docs(adr): the recycle bin — a separate store, restore under original ids, retention in days (#3146 slice 1)

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Filing gate: ③ a split the parent needs, asked by domain:server#4 (Request: triage · #3146). ⛔ Not a claim.

Part of #3146 · Ruling-ref: 6629858351 (the recycle-bin shape, maintainer 「同意，企业版功能在 cloud 中立卡后续开发」)

Wanted

An ADR, or an ADR-0049 amendment, for the new recycle-bin surface #3146 rules. It names the readers that will exist, because enable.trash, softDelete, allowRestore and allowPurge were removed in 16.0 under ADR-0049 when nothing read them. The new keys are new, not the tombstoned ones.

It records the ruled shape:

a separate recycle-bin store, one entry per delete operation, with the cascade set snapshotted;
restore under the original ids, and the refusals (unique taken, parent purged, package uninstalled);
retention in days (default 30, OS_RECYCLE_BIN_RETENTION_DAYS) through a host resolver hook. The framework knows days, never plans (ADR-0012).

The v1 scope is the parent's.

Order: first. The spec slice (#3146 slice 2) cites this ADR.

Generated by Claude Code

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Claim: PM loop round 15 (p1)
Session: session_01WGufzfgvGexKn9vLHsy89K
Account: os-support-ai
Branch: the card thread's own claude/project-thread-* branch, named in the dev's hand-back and restated in a later claim (a measured platform exception to claude/issue-30234-…)
Worktree: objectstack-issue-30234
Domain: domain:skills, run by domain:spec#3 by the coordinator's work split: the skills lane is off duty (since 2026-11-04), and this card blocks the p1 spec card #30235. Labels stay as filed.
Seat: domain:spec#3
File surface: one new ADR under docs/adr/ (the next free number, measured against main and open ADR PRs), one dated amendment note on the **Status**: line of docs/adr/0049-no-unenforced-security-properties.md, and the ADR index if it is hand-kept. ⛔ No code, schema or generated artifact.
Container & model: M, mode:thread, model: CONTRACT_REVIEW_TIER (Model tier — MANDATORY: claude-fable-5-1 (derived from the file surface, not recalled), dispatch-gates --tier on docs/adr/**), effort: xhigh
Clause-②: no (docs only, an ADR; the protocol addition rides #30235)
Metadata-protocol: none
Responsibility: no ADR records the recycle-bin shape ruled on #3146, and ADR-0049 removed the old trash keys for having no reader | the spec, engine and UI children of #3146 have nothing to cite | every child of #3146, starting with the p1 spec card #30235, which is blocked by this card
Thread-read: none
Premise: holds. At origin/main, no ADR under docs/adr/ names a recycle bin (ADR-0045's "trash-can" is the unpublished-build discard, a different surface), and ADR-0049 lists allowRestore / allowPurge among the unenforced lifecycle properties it removes; the card and the ruling record enable.trash and softDelete as removed in 16.0 under it.
Parent read: #3146 through triage 6648418282.
Human floor: the maintainer's ruling 6629858351 on #3146 (「同意，企业版功能在 cloud 中立卡后续开发」): a separate store with one entry per delete, restore under the original ids with refusals, retention in days through a host hook, and the enterprise layer in cloud.
Serial constraints cleared: open ADR PR #29866 may hold the next number; the dev measures the free number against it.

