feat(objectql,platform-objects): keep a by-id delete's rows in the recycle bin (ADR-0148) - #30780

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/cli, @objectstack/objectql, @objectstack/platform-objects, @objectstack/spec, touching 60 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/objectql/src/index.ts, packages/platform-objects/src/system/index.ts, packages/spec/src/data/recycle-bin.zod.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

61 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 1371b9d87a798f86fa1217de30dc1072acfec11a.

⛔ 16 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a666eedd24dc42521cac4a7f30af913592e9f185 && git checkout a666eedd24dc42521cac4a7f30af913592e9f185
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1371b9d87a798f86fa1217de30dc1072acfec11a 819b02f707dd76ef25254db10092706dd7b8f772 && git checkout -B drift-repro 1371b9d87a798f86fa1217de30dc1072acfec11a && git merge --no-ff 819b02f707dd76ef25254db10092706dd7b8f772

node scripts/docs-audit/affected-docs.mjs --json 1371b9d87a798f86fa1217de30dc1072acfec11a

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 1371b9d87a798f86fa1217de30dc1072acfec11a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 819b02f707dd76ef25254db10092706dd7b8f772
Local-runs: none
Scope: packages/spec/src/data/recycle-bin.zod.ts, packages/spec/src/system/constants/platform-object-names.ts + packages/platform-objects/src/system/sys-recycle-bin.object.ts, packages/platform-objects/src/system/index.ts, packages/platform-objects/src/plugin.ts, packages/platform-objects/src/plugin.test.ts, packages/objectql/src/recycle-bin/capture.ts, packages/objectql/src/recycle-bin/capture.test.ts, packages/objectql/src/recycle-bin/retention.ts, packages/objectql/src/recycle-bin/retention.test.ts, packages/objectql/src/engine.ts, packages/objectql/src/engine-cascade-planning.ts, packages/objectql/src/engine-top-level.ts, packages/objectql/src/plugin.ts, packages/objectql/src/index.ts, packages/objectql/src/federated-injected-column-readers.test.ts, packages/cli/src/utils/organization-ownership-inventory.ts, scripts/platform-object-tenancy-census.json, scripts/adr-anchors/packages__objectql__src__recycle-bin__capture.ts.json, .changeset/30237-recycle-bin-snapshot-on-delete.md (widened to the whole non-prose diff; the cited code on main — engine-driver-options.ts buildDriverOptions, engine-cascade-planning.ts planCascadeAtomicity / walkReferencingRelations / isTenantColumnSetNull / outlivesOrganization / refuseOrganizationDeleteWhileOwned / organizationOwnedRowCounts, declared-read-columns.ts, engine-secret-internal-fields.ts, lifecycle/lifecycle-service.ts reap / batchedReap / effectiveWindowMs, lifecycle/duration.ts, plugin-audit audit-writers.ts SKIP_OBJECTS / writeAudit, spec/data/field.zod.ts Field, scripts/check-keyed-text-bounds.mjs, scripts/check-changeset-no-major.mjs, scripts/pm/clause2-line.mjs, platform-objects/scripts/i18n-extract.config.ts, .changeset/config.json, docs/adr/0057 §3.3 as #30751's record cites it — was read, not reviewed)

Governing text: card #30237 body; unblock 6673225435; claim 6673233448 and its amendment 6673429400 (Q1, Q2, Q4, Q6 seat rulings, PR 1 file surface); the seat's plan plan-30237.md (PR 1 section, Q4/Q6, "no lost snapshot is silent"); spec#3 hand-over 6665087359 and consent 6673450505 on #30658 (hunks (a) and (b), terms); dev report 6675407579; ADR-0148 D1–D4; the PR body. Read-only shape held: git diff origin/main...head, files via git show, the card and every comment, the head's commits and check-runs through the API. PR user.login is objectstack-fleet[bot]; the PR is a draft; no auto-merge armed. Head verified: git fetch origin claude/project-thread-jf62r6 answers 819b02f7, five commits on main including one merge of main at 0a8d24ac.

Check-runs on this head (API, at review time): 61 runs, 36 success, 9 skipped, 16 still running, 0 red. Green: Check Changeset, Governed Surface Queue Guard, PR-body guards, Spec property liveness, Plan Test Core shards, Dogfood Regression Gate, Auto Label, Check PR Size, Flag docs, Lint & Repo Gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · repo & tooling gates (the census checks), Lint · CI release & engine gates, Lint · docs & code guards, Lint · scoped (three), Type Check · source gates, Type Check · debt ledger, Type Check · consumer gates, Build Core, Build UI Deps, Build & E2E UI, Live E2E UI, Test Core 5/8, 6/8 and 8/8, Test UI 5, 7, 10, 11, 12, 14 and 16. Running: Test Core 1/8, 2/8, 3/8, 4/8 and 7/8, Type Check · workspace, Type Check UI, Test UI 1, 2, 3, 4, 6, 8, 9, 13 and 15. Running CI does not decide this record; what follows does, and neither must-fix below is one a green shard would contradict — no test in the tree reaps a bin entry under plugin-audit or sweeps a lifecycle-declaring business object.

The two packages/spec hunks against the consent.

