Tracer: purge Channel content with a durable restore-safe ledger

Parent

Native sub-issue of #138; required implementation prerequisite for complete-core Profile Backup/Restore #886 under #882. Milestone v1.1, Project V1 · Memory. Target contract: ADR-0037/0042 and ADR-0130.

Observable behavior

Human ends a local Channel while preserving its history, then separately reviews and confirms Content Purge of selected Source Event content. The UI shows a retained causal/audit tombstone instead of purged bodies after cold restart. The owning production Purge Ledger supplies a real export checkpoint and enforces a package/destination union against a restored older disposable snapshot before Messaging becomes readable.

Acceptance

Ordinary Channel deletion ends active membership/routes/admission/effects and retains history; Hidden Channel remains reversible. Bridged deletion affects local routes only, leaving external conversations and unrelated Channel/Inbox targets intact. Preserve any already-issued Outbox Unknown Outcome honestly.
A separate Human-only Content Purge entry presents source scope, all affected shared placements/Admissions, referenced managed files and Memory/Workspace/export derivatives before confirmation. Body authority is Source Event, not Channel placement. Stale scope/ref revisions require a new preview; cancelled preview changes nothing.
A canonical Host-lifetime deep module owns a validated, monotonic durable Purge Ledger outside restorable operational database snapshots. It contains stable selectors and minimum audit/causal metadata, never the purged bodies; no in-memory/JSON shadow, placeholder checkpoint or restoration rollback of target purge facts.
Ledger acceptance precedes Messaging body removal and reference-aware managed file cleanup. Application/recovery is idempotent and fail-closed: accepted scopes cannot be read, delivered or used for new external effects during interrupted cleanup. Ledger corruption/unavailability cannot mount writable/readable Messaging under a fabricated empty state. Required bounded diagnostics contain no source bodies or secrets.
Retain minimum event identity, causal links and purge actor/time/reason tombstones. Clean only exclusively referenced managed attachment bytes after revalidation; shared references retain files. Handle current real-file identities/bindings and still-reachable legacy CAS, not hashes alone. Do not silently rewrite user-owned Memory/Workspace copies or DSH Session Persistence.
Fence duplicate ingress, provider reconciliation, stale commands and pending content-dependent Outbox effects against accepted purge facts; a late duplicate cannot refill an erased body. Started requests settle through actual Outbox rules rather than being declared cancelled or automatically retried.
Publish an owning-module checkpoint/export, validated monotonic union and apply-before-Messaging contract for Tracer: export a complete Profile and restore as new with explicit activation #886. Serialize with its future Backup Barrier. Real SQLite/managed-file tests restore an older disposable snapshot and verify destination/package union, missing/corrupt/unsupported checkpoints, interrupted acceptance/application and cold restart without old bodies reappearing. This is a testable contract, not a disconnected schema-only foundation or a UI claim that full Profile Backup exists.
Preview and completion disclose surviving DSH prompt/results, external provider copies, Git remotes and Human-managed offline backups. Old standalone files guarantee only their contained checkpoint; no automatic catalog, backup deletion, scheduler or online requirement is introduced.
Real DSH E2E covers history-preserving deletion, separate confirmation/cancel, selected purge, shared-source/file retention, interrupted cleanup and cold restart. Genuine screenshots/recording, meaningful owning-module regressions and required checks are in the PR; pause for Human QA.

Blocked by

设计：PersonaBot / Channel 破坏性删除与 Purge 依赖契约 #138 — accepted deletion/Purge dependency design.
Tracer: delete a PersonaBot with explicit optional Memory erasure #896 — durable retained/deleted-identity repository locators required by the dependency preview and complete backup scope.

Unblocks

#886. Add this actual native blocking edge before starting Profile backup implementation; accepted design alone is insufficient.

Non-goals

Full .botharness-backup UI/restore implementation, broad Purge Everywhere, provider recall, DSH Session erasure, automatic pruning or shared filesystem cleanup. No real user content is erased by test fixtures.

Agent work claim

Agent: Codex
Task: codex/local/01a11a78-5bd0-7e71-9603-2d7b2cfda2f5 (not a DSH Session)
Issue scope: Tracer: purge Channel content with a durable restore-safe ledger #897 Channel deletion/history and Human-only restore-safe Content Purge through the owning Host module, RPC and Client; no Profile Backup UI.
Branch: codex/897-channel-purge
Started: 2026-10-08 08:07 UTC
State: active

Rechecked: #138 and #896 closed; no existing claim or matching open PR. First tracer targets a disposable local Channel: retained-history deletion, source-scope preview/cancel/confirm, durable acceptance and cold-start tombstone. Subsequent work stays inside #897 acceptance. Synthetic disposable QA content only; stop at Human QA, no merge/release.

Agent work progress — first local-text tracer

Task: codex/local/01a11a78-5bd0-7e71-9603-2d7b2cfda2f5; branch codex/897-channel-purge; active.

Implemented Host-owned independent SQLite Purge Ledger, selected-source preview/confirmation, fail-closed interrupted application, cold startup before Messaging, actual checkpoint and validated destination/package union against an older disposable SQLite snapshot. Client has ended-Group retained history and separate destructive consent. Scope is deliberately restricted to text in ended local Groups with all shared placements ended; external sources, files/bindings, active deliveries and complex derivatives are refused. This will be a Refs #897 first-slice PR for Human feedback, not a completion claim or #886 unblock.

Focused checks currently have 117 passing assertions/tests and one Windows managed-file upload fsync refusal in unchanged attachment code. The 10 existing bridge-RPC cleanup EPERM failures also reproduce on an untouched main copy. Real DSH UI deletion/history and matching main before screenshots are captured; selected Purge/cancel/confirm/restart qualification is in progress. A real Client message shape (empty attachment array on text) exposed and fixed a scope-check bug, now covered by the owning regression. Only task-owned synthetic disposable QA content is used.

merge: preserve main typing migration before purge generation 68

fix: preserve recovery diagnostics and complete bridge contracts

Agent work outcome — first slice ready for Human QA

Agent task: codex/local/01a11a78-5bd0-7e71-9603-2d7b2cfda2f5 (not a DSH Session)
State: handed-off
PR: feat: ended Group text purge with a durable ledger (Refs #897) #1182 — Refs Tracer: purge Channel content with a durable restore-safe ledger #897, draft; no merge or release
Head: 8f7c55d1; integrated main 89515335, preserving its typing migration at 67 and advancing Content Purge to Generation 68
Required Linux verify passed: 3,237 tests passed / nine skipped; lint, format, typecheck, slides, build and generated-bundle checks. Windows attachment upload/RPC cleanup EPERM limitations remain documented; the merged typing timeout passed all 14 tests on isolated rerun.
Actual DSH 0.2.0-rc.1, fresh disposable Generation 68 Profile: real Client send/end/history, no-default-selection, separate preview/cancel/confirm, only selected body removed, same-name Group identity isolation, cold restart with tombstone/unselected history retained. Updated UI follows Human feedback: 760px desktop modal, compact scrolling/actions and hover/click information controls for detailed strings. All 17 published screenshot assets return image responses and GitHub renders all 17 in the PR body.

This is the first qualified local-text path, not completion of #897 and not an unblock of #886. It supplies an owning independent SQLite ledger, real checkpoint/validated monotonic union, apply-before-Messaging recovery and persistent accepted-scope fences, with actual older SQLite snapshot and interrupted-application tests. Files/bindings, external sources, running Admissions, Assignments, causal descendants and linked Outbox intents are refused before acceptance.

Remaining: reference-aware current/legacy file cleanup and recovery, external ingress/reconciliation and started-effect qualification, wider access/dependency policy, real DSH interrupted-cleanup/shared-file restore scenarios, and the future asynchronous Profile Backup Barrier. Pause here for Human QA and feedback before extending this scope. No real user content was erased; all fixtures used synthetic disposable text/files.

