The retention purge can delete a site a member is restoring #245

New Issue

2026-10-22T03:43:19Z

cgalo5758 commented

2026-10-22 03:43:19 +00:00

What happens

The retention purge reads the archived sites past the 30-day window once, then hard-deletes each on the farm and deletes its row without reading the site again. A member who restores one of those sites before the purge reaches it has the restore accepted, and the purge then deletes the site on the farm and deletes its row, whatever status the row has by then. If the restore had finished, the pool's usage also stays one above its active sites, because the purge writes no usage.

What should happen

The purge deletes a site only while its row is still archived and past the window and no lifecycle request on the site is open, checked at the delete. Otherwise it leaves the site to a later tick, as the sync already skips a site with an open request.

Where

internal/integrations/fedwiki/workflows/reconcile.go, PurgeExpiredArchivedActivity

Steps

Archive a site and move its archived_at back past 30 days, start a restore, and let the sync tick run while the restore's farm call is in progress.

Why it matters

A restore the console accepted ends with the member's site permanently deleted.

### What happens The retention purge reads the archived sites past the 30-day window once, then hard-deletes each on the farm and deletes its row without reading the site again. A member who restores one of those sites before the purge reaches it has the restore accepted, and the purge then deletes the site on the farm and deletes its row, whatever status the row has by then. If the restore had finished, the pool's usage also stays one above its active sites, because the purge writes no usage. ### What should happen The purge deletes a site only while its row is still archived and past the window and no lifecycle request on the site is open, checked at the delete. Otherwise it leaves the site to a later tick, as the sync already skips a site with an open request. ### Where `internal/integrations/fedwiki/workflows/reconcile.go`, `PurgeExpiredArchivedActivity` ### Steps Archive a site and move its `archived_at` back past 30 days, start a restore, and let the sync tick run while the restore's farm call is in progress. ### Why it matters A restore the console accepted ends with the member's site permanently deleted.

cgalo5758 added this to the Public launch milestone 2026-10-22 03:43:19 +00:00

cgalo5758 added the

kind

bug

area/fedwiki labels 2026-10-22 03:43:19 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#245