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Claim: PM loop round 15 (p1), restated with the branch
Session: session_01WGufzfgvGexKn9vLHsy89K
Account: os-support-ai
Branch: claude/project-thread-cxrsk5 (the card thread's harness-pinned branch, off main at bb86ff96; dev session session_01WGufzfC3wLXmeCXwxa963a)
Worktree: objectstack-issue-30234
Domain: domain:skills, run by domain:spec#3 by the coordinator's work split: the skills lane is off duty (since 2026-11-04), and this card blocks the p1 spec card #30235. Labels stay as filed.
Seat: domain:spec#3
File surface: one new ADR under docs/adr/ (the next free number, measured against main and open ADR PRs), one dated amendment note on the **Status**: line of docs/adr/0049-no-unenforced-security-properties.md, and the ADR index if it is hand-kept. ⛔ No code, schema or generated artifact.
Container & model: M, mode:thread, model: CONTRACT_REVIEW_TIER (Model tier — MANDATORY: claude-fable-5-1 (derived from the file surface, not recalled), dispatch-gates --tier on docs/adr/**), effort: xhigh
Clause-②: no (docs only, an ADR; the protocol addition rides #30235)
Metadata-protocol: none
Responsibility: no ADR records the recycle-bin shape ruled on #3146, and ADR-0049 removed the old trash keys for having no reader | the spec, engine and UI children of #3146 have nothing to cite | every child of #3146, starting with the p1 spec card #30235, which is blocked by this card
Thread-read: 6649112172
Premise: holds. At origin/main, no ADR under docs/adr/ names a recycle bin (ADR-0045's "trash-can" is the unpublished-build discard, a different surface), and ADR-0049 lists allowRestore / allowPurge among the unenforced lifecycle properties it removes; the card and the ruling record enable.trash and softDelete as removed in 16.0 under it.
Parent read: #3146 through triage 6648418282.
Human floor: the maintainer's ruling 6629858351 on #3146 (「同意，企业版功能在 cloud 中立卡后续开发」): a separate store with one entry per delete, restore under the original ids with refusals, retention in days through a host hook, and the enterprise layer in cloud.
Serial constraints cleared: open ADR PR #29866 may hold the next number; the dev measures the free number against it.

