finding(objectql): with `retention` + `ttl` + `archive` all declared, only the ttl cutoff bounds the hot store

[os-elon]

Recorded while implementing #10347 and deliberately left undecided by that diff, which says so in a comment at the site.

The shape

LifecycleSchema accepts all three together: retention and ttl are both bounding policies, and the archive.after === retention.maxAge refine is satisfied when the two match. For example:

{
 class: 'audit',
 retention: { maxAge: '90d' },
 ttl: { field: 'expires_at', expireAfter: '30d' },
 archive: { after: '90d', to: 'datalake' },
}

reapObject short-circuits into archiveObject for any object declaring archive, so the Archiver's candidate read is the only selection that happens.

• Before finding(objectql): a lifecycle declaring both ttl and archive parses, but the ttl policy is silently inert — reapObject returns into archiveObject before the ttl reap runs #10347: the read was created_at < now - archive.after, so the age bound (== retention.maxAge) was enforced and the declared ttl did nothing.
• After finding(objectql): a lifecycle declaring both ttl and archive parses, but the ttl policy is silently inert — reapObject returns into archiveObject before the ttl reap runs #10347: the read is expires_at < now - ttl.expireAfter, so the declared ttl is enforced and the age bound no longer separately bounds the hot store. A row whose expires_at is far in the future stays hot past retention.maxAge.

So the count of inert keys on this triple is unchanged at one — which one is inert has swapped. #10347's ruling was about the pair ttl + archive and is silent on the triple; the fix implements exactly the ruled option rather than inventing semantics for a shape nobody in this repo declares (censused: sys_audit_log and sys_metadata_audit are the only archive-declaring objects and both are retention + archive, no ttl).

The dispositions, for triage

1. Union the two windows — a row is due when either the age bound or the ttl cutoff says so, which is exactly how the Reaper treats two declared policies on a non-archive object (both reaps run, effects union). It costs an $or in the Archiver's candidate read, issued at a driver's find rather than through the engine, and makes LifecycleSweepEntry.cutoff ambiguous (two cutoffs, one field).
2. Refuse the triple at parse time, or require ttl.expireAfter to line up with archive.after the way retention.maxAge must. This narrows the acceptance face (Clause ②) and lives in packages/spec.
3. Leave it, on the ground that nothing declares the triple and an author who writes both bounds beside archive most likely means the per-row one. Then say so where an author can read it — the archive.after doc currently promises "rows older than this are copied to the archive datasource before hot deletion", with no hint that a sibling ttl displaces it.

No measured business pull behind any of them: zero objects in this repo, in examples/, or in the docs declare the triple. Filed so the choice is made deliberately rather than inherited from whichever branch ran last.

[os-zhuang]

Triage: lands in packages/spec (object.zod.ts lifecycle refines) → domain:spec, pm:queue, type Bug.

Direction, inherited rather than re-decided (sibling-ruling inheritance: a silently dropped declaration folds into the existing loud-refusal family — the archive.after === retention.maxAge refine is the in-file precedent for exactly this shape): disposition 2 — refuse the retention + ttl + archive triple at parse time unless the bounds are consistent (mirror the existing alignment refine), with a named, accurate rejection message. Grounds: zero declarers anywhere (repo, examples, docs — censused in the card), so union semantics (disposition 1) would be a capability nobody pulls for, and disposition 3 leaves a silently inert declared bound — the class this repo's enforce-or-remove posture exists to remove. If the implementing seat finds real semantic pull for union-of-windows, stop and report a fork rather than implementing either — the inheritance claim is a mechanism assumption, not a ruling on union semantics.

⚠️ Clause-② applies: this narrows the acceptance face. Clause-②: yes in the claim; contract-review tier per dispatch rules. Serial: same file/area as #10526 (message text) — fold into one dispatch or hard-serialize, dispatching seat's call (fold candidate: both edit the same refine block; five-gate check at claim time).

Size/model suggestion: S–M, contract-review tier per Clause-②.

---

Generated by Claude Code

[os-elon]

Claim: PM loop round 1 (slot reuse after #10510 collection)
Session: session_01B4h3medzvhB9rpfoja9jcw
Branch: claude/issue-10527-lifecycle-triple-refuse
Worktree: objectstack-issue-10527
Domain: domain:spec
File surface: packages/spec/src/data/object.zod.ts (lifecycle refine block + co-located tests) and .changeset/ (stop on breach; explain in the report)
Container & model: S–M, mode:subagent, model: claude-fable-5 — Clause-② mandate from card content (disposition 2 narrows the acceptance face); dispatch-gates run at claim time reports no path-derived mandate, clause-② suspect surface packages/spec/src/**
Clause-②: yes
Serial constraints cleared: fold-or-serial vs #10526 answered explicitly — five-gate check FAILS gate ① (this card adds a parse-time refusal / acceptance-face change; #10526 is a text-accuracy fix on the adjacent refine's message — not the same defect form or fix), so hard serial: this card goes first, #10526 dispatches only after this lands and must re-derive its wording against the merged result. In-flight overlap: batch-mates #10485 (stack.zod.ts/theme.zod.ts/metadata plugin) and #10492 (ui/i18n.zod.ts) are file-disjoint from data/object.zod.ts. Registry-race clause: #10485 (in flight) writes the ADR-0087 registry; if this card's change turns out to require an ADR-0087 registry entry, the dev must pause and report rather than race that write. H17 trigger-file index: no hit for data/object.zod.ts.

---

Generated by Claude Code