1. Hunk (a), platform-object-names.ts (+1): 'sys_recycle_bin' under PLATFORM_OBJECTS_BY_PACKAGE['platform-objects'], between 'sys_platform_setting_audit' and 'sys_scim_connection_binding': sorted position, one line. Same-commit term, verified on the commit API, not the body: d374cbe5 holds the roster line, the object file, system/index.ts, plugin.ts and the ownership-inventory row (18 files). The census row is not in it: scripts/platform-object-tenancy-census.json moves only in 819b02f7, three commits later, after check:platform-object-tenancy-census reported the drift in the dev's first gate round. Four of the consent's five travel together; the census row trails. Cost: d374cbe5, 5c253f2a and 136ad85d are not bisect-clean for that gate; all five commits merge together, and a squash makes it moot. The purpose of the term — the roster never names a table that does not exist — holds at every commit, since the object file precedes or accompanies the line. Judged acceptable, named here as the consent asks; the PR body's sentence "in the same commit as the object file, its registration, the census row and the inventory row" is not what the commit API shows (should-fix, prose).
2. Hunk (b), data/recycle-bin.zod.ts (+4 −4, the four // lines at :14-17 and nothing else). Present tense: it names the file (sys-recycle-bin.object.ts in @objectstack/platform-objects), that PlatformObjectsPlugin registers it and PLATFORM_OBJECTS_BY_PACKAGE lists it, and keeps the registry sentence in a respelled form ("that registry means "a table exists", and the name sits there because the table does"). The module header at :8-9 ("Nothing in this module writes or reads the bin at runtime") is byte-identical to main. Every .describe(), TSDoc block, shape and export is diff context; RECORD_RESTORED_EVENT's "NAMED, NOT YET EMITTED" and the cleared-reference should-fix sentence stay for PR 3, as consented. Nothing under packages/spec/generated, packages/spec/scripts or scripts/ renders a // comment, so there was nothing to regenerate. Holds.
3. Nothing else under packages/spec: the diff's file list has exactly those two paths there.
4. Terms: Clause-②: yes (widening), Metadata-protocol: added, a @objectstack/spec: minor changeset whose Skills-docs: line names skills/objectstack-api/SKILL.md :268, :417 as owed, not moved; skills/** untouched. Met.

① Derived judgments

1. Roster (the schema face) widens. PLATFORM_PROVIDED_OBJECT_NAMES / isPlatformProvidedObjectName answer true for one more real object; nothing accepted before is refused. platform-object-names.test.ts on main holds the roster to the declared *.object.ts set both ways, and the declaration is in this PR. Right: widening, as declared.
2. The object mirrors RECYCLE_BIN_ENTRY_FIELDS through builders, and the pin holds field for field. Field.text(config) is { type: 'text', ...config } and Field.lookup(reference, config) is { type: 'lookup', reference, ...config } (field.zod.ts :3461, :3558), so re-passing a built field through its own builder reproduces it key for key: the spread already carries the type (and reference: 'sys_user') the builder prefixes, with the same value. maxLength: 255 on object_name and record_id restates the spec's own 255 on both, so the restatement adds no key and changes no value. The pin runs both sides through ObjectSchema.create and toEquals fields minus organization_id; toEqual overlooks only undefined-valued keys, which neither side carries, and the dev's ablation (254) reds it. The tenant column is asserted separately (lookup, sys_organization, cascade) and name equals RECYCLE_BIN_OBJECT. Holds.
3. Posture and tenancy, as ruled. isSystem: true, managedBy: 'engine-owned', access: { default: 'private' }, enable.apiEnabled: false, apiMethods: [], trackHistory: false, searchable: false; nameField: 'record_id'; indexes on (object_name, record_id), purge_after, deleted_by; lifecycle: { class: 'transient', ttl: { field: 'purge_after', expireAfter: '0h' } }. organization_id is an authored lookup to sys_organization, required: false, readonly: true, deleteBehavior: 'cascade' — the idiom sys_member, sys_invitation and sys_business_unit use. Census: reach: in, tenantField: organization_id, registered 93 → 94, in reach 47 → 48, out of reach unchanged. Inventory: fate: 'attribution', PMAIN, no anchors, the row shape of sys_exchange_rate above it. Q4 in the code on main: refuseOrganizationDeleteWhileOwned and organizationOwnedRowCounts skip outlivesOrganization (engine-owned) rows, so the entries are never counted against an organization delete; the walk reads the column through cascadeRelationBehavior as cascade, isTenantColumnSetNull is false for an authored cascade and keepsOrganizationReference applies only to set_null, so the organization's delete cascades into its entries through nested by-id deletes, each of a sys_ object, so none writes an entry of its own. Right — and unpinned: no test in the PR deletes an organization with entries (should-fix, a pin).
4. Where the capture runs, and its unit of work. Inside runByIdDelete: open before the cascade (a retention defect throws here, before any write — pinned, rows and children intact); onCollected after collectCascadeDeleteSet and refuseRestrictsInsideOwnCascade, before walkReferencingRelations; write() after the walk and before driver.delete(root); compensate() when the root removal throws. buildDriverOptions attaches the explicit or ambient transaction only when transactionCoversDriverFor(object, tx) (the ambient 事务句柄跨数据源泄漏:凡在事务中执行的被审计写入,合规审计行全部静默丢失(#5226 的真实根因) #5351 same-origin gate), so the capture's covered is true exactly when the bin's driver owns the handle; a bin on a datasource the transaction does not cover gets no handle and takes the compensation path, which is the right direction. Pinned: the entry carries the same handle as the root delete; a failed root removal rolls the entry back with the transaction; without one the entry is written and then removed (['create', 'delete']). Right.
5. Failure direction against the plan ("the entry write and the delete still form one unit or the entry is compensated — no lost snapshot is silent"). A bin write that throws refuses the delete: in the atomic plan the transaction rolls the children back; in the none plan nothing references the object, so nothing was written before it; in the split plan (a cross-datasource cascade) the children are already gone when write() throws and the root stays, which is the pre-existing split posture (warnCascadeNotAtomic) with one more failure point in the same window. The never-collected path logs at error and lets the delete through (an engine defect, loud, as the plan asks). Holds, with the split note. The PR body's 「回收站表写失败时整个删除会被拒（不丢快照）」 is exact for atomic and none.
6. Snapshot content. cascadeMembersInOrder is the root, then breadth-first along cascadeEdges (a master before its details), then any member no edge reached; recycleBinTakesObject drops sys_* members; declaredColumnSet keeps declared plus provisioned columns; deletedSecretColumns is collectSecretFields, so secret columns are left out (D4); undeclared columns are dropped (pinned). clearedReferences is assigned in onCollected and pushed after the update in the set_null branch, after both arities, with value: String(id); a nested delete of the same cascade walks with the inherited set, so its clears land on the root's list. Right.
7. Attribution. deleted_by is context.userId, else context.attributedUserId — the audit ledger's own precedence (sess.userId ?? provenance.attributedUserId), pinned for both. organization_id is the root row's tenant column, else context.tenantId; the READERS row (row-value) says so. The inventory comment's "a NULL row has no producer" is not exact — a system-context delete of an object whose tenancy is disabled writes NULL — but fate: 'attribution' tolerates it (prose nit). Right.
8. Retention. Resolver, then OS_RECYCLE_BIN_RETENTION_DAYS, then 30; both schemas and the refusal text are the spec's; the resolver's undefined falls through, its defect throws with 'resolver', the variable's with 'env'; purge_after is deleted_at plus whole days (26 cases). ObjectQLPlugin.init() reads the variable once, so a bad value stops the boot — stricter than the plan's "refused" and what the body declares; it also runs in a composition without the bin (nit). Right.
9. The TTL sweep. '0h' parses (LIFECYCLE_DURATION_REGEX is ^(\d+)(h|d|w|y)$) to a zero window, so the cutoff is now and the selector is purge_after $lt now; an override can only lengthen, because the regex admits no negative and the declared window is already zero; no floor is registered. batchedReap deletes each due row by id through engine.delete, the object is sys_, so the reap writes no entry; nothing references the bin, so its plan is none. Pinned: due reaped, undue kept, the resolver asked zero times. Right — but see item 11 for what else that by-id delete does.
10. Public surface. @objectstack/objectql gains the type RecycleBinRetentionSettings, ObjectQLPluginOptions.recycleBinRetention, ObjectQL.setRecycleBinRetention, and the optional CascadeDeleteSet.clearedReferences (the interface is not re-exported from index.ts); cascadeDeleteRelations gains a trailing optional parameter. @objectstack/platform-objects gains SysRecycleBin. All widening, covered by the minors. Right.
11. Must-fix A — the reap of a bin entry is audited, with the snapshot in the ledger. The sweep deletes each due entry by id through engine.delete, so the engine dispatches afterDelete with the pre-image bound. plugin-audit's writeAudit is registered on afterDelete with excludeObjects: AUDIT_EXCLUDED_OBJECTS, and sys_recycle_bin is in neither that list nor SKIP_OBJECTS on main; the handler's only early returns are the skip set, a missing action and a missing api.sudo (the sweep's SYSTEM_CTX gets one from buildHookApi). So every reaped entry writes one sys_audit_log row and one sys_activity row whose old_value / metadata is the whole entry, snapshot included: every declared column of the deleted rows and their cascade, internal: true columns among them, which the ledger omits on the business row's own delete ([security] The compliance ledger stores a JWT signing-key row's key material in its create snapshot, and an admin is served it through the ledger's by-id door while the key object itself declares no API door #21197) and which the bin's own schema gives the ledger no reason to mask. The same handler fires on afterUpdate when a user's delete set_nulls deleted_by, and N times on an organization delete that cascades into N entries. Against: ADR-0057 §3.3's hard rule (the LifecycleService's own deletes are not audited or activity-logged, or cleanup re-feeds the tables it drains); the lifecycle header's own population invariant ("every lifecycle-declaring platform object is in the audit writer's SKIP_OBJECTS … and sys_file"); the object docblock's own claim ("no insert hook, audit mirror or activity row fires for the bookkeeping of a delete the audit already records"); ADR-0148 D4 (the snapshot is read only under the live object's FLS); and the sys_lifecycle_state lesson on feat(objectql): the lifecycle sweep keeps a last-swept watermark in sys_lifecycle_state, so a reboot skips a sweep the interval has not come due for #30751 (ruling 6663872259), where the generic writer picked up an engine-owned row the same way. The capture itself is clean: the entry is written raw, so the insert fires nothing. Minimal fix: one 'sys_recycle_bin' entry in SKIP_OBJECTS (group 2, beside sys_job_queue / sys_upload_session, with its reason), a pin in audit-writers.test.ts of feat(objectql): the lifecycle sweep keeps a last-swept watermark in sys_lifecycle_state, so a reboot skips a sweep the interval has not come due for #30751's shape (a delete and an update of a sys_recycle_bin row write no ledger row, a business delete still does), '@objectstack/plugin-audit': minor and one sentence in the changeset. The derived consequences are feat(objectql): the lifecycle sweep keeps a last-swept watermark in sys_lifecycle_state, so a reboot skips a sweep the interval has not come due for #30751's and are right for an object with no data API: read-audit.ts refuses a read-audit opt-in naming it, parent-record-read-gate.ts drops it from the enumerated parents. Whether a purge (PR 2, a human act) is audited is then an event-specific writer's question — ③.6.
12. Must-fix B — a lifecycle reap of an object outside sys_ enters the bin. batchedReap issues engine.delete(object, { where: { id: row.id }, multi: true, context: SYSTEM_CTX }) per confirmed row, and the engine's ladder is keyed on the id (isByIdDelete = Boolean(id), beforeUpdate hook 在 multi:true 批量更新上拿不到 ctx.previous —— sys_fetch_previous_update 依赖 input.id;引擎已为校验取 priorRows 却不喂 hook(17.0.0-rc.2) #5574; not on options.multi, A compare-and-set where on a by-id update is silently inert — the extra predicate keys never reach the driver, and SqlHttpOutbox.redeliver's status guard is one of them #11009), so a reap is a by-id delete; openRecycleBinCapture sees only the object's name, so a lifecycle-declared object whose name is outside sys_ writes one entry per reaped row, stamped for 30 days, to be reaped again from the bin (and audited, item 11). Against: seat ruling Q6 in 6673429400 ("lifecycle reaps … do not create entries"), the plan, and the PR body and changeset ("a delete by predicate (multi: true), which includes the lifecycle sweep" does not enter the bin) — the release note declares a behaviour the code does not have. Reach today: every lifecycle-declaring *.object.ts in this tree, in hotcrm, in examples/ and in the templates is sys_ (17 files), so it is latent here; it is reached by any application or cloud_* object that declares lifecycle (ADR-0057's public authoring surface) and by the ai_traces telemetry object the audit writer already names. Minimal fix: in runByIdDelete, do not open the capture when the delete's own options.multi === true (the body's definition of a predicate delete), or hand openRecycleBinCapture that flag; one pin, a LifecycleService.sweep() over a lifecycle-declaring business object leaves the bin empty. The changeset sentence then becomes true as written.