Report recorded Memory and possible Workspace derivatives before purge

Normalize architecture source formatting

Redact shared-source Client caches after Content Purge

Preserve shared Channel placement identities in message projections

Verify shared placement quotes through Content Purge

Assert purged shared messages by placement identity

Merge current main while retaining complete Content Purge delivery

Agent work outcome — complete #897 implementation ready for Human QA

Agent task: codex/local/01a11a78-5bd0-7e71-9603-2d7b2cfda2f5 (not a DSH Session)
State: handed-off
One completion PR: #1190, ready for review, Closes Tracer: purge Channel content with a durable restore-safe ledger #897; final head 0fff20efa7e5b0fea50a0b9bb1195b4f0993c79c, integrated current main 455e16b0.
Required Linux verify passed: 3,279 tests passed / nine skipped, 404 files passed / five skipped; lint, format, typecheck, slides, build, docs and committed-bundle consistency. The 63-case focused owner/live/Client run also passed.
Remaining Tracer: purge Channel content with a durable restore-safe ledger #897 implementation is completed in this PR: real/current and reachable legacy managed-file cleanup with shared-reference retention; shared/external source and started-effect qualification; duplicate/stale/native tool fences and honest issued-Outbox settlement; recorded Memory and possible Workspace dependency disclosure; asynchronous checkpoint serialization; validated destination/package union on existing and fresh destinations; idempotent interrupted cleanup and fail-closed cold startup.
Real DSH evidence covers uploaded files, preview/cancel/confirm, only selected content removed, shared files retained, interrupted cleanup, cold restart and restoring older SQLite/attachment files. A fresh integrated shared-source/Memory scenario additionally verifies both placements, an active shared Channel, sidebar and recorded Memory Git bytes. Live/cached Client views and delayed responses are fenced; Channel reads, pagination and quoted previews use each placement identity. Browser console has zero errors/warnings and the Host diagnostic reader confirms shell-ready. All 19 matched light/dark/compact PR images render on GitHub and return actual PNGs.

No implementation slice remains deferred from #897. The issue's explicit Human QA gate is the remaining step before merging this one PR; no automatic merge, release, administrative issue closure or real-user content purge was performed. Merging #1190 will close #897 and fulfill its implementation prerequisite for #886; retain the actual #886 blocking edge until then. Full Profile Backup/Restore remains #886's own scope.

Agent work resumed — authorized conflict resolution and merge

Task: codex/local/01a11a78-5bd0-7e71-9603-2d7b2cfda2f5
State: active
Scope: Human authorized resolving current conflicts and merging Complete Channel Content Purge and recovery (#897) #1190. Preserve main's WeChat defaults migration at Generation 69, append Content Purge completion at Generation 70, verify migration/runtime regressions and required CI, then merge this same PR and verify Tracer: purge Channel content with a durable restore-safe ledger #897 closure.

Merge main and sequence Content Purge after WeChat defaults

Agent work outcome — merged with Human authorization

Task: codex/local/01a11a78-5bd0-7e71-9603-2d7b2cfda2f5
State: completed
Human explicitly authorized resolving conflicts and merging this completion PR.
Merged PR: #1190
Squash commit: 92965cf1699a7b034b35286b40f1d64db1da2dec; verified head 80a6adb53c621e0c69ffac245b8974711df17c0e.
Required final Linux verify passed: 3,294 tests / nine skipped, lint, formatting, typecheck, slides, build, docs and committed-bundle consistency. All 73 focused merge-qualification cases passed.
Conflict resolution retained main's exact WeChat Generation 69 migration and appended Content Purge at Generation 70. The regression verifies preserved WeChat defaults and replay of an accepted v1 purge checkpoint. A fresh Generation 70 DSH Profile passed shared-source/Memory purge QA, with zero browser console errors/warnings and shell-ready diagnostics.
GitHub automatically closed Tracer: purge Channel content with a durable restore-safe ledger #897 through the merged PR at 2026-10-08 11:19:40 UTC. Native Tracer: export a complete Profile and restore as new with explicit activation #886 dependency inspection confirms all six recorded blockers, including Tracer: purge Channel content with a durable restore-safe ledger #897, are now closed; its separate Profile Backup implementation may proceed.

Navigation Menu

Repository navigation

Tracer: purge Channel content with a durable restore-safe ledger #897

Parent

Observable behavior

Acceptance

Blocked by

Unblocks

Non-goals

Agent work claim

Agent work progress — first local-text tracer

Agent work outcome — first slice ready for Human QA

5 remaining items

Agent work outcome — complete #897 implementation ready for Human QA

Agent work resumed — authorized conflict resolution and merge

Agent work outcome — merged with Human authorization

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Tracer: purge Channel content with a durable restore-safe ledger #897

Description

Parent

Observable behavior

Acceptance

Blocked by

Unblocks

Non-goals

Activity

DoodleBears commented on Oct 8, 2026

Agent work claim

DoodleBears commented on Oct 8, 2026

Agent work progress — first local-text tracer

DoodleBears commented on Oct 8, 2026

Agent work outcome — first slice ready for Human QA

5 remaining items

DoodleBears commented on Oct 8, 2026

Agent work outcome — complete #897 implementation ready for Human QA

DoodleBears commented on Oct 8, 2026

Agent work resumed — authorized conflict resolution and merge

DoodleBears commented on Oct 8, 2026

Agent work outcome — merged with Human authorization

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions