Deletes

As in choudoufu, a record is never permission to delete. Every object a run would delete, under plunge destroy too, is first checked against its live marker.

The live object	Outcome
carries this stack’s plunge-stack and plunge-urn	deleted
has a marker naming another stack, or another resource of this stack	the run is refused
takes markers but carries none	the run is refused: tags stripped by hand are not consent to delete
is of a record-owned type (Identity)	deleted on the record’s word; the record’s ownership entry says "by": "record"
is gone	nothing to delete

The refusal (DeleteRefusedError) lists each URN with its object ID, marker value, record key and plunge state delete '<urn>'. No delete runs.

Where the marker comes from

With refresh on (the default for up and preview), the refreshed outputs hold the tags, so no extra provider call is made. With refresh off (PLUNGE_REFRESH=false, or destroy without --refresh), each marked object is read once under the stack’s provider configuration.

When it refuses

destroy refuses before any step but the refresh. up knows its deletes only after the program registers everything, so --skip-preview is refused after creates and updates, before any delete. A plain plunge up is refused in its preview, before anything changes.

An adopted stack never updated under plunge has no markers yet, so its destroy is refused for each taggable object. Run plunge up to write them, or drop the records by name. PLUNGE_MARKERS=false turns off markers and this check.

Replacements and imports

The delete half of a replacement is checked the same way, before the replacement’s first step, and so is a pending delete an earlier replacement left. An original carrying this stack’s markers is deleted as before; an unmarked one refuses the run, and nothing is created or deleted.

An import: is checked before the import step (ImportRefusedError): a live object with another stack’s marker is refused, and so is any type whose tags are create-only. An unmarked object imports and is marked by the next update (#51, open for that ruling).

On the pinned floci, a destroy of an aws-* corpus program is refused on its SSM parameters, whose tags floci drops (lex00/floci#263).

Source: pkg/backend/plunge/deletevet.go.