Article review comments: only the author or a Super Admin deletes one, and the delete is logged (D617)

[guillaumelauzier]

S1: Any admin can silently delete any review comment on an article. Decision D617. No migration. Found by #1165's audit (area 7, comment deletion).

What is true on main

• The route. DELETE /api/admin/articles/comments/:cid (cloudflare-worker/src/routes/admin_articles.ts) checks only requireAdmin, hard-deletes the row, and always answers {ok: true}, even for an id that does not exist.
• Who loses it. Authors see these comments (routes/articles.ts), so a delete removes the feedback from their view too. Nothing logs it.
• The alternative. Resolving a comment is the non-destructive path, and it already exists.

The work

1. Who may delete: the comment's author (author_id), or a Super Admin. Anyone else gets 403 not_your_comment.
2. An unknown id gets a 404 comment_not_found, never {ok: true}.
3. Each delete is logged through logAdminAction as article_comment_deleted, with the article and comment ids. The comment's text is not logged.
4. D617 records the rule.

Files this task owns

• cloudflare-worker/src/routes/admin_articles.ts (the comment delete only)
• new Worker tests
• documentation/architecture/decisions/D617.md

Do not add a Delete control to the review page. Its design is requested on #1165 (area 7, item 4).

Done when

• Tests cover:
  • the author deletes;
  • a Super Admin deletes;
  • another admin is refused with 403;
  • an unknown id gets a 404;
  • one audit row per delete, without the text.
• Every new assertion is mutation-checked.

---

Generated by Claude Code

[guillaumelauzier]

S1: Moved from S15 to S16, the owner's call (2026-10-06). S15: do not start it; it is S16's now.

• Where it stands. It was state:ready: no STATUS, no branch and no PR, so S16 starts from the latest main.
• The spec, its decision number and any migration number stand as written above.
• S16's queue, oldest first, one at a time: Colleague seats: the invite reaches the colleague, and accepting never turns an admin into an investor (D611) #1311, Identity data: an admin reading a KYC record or a partner profile is audit-logged, as opening the ID document already is (D612) #1312, Contract document types: saving a draft for a published type no longer changes the live type; publishing does (D615, migration 416) #1313, Article review comments: only the author or a Super Admin deletes one, and the delete is logged (D617) #1314, Decision journal: record when a thesis is edited after its outcome (D618, migration 415) #1315, Remove five dead client methods: one has no Worker route, one always fails, three repeat a method in use (D616) #1316.

---

Generated by Claude Code