Delete the caller's own drafts that a just-written review record consumed
Contract §5(a). Called by the console once POST …/review-record has already answered 201 — never from inside that insert. Verifies review_record_id names a record on THIS sealed submission, verifies every id in ids is an item id of that record’s findings or corrections, then deletes exactly those drafts for the caller’s own owner scope.
RECORDS what one human reviewer has typed about this exact sealed subject and has NOT yet recorded.
DOES NOT ESTABLISH anything: not that the reviewer read the package, not that the note is right, not that the policy is correct, and not that the source is true or complete. A draft finding is a working note, not evidence — it is excluded from every digest, every receipt, every export and every research record, and no receipt binds one. A judgment becomes evidence only when its author submits a review record through the unchanged review-record route.
Your own notes only. A co-reviewer on the same submission never sees them, because showing one reviewer another’s working notes would pre-load the second reader. Naming another reviewer’s note returns 404 rather than 403: 403 would confirm that it exists.
Requires an authenticated human-session principal. An API-key principal that holds the policies:read or policies:write scope this route declares is refused 403 HUMAN_PRINCIPAL_REQUIRED at the handler; one lacking that scope is refused 403 FORBIDDEN one step earlier, by the scope gate. A machine has no working notes on a human review. This route is deliberately NOT in the humanGovernanceAct class that gates reject and ratification: a note is not a governance act, nothing transitions and nothing is recorded.
Reads meshqu.review_records; never writes it. This route is the one place contract §6 allows to read BOTH tables, because the invariant §6 states is one-way: the RECORD route never reads the draft store. Nothing here changes the record, and nothing here could — ReviewRecordRepo exposes no update or delete method at all.
Refuses whole, never partially. An unknown or cross-submission review_record_id is 404. Any id in ids that is not an item of that record is 422, naming it. Either every named draft is removed, or none is — there is no path that deletes some and refuses others.
Idempotent. An id that names a real item of the record but no longer names an existing draft (already consumed by an earlier call, or separately discarded by its owner) is not an error: it is absent from the response’s ids and not counted in deleted, both of which can therefore be smaller than the request’s ids.length. A retried consume after a lost response is therefore safe to repeat, and its response names nothing it did not remove.
Authorizations
MeshQu API key passed as a bearer token: Authorization: Bearer mqu_…. Mint one in the console (Settings → API keys).
Tenant UUID for multi-tenant isolation. Required on all authenticated routes — validated before authentication (middleware/tenant.ts), so a missing or non-UUID header returns 400 (MISSING_TENANT_ID / INVALID_TENANT_ID) before the API key is checked.
Path Parameters
Policy id. The submission must belong to it, or the request is a 404.
The sealed submission the note is about. This is the review IDENTITY — not the policy version, which is a mutable container that yields many sealed subjects over time.
Body
Deletes the caller's own drafts that a just-written review record consumed. RECORDS that the owner is done with these notes now that they have become part of an immutable record. DOES NOT ESTABLISH anything about the record itself — it is already written and immutable by the time this route is ever called, and this route cannot touch it.
Deletes the caller's own drafts that a just-written review record consumed. RECORDS that the owner is done with these notes now that they have become part of an immutable record. DOES NOT ESTABLISH anything about the record itself — it is already written and immutable by the time this route is ever called, and this route cannot touch it.
The id POST …/review-record returned. Read-only: this route reads meshqu.review_records to confirm the record exists for THIS submission and that every id below is really one of its items — it never writes to that table, and nothing about the record changes because of this call.
The draft ids to delete — the same ids the reviewer submitted as finding/correction item ids, because contract §5 fixes them as one and the same string. Every id must name an item of the record above, or the request is refused 422 naming the one that does not, and NOTHING is deleted — not the ids that did resolve, either.
11 - 200^[A-Za-z0-9._:-]{1,200}$Response
The named drafts are gone. Nothing in the review record they became is touched — this route never writes to meshqu.review_records — and a draft NOT named here (one the reviewer did not submit, or already discarded) is untouched too.
The named drafts are gone. Nothing in the review record they became is touched — this route never writes to meshqu.review_records — and a draft NOT named here (one the reviewer did not submit, or already discarded) is untouched too.
The ids that were actually deleted, as the DELETE reported them — NOT an echo of the request. Every id the request named either resolved to a draft of the record (and was removed) or named no existing draft at all (already consumed by an earlier call, or separately discarded by its owner), in which case it is absent here. There is no partial refusal: an id that is not an item of the record is 422 and nothing is deleted. Order is the database's, not the request's.
The length of ids above — the same answer counted, never a second one.
x >= 0