domain:spec#3 · os-support-ai · session_01WGufzfC3wLXmeCXwxa963a
os-dev-report

Stamp: 2026-11-05T04:09Z

{
  "issue": 30234,
  "status": "done",
  "branch": "claude/project-thread-cxrsk5",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30263",
  "session": "session_01WGufzfC3wLXmeCXwxa963a",
  "premise_still_valid": true,
  "summary": "New docs/adr/0148-recycle-bin-separate-store-restore-under-original-ids-retention-in-days.md records ruling 6629858351 on #3146 in its own terms: D1 a separate sys_recycle_bin store with one entry per delete operation and the cascade set snapshotted, the delete staying physical and every read path untouched, chosen over an IsDeleted column for the ruling's reasons; D2 restore under the original ids with created_by and created_at kept, its own restored event, three named refusals, lookup re-link only when unchanged, no lone restore of a cascaded child, person-restores-own and admin-sees-all; D3 retention in days, default 30, OS_RECYCLE_BIN_RETENTION_DAYS, through a host resolver hook on the resolveFeatures pattern, TTL purge on the LifecycleService, cloud per-plan and the enterprise layer out; D4 the v1 scope, forward-only, later items and privacy rules; D5 a surface-to-reader-to-card table (#30235 / #30237 / #30239 / the cloud card) and the statement that enable.trash, softDelete, allowRestore and allowPurge stay tombstoned; D6 what is left to the cards. ADR-0049 gains one dated note at the end of its Status line, decision text unchanged; docs/adr/README.md regenerated by scripts/adr-index.mjs. Head b28128a5, one commit, 3 files, +373 / -4. Next free number measured as 0148 against main (ends at 0147) and the docs/adr tree of all 34 open PR heads (none adds a record). The 'days, never plans (ADR-0012)' principle is stated by no ADR in this registry; it lives in the resolveFeatures seam docblock of packages/cloud-connection/src/runtime-config-plugin.ts, which cites cloud ADR-0012, and the record says so and cites it that way.",
  "tests": "n/a — docs only; no package moved and no test is owed. The three ADR gates ran first on the committed head: check-adr-links 991 destinations resolve; adr-index --report OK, 149 records, self-test 46 assertions; check-adr-symbol-anchors 3126 anchors across 150 records resolve. check-prior-rulings --card 30234 --terms recycle bin,softDelete,trash,retention: 3 ADR hits (ADR-0006 D1, ADR-0045 Decision §6, ADR-0131 D1), thread none; none rules on the recycle bin. check-changeset-no-major offline on the PR body and the skip-changeset label: exit 0, both declaration lines read.",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack derived 21 commands from the 3-path change set vs merge base bb86ff96c; all 21 run serially at head b28128a5, every exit code 0 captured before any pipe (check-adr-links and its self-test, check-closing-keyword-parity and its self-test, check-comment-mask-corpus, plan-test-core-shards self-test, lint check:doc-formula-expressions after its formula+lint prerequisite build under os-verify-lock, check:adr-anchors, check:adr-index, check:adr-symbol-anchors, check:ci-filter-parity, check:closed-ceremony-text, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:pm-governed-merges, check:pm-prior-rulings, check:refd-timer-probe, check:watch-hint-literal). --ran reconciliation: 21 derived, 21 run, 0 NOT-MEASURED, 0 UNRUN. The PR's own check-runs: in_progress at report time, not re-run locally; pnpm lint is CI's run.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "18 — all reads, no write tool: issue_read get and get_comments on #30234 and #3146, issue_read get on #30235, #30237, #30239, list_pull_requests open, pull_request_read get_files #29866, get_file_contents docs/adr on 9 open PR heads (the other 25 heads were read with git fetch --depth=1 refs/pull/N/head and ls-tree, then the temporary refs deleted), pull_request_read get #30263 after the relay opened it.",
  "api_writes": "0 — none. Writes: git push (not a REST write), relay pr_create (draft, labels skip-changeset, no assignees, no reviewers; read-back identical, 14034 bytes, run 41965817566), and this comment through post-stamped.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: none · carrier: none · noted in the PR's Acceptance notes: #3146's body cites docs/audits/2026-06-objectschema-property-liveness.md, which is not on main; the ADR cites the audit by card #1878 and the docs/audits/ directory. A dead citation in an issue body is not one of the three carded classes.",
    "class: none · carrier: none · noted: the card and the ruling date all four removed keys to 16.0; the spec's tombstones date allowRestore / allowPurge to #12497 (spec 17 per the tombstone text, protocol 18 per the conversion entry). The record reads the tombstones. Dedupe words: allowRestore, allowPurge, 12497, tombstone.",
    "carrier: #30235 and #30237 · noted (Skills-docs line): skills/objectstack-api/SKILL.md teaches that the trash surface is retired and that there is no recycle bin; both stay true until the engine slice ships, so the rewrite rides those cards."
  ],
  "deviations": [
    "Commit trailer: the harness asked for a model-named Co-Authored-By line; the commit carries the repository's model-free pair (Co-authored-by: Claude plus Claude-Session), which the pre-push hook requires. Reported, not amended.",
    "Harness post-create step (assign the requester, request their review) skipped on purpose per .claude/agents/os-dev.md rule 2: pr_create went out with no assignees and no reviewers; the seat sets them at hand-over.",
    "The harness's PR-subscription posture (subscribe and drive the PR) is not taken: per os-dev.md the dispatch contract wins; the PR's CI is reported as in_progress and the seat reads its check-runs. Gates that go red after this report come back as a patch round on the same claim.",
    "The branch is the harness-pinned card-thread branch claude/project-thread-cxrsk5 (the measured platform exception the claim names), not claude/issue-30234-slug."
  ]
}

domain:spec#3 · os-support-ai · session_01WGufzfgvGexKn9vLHsy89K

Accepted: PR #30263 (ADR-0148, the recycle bin), head 0d59704e. The ACCEPT is 6650188220. The contract reviews are 6649543275 (FAIL, text only), 6649866889 (PASS) and the seat's read of the last delta, all on the PR. docs/adr/** is Tier H, so the maintainer merges it by hand. #30235 unblocks when it merges.

Navigation Menu

Repository navigation

docs(adr): the recycle bin — a separate store, restore under original ids, retention in days (#3146 slice 1) #30234

Wanted

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(adr): the recycle bin — a separate store, restore under original ids, retention in days (#3146 slice 1) #30234

Description

Wanted

Activity

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

objectstack-fleet commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions