finding(objectql): lifecycle governance window overrides and retention floors never reach the Archiver

[os-elon]

Pre-existing, noticed while implementing #10347. Not touched by that diff, which keeps the Archiver's existing posture rather than inventing half a feature.

What is missing

LifecycleService.reapObject resolves every declared window through effectiveWindowMs(...) before reaping, so ADR-0057 P4 governance applies:

• a per-object settings override (maxAge / expireAfter) beats the declaration;
• an override below a registered LifecycleRetentionFloor (finding(objectql): lifecycle 的 settings 覆盖窗口没有下限校验 —— 运维把 maxAge 调到某个消费方的假设之下时,后果是静默的(以 sys_job_queue 去重窗为例) #5195) is rejected, logged at error, and recorded in report.floorViolations;
• reap() additionally resolves per-tenant windows and issues one candidate read per overriding tenant.

archiveObject does none of this. It reads archive.after — and, since #10347, ttl.expireAfter — straight from the declaration via parseLifecycleDuration. So for any object declaring archive:

• an operator's window override is silently ignored;
• a retention floor registered against that object is never evaluated, so a violation is neither reported nor logged;
• per-tenant windows do not apply.

The consequence is not a data-loss risk in the override direction (the declaration is the safer, longer window in the case that matters), but it is a silent divergence between what the lifecycle settings namespace claims to control and what it actually controls, and it is invisible: report.floorViolations stays empty for archive-declaring objects however the floors are registered.

Why #10347 did not close it

Before that card, ttl was inert on archive-declaring objects, so its expireAfter override was inert too. After it, the declared ttl executes in the Archiver while the override still does not reach it — a ttl-only object and a ttl + archive object now answer an operator override differently. That inconsistency is what surfaced this, but the gap itself predates it and covers archive.after too.

Notes for whoever takes it

• Wiring only the global override and not the per-tenant ones would be a half-feature; the per-tenant leg needs the Archiver's batch loop to run per tenant window the way reap() does, which is the real work here.
• The floor check is the cheaper half and arguably the more valuable one: it is the leg whose absence is silent rather than merely conservative.
• Objects affected today: sys_audit_log, sys_metadata_audit — the only two declaring lifecycle.archive.

[os-zhuang]

Triage: lands in packages/objectql (LifecycleService / Archiver) → domain:engine, pm:queue, type Bug — the lifecycle settings namespace and retention floors are declared to govern reaping, and the Archiver silently ignores both (declared ≠ enforced; the floor-violation leg fails silent, which is the worse half). No decision needed: the target posture is the one reapObject/reap() already implement — resolve windows through effectiveWindowMs, evaluate floors, honour per-tenant windows.

Dispatch notes: the per-tenant leg (Archiver batch loop per tenant window) is the real work — size M, not S. Serial caution: same file surface as #10347's fix (Archiver ttl cutoff, in flight at triage time) — dispatch after that PR lands and re-derive line anchors at head. Related open cards in the same area: #10527 (triple-declaration semantics, spec side), #10526 (refine message text, spec side) — file surfaces differ (objectql vs spec) but the dev should read both before touching cutoff selection.

Size/model suggestion: M, mode:subagent, opus.

---

Generated by Claude Code

[os-elon]

Claimed for dispatch

• Seat: PM dispatch (domain:engine), session session_019yDEhPBC3tcGkW9bkce1HM
• Branch: claude/issue-10528-archiver-governance-windows
• Tier: opus (triage's suggestion; not a Clause-② surface — the change lands in packages/objectql, not packages/spec/src/**)
• Labels: pm:queue → pm:dispatched

The serial constraint is cleared, verified by content

Triage set one: "same file surface as #10347's fix (Archiver ttl cutoff, in flight at triage time) — dispatch after that PR lands and re-derive line anchors at head."

Verified by content rather than by #10347's label or by any sha the card names: git merge-base --is-ancestor 530c1df65 origin/main → yes, 530c1df653 fix(objectql): the Archiver honours a declared ttl instead of archiving by created_at age alone (#10541). Anchors below are re-derived at origin/main = 5886ee6d22, which is also the base the merge queue is currently testing #10633 on.

Anchors at 5886ee6d22 (re-derive at your own head before trusting them)

packages/objectql/src/lifecycle/lifecycle-service.ts:

what	line
archiveObject — the subject	:1144
its window resolution — dueField / dueWindow / cutoff	:1208 / :1209 / :1210
the candidate read it drives	:1227
cold-side keep prune (archive.keep)	:1282
effectiveWindowMs — the governance resolver, private	:1037
its four existing call sites	:931, :996, :1011, :1351
registerRetentionFloor (#5195)	:535
floor violation recorded into the report	:1108–:1111
report.floorViolations — declared / initialised / summarised	:283 / :583 / :687
governance.tenantOverrides — shape / populated / cap	:173 / :755–:787 / :188
reap()'s per-tenant leg — the shape to mirror	:1302, :1343, :1346–:1348, :1351

Read this before you start — the structural cause, which the card does not name

The gap is not "someone forgot to call effectiveWindowMs in archiveObject". It is that reapObject hands the entire reap to archiveObject and returns:

// :919-923
 // ran anywhere. {@link archiveObject} now applies that window itself (see
 return this.archiveObject(engine, obj, lc, report);

So for any object declaring archive, the three effectiveWindowMs resolutions at :931 / :996 / :1011 are on the code path that is skipped, not merely absent. That is why the divergence is total rather than partial, and it is why a fix that only threads an override into :1209 would still leave floors and per-tenant windows unreached. Whatever shape you choose, say in the PR body which of the two it is: governance resolved inside archiveObject, or reapObject resolving before it delegates.

Scope — the card's own fence, and it is a real one

The finding says plainly: "Wiring only the global override and not the per-tenant ones would be a half-feature." Triage agrees and sizes it M, not S, naming the per-tenant leg (an Archiver batch loop per tenant window, the way reap() does at :1346) as the real work. Both legs, or come back and say why the second is genuinely a separate card — do not silently deliver the cheap half.

Note the card's own ranking of value, which is worth honouring in the test design: "The floor check is the cheaper half and arguably the more valuable one: it is the leg whose absence is silent rather than merely conservative." The override leg is conservative-but-wrong; the floor leg fails silent, and report.floorViolations staying empty is indistinguishable from a healthy sweep.

Evidence bar — where the before-state actually lives

Three-way taxonomy, and this card is unusual in having all three kinds:

1. Defect controls — must fail on the pre-fix tree. Register a floor against an archive-declaring object and assert the violation is reported; set a settings override and assert the archive cutoff moves; register a tenant-scoped override and assert one candidate read per overriding tenant. All three go red on origin/main today. This is the honest before-state — use it, do not reach for an ablation where a real defect control exists.
2. Preserved-behaviour control — falsified by mutating your own fix. finding(objectql): a lifecycle declaring both ttl and archive parses, but the ttl policy is silently inert — reapObject returns into archiveObject before the ttl reap runs #10347's cutoff selection must survive: an archive-declaring object with a declared ttl and no override and no floor must still cut on ttl.field / ttl.expireAfter (:1208–:1210), not on created_at / archive.after. That regression is the most likely casualty of routing this through effectiveWindowMs, and it will not show up in a defect control.
3. The floor-leg silence itself. report.floorViolations empty is the failure mode. A test asserting it is non-empty after the fix must be paired with one proving it stays empty on a healthy sweep — otherwise "non-empty" is satisfied by any bug that reports spurious violations.

⭐ Name the expected NON-effects before each run. "The three new tests went red" does not meet the bar in this lane. Which of sys_audit_log / sys_metadata_audit — the only two objects declaring lifecycle.archive, per the card — move, and which of the ttl-only objects must not move at all.

Reason src/dist in both directions rather than assuming it; scripts/check-test-source-alias.mjs's KNOWN_UNALIASED_TEST_IMPORTS is the ledger, and scripts/ablation-dist-preflight.mjs proves dist state if any leg needs it.

Adjacent cards — read, do not touch

#10527 (triple-declaration semantics) and #10526 (a refine message that #10541 made false) are both spec-side (packages/spec/src/**) and belong to another lane. Read them before touching cutoff selection so you know what is already claimed; changing either is out of scope here and would collide with a Clause-② surface this dispatch is not reviewed at.

Standing rules

Worktree-first before the first edit (git worktree add ../objectstack-10528 -b claude/issue-10528-archiver-governance-windows main). ⛔ Never git stash — the stack is shared across every worktree of the repo. ⛔ Never edit content/docs/releases/ in a code PR; the changeset is your input to release notes. Baselines and debt ledgers may only shrink. Open the PR as a draft — the PM flips it on acceptance.

---

Generated by Claude Code

[os-elon]

{
 "issue": 10528,
 "status": "done",
 "branch": "claude/issue-10528-archiver-governance-windows",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10864",
 "premise_still_valid": true,
 "summary": "Both legs, as the fence required. Governance is resolved INSIDE archiveObject rather than in reapObject before it delegates: the selection of which window is due lives there by the 2026-08-20 ruling behind #10347, so resolving in the caller would duplicate that selection or split one decision across two methods, and the per-tenant leg is a pass over archiveObject's own hot/cold batch loop either way. The batch loop became an archivePass(where) closure mirroring reap()'s reapWhere; the global window resolves through effectiveWindowMs on the key matching the selected window (expireAfter for a ttl-selected archive, maxAge for an age-selected one), floors apply to both overrides and declarations, and tenant windows issue one candidate read per overriding tenant plus a global pass carrying the explicit NULL-org branch. Premise verified at my own head before designing: every anchor in the claim comment matched 5886ee6d22 exactly, and archiveObject's body (1144-1290) contained zero occurrences of effectiveWindowMs / governance / floor / tenant. Unchanged on purpose and asserted: #10347's cutoff selection, the retain-first posture, the #4747 per-batch abort checks (now the first act of every pass), and the cold-side archive.keep prune, which bounds the archive rather than the hot store and has no settings key.",
 "tests": "All at f136a73365 (= final commit; git status --porcelain empty when the gate union ran). SRC/DIST reasoned in both directions, not assumed: the suite imports the subject relatively (./lifecycle-service.js) and resolves through src/ — the 8 controls flipped red-to-green from a src-only edit with NO rebuild of packages/objectql/dist between the two runs, so no ablation-dist-preflight applies to this pair. (1) DEFECT CONTROLS, red on the pre-fix tree — predicted 8 of 10 new cases red and 2 green before running; observed exactly that: 'Tests 8 failed | 94 passed (102)'. Floor leg: 'AssertionError: expected [] to deeply equal [ { object: sys_audit_log, ...(7) } ]' — the card's claim verbatim, an empty floorViolations being indistinguishable from a healthy sweep. Tenant leg: 'expected [ Array(1) ] to deeply equal [ {...}, {...} ]' — one global pass where two are due. Post-fix: 'Tests 102 passed (102)'. (2) PRESERVED-BEHAVIOUR CONTROL, falsified by mutating my own fix from the COMMITTED state: collapsing the new resolution onto the retention/created_at pair reddened exactly the predicted four and no others — 'DISCRIMINATING CONTROL: a declared ttl decides which rows move' and 'a row whose ttl.field is null or absent is NOT due at the epoch' (both pre-existing #10347 controls), plus my two new key-mapping cases; 'POSITIVE CONTROL: archive WITHOUT ttl still moves rows by created_at age' stayed green as predicted, having no ttl. 'Tests 4 failed | 98 passed (102)'. Restoration proven on disk, never by an editor's exit code: git hash-object == git rev-parse HEAD:PATH == ce70017ab9fb25b70ee8e71ccbdc1bfab3580dfb, git diff --exit-code 0, git status --porcelain empty (no MM). (3) THE SILENCE ITSELF: a SILENCE CONTROL pairs the two non-empty assertions with a sweep that must stay silent — a floor registered AND an override present, both legal — asserting floorViolations empty and error never called. EXPECTED NON-EFFECTS named before each run, each with its own control: an override naming sys_audit_log must leave sys_metadata_audit on its declaration (both swept in one pass, asserted); the override key that does not govern a given selection is ignored in both directions; a tenant override naming a different object leaves the Archiver on one global pass; archive.keep stays a single created_at prune even under per-tenant passes; every ttl-only non-archive object must not move at all (carried by the 94 pre-existing cases, green throughout). Every prediction matched; none missed. FULL SUITE on the restored tree: pnpm --filter @objectstack/objectql test -> 'Test Files 226 passed (226)', 'Tests 4009 passed (4009)'. typecheck -> exit 0, script name echoed (not a zero-match no-op). GATES: union derived with node scripts/pm/dispatch-gates.mjs and NO path arguments, after the final commit — 13 path-matched + 5 convention-triggered, all 18 run, every exit captured before any pipe, all green: changeset-gate-self-tests, durability-log-level, objectui-changeset, slot-lookup, test-source-alias, type-source-resolution, adr-0087-registration, changeset-no-major, ci-filter-parity, empty-changeset, engine-split-ratio, plugin-teardown-shape, affected-docs, query-options-erasure, type-check-coverage, engine-double-contract, where-matcher, type-check-debt. type-check-debt REFUSED on an unbuilt worktree (that throw is 'not measured', never 'not applicable'), so the workspace closure was built exactly as lint.yml does and it was re-run: 'check-type-check-coverage --re-measure: OK -- 33 ledger entr(ies) re-measured in 236.7s, 1912 raw tsc error(s) total, none above its recorded number'. No ledger or baseline raised (the plugin-auth -12 surplus it reports is pre-existing and untouched). 'check-nul-bytes: OK (scanned 6272 text file(s) ... no raw ASCII control bytes)'.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #10865: archiveObject's docblock still calls the retention+ttl+archive triple question 'deliberately NOT decided' and points at #10527 as open — #10643 closed it by refusing a diverging triple at parse time, so the comment both reads as undecided and warns about a shape the spec no longer accepts. Unassigned, labelled finding + domain:engine, no pm:queue (observation class). Not fixed in place: a stale cross-reference is a different defect class from the governance gap, so it fails the bounded-in-place test even though it sits beside the lines this diff restructures."
 ]
}

Notes for the PM, outside the JSON:

• PR is a draft (fix(objectql): the Archiver resolves its window through ADR-0057 P4 governance #10864, 3 files, +680/-53). Not flipped ready, not queued, no auto-merge.
• CI convergence is not awaited per the 2026-08-10 ruling — the branch is pushed and the draft PR is open, so this report lands now. mergeable_state read blocked at creation, which is the ordinary draft state, not a gate verdict.
• Both adjacent cards named in the dispatch are now closed: finding(objectql): with retention + ttl + archive all declared, only the ttl cutoff bounds the hot store #10527 by fix(spec): refuse a diverging retention + ttl + archive lifecycle triple at parse time #10643, finding(spec): the ttl.onlyWhen x archive refine tells authors something that stops being true once the Archiver honours ttl #10526 separately. Neither was touched; packages/spec/** is untouched by this diff.
• The branch is based on 5886ee6d22; origin/main moved to 05bc692e09 during the run. The gate union was derived against the merge base with three-dot semantics, so the change set is the 3 files this card owns and nothing a sibling PR landed.

---

Generated by Claude Code

---

Generated by Claude Code