engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3)

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Filing gate: ③ a split the parent needs, asked by domain:server#4 (Request: triage · #3146). ⛔ Not a claim.

Blocked-by: #30235
Part of #3146 · Ruling-ref: 6629858351 (the recycle-bin shape, maintainer 「同意，企业版功能在 cloud 中立卡后续开发」)

Wanted

The engine half of the ruled v1:

Snapshot: before a physical delete, write the rows it removes (the cascade set from engine-delete-cascade.ts) into one bin entry, then delete as today. Business objects only, not sys_*.
Restore: write the rows back under their original ids, keep created_by / created_at, and restore a master-detail cascade together. Refuse with a reason, never a forced write, when a unique value is taken, the parent is purged, or the package is uninstalled. Re-link a set_null lookup only if nothing has changed it since. Emit a "restored" event, never a create. Rollups recompute.
Purge and TTL: permanent delete never enters the bin. A TTL reap runs on the existing LifecycleService (the sys_file tombstone pattern).
Permissions: a person restores what they deleted, and an admin sees all.

Every read path stays untouched.

Order: after #30235 (spec). The UI slice reads it.

Generated by Claude Code

docs(adr): ADR-0148 marks the record's own choices, stamps the purge …

docs(adr): ADR-0148 names ADR-0087's kit rule, the ref a snapshot wou…

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

The spec half of the recycle bin landed: PR #30577 merged at d9d42d4e, closing #30235. This card's Blocked-by: #30235 target is now closed. What this card inherits from it, so the engine slice starts from the record and not from the PR thread:

The four seat decisions #30235 was built on (takeover comment 6662490518 on #30235), binding on this card's reading of the spec:

restored is a spec constant only, RECORD_RESTORED_EVENT = 'data.record.restored'. DataEventType / RealtimeEventType list emitted events, so the member joins them in the change that emits it: this card (the pin in recycle-bin.zod.test.ts that keeps it out flips with it).
sys-recycle-bin.object.ts, its plugin registration and its PLATFORM_OBJECTS_BY_PACKAGE row are this card's. The spec fixes the name (RECYCLE_BIN_OBJECT) and the full field contract (RECYCLE_BIN_ENTRY_FIELDS, value shape RecycleBinEntrySchema); build the object from them.
allowRestoreOwnDeleted and manageRecycleBin are planned rows in packages/spec/liveness/permission.json naming this card (evaluator mapping, engine doors) and ui: the admin recycle-bin page (list, restore, empty) and the 已删除 · 撤销 toast (#3146 slice 4) #30239 (Console). This card flips both to live when it reads them.
RESTORE_UNIQUE_VALUE_TAKEN, RESTORE_PARENT_PURGED, RESTORE_PACKAGE_UNINSTALLED are in the error-code ledger under @objectstack/objectql ahead of their producer, status 409 (RECYCLE_BIN_RESTORE_REFUSAL_STATUS); once this card stamps them, the error-status conformance deriver pins the status.

Carried from #30577's contract review (6664134926) and the seat's ACCEPT (6664274007), each owed here:

Should-fix 1: RecycleBinClearedReferenceSchema's docblock and describe say a cleared reference is re-linked "only if the field still holds no value". On main the cascade clears a set_null member of a multi-valued lookup by removing that member and keeping the rest (engine-cascade-planning.ts remainderAfterMemberRemoval), so read literally the sentence never re-links a multi-valued reference, while ADR-0148 D2 rules "only if nothing has changed it since". Restate it for both arities (a single-valued field re-links when it still holds no value; a multi-valued one when it no longer holds the member) before implementing re-link; one describe edit plus gen:docs, the shape needs no change.
Should-fix 2: the two grant keys' describes say nothing on whether modifyAllRecords implies them or whether allowRead bounds them (as allowExport states for itself). Write those sentences when the reader lands, and in the same stroke re-point the restore / purge guidance, the allowRestore / allowPurge tombstone text and the liveness/permission.json notes at D5's answer (respelled; the tombstones stay through the ADR-0087 kit schedule).
Reader-side additions the spec PR left out on purpose: OPERATION_TO_PERMISSION in plugin-security/src/permission-evaluator.ts; GRANT_BITS in core/src/security/effective-object-permissions.ts, which the '*' wildcard materialisation and the verb-less-entry fold also key on; ObjectPermissionVerbTarget / objectPermissionGrants in spec/src/security/permission.zod.ts (a spec widening riding this card, with its own Clause-②: yes).
The object file's managedBy: engine-owned rows survive an organization delete today (engine-cascade-planning.ts), and D4 says an organization's bin entries go with it; the object this card registers owes that answer.
Skills-docs: skills/objectstack-api/SKILL.md (:268, :417) teaches that the trash surface is retired and there is no recycle bin; true until this card ships the reader, then rewritten (Tier H surface).

