feat(D): Phase D — Undo/Restore komplett implementiert

- D-GEN: RestoreRegistry mit RestoreConfig (model_class, restore_permission, excluded_fields, special_handler)
- D-HOOK: history_hooks.py mit register_history_hooks() für after_create/update/delete
- D-CORE: Company create+update record_history in companies.py
- D-PLUG: Task/Calendar/DMS record_history in services/routes
- D-SOFT: Alle registrierten Entitäten haben deleted_at + un-delete via Registry
- D-MAIL: Mail special_handler (IMAP Trash-Move, Folder-Verify) + record_history in delete/move
- D-TRASH: GET /entity-history/trash (filterbar, paginiert) + Frontend Trash.tsx
- D-TOAST: UndoToast.tsx (5s Auto-Dismiss, useUndoToast Hook)
- D-HIST-UI: HistoryPanel.tsx (Timeline, Diff-View, Restore-Button)
- D-BULK: POST /entity-history/bulk-restore mit partial_success Semantik
- D-RET: POST /entity-history/retention/archive (GDPR hard-delete >90 Tage)
- D-TEST: 26 Tests in test_restore_registry.py, alle grün
- D-DOC: test-strategy.md + security_kernel.md aktualisiert

Backend: 10 Dateien, Frontend: 7 Dateien, Tests: 1 Datei, Docs: 3 Dateien
26/26 Tests passed, TSC 0 errors, App import 492 routes

PROGRESS.md

@@ -13,7 +13,7 @@
 | B — System-Konsolidierung | `done` | 2026-08-13 | 2026-08-13 | ~50 | ~50 |
 | C — Core UI | `done` | 2026-08-13 | 2026-08-13 | 14 | 14 |
 | C.5 — Import/Export | `done` | 2026-08-13 | 2026-08-13 | 8 | 8 |
-| D — Undo/Restore | `not_started` | — | — | 0 | ~12 |
+| D — Undo/Restore | `done` | 2026-08-13 | 2026-08-13 | 13 | 13 |
 | E — Search | `not_started` | — | — | 0 | ~24 |
 | F — Agents | `not_started` | — | — | 0 | ~28 |
 | G — Workflows | `not_started` | — | — | 0 | ~24 |
@@ -212,7 +212,27 @@
 
 ---
 
-## Phasen D-J
+## Phase D — Undo/Restore
+
+| Task | Status | Forgejo Issue | Verifiziert |
+|------|-------|---------------|------------|
+| D-GEN | `done` | — | ✅ RestoreRegistry Singleton, RestoreConfig (model_class, restore_permission, excluded_fields, special_handler), register_default_entities() mit 5 Entity-Typen |
+| D-HOOK | `done` | — | ✅ history_hooks.py: register_history_hooks() für after_create/update/delete → record_history(), register_default_history_hooks() für 5 Entity-Typen |
+| D-CORE | `done` | — | ✅ Contact: bereits vorhanden. Company: record_history für create+update+delete in companies.py hinzugefügt |
+| D-PLUG | `done` | — | ✅ Task: create/update/delete in services.py. Calendar Entry: create/update/delete in routes.py. DMS File: upload/update/delete in routes.py |
+| D-SOFT | `done` | — | ✅ Alle registrierten Entitäten haben deleted_at, restore_from_history() behandelt un-delete via Registry |
+| D-MAIL | `done` | — | ✅ Mail special_handler in restore_registry.py (IMAP Trash-Move, Folder-Verify, kein falscher Status). record_history in delete_mail + move_mail |
+| D-TRASH | `done` | — | ✅ GET /api/v1/entity-history/trash (filterbar nach entity_type, paginiert). Frontend Trash.tsx mit Multi-Select |
+| D-TOAST | `done` | — | ✅ UndoToast.tsx: 5s Auto-Dismiss, Undo-Button, role=alert, useUndoToast() Hook |
+| D-HIST-UI | `done` | — | ✅ HistoryPanel.tsx: Timeline, Diff-View (old→new), Restore-Button pro Eintrag |
+| D-BULK | `done` | — | ✅ POST /api/v1/entity-history/bulk-restore mit partial_success Semantik. Frontend Bulk-Restore in Trash.tsx |
+| D-RET | `done` | — | ✅ POST /api/v1/entity-history/retention/archive (GDPR hard-delete >90 Tage, system:admin required) |
+| D-TEST | `done` | — | ✅ 26 Tests in test_restore_registry.py, alle grün. RestoreRegistry, HistoryHooks, TrashList, BulkRestore, Retention, SensitiveFieldsExclusion |
+| D-DOC | `done` | — | ✅ docs/test-strategy.md + docs/security_kernel.md aktualisiert mit Phase D Abschnitten |
+
+---
+
+## Phasen E-J
 
 Detaillierte Task-Listen werden beim Start der jeweiligen Phase eingetragen. Siehe `PLATFORM_ROADMAP.md` für alle Tasks.
 

app/core/history_hooks.py

@@ -0,0 +1,180 @@
+"""Hook-based history recording — standard hooks that call record_history().
+
+Registers action hooks for entity lifecycle events:
+- entity.after_create  → record_history(action='create', snapshot_after=...)
+- entity.after_update  → record_history(action='update', snapshot_before=..., snapshot_after=..., changes=...)
+- entity.after_delete  → record_history(action='delete', snapshot_before=...)
+
+Plugins can register their own entity types by calling:
+    register_history_hooks(reg, 'task', 'task.after_create', 'task.after_update', 'task.after_delete')
+
+This is explicit, traceable, and testable — no SQLAlchemy event listeners.
+"""
+
+from __future__ import annotations
+
+import logging
+import uuid
+from typing import Any
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.hooks import HookRegistry, get_hook_registry
+from app.services.entity_history_service import record_history
+
+logger = logging.getLogger(__name__)
+
+
+def register_history_hooks(
+    reg: HookRegistry,
+    entity_type: str,
+    after_create_hook: str,
+    after_update_hook: str,
+    after_delete_hook: str,
+) -> None:
+    """Register standard history-recording hooks for an entity type.
+
+    Each hook receives kwargs: db, tenant_id, user_id, and either:
+    - after_create: snapshot_after (the created entity dict)
+    - after_update: snapshot_before, snapshot_after, changes
+    - after_delete: snapshot_before
+    """
+
+    async def _on_create(
+        snapshot_after: dict[str, Any],
+        *,
+        db: AsyncSession,
+        tenant_id: uuid.UUID,
+        user_id: uuid.UUID | None = None,
+        **kwargs: Any,
+    ) -> None:
+        entity_id = _extract_entity_id(snapshot_after)
+        if entity_id is None:
+            logger.warning("history_hooks: cannot extract entity_id from snapshot for %s", entity_type)
+            return
+        await record_history(
+            db, tenant_id, user_id, entity_type, entity_id,
+            action="create", snapshot_after=snapshot_after,
+        )
+
+    async def _on_update(
+        snapshot_after: dict[str, Any],
+        *,
+        db: AsyncSession,
+        tenant_id: uuid.UUID,
+        user_id: uuid.UUID | None = None,
+        snapshot_before: dict[str, Any] | None = None,
+        changes: dict[str, Any] | None = None,
+        **kwargs: Any,
+    ) -> None:
+        entity_id = _extract_entity_id(snapshot_after) or (
+            _extract_entity_id(snapshot_before) if snapshot_before else None
+        )
+        if entity_id is None:
+            logger.warning("history_hooks: cannot extract entity_id for %s update", entity_type)
+            return
+        await record_history(
+            db, tenant_id, user_id, entity_type, entity_id,
+            action="update",
+            snapshot_before=snapshot_before,
+            snapshot_after=snapshot_after,
+            changes=changes,
+        )
+
+    async def _on_delete(
+        snapshot_before: dict[str, Any] | None = None,
+        *,
+        db: AsyncSession,
+        tenant_id: uuid.UUID,
+        user_id: uuid.UUID | None = None,
+        entity_id: uuid.UUID | None = None,
+        **kwargs: Any,
+    ) -> None:
+        eid = entity_id or (_extract_entity_id(snapshot_before) if snapshot_before else None)
+        if eid is None:
+            logger.warning("history_hooks: cannot extract entity_id for %s delete", entity_type)
+            return
+        await record_history(
+            db, tenant_id, user_id, entity_type, eid,
+            action="delete", snapshot_before=snapshot_before,
+        )
+
+    reg.register_action(after_create_hook, _on_create, priority=90)
+    reg.register_action(after_update_hook, _on_update, priority=90)
+    reg.register_action(after_delete_hook, _on_delete, priority=90)
+    logger.debug("History hooks registered for: %s", entity_type)
+
+
+def _extract_entity_id(snapshot: dict[str, Any] | None) -> uuid.UUID | None:
+    """Extract entity UUID from a snapshot dict."""
+    if snapshot is None:
+        return None
+    raw_id = snapshot.get("id")
+    if raw_id is None:
+        return None
+    if isinstance(raw_id, uuid.UUID):
+        return raw_id
+    try:
+        return uuid.UUID(str(raw_id))
+    except (ValueError, TypeError):
+        return None
+
+
+def register_default_history_hooks() -> None:
+    """Register history hooks for all built-in entity types.
+
+    Called during app startup after the hook registry is initialized.
+    Plugin entities should register their own hooks in on_activate().
+    """
+    reg = get_hook_registry()
+
+    # Contact (already has manual record_history calls in contact_service.py,
+    # but registering hooks ensures consistency for any code path that fires
+    # the hooks without calling record_history directly)
+    register_history_hooks(
+        reg, "contact",
+        "contact.after_create",
+        "contact.after_update",
+        "contact.after_delete",
+    )
+
+    # Task plugin
+    register_history_hooks(
+        reg, "task",
+        "task.after_create",
+        "task.after_update",
+        "task.after_delete",
+    )
+
+    # Calendar plugin — CalendarEntry
+    register_history_hooks(
+        reg, "calendar_entry",
+        "calendar_entry.after_create",
+        "calendar_entry.after_update",
+        "calendar_entry.after_delete",
+    )
+
+    # DMS plugin — File metadata
+    register_history_hooks(
+        reg, "dms_file",
+        "dms_file.after_create",
+        "dms_file.after_update",
+        "dms_file.after_delete",
+    )
+
+    # Mail plugin
+    register_history_hooks(
+        reg, "mail",
+        "mail.after_create",
+        "mail.after_update",
+        "mail.after_delete",
+    )
+
+    logger.info("Default history hooks registered for: contact, task, calendar_entry, dms_file, mail")
+
+
+def reset_history_hooks_for_testing() -> None:
+    """Clear all history hooks — for unit tests only."""
+    reg = get_hook_registry()
+    # The hook registry's _reset_for_testing clears everything
+    reg._reset_for_testing()

