#281 - Deleted files 3/3: purge log — record of finally-deleted files (#278) - Cordy/Cairn

Cordy commented

2026-08-19 18:44:18 +00:00

Owner

Part of epic #278.

Backend

Every final deletion (automatic retention purge, manual purge #280, and — once #268 lands — space purge) appends a purge-log record: original path, owner, size, deleted-into-trash at, purged at, purge cause (auto-retention | admin-manual | space-delete), acting admin where applicable.
Storage: append-only JSON in the state-backend (statestore pattern, same family as holds/settings), separate from the trash entries themselves so the log survives the purge it documents. Bounded growth: cap by count with oldest-first rollover (the audit log keeps the long tail; this is the trash-scoped view).
Records are also mirrored as audit events (trash-purge), so instances with audit disabled still get the purge log, and instances with audit enabled get both views consistently.

UI (mockup-first)

Deleted files → Purge log tab:

Read-only, newest-first list in the established row style: path, owner, size, purged-at, cause, actor.
Filter by user / path substring / cause; empty state explains when entries appear.
No delete/clear action on the log itself from this surface (it is the record); rollover is the only trimming.

Acceptance

Auto-purged and manually purged items both appear with correct cause and actor.
The log survives redeploys (state-backend) and outlives the purged data.
Bounded: rollover works and is documented in the tab's hint text.
Mockup proposed and signed off before implementation ships.

Part of epic #278. ## Backend - Every **final** deletion (automatic retention purge, manual purge #280, and — once #268 lands — space purge) appends a purge-log record: original path, owner, size, deleted-into-trash at, purged at, purge cause (`auto-retention` | `admin-manual` | `space-delete`), acting admin where applicable. - Storage: append-only JSON in the state-backend (statestore pattern, same family as holds/settings), separate from the trash entries themselves so the log survives the purge it documents. Bounded growth: cap by count with oldest-first rollover (the audit log keeps the long tail; this is the trash-scoped view). - Records are also mirrored as audit events (`trash-purge`), so instances with audit disabled still get the purge log, and instances with audit enabled get both views consistently. ## UI (mockup-first) **Deleted files → Purge log** tab: - Read-only, newest-first list in the established row style: path, owner, size, purged-at, cause, actor. - Filter by user / path substring / cause; empty state explains when entries appear. - No delete/clear action on the log itself from this surface (it is the record); rollover is the only trimming. ## Acceptance 1. Auto-purged and manually purged items both appear with correct cause and actor. 2. The log survives redeploys (state-backend) and outlives the purged data. 3. Bounded: rollover works and is documented in the tab's hint text. 4. Mockup proposed and signed off before implementation ships.

Cordy added this to the v0.7 — Closed beta (dogfood + hardening) milestone

2026-08-19 18:44:18 +00:00

Cordy referenced this issue

2026-08-19 19:41:39 +00:00

#280: Manual purge tab — instance-wide admin trash listing + purge, slot-leak fix (v0.6.49) #283

Cordy referenced this issue

2026-08-19 19:52:54 +00:00

Deleted files 2/3: manual purge surface in the admin topic (#278) #280

Cordy referenced this issue from a commit

2026-08-19 20:28:45 +00:00

scout: #281 audit event shape + query surface + audit pane JS

Cordy referenced this issue from a commit

2026-08-19 20:35:31 +00:00

#281: Purge log tab (patch)

Cordy referenced this issue from a commit

2026-08-19 20:35:56 +00:00

ship workflow: #281 Purge log tab (node check; also removes stale scout-281.yml ref note)

forgejo-actions referenced this issue from a commit

2026-08-19 20:36:14 +00:00

#281: Purge log tab - read-only ledger of permanent deletions from the audit log (manual + automatic)

Cordy referenced this issue

2026-08-19 20:37:24 +00:00

#281: Purge log tab — read-only ledger of permanent deletions (v0.6.51) #285

Cordy referenced this issue from a commit

2026-08-19 20:40:28 +00:00

Merge pull request '#281: Purge log tab — read-only ledger of permanent deletions (v0.6.51)' (#285) from feat/purgelog281 into main

Cordy commented

2026-08-19 20:48:33 +00:00

Author

Owner

Shipped as v0.6.51 (PR #285), live on both dogfoods. Pure frontend — the audit log already recorded both purge kinds, and the admin audit query already filters by action; the tab merges manual-purge + auto-purge queries, newest first, capped at 200.

As built (per the signed-off mockup, fidelity-diffed before shipping): flat hairline rows with mono timestamp and mono original path; red manual pill with "purged by " vs teal automatic pill with "retention sweep · owner " (the audit user field means different things for the two actions, so the label disambiguates); path-prefix filter (button + Enter); audit-source footer.

Dogfood checklist (fresh login after the roll):

#admin/trash/log shows your #280 test purges as manual rows attributed to the purging admin
path-prefix filter narrows (e.g. /spaces/Fall)
empty-filter miss shows the empty-state line, not an error

With this, the epic #278 surface is complete: Retention (v0.6.48), Manual purge (v0.6.49 + v0.6.50 polish), Purge log (v0.6.51). Automatic-sweep rows will appear once an instance runs with auto-purge enabled.

Shipped as **v0.6.51** (PR #285), live on both dogfoods. Pure frontend — the audit log already recorded both purge kinds, and the admin audit query already filters by action; the tab merges `manual-purge` + `auto-purge` queries, newest first, capped at 200. As built (per the signed-off mockup, fidelity-diffed before shipping): flat hairline rows with mono timestamp and mono original path; red **manual** pill with "purged by <admin>" vs teal **automatic** pill with "retention sweep · owner <user>" (the audit user field means different things for the two actions, so the label disambiguates); path-prefix filter (button + Enter); audit-source footer. Dogfood checklist (fresh login after the roll): - `#admin/trash/log` shows your #280 test purges as **manual** rows attributed to the purging admin - path-prefix filter narrows (e.g. `/spaces/Fall`) - empty-filter miss shows the empty-state line, not an error With this, the epic #278 surface is complete: Retention (v0.6.48), Manual purge (v0.6.49 + v0.6.50 polish), Purge log (v0.6.51). Automatic-sweep rows will appear once an instance runs with auto-purge enabled.

Cordy closed this issue

2026-08-20 05:12:28 +00:00

Rows
Columns

Deleted files 3/3: purge log — record of finally-deleted files (#278) #281

Backend

UI (mockup-first)

Acceptance