For #30239: CAPS in ui/packages/app-shell/src/views/metadata-admin/previews/PermissionPreview.tsx lists neither grant key.

Generated by Claude Code

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Unblock · 2026-11-06T00:27Z · `Blocked-by: #30235` closed

Blocker: spec: declare the recycle-bin surface — the sys_recycle_bin object, the retention hook and the restore refusals (#3146 slice 2) #30235 is closed, by PR feat(spec): declare the recycle-bin surface: the sys_recycle_bin entry contract, the retention hook, the restore refusals, the restored event and two grant keys (ADR-0148) #30577 (merged d9d42d4e). The spec seat's hand-over note 6665087359 lists what this card inherits.
Re-derived: the card's Wanted list still stands on main. The spec half fixes RECYCLE_BIN_OBJECT, RECYCLE_BIN_ENTRY_FIELDS / RecycleBinEntrySchema, RECORD_RESTORED_EVENT, the three RESTORE_* 409 codes in the ledger, and the planned grant rows in liveness/permission.json. The engine half (snapshot, restore, purge/TTL, permissions, the object and its registration) is still unbuilt. No open PR names this card or the recycle bin.
Carried into the claim: the two should-fix items from feat(spec): declare the recycle-bin surface: the sys_recycle_bin entry contract, the retention hook, the restore refusals, the restored event and two grant keys (ADR-0148) #30577's contract review (the multi-valued re-link sentence, and the grant-key describes), the reader-side additions, the managedBy answer for organization delete, and the skills/objectstack-api/SKILL.md follow-up, all from 6665087359.
pm:blocked → pm:queue. Being p1 and pm:blocking, it heads the server order, and this seat claims it in the next comment.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Claim: PM loop round 4 · 2026-11-06T00:28Z
Session: session_016WV4cytLmJxfAmgPVjUbbW
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: the card thread's designated claude/project-thread-* branch, named in a claim amendment once the thread reports it
Worktree: objectstack-issue-30237
Domain: domain:server
Seat: domain:server#1
File surface (to be narrowed by amendment after the thread's first reading): packages/objectql/src/** (delete snapshot beside engine-delete-cascade.ts, restore, purge, the TTL reap on the LifecycleService, the restored event), the sys_recycle_bin object file and its plugin registration, plugin-security/src/permission-evaluator.ts (OPERATION_TO_PERMISSION), core/src/security/effective-object-permissions.ts (GRANT_BITS), their tests, the census/inventory rows, changesets. packages/spec/** only as the spec seat's hand-over 6665087359 allocates to this card: the PLATFORM_OBJECTS_BY_PACKAGE row, DataEventType / RealtimeEventType gaining the restored member (with its pin), liveness/permission.json planned → live, ObjectPermissionVerbTarget / objectPermissionGrants, and the two describe should-fixes. Each is named in an amendment before it is edited, with the spec seat told. ⛔ ui/** (#30239); ⛔ skills/** (follow-up card, Tier H)
Container & model: L, p1, mode:thread, model: default, effort: xhigh; a PR split is expected and is proposed by the thread before its first PR
Clause-②: yes (widening)
Metadata-protocol: added
Responsibility: deletes in packages/objectql | a physical delete with no way back | every tenant user who deletes a record by mistake, and the admin who cannot restore it
Thread-read: 6665087359
Premise: holds per ruling 6629858351 (maintainer 「同意，企业版功能在 cloud 中立卡后续开发」) and ADR-0148; the engine half is unbuilt on main
Serial constraints cleared: #30235 closed (PR #30577). No open PR names the recycle bin; open PR file lists are re-read by the thread before its first push.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448

Branch: claude/project-thread-jf62r6 (the card thread's harness-pinned branch, objectstack-ai/objectstack; platform exception to claude/issue-<n>-<slug>).
Dev session: session_016WV4czFGLnXKQd6cQjv3Pr
Plan: five PRs, serial on that branch, each cut from main after the previous one merges and each under 3000 lines: (1) object + snapshot on delete + TTL reap; (2) purge, empty, permanent delete; (3) restore; (4) the permission reader; (5) the REST doors.

