engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3)

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Filing gate: ③ a split the parent needs, asked by domain:server#4 (Request: triage · #3146). ⛔ Not a claim.

Blocked-by: #30235
Part of #3146 · Ruling-ref: 6629858351 (the recycle-bin shape, maintainer 「同意，企业版功能在 cloud 中立卡后续开发」)

Wanted

The engine half of the ruled v1:

Snapshot: before a physical delete, write the rows it removes (the cascade set from engine-delete-cascade.ts) into one bin entry, then delete as today. Business objects only, not sys_*.
Restore: write the rows back under their original ids, keep created_by / created_at, and restore a master-detail cascade together. Refuse with a reason, never a forced write, when a unique value is taken, the parent is purged, or the package is uninstalled. Re-link a set_null lookup only if nothing has changed it since. Emit a "restored" event, never a create. Rollups recompute.
Purge and TTL: permanent delete never enters the bin. A TTL reap runs on the existing LifecycleService (the sys_file tombstone pattern).
Permissions: a person restores what they deleted, and an admin sees all.

Every read path stays untouched.

Order: after #30235 (spec). The UI slice reads it.

Generated by Claude Code

docs(adr): ADR-0148 marks the record's own choices, stamps the purge …

docs(adr): ADR-0148 names ADR-0087's kit rule, the ref a snapshot wou…

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

The spec half of the recycle bin landed: PR #30577 merged at d9d42d4e, closing #30235. This card's Blocked-by: #30235 target is now closed. What this card inherits from it, so the engine slice starts from the record and not from the PR thread:

The four seat decisions #30235 was built on (takeover comment 6662490518 on #30235), binding on this card's reading of the spec:

restored is a spec constant only, RECORD_RESTORED_EVENT = 'data.record.restored'. DataEventType / RealtimeEventType list emitted events, so the member joins them in the change that emits it: this card (the pin in recycle-bin.zod.test.ts that keeps it out flips with it).
sys-recycle-bin.object.ts, its plugin registration and its PLATFORM_OBJECTS_BY_PACKAGE row are this card's. The spec fixes the name (RECYCLE_BIN_OBJECT) and the full field contract (RECYCLE_BIN_ENTRY_FIELDS, value shape RecycleBinEntrySchema); build the object from them.
allowRestoreOwnDeleted and manageRecycleBin are planned rows in packages/spec/liveness/permission.json naming this card (evaluator mapping, engine doors) and ui: the admin recycle-bin page (list, restore, empty) and the 已删除 · 撤销 toast (#3146 slice 4) #30239 (Console). This card flips both to live when it reads them.
RESTORE_UNIQUE_VALUE_TAKEN, RESTORE_PARENT_PURGED, RESTORE_PACKAGE_UNINSTALLED are in the error-code ledger under @objectstack/objectql ahead of their producer, status 409 (RECYCLE_BIN_RESTORE_REFUSAL_STATUS); once this card stamps them, the error-status conformance deriver pins the status.

Carried from #30577's contract review (6664134926) and the seat's ACCEPT (6664274007), each owed here:

Should-fix 1: RecycleBinClearedReferenceSchema's docblock and describe say a cleared reference is re-linked "only if the field still holds no value". On main the cascade clears a set_null member of a multi-valued lookup by removing that member and keeping the rest (engine-cascade-planning.ts remainderAfterMemberRemoval), so read literally the sentence never re-links a multi-valued reference, while ADR-0148 D2 rules "only if nothing has changed it since". Restate it for both arities (a single-valued field re-links when it still holds no value; a multi-valued one when it no longer holds the member) before implementing re-link; one describe edit plus gen:docs, the shape needs no change.
Should-fix 2: the two grant keys' describes say nothing on whether modifyAllRecords implies them or whether allowRead bounds them (as allowExport states for itself). Write those sentences when the reader lands, and in the same stroke re-point the restore / purge guidance, the allowRestore / allowPurge tombstone text and the liveness/permission.json notes at D5's answer (respelled; the tombstones stay through the ADR-0087 kit schedule).
Reader-side additions the spec PR left out on purpose: OPERATION_TO_PERMISSION in plugin-security/src/permission-evaluator.ts; GRANT_BITS in core/src/security/effective-object-permissions.ts, which the '*' wildcard materialisation and the verb-less-entry fold also key on; ObjectPermissionVerbTarget / objectPermissionGrants in spec/src/security/permission.zod.ts (a spec widening riding this card, with its own Clause-②: yes).
The object file's managedBy: engine-owned rows survive an organization delete today (engine-cascade-planning.ts), and D4 says an organization's bin entries go with it; the object this card registers owes that answer.
Skills-docs: skills/objectstack-api/SKILL.md (:268, :417) teaches that the trash surface is retired and there is no recycle bin; true until this card ships the reader, then rewritten (Tier H surface).

