engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3)

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Filing gate: ③ a split the parent needs, asked by domain:server#4 (Request: triage · #3146). ⛔ Not a claim.

Blocked-by: #30235
Part of #3146 · Ruling-ref: 6629858351 (the recycle-bin shape, maintainer 「同意，企业版功能在 cloud 中立卡后续开发」)

Wanted

The engine half of the ruled v1:

Snapshot: before a physical delete, write the rows it removes (the cascade set from engine-delete-cascade.ts) into one bin entry, then delete as today. Business objects only, not sys_*.
Restore: write the rows back under their original ids, keep created_by / created_at, and restore a master-detail cascade together. Refuse with a reason, never a forced write, when a unique value is taken, the parent is purged, or the package is uninstalled. Re-link a set_null lookup only if nothing has changed it since. Emit a "restored" event, never a create. Rollups recompute.
Purge and TTL: permanent delete never enters the bin. A TTL reap runs on the existing LifecycleService (the sys_file tombstone pattern).
Permissions: a person restores what they deleted, and an admin sees all.

Every read path stays untouched.

Order: after #30235 (spec). The UI slice reads it.

Generated by Claude Code

docs(adr): ADR-0148 marks the record's own choices, stamps the purge …

docs(adr): ADR-0148 names ADR-0087's kit rule, the ref a snapshot wou…

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

The spec half of the recycle bin landed: PR #30577 merged at d9d42d4e, closing #30235. This card's Blocked-by: #30235 target is now closed. What this card inherits from it, so the engine slice starts from the record and not from the PR thread:

The four seat decisions #30235 was built on (takeover comment 6662490518 on #30235), binding on this card's reading of the spec:

restored is a spec constant only, RECORD_RESTORED_EVENT = 'data.record.restored'. DataEventType / RealtimeEventType list emitted events, so the member joins them in the change that emits it: this card (the pin in recycle-bin.zod.test.ts that keeps it out flips with it).
sys-recycle-bin.object.ts, its plugin registration and its PLATFORM_OBJECTS_BY_PACKAGE row are this card's. The spec fixes the name (RECYCLE_BIN_OBJECT) and the full field contract (RECYCLE_BIN_ENTRY_FIELDS, value shape RecycleBinEntrySchema); build the object from them.
allowRestoreOwnDeleted and manageRecycleBin are planned rows in packages/spec/liveness/permission.json naming this card (evaluator mapping, engine doors) and ui: the admin recycle-bin page (list, restore, empty) and the 已删除 · 撤销 toast (#3146 slice 4) #30239 (Console). This card flips both to live when it reads them.
RESTORE_UNIQUE_VALUE_TAKEN, RESTORE_PARENT_PURGED, RESTORE_PACKAGE_UNINSTALLED are in the error-code ledger under @objectstack/objectql ahead of their producer, status 409 (RECYCLE_BIN_RESTORE_REFUSAL_STATUS); once this card stamps them, the error-status conformance deriver pins the status.

Carried from #30577's contract review (6664134926) and the seat's ACCEPT (6664274007), each owed here:

Should-fix 1: RecycleBinClearedReferenceSchema's docblock and describe say a cleared reference is re-linked "only if the field still holds no value". On main the cascade clears a set_null member of a multi-valued lookup by removing that member and keeping the rest (engine-cascade-planning.ts remainderAfterMemberRemoval), so read literally the sentence never re-links a multi-valued reference, while ADR-0148 D2 rules "only if nothing has changed it since". Restate it for both arities (a single-valued field re-links when it still holds no value; a multi-valued one when it no longer holds the member) before implementing re-link; one describe edit plus gen:docs, the shape needs no change.
Should-fix 2: the two grant keys' describes say nothing on whether modifyAllRecords implies them or whether allowRead bounds them (as allowExport states for itself). Write those sentences when the reader lands, and in the same stroke re-point the restore / purge guidance, the allowRestore / allowPurge tombstone text and the liveness/permission.json notes at D5's answer (respelled; the tombstones stay through the ADR-0087 kit schedule).
Reader-side additions the spec PR left out on purpose: OPERATION_TO_PERMISSION in plugin-security/src/permission-evaluator.ts; GRANT_BITS in core/src/security/effective-object-permissions.ts, which the '*' wildcard materialisation and the verb-less-entry fold also key on; ObjectPermissionVerbTarget / objectPermissionGrants in spec/src/security/permission.zod.ts (a spec widening riding this card, with its own Clause-②: yes).
The object file's managedBy: engine-owned rows survive an organization delete today (engine-cascade-planning.ts), and D4 says an organization's bin entries go with it; the object this card registers owes that answer.
Skills-docs: skills/objectstack-api/SKILL.md (:268, :417) teaches that the trash surface is retired and there is no recycle bin; true until this card ships the reader, then rewritten (Tier H surface).

For #30239: CAPS in ui/packages/app-shell/src/views/metadata-admin/previews/PermissionPreview.tsx lists neither grant key.

Generated by Claude Code

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Unblock · 2026-11-06T00:27Z · `Blocked-by: #30235` closed

Blocker: spec: declare the recycle-bin surface — the sys_recycle_bin object, the retention hook and the restore refusals (#3146 slice 2) #30235 is closed, by PR feat(spec): declare the recycle-bin surface: the sys_recycle_bin entry contract, the retention hook, the restore refusals, the restored event and two grant keys (ADR-0148) #30577 (merged d9d42d4e). The spec seat's hand-over note 6665087359 lists what this card inherits.
Re-derived: the card's Wanted list still stands on main. The spec half fixes RECYCLE_BIN_OBJECT, RECYCLE_BIN_ENTRY_FIELDS / RecycleBinEntrySchema, RECORD_RESTORED_EVENT, the three RESTORE_* 409 codes in the ledger, and the planned grant rows in liveness/permission.json. The engine half (snapshot, restore, purge/TTL, permissions, the object and its registration) is still unbuilt. No open PR names this card or the recycle bin.
Carried into the claim: the two should-fix items from feat(spec): declare the recycle-bin surface: the sys_recycle_bin entry contract, the retention hook, the restore refusals, the restored event and two grant keys (ADR-0148) #30577's contract review (the multi-valued re-link sentence, and the grant-key describes), the reader-side additions, the managedBy answer for organization delete, and the skills/objectstack-api/SKILL.md follow-up, all from 6665087359.
pm:blocked → pm:queue. Being p1 and pm:blocking, it heads the server order, and this seat claims it in the next comment.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Claim: PM loop round 4 · 2026-11-06T00:28Z
Session: session_016WV4cytLmJxfAmgPVjUbbW
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: the card thread's designated claude/project-thread-* branch, named in a claim amendment once the thread reports it
Worktree: objectstack-issue-30237
Domain: domain:server
Seat: domain:server#1
File surface (to be narrowed by amendment after the thread's first reading): packages/objectql/src/** (delete snapshot beside engine-delete-cascade.ts, restore, purge, the TTL reap on the LifecycleService, the restored event), the sys_recycle_bin object file and its plugin registration, plugin-security/src/permission-evaluator.ts (OPERATION_TO_PERMISSION), core/src/security/effective-object-permissions.ts (GRANT_BITS), their tests, the census/inventory rows, changesets. packages/spec/** only as the spec seat's hand-over 6665087359 allocates to this card: the PLATFORM_OBJECTS_BY_PACKAGE row, DataEventType / RealtimeEventType gaining the restored member (with its pin), liveness/permission.json planned → live, ObjectPermissionVerbTarget / objectPermissionGrants, and the two describe should-fixes. Each is named in an amendment before it is edited, with the spec seat told. ⛔ ui/** (#30239); ⛔ skills/** (follow-up card, Tier H)
Container & model: L, p1, mode:thread, model: default, effort: xhigh; a PR split is expected and is proposed by the thread before its first PR
Clause-②: yes (widening)
Metadata-protocol: added
Responsibility: deletes in packages/objectql | a physical delete with no way back | every tenant user who deletes a record by mistake, and the admin who cannot restore it
Thread-read: 6665087359
Premise: holds per ruling 6629858351 (maintainer 「同意，企业版功能在 cloud 中立卡后续开发」) and ADR-0148; the engine half is unbuilt on main
Serial constraints cleared: #30235 closed (PR #30577). No open PR names the recycle bin; open PR file lists are re-read by the thread before its first push.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448

Branch: claude/project-thread-jf62r6 (the card thread's harness-pinned branch, objectstack-ai/objectstack; platform exception to claude/issue-<n>-<slug>).
Dev session: session_016WV4czFGLnXKQd6cQjv3Pr
Plan: five PRs, serial on that branch, each cut from main after the previous one merges and each under 3000 lines: (1) object + snapshot on delete + TTL reap; (2) purge, empty, permanent delete; (3) restore; (4) the permission reader; (5) the REST doors.

PR 1 file surface (this amendment admits PR 1 only; each later PR gets its own amendment): packages/platform-objects/src/system/sys-recycle-bin.object.ts (new), system/index.ts, plugin.ts and their tests, the generated translation bundles if check:i18n derives them; packages/objectql/src/recycle-bin/ (new: eligibility, snapshot, retention, with tests), engine-cascade-planning.ts (hand the collected set to the snapshot; record each cleared reference for the D2 re-link), engine.ts (the by-id delete branch), engine-top-level.ts (retention seam types), plugin.ts (ObjectQLPluginOptions retention seam); the census and inventory rows the new sys_* object trips; one scripts/adr-anchors/ JSON; changesets. packages/spec/** for PR 1: the sys_recycle_bin line in system/constants/platform-object-names.ts (allocated to this card by 6665087359) and the data/recycle-bin.zod.ts docblock sentence saying the object lands with the engine slice. The spec seat is told before either is pushed.

Seat decisions (from the thread's open questions): Q1: serial on the one branch. Q2: the host passes the retention resolver and its token once at boot; no spec change. Q4: managedBy: 'engine-owned', with the object's organization_id declared deleteBehavior: 'cascade', so an organization's delete removes its entries (ADR-0148 D4). Q6: the literal ruling. A by-id delete of a business object enters the bin; sys_* rows in its cascade, predicate deletes, lifecycle reaps and cascade children do not, and the release notes say so. To the maintainer: Q3 (who may delete permanently: rides PR 2) and Q5 (the grant fold: rides PR 4); neither blocks PR 1.

domain:server#1 · os-elon-musk · session_016WV4czFGLnXKQd6cQjv3Pr
os-dev-report

{
  "issue": 30237,
  "status": "done",
  "branch": "claude/project-thread-jf62r6",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30780",
  "session": "session_016WV4czFGLnXKQd6cQjv3Pr",
  "premise_still_valid": true,
  "summary": "PR 1 of the seat's five-PR split (claim amendment 6673429400), opened as a draft with `Part of #30237`. It adds the engine-owned `sys_recycle_bin` object (fields from the spec's RECYCLE_BIN_ENTRY_FIELDS, cascading tenant column, TTL on `purge_after`) and the snapshot on delete: a by-id delete of a business record writes one entry, the master and its master-detail cascade plus the cleared set_null references, inside the delete's own unit of work before the root row is removed, compensated when no transaction covers it. Retention is resolver, then OS_RECYCLE_BIN_RETENTION_DAYS, then 30, wired through `ObjectQLPlugin({ recycleBinRetention })` per seat ruling Q2. Predicate deletes, cascade children and sys_* objects skip the bin (Q6). Both spec hunks carry domain:spec#3's consent (6673450505). Still on the card: PR 2 purge/empty/permanent delete (waits Elon's Q3, then a new spec consent), PR 3 restore, PR 4 permission reader (waits Elon's Q5; its announcement names the permission.json rows it flips), PR 5 REST doors. Each waits for the previous merge and a new seat amendment.",
  "tests": "`pnpm --filter @objectstack/objectql exec vitest run --project local src/recycle-bin/`: Test Files 2 passed (2), Tests 42 passed (42). `packages/platform-objects` `vitest run src/plugin.test.ts`: Tests 23 passed (23). Full objectql suite earlier this session: 3 failures from this change (two tests asserting no warn, one census row), all fixed and re-run green. Ablation 1, via scripts/ablation-replace.mjs on packages/objectql/src/engine.ts (anchor x1 -> x0, blob 9ce18cdff098 -> 417163f7491e): `openRecycleBinCapture(...)` replaced by undefined, so capture.test.ts goes Tests 11 failed | 5 passed (16). The 5 that stay green assert absence or the BFS helper. Restore printed blob == HEAD and an empty `git diff HEAD`. Ablation 2 on sys-recycle-bin.object.ts: object_name maxLength 255 -> 254, so the new field pin fails (Tests 1 failed | 22 passed). Restore printed blob == HEAD. Both suites import src relatively, so no dist leg.",
  "gates": "Final round on head 819b02f7: `dispatch-gates.mjs --ran` gives 97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN, and every family exits 0. `pnpm lint` exit 0. `pnpm --filter @objectstack/platform-objects typecheck` exit 0, `pnpm --filter @objectstack/objectql typecheck` exit 0. The first round on 136ad85d had three real reds, fixed in 819b02f7: check:keyed-text-bounds (a spread in fields and a constant name are unreadable to the source scan), check:objectql-double-limit (the test double applied no bound and copied rows before one), check:platform-object-tenancy-census (regenerated with --write). It also had seven exit-3 results: six spec dist gates stale after the comment edit, and the teardown self-test in the shallow clone. All seven are green in the final round. CI check-runs on the PR are not cited: per the contract this thread does not wait on CI.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-②: yes (widening))",
  "mcp_calls": "4 — mcp__github__issue_read x3, mcp__github__pull_request_read x1 (read-back of #30780); no write tool",
  "api_writes": "2 — relay pr_create -> POST /repos/objectstack-ai/objectstack/pulls (#30780, read back byte-identical); this comment -> POST /repos/objectstack-ai/objectstack/issues/30237/comments. git push is not a REST write.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: c · reach: named producer: skills/objectstack-api/SKILL.md :268 and :417 still teach that there is no recycle bin · evidence: the changeset and PR body carry `Skills-docs: follow-up owed` · dedupe words: recycle bin, objectstack-api skill, sys_recycle_bin",
    "carrier: server seat 1 · noted, not filed"
  ]
}

Generated by Claude Code

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

席位核对 · Amendment · 2026-11-06T02:58Z · claim 6673233448

PR 1 (PR #30780) file surface adds packages/plugins/plugin-audit/src/audit-writers.ts (one SKIP_OBJECTS entry, sys_recycle_bin, with its reason), packages/plugins/plugin-audit/src/audit-writers.test.ts (one pin), and '@objectstack/plugin-audit': minor with one sentence in the PR's changeset. Why: contract review 6675639559 FAIL, must-fix A. The sweep's reap of a bin entry, and the set_null of its deleted_by, would write a ledger and an activity row carrying the whole snapshot, internal: true columns included, against ADR-0057 §3.3 and the #30751 precedent (ruling 6663872259).

Must-fix B rides inside the existing surface (packages/objectql/src/engine*.ts, recycle-bin/**): a delete with options.multi === true, which includes every lifecycle reap, opens no capture, as seat ruling Q6 and the changeset already say.