② Semver level

• Changeset .changeset/30237-recycle-bin-snapshot-on-delete.md: minor for @objectstack/objectql, @objectstack/platform-objects, @objectstack/spec, @objectstack/cli; no major (check-changeset-no-major.mjs, pre-GA). Level axis (ruling A as clause2-line.mjs states it): Metadata-protocol: added needs at least one package whose published source moves minor or above — spec (roster) and objectql do; the minor on cli for an inventory row is admissible under added, and all four sit in the one fixed group, so the per-package level touches the CHANGELOG heading and nothing of the version. After must-fix A the changeset gains '@objectstack/plugin-audit': minor, still consistent with added. Check Changeset concluded success on this head.
• Clause-②: yes (widening) and Metadata-protocol: added are byte-identical in the PR body and the changeset, and match the claim and the consent's terms. Part of #30237 is in the body (PR 1 of 5, so no Fixes).
• Skills-docs: grammar follow-up owed — FILES is the declared one in both, naming the same file and lines; the parentheticals differ ("they teach that there is no recycle bin" in the body, "they still teach that there is no recycle bin; not moved in this release" in the changeset), so the two lines are not byte-identical. No script reads the line (clause2-line.mjs and check-changeset-no-major.mjs read only the two lines above it); the seat rewrites owed — FILES to #N at ACCEPT anyway. Should-fix, prose.

③ Boundary flags

open_questions: [] in the dev report. The declared deviation and the body's acceptance notes, each answered:

1. Builder spelling, restated bounds, literal name (check:keyed-text-bounds). The gate is a source scan by design (its header: a central pin cannot import the plugins' objects without a cycle); it refuses, rather than skips, a fields entry it cannot attribute to a column (a spread) and reads a keyed text column's maxLength only as an integer literal — and object_name / record_id are keyed by the first declared index, so their bound has to be visible in source. The spec's own bound on both is 255, so the restatement is equal by value and the plugin.test.ts pin keeps it so (the 254 ablation reds). The literal name carries its constant in a trailing comment and the pin asserts equality with RECYCLE_BIN_OBJECT. Sound; the one honest way to satisfy the gate without weakening it.
2. Census row in a later commit than the consent's same-commit term — hunk (a) above. Accepted, named.
3. File surface against amendment 6673429400. packages/objectql/src/index.ts (one type re-export) and federated-injected-column-readers.test.ts (a READERS row the resolveTenantFieldName() use trips) are not named by path; both sit inside the claim's packages/objectql/src/** and the amendment's "rows the new object trips". Noted.
4. Boot-time read of the retention variable. Stricter than the plan's "refused" at delete time, declared in the body and the changeset; it also stops a composition that registers no bin. Accepted, nit.
5. No translations bundle. platform-objects/scripts/i18n-extract.config.ts enumerates its objects by hand and does not list SysTrustedKey either, so check:i18n derives nothing for sys_recycle_bin and is green; the labels reach no list page until PR 5 / ui: the admin recycle-bin page (list, restore, empty) and the 已删除 · 撤销 toast (#3146 slice 4) #30239, which should add the object to the config and regenerate. Noted.
6. Open question, does not block (policy for the maintainer, with PR 2): once sys_recycle_bin is in SKIP_OBJECTS (must-fix A), no generic ledger row records anything done to an entry; a purge or an empty by an administrator is a human act, so if the maintainer wants it in sys_audit_log, PR 2 owes an event-specific writer (the action-invocation-audit.ts shape), not the generic one. The seat should name it when announcing PR 2.
7. Open question, does not block (seat ruling Q6, with must-fix B): Q6 reads "business object" as "a name outside sys_"; the census's own platform namespace is sys_ / cloud_ / ai_. Should recycleBinTakesObject exclude every platform prefix, so a cloud_* or ai_* row never enters a tenant's bin? One line either way; the seat decides and the release note follows.
8. PR body prose (the seat's stroke at ACCEPT, os-dev rule 1 bars a dev PATCH): the "same commit" sentence (hunk (a)); the "Skills-docs" parenthetical (②).

Author note: PR user.login is objectstack-fleet[bot]; no outside author.

④ Design judgment

1. Hunk (a) against its consumers. The roster test and the declaration land together; the inventory test is satisfied by the row; the census gate ran green in "Lint · repo & tooling gates" on this head; no generated artifact derives from the roster. Holds.
2. Hunk (b) against the tree. The object file is where the comment says, in that package; it builds fields from RECYCLE_BIN_ENTRY_FIELDS (through builders, which is still "from"); PlatformObjectsPlugin registers it; the roster lists it. The sentence the consent asked to keep still explains the order. Holds.
3. The object against ADR-0148 D1 / D3 / D4 and ruling Q4. One entry per delete operation; the deadline stamped per entry and read by the sweep without a resolver, so a later shortening never shortens a window shown; no read path filters on it; no generic data API, so the snapshot is read only by the doors PR 4 and PR 5 open under the live object's FLS; the organization cascade. Holds on the write side; item 11 is the one place the snapshot leaves the bin before those doors exist, through the generic ledger on reap — a D4 breach by the audit copy, fixed by must-fix A.
4. Pins are real. The dev's ablation of openRecycleBinCapture(...) reds 11 of 16, and the five that stay green assert absence or the BFS helper; the 254 ablation reds the field pin. Reading the suites: the driver keeps real rows and a real per-transaction snapshot, so "rolled back with the transaction" and "compensated without one" are told apart by what is in the store and the order of writes, not by a stub's say-so.
5. Tried to break it. A restrict inside the cascade: refuseRestrictsInsideOwnCascade runs before onCollected, nothing read, nothing written. A beforeDelete refusal or a permission refusal: before runByIdDelete, no capture. A resolver that throws rather than answers: propagates out of openRecycleBinCapture inside the unit, the delete is refused before any write (same direction as the pinned defect, unpinned). A delete inside a caller's explicit transaction: buildDriverOptions prefers the explicit handle, covered is true, the caller's rollback carries the entry. A driver answering no id on create: compensate logs at error with the record named, the delete's own error still wins. A root with no tenant column deleted by a user in organization A: the entry takes A from the context; by a platform administrator with no active organization: a NULL row, PR 4's listing has to say whose it is. 600 cascade members: two 500-id reads, one entry of 601 rows — no cap on an entry's size; a ten-thousand-row cascade is one JSON cell, a later card's question. The same record id deleted, re-created and deleted again: two entries under the (object_name, record_id) index, newest first. A user deleted after deleting records: deleted_by is cleared by the walk's set_null through engine.update under the referential marker — and audited, item 11. An organization deleted with entries: the cascade removes them, each a sys_ delete writing no entry — and each audited, item 11. A reap of a business object with a lifecycle block: item 12. A cloud_* row deleted by id: enters the bin — ③.7. A predicate delete with a scalar id and multi: true from a flow's delete_record: today enters the bin; after must-fix B it does not, which is what the body already says.

Should-fix (non-blocking): (a) a pin for Q4 (an organization delete removes its entries and is not refused by them); (b) the Skills-docs: parentheticals (②); (c) the PR body's "same commit" sentence (hunk (a)); (d) the inventory comment's "a NULL row has no producer"; (e) the i18n extract config entry, with PR 5 / #30239; (f) the entry-size question, a later card.

Implemented-by: claude/project-thread-jf62r6
Reviewed-by: session_016WV4cytLmJxfAmgPVjUbbW

VERDICT: FAIL

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 6a07be615a15c79843c7ec65e7e0592cb0503d1b
Local-runs: none
Scope: packages/spec/src/data/recycle-bin.zod.ts, packages/spec/src/system/constants/platform-object-names.ts + packages/platform-objects/src/system/sys-recycle-bin.object.ts, packages/platform-objects/src/system/index.ts, packages/platform-objects/src/plugin.ts, packages/platform-objects/src/plugin.test.ts, packages/objectql/src/recycle-bin/capture.ts, packages/objectql/src/recycle-bin/capture.test.ts, packages/objectql/src/recycle-bin/retention.ts, packages/objectql/src/recycle-bin/retention.test.ts, packages/objectql/src/engine.ts, packages/objectql/src/engine-cascade-planning.ts, packages/objectql/src/engine-top-level.ts, packages/objectql/src/plugin.ts, packages/objectql/src/index.ts, packages/objectql/src/federated-injected-column-readers.test.ts, packages/plugins/plugin-audit/src/audit-writers.ts, packages/plugins/plugin-audit/src/audit-writers.test.ts, packages/cli/src/utils/organization-ownership-inventory.ts, scripts/platform-object-tenancy-census.json, scripts/adr-anchors/packages__objectql__src__recycle-bin__capture.ts.json, .changeset/30237-recycle-bin-snapshot-on-delete.md (widened to the whole non-prose diff; the cited code on main — lifecycle/lifecycle-service.ts batchedReap and its per-row reap, engine.ts delete() ladder (isByIdDelete, isPredicatePath) and runByIdDelete, engine-cascade-planning.ts refuseOrganizationDeleteWhileOwned / outlivesOrganization / isTenantColumnSetNull, plugin-audit audit-writers.ts SKIP_OBJECTS / AUDIT_EXCLUDED_OBJECTS / writeAudit, read-audit.ts, spec/system/constants/platform-object-names.ts PLATFORM_OBJECT_PREFIXES / hasPlatformObjectPrefix, spec/system/index.ts and constants/index.ts (the export path), scripts/pm/clause2-line.mjs, scripts/check-changeset-no-major.mjs, docs/adr/0057 §3.3 as #30751's record cites it — was read, not reviewed)

