docs(sites): document restore, deleted-site retention, and MCP site tools

documentation-metadata.json

@@ -113,6 +113,16 @@
         "helm-charts": "6aff91c22411e641964774bcbb09e5265ac1250c"
       },
       "notes": "All four Sites access-control implementing PRs merged to main and deployed to production. Live-verified end to end: owner-only private access, distinct denied-vs-missing responses on the management API, the CLI's visibility/create/list/get/update/extend/delete commands, the shared-apex opt-in, stable Site ID and content URL across visibility and content changes, and the intentional full downgrade path."
+    },
+    "2026-10-09-sites-restore-released": {
+      "verifiedOn": "2026-10-09",
+      "sources": {
+        "lifecycle": "0cfc1a1436e5bbb325d299c79aee7246238d8d8e",
+        "lifecycle-ui": "c6750243dd1b458da4a9a89fc2695264cec7c7d6",
+        "lifecycle-cli": "9fbd757fac74ff05576121a5d99ef7663aaeb948",
+        "helm-charts": "6aff91c22411e641964774bcbb09e5265ac1250c"
+      },
+      "notes": "Sites soft delete, restore, Recently deleted view, deleted-site retention setting, MCP hosted site write tools, and creator-or-admin Environment teardown merged and deployed. Live-verified: delete then restore through UI, CLI 0.6.0, and MCP; deleted public sites return 404; cleanup purges after retention."
     }
   }
 }

documentation-style-baseline.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 3,
-  "updatedOn": "2026-09-23",
+  "updatedOn": "2026-10-09",
   "references": {
     "canonical": "ASD-STE100 Issue 9",
     "canonicalRules": [
@@ -69,8 +69,8 @@
     "/docs/api-authentication/api-keys": {
       "file": "src/pages/docs/api-authentication/api-keys.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-23",
-      "sha256": "6ab98c32c5f8ebf35d609cdb62d6d67820fbaa6cc9ece818537948ab86eb4aa6"
+      "reviewedOn": "2026-10-09",
+      "sha256": "474f3f6757f0a91793e3485b40c3a6f0091747a5debaf722e8d48e0a598c9c5f"
     },
     "/docs/api-authentication/overview": {
       "file": "src/pages/docs/api-authentication/overview.mdx",
@@ -111,8 +111,8 @@
     "/docs/features/api-environments": {
       "file": "src/pages/docs/features/api-environments.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-07-25",
-      "sha256": "12ea39615d56eeab2a02438c2addbe6ed863b3d6e0c6baf4caff672a5c3fa39a"
+      "reviewedOn": "2026-10-09",
+      "sha256": "973889ba8bb7a0fbfe61f9845747f08d4350644d381b11c6d1b7bbb3f733917f"
     },
     "/docs/features/authentication": {
       "file": "src/pages/docs/features/authentication.mdx",
@@ -135,8 +135,8 @@
     "/docs/features/cli": {
       "file": "src/pages/docs/features/cli.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-22",
-      "sha256": "0f57d131ad05effbf05847828dd7f30d8b5641c5ecde54af181c3aec6821e15b"
+      "reviewedOn": "2026-10-09",
+      "sha256": "b874b693d8a1acd30209d3351b5a64d4799415e21d4e73844c812908aae1bd5d"
     },
     "/docs/features/cli-telemetry": {
       "file": "src/pages/docs/features/cli-telemetry.mdx",
@@ -177,8 +177,8 @@
     "/docs/features/mcp-server": {
       "file": "src/pages/docs/features/mcp-server.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-22",
-      "sha256": "70ab60a321461fb609365c7184ad40fd7450e1ae68271748681b87be80d7e699"
+      "reviewedOn": "2026-10-09",
+      "sha256": "68a24b2233654003826b9979499e26ab36fc84de01c7ec09b2ba3795930513f9"
     },
     "/docs/features/native-helm-deployment": {
       "file": "src/pages/docs/features/native-helm-deployment.mdx",
@@ -201,8 +201,8 @@
     "/docs/features/sites": {
       "file": "src/pages/docs/features/sites.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-23",
-      "sha256": "7a1bbdb4b545c7fcba428fc4f4eaa336ee6f556916ee4cb9f2371203cdfaf1e8"
+      "reviewedOn": "2026-10-09",
+      "sha256": "1b20228a0ac155a39926073b6d26128df720a59acb13c1463ca05cb000472ca8"
     },
     "/docs/features/template-variables": {
       "file": "src/pages/docs/features/template-variables.mdx",
@@ -273,8 +273,8 @@
     "/docs/operations/configuration": {
       "file": "src/pages/docs/operations/configuration.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-22",
-      "sha256": "fd1c2f4537187df8dfced9799dec480e5754c6ba519f548d244f65f66666717f"
+      "reviewedOn": "2026-10-09",
+      "sha256": "149172077735fcbd20dfa1bff1647708ff01c785bf16327169c9902e6601b33e"
     },
     "/docs/operations/day-two": {
       "file": "src/pages/docs/operations/day-two.mdx",

public/llms.txt

@@ -31,23 +31,23 @@ This index is generated from the human documentation. Follow the linked page for
 - [Native Helm deployment](https://uselifecycle.com/docs/features/native-helm-deployment.md): Deploy Services with Helm directly in Kubernetes without an external CI/CD deployment pipeline. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Cloud secrets](https://uselifecycle.com/docs/features/secrets.md): Reference External Secrets Operator values from Lifecycle Services and native Helm deployments. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Environment expiration and cleanup](https://uselifecycle.com/docs/features/environment-ttl.md): Understand how Lifecycle cleans up pull-request environments and expires API-created environments. _(audience: application-developer, platform-operator, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [API-created Environments](https://uselifecycle.com/docs/features/api-environments.md): Create branch-based Lifecycle Environments without a pull request. Then, track, extend, redeploy, or tear them down. _(audience: api-user, application-developer; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-23; baseline: 2026-09-22-sites-access-control-released)_
+- [API-created Environments](https://uselifecycle.com/docs/features/api-environments.md): Create branch-based Lifecycle Environments without a pull request. Then, track, extend, redeploy, or tear them down. _(audience: api-user, application-developer; last verified: 2026-10-09; baseline: 2026-10-09-sites-restore-released)_
+- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-10-09; baseline: 2026-10-09-sites-restore-released)_
 - [Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent.md): Investigate a Lifecycle Environment, examine evidence, and do approved recovery tasks from the Environment details page. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Configure Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent-configuration.md): Configure models, instructions, tools, approvals, and repository overrides for Lifecycle Agent from Settings. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent Sessions](https://uselifecycle.com/docs/features/agent-sessions.md): Start, examine, and continue repository work with Lifecycle Agent in an isolated workspace. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent administration](https://uselifecycle.com/docs/features/agent-administration.md): Administer Lifecycle Agent availability, models, instructions, permissions, tools, workspaces, and session audit. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent workspace backends](https://uselifecycle.com/docs/features/workspace-backends.md): Compare and safely activate the runtime backend used for new Lifecycle Agent workspaces. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Connect external MCP servers](https://uselifecycle.com/docs/features/mcp-integration.md): Add administrator-approved Model Context Protocol servers and complete authentication for each Lifecycle Agent user. _(audience: agent-user, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Lifecycle MCP](https://uselifecycle.com/docs/features/mcp-server.md): Enable Lifecycle MCP, connect an OAuth client, and use Lifecycle tools with existing user permissions. _(audience: agent-user, administrator, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
-- [CLI (lfc)](https://uselifecycle.com/docs/features/cli.md): Install and use the Lifecycle CLI to examine Environments, manage Services, stream logs, and validate configuration. _(audience: application-developer, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
+- [Lifecycle MCP](https://uselifecycle.com/docs/features/mcp-server.md): Enable Lifecycle MCP, connect an OAuth client, and use Lifecycle tools with existing user permissions. _(audience: agent-user, administrator, platform-operator; last verified: 2026-10-09; baseline: 2026-10-09-sites-restore-released)_
+- [CLI (lfc)](https://uselifecycle.com/docs/features/cli.md): Install and use the Lifecycle CLI to examine Environments, manage Services, stream logs, and validate configuration. _(audience: application-developer, platform-operator; last verified: 2026-10-09; baseline: 2026-10-09-sites-restore-released)_
 - [Lifecycle CLI telemetry](https://uselifecycle.com/docs/features/cli-telemetry.md): Understand the pseudonymous command-usage event sent by lfc, its destination, and how to opt out. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Use the Lifecycle UI](https://uselifecycle.com/docs/features/lifecycle-ui.md): Use the web UI to find Environments, examine Services and logs, run actions, and examine webhooks. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
 ## API authentication
 
 - [API authentication](https://uselifecycle.com/docs/api-authentication/overview.md): Select a supported authentication method for Lifecycle v2 API requests and understand typical authorization failures. _(audience: api-user, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [API keys](https://uselifecycle.com/docs/api-authentication/api-keys.md): Create, scope, use, rotate, and revoke personal or service API keys for authenticated Lifecycle v2 requests. _(audience: api-user, administrator; last verified: 2026-09-23; baseline: 2026-09-22-sites-access-control-released)_
+- [API keys](https://uselifecycle.com/docs/api-authentication/api-keys.md): Create, scope, use, rotate, and revoke personal or service API keys for authenticated Lifecycle v2 requests. _(audience: api-user, administrator; last verified: 2026-10-09; baseline: 2026-10-09-sites-restore-released)_
 
 ## HTTP API
 
@@ -81,7 +81,7 @@ This index is generated from the human documentation. Follow the linked page for
 ## Operations
 
 - [Lifecycle architecture](https://uselifecycle.com/docs/operations/architecture.md): Understand how requests become Lifecycle Environments and plan dependencies, security controls, availability, and recovery. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Runtime configuration surfaces](https://uselifecycle.com/docs/operations/configuration.md): Select a supported UI, API, Helm, or repository configuration surface and verify each change. _(audience: platform-operator, administrator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
+- [Runtime configuration surfaces](https://uselifecycle.com/docs/operations/configuration.md): Select a supported UI, API, Helm, or repository configuration surface and verify each change. _(audience: platform-operator, administrator; last verified: 2026-10-09; baseline: 2026-10-09-sites-restore-released)_
 - [Security boundaries](https://uselifecycle.com/docs/operations/security.md): Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment. _(audience: platform-operator; last verified: 2026-09-23; baseline: 2026-09-22-sites-access-control-released)_
 - [Monitor Lifecycle](https://uselifecycle.com/docs/operations/monitoring.md): Interpret health endpoints, verify end-to-end operation, and collect safe diagnostic data for stuck work. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Day-two operations](https://uselifecycle.com/docs/operations/day-two.md): Plan Lifecycle upgrades, backups, rollback decisions, recovery validation, and uninstall. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_

src/pages/docs/api-authentication/api-keys.mdx

@@ -4,8 +4,8 @@ description: Create, scope, use, rotate, and revoke personal or service API keys
 audience:
   - api-user
   - administrator
-lastVerified: "2026-09-23"
-verificationBaseline: "2026-09-22-sites-access-control-released"
+lastVerified: "2026-10-09"
+verificationBaseline: "2026-10-09-sites-restore-released"
 contentProfile: asd-ste100
 tags:
   - api
@@ -59,7 +59,7 @@ Lifecycle recognizes seven scopes:
 | `env:read`    | Read Environments and Builds                                         |
 | `env:write`   | Create or change Environments and Builds. Also satisfies `env:read`. |
 | `sites:read`  | Read sites. `sites:write` satisfies this scope.                      |
-| `sites:write` | Upload, replace, extend, or delete sites                             |
+| `sites:write` | Upload, replace, extend, delete, or restore sites                    |
 | `repos:read`  | Read repository information. `repos:write` satisfies this scope.     |
 | `repos:write` | Change supported repository configuration                            |
 | `env:admin`   | Legacy/reserved Environment administration                           |

src/pages/docs/features/api-environments.mdx

@@ -4,8 +4,8 @@ description: Create branch-based Lifecycle Environments without a pull request.
 audience:
   - api-user
   - application-developer
-lastVerified: "2026-07-24"
-verificationBaseline: "2026-07-24-comprehensive-audit"
+lastVerified: "2026-10-09"
+verificationBaseline: "2026-10-09-sites-restore-released"
 contentProfile: asd-ste100
 tags:
   - environments
@@ -116,6 +116,10 @@ extension values.
 
 ## Teardown and reuse
 
+Only the user who created the Environment or an administrator can tear it down.
+A personal API key can tear down only Environments that its owner created.
+A service API key can tear down Environments in its allowed repositories.
+
 Deletion queues teardown and returns `202`. Continue polling while the details
 route returns `200`. A subsequent `404` means teardown is complete. You can
 then reuse its vanity name.
@@ -127,7 +131,8 @@ cleanup](/docs/features/environment-ttl).
 ## Troubleshooting
 
 - `403`: The administrator disabled API Environments, the key lacks `env:write`,
-  or the repository does not match its constraint.
+  or the repository does not match its constraint. For teardown, you must be
+  the creator of the Environment or an administrator.
 - `404 repo_not_onboarded`: onboard the repository before creating the
   Environment.
 - `409 name_conflict`: select a different vanity name or wait for teardown.

src/pages/docs/features/cli.mdx

@@ -4,8 +4,8 @@ description: Install and use the Lifecycle CLI to examine Environments, manage S
 audience:
   - application-developer
   - platform-operator
-lastVerified: "2026-09-22"
-verificationBaseline: "2026-09-22-sites-access-control-released"
+lastVerified: "2026-10-09"
+verificationBaseline: "2026-10-09-sites-restore-released"
 contentProfile: asd-ste100
 tags:
   - cli
@@ -228,18 +228,24 @@ Only the owner can change a site.
 `--mine` selects ownership, and `--public` selects public sites.
 These filters cannot be combined.
 