PR 1 file surface (this amendment admits PR 1 only; each later PR gets its own amendment): packages/platform-objects/src/system/sys-recycle-bin.object.ts (new), system/index.ts, plugin.ts and their tests, the generated translation bundles if check:i18n derives them; packages/objectql/src/recycle-bin/ (new: eligibility, snapshot, retention, with tests), engine-cascade-planning.ts (hand the collected set to the snapshot; record each cleared reference for the D2 re-link), engine.ts (the by-id delete branch), engine-top-level.ts (retention seam types), plugin.ts (ObjectQLPluginOptions retention seam); the census and inventory rows the new sys_* object trips; one scripts/adr-anchors/ JSON; changesets. packages/spec/** for PR 1: the sys_recycle_bin line in system/constants/platform-object-names.ts (allocated to this card by 6665087359) and the data/recycle-bin.zod.ts docblock sentence saying the object lands with the engine slice. The spec seat is told before either is pushed.

Seat decisions (from the thread's open questions): Q1: serial on the one branch. Q2: the host passes the retention resolver and its token once at boot; no spec change. Q4: managedBy: 'engine-owned', with the object's organization_id declared deleteBehavior: 'cascade', so an organization's delete removes its entries (ADR-0148 D4). Q6: the literal ruling. A by-id delete of a business object enters the bin; sys_* rows in its cascade, predicate deletes, lifecycle reaps and cascade children do not, and the release notes say so. To the maintainer: Q3 (who may delete permanently: rides PR 2) and Q5 (the grant fold: rides PR 4); neither blocks PR 1.

domain:server#1 · os-elon-musk · session_016WV4czFGLnXKQd6cQjv3Pr
os-dev-report

{
  "issue": 30237,
  "status": "done",
  "branch": "claude/project-thread-jf62r6",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30780",
  "session": "session_016WV4czFGLnXKQd6cQjv3Pr",
  "premise_still_valid": true,
  "summary": "PR 1 of the seat's five-PR split (claim amendment 6673429400), opened as a draft with `Part of #30237`. It adds the engine-owned `sys_recycle_bin` object (fields from the spec's RECYCLE_BIN_ENTRY_FIELDS, cascading tenant column, TTL on `purge_after`) and the snapshot on delete: a by-id delete of a business record writes one entry, the master and its master-detail cascade plus the cleared set_null references, inside the delete's own unit of work before the root row is removed, compensated when no transaction covers it. Retention is resolver, then OS_RECYCLE_BIN_RETENTION_DAYS, then 30, wired through `ObjectQLPlugin({ recycleBinRetention })` per seat ruling Q2. Predicate deletes, cascade children and sys_* objects skip the bin (Q6). Both spec hunks carry domain:spec#3's consent (6673450505). Still on the card: PR 2 purge/empty/permanent delete (waits Elon's Q3, then a new spec consent), PR 3 restore, PR 4 permission reader (waits Elon's Q5; its announcement names the permission.json rows it flips), PR 5 REST doors. Each waits for the previous merge and a new seat amendment.",
  "tests": "`pnpm --filter @objectstack/objectql exec vitest run --project local src/recycle-bin/`: Test Files 2 passed (2), Tests 42 passed (42). `packages/platform-objects` `vitest run src/plugin.test.ts`: Tests 23 passed (23). Full objectql suite earlier this session: 3 failures from this change (two tests asserting no warn, one census row), all fixed and re-run green. Ablation 1, via scripts/ablation-replace.mjs on packages/objectql/src/engine.ts (anchor x1 -> x0, blob 9ce18cdff098 -> 417163f7491e): `openRecycleBinCapture(...)` replaced by undefined, so capture.test.ts goes Tests 11 failed | 5 passed (16). The 5 that stay green assert absence or the BFS helper. Restore printed blob == HEAD and an empty `git diff HEAD`. Ablation 2 on sys-recycle-bin.object.ts: object_name maxLength 255 -> 254, so the new field pin fails (Tests 1 failed | 22 passed). Restore printed blob == HEAD. Both suites import src relatively, so no dist leg.",
  "gates": "Final round on head 819b02f7: `dispatch-gates.mjs --ran` gives 97 derived, 97 run, 0 NOT-MEASURED, 0 UNRUN, and every family exits 0. `pnpm lint` exit 0. `pnpm --filter @objectstack/platform-objects typecheck` exit 0, `pnpm --filter @objectstack/objectql typecheck` exit 0. The first round on 136ad85d had three real reds, fixed in 819b02f7: check:keyed-text-bounds (a spread in fields and a constant name are unreadable to the source scan), check:objectql-double-limit (the test double applied no bound and copied rows before one), check:platform-object-tenancy-census (regenerated with --write). It also had seven exit-3 results: six spec dist gates stale after the comment edit, and the teardown self-test in the shallow clone. All seven are green in the final round. CI check-runs on the PR are not cited: per the contract this thread does not wait on CI.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm (Clause-②: yes (widening))",
  "mcp_calls": "4 — mcp__github__issue_read x3, mcp__github__pull_request_read x1 (read-back of #30780); no write tool",
  "api_writes": "2 — relay pr_create -> POST /repos/objectstack-ai/objectstack/pulls (#30780, read back byte-identical); this comment -> POST /repos/objectstack-ai/objectstack/issues/30237/comments. git push is not a REST write.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: c · reach: named producer: skills/objectstack-api/SKILL.md :268 and :417 still teach that there is no recycle bin · evidence: the changeset and PR body carry `Skills-docs: follow-up owed` · dedupe words: recycle bin, objectstack-api skill, sys_recycle_bin",
    "carrier: server seat 1 · noted, not filed"
  ]
}

