Expire trash after 30 days, and make the deadline something you can see

Trash had no end. A note sat in /trash until someone emptied it by hand, and
its attachment BYTES sat on disk the whole time — the pile-up the operator
asked about. Nothing purged; there was no scheduler at all.

Retention is server-owned: `trash_retention_days` (default 30, 0 = keep
forever) in the settings registry, so it lands in admin Settings with no
migration and takes effect without a restart. A background sweep started in
before_serving does the work. Clients learn about a purge the way they learn
about any deletion — as a tombstone on the delta feed.

An auto-purge nobody can see coming is data loss on a timer, so the window is
now visible: /api/config publishes it, notes carry `deleted_at`, Trash leads
with the policy, and each card counts down. The countdown rounds DOWN — saying
"1 day left" for a note with ten minutes on the clock is the one error here
that actually costs someone a note.

Three things this turned up on the way:

- `DELETE /api/notes/<id>` hard-deleted the row, leaving no tombstone at all.
  A permanent delete in the web UI never reached a linked device, which would
  keep its copy forever and push it back on the next edit. It now purges
  through the same path as everything else.
- The purge left `note_revisions` and `note_link_previews` behind. A revision
  holds the full body, so the text of a "permanently deleted" note was still
  sitting in the database.
- `deleted_at` now SURVIVES a purge instead of being cleared. It's still true,
  and it means every query that says "not trashed" excludes tombstones for
  free — without it a content-less row reads as a perfectly normal active note
  and shows up on the board as a blank card.

Desktop keeps its own clock only when there's nobody else to keep one: the
sweep runs at startup on an UNLINKED device and refuses otherwise. A linked
client that expired notes on its own schedule could destroy something the
server was deliberately keeping, then push that delete upstream. Local policy
must never outrank the server's — so it also adopts the server's window for
the countdown rather than showing its offline default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

tests/test_retention.py

@@ -0,0 +1,83 @@
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from thoughtsync.retention import (
+    SWEEP_BATCH,
+    SWEEP_INTERVAL_SECONDS,
+    SWEEP_STARTUP_DELAY_SECONDS,
+    expired_before,
+    sweep_expired_trash,
+)
+from thoughtsync.settings import REGISTRY, get_public_config, validate_updates
+
+NOW = datetime(2026, 7, 26, 12, 0, tzinfo=timezone.utc)
+
+
+def test_expired_before_is_the_window_ago():
+    assert expired_before(NOW, 30) == NOW - timedelta(days=30)
+    assert expired_before(NOW, 1) == NOW - timedelta(days=1)
+
+
+def test_zero_means_keep_forever():
+    # The opt-out. A user who wants Trash to be an indefinite archive gets one, and
+    # `None` is what stops the sweep before it builds a query at all.
+    assert expired_before(NOW, 0) is None
+
+
+def test_a_negative_window_also_means_never():
+    # Reachable by typing a stray minus into the Settings field. The dangerous reading
+    # of -1 would be "expired a day in the FUTURE", which purges the entire trash on
+    # the next sweep; refusing to run is the only safe interpretation.
+    assert expired_before(NOW, -1) is None
+    assert expired_before(NOW, -3650) is None
+
+
+async def test_sweep_is_a_noop_when_retention_is_off():
+    # Passing None as the session proves it: retention off must return before it so
+    # much as touches the database.
+    assert await sweep_expired_trash(None, 0) == 0
+    assert await sweep_expired_trash(None, -1) == 0
+
+
+def test_retention_setting_is_registered_with_a_30_day_default():
+    defn = next((d for d in REGISTRY if d.key == "trash_retention_days"), None)
+    assert defn is not None, "the setting must appear in the admin Settings UI"
+    assert defn.type == "int"
+    assert defn.default == 30
+    # The operator has to be able to tell what it does without reading the code.
+    assert "0" in defn.description, "the keep-forever escape hatch must be documented"
+
+
+def test_retention_setting_accepts_an_int_and_rejects_nonsense():
+    clean, err = validate_updates({"trash_retention_days": "7"})
+    assert err is None
+    assert clean == {"trash_retention_days": 7}
+    _, err = validate_updates({"trash_retention_days": "soon"})
+    assert err is not None
+
+
+async def test_public_config_publishes_the_window():
+    # Clients need it to say how long a note has left in Trash, and a native client
+    # reads it before it holds any credential — so it rides the unauthenticated
+    # config. A stub session stands in for the DB: no row set => registry default.
+    class _NoRows:
+        async def get(self, *_args):
+            return None
+
+    cfg = await get_public_config(_NoRows())
+    assert cfg["trash_retention_days"] == 30
+
+
+@pytest.mark.parametrize(
+    "value", [SWEEP_INTERVAL_SECONDS, SWEEP_STARTUP_DELAY_SECONDS, SWEEP_BATCH]
+)
+def test_sweeper_pacing_constants_are_positive(value):
+    # A zero interval would turn the background loop into a busy spin against the DB.
+    assert value > 0
+
+
+def test_sweep_interval_is_well_under_a_day():
+    # Retention is measured in days, but the sweep still has to run often enough that
+    # "30 days" doesn't quietly become 31.
+    assert SWEEP_INTERVAL_SECONDS <= 12 * 60 * 60