Verified source deletion
Explicitly remove unchanged archived records with atomic batches and durable local deletion progress.
Authorize a completed original archive
Upgrade state and install an approved connector advertising verified-delete-v1. The archive must be completed, locally created and retain its original safety contract. Imported archives cannot authorize deletion. Both confirmations are required; verification alone never enables deletion.
coldctl archive delete JOB_ID --confirm-delete --confirm-original-source --max-batches 1
coldctl archive deletion-status JOB_IDVerification and comparison
The host verifies the complete archive before connecting, then rechecks each batch and decodes the exact bytes whose digest was verified. The connector validates original source and dataset identity and compares each existing record to the archive inside a transaction. Any mismatch rolls back that batch, including earlier deletes in it. Already absent keys are counted. Earlier committed batches remain deleted after a later failure.
PostgreSQL permissions and locks
Use the original source role with schema USAGE and table SELECT/DELETE. Each batch, up to 1,000 rows, holds SHARE ROW EXCLUSIVE, blocking writers while allowing ordinary reads. RLS, inheritance, partitions, user triggers, rules and incoming foreign keys are refused. The original endpoint/user, database and table identity checks still apply.
MySQL permissions and locks
MySQL 8.4 InnoDB supports up to 400 rows per batch and preserves full unsigned integer keys. The role needs SELECT, DELETE, LOCK TABLES, direct TRIGGER privilege and global PROCESS for identity and foreign-key inspection. TRIGGER must be granted directly at table, database or global scope; role-only grants and partial revokes are refused. Tables with triggers or incoming foreign keys, including hidden cross-database child tables, are refused. A WRITE table lock blocks readers and writers for the batch; errors roll back before unlocking.
MongoDB transactions
MongoDB 8.0 requires a replica-set primary and the quiescent-copy contract. Add remove permission on the source collection to the connector discovery/read permissions. Each batch, up to 100 documents, compares exact raw BSON in a snapshot transaction with majority commit. ObjectId, deployment identity, collection UUID and options are checked. Changed or oversized documents fail the batch; concurrent conflicting writes abort the transaction. Standalone servers, routers and unsupported collection shapes are refused.
Restart and uncertain commits
The source commits before the local SQLite checkpoint. If acknowledgement or the process is lost, retry the same job: missing keys count as absent and remaining records must still match. rows_processed is reconciled archive rows; rows_deleted is acknowledged deletions; rows_absent includes missing rows and unrecorded source commits. Do not reuse or reinsert archived keys during deletion/retries; identical reinserts cannot be distinguished from originals. Repeat with --max-batches to bound work, or omit it to finish. Ctrl+C stops between batches.
Completion and Cloud
A completed deletion is terminal and does not delete later inserted records. Archive files and the export manifest stay unchanged; source_deleted: false describes export, not subsequent deletion. deletion-status returns null before a checkpoint exists. Keep local state with your archive backups. Deletion progress is not currently uploaded to Cloud; inspect it locally.