Re-record at the new head. The prior record at 819b02f7 (PR comment 6675639559) was a FAIL with two must-fixes (A: the generic audit writer ledgers the bin's bookkeeping; B: a lifecycle reap of a non-sys_ object enters the bin) and should-fixes (a) to (f). The seat ordered the fixes in claim amendment 6675653517 on #30237, which also widened the PR 1 file surface by the two plugin-audit files and '@objectstack/plugin-audit': minor, and ruled the review's open question ③.7: a business object is a name outside every platform namespace the tenancy census uses, sys_, cloud_ and ai_. Governing text otherwise unchanged: card #30237 body; unblock 6673225435; claim 6673233448 and amendments 6673429400 and 6675653517; plan-30237.md; spec#3 hand-over 6665087359 and consent 6673450505 on #30658; dev report 6675407579; ADR-0148 D1–D4; the PR body as re-patched. Read-only shape held: git fetch origin claude/project-thread-jf62r6 main answers 6a07be61 as the head, one commit on top of 819b02f7 (git diff 819b02f7 6a07be61: 8 files, +174 −24) and six commits on main in all (git diff origin/main...6a07be61: 22 files, +1460 −20, matching the PR's changed_files 22 / 1460 / 20); files via git show; the card and every comment; the head's check-suites and check-runs through the API. PR user.login is objectstack-fleet[bot], head repo is the base repo, the PR is a draft, no auto-merge armed.

Check-runs on this head (API, read at 2026-11-06T03:52Z): check-runs answers total_count: 0; check-suites lists 5 suites (objectstack-fleet, claude, vercel, fly-io, cloudflare-workers-and-pages), every one queued with no conclusion; the combined status is pending with 0 statuses; actions/runs?head_sha= answers 0 runs. So no job has started on 6a07be61 at review time: nothing is green and nothing is red. This record does not wait on CI (the thread's own contract), and no judgment below is one a shard would contradict; the landing still needs every check green, which the owning seat reads before it queues.

Each ordered fix, verified against the diff.

1. Must-fix A, resolved. audit-writers.ts SKIP_OBJECTS gains 'sys_recycle_bin' in group 2, between sys_upload_session and ai_traces, with a twelve-line reason naming ADR-0148 D4 and ADR-0057 §3.3, the three bookkeeping writes (the reap, the set_null of deleted_by, the organization cascade), what the generic copy would carry (snapshot, internal: true columns) and where the snapshot is read instead. AUDIT_EXCLUDED_OBJECTS spreads the set, so the hook registration's excludeObjects and the in-handler SKIP_OBJECTS.has(ctx.object) early return both cover it; read-audit.ts derives from the same set, as the prior record said. audit-writers.test.ts gains a describe of three cases on the file's own makeEngine / fire harness: afterDelete of a sys_recycle_bin row under a system session writes nothing; afterUpdate clearing deleted_by under a user session writes nothing; afterDelete of crm_lead still writes ['sys_audit_log', 'sys_activity']. The harness fires registered handlers directly, so the pin exercises the in-handler set, which is the one that matters when a host registers the writer without the exclude list. The dev's ablation (the entry removed) reds 2 of 3 and keeps the business control green, which is the right split. The lifecycle header's population invariant (every lifecycle-declaring platform object is in SKIP_OBJECTS) now holds for the bin, and the object docblock's claim is restated to say which layer keeps the later writes out of the ledger.
2. Must-fix B, resolved. runByIdDelete passes options?.multi === true as a fourth argument predicate; ObjectQL.openRecycleBinCapture (private) forwards it; openRecycleBinCapture in capture.ts returns undefined on predicate || !recycleBinTakesObject(object) before any read. The sweep's per-row reap is engine.delete(object, { where: { id: row.id }, multi: true, context: SYSTEM_CTX }) (lifecycle-service.ts), the ladder keys on Boolean(id) so it arrives in runByIdDelete, and options there is the delete's own argument, so the flag is the reap's. Two pins: a by-id delete of loner with multi: true removes the row and writes no entry; a real LifecycleService (getEngine, fixed now) sweep() over ephemeral, a non-platform object declaring lifecycle: { class: 'transient', ttl: { field: 'expires_at', expireAfter: '0h' } }, reports no errors, reaps the due row, keeps the undue one and leaves the bin empty. The dev's ablation (the flag forced to false) reds exactly those two. The changeset's sentence now reads "which includes every lifecycle sweep reap, even though the sweep names each reaped row by its id", which is what the code does. Side effect, declared in the body: a flow's delete_record that passes a scalar id beside multi: true also skips the bin, which is the body's definition of a predicate delete.
3. Ruling ③.7 (prefixes), implemented. recycleBinTakesObject is !hasPlatformObjectPrefix(object), imported from @objectstack/spec/system (system/index.ts exports ./constants, which exports ./platform-object-names; objectql already imports that subpath in engine-cascade-planning.ts, so no new package edge). PLATFORM_OBJECT_PREFIXES on main is ['sys_', 'cloud_', 'ai_'], the census's population, so the capture's reach and the census's platform set are one list. Pinned with it.each(['sys_thing', 'cloud_thing', 'ai_thing']); the dev's ablation back to sys_ reds cloud_thing and ai_thing. The capture docblock, the function's TSDoc, the changeset and the body all say the three prefixes.
4. Should-fix (a), Q4 pin, resolved. sys_organization is registered in the harness; two loner rows are deleted under contexts with tenantId org_1 and org_2, giving two entries stamped from the context (loner has no tenant column); the by-id delete of org_1 resolves truthy, leaves org_2 in sys_organization, and leaves exactly the org_2 entry. That is the ruling: removed with the organization, not refused by it, the other organization's untouched.
5. Should-fix (b), resolved. The changeset's Skills-docs: line is now byte-identical to the body's (follow-up owed — skills/objectstack-api/SKILL.md :268, :417 (they teach that there is no recycle bin)).
6. Should-fix (c), resolved in the body. The spec paragraph now says the roster line shares d374cbe5 with the object file, its registration and the ownership-inventory row, and that the census row followed in 819b02f7 after its gate reported the drift, which is what the commit API shows (hunk (a) of the prior record).
7. Should-fix (d), resolved. The inventory comment names the one NULL producer: a tenancy-disabled object deleted by a context with no active organization, and says a NULL row comes only from that.
8. Should-fix (e) and (f), carried, not owed here. (e) the i18n-extract.config.ts entry rides PR 5 / ui: the admin recycle-bin page (list, restore, empty) and the 已删除 · 撤销 toast (#3146 slice 4) #30239 as the prior record said; (f) the entry-size question is a later card. Neither was ordered for this head.