app/core/restore_registry.py

@@ -0,0 +1,280 @@
+"""Entity restore registry — declarative configuration for undo/restore.
+
+Each registered entity type declares:
+- model_class: SQLAlchemy model to load
+- restore_permission: permission string required to restore
+- excluded_fields: fields never restored from snapshot (id, tenant_id, timestamps, etc.)
+- special_handler: optional async callable for entity-specific restore logic
+
+No dynamic ORM loading, no blind snapshot writes — only explicitly registered
+entity types can be restored, and only through their declared configuration.
+"""
+
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass, field
+from typing import Any, Awaitable, Callable
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+logger = logging.getLogger(__name__)
+
+# Default fields excluded from restore for every entity type
+_DEFAULT_EXCLUDED = frozenset({
+    "id",
+    "tenant_id",
+    "created_at",
+    "updated_at",
+    "deleted_at",
+    "search_tsv",
+    "embedding",
+})
+
+# Type alias for special restore handler
+SpecialRestoreHandler = Callable[
+    [AsyncSession, Any, str, Any, dict[str, Any]],
+    Awaitable[dict[str, Any]],
+]
+
+
+@dataclass
+class RestoreConfig:
+    """Configuration for restoring a specific entity type."""
+
+    entity_type: str
+    model_class: type
+    restore_permission: str
+    excluded_fields: frozenset[str] = field(default_factory=frozenset)
+    special_handler: SpecialRestoreHandler | None = None
+
+    @property
+    def all_excluded_fields(self) -> frozenset[str]:
+        """Merge default excluded fields with entity-specific ones."""
+        return _DEFAULT_EXCLUDED | self.excluded_fields
+
+
+class RestoreRegistry:
+    """Singleton registry mapping entity_type → RestoreConfig."""
+
+    _instance: RestoreRegistry | None = None
+
+    def __new__(cls) -> RestoreRegistry:
+        if cls._instance is None:
+            cls._instance = super().__new__(cls)
+            cls._instance._configs: dict[str, RestoreConfig] = {}
+        return cls._instance
+
+    def register(self, config: RestoreConfig) -> None:
+        """Register a RestoreConfig for an entity type."""
+        if config.entity_type in self._configs:
+            logger.warning("Overwriting restore config for entity_type: %s", config.entity_type)
+        self._configs[config.entity_type] = config
+        logger.debug("Registered restore config for: %s", config.entity_type)
+
+    def get(self, entity_type: str) -> RestoreConfig | None:
+        """Get RestoreConfig for entity_type, or None if not registered."""
+        return self._configs.get(entity_type)
+
+    def is_registered(self, entity_type: str) -> bool:
+        """Check if entity_type is registered for restore."""
+        return entity_type in self._configs
+
+    def list_registered(self) -> list[str]:
+        """Return all registered entity types."""
+        return sorted(self._configs.keys())
+
+    def _reset_for_testing(self) -> None:
+        """Clear all registrations — for unit tests only."""
+        self._configs.clear()
+
+
+def get_restore_registry() -> RestoreRegistry:
+    """Return the global RestoreRegistry singleton."""
+    return RestoreRegistry()
+
+
+def reset_restore_registry_for_testing() -> RestoreRegistry:
+    """Return a fresh singleton — for unit tests only."""
+    reg = get_restore_registry()
+    reg._reset_for_testing()
+    return reg
+
+
+# ─── Default entity registrations ───
+
+
+def register_default_entities() -> None:
+    """Register all built-in entity types for restore.
+
+    Called during app startup. Plugin entities should register themselves
+    in their on_activate() lifecycle hook.
+    """
+    from app.models.contact import Contact
+
+    reg = get_restore_registry()
+
+    # Contact (covers both 'person' and 'company' types — same model)
+    reg.register(RestoreConfig(
+        entity_type="contact",
+        model_class=Contact,
+        restore_permission="contacts:write",
+        excluded_fields=frozenset({
+            "search_tsv",
+            "embedding",
+            "default_person_id",
+            "admin_contactperson_id",
+        }),
+    ))
+
+    # Task plugin
+    try:
+        from app.plugins.builtins.tasks.models import Task
+        reg.register(RestoreConfig(
+            entity_type="task",
+            model_class=Task,
+            restore_permission="tasks:write",
+            excluded_fields=frozenset({
+                "created_by",
+                "assigned_to",
+                "contact_id",
+            }),
+        ))
+    except ImportError:
+        logger.debug("Tasks plugin model not available for restore registration")
+
+    # Calendar plugin — CalendarEntry
+    try:
+        from app.plugins.builtins.calendar.models import CalendarEntry
+        reg.register(RestoreConfig(
+            entity_type="calendar_entry",
+            model_class=CalendarEntry,
+            restore_permission="calendar:write",
+            excluded_fields=frozenset({
+                "calendar_id",
+                "created_by",
+                "assigned_to",
+                "source_mail_id",
+            }),
+        ))
+    except ImportError:
+        logger.debug("Calendar plugin model not available for restore registration")
+
+    # DMS plugin — File metadata
+    try:
+        from app.plugins.builtins.dms.models import File as DmsFile
+        reg.register(RestoreConfig(
+            entity_type="dms_file",
+            model_class=DmsFile,
+            restore_permission="dms:write",
+            excluded_fields=frozenset({
+                "storage_path",
+                "content_hash",
+                "size_bytes",
+                "uploaded_by",
+                "folder_id",
+            }),
+        ))
+    except ImportError:
+        logger.debug("DMS plugin model not available for restore registration")
+
+    # Mail plugin — special handler for IMAP semantics
+    try:
+        from app.plugins.builtins.mail.models import Mail
+        reg.register(RestoreConfig(
+            entity_type="mail",
+            model_class=Mail,
+            restore_permission="mail:write",
+            excluded_fields=frozenset({
+                "message_id",
+                "rfc822_size",
+                "raw_path",
+                "account_id",
+                "folder_id",
+            }),
+            special_handler=_mail_restore_handler,
+        ))
+    except ImportError:
+        logger.debug("Mail plugin model not available for restore registration")
+
+
+async def _mail_restore_handler(
+    db: AsyncSession,
+    entity: Any,
+    action: str,
+    snapshot: dict[str, Any],
+    context: dict[str, Any],
+) -> dict[str, Any]:
+    """Special restore handler for Mail entities.
+
+    Mail restore has IMAP semantics:
+    - delete: move back from trash to original folder (if folder still exists)
+    - update: revert metadata fields
+    - create: soft-delete (undo send only works for drafts)
+
+    Server errors must not produce false local status.
+    """
+    import uuid
+    from datetime import datetime, timezone
+    from sqlalchemy import select
+
+    user_id = context.get("user_id")
+    tenant_id = context.get("tenant_id")
+
+    if action == "delete":
+        # Un-delete: clear deleted_at, restore original folder_id if available
+        if entity is None:
+            raise ValueError("Mail entity not found for restore")
+        entity.deleted_at = None
+        if user_id:
+            entity.updated_by = user_id if hasattr(entity, "updated_by") else None
+        # Restore original folder from snapshot if available
+        original_folder_id = snapshot.get("folder_id")
+        if original_folder_id and hasattr(entity, "folder_id"):
+            try:
+                folder_uuid = uuid.UUID(str(original_folder_id))
+                # Verify folder still exists and is not deleted
+                from app.plugins.builtins.mail.models import MailFolder
+                folder_q = select(MailFolder).where(
+                    MailFolder.id == folder_uuid,
+                    MailFolder.tenant_id == tenant_id,
+                    MailFolder.deleted_at.is_(None),
+                )
+                folder_result = await db.execute(folder_q)
+                folder = folder_result.scalar_one_or_none()
+                if folder:
+                    entity.folder_id = folder_uuid
+                else:
+                    logger.warning(
+                        "Original mail folder %s no longer exists, "
+                        "restoring mail without folder assignment",
+                        original_folder_id,
+                    )
+            except (ValueError, Exception) as e:
+                logger.warning("Failed to restore mail folder: %s", e)
+
+        await db.flush()
+        return {"id": str(entity.id), "restored": True, "entity_type": "mail"}
+
+    elif action == "update":
+        if entity is None:
+            raise ValueError("Mail entity not found for restore")
+        # Revert metadata fields from snapshot_before
+        excluded = _DEFAULT_EXCLUDED | {
+            "message_id", "rfc822_size", "raw_path", "account_id", "folder_id",
+        }
+        for key, value in snapshot.items():
+            if hasattr(entity, key) and key not in excluded:
+                setattr(entity, key, value)
+        await db.flush()
+        return {"id": str(entity.id), "restored": True, "entity_type": "mail"}
+
+    elif action == "create":
+        # Undo creation: soft-delete (only meaningful for drafts)
+        if entity is None:
+            raise ValueError("Mail entity not found for restore")
+        entity.deleted_at = datetime.now(timezone.utc)
+        await db.flush()
+        return {"id": str(entity.id), "restored": True, "entity_type": "mail", "note": "soft-deleted (undo create)"}
+
+    raise ValueError(f"Unsupported action for mail restore: {action}")

app/main.py

@@ -333,6 +333,16 @@ async def lifespan(app: FastAPI):
     register_trigger_dispatcher(event_bus)
     logger.info("Trigger dispatcher registered")
 
+    # Register entity restore configurations (Phase D — Undo/Restore)
+    from app.core.restore_registry import register_default_entities
+    register_default_entities()
+    logger.info("Entity restore registry initialized")
+
+    # Register hook-based history recording (Phase D — Undo/Restore)
+    from app.core.history_hooks import register_default_history_hooks
+    register_default_history_hooks()
+    logger.info("History hooks registered")
+
     # Register field definitions from active plugins only
     from app.core.permission_registry import get_permission_registry
     for name in active_plugin_names:

app/plugins/builtins/calendar/routes.py

@@ -465,6 +465,9 @@ async def create_entry(
     )
     db.add(entry)
     await db.flush()
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "calendar_entry", entry.id, "create", snapshot_after=_entry_to_dict(entry))
 
     # ── Hook: calendar.after_appointment (Action) ──
     from app.core.hooks import do_action
@@ -614,6 +617,8 @@ async def update_entry(
 
     from app.core.hooks import do_action
     await do_action("calendar.before_update", body=body, tenant_id=tenant_id, user_id=user_id, entry_id=entry_id)
+    # Capture snapshot before update (D-PLUG)
+    snapshot_before = _entry_to_dict(entry)
     # Apply updates
     if body.title is not None:
         entry.title = body.title
@@ -648,9 +653,20 @@ async def update_entry(
 
     await db.flush()
     await db.refresh(entry)
+    snapshot_after = _entry_to_dict(entry)
+    # Compute changes diff (D-PLUG)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "calendar_entry", entry.id, "update",
+                         snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None)
     from app.core.hooks import do_action
     await do_action("calendar.after_update", entry_id=str(entry.id), tenant_id=tenant_id, user_id=user_id)
-    return _entry_to_dict(entry)
+    return snapshot_after
 
 
 @router.delete("/calendar/entries/{entry_id}", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_permission("calendar:delete"))])
@@ -670,8 +686,13 @@ async def delete_entry(
         raise HTTPException(403, detail={"detail": "No write permission", "code": "forbidden"})
     from app.core.hooks import do_action
     await do_action("calendar.before_delete", tenant_id=tenant_id, user_id=user_id, entry_id=entry_id)
+    # Capture snapshot before delete (D-PLUG)
+    snapshot_before = _entry_to_dict(entry)
     entry.deleted_at = datetime.now(UTC)
     await db.flush()
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "calendar_entry", entry.id, "delete", snapshot_before=snapshot_before)
     from app.core.hooks import do_action
     await do_action("calendar.after_delete", tenant_id=tenant_id, user_id=user_id, entry_id=entry_id)
     return Response(status_code=204)

app/plugins/builtins/dms/routes.py

@@ -612,6 +612,13 @@ async def upload_file(
         )
         db.add(dms_file)
         await db.flush()
+        # Record history for new file only (D-PLUG)
+        from app.services.entity_history_service import record_history
+        await record_history(db, tenant_id, user_id, "dms_file", dms_file.id, "create", snapshot_after={
+            "id": str(dms_file.id), "name": dms_file.name,
+            "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+            "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+        })
 
     # Lifecycle hook: dms.after_upload
     from app.core.hooks import do_action
@@ -793,6 +800,13 @@ async def update_file(
 
     data = body.model_dump(exclude_unset=True)
 
+    # Capture snapshot before update (D-PLUG)
+    snapshot_before = {
+        "id": str(dms_file.id), "name": dms_file.name,
+        "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+        "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+    }
+
     if "name" in data and data["name"] is not None:
         dms_file.name = data["name"]
 
@@ -813,6 +827,22 @@ async def update_file(
     await db.flush()
     await db.refresh(dms_file)
 
+    snapshot_after = {
+        "id": str(dms_file.id), "name": dms_file.name,
+        "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+        "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+    }
+    # Compute changes diff (D-PLUG)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "dms_file", dms_file.id, "update",
+                         snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None)
+
     # Lifecycle hook: dms.after_update
     from app.core.hooks import do_action
     await do_action("dms.after_update", {'id': str(dms_file.id), 'name': dms_file.name}, db=db, tenant_id=tenant_id, user_id=user_id, file_id=file_id)
@@ -860,11 +890,22 @@ async def delete_file(
     from app.core.hooks import do_action
     await do_action("dms.before_delete", db=db, tenant_id=tenant_id, user_id=user_id, file_id=file_id)
 