Generated by Claude Code

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Claim: PM loop round 1 · #30237 · 2026-11-08T06:19Z · build (PR 4 of 5, the permission reader; PR 5 the REST doors follows on this branch under its own amendment after PR 4 merges)
Session: session_01FEkQ5pXkgNXVpCn2GZDjyy
Account: os-project-manager
Branch: claude/project-thread-py4hal (the card thread's harness-pinned branch; platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-30237
Domain: domain:server
Seat: domain:server#3
File surface: plugin-security's evaluator mapping (OPERATION_TO_PERMISSION, DESTRUCTIVE_OPERATIONS) and the sites listed in hand-over 6690307585, packages/core/src/security/* (grant-bit fold), packages/objectql/src/recycle-bin/{purge,restore}.ts, packages/verify/src/handle.ts, packages/spec/src/security/permission.zod.ts + packages/spec/liveness/permission.json (only after the maintainer's PR-4 consent is recorded on this card), tests, changesets (stop on breach; explain in the report)
Container & model: L, mode:thread, model: default tier, effort: default (coordinator default)
Clause-②: yes (widening) — a granted allowRestoreOwnDeleted / manageRecycleBin (and, per Q5 = A, modifyAllRecords) opens restore / purge, which every non-system caller is denied today; the dev confirms from the real diff
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6718007356
Premise: holds — PRs 1–3 on main (#30780, #30990, #31220); nothing reads either key at origin/main 4a3b186c. Seat 2's release note "PR 4 (purge) and PR 5 (TTL reap)" is a mislabel (both shipped in PRs 1–2); the plan of record is hand-over 6690307585: PR 4 = permission reader, PR 5 = REST doors. The system-context permanent question is closed by ruling 6691358077.
Serial constraints cleared: PR 3 (#31220) merged 69c7cd6357; PR-4 spec consent asked of the maintainer (the packages/spec/** hunk waits for it); #30020 S1 held behind this card's engine.ts reading; plugin-security is server seat 6's face — seat 6 confirmed no overlap with its in-flight #31330 / #31373. Order: pm-orders/server/order-30237-pr4-pr5.md (project files).

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Claim amendment · 2026-11-08T06:22Z · #30237 PR 4 · File surface only (Branch, Clause-②, Metadata-protocol unchanged)

File surface adds two things, both measured by the card thread at 3a0aa915.

packages/objectql/src/engine.ts. No new member. Only the restore() / purge() / empty() host literals change: they gain closures over existing private state.
- The registered _effectiveObjectPermissionsResolver answers the own-entry check: "does the caller hold manageRecycleBin?" The check fails closed when no resolver is registered or the resolver throws.
- The engine's Layer-0 verdict is used for PR 2 review should-fix 1 (6689562965): a deny refuses, and the executors pass recordedVerdict: opCtx.tenantLayer0Verdict.
- refactor: move shared state out of the protocol.ts and engine.ts facades into state-owning facets, so the hot bodies left on the class can become delegations (ruling 6624345766) #30020 S1 waits for this PR to land because both PRs edit engine.ts.
The spec hunk is wider than the describes. The Q5 fold has one definition, objectPermissionGrants in packages/spec/src/security/permission.zod.ts. The plugin-security evaluator, core's GRANT_BITS fold and the Console all call it. In that file:
- the exported ObjectPermissionVerbTarget union gains the two keys;
- objectPermissionGrants gains two cells: restoreOwn = allowRead ∧ (allowRestoreOwnDeleted ∨ manageRecycleBin ∨ modifyAllRecords); manage = allowRead ∧ (manageRecycleBin ∨ modifyAllRecords).
  OBJECT_PERMISSION_VERBS and can() are unchanged. A second fold inside plugin-security is not an option, because [finding] the super-user permission fold is now stated three times — spec's objectPermissionGrants, plugin-security's PermissionEvaluator and lint's buildAccessMatrix — one rule, three implementations #18785 forbids it. The maintainer's consent is being asked for this wider hunk, and the whole packages/spec/** hunk stays held until that consent is recorded here.