The two packages/spec hunks against the consent: unchanged since 819b02f7. git diff 819b02f7 6a07be61 touches nothing under packages/spec; hunk (a) ('sys_recycle_bin' in PLATFORM_OBJECTS_BY_PACKAGE['platform-objects'], +1) and hunk (b) (the four // lines above RECYCLE_BIN_OBJECT, +4 −4, present tense, module header byte-identical to main) stand as judged in the prior record, and the diff's file list under packages/spec is exactly those two paths. Nothing to regenerate. Holds.

File surface against the claim as amended. The new commit touches .changeset/…, cli/…/organization-ownership-inventory.ts, objectql/src/engine.ts, objectql/src/recycle-bin/capture.ts and capture.test.ts, platform-objects/…/sys-recycle-bin.object.ts (docblock), plugin-audit/src/audit-writers.ts and audit-writers.test.ts: every path is inside 6673429400 (packages/objectql/src/**, the object file, the inventory row, changesets) or 6675653517 (the two plugin-audit files). The whole-PR list is the prior record's 20 paths plus those two. ui/**, skills/**, docs/adr/** and the governed register untouched. Met.

① Derived judgments

The prior record's items 1–10 stand unchanged for the code they judged (roster widening; the object mirrors RECYCLE_BIN_ENTRY_FIELDS through builders with the field pin; posture and tenancy; the capture's placement in the unit of work and its covered / compensation directions; the failure direction per plan; snapshot content and clearedReferences; attribution; retention; the '0h' TTL sweep; the public surface). What this head changes in them:

1. Reach (items 6, 9, 12 of the prior record). The bin now takes a by-id delete that is the root of its cascade, of a non-platform object, asked without multi: true. The three exclusions compose in openRecycleBinCapture in that order (flag, prefix, cascade membership) and each is pinned separately. A platform row the cascade reaches is still dropped from the snapshot by the same predicate (cascadeMembersInOrder filter), so a cloud_* detail of a business master is now left out where before only sys_* was; consistent with the ruling, and the release note says so.
2. The ledger (item 11 of the prior record). With the bin in SKIP_OBJECTS, the reap, the deleted_by clear and the organization cascade write no sys_audit_log / sys_activity row; the business delete an entry was taken for is audited as on main. D4's "read only under the live object's FLS" holds on every path the generic writer could reach. The one remaining ledger question (whether a human purge is recorded) is PR 2's, flagged below.
3. Signature change is internal. openRecycleBinCapture gains a required parameter; recycle-bin/capture.ts is not re-exported from index.ts (only the RecycleBinRetentionSettings type is) and the engine member is private, so no published surface moves for it. The public additions are the prior record's and all widening.
4. Pins are real. The sweep pin boots a real LifecycleService over a real ObjectQL and asserts the due row gone, the undue row kept and the bin empty, so a regression that re-opens the capture for reaps writes an entry the assertion sees; the multi: true pin asserts both the row's removal and the bin's emptiness; the Q4 pin asserts the surviving organization and its surviving entry, not only a count.