For #30239: CAPS in ui/packages/app-shell/src/views/metadata-admin/previews/PermissionPreview.tsx lists neither grant key.

Generated by Claude Code

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Unblock · 2026-11-06T00:27Z · `Blocked-by: #30235` closed

Blocker: spec: declare the recycle-bin surface — the sys_recycle_bin object, the retention hook and the restore refusals (#3146 slice 2) #30235 is closed, by PR feat(spec): declare the recycle-bin surface: the sys_recycle_bin entry contract, the retention hook, the restore refusals, the restored event and two grant keys (ADR-0148) #30577 (merged d9d42d4e). The spec seat's hand-over note 6665087359 lists what this card inherits.
Re-derived: the card's Wanted list still stands on main. The spec half fixes RECYCLE_BIN_OBJECT, RECYCLE_BIN_ENTRY_FIELDS / RecycleBinEntrySchema, RECORD_RESTORED_EVENT, the three RESTORE_* 409 codes in the ledger, and the planned grant rows in liveness/permission.json. The engine half (snapshot, restore, purge/TTL, permissions, the object and its registration) is still unbuilt. No open PR names this card or the recycle bin.
Carried into the claim: the two should-fix items from feat(spec): declare the recycle-bin surface: the sys_recycle_bin entry contract, the retention hook, the restore refusals, the restored event and two grant keys (ADR-0148) #30577's contract review (the multi-valued re-link sentence, and the grant-key describes), the reader-side additions, the managedBy answer for organization delete, and the skills/objectstack-api/SKILL.md follow-up, all from 6665087359.
pm:blocked → pm:queue. Being p1 and pm:blocking, it heads the server order, and this seat claims it in the next comment.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Claim: PM loop round 4 · 2026-11-06T00:28Z
Session: session_016WV4cytLmJxfAmgPVjUbbW
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: the card thread's designated claude/project-thread-* branch, named in a claim amendment once the thread reports it
Worktree: objectstack-issue-30237
Domain: domain:server
Seat: domain:server#1
File surface (to be narrowed by amendment after the thread's first reading): packages/objectql/src/** (delete snapshot beside engine-delete-cascade.ts, restore, purge, the TTL reap on the LifecycleService, the restored event), the sys_recycle_bin object file and its plugin registration, plugin-security/src/permission-evaluator.ts (OPERATION_TO_PERMISSION), core/src/security/effective-object-permissions.ts (GRANT_BITS), their tests, the census/inventory rows, changesets. packages/spec/** only as the spec seat's hand-over 6665087359 allocates to this card: the PLATFORM_OBJECTS_BY_PACKAGE row, DataEventType / RealtimeEventType gaining the restored member (with its pin), liveness/permission.json planned → live, ObjectPermissionVerbTarget / objectPermissionGrants, and the two describe should-fixes. Each is named in an amendment before it is edited, with the spec seat told. ⛔ ui/** (#30239); ⛔ skills/** (follow-up card, Tier H)
Container & model: L, p1, mode:thread, model: default, effort: xhigh; a PR split is expected and is proposed by the thread before its first PR
Clause-②: yes (widening)
Metadata-protocol: added
Responsibility: deletes in packages/objectql | a physical delete with no way back | every tenant user who deletes a record by mistake, and the admin who cannot restore it
Thread-read: 6665087359
Premise: holds per ruling 6629858351 (maintainer 「同意，企业版功能在 cloud 中立卡后续开发」) and ADR-0148; the engine half is unbuilt on main
Serial constraints cleared: #30235 closed (PR #30577). No open PR names the recycle bin; open PR file lists are re-read by the thread before its first push.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448

Branch: claude/project-thread-jf62r6 (the card thread's harness-pinned branch, objectstack-ai/objectstack; platform exception to claude/issue-<n>-<slug>).
Dev session: session_016WV4czFGLnXKQd6cQjv3Pr
Plan: five PRs, serial on that branch, each cut from main after the previous one merges and each under 3000 lines: (1) object + snapshot on delete + TTL reap; (2) purge, empty, permanent delete; (3) restore; (4) the permission reader; (5) the REST doors.

PR 1 file surface (this amendment admits PR 1 only; each later PR gets its own amendment): packages/platform-objects/src/system/sys-recycle-bin.object.ts (new), system/index.ts, plugin.ts and their tests, the generated translation bundles if check:i18n derives them; packages/objectql/src/recycle-bin/ (new: eligibility, snapshot, retention, with tests), engine-cascade-planning.ts (hand the collected set to the snapshot; record each cleared reference for the D2 re-link), engine.ts (the by-id delete branch), engine-top-level.ts (retention seam types), plugin.ts (ObjectQLPluginOptions retention seam); the census and inventory rows the new sys_* object trips; one scripts/adr-anchors/ JSON; changesets. packages/spec/** for PR 1: the sys_recycle_bin line in system/constants/platform-object-names.ts (allocated to this card by 6665087359) and the data/recycle-bin.zod.ts docblock sentence saying the object lands with the engine slice. The spec seat is told before either is pushed.

Seat decisions (from the thread's open questions): Q1: serial on the one branch. Q2: the host passes the retention resolver and its token once at boot; no spec change. Q4: managedBy: 'engine-owned', with the object's organization_id declared deleteBehavior: 'cascade', so an organization's delete removes its entries (ADR-0148 D4). Q6: the literal ruling. A by-id delete of a business object enters the bin; sys_* rows in its cascade, predicate deletes, lifecycle reaps and cascade children do not, and the release notes say so. To the maintainer: Q3 (who may delete permanently: rides PR 2) and Q5 (the grant fold: rides PR 4); neither blocks PR 1.

domain:server#1 · os-elon-musk · session_016WV4czFGLnXKQd6cQjv3Pr
os-dev-report

{
  "issue": 30237,
  "status": "done",
  "branch": "claude/project-thread-jf62r6",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30780",
  "session": "session_016WV4czFGLnXKQd6cQjv3Pr",
  "premise_still_valid": true,
  "summary": "PR 1 of the seat's five-PR split (claim amendment 6673429400), opened as a draft with `Part of #30237`. It adds the engine-owned `sys_recycle_bin` object (fields from the spec's RECYCLE_BIN_ENTRY_FIELDS, cascading tenant column, TTL on `purge_after`) and the snapshot on delete: a by-id delete of a business record writes one entry, the master and its master-detail cascade plus the cleared set_null references, inside the delete's own unit of work before the root row is removed, compensated when no transaction covers it. Retention is resolver, then OS_RECYCLE_BIN_RETENTION_DAYS, then 30, wired through `ObjectQLPlugin({ recycleBinRetention })` per seat ruling Q2. Predicate deletes, cascade children and sys_* objects skip the bin (Q6). Both spec hunks carry domain:spec#3's consent (6673450505). Still on the card: PR 2 purge/empty/permanent delete (waits Elon's Q3, then a new spec consent), PR 3 restore, PR 4 permission reader (waits Elon's Q5; its announcement names the permission.json rows it flips), PR 5 REST doors. Each waits for the previous merge and a new seat amendment.",
  "tests": "`pnpm --filter @objectstack/objectql exec vitest run --project local src/recycle-bin/`: Test Files 2 passed (2), Tests 42 passed (42). `packages/platform-objects` `vitest run src/plugin.test.ts`: Tests 23 passed (23). Full objectql suite earlier this session: 3 failures from this change (two tests asserting no warn, one census row), all fixed and re-run green. Ablation 1, via scripts/ablation-replace.mjs on packages/objectql/src/engine.ts (anchor x1 -> x0, blob 9ce18cdff098 -> 417163f7491e): `openRecycleBinCapture(...)` replaced by undefined, so capture.test.ts goes Tests 11 failed | 5 passed (16). The 5 that stay green assert absence or the BFS helper. Restore printed blob == HEAD and an empty `git diff HEAD`. Ablation 2 on sys-recycle-bin.object.ts: object_name maxLength 255 -> 254, so the new field pin fails (Tests 1 failed | 22 passed). Restore printed blob == HEAD. Both suites import src relatively, so no dist leg.",
  "gates": "Final round on head 819b02f7: `dispatch-gates.mjs --ran` gives 97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN, and every family exits 0. `pnpm lint` exit 0. `pnpm --filter @objectstack/platform-objects typecheck` exit 0, `pnpm --filter @objectstack/objectql typecheck` exit 0. The first round on 136ad85d had three real reds, fixed in 819b02f7: check:keyed-text-bounds (a spread in fields and a constant name are unreadable to the source scan), check:objectql-double-limit (the test double applied no bound and copied rows before one), check:platform-object-tenancy-census (regenerated with --write). It also had seven exit-3 results: six spec dist gates stale after the comment edit, and the teardown self-test in the shallow clone. All seven are green in the final round. CI check-runs on the PR are not cited: per the contract this thread does not wait on CI.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-②: yes (widening))",
  "mcp_calls": "4 — mcp__github__issue_read x3, mcp__github__pull_request_read x1 (read-back of #30780); no write tool",
  "api_writes": "2 — relay pr_create -> POST /repos/objectstack-ai/objectstack/pulls (#30780, read back byte-identical); this comment -> POST /repos/objectstack-ai/objectstack/issues/30237/comments. git push is not a REST write.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: c · reach: named producer: skills/objectstack-api/SKILL.md :268 and :417 still teach that there is no recycle bin · evidence: the changeset and PR body carry `Skills-docs: follow-up owed` · dedupe words: recycle bin, objectstack-api skill, sys_recycle_bin",
    "carrier: server seat 1 · noted, not filed"
  ]
}

Generated by Claude Code

domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH

Claim: PM loop round 1 · take-over of PR 2 of 5 (#30990) on domain:server#1's hand-overs 6690307585 (card) and 6690367934 (PR) · 2026-11-06T17:46Z
Session: session_01L9qibyvxbrLP4jm4PargoH
Account: os-tesla (the card's assignee from this claim)
Branch: claude/project-thread-jf62r6 (PR #30990's branch; card thread session session_01L9qibxhbtrhtRZ958iyyJp pushes by merge only, no new PR)
Worktree: objectstack-issue-30237
Domain: domain:server
Seat: domain:server#2
File surface: the fix under ruling 6691358077 only: packages/spec/src/data/hook-api.ts (HookDeleteOptions omits permanent) and its drift pin hook-api.test.ts, hook.zod.ts if it mirrors the key, packages/runtime/src/sandbox/body-runner.ts (the ql.delete forward refuses a body's permanent, 400 VALIDATION_ERROR, param: 'permanent') and its test, PR 2's changeset and body. PR 3 to PR 5 are not in this claim.
Container & model: M, mode:thread, build model: TIER_DEFAULT, effort: high; packages/spec/** is touched, so the seat runs a CONTRACT_REVIEW_TIER delta review before landing.
Clause-②: yes (widening)
Metadata-protocol: added
Both as PR 2 declares them: the ruling narrows only the hook face PR 2 first offered, a key that never shipped.
Responsibility: as on the card (ADR-0148); unchanged by this take-over.
Thread-read: 6691358077
Premise: holds. PR #30990 head 16a1d37e, Test Core (2/8) red at packages/spec/src/data/hook-api.test.ts:232 (the drift pin does not list permanent); auto-merge off since hold 6690367934.
Serial constraints cleared: none new; PR 3 to PR 5 follow #30990 in ruling Q1's order.
Resume-from: claude/project-thread-jf62r6@16a1d37e

Order: /mnt/project-files/server-seat-2/r2026-11-06/dispatch-30990-fix.md (frame FRAME.md beside it).

domain:server#2 · os-tesla · session_01L9qibxhbtrhtRZ958iyyJp
os-dev-report

{
  "issue": 30237,
  "status": "done",
  "branch": "claude/project-thread-jf62r6",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30990",
  "session": "session_01L9qibxhbtrhtRZ958iyyJp",
  "premise_still_valid": true,
  "summary": "PR 2 fix under maintainer ruling A (6691358077), resumed on PR #30990 at 16a1d37e, new head 9f765466. Commits: 7c834758 merges origin/main bcf8a37e (clean, no conflict, no generated-file path touched); d8e95344 narrows HookDeleteOptions to Omit of EngineDeleteOptions minus 'context' and 'permanent' (the drift pin lists permanent under omitted, citing the ruling) and adds refuseBodyPermanentDeletes as the outermost layer of buildSandboxApi in packages/runtime/src/sandbox/body-runner.ts, so a hook, action or job body's ctx.api.object(n).delete() whose options carry permanent with any value but false is refused 400 VALIDATION_ERROR, param 'permanent', before the verb runs, on every derived context (object, sudo, withRunAs, transactions via deriveThroughSeam); 9f765466 adds 6 pins to body-runner.test.ts and the changeset line. The refusal sits at buildSandboxApi rather than only the engine-repo fallback at the old L1133, because a job body reaches the engine through ql.createContext(executionContext).object(), not that facade. hook.zod.ts needs no mirror: its api is typed IScopedContext, and its EngineDeleteOptions mention is the firing delete's options, which a beforeDelete hook still reads permanent off. The engine's own delete(..., { permanent: true }) is unchanged and pinned so. Refusal message verbatim (face label varies: hook body / action body / job body): \"A job body cannot delete a record permanently: app-authored code cannot purge; its deletes enter the recycle bin. Remove 'permanent' from the delete of 'OBJECT'.\" The VM sees code, status and message only (the sandbox error allowlist); param stays on the host error.",
  "tests": "packages/runtime: vitest run src/sandbox/body-runner.test.ts on 9f765466 -> Test Files 1 passed (1), Tests 42 passed (42), 6 new: a job body (system envelope) passing permanent: true is refused VALIDATION_ERROR 400 with the rule in the message, no delete dispatched, the record stays and the bin still holds its one pre-existing entry; uncaught it fails the job run with that envelope; a hook body (engine api) and an action body (executionContext fallback) are refused alike; permanent: false and an absent key are one ordinary delete dispatch and the record enters the bin; host engine.delete(..., permanent: true) still dispatches purge and writes no entry. Real ObjectQL over a row-keeping driver. Full runtime local project: Test Files 551 passed (551), Tests 8832 passed | 19 skipped (8851), lock VERDICT command-exit 0. packages/spec: vitest run src/data/hook-api.test.ts -> Tests 13 passed (13). Ablation via scripts/ablation-replace.mjs on body-runner.ts, anchor 'if (permanent !== undefined && permanent !== false) {' x1 -> x0, replacement 'if (false) {' x0 -> x1, blob 0a33b238 -> d1c7f8ab: Tests 3 failed | 39 passed (42), the three refusal cases red; restored, blob == HEAD 0a33b238, git diff HEAD empty. The test imports ./body-runner.js relatively, so no dist leg.",
  "gates": "Head 9f765466. dispatch-gates.mjs --commands: 109 families (whole PR diff vs merge base bcf8a37e, 17 paths, 1176 changed lines). First pass: 105 exit 0; check:plugin-teardown-shape --self-test exit 3 (shallow clone lacked 621a4876), spec check:skill-examples exit 3 and check:dual-build-cjs-loads exit 3 (missing dists), spec check:generated exit 1 (check:test-typecheck 'tsc failed without diagnostics', the default-heap trap). After fetching 621a4876, a full turbo build (lock VERDICT 0) and NODE_OPTIONS=--max-old-space-size=4096 for check:generated, all four exit 0. --ran: 109 derived, 109 run, 0 NOT-MEASURED, 0 UNRUN. eslint --no-inline-config on the 4 touched source files exit 0. pnpm --filter @objectstack/runtime run typecheck exit 0 (check:test-typecheck OK), pnpm --filter @objectstack/spec run typecheck exit 0. CI on 9f765466: 57 success, 8 skipped, 0 failure, Test Core 2/8 included.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-②: yes (widening); the hook face narrows only from what this unreleased PR first offered)",
  "mcp_calls": "0 — card, PR and comments read with gh api GET",
  "api_writes": "1 — this comment via post-stamped -> POST /repos/objectstack-ai/objectstack/issues/30237/comments. git push is not a REST write. The PR body is not patched by the dev: the delta is drafted for the seat at /mnt/project-files/server-seat-2/r2026-11-06/out/30990-fix-body-delta.md (速读 three lines, a What-changes block, Tests, changeset note).",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: server seat 2 (for its judgment) · noted, not filed: in-process (non-sandboxed) hook handlers written in TypeScript can still pass permanent through ctx.api at runtime by casting past HookDeleteOptions; the ruling names the published type and the sandbox body runner, and host code is deployer code outside the body boundary."
  ]
}

domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH

ACCEPT pointer · 2026-11-06T19:40Z · PR #30990 (PR 2 of 5: purge, empty and the permanent delete; app-authored bodies refused permanent per ruling 6691358077) accepted at head 9cfc7667 in 6693746412; auto-merge armed. PR 3 follows after it lands.

domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH

Landing · 2026-11-06T20:07Z · PR #30990 MERGED 2026-11-06T20:07Z as 9d939c58 (Part of #30237, PR 2 of 5): the engine's purge(entryId), empty(object) and delete(…, { permanent: true }) on one purge verb; app-authored hook, action and job bodies are refused permanent (ruling 6691358077). The card stays open. PR 3 to PR 5 go back to the queue in ruling Q1's serial order, with the hand-over 6690307585 as their plan: PR 3 needs the maintainer's spec consent for events.zod.ts, realtime.zod.ts and recycle-bin.zod.ts before it starts. The seat moves pm:dispatched → pm:queue. Follow-up the seat files: the deprecated in-process hook handler route can still cast past HookDeleteOptions (review 6693177811, should-fix 2).

domain:server#2 · marchtian · session_017ihL2fBJ6xsLWJsnNJGMMx

Ruling recorded · #30237 PR 3 spec consent · 2026-11-07T15:31Z · the maintainer chose A on a decision card (Fable decision thread, tapped 2026-11-07T15:30:06Z).

Card question, verbatim: 「B · engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237 PR 3：同意 restored 事件加入两个事件枚举的 spec 改动吗？」 Chosen option, verbatim: 「A 同意三处（推荐）」.
What it consents to, in packages/spec/src/**, in PR 3 only: DataEventType and RealtimeEventType gain data.record.restored; the recycle-bin.zod.ts "NAMED, NOT YET EMITTED" comment and the recycle-bin.zod.test.ts pin flip in the same change. A pure widening (Clause-②: yes (widening)), the PR-3-specific consent that PR 2's consent 6688058790 did not cover.
Analysis: project file issue-30237/decision-analysis.md.
PR 3 touches packages/spec/src/** ⇒ a full Fable review before ACCEPT. The seat dispatches it next. ⛔ Not a claim.

domain:server#2 · marchtian · session_017ihL2fBJ6xsLWJsnNJGMMx

Claim: PM loop round 1 · #30237 PR 3 of 5 (restore: the recycle-bin entry written back under its original ids, data.record.restored) · 2026-11-07T15:35Z · resumes landing 6694344641 (domain:server#2, previous holder) on hand-over 6690307585
Session: session_017ihL2fBJ6xsLWJsnNJGMMx
Account: marchtian (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-2sxr1i (the card thread's harness-pinned branch, cut from main 8ef4d309; platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-30237
Domain: domain:server
Seat: domain:server#2
File surface: new packages/objectql/src/recycle-bin/restore.ts (+ tests); the engine entry for restore (packages/objectql/src/engine.ts delegation or an engine facet, engine-top-level.ts ENGINE_OPERATION_VERBS, write-epoch.ts WRITE_EPOCH_OPERATIONS, index.ts); the #7809 verb pin engine-middleware-operation-vocabulary.test.ts; the spec hunk the maintainer consented to (ruling record 6709046255): DataEventType (packages/spec/src/**/events.zod.ts) and RealtimeEventType (realtime.zod.ts) gain data.record.restored, the recycle-bin.zod.ts "NAMED, NOT YET EMITTED" comment and recycle-bin.zod.test.ts pin flip, plus the generated spec artifacts those regenerate; docs where a sentence becomes false; one changeset. ⛔ the permission reader (OPERATION_TO_PERMISSION, GRANT_BITS, permission.zod.ts: PR 4), the REST doors (PR 5), ui/**, any other packages/spec/src/** hunk.
Container & model: L, mode:thread, model: TIER_DEFAULT, effort: default; the seat runs an independent full Fable review (spec surface) and a CONTRACT_REVIEW_TIER read of the spec hunk before ACCEPT.
Clause-②: yes (widening)
Metadata-protocol: none
Responsibility: n/a — not a defect card (ADR-0148 implementation, serial split ruling Q1)
Thread-read: 6694344641
Premise: holds. PR 2 #30990 merged 9d939c58 (2026-11-06); on origin/main the three refusal codes RESTORE_UNIQUE_VALUE_TAKEN / RESTORE_PARENT_PURGED / RESTORE_PACKAGE_UNINSTALLED are already in error-code-ledger.zod.ts and named in recycle-bin.zod.ts, so no new ledger code is owed; data.record.restored is not yet in either event enum (the consented hunk).
Serial constraints cleared: #30020's facade series edits engine.ts: E3 (#31151) is in the merge queue and lands first; the next series step (S1) is held by this seat until this PR lands. #29594 PR 3 (#31134) does not touch engine.ts or recycle-bin/**. No other open PR edits recycle-bin/**.

Clause-②: yes (widening): the two event enums widen (consent 6709046255, 「A 同意三处（推荐）」). Order: project file server-seat-2/orders/30237-pr3.md, delivered as the card thread's opening message. Refs #30237 (PR 3 carries Part of #30237; the card stays open for PR 4 and PR 5).

domain:server#2 · marchtian · session_017ihL2fBJ6xsLWJsnNJGMMx

Seat call — #30237 PR 3, two questions from the card thread

Q1 — the detail's master-detail parent is in the bin (its own later entry), not live and not purged. ADR-0148 D1 names a closed set of three refusals, and the spec defines RESTORE_PARENT_PURGED as "neither live nor in the bin" and every reason as "permanent for that entry" (packages/spec/src/data/recycle-bin.zod.ts ~L237–251). This case is neither: it clears once the parent's entry is restored. So the ADR does not cover it, and each clean answer touches spec:

(C) a fourth code, e.g. RESTORE_PARENT_IN_RECYCLE_BIN, in RECYCLE_BIN_RESTORE_REFUSAL_CODES + the error-code ledger; or
(A+) widen RESTORE_PARENT_PURGED's definition (and drop "permanent" for it).
Both fall outside the PR 3 spec consent (record 6709046255), so they go to the maintainer as a design question.

Interim for PR 3 (seat call, reversible): refuse fail-closed with 409 RESTORE_PARENT_PURGED, nothing written, nothing removed; the message says the parent is in the recycle bin and must be restored first; details carry parentObject / parentId. Keep the choice of code in one place so the ruling can swap it in one line. Writing an orphan detail (B) is refused: it breaks ADR-0055 master-detail. The PR body names the gap under a Known gap line. If the maintainer rules before ACCEPT, the ruled shape joins this PR under a fresh consent; otherwise it becomes a follow-up card.

Q2 — packages/spec/src/api/events.test.ts pin of DataEventType.options. Accepted as inside consent: it is the mechanical twin of the recycle-bin.zod.test.ts pin the consent names, a test file, no source hunk. Any RealtimeEventType options pin moves the same way. Name the hunk in the PR body and spec_hunk.

Navigation Menu

Repository navigation

engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237

Wanted

Unblock · 2026-11-06T00:27Z · `Blocked-by: #30235` closed

席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448

10 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237

Description

Wanted

Activity

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 6, 2026

Unblock · 2026-11-06T00:27Z · Blocked-by: #30235 closed

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448

objectstack-fleet commented on Nov 6, 2026

10 remaining items

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 7, 2026

objectstack-fleet commented on Nov 7, 2026

objectstack-fleet commented on Nov 7, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Unblock · 2026-11-06T00:27Z · `Blocked-by: #30235` closed