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Ruling recorded · #30237 PR 4 spec consent · 2026-11-08T06:40Z · the maintainer chose A in the Fable decision thread. His words were 「以上都同意」, written 2026-11-08T06:38Z (Ruling-ref cmsg_01TenzsRopZj4jMbvjX8uz1XN1Vwc2QdcfhdqcbPa2zcGj). They accept that thread's recommendations, including the corrected PR 4 item.

The consent covers these hunks, in PR 4 only.

packages/spec/src/security/permission.zod.ts:

(a) The exported ObjectPermissionVerbTarget gains allowRestoreOwnDeleted and manageRecycleBin. This widens an exported type.
(b) objectPermissionGrants gains two cells, which carry the Q5 = A fold (6676415868):
- restoreOwn = allowRead ∧ (allowRestoreOwnDeleted ∨ manageRecycleBin ∨ modifyAllRecords)
- manage = allowRead ∧ (manageRecycleBin ∨ modifyAllRecords)
(c) The [PLANNED] … Not read yet describes and the docblock (~:668–675) are rewritten to say the keys are now read.

packages/spec/liveness/permission.json:

The allowRestoreOwnDeleted and manageRecycleBin rows move from planned to live, and cite this PR as the reader.

Unchanged: OBJECT_PERMISSION_VERBS and can(). No second fold is added in plugin-security (#18785). Consents for PR 2 (6688058790) and PR 3 (6709046255, 6710220841) do not cover PR 5. If PR 5 touches packages/spec/src/**, it needs its own consent.

Clause-②: yes (widening). PR 4 touches packages/spec/src/**, so it gets a full Fable contract review before ACCEPT.

Landing condition, which the maintainer was told about: PR 2 review should-fix 1 (6689562965) closes in PR 4. The object-level dispatches in purge.ts must carry the tenant Layer-0 verdict, as recordedVerdict: opCtx.tenantLayer0Verdict.

domain:server#3 · os-project-manager · session_01FEkQ5nYzXijPZzrM68FB5J
os-dev-report

{
  "issue": 30237,
  "status": "done",
  "branch": "claude/project-thread-py4hal",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31438",
  "head": "aa6ae4c43c",
  "session": "session_01FEkQ5nYzXijPZzrM68FB5J",
  "premise_still_valid": true,
  "summary": "PR 4 of 5, the recycle-bin permission reader. plugin-security maps restore→allowRestoreOwnDeleted and purge→manageRecycleBin through the one fold (objectPermissionGrants gains the two Q5 = A cells under consent 6718336940; core GRANT_BITS reports them); every write-class site reads rlsOperationForVerb. The engine refuses (403) a restore of an entry whose deleted_by is not the caller unless the effective-permissions resolver grants manageRecycleBin, failing closed with no resolver or a throwing one. Should-fix 1 closes: a Layer-0 deny answers restore null / purge false / empty 0 before any read, and the purge/empty executors pass recordedVerdict to the driver.",
  "tests": "objectql recycle-bin restore.test.ts + purge.test.ts (new describes: another caller's entry, tenant wall) and full objectql 570 files / 11570 tests pass; plugin-security full suite 248/249 files green on first run, security-plugin.test.ts's 3 old fail-closed pins of the unmapped verbs rewritten → 255/255; permission-evaluator.test.ts Q5 named cells + 3-state sweep (6 bits) + present/absent sweep (10 bits × 8 verbs); core 143/3242 (one super-user wildcard shape pin updated); spec permission.test.ts 122; verify handle.observe-writes 11; repo projects core 96, objectql 5, spec 1556. Ablations: 18 mutations via scripts/ablation-replace.mjs, each red and each restored blob == HEAD (A1–A12 engine own-entry and wall pins, B1–B3 evaluator map rows, C1–C3 spec fold cells); per-ablation red counts and first failing test are in the PR body <details>.",
  "gates": "dispatch-gates --commands: 124 families, every exit captured before any pipe; --ran reconciliation: 124 derived, 124 run, 0 NOT-MEASURED, 0 UNRUN. First pass 112/124; 11 were prerequisite exit-3 (no dist, shallow clone) and 1 real finding (check:system-context-census: two new isSystem reads without a row) fixed by system-context.mdx rows 29d/29e + --write; after git fetch --unshallow and a full workspace build (119/119) all 12 exit 0. Typecheck objectql/plugin-security/core/verify/spec exit 0; eslint on touched source exit 0. CI check-runs not yet read (PR just opened).",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "line_budget": "29 files, +775 / -229 vs origin/main",
  "files_changed": "plugin-security: permission-evaluator.ts, lifecycle-verb-rls-operation.ts, rls-compiler.ts, security-plugin-{rls-filter,addressed-writes,cbp-write-gate,authz-middleware}.ts, platform-ownership-policies.ts, explain-engine.ts (+2 tests); objectql: recycle-bin/{purge,restore}.ts, engine.ts (+2 tests); core: security/effective-object-permissions.ts, resolve-user-grants-cache.ts (+1 test); verify: handle.ts; spec: security/permission.zod.ts, liveness/permission.json, liveness/state-counts/permission.md (generated) (+permission.test.ts); content/docs/references/{api/auth,api/protocol,security/permission}.mdx (generated); content/docs/permissions/system-context.mdx; .changeset/30237-recycle-bin-permission-reader.md",
  "deviations": [
    "Surface beyond the claim: content/docs/permissions/system-context.mdx rows 29d/29e + regenerated register (check:system-context-census requires a row for each new isSystem read); generated content/docs/references/** and spec liveness/state-counts (check:generated --fix); spec permission.test.ts (seat said include).",
    "Should-fix 1 names three dispatches (entry read, purge executor, empty executor). The purge entry read runs before the dispatch, so it cannot carry opCtx.tenantLayer0Verdict; it is scoped by the engine's own verdict and the deny check precedes it. The two executors carry recordedVerdict.",
    "Restore got the same deny-verdict refusal as purge/empty (same class of fall-open: driverReadScope projects deny-with-no-org to no scope).",
    "resolve-user-grants-cache WRITE_OPERATIONS kept as insert/update/delete (the bin never takes a platform object; every watched object is sys_); comment added.",
    "Origin/main merged once (db502314) before opening; merge commit carries git's default message."
  ],
  "mcp_calls": "reads only — mcp__github__issue_read and mcp__github__pull_request_read (card and PR 2 review reads, early in the run); later comment reads via gh api GET. No MCP write tool called.",
  "api_writes": "2 — relay pr_create (repository_dispatch → objectstack-ai/objectstack#31438, run 42460914944); this os-dev-report comment via post-stamped. Plus git push (not a REST write).",
  "open_questions": [],
  "security_findings": "withheld",
  "acceptance_notes": [
    "plugin-security records tenantLayer0Verdict only on AST operations, so for AST-less restore/purge the engine verdict decides today; the recorded-verdict path is pinned through a test middleware.",
    "The CBP master gate and delegated-admin gate still do not judge id-less restore/purge.",
    "A super-user wildcard's /me/permissions map now shows both bin keys on sys_ objects too, where the engine refuses to bin them.",
    "Spec prose outside the consent: the [REMOVED] describes of allowRestore/allowPurge still say a dispatched restore/purge stays denied by the backstop and the bit returns with M2 — now stale; left for the seat."
  ],
  "out_of_scope_findings": [
    "carrier: seat 3 · the stale [REMOVED] describes of allowRestore/allowPurge in permission.zod.ts (spec prose, regenerated into content/docs/references) · noted, not filed"
  ],
  "pr5_spec_need": "Not yet measured; reported before PR 5 starts, after PR 4 merges and the claim amendment."
}

Generated by Claude Code

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Claim amendment · 2026-11-08T08:12Z · #30237 PR 4 (PR #31438) · File surface only (Branch, Clause-②, Metadata-protocol unchanged)

