Behaviour: what users see and who can do what¶
Part of the temporary reversible deletion plan. Wording marked "proposed copy" is a draft for the UI slices; the M3 design follows the FEAT-023 contract (light and dark themes, preview acceptance). Decision numbers (D1, D2, …) refer to decisions and risks.
1. Words used¶
| Term | Meaning |
|---|---|
| Deleted | Removed from normal use. Nothing is erased: the data stays in the database, detached and marked, indefinitely (D2) |
| Recently deleted | The list of deleted searches (per project) and deleted projects (per owner) that can still be restored by their users |
| Restore window | 30 days from the deletion (D1). The end date is fixed when the item is deleted |
| Restore | Undo a deletion. Everything that was kept comes back |
| Deletion pending | The deletion has been requested and is waiting for running work to stop (in-flight work) |
2. Deleting a search¶
Who. Holders of the project activity RemoveSearch, which is the project Administrators group by
default (ResourceSecurity.json, RemoveSearch entry). Unchanged from today (D3).
Where. The bin icon on the project's Searches page (/projects/{id}/searches), as today.
The dialog (proposed copy).
Delete "Search 2"? Its 1,200 references, and all screening and annotation on them, leave this project. You can restore the search from Recently deleted until 4 November 2026. After that, an application administrator can still restore it. SyRF keeps the data; it is not erased. Its import in progress and 1 PDF upload will be cancelled. PDFs already added to studies are kept. Type the search name to confirm. · Reason (optional) · [Cancel] [Delete search]
The typed-name confirmation stays because deletion still has an immediate effect on everybody's work.
What happens.
- Work that belongs to the search is cancelled first: its import, its PDF uploads, and a bulk study update that would change its Studies (rolled back, so none of its changes are applied). Work that has passed its point of no return, or belongs to something else in the project, is waited for (recommendation). Meanwhile the search shows "Deletion pending" with the reason, stays usable, and the project takes no new imports, PDF uploads or bulk study updates. The deletion continues by itself (in-flight work).
- Then the search disappears from the search list, from the Library's search filter and from search counts. A stage's saved search filter is not changed. Stage search filters have no effect on what a stage shows today, and their settings card ("Select Studies for Review") is off by default and not turned on in any environment's configuration; where it is turned on, it does not show the saved searches, and saving it clears the stage's saved search filter whether or not a search is deleted (data model §5.3).
- Its Studies disappear from the Library, screening and annotation queues, allocation, reconciliation, exports started from then on and every statistics page. Large searches finish within minutes; the Recently deleted entry shows "Deleting… 900 of 1,200 references" until then.
- Temporary review places (reservations) on those Studies are released.
- A reviewer who has one of those Studies open sees, on their next save (proposed copy): "This study's search was deleted, so this change can't be saved. Work saved before the deletion is kept and comes back if the search is restored." Unsaved input stays in the open form.
- Open pages of the project refresh through a SignalR event. As built (S4a): members with the project open see "Search "Search 2" was deleted."; the page reloads the project (the search list and counts), refreshes a Library or stage study list already on screen and refetches statistics. The event is best effort; the project's own notification of the unlink refreshes the search list even when it is lost.
3. Recently deleted searches¶
Where. A "Recently deleted" section at the end of the Searches page, collapsed by default and shown only when it has entries.
Who sees it. RemoveSearch holders and the project owner. Other members never see deleted searches.
Each entry shows. Search name; number of references; deleted by; "Deleted on 5 October 2026"; "Can be restored until 4 November 2026"; the reason if one was given; a state while busy ("Deletion pending", "Deleting…", "Restoring…").
After the window the entry leaves the list. The data stays. An application administrator can still restore it (restore window §3).
Action. Restore, for RemoveSearch holders, within the window. There is no "delete permanently".
4. Restoring a search¶
- The search returns to the list and its Studies return to every view, with every screening decision, annotation, saved annotation session and PDF link they had (D4).
- Temporary review places are not revived. Reviewers pick Studies up again through normal allocation, with capacity checked as usual.
- Changes made while the search was deleted are applied to the returning Studies, so they match the rest of the project:
- their stored inclusion status and agreement figures are recalculated against the current agreement settings (the threshold may have changed);
- answers to annotation questions deleted in the meantime are removed, exactly as the question deletion removed them from every other Study.
- Stage search filters are as they were before the deletion: the deletion and the restore never change them. One exception, which is not caused by the deletion: if someone saved the "Select Studies for Review" card while the search was deleted, that save cleared the stage's saved search filter, and it stays cleared.
- Refused while the project is deleted ("Restore the project first"), and after the window for anyone but an application administrator ("The restore period has ended. Ask a SyRF administrator."). Waits, like a deletion, while a bulk study update, import, recalculation or another deletion or restore runs in the project.
5. Deleting a project¶
Who. The project owner only. Delete is an owner-reserved activity (OwnerReservedActivities), and
that does not change (D3).
Where. The Danger Zone of Project Settings, as today.
The dialog (proposed copy).
Delete "Pilot 2024"? All 12 members lose access. Imports, PDF uploads and bulk study updates in progress will be cancelled. You can restore the project from Recently deleted projects until 4 November 2026. After that, an application administrator can still restore it. SyRF keeps the data; it is not erased. Type the confirmation phrase · Reason (optional) · [Cancel] [Delete project]
What happens.
- Running work is handled first: every import, PDF upload and bulk study update in the project is cancelled (a bulk update that has already committed is kept and waited for, and a version 1 update that is already applying is waited for, because it cannot be undone); PDF processing past the cancel point, recalculations, exports and search deletions or restores are waited for (in-flight work).
- Then the project disappears from every list: My projects, public projects, the administrator project list, invitations and join requests.
- Every project page and API route answers "This project was deleted on 5 October 2026" to the project's members (HTTP 410 with a typed problem code) and "not found" (404) to everyone else, so the response never reveals that a project the caller never belonged to exists.
- Open browser sessions receive a SignalR event and leave the project.
- Scheduled and background work for the project stops: statistics jobs, daily observations, exports, invitations, queued delegated work. Two kinds keep running because they only release or clean up: reservation timeouts, and Bulk PDF clean-up of cancelled uploads.
- Memberships are kept exactly as they were (D5).
6. Recently deleted projects¶
Where. A "Recently deleted" tab on the projects page (indicative route projects/deleted, the route
the integrated plan's UX strategy reserves).
Who sees what. The owner sees their own deleted projects during the window. Members see nothing here (D5). Application administrators use the administrator route for any deleted project, in or after the window (recommendation; restore window §3).
Each entry shows. Name; deleted by; "Deleted on
Action. Restore, for the owner, within the window.
7. Restoring a project¶
- Who. The owner within the window; application administrators at any time (D3).
- The project returns to every member's list with its members, groups, stages, searches, references and results unchanged.
- Any review place that was still recorded from before the deletion is released; none is revived.
- Its kept statistics are served again; anything that changed while it was deleted is recalculated (statistics §6).
- Members are told through the project's SignalR group if they have it open; no email (MVP).
8. Nothing is erased¶
There is no "Delete permanently" action and no job that erases anything. After the window an item simply leaves the users' Recently deleted view; its data, its stored files and its records stay. The user guide says so plainly. A future erasure policy is a separate decision (restore window §6).
9. In-flight work, at a glance¶
Full design in in-flight work.
| Work in progress | Search deletion | Project deletion | Restore |
|---|---|---|---|
| Bulk PDF upload not yet claimed by the agent | Cancelled, then deletion proceeds (D6) | Same, for every upload of the project | — |
| Bulk PDF processing past the cancel point | Waited for | Waited for | — |
| Search import of the deleted item | Cancelled (D12); its unrevealed Studies are cleaned up as for any failed import (Q7) | Cancelled, every import of the project | Waited for |
| Another search's import | Waited for (recommendation) | — | Waited for |
| Bulk study update, version 2 | Cancelled and rolled back if its plan touches the search's Studies; waited for if not (recommendation) or if already committed | Cancelled and rolled back; waited for if already committed | Waited for |
| Bulk study update, version 1 | Waited for (scope unknown; no rollback) | Cancelled before it applies; waited for while applying | Waited for |
| New imports, uploads and bulk study updates | Refused in the project while the deletion is pending | Same | Same |
| Agreement-threshold recalculation or question deletion | Waited for | Waited for | Waited for |
| Data export | Waited for (with a staleness bound) | Same | — |
| Another deletion or restore in the project | Queued | Queued | Queued |
Temporary review places (SlotReservations) |
Released on the moved Studies | Left to the existing idle and suspended timeouts | Any place older than the deletion is released; none revived |
| Annotation sessions saved as in progress | Kept on the Study; return on restore | Kept | Return as they were |
| Unsaved form input in a browser | Next save refused with the message in §2; input stays in the form | Next request refused; the page leaves the project | — |
| FEAT-024 pending fold entries | A Study moves only when it has none; the fold drains them within about a second | No study writes; the fold stops for the deleted project | Studies return with none |
| Scheduled session timeouts (Quartz) | Fire and find nothing to release | Fire and release as usual | — |
| Invitations and join requests | — | Hidden; accepting is refused | Return |
10. Notifications and audit records¶
Audit ledger (MVP). Every action appends one record to the deletion ledger: SearchDeletionRequested,
SearchDeleted, SearchRestored, ProjectDeletionRequested, ProjectDeleted, ProjectRestored,
UploadCancelledForDeletion, ImportCancelledForDeletion, BulkStudyUpdateCancelledForDeletion and
BulkStudyUpdateAbandonedForDeletion (a version 1 bulk update the deletion stopped waiting for after 30 minutes
without a change). Each
holds the actor (or system), the time, the operation identifier, the scope identifiers and counts
(Studies, sessions, jobs). For a cancelled job the actor is the deleting person and the executor is
system. Records are never edited or expired and hold
no free text; the optional reason lives on the deletion record and is shown in Recently deleted. The
shapes are in data model §5.5.
In-app (MVP). SignalR events to the project's subscribers (SearchDeleted since S4a: per-subscriber
access rechecked at delivery, not a group send): SearchDeleted, SearchRestored,
ProjectDeleted, ProjectRestored. The web drops or reloads the affected entities.
Email and inbox (not MVP). No email is sent. Once the notification programme passes G-NOTIF, the candidates are: members when a project is deleted or restored, and the owner shortly before a project's restore window ends (ACD §7 impact rules, OS-A26 content policy).
Telemetry (MVP). Counters for operations requested, completed, waiting and blocked; gauges for the
number of detached Studies and deleted projects; all tagged only with bounded values (scope search or
project, outcome). Never a project, search or person identifier.