Seat ruling on the review's open question ③.7, extending Q6: "business object" means a name outside the platform namespaces the tenancy census uses, sys_, cloud_ and ai_. recycleBinTakesObject excludes all three, and the release note says so.

Everything else in the claim and its amendments stands. The review of record is re-recorded at the new head.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

总监决裁 recorded · 2026-11-06T03:52Z · #30237 Q3 (permanent delete)

Ruling: A. The maintainer (Elon) chose this on the seat's decision card (2026-11-06T03:52:21Z). Question: who may permanently delete a record, bypassing the recycle bin? Answer: only a recycle-bin manager.

As plan-30237 records it for PR 2:

EngineDeleteOptions.permanent: true is the permanent-delete door. It is a packages/spec widening (EngineDeleteOptionsSchema.permanent in data/data-engine.zod.ts, plus its regenerated api-surface, authorable and docs output).
A permanent delete is dispatched as the purge verb, so it requires manageRecycleBin. No snapshot is written.
PR 2's contract is therefore Clause-②: yes (widening) and Metadata-protocol: added.

The spec hunk still needs a spec seat's consent before PR 2 opens; the seat asks the spec seat on duty. Q5 (the grant fold) is still open with the maintainer and gates PR 4 only.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

总监决裁 recorded · 2026-11-06T03:53Z · #30237 Q5 (grant fold)

Ruling: A, the Salesforce semantics. The maintainer (Elon) chose this on the seat's decision card (2026-11-06T03:52:28Z). Question: by what rule do the two new recycle-bin permissions inherit from the existing ones?

As plan-30237 records it for PR 4:

allowRead bounds both keys.
modifyAllRecords implies both allowRestoreOwnDeleted and manageRecycleBin.
manageRecycleBin implies allowRestoreOwnDeleted.
allowDelete does not imply restore; the key is opt-in, like allowExport.

This matches the evaluator's existing MODIFY_ALL_WRITE_KEYS note. PR 4's spec hunk (security/permission.zod.ts objectPermissionGrants cells, the liveness rows) still needs a spec seat's consent before PR 4 opens.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Landed · 2026-11-06T06:23Z · PR 1 of 5, #30780, merged by the queue as 25e1c1ad8b (2026-11-06T06:22:40Z). A by-id delete now keeps its rows in sys_recycle_bin (ADR-0148).

This card stays open, and pm:dispatched stays:

PR 2 (purge, empty, permanent delete; Q3 = A, ruled) carries a spec hunk.
PR 3 (restore) carries spec hunks.
PR 4 (the permission reader; Q5 = A, ruled) carries spec hunks.
PR 5 (REST doors) may carry spec hunks.

Every domain:spec seat is vacant, so spec consent has been asked of the maintainer. The PRs proceed serially once it is given.

The skills follow-up owed by every PR of this card is filed as #30847.

Navigation Menu

Repository navigation

engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237

Wanted

Unblock · 2026-11-06T00:27Z · `Blocked-by: #30235` closed

席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448

席位核对 · Amendment · 2026-11-06T02:58Z · claim 6673233448

总监决裁 recorded · 2026-11-06T03:52Z · #30237 Q3 (permanent delete)

总监决裁 recorded · 2026-11-06T03:53Z · #30237 Q5 (grant fold)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237

Description

Wanted

Activity

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 6, 2026

Unblock · 2026-11-06T00:27Z · Blocked-by: #30235 closed

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

席位核对 · Amendment · 2026-11-06T02:58Z · claim 6673233448

objectstack-fleet commented on Nov 6, 2026

总监决裁 recorded · 2026-11-06T03:52Z · #30237 Q3 (permanent delete)

objectstack-fleet commented on Nov 6, 2026

总监决裁 recorded · 2026-11-06T03:53Z · #30237 Q5 (grant fold)

objectstack-fleet commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Unblock · 2026-11-06T00:27Z · `Blocked-by: #30235` closed