docs: token actor, connection deleted_at and CSRF decisions; follow-ups

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/DECISIONS.md

@@ -4,6 +4,24 @@ Append-only. Never edit or delete an entry. Supersede it with a new one that lin
 One entry per decision a future maintainer would otherwise have to reverse-engineer.
 No index: `grep -n '^## ' docs/DECISIONS.md` lists every entry (date, title, line number).
 
+## 2026-10-30: Token actor in history, connection deleted_at, CSRF on every browser write
+**Status:** accepted. Supersedes the **Actor**, **CSRF** and **Deleted connections** bullets of
+"HTTP API: auth modes, CSRF header, error mapping, actor" below.
+**Context:** Task 16 fix round 1 (controller rulings).
+**Decision:**
+- **Actor vs. owner.** API writes pass actor `token:<name>` for Bearer requests and `"user"` for sessions, so history
+  shows which script changed what (spec §6.9). `field_sources` stores `fieldOwner(actor)`: every actor that does not start
+  with `plugin:` is stored as `"user"`. A token edit is the user's edit, and syncs file a pending change instead of
+  overwriting it. List ownership, which is read from history, applies the same mapping.
+- **CSRF.** `X-Requested-With: sttracker` is required on every non-GET request that has no Bearer token, including the
+  `auth: "none"` routes login and register (login CSRF). JSON-body routes also require `Content-Type: application/json`
+  (415 `unsupported_media_type` otherwise), so a cross-site simple form post cannot pass as JSON.
+- **Deleted connections** carry `source_connections.deleted_at` (migration 0003). `deleteConnection` sets it and still pauses
+  the connection and wipes its credentials. Listing, lookups, updates, the scheduler and the sync handler ignore deleted rows.
+  A user-paused connection without credentials is a normal, visible, resumable connection.
+- **Dev mode** (`Bun.serve({ development })`) is on only with `NODE_ENV=development` or `bun --hot` (detected through
+  `process.execArgv`; `Bun.argv` does not carry runtime flags). Everything else runs in production mode.
+
 ## 2026-10-30: HTTP API: auth modes, CSRF header, error mapping, actor
 **Status:** accepted
 **Context:** Task 16 (`apps/server`).