Expire trash after 30 days, and make the deadline something you can see

Trash had no end. A note sat in /trash until someone emptied it by hand, and
its attachment BYTES sat on disk the whole time — the pile-up the operator
asked about. Nothing purged; there was no scheduler at all.

Retention is server-owned: `trash_retention_days` (default 30, 0 = keep
forever) in the settings registry, so it lands in admin Settings with no
migration and takes effect without a restart. A background sweep started in
before_serving does the work. Clients learn about a purge the way they learn
about any deletion — as a tombstone on the delta feed.

An auto-purge nobody can see coming is data loss on a timer, so the window is
now visible: /api/config publishes it, notes carry `deleted_at`, Trash leads
with the policy, and each card counts down. The countdown rounds DOWN — saying
"1 day left" for a note with ten minutes on the clock is the one error here
that actually costs someone a note.

Three things this turned up on the way:

- `DELETE /api/notes/<id>` hard-deleted the row, leaving no tombstone at all.
  A permanent delete in the web UI never reached a linked device, which would
  keep its copy forever and push it back on the next edit. It now purges
  through the same path as everything else.
- The purge left `note_revisions` and `note_link_previews` behind. A revision
  holds the full body, so the text of a "permanently deleted" note was still
  sitting in the database.
- `deleted_at` now SURVIVES a purge instead of being cleared. It's still true,
  and it means every query that says "not trashed" excludes tombstones for
  free — without it a content-less row reads as a perfectly normal active note
  and shows up on the board as a blank card.

Desktop keeps its own clock only when there's nobody else to keep one: the
sweep runs at startup on an UNLINKED device and refuses otherwise. A linked
client that expired notes on its own schedule could destroy something the
server was deliberately keeping, then push that delete upstream. Local policy
must never outrank the server's — so it also adopts the server's window for
the countdown rather than showing its offline default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

frontend/src/components/NoteCard.vue

@@ -14,7 +14,8 @@ import Icon from "./Icon.vue";
 import LinkPreview from "./LinkPreview.vue";
 import MarkdownText from "./MarkdownText.vue";
 import NoteChecklist from "./NoteChecklist.vue";
-import { formatReminder, isOverdue } from "../notes/datetime";
+import { formatReminder, formatTrashCountdown, isOverdue, trashDaysLeft } from "../notes/datetime";
+import { useConfigStore } from "../stores/config";
 
 const props = defineProps<{ note: Note; reorderable?: boolean; active?: boolean }>();
 const emit = defineEmits<{
@@ -24,6 +25,17 @@ const emit = defineEmits<{
   (e: "drop", note: Note): void;
 }>();
 const notes = useNotesStore();
+const config = useConfigStore();
+
+// --- Retention countdown. A note in Trash is on a clock, and the card is the only
+// place someone browsing Trash would ever find that out in time to restore it.
+// Null whenever nothing is going to happen: not trashed, or retention turned off. ---
+const trashDays = computed(() =>
+  props.note.trashed ? trashDaysLeft(props.note.deleted_at, config.trashRetentionDays) : null,
+);
+const trashCountdown = computed(() => formatTrashCountdown(trashDays.value));
+// Same red the overdue reminder uses — the last few days are worth noticing.
+const trashUrgent = computed(() => trashDays.value !== null && trashDays.value <= 3);
 
 // The card previews the first image inline; non-image files show as compact chips.
 const firstImage = computed(() => props.note.attachments.find((a) => a.mime.startsWith("image/")));
@@ -236,6 +248,32 @@ onBeforeUnmount(() => document.removeEventListener("mousedown", onDocMousedown))
       </span>
     </div>
 
+    <div v-if="trashCountdown" class="mt-2">
+      <span
+        class="inline-flex items-center gap-1 rounded-full px-2 py-0.5 text-xs"
+        :class="
+          trashUrgent
+            ? 'bg-red-100 text-red-700 dark:bg-red-950/50 dark:text-red-300'
+            : 'bg-black/5 text-neutral-600 dark:bg-white/10 dark:text-neutral-300'
+        "
+        :title="`Permanently deleted ${config.trashRetentionDays} days after it was trashed`"
+      >
+        <svg
+          class="h-3 w-3"
+          viewBox="0 0 24 24"
+          fill="none"
+          stroke="currentColor"
+          stroke-width="2"
+          stroke-linecap="round"
+          stroke-linejoin="round"
+        >
+          <circle cx="12" cy="12" r="10" />
+          <polyline points="12 6 12 12 16 14" />
+        </svg>
+        {{ trashCountdown }}
+      </span>
+    </div>
+
     <!-- Toolbar overlays the card's top-right on hover/focus as a floating pill
          (window-control style) instead of reserving a permanent row — so at rest
          the card is content-sized with even padding, not text pinned to the top

frontend/src/components/NoteEditor.vue

@@ -65,6 +65,7 @@ const draftNote = computed<Note>(() => ({
   pinned: false,
   archived: false,
   trashed: false,
+  deleted_at: null,
   remind_at: null,
   recurrence: null,
   labels: labelList.value,

frontend/src/notes/datetime.ts

@@ -49,3 +49,36 @@ export function formatLocalDay(d: Date): string {
   const pad = (n: number) => String(n).padStart(2, "0");
   return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
 }
+
+// --- Trash retention. The server permanently deletes a trashed note once it's older
+// than `trash_retention_days` (0 = keep forever). Counting down from the note's own
+// deleted_at is what turns that from a surprise into a policy: a card in Trash can
+// say how long it has left while there's still time to restore it. ---
+
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+// Whole days a trashed note has left, or null when nothing will happen to it
+// (retention off, or the note isn't trashed).
+//
+// Rounds DOWN deliberately. Rounding up would report "1 day left" for a note with
+// ten minutes on the clock — overstating the time remaining is the one error here
+// that actually costs someone a note.
+export function trashDaysLeft(
+  deletedAt: string | null | undefined,
+  retentionDays: number,
+  now: number = Date.now(),
+): number | null {
+  if (!deletedAt || retentionDays <= 0) return null;
+  const trashedAt = new Date(deletedAt).getTime();
+  if (Number.isNaN(trashedAt)) return null;
+  const remaining = trashedAt + retentionDays * MS_PER_DAY - now;
+  return remaining <= 0 ? 0 : Math.floor(remaining / MS_PER_DAY);
+}
+
+// The countdown as the card shows it. "" when there's nothing to say.
+export function formatTrashCountdown(daysLeft: number | null): string {
+  if (daysLeft === null) return "";
+  if (daysLeft <= 0) return "Deletes today";
+  if (daysLeft === 1) return "1 day left";
+  return `${daysLeft} days left`;
+}

frontend/src/stores/config.ts

@@ -7,6 +7,8 @@ export interface PublicConfig {
   allow_registration: boolean;
   version: string;
   enable_url_unfurl: boolean;
+  // How many days a note survives in Trash before the server purges it. 0 = forever.
+  trash_retention_days: number;
 }
 
 // Public, unauthenticated app config (site name, whether signups are open).
@@ -15,6 +17,10 @@ export const useConfigStore = defineStore("config", () => {
   const allowRegistration = ref(true);
   const version = ref("");
   const enableUrlUnfurl = ref(true);
+  // Mirrors the server default (settings.REGISTRY). Only used if /api/config is
+  // unreachable — and 30 is a safer stand-in than 0, since claiming "kept forever"
+  // when the server is actually purging is the wrong way to be wrong.
+  const trashRetentionDays = ref(30);
   const loaded = ref(false);
 
   async function load(): Promise<void> {
@@ -25,6 +31,7 @@ export const useConfigStore = defineStore("config", () => {
       allowRegistration.value = cfg.allow_registration;
       version.value = cfg.version;
       enableUrlUnfurl.value = cfg.enable_url_unfurl ?? true;
+      trashRetentionDays.value = cfg.trash_retention_days ?? 30;
     } catch {
       // Keep defaults if the config endpoint is unreachable.
     } finally {
@@ -37,5 +44,5 @@ export const useConfigStore = defineStore("config", () => {
     await load();
   }
 
-  return { siteName, allowRegistration, version, enableUrlUnfurl, loaded, load, reload };
+  return { siteName, allowRegistration, version, enableUrlUnfurl, trashRetentionDays, loaded, load, reload };
 });

frontend/src/stores/notes.ts

@@ -76,6 +76,9 @@ export interface Note {
   pinned: boolean;
   archived: boolean;
   trashed: boolean;
+  // When it was trashed (null unless trashed). The Trash view counts the retention
+  // window from here to show how long the note has left before it's purged.
+  deleted_at: string | null;
   remind_at: string | null;
   recurrence: string | null;
   labels: NoteLabel[];

frontend/src/views/BoardView.vue

@@ -2,6 +2,7 @@
 import { computed, onBeforeUnmount, onMounted, ref, watch } from "vue";
 import { useRoute, useRouter } from "vue-router";
 import { useNotesStore, type Note, type NoteView } from "../stores/notes";
+import { useConfigStore } from "../stores/config";
 import { useUiStore } from "../stores/ui";
 import { facetCount, facetsFromQuery, facetsToQuery } from "../notes/facets";
 import { useNoteEditor } from "../composables/useNoteEditor";
@@ -12,6 +13,7 @@ import NoteCard from "../components/NoteCard.vue";
 import NoteEditor from "../components/NoteEditor.vue";
 
 const notes = useNotesStore();
+const config = useConfigStore();
 const route = useRoute();
 const ui = useUiStore();
 const router = useRouter();
@@ -144,6 +146,17 @@ watch(
 );
 watch([currentView, currentLabel, facetKey], () => (focusedIndex.value = -1));
 
+// The retention policy, said out loud at the top of Trash. Empty when retention is
+// off — promising a deletion that never comes is its own kind of lie.
+const retentionNotice = computed(() => {
+  if (currentView.value !== "trash") return "";
+  const days = config.trashRetentionDays;
+  if (days <= 0) return "Notes stay in Trash until you delete them.";
+  return days === 1
+    ? "Notes here are permanently deleted 1 day after you trash them. Restore one to keep it."
+    : `Notes here are permanently deleted ${days} days after you trash them. Restore one to keep it.`;
+});
+
 const emptyState = computed(() => {
   if (filtered.value) return { title: "No notes match these filters", subtitle: "Try clearing or loosening a facet." };
   if (currentView.value === "trash") return { title: "Trash is empty", subtitle: "Notes you delete land here first." };
@@ -208,6 +221,13 @@ async function onDrop(target: Note) {
     </button>
     <FilterBar v-if="isMainBoard" />
 
+    <p
+      v-if="retentionNotice"
+      class="mx-auto mb-4 max-w-xl rounded-xl bg-black/5 px-4 py-2.5 text-center text-sm text-neutral-600 dark:bg-white/10 dark:text-neutral-300"
+    >
+      {{ retentionNotice }}
+    </p>
+
     <AsyncState
       :loading="notes.loading"
       :error="loadError || undefined"