem Delete, retained quarantine receipts, v2 result-bound review and
+approval, immediate and later continuation, multi-rollover tombstones, explicit
+recreation, interrupted-prefix recovery, and legacy v1 reads. A native-Windows
+skip must remain visible rather than becoming an unqualified platform claim.
+
 They do not prove:
 
 - Claude runtime loading;

docs/reference.md

@@ -43,6 +43,17 @@ observation, path dispositions, and preserved user work. New-program status
 cannot become authorized until this baseline and its plan-bound action
 authorization are durable.
 
+Version 0.1.3 keeps accepted v1 baselines for `Create`, `Modify`, and `Preserve`.
+The v2 family adds exact regular-file `Delete`, including the original file
+identity and a deterministic descriptor-bound quarantine allocation.
+
+### Product-path result
+
+The ordered v2 result for every exact-file operation. A successful Delete is an
+`absent` product-path state with no product digest and an exact receipt for the
+retained quarantine bytes. Absence is therefore evidence-bound, not inferred
+from a missing pathname.
+
 ### Workspace binding
 
 The approved writable repository path, branch, base, current head, and recorded
@@ -95,6 +106,12 @@ remain owned by Plan A. Plan B adds exact `accept-continue`, the distinct
 Final programs reuse the unchanged Plan A closure transaction and derive paths
 from `implementation-closure-storage/v1`.
 
+Version 0.1.3 adds the setup/envelope v2 Delete family. The same ordered
+product-path result is bound through execution transition, review, diff
+acceptance, continuation, rollover, and discovery. An inherited absence remains
+a tombstone until a successor exact plan explicitly owns `Create`; retained
+quarantine evidence is not disposed of by recreation.
+
 Every typed transaction writes controlling status last and adopts only
 byte-identical prefixes. A divergent prefix stops for recovery without cleanup.
 
@@ -104,7 +121,7 @@ before relying on an earlier state.
 ## Approval modes
 
 Approval modes define routine interruption policy. New-model typed dispositions
-in version 0.1.2 always offer `accept-stop` and conditionally offer exact
+in version 0.1.3 always offer `accept-stop` and conditionally offer exact
 `accept-continue` for one satisfied successor. Modes do not grant action authority
 or automatic successor rollover. Legacy `approval:full` and
 `approval:full-diff` modes retain their automatic acceptance behavior.
@@ -153,6 +170,8 @@ The workflow stops instead of guessing when it finds:
 - more than one possible program or workspace;
 - a source, plan, approval, status, brief, handoff, or packet digest mismatch;
 - a branch, base, head, path, or pre-existing-work observation that has drifted;
+- an unsafe, protected, changed, cross-device, symlinked, or unsupported Delete
+  source or quarantine allocation;
 - an active or conflicted Git operation;
 - a requested transition that is not legal from the current state;
 - missing, expired, revoked, rejected, ambiguous, or mismatched authority;
@@ -177,6 +196,12 @@ The bundled scripts can validate schemas, exact bindings, digests, declared
 state transitions, file constraints, deterministic packet structure, and
 specific local command evidence supplied to them.
 
+For Delete, they can establish exact regular-file path removal by a local
+same-filesystem rename into retained quarantine and verify the resulting
+tombstone chain. They do not perform secure erasure, dispose of quarantine,
+prove requirement-level terminal evidence, or close the program; those latter
+contracts remain PLUG-002 work.
+
 They do not prove that a reviewer was genuinely independent, a human approval
 was well informed, a design is semantically correct, a live service behaves as
 expected, or an external action occurred. Those claims still need evidence from