---
apiVersion: manual-runbook/v1
id: normalize-recycle-bin-deletedby-20260429
title: "Audit legacy _System_RecycleBin.DeletedBy display-name rows before any manual canonicalization"
description: "Manual audit/runbook for historical _System_RecycleBin.DeletedBy rows that still store mutable display names instead of canonical User.Id ownership. This file is explicit protocol-outside documentation only: no automatic bootstrap rewrite is allowed, and no data-spec runner may apply it."
issue: "#2150, PR #2241 Codex Review"
created: 2026-04-29
scope: production-only
status: manual-review-required
tables_modified:
  - _System_RecycleBin
tables: [_System_RecycleBin]
idempotent: false
risk: high
reviewers: ["@codeowners"]
depends_on: []
---

# Audit legacy `_System_RecycleBin.DeletedBy` rows before any manual repair

**Protocol status: this is a manual operator runbook, not a `data-spec/v1`
apply target.** The SQL below contains row-specific placeholders and must stay
outside the automated `data-spec-apply` protocol.

## Why this exists

Historical recycle-bin rows stored `DeletedBy` as the deleter's display name.
The current write path stores `User.Id`, and the runtime ownership checks for
Bucket C now treat the recycle-bin entry itself as the authority. Keeping a
display-name fallback in runtime is unsafe because display names are mutable and
non-unique.

So the long-term model is:

1. runtime reads and writes own recycle-bin ownership through `User.Id` only
2. no automatic rewrite guesses history from current display names
3. any legacy row repair must be manual, row-specific, and operator-audited
4. ambiguous or weakly-evidenced rows fail closed rather than being reassigned

## Why there is no automatic migration

A unique current display-name match is not proof of historical ownership:

1. a user can rename their display name after deleting a record
2. a different user can later adopt the old display name
3. current uniqueness still would not prove who deleted the historical row

Because `DeletedBy` controls who can list, restore, and purge a recycle-bin
entry, a guessed rewrite can permanently transfer ownership to the wrong user.
This is precisely the kind of stale-legacy-to-SSoT repair that must stay out of
bootstrap/runtime code.

## Audit queries

### 1. List legacy rows whose DeletedBy is not already a canonical User.Id

```sql
SELECT rb.Id, rb.RecordId, rb.ObjectAPIName, rb.DeletedBy, rb.DeletedDate
FROM _System_RecycleBin rb
LEFT JOIN User u ON u.Id = rb.DeletedBy
WHERE u.Id IS NULL
ORDER BY rb.DeletedDate DESC, rb.Id;
```

### 2. For each legacy DeletedBy label, show all current users who match it

```sql
SELECT
  rb.DeletedBy,
  u.Id,
  u.Username,
  TRIM(CONCAT(COALESCE(u.FirstName, ''), ' ', COALESCE(u.LastName, ''))) AS DisplayName
FROM _System_RecycleBin rb
JOIN User u
  ON TRIM(CONCAT(COALESCE(u.FirstName, ''), ' ', COALESCE(u.LastName, ''))) = rb.DeletedBy
WHERE NOT EXISTS (
  SELECT 1 FROM User canonical WHERE canonical.Id = rb.DeletedBy
)
ORDER BY rb.DeletedBy, u.Id;
```

This query is for audit evidence only. It MUST NOT be used as an unattended
rewrite source.

## Verification

Before any manual repair, collect:

```sql
SELECT COUNT(*)
FROM _System_RecycleBin rb
LEFT JOIN User u ON u.Id = rb.DeletedBy
WHERE u.Id IS NULL;
```

And for any row you plan to rewrite, retain operator evidence showing why the
target `User.Id` is historically correct. Examples of acceptable evidence:

1. immutable audit/event logs from the deletion time
2. a separate business record that stores the deleter's immutable user id
3. a bounded manual review signed off by the operator for a specific row set

## Manual repair shape

Only after operator review, apply row-specific updates guarded by both the
recycle-bin row id and the exact legacy `DeletedBy` value:

```sql
UPDATE _System_RecycleBin
SET DeletedBy = '<canonical-user-id>', LastModifiedDate = NOW()
WHERE Id = '<recycle-bin-row-id>' AND DeletedBy = '<legacy-display-name>';
```

This spec is intentionally not idempotent as a bulk operation because each row
needs human-reviewed evidence before execution.