From 5b863df7a6eb290f1ce8cd07608847426907e37f Mon Sep 17 00:00:00 2001 From: Dotta Date: Sun, 25 Oct 2026 04:47:46 -0500 Subject: [PATCH] docs: audit inbound voice history retention deadlines Co-Authored-By: Paperclip --- ...2026-10-24-recurring-server-sleep-stack.md | 9 +++ ...-25-voice-inbound-retention-sleep-audit.md | 66 +++++++++++++++++++ 2 files changed, 75 insertions(+) create mode 100644 doc/plans/2026-10-25-voice-inbound-retention-sleep-audit.md diff --git a/doc/plans/2026-10-24-recurring-server-sleep-stack.md b/doc/plans/2026-10-24-recurring-server-sleep-stack.md index a85eb03abce..024f4cc533e 100644 --- a/doc/plans/2026-10-24-recurring-server-sleep-stack.md +++ b/doc/plans/2026-10-24-recurring-server-sleep-stack.md @@ -1297,3 +1297,12 @@ acceptance remain pending. History retention and call reports remain separate ne slices. Parent #17578 at 90caaf3fa9 has no pending/failed checks and exact-head Greptile 5/5; the second Paperclip reviewer stopped before completion. The original remaining inventory, #17490 E2E failure and final reconciliation remain in scope. + + +Inbound cleanup is [#17580](https://github.com/paperclipai/paperclip/pull/17580), +head 4b4bf2d8af6e08d3859ada4b720e7fbd3ea27e24, stacked on #17578. It is +mergeable; CI 40181994295 and review 40181994134 are live with no initial failure. +The final migration applies/replays and its backfill is tested twice. Slice 24 +starts the separate inbound-history retention audit. Its deadline preserves both +seven-day age conditions and requires confirmed cleanup plus no task/session +binding. Call reports follow separately. No original remaining scope is removed. diff --git a/doc/plans/2026-10-25-voice-inbound-retention-sleep-audit.md b/doc/plans/2026-10-25-voice-inbound-retention-sleep-audit.md new file mode 100644 index 00000000000..bfa4e9e1f43 --- /dev/null +++ b/doc/plans/2026-10-25-voice-inbound-retention-sleep-audit.md @@ -0,0 +1,66 @@ +# Inbound voice history retention sleep audit + +Baseline: inbound cleanup PR #17580, head +4b4bf2d8af6e08d3859ada4b720e7fbd3ea27e24. +Branch: codex/sleep-24-voice-inbound-retention. +Status: owner audit; implementation, tests, publication and acceptance pending. + +## One reason + +Remove the remaining recurring inbound history delete. Keep call reports in the +next separate slice. `voiceInboundService.pruneHistory` currently runs from +`voiceSessionService.reconcileMaintenance` in chat's periodic maintenance lane. + +The existing retention policy deletes only denied, expired or ended admissions +with no session or intake task, confirmed provider cleanup, and both expiresAt +and updatedAt at least seven days old. Preserve that policy. The actual deletion +deadline is max(expiresAt, updatedAt) + seven days. Never treat unconfirmed cleanup +or a terminal UI label as deletable history. + +## Owners and producer boundary + +The existing admission rows and cleanup confirmation remain truth. No new table +or row fields are needed. Reuse the scoped deadline worker and register a separate +retention queue. Keep state selection, deadline calculation and deletion in the +voice owner. Startup/app wiring only registers the owner. + +All supported admission mutations already use notifyVoiceInbound directly or the +voice-change composition. Extend that boundary to signal the separate retention +queue before writes. This includes signed terminal callbacks, cleanup confirmation, +legacy binding repair, approval/session handoff, expiry and rejection. Bound rows +remain ineligible; their history belongs to their other owners. Company deletion +can remove confirmed unbound history within its existing transaction. + +At deletion time, lock and recheck the row and deadline. A cached candidate must +not delete a row that acquired a binding, lost confirmation, or had its updatedAt +moved by a committed write. Preserve fair paging, coalescing, backoff, drain and +shutdown through the existing shared mechanism. Own deletes should retire their +cached entries without starting another periodic scan. + +## Required verification + +- Configured idle and no eligible history become SQL-quiet. +- Confirmed retained history schedules the exact seven-day deadline and does not + query before it; restart reconstructs that same deadline. +- Real cleanup confirmation and signed callbacks register retention through their + transaction boundary; rollback/outer commit behave correctly. +- Unconfirmed cleanup and bound history are never deleted. +- A changed deadline/binding between discovery and deletion is rechecked. +- Paged backlog, first write during drain, failures, and shutdown retain work. +- Existing voice, cleanup, deletion and startup consumers pass. +- Remove only history pruning from recurring maintenance; call reports remain. + +No Cloud wake or sleep eligibility expansion is included. The external scheduler +must cover a deadline before that deadline can justify stopping the host. + +## Stack state + +#17580 is published and attached; 205 selected tests, workspace types/build and +migration checks passed locally. Initial CI run 40181994295 and review run +40181994134 are live on its exact published head. It is mergeable and had no +failures at inspection. Fresh checks/reviews remain required; no merge authority +is implied. #17578 at 90caaf3fa9 has passing checks and exact-head Greptile 5/5; +its latest Paperclip reviewer stopped before completion. + +The full original recurring-server ledger, older #17490 E2E failure and final +stack/master reconciliation remain required.