A final update: the implementation is now up as a ready-for-review PR:
https://github.com/discourse/discourse/pull/43323
The final design is the per-admin opt-in approach described above rather than the site-wide enum I originally suggested.
A couple of UX details were added during the final pass:
- the per-admin preference is shown under Preferences → Interface when the site-level gates allow it
- when an opted-in admin permanently deletes the first post/topic, the irreversible confirmation now explicitly says that it will permanently delete the topic and all replies
- when the admin is not opted in, the existing behaviour and wording remain unchanged
- the existing same-admin permanent-delete cooldown is still enforced
- preference changes are recorded in Staff Action Logs
I also manually tested the complete opted-in path on a disposable topic with two replies and verified afterward that the topic and all of its posts had been removed from the database.
The main GitHub test/lint checks have passed; the PR is now waiting for review, with the security scan still queued at the time of writing.