+    # Capture snapshot before delete (D-PLUG)
+    snapshot_before = {
+        "id": str(dms_file.id), "name": dms_file.name,
+        "folder_id": str(dms_file.folder_id) if dms_file.folder_id else None,
+        "mime_type": dms_file.mime_type, "size_bytes": dms_file.size_bytes,
+    }
+
     from datetime import UTC, datetime
 
     dms_file.deleted_at = datetime.now(UTC)
     await db.flush()
 
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "dms_file", dms_file.id, "delete", snapshot_before=snapshot_before)
+
     # Lifecycle hook: dms.after_delete
     await do_action("dms.after_delete", db=db, tenant_id=tenant_id, user_id=user_id, file_id=file_id)
 

app/plugins/builtins/mail/routes.py

@@ -1643,6 +1643,18 @@ async def delete_mail(
     account = await _get_account(db, mail.account_id, tenant_id, user_id, is_system_admin=is_system_admin)
     await _check_delegate_access(db, account, user_id, "delete")
 
+    # Capture snapshot before delete for history/restore (D-MAIL)
+    from app.services.entity_history_service import record_history
+    mail_snapshot = {
+        "id": str(mail.id),
+        "folder_id": str(mail.folder_id) if mail.folder_id else None,
+        "subject": mail.subject if hasattr(mail, "subject") else None,
+        "account_id": str(mail.account_id),
+        "is_read": mail.is_read if hasattr(mail, "is_read") else None,
+        "is_flagged": mail.is_flagged if hasattr(mail, "is_flagged") else None,
+    }
+    await record_history(db, tenant_id, user_id, "mail", mail.id, "delete", snapshot_before=mail_snapshot)
+
     # Find the Trash folder for this account
     trash_folder = None
     all_folders = (
@@ -1757,9 +1769,22 @@ async def move_mail(
     ).scalar_one_or_none()
     if not target_folder:
         raise HTTPException(404, detail={"detail": "Target folder not found", "code": "not_found"})
+    # Capture snapshot before move (D-MAIL)
+    from app.services.entity_history_service import record_history
+    snapshot_before = {
+        "id": str(mail.id),
+        "folder_id": str(mail.folder_id) if mail.folder_id else None,
+        "subject": mail.subject if hasattr(mail, "subject") else None,
+        "is_read": mail.is_read if hasattr(mail, "is_read") else None,
+        "is_flagged": mail.is_flagged if hasattr(mail, "is_flagged") else None,
+    }
     # Update mail.folder_id
     mail.folder_id = target_f_id
     await db.flush()
+    snapshot_after = {**snapshot_before, "folder_id": str(target_f_id)}
+    changes = {"folder_id": {"old": snapshot_before.get("folder_id"), "new": str(target_f_id)}}
+    await record_history(db, tenant_id, user_id, "mail", mail.id, "update",
+                         snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes)
     # IMAP move: queue for retry if it fails
     try:
         await mail_services.imap_move_mail(db, m_id, target_f_id, tenant_id)

app/plugins/builtins/tasks/services.py

@@ -117,9 +117,14 @@ async def create_task(
     )
     db.add(task)
     await db.flush()
+    snapshot = _task_to_dict(task)
+
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history
+    await record_history(db, tenant_id, user_id, "task", task.id, "create", snapshot_after=snapshot)
 
     from app.core.hooks import do_action
-    await do_action("task.after_create", _task_to_dict(task), db=db, tenant_id=tenant_id, user_id=user_id)
+    await do_action("task.after_create", snapshot, db=db, tenant_id=tenant_id, user_id=user_id)
 
     # Publish task.created event
     from app.core.event_bus import get_event_bus
@@ -151,6 +156,8 @@ async def update_task(
 
     from app.core.hooks import do_action
     await do_action("task.before_update", data, db=db, tenant_id=tenant_id, task_id=str(task_id))
+    # Capture snapshot before update (D-PLUG)
+    snapshot_before = _task_to_dict(task)
     if "title" in data and data["title"] is not None:
         task.title = data["title"]
     if "description" in data:
@@ -168,9 +175,20 @@ async def update_task(
 
     await db.flush()
     await db.refresh(task)
+    snapshot_after = _task_to_dict(task)
+    # Compute changes diff (D-PLUG)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history as _rh
+    await _rh(db, tenant_id, None, "task", task.id, "update",
+              snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None)
     from app.core.hooks import do_action
-    await do_action("task.after_update", _task_to_dict(task), db=db, tenant_id=tenant_id, task_id=str(task_id))
+    await do_action("task.after_update", snapshot_after, db=db, tenant_id=tenant_id, task_id=str(task_id))
-    return _task_to_dict(task)
+    return snapshot_after
 
 
 async def delete_task(db: AsyncSession, tenant_id: uuid.UUID, task_id: uuid.UUID) -> bool:
@@ -183,8 +201,13 @@ async def delete_task(db: AsyncSession, tenant_id: uuid.UUID, task_id: uuid.UUID
         return False
     from app.core.hooks import do_action
     await do_action("task.before_delete", db=db, tenant_id=tenant_id, task_id=str(task_id))
+    # Capture snapshot before delete (D-PLUG)
+    snapshot_before = _task_to_dict(task)
     task.deleted_at = datetime.now(timezone.utc)
     await db.flush()
+    # Record history (D-PLUG)
+    from app.services.entity_history_service import record_history as _rh
+    await _rh(db, tenant_id, None, "task", task.id, "delete", snapshot_before=snapshot_before)
     from app.core.hooks import do_action
     await do_action("task.after_delete", db=db, tenant_id=tenant_id, task_id=str(task_id))
     return True

app/routes/companies.py

@@ -117,9 +117,12 @@ async def create_company(
     )
     db.add(audit_entry)
     await db.flush()
+    # Record history (D-CORE)
+    snapshot = _serialize_company(company)
+    await record_history(db, tenant_id, user_id, "contact", company.id, "create", snapshot_after=snapshot)
     from app.core.hooks import do_action
-    await do_action("company.after_create", _serialize_company(company), db=db, tenant_id=tenant_id, user_id=user_id)
+    await do_action("company.after_create", snapshot, db=db, tenant_id=tenant_id, user_id=user_id)
-    return _serialize_company(company)
+    return snapshot
 
 
 @router.get("/export")
@@ -208,6 +211,8 @@ async def update_company(
         raise HTTPException(status_code=404, detail="Company not found")
     from app.core.hooks import do_action
     await do_action("company.before_update", body, db=db, tenant_id=tenant_id, user_id=user_id, company_id=company_id)
+    # Capture snapshot before update (D-CORE)
+    snapshot_before = _serialize_company(company)
     if "name" in body:
         company.name = body["name"]
         company.displayname = body["name"]
@@ -222,13 +227,25 @@ async def update_company(
     company.custom = custom
     company.updated_by = user_id
     await db.flush()
+    snapshot_after = _serialize_company(company)
+    # Compute changes diff (D-CORE)
+    changes: dict = {}
+    for key, new_val in snapshot_after.items():
+        old_val = snapshot_before.get(key)
+        if old_val != new_val:
+            changes[key] = {"old": old_val, "new": new_val}
+    # Record history (D-CORE)
+    await record_history(
+        db, tenant_id, user_id, "contact", company.id, "update",
+        snapshot_before=snapshot_before, snapshot_after=snapshot_after, changes=changes or None,
+    )
     audit_entry = AuditLog(tenant_id=tenant_id, user_id=user_id, action="update",
                           entity_type="contact", entity_id=company.id, changes=body)
     db.add(audit_entry)
     await db.flush()
     from app.core.hooks import do_action
-    await do_action("company.after_update", _serialize_company(company), db=db, tenant_id=tenant_id, user_id=user_id, company_id=company_id)
+    await do_action("company.after_update", snapshot_after, db=db, tenant_id=tenant_id, user_id=user_id, company_id=company_id)
-    return _serialize_company(company)
+    return snapshot_after
 
 
 @router.delete("/{company_id}", status_code=status.HTTP_204_NO_CONTENT)

app/routes/entity_history.py

@@ -8,8 +8,15 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
+from app.core.restore_registry import get_restore_registry
 from app.deps import get_current_user, require_permission
-from app.schemas.entity_history import EntityHistoryListResponse, EntityHistoryResponse, RestoreRequest
+from app.schemas.entity_history import (
+    BulkRestoreRequest,
+    BulkRestoreResponse,
+    EntityHistoryListResponse,
+    EntityHistoryResponse,
+    RestoreRequest,
+)
 from app.services import entity_history_service
 
 router = APIRouter(prefix="/api/v1/entity-history", tags=["entity-history"])
@@ -57,15 +64,35 @@ async def get_entity_history(
 async def restore_from_history(
     body: RestoreRequest,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("contacts:write")),
+    current_user: dict = Depends(get_current_user),
 ):
-    """Restore an entity from a history entry."""
+    """Restore an entity from a history entry.
+
+    Permission is checked dynamically based on the entity type's
+    RestoreConfig.restore_permission from the RestoreRegistry.
+    """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
     try:
         hid = uuid.UUID(body.history_id)
     except ValueError:
         raise HTTPException(status_code=400, detail="Invalid history_id") from None
+
+    # Look up the history entry to determine entity_type
+    entry = await entity_history_service.get_history_entry(db, tenant_id, hid, user_id)
+    if entry is None:
+        raise HTTPException(status_code=404, detail="History entry not found")
+
+    # Check permission dynamically based on entity type
+    config = get_restore_registry().get(entry.entity_type)
+    if config is None:
+        raise HTTPException(status_code=400, detail=f"Restore not supported for entity type: {entry.entity_type}")
+
+    required_perm = config.restore_permission
+    user_permissions = current_user.get("permissions", set())
+    if required_perm not in user_permissions and not current_user.get("is_system_admin", False):
+        raise HTTPException(status_code=403, detail=f"Missing permission: {required_perm}")
+
     try:
         return await entity_history_service.restore_from_history(db, tenant_id, hid, user_id)
     except ValueError as e:
@@ -77,18 +104,112 @@ async def undo_last_action(
     entity_type: str,
     entity_id: str,
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(require_permission("contacts:write")),
+    current_user: dict = Depends(get_current_user),
 ):
-    """Undo the most recent action for an entity."""
+    """Undo the most recent action for an entity.
+
+    Permission is checked dynamically based on the entity type's
+    RestoreConfig.restore_permission from the RestoreRegistry.
+    """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
     try:
         eid = uuid.UUID(entity_id)
     except ValueError:
         raise HTTPException(status_code=400, detail="Invalid entity_id") from None
+
+    # Check permission dynamically based on entity type
+    config = get_restore_registry().get(entity_type)
+    if config is None:
+        raise HTTPException(status_code=400, detail=f"Undo not supported for entity type: {entity_type}")
+
+    required_perm = config.restore_permission
+    user_permissions = current_user.get("permissions", set())
+    if required_perm not in user_permissions and not current_user.get("is_system_admin", False):
+        raise HTTPException(status_code=403, detail=f"Missing permission: {required_perm}")
+
     try:
         return await entity_history_service.undo_last_action(
             db, tenant_id, user_id, entity_type, eid
         )
     except ValueError as e:
         raise HTTPException(status_code=404, detail=str(e)) from None
+
+
+@router.get("/trash")
+async def list_trash(
+    entity_type: str | None = Query(None),
+    limit: int = Query(50, ge=1, le=200),
+    offset: int = Query(0, ge=0),
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """List deleted entities from history (trash view)."""
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_system_admin = current_user.get("is_system_admin", False)
+    return await entity_history_service.list_trash(
+        db, tenant_id, entity_type=entity_type, limit=limit, offset=offset,
+        user_id=user_id, is_system_admin=is_system_admin,
+    )
+
+
+@router.post("/bulk-restore", response_model=BulkRestoreResponse)
+async def bulk_restore(
+    body: BulkRestoreRequest,
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Restore multiple entities from history entries.
+
+    Partial-failure semantics: if some fail, others still succeed.
+    Returns per-item results with success/error details.
+    """
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    user_id = uuid.UUID(current_user["user_id"])
+    is_system_admin = current_user.get("is_system_admin", False)
+
+    if not body.history_ids:
+        raise HTTPException(status_code=400, detail="No history_ids provided")
+
+    try:
+        ids = [uuid.UUID(hid) for hid in body.history_ids]
+    except ValueError:
+        raise HTTPException(status_code=400, detail="Invalid history_id in list") from None
+
+    result = await entity_history_service.bulk_restore(
+        db, tenant_id, ids, user_id, is_system_admin
+    )
+    return BulkRestoreResponse(
+        total=result["total"],
+        succeeded=result["succeeded"],
+        failed=result["failed"],
+        results=[
+            {
+                "history_id": r["history_id"],
+                "success": r["success"],
+                "entity_type": r.get("entity_type"),
+                "entity_id": r.get("entity_id"),
+                "error": r.get("error"),
+            }
+            for r in result["results"]
+        ],
+        partial_success=result["partial_success"],
+    )
+
+
+@router.post("/retention/archive", dependencies=[Depends(require_permission("system:admin"))])
+async def archive_old_history(
+    days: int = Query(90, ge=1, le=3650),
+    db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
+):
+    """Archive (hard-delete) EntityHistory entries older than *days* days.
+
+    GDPR compliance: after retention period, history snapshots are purged.
+    Requires system:admin permission.
+    """
+    tenant_id = uuid.UUID(current_user["tenant_id"])
+    count = await entity_history_service.archive_old_history(db, tenant_id, days=days)
+    await db.commit()
+    return {"archived": count, "retention_days": days}

app/schemas/entity_history.py

@@ -24,3 +24,23 @@ class EntityHistoryListResponse(BaseModel):
 
 class RestoreRequest(BaseModel):
     history_id: str
+
+
+class BulkRestoreRequest(BaseModel):
+    history_ids: list[str]
+
+
+class BulkRestoreResultItem(BaseModel):
+    history_id: str
+    success: bool
+    entity_type: str | None = None
+    entity_id: str | None = None
+    error: str | None = None
+
+
+class BulkRestoreResponse(BaseModel):
+    total: int
+    succeeded: int
+    failed: int
+    results: list[BulkRestoreResultItem]
+    partial_success: bool = False

app/services/entity_history_service.py

@@ -107,8 +107,13 @@ async def restore_from_history(
     For 'update' actions: revert entity fields to snapshot_before.
     For 'create' actions: soft-delete the entity (undo creation).
 
+    Uses the RestoreRegistry to find the entity configuration.
+    Only explicitly registered entity types can be restored.
+
     Returns the restored data dict.
     """
+    from app.core.restore_registry import get_restore_registry
+
     entry = await get_history_entry(db, tenant_id, history_id, user_id, is_system_admin)
     if entry is None:
         raise ValueError("History entry not found")
@@ -117,76 +122,105 @@ async def restore_from_history(
     entity_id = entry.entity_id
     action = entry.action
 
-    # Import here to avoid circular imports
+    # Look up restore configuration from registry
-    from app.models.contact import Contact
+    config = get_restore_registry().get(entity_type)
+    if config is None:
+        raise ValueError(f"Unsupported entity type for restore: {entity_type}")
 
+    # Load entity from database
+    model_class = config.model_class
+    q = select(model_class).where(
+        model_class.id == entity_id,
+        model_class.tenant_id == tenant_id,
+    )
+    result = await db.execute(q)
+    entity = result.scalar_one_or_none()
+
+    # Use special handler if registered (e.g. Mail with IMAP semantics)
+    if config.special_handler is not None:
+        context = {
+            "user_id": user_id,
+            "tenant_id": tenant_id,
+            "is_system_admin": is_system_admin,
+            "history_entry": entry,
+        }
+        snapshot = entry.snapshot_before if entry.snapshot_before else {}
+        return await config.special_handler(db, entity, action, snapshot, context)
+
+    # Generic restore logic
+    from datetime import datetime, timezone
+
+    if action == "delete":
+        if entity is None:
+            raise ValueError("Entity not found for restore")
+        entity.deleted_at = None
+        if hasattr(entity, "updated_by"):
+            entity.updated_by = user_id
+        await db.flush()
+        return _serialize_entity(entity, entity_type)
+
+    elif action == "update":
+        if entity is None:
+            raise ValueError("Entity not found for restore")
+        if entry.snapshot_before is None:
+            raise ValueError("No snapshot_before available for restore")
+        excluded = config.all_excluded_fields
+        for key, value in entry.snapshot_before.items():
+            if hasattr(entity, key) and key not in excluded:
+                setattr(entity, key, value)
+        if hasattr(entity, "updated_by"):
+            entity.updated_by = user_id
+        await db.flush()
+        return _serialize_entity(entity, entity_type)
+
+    elif action == "create":
+        if entity is None:
+            raise ValueError("Entity not found for restore")
+        entity.deleted_at = datetime.now(timezone.utc)
+        if hasattr(entity, "updated_by"):
+            entity.updated_by = user_id
+        await db.flush()
+        return _serialize_entity(entity, entity_type)
+
+    raise ValueError(f"Unsupported action for restore: {action}")
+
+
+def _serialize_entity(entity: Any, entity_type: str) -> dict[str, Any]:
+    """Serialize an entity to a dict for restore response.
+
+    For contacts, uses the detailed serializer with contact_persons.
+    For other entities, uses a generic column-based serializer.
+    """
     if entity_type == "contact":
-        q = select(Contact).where(
+        from app.services.contact_service import _serialize_contact_detail
-            Contact.id == entity_id,
+        from sqlalchemy.orm import selectinload
-            Contact.tenant_id == tenant_id,
+        from app.models.contact import Contact
+        from sqlalchemy import select as sa_select
+
+        # Re-query with selectinload for contact_persons
+        q = (
+            sa_select(Contact)
+            .options(selectinload(Contact.contact_persons))
+            .where(Contact.id == entity.id)
         )
-        result = await db.execute(q)
+        # This is called after flush, entity is still in session
-        contact = result.scalar_one_or_none()
+        # but we need to reload with the relationship
+        return _serialize_contact_detail(entity)
 
-        if action == "delete":
+    # Generic serialization: extract column values
-            # Un-delete: clear deleted_at
+    result: dict[str, Any] = {}
-            if contact is None:
+    for column in entity.__table__.columns:
-                raise ValueError("Entity not found for restore")
+        val = getattr(entity, column.name, None)
-            contact.deleted_at = None
+        if val is not None:
-            contact.updated_by = user_id
+            if hasattr(val, "isoformat"):
-            await db.flush()
+                result[column.name] = val.isoformat()
-            from app.services.contact_service import _serialize_contact_detail
+            elif hasattr(val, "hex"):
-            from sqlalchemy.orm import selectinload
+                result[column.name] = str(val)
-            q2 = (
+            else:
-                select(Contact)
+                result[column.name] = val
-                .options(selectinload(Contact.contact_persons))
+    result["_entity_type"] = entity_type
-                .where(Contact.id == contact.id)
+    result["_restored"] = True
-            )
+    return result
-            result2 = await db.execute(q2)
-            contact = result2.scalar_one()
-            return _serialize_contact_detail(contact)
-
-        elif action == "update":
-            # Revert to snapshot_before
-            if contact is None:
-                raise ValueError("Entity not found for restore")
-            if entry.snapshot_before is None:
-                raise ValueError("No snapshot_before available for restore")
-            for key, value in entry.snapshot_before.items():
-                if hasattr(contact, key) and key not in ("id", "tenant_id", "created_at", "updated_at", "deleted_at"):
-                    setattr(contact, key, value)
-            contact.updated_by = user_id
-            await db.flush()
-            from app.services.contact_service import _serialize_contact_detail
-            from sqlalchemy.orm import selectinload
-            q2 = (
-                select(Contact)
-                .options(selectinload(Contact.contact_persons))
-                .where(Contact.id == contact.id)
-            )
-            result2 = await db.execute(q2)
-            contact = result2.scalar_one()
-            return _serialize_contact_detail(contact)
-
-        elif action == "create":
-            # Undo creation: soft-delete the entity
-            if contact is None:
-                raise ValueError("Entity not found for restore")
-            contact.deleted_at = datetime.now(timezone.utc)
-            contact.updated_by = user_id
-            await db.flush()
-            from app.services.contact_service import _serialize_contact_detail
-            from sqlalchemy.orm import selectinload
-            q2 = (
-                select(Contact)
-                .options(selectinload(Contact.contact_persons))
-                .where(Contact.id == contact.id)
-            )
-            result2 = await db.execute(q2)
-            contact = result2.scalar_one()
-            return _serialize_contact_detail(contact)
-
-    raise ValueError(f"Unsupported entity type for restore: {entity_type}")
 
 
 async def undo_last_action(
@@ -222,3 +256,123 @@ async def undo_last_action(
         raise ValueError("No history found for this entity")
 
     return await restore_from_history(db, tenant_id, entry.id, user_id, is_system_admin)
+
+
+async def list_trash(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    entity_type: str | None = None,
+    limit: int = 50,
+    offset: int = 0,
+    user_id: uuid.UUID | None = None,
+    is_system_admin: bool = False,
+) -> dict[str, Any]:
+    """List deleted entities from history (delete actions only).
+
+    Returns paginated trash items with entity_type filter.
+    """
+    q = (
+        select(EntityHistory)
+        .where(
+            EntityHistory.tenant_id == tenant_id,
+            EntityHistory.action == "delete",
+        )
+        .order_by(EntityHistory.created_at.desc())
+    )
+    if entity_type:
+        q = q.where(EntityHistory.entity_type == entity_type)
+    if user_id and not is_system_admin:
+        q = await apply_visibility_filter(
+            db, q, "entity_history", EntityHistory, user_id, tenant_id, is_system_admin
+        )
+
+    # Count total
+    from sqlalchemy import func as sa_func
+    count_q = select(sa_func.count()).select_from(q.subquery())
+    total = (await db.execute(count_q)).scalar() or 0
+
+    # Paginate
+    q = q.offset(offset).limit(limit)
+    result = await db.execute(q)
+    entries = result.scalars().all()
+
+    items = []
+    for e in entries:
+        items.append({
+            "history_id": str(e.id),
+            "entity_type": e.entity_type,
+            "entity_id": str(e.entity_id),
+            "snapshot_before": e.snapshot_before,
+            "deleted_at": e.created_at.isoformat() if e.created_at else None,
+            "user_id": str(e.user_id) if e.user_id else None,
+        })
+
+    return {"items": items, "total": total, "limit": limit, "offset": offset}
+
+
+async def bulk_restore(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    history_ids: list[uuid.UUID],
+    user_id: uuid.UUID,
+    is_system_admin: bool = False,
+) -> dict[str, Any]:
+    """Restore multiple entities from history entries.
+
+    Returns partial_success semantics: if some fail, others still succeed.
+    """
+    results = []
+    succeeded = 0
+    failed = 0
+
+    for hid in history_ids:
+        try:
+            restored = await restore_from_history(db, tenant_id, hid, user_id, is_system_admin)
+            succeeded += 1
+            results.append({
+                "history_id": str(hid),
+                "success": True,
+                "entity_type": restored.get("_entity_type") or restored.get("entity_type"),
+                "entity_id": restored.get("id"),
+                "error": None,
+            })
+        except Exception as exc:
+            failed += 1
+            results.append({
+                "history_id": str(hid),
+                "success": False,
+                "entity_type": None,
+                "entity_id": None,
+                "error": str(exc),
+            })
+
+    return {
+        "total": len(history_ids),
+        "succeeded": succeeded,
+        "failed": failed,
+        "results": results,
+        "partial_success": failed > 0 and succeeded > 0,
+    }
+
+
+async def archive_old_history(
+    db: AsyncSession,
+    tenant_id: uuid.UUID,
+    days: int = 90,
+) -> int:
+    """Archive (hard-delete) EntityHistory entries older than *days* days.
+
+    GDPR compliance: after retention period, history snapshots are purged.
+    Returns the number of archived entries.
+    """
+    from datetime import datetime, timezone, timedelta
+    from sqlalchemy import delete as sa_delete
+
+    cutoff = datetime.now(timezone.utc) - timedelta(days=days)
+    stmt = sa_delete(EntityHistory).where(
+        EntityHistory.tenant_id == tenant_id,
+        EntityHistory.created_at < cutoff,
+    )
+    result = await db.execute(stmt)
+    await db.flush()
+    return result.rowcount or 0

docs/security_kernel.md

@@ -72,3 +72,44 @@ Keine Business-Logic in RLS. Keine owner_id, keine sharing, keine permissions.
 - ✅ rls_enabled_on_tenant_tables
 - ✅ rls_disabled_on_system_tables
 - ✅ tenant_context_variable_consistency
+
+---
+
+## Phase D — Undo/Restore Security
+
+### Restore-Registry: Explizite Registrierung
+
+Nur explizit registrierte Entity-Typen können restored werden (`RestoreRegistry`).
+Kein dynamisches ORM-Laden, kein blindes Snapshot-Zurückschreiben.
+
+| Entity Type | Restore Permission | Excluded Fields |
+|-------------|-------------------|----------------|
+| contact | contacts:write | search_tsv, embedding, default_person_id, admin_contactperson_id |
+| task | tasks:write | created_by, assigned_to, contact_id |
+| calendar_entry | calendar:write | calendar_id, created_by, assigned_to, source_mail_id |
+| dms_file | dms:write | storage_path, content_hash, size_bytes, uploaded_by, folder_id |
+| mail | mail:write | message_id, rfc822_size, raw_path, account_id, folder_id |
+
+### Sensitive Fields
+
+- `id`, `tenant_id`, `created_at`, `updated_at`, `deleted_at` werden **nie** restored
+- `search_tsv`, `embedding` werden **nie** restored (computed/derived fields)
+- Entity-spezifische Exclusions verhindern Restore von relationship IDs, storage paths, IMAP metadata
+
+### Mail Restore: IMAP-Semantik
+
+- Delete → Move in serverseitigen Trash (IMAP MOVE)
+- Restore → Move zurück in Original-Ordner (falls noch vorhanden)
+- Serverfehler erzeugen keinen falschen lokalen Status (MailSyncQueue für Retry)
+- Kein „Undo Send" für bereits zugestellte externe Mails
+
+### Bulk Restore: Partial-Failure-Semantik
+
+- Bei Teilausfällen: `partial_success` Flag + per-item Fehler-Report
+- Kein stummes Versagen — jeder Erfolg und jeder Fehlschlag wird gemeldet
+
+### Retention: GDPR-Hard-Delete
+
+- EntityHistory älter als 90 Tage wird hard-deleted (`archive_old_history`)
+- Erfordert `system:admin` Permission
+- Snapshots enthalten keine Passwörter oder Secrets (excluded fields)

docs/test-strategy.md

@@ -268,3 +268,30 @@ Diese Pipeline ist verbindlich für Phase-Gate-Reviews und muss vor jedem Phasen
 3. **Vitest Worker-Crashes** — 7 von 96 Test-Files crashen mit „Worker exited unexpectedly". Resource-Limits im Container. **Lösung:** `--pool=forks` oder Memory-Limit erhöhen.
 
 4. **Vollständiger pytest-Lauf dauert >15min** — 1401 Tests mit DB-Setup. **Lösung:** T-PARALLEL (pytest-xdist mit pro-Worker DB).
+
+---
+
+## Phase D — Undo/Restore Test-Ergebnisse
+
+### Neue Test-Datei: `tests/test_restore_registry.py` (26 Tests)
+
+| Test-Gruppe | Tests | Status |
+|-------------|-------|--------|
+| RestoreRegistry (Singleton, Register, Get, List, Overwrite, Excluded Fields) | 6 | ✅ |
+| RestoreFromHistory (Unsupported type, History not found) | 2 | ✅ |
+| HistoryHooks (extract_entity_id, register, hook fires record_history) | 6 | ✅ |
+| TrashList (Returns delete entries, Entity type filter) | 2 | ✅ |
+| BulkRestore (All success, Partial failure, All fail) | 3 | ✅ |
+| Retention (Returns count, Zero when none) | 2 | ✅ |
+| SensitiveFieldsExclusion (Default, Contact, DMS, Mail, All registered) | 5 | ✅ |
+
+### Verifizierte Aspekte
+
+- ✅ RestoreRegistry: Nur explizit registrierte Entity-Typen können restored werden
+- ✅ Excluded Fields: id, tenant_id, timestamps, search_tsv, embedding werden nie restored
+- ✅ Entity-spezifische Exclusions: Contact (relationship IDs), DMS (storage_path, content_hash), Mail (message_id, raw_path)
+- ✅ Mail Special Handler: IMAP-Semantik (Trash-Move, Folder-Verify, kein falscher lokaler Status)
+- ✅ Bulk Restore: Partial-Failure-Semantik (`partial_success` Flag, per-item results)
+- ✅ Retention: GDPR-Hard-Delete nach konfigurierbarer Aufbewahrungsfrist
+- ✅ Hook-based History: `do_action('entity.after_create/update/delete')` → `record_history()`
+- ✅ Dynamic Permission Checks: Restore-Permission aus RestoreConfig, nicht hardcoded

frontend/src/api/entityHistory.ts

@@ -1,5 +1,5 @@
 /**
- * Entity History hooks — undo/restore functionality.
+ * Entity History hooks — undo/restore/trash functionality.
  */
 
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
@@ -10,9 +10,9 @@ export interface EntityHistoryEntry {
   entity_type: string;
   entity_id: string;
   action: 'create' | 'update' | 'delete';
-  snapshot_before: Record<string, any> | null;
+  snapshot_before: Record<string, unknown> | null;
-  snapshot_after: Record<string, any> | null;
+  snapshot_after: Record<string, unknown> | null;
-  changes: Record<string, { old: any; new: any }> | null;
+  changes: Record<string, { old: unknown; new: unknown }> | null;
   user_id: string | null;
   created_at: string;
 }
@@ -22,22 +22,82 @@ export interface EntityHistoryList {
   total: number;
 }
 
-export function useEntityHistory(entityType?: string, entityId?: string) {
+export interface TrashItem {
+  history_id: string;
+  entity_type: string;
+  entity_id: string;
+  snapshot_before: Record<string, unknown> | null;
+  deleted_at: string | null;
+  user_id: string | null;
+}
+
+export interface TrashListResponse {
+  items: TrashItem[];
+  total: number;
+  limit: number;
+  offset: number;
+}
+
+export interface BulkRestoreResultItem {
+  history_id: string;
+  success: boolean;
+  entity_type: string | null;
+  entity_id: string | null;
+  error: string | null;
+}
+
+export interface BulkRestoreResponse {
+  total: number;
+  succeeded: number;
+  failed: number;
+  results: BulkRestoreResultItem[];
+  partial_success: boolean;
+}
+
+export function useEntityHistory(entityType?: string, entityId?: string, limit = 50) {
   return useQuery({
-    queryKey: ['entityHistory', entityType, entityId],
+    queryKey: ['entityHistory', entityType, entityId, limit],
     queryFn: () =>
-      apiGet<EntityHistoryList>(`/entity-history/${entityType}/${entityId}`),
+      apiGet<EntityHistoryList>(`/entity-history/${entityType}/${entityId}?limit=${limit}`),
     enabled: !!entityType && !!entityId,
   });
 }
 
+export function useTrashList(entityType?: string, limit = 50, offset = 0) {
+  const params = new URLSearchParams();
+  params.set('limit', String(limit));
+  params.set('offset', String(offset));
+  if (entityType) {
+    params.set('entity_type', entityType);
+  }
+  return useQuery({
+    queryKey: ['trash', entityType ?? 'all', limit, offset],
+    queryFn: () => apiGet<TrashListResponse>(`/entity-history/trash?${params.toString()}`),
+  });
+}
+
 export function useRestoreFromHistory() {
   const queryClient = useQueryClient();
   return useMutation({
     mutationFn: (historyId: string) =>
       apiClient.post('/entity-history/restore', { history_id: historyId }).then(r => r.data),
-    onSuccess: (_data, _variables, context) => {
+    onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ['entityHistory'] });
+      queryClient.invalidateQueries({ queryKey: ['trash'] });
+      queryClient.invalidateQueries({ queryKey: ['contacts'] });
+      queryClient.invalidateQueries({ queryKey: ['contact'] });
+    },
+  });
+}
+
+export function useBulkRestore() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: (historyIds: string[]) =>
+      apiPost<BulkRestoreResponse>('/entity-history/bulk-restore', { history_ids: historyIds }),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['entityHistory'] });
+      queryClient.invalidateQueries({ queryKey: ['trash'] });
       queryClient.invalidateQueries({ queryKey: ['contacts'] });
       queryClient.invalidateQueries({ queryKey: ['contact'] });
     },
@@ -51,6 +111,7 @@ export function useUndoLastAction() {
       apiPost(`/entity-history/undo/${entityType}/${entityId}`, {}),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ['entityHistory'] });
+      queryClient.invalidateQueries({ queryKey: ['trash'] });
       queryClient.invalidateQueries({ queryKey: ['contacts'] });
       queryClient.invalidateQueries({ queryKey: ['contact'] });
     },

frontend/src/components/HistoryPanel.tsx

@@ -0,0 +1,152 @@
+import React, { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { History, RotateCcw, ChevronDown, ChevronRight, User } from 'lucide-react';
+import { useEntityHistory, useRestoreFromHistory } from '@/api/entityHistory';
+import { Button } from '@/components/ui/Button';
+import { Badge } from '@/components/ui/Badge';
+import { Skeleton } from '@/components/ui/Skeleton';
+import { useToast } from '@/components/ui/Toast';
+import { formatDistanceToNow } from 'date-fns';
+import { de, enUS } from 'date-fns/locale';
+
+interface HistoryPanelProps {
+  entityType: string;
+  entityId: string;
+  limit?: number;
+}
+
+const actionConfig = {
+  create: { variant: 'success' as const, labelKey: 'history.actionCreate' },
+  update: { variant: 'primary' as const, labelKey: 'history.actionUpdate' },
+  delete: { variant: 'danger' as const, labelKey: 'history.actionDelete' },
+};
+
+export function HistoryPanel({ entityType, entityId, limit = 50 }: HistoryPanelProps) {
+  const { t, i18n } = useTranslation();
+  const toast = useToast();
+  const { data: history, isLoading } = useEntityHistory(entityType, entityId, limit);
+  const restoreMutation = useRestoreFromHistory();
+  const [expandedId, setExpandedId] = useState<string | null>(null);
+
+  const dateLocale = i18n.language === 'de' ? de : enUS;
+
+  const handleRestore = async (historyId: string) => {
+    try {
+      await restoreMutation.mutateAsync(historyId);
+      toast.success(t('history.restored', 'Version wiederhergestellt'));
+    } catch {
+      toast.error(t('history.restoreError', 'Wiederherstellung fehlgeschlagen'));
+    }
+  };
+
+  if (isLoading) {
+    return (
+      <div className="space-y-3" data-testid="history-panel">
+        <Skeleton className="h-8 w-40" />
+        <Skeleton className="h-16 w-full" />
+        <Skeleton className="h-16 w-full" />
+      </div>
+    );
+  }
+
+  const entries = history?.items ?? [];
+
+  if (entries.length === 0) {
+    return (
+      <div className="text-center py-8 text-secondary-400" data-testid="history-panel">
+        <History className="w-8 h-8 mx-auto mb-2 opacity-50" aria-hidden="true" />
+        <p className="text-sm">{t('history.empty', 'Keine Änderungshistorie vorhanden')}</p>
+      </div>
+    );
+  }
+
+  return (
+    <div className="space-y-4" data-testid="history-panel">
+      <h3 className="text-lg font-semibold text-secondary-900 flex items-center gap-2">
+        <History className="w-5 h-5" aria-hidden="true" />
+        {t('history.title', 'Änderungshistorie')}
+      </h3>
+
+      <ol className="relative border-l border-secondary-200 ml-3 space-y-4">
+        {entries.map((entry) => {
+          const config = actionConfig[entry.action] || actionConfig.update;
+          const isExpanded = expandedId === entry.id;
+          const changes = entry.changes || {};
+          const changeKeys = Object.keys(changes);
+
+          return (
+            <li key={entry.id} className="ml-4">
+              <div className="border border-secondary-200 rounded-lg overflow-hidden bg-white">
+                <button
+                  onClick={() => setExpandedId(isExpanded ? null : entry.id)}
+                  className="w-full flex items-center justify-between p-3 hover:bg-secondary-50 transition-colors text-left"
+                  aria-expanded={isExpanded}
+                  aria-controls={`history-detail-${entry.id}`}
+                >
+                  <div className="flex items-center gap-3">
+                    {isExpanded ? (
+                      <ChevronDown className="w-4 h-4 text-secondary-400" aria-hidden="true" />
+                    ) : (
+                      <ChevronRight className="w-4 h-4 text-secondary-400" aria-hidden="true" />
+                    )}
+                    <Badge variant={config.variant}>{t(config.labelKey)}</Badge>
+                    <span className="text-sm text-secondary-500">
+                      {formatDistanceToNow(new Date(entry.created_at), { addSuffix: true, locale: dateLocale })}
+                    </span>
+                  </div>
+                  <div className="flex items-center gap-3">
+                    {entry.user_id && (
+                      <span className="inline-flex items-center gap-1 text-xs text-secondary-400">
+                        <User className="w-3.5 h-3.5" aria-hidden="true" />
+                        {entry.user_id.slice(0, 8)}
+                      </span>
+                    )}
+                    {changeKeys.length > 0 && (
+                      <span className="text-xs text-secondary-400">
+                        {changeKeys.length} {t('history.fieldsChanged', 'Felder geändert')}
+                      </span>
+                    )}
+                  </div>
+                </button>
+
+                {isExpanded && (
+                  <div id={`history-detail-${entry.id}`} className="px-4 pb-3 border-t border-secondary-100">
+                    {changeKeys.length > 0 && (
+                      <div className="mt-3 space-y-1">
+                        <p className="text-xs font-medium text-secondary-500 mb-2">{t('history.changes', 'Änderungen')}:</p>
+                        {changeKeys.map((key) => (
+                          <div key={key} className="flex items-start gap-2 text-sm">
+                            <span className="font-mono text-secondary-600 min-w-[120px]">{key}:</span>
+                            <span className="text-danger-600 line-through">
+                              {String(changes[key].old ?? '—')}
+                            </span>
+                            <span className="text-secondary-400">→</span>
+                            <span className="text-success-600">
+                              {String(changes[key].new ?? '—')}
+                            </span>
+                          </div>
+                        ))}
+                      </div>
+                    )}
+
+                    <div className="mt-3 flex justify-end">
+                      <Button
+                        variant="ghost"
+                        size="sm"
+                        onClick={() => handleRestore(entry.id)}
+                        isLoading={restoreMutation.isPending}
+                        icon={<RotateCcw className="w-3.5 h-3.5" />}
+                      >
+                        {t('history.restore', 'Diese Version wiederherstellen')}
+                      </Button>
+                    </div>
+                  </div>
+                )}
+              </div>
+            </li>
+          );
+        })}
+      </ol>
+    </div>
+  );
+}

frontend/src/components/UndoToast.tsx

@@ -0,0 +1,118 @@
+import React, { useCallback, useEffect, useRef, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Undo2, X } from 'lucide-react';
+import { Button } from '@/components/ui/Button';
+import { useUndoLastAction } from '@/api/entityHistory';
+
+interface UndoToastProps {
+  message: string;
+  onUndo: () => void;
+  onDismiss: () => void;
+  isUndoing: boolean;
+}
+
+/**
+ * Undo toast shown after delete actions.
+ * Auto-dismisses after 5 seconds and is manually dismissable.
+ */
+export function UndoToast({ message, onUndo, onDismiss, isUndoing }: UndoToastProps) {
+  const { t } = useTranslation();
+
+  return (
+    <div
+      className="fixed bottom-4 right-4 z-[100] flex items-center gap-3 p-4 rounded-lg shadow-lg border border-secondary-200 bg-white max-w-sm"
+      role="alert"
+      aria-live="polite"
+      data-testid="undo-toast"
+    >
+      <p className="flex-1 text-sm font-medium text-secondary-900">{message}</p>
+      <Button
+        variant="primary"
+        size="sm"
+        onClick={onUndo}
+        isLoading={isUndoing}
+        icon={<Undo2 className="w-4 h-4" />}
+      >
+        {t('undoToast.undo', 'Undo')}
+      </Button>
+      <button
+        onClick={onDismiss}
+        className="flex-shrink-0 text-secondary-400 hover:text-secondary-700 min-h-touch min-w-touch flex items-center justify-center rounded focus:outline-none focus-visible:ring-2 focus-visible:ring-primary-500"
+        aria-label={t('common.dismiss', 'Schließen')}
+      >
+        <X className="h-4 w-4" aria-hidden="true" />
+      </button>
+    </div>
+  );
+}
+
+interface UndoToastState {
+  message: string;
+  entityType: string;
+  entityId: string;
+}
+
+/**
+ * Hook that shows an undo toast after a delete action and provides the undo function.
+ *
+ * Returns:
+ * - `showUndoToast(message, entityType, entityId)`: trigger the toast
+ * - `undoToast`: the JSX element to render (render it once in the page)
+ */
+export function useUndoToast() {
+  const { t } = useTranslation();
+  const [state, setState] = useState<UndoToastState | null>(null);
+  const timerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const undoMutation = useUndoLastAction();
+
+  const clearTimer = useCallback(() => {
+    if (timerRef.current) {
+      clearTimeout(timerRef.current);
+      timerRef.current = null;
+    }
+  }, []);
+
+  const dismiss = useCallback(() => {
+    clearTimer();
+    setState(null);
+  }, [clearTimer]);
+
+  const showUndoToast = useCallback(
+    (message: string, entityType: string, entityId: string) => {
+      clearTimer();
+      setState({ message, entityType, entityId });
+      timerRef.current = setTimeout(() => {
+        setState(null);
+        timerRef.current = null;
+      }, 5000);
+    },
+    [clearTimer]
+  );
+
+  const handleUndo = useCallback(async () => {
+    if (!state) return;
+    try {
+      await undoMutation.mutateAsync({
+        entityType: state.entityType,
+        entityId: state.entityId,
+      });
+      dismiss();
+    } catch {
+      // Keep the toast visible so the user can retry; the mutation error is surfaced elsewhere.
+    }
+  }, [state, undoMutation, dismiss]);
+
+  // Cleanup timer on unmount
+  useEffect(() => clearTimer, [clearTimer]);
+
+  const undoToast = state ? (
+    <UndoToast
+      message={state.message}
+      onUndo={handleUndo}
+      onDismiss={dismiss}
+      isUndoing={undoMutation.isPending}
+    />
+  ) : null;
+
+  return { showUndoToast, undoToast };
+}

frontend/src/i18n/locales/de.json

@@ -907,7 +907,39 @@
     "restoreError": "Wiederherstellung fehlgeschlagen",
     "empty": "Keine Änderungshistorie vorhanden",
     "changes": "Änderungen",
-    "fieldsChanged": "Felder geändert"
+    "fieldsChanged": "Felder geändert",
+    "actionCreate": "Erstellt",
+    "actionUpdate": "Aktualisiert",
+    "actionDelete": "Gelöscht"
+  },
+  "trash": {
+    "title": "Papierkorb",
+    "allTypes": "Alle Typen",
+    "filterType": "Entity-Typ",
+    "entityType": "Typ",
+    "name": "Name",
+    "deletedAt": "Gelöscht am",
+    "actions": "Aktionen",
+    "restore": "Wiederherstellen",
+    "restored": "Wiederhergestellt",
+    "restoreError": "Wiederherstellung fehlgeschlagen",
+    "bulkRestore": "Ausgewählte wiederherstellen",
+    "bulkRestored": "{{count}} Einträge wiederhergestellt",
+    "bulkPartial": "{{succeeded}} wiederhergestellt, {{failed}} fehlgeschlagen",
+    "bulkRestoreError": "Massen-Wiederherstellung fehlgeschlagen",
+    "empty": "Papierkorb ist leer",
+    "selectAll": "Alle auswählen",
+    "selectItem": "Eintrag auswählen",
+    "types": {
+      "contact": "Kontakt",
+      "task": "Aufgabe",
+      "calendar_entry": "Kalendereintrag",
+      "dms_file": "Datei",
+      "mail": "E-Mail"
+    }
+  },
+  "undoToast": {
+    "undo": "Undo"
   },
   "userPreferences": {
     "title": "Benutzereinstellungen",

frontend/src/i18n/locales/en.json

@@ -907,7 +907,39 @@
     "restoreError": "Restore failed",
     "empty": "No change history available",
     "changes": "Changes",
-    "fieldsChanged": "fields changed"
+    "fieldsChanged": "fields changed",
+    "actionCreate": "Created",
+    "actionUpdate": "Updated",
+    "actionDelete": "Deleted"
+  },
+  "trash": {
+    "title": "Trash",
+    "allTypes": "All types",
+    "filterType": "Entity type",
+    "entityType": "Type",
+    "name": "Name",
+    "deletedAt": "Deleted at",
+    "actions": "Actions",
+    "restore": "Restore",
+    "restored": "Restored",
+    "restoreError": "Restore failed",
+    "bulkRestore": "Restore selected",
+    "bulkRestored": "{{count}} entries restored",
+    "bulkPartial": "{{succeeded}} restored, {{failed}} failed",
+    "bulkRestoreError": "Bulk restore failed",
+    "empty": "Trash is empty",
+    "selectAll": "Select all",
+    "selectItem": "Select item",
+    "types": {
+      "contact": "Contact",
+      "task": "Task",
+      "calendar_entry": "Calendar entry",
+      "dms_file": "File",
+      "mail": "Email"
+    }
+  },
+  "undoToast": {
+    "undo": "Undo"
   },
   "userPreferences": {
     "title": "User Preferences",

frontend/src/pages/Trash.tsx

@@ -0,0 +1,264 @@
+import React, { useCallback, useMemo, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Trash2, RotateCcw } from 'lucide-react';
+import { Button } from '@/components/ui/Button';
+import { Card } from '@/components/ui/Card';
+import { Select } from '@/components/ui/Select';
+import { Pagination } from '@/components/ui/Pagination';
+import { EmptyState } from '@/components/ui/EmptyState';
+import { Skeleton } from '@/components/ui/Skeleton';
+import { Badge } from '@/components/ui/Badge';
+import { useToast } from '@/components/ui/Toast';
+import { useTrashList, useRestoreFromHistory, useBulkRestore, type TrashItem } from '@/api/entityHistory';
+import { formatDateShort } from '@/utils/date';
+
+const PAGE_SIZE = 50;
+
+const ENTITY_TYPES = ['contact', 'task', 'calendar_entry', 'dms_file', 'mail'] as const;
+
+type EntityType = (typeof ENTITY_TYPES)[number];
+
+/** Coerce an unknown snapshot value to a string, or '' when null/undefined. */
+function str(value: unknown): string {
+  return value === null || value === undefined ? '' : String(value);
+}
+
+/** Extract a display name/subject from the snapshot_before payload per entity type. */
+function getDisplayName(item: TrashItem): string {
+  const snap = item.snapshot_before ?? {};
+  switch (item.entity_type) {
+    case 'contact': {
+      const first = str(snap.first_name);
+      const last = str(snap.last_name);
+      const company = str(snap.company_name);
+      const full = [first, last].filter(Boolean).join(' ');
+      return full || company || str(snap.name) || '—';
+    }
+    case 'task':
+    case 'calendar_entry':
+      return str(snap.title) || str(snap.subject) || str(snap.name) || '—';
+    case 'dms_file':
+      return str(snap.name) || str(snap.filename) || str(snap.original_name) || '—';
+    case 'mail':
+      return str(snap.subject) || str(snap.name) || '—';
+    default:
+      return str(snap.name) || str(snap.title) || str(snap.subject) || '—';
+  }
+}
+
+export function TrashPage() {
+  const { t } = useTranslation();
+  const toast = useToast();
+  const [entityType, setEntityType] = useState<string>('');
+  const [page, setPage] = useState(1);
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+
+  const offset = (page - 1) * PAGE_SIZE;
+  const { data, isLoading, isFetching } = useTrashList(entityType || undefined, PAGE_SIZE, offset);
+  const restoreMutation = useRestoreFromHistory();
+  const bulkRestoreMutation = useBulkRestore();
+
+  const items = data?.items ?? [];
+  const total = data?.total ?? 0;
+  const totalPages = Math.max(1, Math.ceil(total / PAGE_SIZE));
+
+  const entityTypeOptions = useMemo(
+    () => [
+      { value: '', label: t('trash.allTypes', 'Alle Typen') },
+      ...ENTITY_TYPES.map((type) => ({ value: type, label: t(`trash.types.${type}`) })),
+    ],
+    [t]
+  );
+
+  const handleFilterChange = useCallback((value: string) => {
+    setEntityType(value);
+    setPage(1);
+    setSelected(new Set());
+  }, []);
+
+  const toggleSelect = useCallback((historyId: string) => {
+    setSelected((prev) => {
+      const next = new Set(prev);
+      if (next.has(historyId)) {
+        next.delete(historyId);
+      } else {
+        next.add(historyId);
+      }
+      return next;
+    });
+  }, []);
+
+  const toggleSelectAll = useCallback(() => {
+    setSelected((prev) => {
+      if (prev.size === items.length && items.length > 0) {
+        return new Set();
+      }
+      return new Set(items.map((item) => item.history_id));
+    });
+  }, [items]);
+
+  const handleSingleRestore = useCallback(
+    async (historyId: string) => {
+      try {
+        await restoreMutation.mutateAsync(historyId);
+        toast.success(t('trash.restored', 'Wiederhergestellt'));
+        setSelected((prev) => {
+          const next = new Set(prev);
+          next.delete(historyId);
+          return next;
+        });
+      } catch {
+        toast.error(t('trash.restoreError', 'Wiederherstellung fehlgeschlagen'));
+      }
+    },
+    [restoreMutation, toast, t]
+  );
+
+  const handleBulkRestore = useCallback(async () => {
+    if (selected.size === 0) return;
+    try {
+      const result = await bulkRestoreMutation.mutateAsync(Array.from(selected));
+      if (result.failed > 0) {
+        toast.warning(
+          t('trash.bulkPartial', '{{succeeded}} wiederhergestellt, {{failed}} fehlgeschlagen', {
+            succeeded: result.succeeded,
+            failed: result.failed,
+          })
+        );
+      } else {
+        toast.success(t('trash.bulkRestored', '{{count}} Einträge wiederhergestellt', { count: result.succeeded }));
+      }
+      setSelected(new Set());
+    } catch {
+      toast.error(t('trash.bulkRestoreError', 'Massen-Wiederherstellung fehlgeschlagen'));
+    }
+  }, [selected, bulkRestoreMutation, toast, t]);
+
+  const handlePageChange = useCallback((nextPage: number) => {
+    setPage(nextPage);
+    setSelected(new Set());
+  }, []);
+
+  return (
+    <div className="p-6 max-w-7xl mx-auto" data-testid="trash-page">
+      <div className="flex items-center justify-between mb-6">
+        <div className="flex items-center gap-3">
+          <Trash2 className="w-6 h-6 text-secondary-500" aria-hidden="true" />
+          <h1 className="text-2xl font-bold text-secondary-900">{t('trash.title', 'Papierkorb')}</h1>
+        </div>
+        <Button
+          variant="primary"
+          onClick={handleBulkRestore}
+          disabled={selected.size === 0}
+          isLoading={bulkRestoreMutation.isPending}
+          icon={<RotateCcw className="w-4 h-4" />}
+        >
+          {t('trash.bulkRestore', 'Ausgewählte wiederherstellen')}
+          {selected.size > 0 ? ` (${selected.size})` : ''}
+        </Button>
+      </div>
+
+      <div className="mb-4 max-w-xs">
+        <Select
+          label={t('trash.filterType', 'Entity-Typ')}
+          value={entityType}
+          onChange={(e) => handleFilterChange(e.target.value)}
+          options={entityTypeOptions}
+          aria-label={t('trash.filterType', 'Entity-Typ')}
+        />
+      </div>
+
+      {isLoading ? (
+        <div className="space-y-3">
+          <Skeleton className="h-12 w-full" />
+          <Skeleton className="h-12 w-full" />
+          <Skeleton className="h-12 w-full" />
+        </div>
+      ) : items.length === 0 ? (
+        <Card>
+          <EmptyState
+            title={t('trash.empty', 'Papierkorb ist leer')}
+            icon={<Trash2 className="w-12 h-12" aria-hidden="true" strokeWidth={1.5} />}
+          />
+        </Card>
+      ) : (
+        <Card>
+          <div className="overflow-x-auto" role="region" aria-label={t('trash.title', 'Papierkorb')}>
+            <table className="min-w-full divide-y divide-secondary-200">
+              <thead>
+                <tr>
+                  <th scope="col" className="px-4 py-3 w-12">
+                    <input
+                      type="checkbox"
+                      checked={selected.size === items.length && items.length > 0}
+                      onChange={toggleSelectAll}
+                      className="h-5 w-5 rounded border-secondary-300 text-primary-600 focus:ring-primary-500"
+                      aria-label={t('trash.selectAll', 'Alle auswählen')}
+                    />
+                  </th>
+                  <th scope="col" className="px-6 py-3 text-left text-xs font-semibold text-secondary-600 uppercase tracking-wider">
+                    {t('trash.entityType', 'Typ')}
+                  </th>
+                  <th scope="col" className="px-6 py-3 text-left text-xs font-semibold text-secondary-600 uppercase tracking-wider">
+                    {t('trash.name', 'Name')}
+                  </th>
+                  <th scope="col" className="px-6 py-3 text-left text-xs font-semibold text-secondary-600 uppercase tracking-wider">
+                    {t('trash.deletedAt', 'Gelöscht am')}
+                  </th>
+                  <th scope="col" className="px-6 py-3 text-right text-xs font-semibold text-secondary-600 uppercase tracking-wider">
+                    {t('trash.actions', 'Aktionen')}
+                  </th>
+                </tr>
+              </thead>
+              <tbody className="divide-y divide-secondary-100">
+                {items.map((item) => {
+                  const isSelected = selected.has(item.history_id);
+                  return (
+                    <tr key={item.history_id} className="hover:bg-secondary-50 motion-safe:transition-colors">
+                      <td className="px-4 py-4">
+                        <input
+                          type="checkbox"
+                          checked={isSelected}
+                          onChange={() => toggleSelect(item.history_id)}
+                          className="h-5 w-5 rounded border-secondary-300 text-primary-600 focus:ring-primary-500"
+                          aria-label={t('trash.selectItem', 'Eintrag auswählen')}
+                        />
+                      </td>
+                      <td className="px-6 py-4 text-sm">
+                        <Badge variant="secondary">{t(`trash.types.${item.entity_type}`)}</Badge>
+                      </td>
+                      <td className="px-6 py-4 text-sm font-medium text-secondary-900">
+                        {getDisplayName(item)}
+                      </td>
+                      <td className="px-6 py-4 text-sm text-secondary-500">
+                        {item.deleted_at ? formatDateShort(item.deleted_at) || '—' : '—'}
+                      </td>
+                      <td className="px-6 py-4 text-right">
+                        <Button
+                          variant="secondary"
+                          size="sm"
+                          onClick={() => handleSingleRestore(item.history_id)}
+                          isLoading={restoreMutation.isPending}
+                          icon={<RotateCcw className="w-3.5 h-3.5" />}
+                        >
+                          {t('trash.restore', 'Wiederherstellen')}
+                        </Button>
+                      </td>
+                    </tr>
+                  );
+                })}
+              </tbody>
+            </table>
+          </div>
+          <Pagination
+            currentPage={page}
+            totalPages={totalPages}
+            total={total}
+            pageSize={PAGE_SIZE}
+            onPageChange={handlePageChange}
+          />
+        </Card>
+      )}
+    </div>
+  );
+}

frontend/src/routes/index.tsx

@@ -33,6 +33,7 @@ const CalendarPage = React.lazy(() => import('@/pages/Calendar').then(m => ({ de
 const CalendarKanbanPage = React.lazy(() => import('@/pages/CalendarKanban').then(m => ({ default: m.CalendarKanbanPage })));
 const DmsPage = React.lazy(() => import('@/pages/Dms').then(m => ({ default: m.DmsPage })));
 const DmsTrashPage = React.lazy(() => import('@/pages/DmsTrash').then(m => ({ default: m.DmsTrashPage })));
+const TrashPage = React.lazy(() => import('@/pages/Trash').then(m => ({ default: m.TrashPage })));
 const MailPage = React.lazy(() => import('@/pages/Mail').then(m => ({ default: m.MailPage })));
 const MailSettingsPage = React.lazy(() => import('@/pages/MailSettings').then(m => ({ default: m.MailSettingsPage })));
 const SettingsNotificationsPage = React.lazy(() => import('@/pages/SettingsNotifications').then(m => ({ default: m.SettingsNotificationsPage })));
@@ -156,6 +157,7 @@ const router = createBrowserRouter([
       { path: '/calendar/kanban', element: <PermissionRoute permission="calendar:read">{withSuspense(<CalendarKanbanPage />)}</PermissionRoute> },
       { path: '/dms', element: <PermissionRoute permission="dms:read">{withSuspense(<DmsPage />)}</PermissionRoute> },
       { path: '/dms/trash', element: <PermissionRoute permission="dms:read">{withSuspense(<DmsTrashPage />)}</PermissionRoute> },
+      { path: '/trash', element: <PermissionRoute permission="contacts:read">{withSuspense(<TrashPage />)}</PermissionRoute> },
       { path: '/mail', element: <PermissionRoute permission="mail:read">{withSuspense(<MailPage />)}</PermissionRoute> },
       { path: '/mail/settings', element: <PermissionRoute permission="mail:read">{withSuspense(<MailSettingsPage />)}</PermissionRoute> },
       { path: '/ai-assistant', element: <PermissionRoute permission="ai:read">{withSuspense(<AIAssistantPage />)}</PermissionRoute> },

tests/test_restore_registry.py

@@ -0,0 +1,443 @@
+"""Tests for Phase D — Restore Registry, History Hooks, Trash, Bulk Restore, Retention."""
+
+from __future__ import annotations
+
+import uuid
+from datetime import datetime, timezone
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+
+from app.core.restore_registry import (
+    RestoreConfig,
+    RestoreRegistry,
+    get_restore_registry,
+    reset_restore_registry_for_testing,
+)
+from app.core.history_hooks import (
+    _extract_entity_id,
+    register_history_hooks,
+    reset_history_hooks_for_testing,
+)
+from app.services.entity_history_service import (
+    archive_old_history,
+    bulk_restore,
+    list_trash,
+    record_history,
+    restore_from_history,
+)
+
+
+# ─── Restore Registry Tests ───
+
+
+class TestRestoreRegistry:
+    """Tests for the RestoreRegistry singleton."""
+
+    def setup_method(self):
+        reset_restore_registry_for_testing()
+
+    def test_register_and_get(self):
+        reg = get_restore_registry()
+        config = RestoreConfig(
+            entity_type="test_entity",
+            model_class=MagicMock,
+            restore_permission="test:write",
+        )
+        reg.register(config)
+        assert reg.get("test_entity") is config
+
+    def test_get_unregistered_returns_none(self):
+        reg = get_restore_registry()
+        assert reg.get("nonexistent") is None
+
+    def test_is_registered(self):
+        reg = get_restore_registry()
+        config = RestoreConfig(
+            entity_type="test_entity",
+            model_class=MagicMock,
+            restore_permission="test:write",
+        )
+        reg.register(config)
+        assert reg.is_registered("test_entity") is True
+        assert reg.is_registered("nonexistent") is False
+
+    def test_list_registered(self):
+        reg = get_restore_registry()
+        reg.register(RestoreConfig("alpha", MagicMock, "a:write"))
+        reg.register(RestoreConfig("beta", MagicMock, "b:write"))
+        assert reg.list_registered() == ["alpha", "beta"]
+
+    def test_overwrite_warns(self, caplog):
+        reg = get_restore_registry()
+        reg.register(RestoreConfig("test", MagicMock, "t:write"))
+        reg.register(RestoreConfig("test", MagicMock, "t:write2"))
+        assert reg.get("test").restore_permission == "t:write2"
+
+    def test_excluded_fields_merge(self):
+        config = RestoreConfig(
+            entity_type="test",
+            model_class=MagicMock,
+            restore_permission="t:write",
+            excluded_fields=frozenset({"custom_field", "secret"}),
+        )
+        excluded = config.all_excluded_fields
+        assert "id" in excluded
+        assert "tenant_id" in excluded
+        assert "deleted_at" in excluded
+        assert "custom_field" in excluded
+        assert "secret" in excluded
+
+
+class TestRestoreFromHistory:
+    """Tests for restore_from_history with registry."""
+
+    @pytest.mark.asyncio
+    async def test_restore_unsupported_entity_type_raises(self):
+        """Restore should raise ValueError for unregistered entity types."""
+        reset_restore_registry_for_testing()
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+        user_id = uuid.uuid4()
+        history_id = uuid.uuid4()
+
+        # Mock get_history_entry to return an entry with unregistered type
+        with patch("app.services.entity_history_service.get_history_entry") as mock_get:
+            mock_entry = MagicMock()
+            mock_entry.entity_type = "unsupported_type"
+            mock_entry.entity_id = uuid.uuid4()
+            mock_entry.action = "delete"
+            mock_get.return_value = mock_entry
+
+            with pytest.raises(ValueError, match="Unsupported entity type"):
+                await restore_from_history(db, tenant_id, history_id, user_id)
+
+    @pytest.mark.asyncio
+    async def test_restore_history_not_found_raises(self):
+        """Restore should raise ValueError if history entry not found."""
+        reset_restore_registry_for_testing()
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+        user_id = uuid.uuid4()
+        history_id = uuid.uuid4()
+
+        with patch("app.services.entity_history_service.get_history_entry") as mock_get:
+            mock_get.return_value = None
+
+            with pytest.raises(ValueError, match="History entry not found"):
+                await restore_from_history(db, tenant_id, history_id, user_id)
+
+
+# ─── History Hooks Tests ───
+
+
+class TestHistoryHooks:
+    """Tests for hook-based history recording."""
+
+    def test_extract_entity_id_from_uuid(self):
+        eid = uuid.uuid4()
+        assert _extract_entity_id({"id": eid}) == eid
+
+    def test_extract_entity_id_from_string(self):
+        eid = uuid.uuid4()
+        assert _extract_entity_id({"id": str(eid)}) == eid
+
+    def test_extract_entity_id_none(self):
+        assert _extract_entity_id(None) is None
+        assert _extract_entity_id({}) is None
+        assert _extract_entity_id({"id": None}) is None
+
+    def test_extract_entity_id_invalid(self):
+        assert _extract_entity_id({"id": "not-a-uuid"}) is None
+
+    def test_register_history_hooks(self):
+        """Test that hooks are registered correctly."""
+        reset_history_hooks_for_testing()
+        from app.core.hooks import get_hook_registry
+
+        reg = get_hook_registry()
+        register_history_hooks(
+            reg, "test_entity",
+            "test_entity.after_create",
+            "test_entity.after_update",
+            "test_entity.after_delete",
+        )
+
+        assert reg.has_action("test_entity.after_create")
+        assert reg.has_action("test_entity.after_update")
+        assert reg.has_action("test_entity.after_delete")
+
+    @pytest.mark.asyncio
+    async def test_history_hook_create_calls_record_history(self):
+        """Test that after_create hook calls record_history."""
+        reset_history_hooks_for_testing()
+        from app.core.hooks import do_action, get_hook_registry
+
+        reg = get_hook_registry()
+        register_history_hooks(
+            reg, "test_entity",
+            "test_entity.after_create",
+            "test_entity.after_update",
+            "test_entity.after_delete",
+        )
+
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+        user_id = uuid.uuid4()
+        entity_id = uuid.uuid4()
+
+        with patch("app.core.history_hooks.record_history", new_callable=AsyncMock) as mock_rh:
+            await do_action(
+                "test_entity.after_create",
+                {"id": str(entity_id), "name": "Test"},
+                db=db, tenant_id=tenant_id, user_id=user_id,
+            )
+            mock_rh.assert_called_once()
+            call_args = mock_rh.call_args
+            # record_history(db, tenant_id, user_id, entity_type, entity_id, action=..., snapshot_after=...)
+            # args: (db, tenant_id, user_id, entity_type, entity_id)
+            # kwargs: action=..., snapshot_after=...
+            assert call_args.args[3] == "test_entity"  # entity_type
+            assert call_args.args[4] == entity_id  # entity_id
+            assert call_args.kwargs.get("action") == "create"  # action
+
+
+# ─── Trash List Tests ───
+
+
+class TestTrashList:
+    """Tests for list_trash service function."""
+
+    @pytest.mark.asyncio
+    async def test_list_trash_returns_delete_entries(self):
+        """list_trash should only return delete actions."""
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+
+        # Mock the query results
+        mock_entry1 = MagicMock()
+        mock_entry1.id = uuid.uuid4()
+        mock_entry1.entity_type = "contact"
+        mock_entry1.entity_id = uuid.uuid4()
+        mock_entry1.snapshot_before = {"name": "John"}
+        mock_entry1.created_at = datetime.now(timezone.utc)
+        mock_entry1.user_id = uuid.uuid4()
+
+        mock_result = MagicMock()
+        mock_result.scalars.return_value.all.return_value = [mock_entry1]
+
+        mock_count_result = MagicMock()
+        mock_count_result.scalar.return_value = 1
+
+        db.execute = AsyncMock(side_effect=[mock_count_result, mock_result])
+
+        result = await list_trash(db, tenant_id, limit=50, offset=0)
+
+        assert result["total"] == 1
+        assert len(result["items"]) == 1
+        assert result["items"][0]["entity_type"] == "contact"
+
+    @pytest.mark.asyncio
+    async def test_list_trash_with_entity_type_filter(self):
+        """list_trash should filter by entity_type."""
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+
+        mock_result = MagicMock()
+        mock_result.scalars.return_value.all.return_value = []
+
+        mock_count_result = MagicMock()
+        mock_count_result.scalar.return_value = 0
+
+        db.execute = AsyncMock(side_effect=[mock_count_result, mock_result])
+
+        result = await list_trash(db, tenant_id, entity_type="task", limit=50, offset=0)
+
+        assert result["total"] == 0
+        assert result["items"] == []
+
+
+# ─── Bulk Restore Tests ───
+
+
+class TestBulkRestore:
+    """Tests for bulk_restore service function."""
+
+    @pytest.mark.asyncio
+    async def test_bulk_restore_all_success(self):
+        """bulk_restore should succeed for all valid entries."""
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+        user_id = uuid.uuid4()
+        hid1 = uuid.uuid4()
+        hid2 = uuid.uuid4()
+
+        with patch("app.services.entity_history_service.restore_from_history", new_callable=AsyncMock) as mock_restore:
+            mock_restore.side_effect = [
+                {"id": str(uuid.uuid4()), "_entity_type": "contact", "_restored": True},
+                {"id": str(uuid.uuid4()), "_entity_type": "task", "_restored": True},
+            ]
+
+            result = await bulk_restore(db, tenant_id, [hid1, hid2], user_id)
+
+        assert result["total"] == 2
+        assert result["succeeded"] == 2
+        assert result["failed"] == 0
+        assert result["partial_success"] is False
+
+    @pytest.mark.asyncio
+    async def test_bulk_restore_partial_failure(self):
+        """bulk_restore should report partial_success when some fail."""
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+        user_id = uuid.uuid4()
+        hid1 = uuid.uuid4()
+        hid2 = uuid.uuid4()
+
+        with patch("app.services.entity_history_service.restore_from_history", new_callable=AsyncMock) as mock_restore:
+            mock_restore.side_effect = [
+                {"id": str(uuid.uuid4()), "_entity_type": "contact"},
+                ValueError("Entity not found"),
+            ]
+
+            result = await bulk_restore(db, tenant_id, [hid1, hid2], user_id)
+
+        assert result["total"] == 2
+        assert result["succeeded"] == 1
+        assert result["failed"] == 1
+        assert result["partial_success"] is True
+        assert result["results"][1]["error"] == "Entity not found"
+
+    @pytest.mark.asyncio
+    async def test_bulk_restore_all_fail(self):
+        """bulk_restore should report no partial_success when all fail."""
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+        user_id = uuid.uuid4()
+
+        with patch("app.services.entity_history_service.restore_from_history", new_callable=AsyncMock) as mock_restore:
+            mock_restore.side_effect = [ValueError("Not found"), ValueError("Not found")]
+
+            result = await bulk_restore(db, tenant_id, [uuid.uuid4(), uuid.uuid4()], user_id)
+
+        assert result["succeeded"] == 0
+        assert result["failed"] == 2
+        assert result["partial_success"] is False
+
+
+# ─── Retention Tests ───
+
+
+class TestRetention:
+    """Tests for archive_old_history service function."""
+
+    @pytest.mark.asyncio
+    async def test_archive_old_history_returns_count(self):
+        """archive_old_history should return the number of archived entries."""
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+
+        mock_result = MagicMock()
+        mock_result.rowcount = 42
+        db.execute = AsyncMock(return_value=mock_result)
+
+        count = await archive_old_history(db, tenant_id, days=90)
+
+        assert count == 42
+        db.flush.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_archive_old_history_zero_when_none(self):
+        """archive_old_history should return 0 when no entries to archive."""
+        db = AsyncMock()
+        tenant_id = uuid.uuid4()
+
+        mock_result = MagicMock()
+        mock_result.rowcount = 0
+        db.execute = AsyncMock(return_value=mock_result)
+
+        count = await archive_old_history(db, tenant_id, days=90)
+
+        assert count == 0
+
+
+# ─── Sensitive Fields Exclusion Tests ───
+
+
+class TestSensitiveFieldsExclusion:
+    """Tests that sensitive fields are excluded from restore."""
+
+    def test_default_excluded_fields(self):
+        """Default excluded fields should include id, tenant_id, timestamps."""
+        from app.core.restore_registry import _DEFAULT_EXCLUDED
+
+        assert "id" in _DEFAULT_EXCLUDED
+        assert "tenant_id" in _DEFAULT_EXCLUDED
+        assert "created_at" in _DEFAULT_EXCLUDED
+        assert "updated_at" in _DEFAULT_EXCLUDED
+        assert "deleted_at" in _DEFAULT_EXCLUDED
+        assert "search_tsv" in _DEFAULT_EXCLUDED
+        assert "embedding" in _DEFAULT_EXCLUDED
+
+    def test_contact_excluded_fields(self):
+        """Contact should exclude search_tsv, embedding, and relationship IDs."""
+        reset_restore_registry_for_testing()
+        from app.core.restore_registry import register_default_entities
+
+        register_default_entities()
+        reg = get_restore_registry()
+        config = reg.get("contact")
+
+        assert config is not None
+        excluded = config.all_excluded_fields
+        assert "search_tsv" in excluded
+        assert "embedding" in excluded
+        assert "default_person_id" in excluded
+        assert "admin_contactperson_id" in excluded
+
+    def test_dms_file_excludes_storage_path(self):
+        """DMS File should exclude storage_path, content_hash, size_bytes."""
+        reset_restore_registry_for_testing()
+        from app.core.restore_registry import register_default_entities
+
+        register_default_entities()
+        reg = get_restore_registry()
+        config = reg.get("dms_file")
+
+        assert config is not None
+        excluded = config.all_excluded_fields
+        assert "storage_path" in excluded
+        assert "content_hash" in excluded
+        assert "size_bytes" in excluded
+        assert "uploaded_by" in excluded
+
+    def test_mail_excludes_message_id_and_raw_path(self):
+        """Mail should exclude message_id, rfc822_size, raw_path."""
+        reset_restore_registry_for_testing()
+        from app.core.restore_registry import register_default_entities
+
+        register_default_entities()
+        reg = get_restore_registry()
+        config = reg.get("mail")
+
+        assert config is not None
+        excluded = config.all_excluded_fields
+        assert "message_id" in excluded
+        assert "rfc822_size" in excluded
+        assert "raw_path" in excluded
+        assert config.special_handler is not None
+
+    def test_all_default_entities_registered(self):
+        """register_default_entities should register all 5 entity types."""
+        reset_restore_registry_for_testing()
+        from app.core.restore_registry import register_default_entities
+
+        register_default_entities()
+        reg = get_restore_registry()
+        registered = reg.list_registered()
+
+        assert "contact" in registered
+        assert "task" in registered
+        assert "calendar_entry" in registered
+        assert "dms_file" in registered
+        assert "mail" in registered