② Semver level

• Changeset .changeset/30237-recycle-bin-snapshot-on-delete.md: minor for @objectstack/objectql, @objectstack/platform-objects, @objectstack/spec, @objectstack/cli and now @objectstack/plugin-audit; no major (check-changeset-no-major.mjs, pre-GA). Metadata-protocol: added is unchanged: a new metadata object and the roster entry are what an author can now write, and the kind takes at least minor on every package the diff moves (Post-Task Checklist step 3), so plugin-audit: minor is the rule's own answer, not a judgment call; it is also a published behaviour change in that package (one more object the ledger never records). All five sit in the one fixed group, so the per-package level touches the CHANGELOG heading and nothing of the version. The changeset carries its one new sentence for plugin-audit, matching the amendment's order.
• Clause-②: yes (widening) re-judged: the roster answers true for one more real object; the new exclusions narrow what the bin takes relative to 819b02f7, not relative to any published contract on main, where the bin does not exist; the audit skip withholds ledger rows only for an object main has no rows of. Nothing a consumer could accept, write or read on main is refused or removed. Widening, as declared. The two lines are byte-identical in the PR body and the changeset and match the claim and the consent. Part of #30237 in the body (PR 1 of 5, no Fixes).
• Skills-docs: lines byte-identical (should-fix (b) above).

③ Boundary flags

open_questions: [] in the dev report; the body declares no new deviation. Carried from the prior record, re-read at this head:

1. Builder spelling, restated 255 bounds, literal name (check:keyed-text-bounds): unchanged, sound, pinned. Accepted.
2. Census row three commits after the roster line: unchanged; the body now says so. Accepted, named.
3. Two objectql paths not named by path in 6673429400 (index.ts, federated-injected-column-readers.test.ts): inside the claim's packages/objectql/src/**. Noted.
4. Boot-time read of OS_RECYCLE_BIN_RETENTION_DAYS in ObjectQLPlugin.init(): stricter than the plan's "refused" and declared in body and changeset; it also stops a composition that registers no bin. Accepted, nit.
5. No translations bundle for sys_recycle_bin (i18n-extract.config.ts enumerates by hand): rides PR 5 / ui: the admin recycle-bin page (list, restore, empty) and the 已删除 · 撤销 toast (#3146 slice 4) #30239. Noted.
6. For the seat to name when announcing PR 2 (does not block): with the bin in SKIP_OBJECTS, no generic ledger row records a purge or an empty by an administrator. If the maintainer wants a human purge in sys_audit_log, PR 2 owes an event-specific writer (the action-invocation-audit.ts shape); the SKIP_OBJECTS reason already says as much.
7. For the seat, a reading to confirm, not a ruling (does not block): a flow delete_record or an API caller that sends { where: { id }, multi: true } for one row now skips the bin by the caller's flag. The body states it as the definition of a predicate delete; if the seat wants the product behaviour to key on the ladder's verdict instead (so a multi: true spelling of one id still enters the bin), the lifecycle reap would then need its own marker, and that is a design change outside this PR's order. As ordered, the flag is the right discriminator.
8. CI on this head has not started (0 check-runs, 5 suites queued at review time). The landing reads every check green before the queue; this record does not.

Author note: PR user.login is objectstack-fleet[bot]; head repo is the base repo; no outside author.

④ Design judgment

1. Hunk (a) against its consumers: unchanged since the prior record; the roster test and the declaration land together; nothing generated derives from the roster. Holds.
2. Hunk (b) against the tree: unchanged; the object file is where the comment says, built from RECYCLE_BIN_ENTRY_FIELDS through builders, registered, listed. Holds.
3. The object against ADR-0148 D1 / D3 / D4 and ruling Q4, with the ledger closed. One entry per delete; the deadline stamped per entry and read by the sweep without a resolver; no generic data API; the organization cascade pinned; and now no path on which the snapshot leaves the bin before PR 4 / PR 5's doors exist, since the generic writer is the only other reader of a bin row's pre-image and it is skipped. Holds on the write side.
4. The reach against ADR-0057 §3.3 and ruling Q6 as extended. A lifecycle reap of any object, platform or business, writes no entry (the flag) and no ledger row for the bin's own reap (the skip); a declared-lifecycle business object is reaped exactly as on main. The sweep's by-id spelling (per-row reap with its own pre-image, hooks and walk, finding(objectql): LifecycleService 的无 guard reap 每次 sweep 发一条无上限 DELETE —— 首次给存量大表加 retention 时是一条长事务 #5194) is untouched, so the reap's existing guarantees stand.
5. Tried to break it at this head. A by-id delete with multi: false or no flag: enters the bin (the 16 original pins). A by-id delete with multi: true that cascades into business details: the root opens no capture, the nested child deletes are cascadeIssuedDeletes and inherit the cascade set, so no child opens one either; no partial entry. A cloud_* master with business details: no entry, and its details are deleted as on main (the ruling's cost, named in the changeset as "any platform object"). A business master with a cloud_* detail: entry written, the detail's rows left out of snapshot (prefix filter), its set_null clears still recorded on clearedReferences since that branch does not filter by prefix; a later restore re-links a platform row it never held, which is a PR 3 reading. The reap of an entry: sys_, no capture; SKIP_OBJECTS, no ledger row; afterDelete still dispatched, so a host's own hook on the bin still fires, which is right. A user deleted after deleting records: the walk's set_null on deleted_by goes through engine.update under the referential marker, no ledger row now. An organization deleted with entries in two organizations: pinned.

Should-fix (non-blocking): (e) the i18n extract config entry, with PR 5 / #30239; (f) the entry-size question, a later card; (g) ③.6 named in PR 2's announcement.

Implemented-by: claude/project-thread-jf62r6
Reviewed-by: session_016WV4cytLmJxfAmgPVjUbbW

VERDICT: PASS

Generated by Claude Code