+`--deleted` shows your deleted sites that you can restore.
+`--deleted` cannot be combined with `--public`.
+
 ```sh
 lfc sites create <file-or-dir> [--name <label>] [--visibility private|public] [--yes]
-lfc sites list [--mine | --public] [--search <text>]
+lfc sites list [--mine | --public | --deleted] [--search <text>]
 lfc sites get <id>
 lfc sites update <id> <file-or-dir>
 lfc sites visibility <id> private|public [--yes]
 lfc sites extend <id>                             # extend expiration
 lfc sites delete <id> --yes
+lfc sites restore <id>
 ```
 
 The CLI prints the site's `openUrl`.
 Changing visibility keeps the Site ID and content URL.
+After `delete`, the CLI shows the time until which you can restore the site.
+`restore` keeps the Site ID and URL.
 If a change returns `409`, fetch the site again before you retry.
 See [Sites](/docs/features/sites) for access rules and API details.
 

src/pages/docs/features/mcp-server.mdx

@@ -5,8 +5,8 @@ audience:
   - agent-user
   - administrator
   - platform-operator
-lastVerified: "2026-09-22"
-verificationBaseline: "2026-09-22-sites-access-control-released"
+lastVerified: "2026-10-09"
+verificationBaseline: "2026-10-09-sites-restore-released"
 contentProfile: asd-ste100
 tags:
   - mcp
@@ -48,8 +48,8 @@ MCP does not grant access to an Environment, repository, Site, or action.
 ## Understand the available tools
 
 Lifecycle MCP groups its core tools into three capabilities. When Lifecycle
-Sites is enabled, clients also discover a fourth **View Hosted Sites**
-capability.
+Sites is enabled, clients also discover the **View Hosted Sites** and
+**Manage Hosted Sites** capabilities.
 
 ### Understand Environments
 
@@ -81,6 +81,8 @@ capability.
 | `extend_environment`    | Extends Environment expiration            |
 | `destroy_environment`   | Previews or destroys an exact Environment |
 
+Only the user who created an Environment or an administrator can destroy it.
+
 ### View Hosted Sites
 
 When Sites is enabled, these tools are available:
@@ -92,13 +94,36 @@ When Sites is enabled, these tools are available:
 
 <Callout type="info">
   These tools return the user's private sites and public sites. `mineOnly`
-  selects ownership rather than creator or updater email. Sites tools provide
-  read access only.
+  selects ownership rather than creator or updater email. `deleted` lists the
+  user's deleted sites that the user can restore.
 </Callout>
 
 Results include visibility and `openUrl`.
 A private site's URL does not grant access to another user.
-The tools do not publish sites or send email invitations.
+
+### Manage Hosted Sites
+
+When Sites is enabled and **Allow changes** is on, these tools are available:
+
+| Tool                  | Result                                      |
+| --------------------- | ------------------------------------------- |
+| `create_site`         | Publishes one text file as a new Site       |
+| `update_site_content` | Replaces the content of an owned Site       |
+| `set_site_visibility` | Makes an owned Site private or public       |
+| `extend_site`         | Extends the expiration of an owned Site     |
+| `delete_site`         | Deletes an owned Site                       |
+| `restore_site`        | Restores an owned Site during its retention |
+
+New Sites are private by default.
+`create_site` and `update_site_content` accept one text file: HTML, Markdown, text, JSON, CSV, XML, or SVG.
+They do not accept ZIP archives, more than one file, or binary files.
+To publish a Site with assets, use the UI or `lfc sites create`.
+
+`set_site_visibility`, `delete_site`, and `restore_site` require the current `expectedAccessRevision`.
+For `set_site_visibility` and `delete_site`, get it from `get_site`.
+For `restore_site`, get it from `list_sites` with `deleted`.
+A deleted Site stays restorable until `restorableUntil`.
+The tools do not send email invitations.
 
 An administrator can turn off all change tools. When change tools are off,
 clients do not discover them, and Lifecycle rejects their invocation.