cadrumo.application.bucket_maintenance.service module

Read-only current-capsule bucket maintenance projections.

Lifecycle mutation moved to the custody transaction owner. This surface keeps only target locking and read-only observations; archive, restore, bundle import/export, legacy rename, and manifest-backed lifecycle mutation have no current implementation and are intentionally not exposed here.

class BucketDeletionPreconditionCondition(*values)

Bases: StrEnum

Closed failed-condition identities for deletion-preflight refusals.

CUSTODY_TARGET_UNLINKED

LABEL_PROJECTION_PRESENT

CAPSULE_INVENTORY_READABLE

RETENTION_SNAPSHOT_ASSESSABLE

class BucketMaintenanceService(*, bucket_storage)

Bases: object

Expose only non-mutating maintenance operations for current capsules.

Parameters:

bucket_storage (ProfileBucketStoragePort)

deletion_target_locks(*, root, bucket_ids, wait_seconds)

Hold existing target locks in stable UUID order.

This is intentionally a locking primitive only. It neither derives a profile status nor makes a lifecycle decision from the label projection.

Return type:

Generator[None]

Parameters:

• root (Path)

• bucket_ids (Iterable[str])

• wait_seconds (float)

assess_deletion(command)

Observe one deletion target: existence, label, contents and retention.

Retention is answered WITHOUT a session, and the distinction matters because it is why this surface can answer at all. Producing the filing retention position still needs the bucket’s key – it summarises the encrypted filing catalogue – so the filing owner records a plaintext snapshot at the two moments a session is held by construction, profile creation and filing persistence. A deletion preflight runs against profiles it has NOT unlocked, so it reads that snapshot rather than the modelo records, which are encrypted under a key nobody here holds.

setup_state stays absent for the same reason it always did: it lives inside the encrypted profile record and no unauthenticated read can reach it. The field is optional on the assessment precisely so this surface can decline it rather than guess.

Return type:

BucketDeletionAssessment

Parameters:

command (AssessBucketDeletionCommand)