Repository navigation
engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237
Description
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Filing gate: ③ a split the parent needs, asked by domain:server#4 (Request: triage · #3146). ⛔ Not a claim.
Blocked-by: #30235
Part of #3146 · Ruling-ref: 6629858351 (the recycle-bin shape, maintainer 「同意，企业版功能在 cloud 中立卡后续开发」)
Wanted
The engine half of the ruled v1:
- Snapshot: before a physical delete, write the rows it removes (the cascade set from
engine-delete-cascade.ts) into one bin entry, then delete as today. Business objects only, notsys_*. - Restore: write the rows back under their original ids, keep
created_by/created_at, and restore a master-detail cascade together. Refuse with a reason, never a forced write, when a unique value is taken, the parent is purged, or the package is uninstalled. Re-link aset_nulllookup only if nothing has changed it since. Emit a "restored" event, never a create. Rollups recompute. - Purge and TTL: permanent delete never enters the bin. A TTL reap runs on the existing LifecycleService (the
sys_filetombstone pattern). - Permissions: a person restores what they deleted, and an admin sees all.
Every read path stays untouched.
Order: after #30235 (spec). The UI slice reads it.
Generated by Claude Code
Activity
docs(adr): ADR-0148 marks the record's own choices, stamps the purge …
docs(adr): ADR-0148 names ADR-0087's kit rule, the ref a snapshot wou…
objectstack-fleet commentedon Nov 5, 2026
domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa
The spec half of the recycle bin landed: PR #30577 merged at
d9d42d4e, closing #30235. This card'sBlocked-by: #30235target is now closed. What this card inherits from it, so the engine slice starts from the record and not from the PR thread:The four seat decisions #30235 was built on (takeover comment 6662490518 on #30235), binding on this card's reading of the spec:
restoredis a spec constant only,RECORD_RESTORED_EVENT='data.record.restored'.DataEventType/RealtimeEventTypelist emitted events, so the member joins them in the change that emits it: this card (the pin inrecycle-bin.zod.test.tsthat keeps it out flips with it).sys-recycle-bin.object.ts, its plugin registration and itsPLATFORM_OBJECTS_BY_PACKAGErow are this card's. The spec fixes the name (RECYCLE_BIN_OBJECT) and the full field contract (RECYCLE_BIN_ENTRY_FIELDS, value shapeRecycleBinEntrySchema); build the object from them.allowRestoreOwnDeletedandmanageRecycleBinareplannedrows inpackages/spec/liveness/permission.jsonnaming this card (evaluator mapping, engine doors) and ui: the admin recycle-bin page (list, restore, empty) and the 已删除 · 撤销 toast (#3146 slice 4) #30239 (Console). This card flips both tolivewhen it reads them.RESTORE_UNIQUE_VALUE_TAKEN,RESTORE_PARENT_PURGED,RESTORE_PACKAGE_UNINSTALLEDare in the error-code ledger under@objectstack/objectqlahead of their producer, status 409 (RECYCLE_BIN_RESTORE_REFUSAL_STATUS); once this card stamps them, the error-status conformance deriver pins the status.Carried from #30577's contract review (6664134926) and the seat's ACCEPT (6664274007), each owed here:
RecycleBinClearedReferenceSchema's docblock and describe say a cleared reference is re-linked "only if the field still holds no value". Onmainthe cascade clears aset_nullmember of a multi-valued lookup by removing that member and keeping the rest (engine-cascade-planning.tsremainderAfterMemberRemoval), so read literally the sentence never re-links a multi-valued reference, while ADR-0148 D2 rules "only if nothing has changed it since". Restate it for both arities (a single-valued field re-links when it still holds no value; a multi-valued one when it no longer holds the member) before implementing re-link; one describe edit plusgen:docs, the shape needs no change.modifyAllRecordsimplies them or whetherallowReadbounds them (asallowExportstates for itself). Write those sentences when the reader lands, and in the same stroke re-point therestore/purgeguidance, theallowRestore/allowPurgetombstone text and theliveness/permission.jsonnotes at D5's answer (respelled; the tombstones stay through the ADR-0087 kit schedule).OPERATION_TO_PERMISSIONinplugin-security/src/permission-evaluator.ts;GRANT_BITSincore/src/security/effective-object-permissions.ts, which the'*'wildcard materialisation and the verb-less-entry fold also key on;ObjectPermissionVerbTarget/objectPermissionGrantsinspec/src/security/permission.zod.ts(a spec widening riding this card, with its ownClause-②: yes).managedBy:engine-ownedrows survive an organization delete today (engine-cascade-planning.ts), and D4 says an organization's bin entries go with it; the object this card registers owes that answer.skills/objectstack-api/SKILL.md(:268,:417) teaches that the trash surface is retired and there is no recycle bin; true until this card ships the reader, then rewritten (Tier H surface).For #30239:
CAPSinui/packages/app-shell/src/views/metadata-admin/previews/PermissionPreview.tsxlists neither grant key.Generated by Claude Code
objectstack-fleet commentedon Nov 6, 2026
domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW
Unblock · 2026-11-06T00:27Z ·
Blocked-by: #30235closedd9d42d4e). The spec seat's hand-over note 6665087359 lists what this card inherits.main. The spec half fixesRECYCLE_BIN_OBJECT,RECYCLE_BIN_ENTRY_FIELDS/RecycleBinEntrySchema,RECORD_RESTORED_EVENT, the threeRESTORE_*409 codes in the ledger, and theplannedgrant rows inliveness/permission.json. The engine half (snapshot, restore, purge/TTL, permissions, the object and its registration) is still unbuilt. No open PR names this card or the recycle bin.managedByanswer for organization delete, and theskills/objectstack-api/SKILL.mdfollow-up, all from 6665087359.pm:blocked→pm:queue. Being p1 andpm:blocking, it heads the server order, and this seat claims it in the next comment.objectstack-fleet commentedon Nov 6, 2026
domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW
Claim: PM loop round 4 · 2026-11-06T00:28Z
Session:
session_016WV4cytLmJxfAmgPVjUbbWAccount:
os-elon-musk(the seat's linked user asGET /useranswers it; the card's assignee)Branch: the card thread's designated
claude/project-thread-*branch, named in a claim amendment once the thread reports itWorktree:
objectstack-issue-30237Domain:
domain:serverSeat:
domain:server#1File surface (to be narrowed by amendment after the thread's first reading):
packages/objectql/src/**(delete snapshot besideengine-delete-cascade.ts, restore, purge, the TTL reap on the LifecycleService, therestoredevent), thesys_recycle_binobject file and its plugin registration,plugin-security/src/permission-evaluator.ts(OPERATION_TO_PERMISSION),core/src/security/effective-object-permissions.ts(GRANT_BITS), their tests, the census/inventory rows, changesets.packages/spec/**only as the spec seat's hand-over 6665087359 allocates to this card: thePLATFORM_OBJECTS_BY_PACKAGErow,DataEventType/RealtimeEventTypegaining the restored member (with its pin),liveness/permission.jsonplanned → live,ObjectPermissionVerbTarget/objectPermissionGrants, and the two describe should-fixes. Each is named in an amendment before it is edited, with the spec seat told. ⛔ui/**(#30239); ⛔skills/**(follow-up card, Tier H)Container & model:
L,p1,mode:thread,model: default,effort: xhigh; a PR split is expected and is proposed by the thread before its first PRClause-②: yes (widening)
Metadata-protocol: added
Responsibility: deletes in
packages/objectql| a physical delete with no way back | every tenant user who deletes a record by mistake, and the admin who cannot restore itThread-read: 6665087359
Premise: holds per ruling 6629858351 (maintainer 「同意，企业版功能在 cloud 中立卡后续开发」) and ADR-0148; the engine half is unbuilt on
mainSerial constraints cleared: #30235 closed (PR #30577). No open PR names the recycle bin; open PR file lists are re-read by the thread before its first push.
objectstack-fleet commentedon Nov 6, 2026
domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW
席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448
Branch:
claude/project-thread-jf62r6(the card thread's harness-pinned branch, objectstack-ai/objectstack; platform exception toclaude/issue-<n>-<slug>).Dev session:
session_016WV4czFGLnXKQd6cQjv3PrPlan: five PRs, serial on that branch, each cut from
mainafter the previous one merges and each under 3000 lines: (1) object + snapshot on delete + TTL reap; (2) purge, empty, permanent delete; (3) restore; (4) the permission reader; (5) the REST doors.PR 1 file surface (this amendment admits PR 1 only; each later PR gets its own amendment):
packages/platform-objects/src/system/sys-recycle-bin.object.ts(new),system/index.ts,plugin.tsand their tests, the generated translation bundles ifcheck:i18nderives them;packages/objectql/src/recycle-bin/(new: eligibility, snapshot, retention, with tests),engine-cascade-planning.ts(hand the collected set to the snapshot; record each cleared reference for the D2 re-link),engine.ts(the by-id delete branch),engine-top-level.ts(retention seam types),plugin.ts(ObjectQLPluginOptionsretention seam); the census and inventory rows the newsys_*object trips; onescripts/adr-anchors/JSON; changesets.packages/spec/**for PR 1: thesys_recycle_binline insystem/constants/platform-object-names.ts(allocated to this card by 6665087359) and thedata/recycle-bin.zod.tsdocblock sentence saying the object lands with the engine slice. The spec seat is told before either is pushed.Seat decisions (from the thread's open questions): Q1: serial on the one branch. Q2: the host passes the retention resolver and its token once at boot; no spec change. Q4:
managedBy: 'engine-owned', with the object'sorganization_iddeclareddeleteBehavior: 'cascade', so an organization's delete removes its entries (ADR-0148 D4). Q6: the literal ruling. A by-id delete of a business object enters the bin;sys_*rows in its cascade, predicate deletes, lifecycle reaps and cascade children do not, and the release notes say so. To the maintainer: Q3 (who may delete permanently: rides PR 2) and Q5 (the grant fold: rides PR 4); neither blocks PR 1.objectstack-fleet commentedon Nov 6, 2026
domain:server#1 · os-elon-musk · session_016WV4czFGLnXKQd6cQjv3Pr
os-dev-report
{ "issue": 30237, "status": "done", "branch": "claude/project-thread-jf62r6", "pr": "https://github.com/objectstack-ai/objectstack/pull/30780", "session": "session_016WV4czFGLnXKQd6cQjv3Pr", "premise_still_valid": true, "summary": "PR 1 of the seat's five-PR split (claim amendment 6673429400), opened as a draft with `Part of #30237`. It adds the engine-owned `sys_recycle_bin` object (fields from the spec's RECYCLE_BIN_ENTRY_FIELDS, cascading tenant column, TTL on `purge_after`) and the snapshot on delete: a by-id delete of a business record writes one entry, the master and its master-detail cascade plus the cleared set_null references, inside the delete's own unit of work before the root row is removed, compensated when no transaction covers it. Retention is resolver, then OS_RECYCLE_BIN_RETENTION_DAYS, then 30, wired through `ObjectQLPlugin({ recycleBinRetention })` per seat ruling Q2. Predicate deletes, cascade children and sys_* objects skip the bin (Q6). Both spec hunks carry domain:spec#3's consent (6673450505). Still on the card: PR 2 purge/empty/permanent delete (waits Elon's Q3, then a new spec consent), PR 3 restore, PR 4 permission reader (waits Elon's Q5; its announcement names the permission.json rows it flips), PR 5 REST doors. Each waits for the previous merge and a new seat amendment.", "tests": "`pnpm --filter @objectstack/objectql exec vitest run --project local src/recycle-bin/`: Test Files 2 passed (2), Tests 42 passed (42). `packages/platform-objects` `vitest run src/plugin.test.ts`: Tests 23 passed (23). Full objectql suite earlier this session: 3 failures from this change (two tests asserting no warn, one census row), all fixed and re-run green. Ablation 1, via scripts/ablation-replace.mjs on packages/objectql/src/engine.ts (anchor x1 -> x0, blob 9ce18cdff098 -> 417163f7491e): `openRecycleBinCapture(...)` replaced by undefined, so capture.test.ts goes Tests 11 failed | 5 passed (16). The 5 that stay green assert absence or the BFS helper. Restore printed blob == HEAD and an empty `git diff HEAD`. Ablation 2 on sys-recycle-bin.object.ts: object_name maxLength 255 -> 254, so the new field pin fails (Tests 1 failed | 22 passed). Restore printed blob == HEAD. Both suites import src relatively, so no dist leg.", "gates": "Final round on head 819b02f7: `dispatch-gates.mjs --ran` gives 97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN, and every family exits 0. `pnpm lint` exit 0. `pnpm --filter @objectstack/platform-objects typecheck` exit 0, `pnpm --filter @objectstack/objectql typecheck` exit 0. The first round on 136ad85d had three real reds, fixed in 819b02f7: check:keyed-text-bounds (a spread in fields and a constant name are unreadable to the source scan), check:objectql-double-limit (the test double applied no bound and copied rows before one), check:platform-object-tenancy-census (regenerated with --write). It also had seven exit-3 results: six spec dist gates stale after the comment edit, and the teardown self-test in the shallow clone. All seven are green in the final round. CI check-runs on the PR are not cited: per the contract this thread does not wait on CI.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-②: yes (widening))", "mcp_calls": "4 — mcp__github__issue_read x3, mcp__github__pull_request_read x1 (read-back of #30780); no write tool", "api_writes": "2 — relay pr_create -> POST /repos/objectstack-ai/objectstack/pulls (#30780, read back byte-identical); this comment -> POST /repos/objectstack-ai/objectstack/issues/30237/comments. git push is not a REST write.", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "class: c · reach: named producer: skills/objectstack-api/SKILL.md :268 and :417 still teach that there is no recycle bin · evidence: the changeset and PR body carry `Skills-docs: follow-up owed` · dedupe words: recycle bin, objectstack-api skill, sys_recycle_bin", "carrier: server seat 1 · noted, not filed" ] }Generated by Claude Code
4 remaining items
objectstack-fleet commentedon Nov 6, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
To: domain:server#1
Request: progress · #30237 · idle since 2026-11-06T06:24Z
Generated by Claude Code
objectstack-fleet commentedon Nov 6, 2026
domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW
Spec consent recorded ·
domain:spec· 2026-11-06T15:08Z · #30237The maintainer (Elon) consented in the seat thread at 2026-11-06T15:07Z, verbatim: 「以上都同意。」. The message it answers was the seat's explanation of the pending spec changes, which named this card's hunk: PR 2 adds the optional key
permanenttoEngineDeleteOptionsSchema(packages/spec/src/data/data-engine.zod.ts), the purge verb of Q3 = A, with its regenerated files; PR 4 (thepermission.zod.tsfold) is not covered and will be asked separately. The consent is recorded here because no spec seat held these hunks while they waited (spec#1 is seated again since). It is consent to the spec hunk only. TheCONTRACT_REVIEW_TIERreview and every other landing condition stay owed.objectstack-fleet commentedon Nov 6, 2026
domain:server#1 · os-elon-musk · session_016WV4czFGLnXKQd6cQjv3Pr
os-dev-report
{ "issue": 30237, "status": "done", "branch": "claude/project-thread-jf62r6", "pr": "https://github.com/objectstack-ai/objectstack/pull/30990", "session": "session_016WV4czFGLnXKQd6cQjv3Pr", "premise_still_valid": true, "summary": "PR 2 of the seat's five-PR split (claim amendment 6673429400), opened as a draft with `Part of #30237`, head 16a1d37e. It adds the recycle bin's removal side per Q3 = A (6676408264): `ObjectQL.purge(entryId)` removes one entry, `ObjectQL.empty(object)` every entry of one object, and `delete(object, { where: { id }, permanent: true })` writes no entry. All three are dispatched as one new operation, `purge`, on the business object, never with an AST (#7809 pin flipped and re-pinned), so plugin-security's fail-closed backstop refuses every non-system caller until PR 4 maps `purge` to `manageRecycleBin`. Entries are read and removed scoped to the caller's organization. The spec hunk (`EngineDeleteOptionsSchema.permanent`, its own commit 2302a5f0) carries the maintainer's consent recorded in 6688058790. The seat accepted the two deviations named in the body (07:31Z): `empty` requires the object, and `permanent` is refused 400 off the by-id path, with `multi`, on sys_/cloud_/ai_ and when not a boolean. `beforePurge` / `afterPurge` stay outside the hook namespace, so `registerHook` is not narrowed. Still on the card: PR 3 restore, PR 4 permission reader (its permission.zod.ts spec consent is asked separately), PR 5 REST doors, each after the previous merge and a new seat amendment.", "tests": "`pnpm --filter @objectstack/objectql exec vitest run --project local src/recycle-bin/ src/engine-middleware-operation-vocabulary.test.ts`: Test Files 4 passed (4), Tests 78 passed (78). On the merged head the same plus write-epoch, engine-unknown-option and engine-hook-event-dispatch-gap: 7 files, 134/134. Full objectql suite on the merged head: 561 files, 11,231/11,231. Eight ablations, each a text replacement in src restored from a copy afterwards (not scripts/ablation-replace.mjs): capture not skipped for permanent (1 red), verb always delete (4 red), permanent refused only on reject (3 red), platform refusal dropped (1 red), purge's entry read unscoped (1 red), empty outside the middleware chain (2 red), fallback stops after one page (1 red), stuck-page guard dropped (the suite hangs on that case). git status was clean before the merge.", "gates": "Merged head 16a1d37e (main 1aeeafd9 merged as a merge commit, data.json regenerated with `pnpm --filter @objectstack/spec gen:schema`): after building spec, objectql, metadata-protocol and client, all 109 families from `dispatch-gates.mjs --commands` exit 0; `--ran` gives 109 derived, 109 run, 0 NOT-MEASURED, 0 UNRUN. `pnpm lint` exit 0. `pnpm --filter @objectstack/objectql run typecheck` exit 0. Pre-merge head aa8b43fa: the same 109, with check:skill-examples exit 3 (stale @objectstack/client build) and check:dts-closure exit 1 (@object-ui/i18n missing a dist .d.ts), both 0 after rebuilding those untouched packages; typecheck exit 0 for objectql, core, plugin-audit, plugin-security, plugin-sharing, service-storage and verify. CI check-runs on the PR are not cited: per the contract this thread does not wait on CI.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-②: yes (widening))", "mcp_calls": "1 — mcp__github__pull_request_read x1 (read-back of #30990); plus one `gh api` GET of comment 6688058790 to check the consent record; no write tool", "api_writes": "2 — relay pr_create -> POST /repos/objectstack-ai/objectstack/pulls (#30990, read back byte-identical, 14039 bytes); this comment -> POST /repos/objectstack-ai/objectstack/issues/30237/comments. git push is not a REST write.", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "class: c · reach: named producer: packages/plugins/plugin-security sites keyed on 'delete' (authz-middleware :2314 comment and the write sites listed under 'For PR 4' in #30990's body) see the permanent delete as `purge` · evidence: #30990 body · dedupe words: purge verb, plugin-security, recycle bin, PR 4", "carrier: server seat 1 · PR 4 of this card · noted, not filed" ] }Generated by Claude Code
objectstack-fleet commentedon Nov 6, 2026
domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW
席位核对 · Amendment · 2026-11-06T16:15Z · claim 6673233448
PR 2 (PR #30990, branch
claude/project-thread-jf62r6): purge, empty and permanent delete. PR 1 landed (6678640327); this amendment admits PR 2 under the serial split (seat ruling Q1).File surface (13 paths):
packages/spec/src/data/data-engine.zod.ts(thepermanentkey only; spec consent 6688058790) andpackages/spec/authorable-surface/data.json(regenerated, one row);packages/objectql/src/recycle-bin/purge.ts,purge.test.ts,capture.ts;packages/objectql/src/engine.ts,engine-top-level.ts,index.ts,write-epoch.ts,write-epoch.test.ts,engine-middleware-operation-vocabulary.test.ts;content/docs/references/data/data-engine.mdx;.changeset/30237-recycle-bin-purge-empty-permanent.md.Accepted by the seat, recorded here:
emptynames its object. There is no bin-wide empty in this PR.permanent: trueis refused with400 VALIDATION_ERROR(withparam) off the by-id path, withmulti: true, and on a platform object (sys_,cloud_,ai_, per ruling Q7). The refusal list is the one in the PR body.beforePurge/afterPurgeuse the hook namespace and warn rather than refuse, like the other hook pairs.Out of PR 2, carried to PR 4 (permission reader): the object-level
purgedispatches inpurge.tsdo not pass the engine's recorded Layer-0 tenant verdict. On this head the destructive-operation backstop refuses every non-system caller first, so nothing is reachable; PR 4 must close it when it mapspurge(contract review 6689562965 on #30990, should-fix 1).Everything else in the claim and its amendments stands.
objectstack-fleet commentedon Nov 6, 2026
domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW
Seat handoff: the lane signs off. PR 2 (#30990) has passed contract review (6689562965) and is ACCEPTed (6689623157), with auto-merge armed. The seat does not start PR 3. PR 3 to PR 5 go back to the queue and start only after #30990 merges, in the serial order of ruling Q1. Each later PR needs its own claim amendment, as 6689578503 did for PR 2. The card thread's handoff follows.
#30237 recycle-bin engine (ADR-0148): handoff for PR 3 to PR 5
Written 2026-11-06 by the server seat 1 card thread (session
session_016WV4czFGLnXKQd6cQjv3Pr). The lane is winding down, so this thread stops after PR 2. The full plan, with file lists per PR, is in plan-30237.md in this folder. This file says what is done, what was ruled, and what the next thread must know first.State of the split
The split is serial, on one branch (
claude/project-thread-jf62r6). Each PR needs its own seat amendment on the card after the previous PR merges.sys_recycle_bin, the snapshot on delete, the retention stamp, the TTL reap25e1c1adpurge(entryId),empty(object),delete(…, { permanent: true })16a1d37e. Contract review passed (6689562965, no must-fix). Amendment 6689578503, ACCEPT 6689623157, ready and auto-merge armed by the seat.allowRestoreOwnDeleted,manageRecycleBinPR 1's skills follow-up is filed as #30847. PR bodies cite it on their
Skills-docs:line; do not write "follow-up owed".Rulings
{ resolve, token }at boot, asObjectQLPlugin({ recycleBinRetention }). The resolver answers first, thenOS_RECYCLE_BIN_RETENTION_DAYS, then 30.EngineDeleteOptions.permanent: trueis thepurgeverb, needsmanageRecycleBin, and writes no snapshot. It shipped in PR 2.organization_idcascades, so an organization's delete takes its entries.allowReadbounds both keys;modifyAllRecordsimplies both;manageRecycleBinimpliesallowRestoreOwnDeleted;allowDeletedoes NOT imply restore.multi: trueskips it, and that includes every LifecycleService reap.sys_,cloud_andai_(hasPlatformObjectPrefix).empty(object)requires the object.permanentis refused400before any middleware runs: off the by-id path, withmulti, on a platform object, or when it is not a boolean.data-engine.zod.ts) is consented in 6688058790. PR 3 needs consent forevents.zod.ts,realtime.zod.tsandrecycle-bin.zod.ts. PR 4 needs consent forpermission.zod.ts. Elon's PR 2 consent does not cover either.How PR 2 shaped the engine (read before PR 3 or PR 4)
purge.OperationContext.operationgained'purge'. The permanent delete,purge(entryId)andempty(object)all dispatch it on the BUSINESS object, never with anast.where.id, so plugin-security's step 2.7 judges the row as a delete.purgeandemptycarry no id, so they are object-level only.packages/objectql/src/recycle-bin/purge.ts.opCtx.operationraw, sopurge/transfer/restorederive no row scope whileupdate/deletenow do (#7665 asymmetry) #7809 pin (engine-middleware-operation-vocabulary.test.ts) now holds 8 verbs. It locks the AST-carrying set and the order of thepurgedispatches.restoremust join the same way: on the union, never with an AST, with the pin updated.ENGINE_OPERATION_VERBS(engine-top-level.ts) isRecord<Verb, boolean>. The value says whether the verb names a hook pair.purge: falsekeepsbeforePurge/afterPurgeoutside the hook namespace, so registering them only warns.restorethe same treatment unless a ruling says otherwise. Putting it inside the namespace would refusebeforeRestoreat registration, which narrowsregisterHookand needs a migration entry.purgeis inWRITE_EPOCH_OPERATIONS(write-epoch.ts).restoreshould join it.purge/restorefail-closed (DESTRUCTIVE_OPERATIONS).Carried by the PR 2 contract review (6689562965)
recordedVerdicton the object-level purge dispatches.purge.tsbuilds the bin's driver options without{ recordedVerdict: opCtx.tenantLayer0Verdict }:purge's executor (about :164);empty's executor (about :198).When PR 4 maps
purge, the executors must pass the verdict the security layer recorded, so a cross-tenant exemption or wall decided by that layer reaches the bin's driver. Today they scope by the engine's own Layer 0 verdict.permanent: true, and the system is never refused thepurgeverb. Should an app's system-context automation be able to delete for good? Put this to Elon as 总监决裁 before PR 4 lands. Do not decide it in a card thread.Plugin-security sites for PR 4
These key on
'delete'and see the permanent delete aspurge. The list is also in #30990's body under "For PR 4".security-plugin-authz-middleware.ts::399, the self-owned epoch bump. It is inert while the engine owns the seam.:2302, the bulk-write guard target. It is AST-only.:2314, the step-3 comment. It still says the vocabulary has seven members and none is destructive.security-plugin-addressed-writes.ts:110/:129;security-plugin-authored-row-write.ts:108;security-plugin-cbp-write-gate.ts:364;security-plugin-rls-filter.ts:172/:371;platform-ownership-policies.ts:358;rls-compiler.ts:1349.Each should read
rlsOperationForVerb(lifecycle-verb-rls-operation.ts) or listpurgebesidedelete.packages/verify/src/handle.ts:598:observeWritesrecordsinsert,updateanddeleteonly.packages/core/src/security/resolve-user-grants-cache.ts: itsWRITE_OPERATIONSisinsert,updateanddelete. The permanent delete is refused on everysys_*object, so a watched grant object never seespurgetoday. Keep it that way, or add the verb there.The rest of PR 3 and PR 5, in brief (detail in the plan)
recycle-bin/restore.ts.created_by/created_atare kept, and no insert hooks run.snapshot.clearedReferences;recomputeSummaries; arestoredevent (data.record.restored).RESTORE_UNIQUE_VALUE_TAKEN,RESTORE_PARENT_PURGED,RESTORE_PACKAGE_UNINSTALLED.OPERATION_TO_PERMISSION:restore→allowRestoreOwnDeleted,purge→manageRecycleBin;GRANT_BITSfold per Q5;deleted_bymust be the caller unless the caller holdsmanageRecycleBin, and it fails closed with no resolver;permission.json;packages/rest/src/recycle-bin-routes.ts, with closed query-parameter sets. The doors are list (managers, FLS on the live object), restore, purge and empty, plus the route ledger, OpenAPI and discovery.emptytakes one object per call, so the Console loops over objects.ui/**(ui: the admin recycle-bin page (list, restore, empty) and the 已删除 · 撤销 toast (#3146 slice 4) #30239) andskills/**(skills: objectstack-api still teaches that DELETE is unrecoverable and that there is no recycle bin (#30237, ADR-0148) #30847) stay out of this card.Traps (measured on this card)
check:skill-examplesexits 3 until@objectstack/clientis rebuilt, andcheck:dts-closureexits 1 on@object-ui/i18n. objectql'sprotocol-destructive-currency-mode.test.tsreads a stale@objectstack/metadata-protocoldist.dispatch-gates.mjs --ran FILE, oneCMD :: exit CODEline per family.single, which scopes nothing. Callengine.setTenancyPostureProvider(() => 'isolated')to test organization scoping.finddouble must filter, then slice bylimit, then copy (check:objectql-double-limit).packages/spec/authorable-surface/data.json. Regenerate it withpnpm --filter @objectstack/spec gen:schema, never by hand.pnpm gen:platform-object-tenancy-census. Two PRs that each add one race in the merge queue: wait for the other PR to land, merge main, then run--write.check:keyed-text-boundsrefuses a spread in an object'sfieldsand a non-literalname.engine.tsis a facade (check:facade-delegation-only), so a new member must be a delegation. The host-literal pattern is the onepurge/empty/openRecycleBinCaptureuse.where: { id }, multi: true, and the engine routes that as by-id. Only the caller's own flag tells it apart.scripts/pm/fleet-write/dispatch.mjs(--dry-run, then--json) andscripts/pm/post-stamped.mjs. Never through MCP write tools.Co-authored-by: Claude <noreply@anthropic.com>andClaude-Session: …. Commit messages carry no card relation and no model name.objectstack-fleet commentedon Nov 6, 2026
domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH
Ruling · 2026-11-06T17:39Z · system-context
permanent: truefrom app-authored code (record 6689562965 should-fix 2;domain:server#1's request 6690678012 on mailbox #30985)The maintainer ruled in the server seat 2 thread 2026-11-06T17:35Z, option A: app-written scheduled jobs (and app-authored bodies generally) cannot permanently erase a record. Their deletes always enter the recycle bin; the permanent delete stays with a principal that holds
manageRecycleBin. This is the same line the system envelope already draws for identity writes (#25251, #25653).What it means for PR 2 (#30990):
HookDeleteOptionsomitspermanent(Omit<EngineDeleteOptions, 'context' | 'permanent'>), and the drift pin inpackages/spec/src/data/hook-api.test.tslists it underomitted. A hook'sctx.api.object(n).delete()cannot pass it.packages/runtime/src/sandbox/body-runner.ts, theql.deleteforward) refuses a body'spermanentkey loudly (400 VALIDATION_ERROR,param: 'permanent', naming this rule) rather than dropping it silently, so a job that asks for a purge learns it got none.delete(…, { permanent: true })(Q3 = A) is unchanged for every other caller.The seat dispatches the fix on the card's branch
claude/project-thread-jf62r6, then runs the delta review and lands it. PR 3 to PR 5 stay queued behind #30990 as hand-over 6690307585 sets out.objectstack-fleet commentedon Nov 6, 2026
domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH
Claim: PM loop round 1 · take-over of PR 2 of 5 (#30990) on
domain:server#1's hand-overs 6690307585 (card) and 6690367934 (PR) · 2026-11-06T17:46ZSession:
session_01L9qibyvxbrLP4jm4PargoHAccount:
os-tesla(the card's assignee from this claim)Branch:
claude/project-thread-jf62r6(PR #30990's branch; card thread sessionsession_01L9qibxhbtrhtRZ958iyyJppushes by merge only, no new PR)Worktree:
objectstack-issue-30237Domain:
domain:serverSeat:
domain:server#2File surface: the fix under ruling 6691358077 only:
packages/spec/src/data/hook-api.ts(HookDeleteOptionsomitspermanent) and its drift pinhook-api.test.ts,hook.zod.tsif it mirrors the key,packages/runtime/src/sandbox/body-runner.ts(theql.deleteforward refuses a body'spermanent, 400VALIDATION_ERROR,param: 'permanent') and its test, PR 2's changeset and body. PR 3 to PR 5 are not in this claim.Container & model:
M,mode:thread, buildmodel: TIER_DEFAULT,effort: high;packages/spec/**is touched, so the seat runs a CONTRACT_REVIEW_TIER delta review before landing.Clause-②: yes (widening)
Metadata-protocol: added
Both as PR 2 declares them: the ruling narrows only the hook face PR 2 first offered, a key that never shipped.
Responsibility: as on the card (ADR-0148); unchanged by this take-over.
Thread-read: 6691358077
Premise: holds. PR #30990 head
16a1d37e, Test Core (2/8) red atpackages/spec/src/data/hook-api.test.ts:232(the drift pin does not listpermanent); auto-merge off since hold 6690367934.Serial constraints cleared: none new; PR 3 to PR 5 follow #30990 in ruling Q1's order.
Resume-from:
claude/project-thread-jf62r6@16a1d37eOrder:
/mnt/project-files/server-seat-2/r2026-11-06/dispatch-30990-fix.md(frameFRAME.mdbeside it).objectstack-fleet commentedon Nov 6, 2026
domain:server#2 · os-tesla · session_01L9qibxhbtrhtRZ958iyyJp
os-dev-report
{ "issue": 30237, "status": "done", "branch": "claude/project-thread-jf62r6", "pr": "https://github.com/objectstack-ai/objectstack/pull/30990", "session": "session_01L9qibxhbtrhtRZ958iyyJp", "premise_still_valid": true, "summary": "PR 2 fix under maintainer ruling A (6691358077), resumed on PR #30990 at 16a1d37e, new head 9f765466. Commits: 7c834758 merges origin/main bcf8a37e (clean, no conflict, no generated-file path touched); d8e95344 narrows HookDeleteOptions to Omit of EngineDeleteOptions minus 'context' and 'permanent' (the drift pin lists permanent under omitted, citing the ruling) and adds refuseBodyPermanentDeletes as the outermost layer of buildSandboxApi in packages/runtime/src/sandbox/body-runner.ts, so a hook, action or job body's ctx.api.object(n).delete() whose options carry permanent with any value but false is refused 400 VALIDATION_ERROR, param 'permanent', before the verb runs, on every derived context (object, sudo, withRunAs, transactions via deriveThroughSeam); 9f765466 adds 6 pins to body-runner.test.ts and the changeset line. The refusal sits at buildSandboxApi rather than only the engine-repo fallback at the old L1133, because a job body reaches the engine through ql.createContext(executionContext).object(), not that facade. hook.zod.ts needs no mirror: its api is typed IScopedContext, and its EngineDeleteOptions mention is the firing delete's options, which a beforeDelete hook still reads permanent off. The engine's own delete(..., { permanent: true }) is unchanged and pinned so. Refusal message verbatim (face label varies: hook body / action body / job body): \"A job body cannot delete a record permanently: app-authored code cannot purge; its deletes enter the recycle bin. Remove 'permanent' from the delete of 'OBJECT'.\" The VM sees code, status and message only (the sandbox error allowlist); param stays on the host error.", "tests": "packages/runtime: vitest run src/sandbox/body-runner.test.ts on 9f765466 -> Test Files 1 passed (1), Tests 42 passed (42), 6 new: a job body (system envelope) passing permanent: true is refused VALIDATION_ERROR 400 with the rule in the message, no delete dispatched, the record stays and the bin still holds its one pre-existing entry; uncaught it fails the job run with that envelope; a hook body (engine api) and an action body (executionContext fallback) are refused alike; permanent: false and an absent key are one ordinary delete dispatch and the record enters the bin; host engine.delete(..., permanent: true) still dispatches purge and writes no entry. Real ObjectQL over a row-keeping driver. Full runtime local project: Test Files 551 passed (551), Tests 8832 passed | 19 skipped (8851), lock VERDICT command-exit 0. packages/spec: vitest run src/data/hook-api.test.ts -> Tests 13 passed (13). Ablation via scripts/ablation-replace.mjs on body-runner.ts, anchor 'if (permanent !== undefined && permanent !== false) {' x1 -> x0, replacement 'if (false) {' x0 -> x1, blob 0a33b238 -> d1c7f8ab: Tests 3 failed | 39 passed (42), the three refusal cases red; restored, blob == HEAD 0a33b238, git diff HEAD empty. The test imports ./body-runner.js relatively, so no dist leg.", "gates": "Head 9f765466. dispatch-gates.mjs --commands: 109 families (whole PR diff vs merge base bcf8a37e, 17 paths, 1176 changed lines). First pass: 105 exit 0; check:plugin-teardown-shape --self-test exit 3 (shallow clone lacked 621a4876), spec check:skill-examples exit 3 and check:dual-build-cjs-loads exit 3 (missing dists), spec check:generated exit 1 (check:test-typecheck 'tsc failed without diagnostics', the default-heap trap). After fetching 621a4876, a full turbo build (lock VERDICT 0) and NODE_OPTIONS=--max-old-space-size=4096 for check:generated, all four exit 0. --ran: 109 derived, 109 run, 0 NOT-MEASURED, 0 UNRUN. eslint --no-inline-config on the 4 touched source files exit 0. pnpm --filter @objectstack/runtime run typecheck exit 0 (check:test-typecheck OK), pnpm --filter @objectstack/spec run typecheck exit 0. CI on 9f765466: 57 success, 8 skipped, 0 failure, Test Core 2/8 included.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-②: yes (widening); the hook face narrows only from what this unreleased PR first offered)", "mcp_calls": "0 — card, PR and comments read with gh api GET", "api_writes": "1 — this comment via post-stamped -> POST /repos/objectstack-ai/objectstack/issues/30237/comments. git push is not a REST write. The PR body is not patched by the dev: the delta is drafted for the seat at /mnt/project-files/server-seat-2/r2026-11-06/out/30990-fix-body-delta.md (速读 three lines, a What-changes block, Tests, changeset note).", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "carrier: server seat 2 (for its judgment) · noted, not filed: in-process (non-sandboxed) hook handlers written in TypeScript can still pass permanent through ctx.api at runtime by casting past HookDeleteOptions; the ruling names the published type and the sandbox body runner, and host code is deployer code outside the body boundary." ] }objectstack-fleet commentedon Nov 6, 2026
domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH
ACCEPT pointer · 2026-11-06T19:40Z · PR #30990 (PR 2 of 5: purge, empty and the permanent delete; app-authored bodies refused
permanentper ruling 6691358077) accepted at head9cfc7667in 6693746412; auto-merge armed. PR 3 follows after it lands.objectstack-fleet commentedon Nov 6, 2026
domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH
Landing · 2026-11-06T20:07Z · PR #30990 MERGED 2026-11-06T20:07Z as
9d939c58(Part of #30237, PR 2 of 5): the engine'spurge(entryId),empty(object)anddelete(…, { permanent: true })on onepurgeverb; app-authored hook, action and job bodies are refusedpermanent(ruling 6691358077). The card stays open. PR 3 to PR 5 go back to the queue in ruling Q1's serial order, with the hand-over 6690307585 as their plan: PR 3 needs the maintainer's spec consent forevents.zod.ts,realtime.zod.tsandrecycle-bin.zod.tsbefore it starts. The seat movespm:dispatched→pm:queue. Follow-up the seat files: the deprecated in-process hookhandlerroute can still cast pastHookDeleteOptions(review 6693177811, should-fix 2).