The file surface adds the following, measured on head aa6ae4c4 and from contract review 6719122724:

content/docs/permissions/system-context.mdx rows 29d/29e, which check:system-context-census requires for the two new isSystem reads. Also the regenerated content/docs/references/{api/auth,api/protocol,security/permission}.mdx and packages/spec/liveness/state-counts/permission.md, all from the generators.
packages/plugins/plugin-sharing/src/sharing-plugin.ts, the by-id write gate. A by-id purge (the permanent delete keeps where.id) must be asked canDelete, the same as delete. Today it is asked only for update and delete. Before this PR no non-system caller could reach purge, so this PR opens the path and must close it. The gate reads rlsOperationForVerb, as the plugin-security sites do.
packages/plugins/plugin-security/src/explain-engine.ts. The report's sharing gate and its comments follow rlsOperationForVerb, so security/explain answers what the door answers for purge and restore (ADR-0111 D3).
Hand-written docs this PR makes false: content/docs/permissions/permissions-matrix.mdx (~~:78) and content/docs/protocol/objectql/security.mdx (~~:111).
Pending the maintainer's consent addendum: the allowRestore / allowPurge tombstone prescriptions and the restore / purge guidance strings in permission.zod.ts (~:527–542, :620–670), and the two dead liveness rows (permission.json ~:94, :100). These are prose only; the tombstones stay. This was the obligation feat(spec): declare the recycle-bin surface: the sys_recycle_bin entry contract, the retention hook, the restore refusals, the restored event and two grant keys (ADR-0148) #30577's review recorded (6665087359).

plugin-sharing belongs to server seat 6. On 06:18Z that seat confirmed it has no overlapping work in flight.

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Ruling recorded · #30237 PR 4 tombstone-prose addendum · 2026-11-08T11:00Z · the maintainer chose A 同意 on decision card cmsg_01TenzsRopZj4jMbvjX8uz1X7YVMGcRkJ6cjJ4gPHu8LLx in the Fable decision thread, tapped 2026-11-08T10:59Z (Ruling-ref: that card id and time; the platform verified the tap as his).

This closes Fable record 6719122724's SF1. The consent covers prose only, in PR 4 (PR #31438), in packages/spec/src/security/permission.zod.ts:

the retiredKey messages of the allowRestore and allowPurge tombstones;
the restore/purge lines of the guidance map;
the docblock that calls those operations "never shipped", refused by the evaluator's backstop, or returning with the M2 lifecycle plan.

The new text says the operations exist and that their grants are spelled allowRestoreOwnDeleted / manageRecycleBin (ADR-0148).

Unchanged: the tombstones stay, the accept set does not move, and PR 4's Clause-②: yes (widening) line from consent 6718336940 still applies. The delta review of the patch round runs at CONTRACT_REVIEW_TIER before ACCEPT.

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Claim amendment · 2026-11-08T11:56Z · #30237 PR 4 (PR #31438) · File surface only (Branch, Clause-②, Metadata-protocol unchanged)

The file surface adds the following, measured by the card thread on head 95d2a17f (handback, patch round 1):

packages/core/src/security/lifecycle-verb-rls-operation.ts and its export from @objectstack/core. LIFECYCLE_VERB_RLS_OPERATION / rlsOperationForVerb move there because plugin-sharing (by-id purge asks canDelete, which the seat added) cannot import plugin-security. plugin-security re-exports it, so there is one definition. This is a new export of @objectstack/core, a package API widening; no spec shape moves.
packages/lint/src/rule-explanations.ts and its test. The residue rule's explanation repeated the "returns with M2" claim that consent 6720657486 corrects, so it follows under the same-PR prose rule.
@objectstack/core, @objectstack/plugin-sharing and @objectstack/lint in the changeset.

Left out of this PR, to a follow-up card: the spec conversion/migration entry 18 texts (historical release records), the ui permission-slice comments, and a packages/metadata/src/plugin.ts comment, which still say the keys return with M2.

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

PR 4 ACCEPT → PR #31438 comment 6721514775 · 2026-11-08T12:32Z · head 95d2a17f · contract review 6719122724 + at-tier delta 6721290796 PASS · the seat marked it ready and turned on auto-merge. This card stays open for PR 5 (REST doors).

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Landed (PR 4 of 5) · 2026-11-08T12:56Z

Probe	Reading
PR #31438	MERGED 2026-11-08T12:56Z through the merge queue as `6a708214` (head `95d2a17f`, seat ACCEPT 6721514775, contract review 6719122724 + at-tier delta 6721290796)
This card	stays open: PR 5 (the REST doors) is next, on the same thread and branch, from fresh `main`

Status: pm:dispatched stays. #31508 (the leftover "return with M2" texts) was blocked on this PR; its precondition is met.

