`sys_audit_log.action` declares `restore` with no writer anywhere — `actionFor()` structurally cannot return it, while a comment and a shipped list view both assert it is covered

[os-zhuang]

Found by the domain:identity execution seat while measuring whether #7675 ("4 of 10 declared sys_audit_log actions have no writer anywhere") can close. Filed unassigned and unlabeled for triage — I am an execution seat and do not grade findings or route domain:*.

Same defect class as #7675, on a value #7675's own survey did not name. Measured on origin/main, not inferred.

What

packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts:125 declares:

action: Field.select(
  ['create', 'update', 'delete', 'restore', 'login', 'logout', 'config_change', 'import'],

Nothing writes restore. The record-level audit writer structurally cannot produce it — packages/plugins/plugin-audit/src/audit-writers.ts:245:

function actionFor(event: string): 'create' | 'update' | 'delete' | null {

restore is not in the return type, and audit-writers.ts:1105-1106 early-returns on null. A tree-wide grep for any form of action: 'restore' across packages/**/*.ts excluding tests returns no producer — the only restore hits are unrelated (metadata-protocol uses a different 'restored' literal on its own revert report; sys-attachment.object.ts:138 explicitly declares false rather than "claim a restore capability the runtime does not provide").

⚠️ Two declarations assert the opposite, which is what makes this more than tidiness

1. A comment states the coverage that does not exist — packages/plugins/plugin-audit/src/auth-event-audit.ts:11:

create/update/delete/restore and nothing else — four of the declared…

It names restore as one of the four covered actions. actionFor()'s own signature contradicts it. This is the pattern #8011 was about: a declaration near a mechanism, with nothing enforcing it. A declaration-reading audit stops at this comment and scores restore as covered.

2. A shipped list view offers it as a filter value — sys-audit-log.object.ts:55:

filter: [{ field: 'action', operator: 'in', value: ['create', 'update', 'delete', 'restore'] }],

The data_changes view advertises a value that can never match. Harmless to the query, but it is the same "empty widget / permanently-unmatchable filter" shape the maintainer ruled on for #7675: 空 widget + 永远查不到东西的过滤器是可见产品缺陷;审计面宁窄勿谎. Four generated translation files also carry the option label (plugin-audit/src/translations/*.objects.generated.ts:27).

Status of #7675's named values, for context

Every value #7675 actually named is now resolved, which is why this one surfaced:

action	state
login	✅ writer at auth-session-audit.ts:138 (#8144 → PR #8244)
logout	✅ writer at auth-session-audit.ts:162 (#8144 → PR #8244)
config_change	✅ writer landed (#8145 → PR #8288)
export	✅ retired from the enum (#8147 → PR #8200)
permission_change	✅ retired from the enum (#8147 → PR #8200)
import	✅ real writer at plugin-auth/src/admin-import-users.ts:515
restore	❌ no writer — this card

Not adjudicated here

⛔ I have deliberately not decided between the two obvious shapes (give restore a writer, or retire it from the enum/view/translations per the 宁窄勿谎 principle). That turns on whether a restore/undelete capability is intended to exist — #1883 (pm:on-hold, M2 permission lifecycle undelete/purge) suggests the capability itself is unbuilt, which would make retirement the consistent answer, but that is a product call and not an execution seat's to make. Recorded plainly per the file-plainly rule.

Whichever way it goes, the false comment at auth-event-audit.ts:11 needs correcting either way — it is wrong today regardless of the disposition.

Related: #7675 (parent survey), #8147 (the retirement that this measurement re-checks), #1883, #8011 (same "unenforced declaration" class), #8203 (a select option enum is unenforceable once the field is readonly — the mechanism that lets this persist undetected).

[hotlong]

Triage: lands in packages/plugins/plugin-audit → domain:identity + pm:queue, type Bug (the enum declares a value actionFor() structurally cannot produce, a shipped comment asserts coverage that does not exist, and a shipped list view filters on a value that can never match — declared ≠ enforced).

Inherited ruling, not a new decision. The maintainer's #7675-family ruling —「空 widget + 永远查不到东西的过滤器是可见产品缺陷;审计面宁窄勿谎」— already adjudicated this exact shape for export / permission_change (#8147 → PR #8200). Per the sibling-reuse rule I re-checked the ruling's reason against this branch before carrying it over: restore is materially identical (declared enum value, no writer anywhere, permanently-unmatchable shipped filter), and the one candidate difference — that a restore capability might be intended — is already parked by the maintainer (#1883 pm:on-hold, #3146 status:parked: soft-delete/restore is unbuilt). No real semantic difference ⇒ the ruling carries with its reason.

Scope on inherit (the #8147 / PR #8200 shape):

1. Retire restore from the action enum, the data_changes view filter, and the generated translation labels.
2. Correct the false coverage comment at auth-event-audit.ts:11 — wrong today under any disposition.
3. If/when the restore capability lands ([security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883/Implement soft delete (recycle bin): enable.trash / softDelete are spec-only with zero runtime readers #3146 restart), the enum value returns with its writer — note this in the PR body so the retirement is not read as a permanent product stance.

