In _delObject and manage_beforeDelete there's a try/except that catches nearly everything (except BeforeDeleteException and the infamous ConflictError). It then proceeds to log a message, but continues: try: object.manage_beforeDelete(object, self) except BeforeDeleteException, ob: raise except ConflictError: # Added for CPS raise except: LOG('Zope',ERROR,'manage_beforeDelete() threw', error=sys.exc_info()) pass The rationale is, I guess, that when you delete an object you really want it gone. This is IMO very harmful because it hides any bug in the catalog or the indexes (especially during unit tests where LOG is ignored). I've been (again) bitten by it. I'd like to condition the pass to the fact that the current user is Manager. Otherwise I'd like it to fail (and reraise). So a Manager will still be able to delete objects when there's a bug, but not others. Comments ? Florent -- Florent Guillaume, Nuxeo (Paris, France) CTO, Director of R&D +33 1 40 33 71 59 http://nuxeo.com fg@nuxeo.com