Verify retention recovery after an interrupted purge run
The purge process crashes between provider acknowledgement and state persistence. The dashboard cannot tell which objects remain.
- Focused work estimate
- 5h 30m + prerequisites
- Priority in the scenario
- Medium
- Engineering practice
- Recovery engineering · Data lifecycle verification
Estimated field mix
- Privacy engineering40%
- Site reliability30%
- Distributed systems30%
Field percentages are editorial estimates of the ticket's engineering focus. They total 100%; they are not measured time, proficiency scores, or ownership evidence.
Review it, then add it to your workspace.
The board opens an editable draft; nothing is saved until you confirm it. Sign-in and workspace permissions apply, and Demo boards remain ephemeral.
Project context
A fictional support service keeps uploaded diagnostic files indefinitely. The exercise policy expires attachments 30 days after case closure, while a separately authorized investigation hold pauses removal. These are invented product rules, not legal advice or compliance certification.
Setup prerequisites
- Create synthetic cases, attachment metadata and a fake object store with controllable failures.
- Use an injected UTC clock and an authorized operator fixture; no real support uploads are needed.
Preceding work
Complete these dependencies, or supply their agreed outputs before taking this ticket.
- RRETENTION-101 · Calculate attachment expiry from the case closure instant
- RRETENTION-102 · Inventory every storage location used by one support attachment
- RRETENTION-103 · Require scoped authority to place an attachment on investigation hold
- RRETENTION-104 · Preview the attachment purge set with stable decision reasons
- RRETENTION-105 · Recheck holds when a queued attachment purge begins
- RRETENTION-106 · Retry partial attachment removal without forgetting derived copies
- RRETENTION-108 · Report retention backlog without listing customer file names
- RRETENTION-107 · Record a reopened case without silently resetting attachment history
- RRETENTION-109 · Rehearse a shorter retention policy without deleting on preview
Acceptance criteria
- Reconcile uncertain per-location states through the declared provider contract.
- Preserve held and not-yet-eligible objects while converging repeated retries.
- Produce a report separating confirmed removal, retained exceptions and unresolved provider outcomes.
Implementation constraints
- Use synthetic objects and deterministic crash points; a completed job record alone does not prove every copy is gone.
Verification to include
- Interrupt before and after each storage acknowledgement and compare actual fixture objects with recorded states.
- Repeat reconciliation and verify no duplicate privileged transition and no newly removed held object.
Deliverables
- Crash matrix, reconciliation procedure and truthful retention report
Rollout and recovery
Enable scheduled local purge only after recovery cases pass; unresolved states remain visible for authorized review.
Value of the work
For the engineer: Practice temporal policy, deletion races, exception authority and truthful recovery reporting.
For the team: Develop inspectable retention behavior that a company can review against its own approved data policy.
Evidence boundaries
Outcome Evidence: Tests, patches, and runbooks are requested deliverables. They become Outcome Evidence only through a qualified Mission and immutable Evidence IDs.
Ownership Evidence: Independent adaptation must be observed under a declared verification policy and cite immutable Evidence IDs. Completing a planning ticket establishes no Ownership Evidence.