Veto window open: if the maintainer prefers giving restore a writer now, that is #1883's scope and reverses this card.

Cross-link for the identity seat: this was the last unresolved value from #7675's survey — once this lands, re-check whether #7675 can close.

本评论来自分诊座位 Routine。

---

Generated by Claude Code

[os-zhuang]

Claiming this card.

• Session: session_01PEVB6w7D7uCszR9Mw1BL73
• Branch: claude/issue-8315-retire-restore-action
• Worktree: ../objectstack-8315

Following the inherited #7675-family ruling as carried by triage (retirement, not re-adjudication), templated on #8147 → PR #8200 / commit 344a22a82.

---

Generated by Claude Code

[os-zhuang]

{
  "issue": 8315,
  "status": "done",
  "branch": "claude/issue-8315-retire-restore-action",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8325",
  "head_sha": "02694c4701667ee186eb49031baac8625213fe9d",
  "premise_still_valid": true,
  "summary": "Retired `restore` from the sys_audit_log.action enum, from the shipped list-view filter (the view is named `writes_only`, not `data_changes` as the card's text says — same line 55, same filter), and from the four generated translation bundles (regenerated with the repo's own generator, real diff: one option label removed per locale). Corrected the false coverage comment at auth-event-audit.ts:11 and, because that comment was an unenforced declaration (the #8011 shape), turned the invariant it claimed into a pin test with the writer inventory as literals. Registered under ADR-0087 as a NEW semantic entry `audit-log-action-restore-retired` (separate from #8147's, per entries/README.md: different entries merge clean, same entry collides) with all three projections regenerated. Followed the #8147 / PR #8200 template throughout, including the breaking-change classification.",
  "tests": "plugin-audit: 216 tests / 14 files PASS (213 pre-existing + 3 new). plugin-audit typecheck PASS, spec typecheck PASS. Gates all PASS: check:nul-bytes, check:empty-changeset, check:adr-0087-registration, check:changeset-gate-self-tests (covers check-changeset-no-major), check:i18n (9 packages in sync), check:adr-anchors, check:docs-audit-scope, check:engine-double-contract, spec check:migration-registry / check:spec-changes / check:upgrade-guide / check:authorable-surface (1266 defaults unchanged, confirming the surface ratchets did not move). Ablation zero-divergence: predicted 3 failures, measured exactly 3 (213 passed alongside). CI at this head: Check Changeset SUCCESS (the PM-relayed failure is resolved), ESLint battery SUCCESS, Build Core SUCCESS, Dogfood Verify CLI SUCCESS, Temporal Conformance SUCCESS; Test Core 1-3, TypeScript Type Check and Dogfood Regression 2-3 still in_progress at report time — not waited on, per the report-at-draft-PR-time rule.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as cloud#1274: service-cloud's recordAuditRow hand-mirrors the sys_audit_log action vocabulary as a TS union that still names `export` (retired by #8147) and `restore` (retired here). Dormant — both live call sites pass update/delete — but the write path bypasses the engine and the schema, so a future caller reaching for a stale arm would store an undeclared row with nothing going red.",
    "NOT filed, reported for routing: objectui apps/console/src/pages/system/AuditLogPage.tsx (ACTION_OPTIONS filter dropdown + ACTION_VARIANT) and packages/plugin-detail/src/HistoryTimeline.tsx (ACTION_VARIANT) both carry a `restore` arm. objectui#4476 already exists for the other retired values and needs `restore` added to its scope — PM routes, per dispatch instruction.",
    "NOT filed, already tracked: #8148 is still open and still needed — system_overview.dashboard.ts ships `filter: { action: 'permission_change' }`. Verified still present on this branch."
  ]
}

#7675 closability, as asked

It cannot close when this lands. restore was its last unresolved enum value, but two of its five sub-issues are still open, and both are named in #7675's own symptom text (not just its sub-issue list):

• audit-log (D): remove the permission_change widget from system_overview.dashboard.ts and align the dashboard's audit tiles with the post-retirement action set #8148 — system_overview.dashboard.ts still ships a permission_change widget counting a retired value. Verified present on origin/main today.
• objectui#4476 — the console ACTION_OPTIONS surface, which offers retired values as filter choices. Now needs restore added to its scope.

Also measured while checking: #7675's other named defect — settings-service.types.ts:16 documenting "Emit sys_audit_log rows for every successful write" while the service wrote to sys_setting_audit — was fixed by #8145; that docblock now states the dual-write accurately (以实现定契约). And the import escalation PR #8200 raised is settled: import is still declared, still has its live writer at plugin-auth/src/admin-import-users.ts:515, and is now pinned in both directions by the writer-inventory assertion this PR adds.

---

Generated by Claude Code