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Claim amendment · 2026-11-08T12:58Z · #30237 PR 5 · File surface only (Branch, Metadata-protocol unchanged)

PR 4 merged as 6a708214, so PR 5 (the REST doors, hand-over 6690307585) starts on the same thread. Branch claude/project-thread-py4hal is reset to fresh origin/main under the follow-up rule.

File surface for PR 5: packages/rest/src/recycle-bin-routes.ts (new) and its mount, the route ledger, the OpenAPI and discovery entries, the delete answer naming the entry to undo (#30239), tests, docs pages the doors make false, a changeset (stop on breach; explain in the report).

Clause-②: to be read from the real diff. New doors are a widening.
packages/spec/src/**: the dev reports first whether PR 5 needs any spec change (response schemas, codes). If it does, the seat records a separate maintainer consent on this card before that hunk is committed.

Cross-face: packages/rest is server seat 5's face. Seat 3 keeps it because this card holds it by first claim, and seat 5 is told.

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Claim amendment · 2026-11-08T13:03Z · #30237 PR 5 · File surface only (Branch, Metadata-protocol unchanged)

The dev's step-1 report (project file pm-orders/server/30237-pr5-spec-report.md) adds the following to the PR 5 file surface:

packages/objectql/src/engine.ts: a new listRecycleBin delegation member. refactor: move shared state out of the protocol.ts and engine.ts facades into state-owning facets, so the hot bodies left on the class can become delegations (ruling 6624345766) #30020 S1 stays held behind it.
packages/metadata-protocol deleteData, which carries the delete answer.
packages/client: client.recycleBin.*, so the route-ledger rows read sdk. This is seat 5's face, and seat 5 is told.
Spec, held until the maintainer consents: S1 DeleteDataResponseSchema.recycleBinEntryId (optional), S2 an optional out-channel key on EngineDeleteOptions, and S3 api-derivation.ts restore/purge derived from delete. The consent request has gone to the maintainer. These hunks stay uncommitted until a consent record is posted here.
The doors nest under /data/:object/recycle-bin, so ApiRoutesSchema is unchanged (seat's call).

domain:server#3 · os-project-manager · session_01FEkQ5pXkgNXVpCn2GZDjyy

Ruling recorded · #30237 PR 5 spec consent · 2026-11-08T13:13Z · the maintainer chose A 同意 S1–S3 on decision card cmsg_01TenzsRopZj4jMbvjX8uz1XJscVEpuNmhLtCKi3NKLT4T in the Fable decision thread, tapped 2026-11-08T13:12Z (Ruling-ref: that card id and time).

The consent covers exactly three spec hunks in PR 5, as the dev's step-1 report describes them (amendment 6721834323):

S1 packages/spec/src/api/protocol.zod.ts: DeleteDataResponseSchema gains an optional recycleBinEntryId, so the delete answer names the entry to undo (ui: the admin recycle-bin page (list, restore, empty) and the 已删除 · 撤销 toast (#3146 slice 4) #30239).
S2 packages/spec/src/data/data-engine.zod.ts: EngineDeleteOptions gains an optional out-channel key, so the engine can hand that id back.
S3 packages/spec/src/data/api-derivation.ts: restore and purge derive from delete instead of flag: () => false, and the docblock that says they return "if/when a real recycle bin ships" is corrected in the same PR.

All three are widenings, and no new error codes are added. The doors nest under /data/:object/recycle-bin, so ApiRoutesSchema is unchanged (the seat's call). Any other packages/spec/** file stays out of scope: stop and report. Because PR 5 changes spec non-test paths, the seat runs a contract review at CONTRACT_REVIEW_TIER before ACCEPT.

Navigation Menu

Repository navigation

engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237

Wanted

Unblock · 2026-11-06T00:27Z · `Blocked-by: #30235` closed

席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448

35 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

engine: snapshot deletes into the recycle bin, restore under original ids, purge, and the TTL reap (#3146 slice 3) #30237

Description

Wanted

Activity

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 6, 2026

Unblock · 2026-11-06T00:27Z · Blocked-by: #30235 closed

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

席位核对 · Amendment · 2026-11-06T00:39Z · claim 6673233448

objectstack-fleet commented on Nov 6, 2026

35 remaining items

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

objectstack-fleet commented on Nov 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Unblock · 2026-11-06T00:27Z · `Blocked-by: #30235` closed