[EPIC] Deletion history core

[kirich1409]

Context

RemovalLogger actor owning JSONL (source of truth) + derived session manifests with .partial -> .json crash-consistent lifecycle. Structured invocation sanitisation. CSBackupSetItemExcluded on state and cache directories.

Goals

• RemovalLogger actor, single writer to JSONL.
• Batched fsync (P3): 10-50 items or 100 ms timer.
• Session manifest lifecycle with .partial atomic rename.
• Startup reconcile: .partial -> aborted, counts recomputed from JSONL.
• Structured invocation log with allowlist + token-redact.
• CSBackupSetItemExcluded at first run.
• File permissions 0600 / 0700.

Child tasks

Will be added as sub-issues after task batch.

Exit criteria

• AC-22, AC-28 pass; crash-injection test reconciles cleanly.

Related documents

n/a