Retention Registry

This page is the lookup surface for POLICY_REGISTRY — the per-(entity_type, content_class) RetentionPolicy entries enforced by spectral.core.retention. For the doctrine — four states, derived state via views, the REFERENCED ⇌ ACTIVE transition, audit posture, late-corruption floor — see Data Retention.

POLICY_REGISTRY keys on (entity_type, content_class). RetentionPolicy.resolve(entity_type, content_class) returns a registered entry or falls back to DEFAULT_POLICY = (active_ttl_days=365, tombstoned_grace_days=30, disposal=HARD_DELETE).

Disposal modes:

• HARD_DELETE — row removed entirely on tombstone-grace expiry.
• STRIP_PAYLOAD — body fields removed; structural metadata + action-linkage row preserved.
• RETAIN_METADATA — disposal applies only on explicit operator soft-delete; metadata persists.

Worlds-domain records (operator-managed authoring artifacts, World Agent memory, source materials, distillation runs, candidate outcomes) map to ContentClass.WORLDS. Operations-context records (control-plane operator actions, internal distillation reasoning) map to ContentClass.OPERATIONS. * means policy applies regardless of content class. Detailed rationale for each entry’s TTL lives in the linked ADRs and code; this page is the at-a-glance catalog.

Event substrate

Entity	Content class	TTL	Grace	Disposal
outbox_row	*	45d	7d	HARD_DELETE
event_handled	*	60d	7d	HARD_DELETE

A contract test pins the inequality event_handled.active_ttl > outbox.active_ttl + outbox.grace. event_handled must strictly exceed the outbox active+grace floor (52 days) to guarantee dedup correctness across the full outbox window.

Decision-execution records

Per Decision Execution — domain-scoped, RLS-isolated per ADR-033 at the domain_id level per ADR-086 D6. Audit-grade records share a 730d active window covering operator-review and customer-review need. Retention discipline anchors on ADR-042, recapped for the decision-time path in ADR-076 D3.

Entity	Content class	TTL	Grace	Disposal
decision_record	PLATFORM	730d	30d	STRIP_PAYLOAD
audit_chain_entry	PLATFORM	730d	30d	STRIP_PAYLOAD
override_pattern_signal	PLATFORM	365d	14d	STRIP_PAYLOAD
system_card_snapshot	PLATFORM	None	30d	RETAIN_METADATA

audit_chain_entry is the per-decision audit record persisted by the platform pillar per ADR-076 D3. decision_record captures the response shape returned to the caller; the audit entry carries the richer trace. override_pattern_signal rows back the customer-initiated review-request and noteworthy-mark flows from the Customer Dashboard. system_card_snapshot opts out of TTL — deployment-scoped operational records remain queryable indefinitely per ADR-082 D3 + the unit-of-authority invariant in ADR-026.

Module store + module integrity

Per ADR-080. Content-addressed; module bundles are immutable artifacts indexed by content hash. Module-store rows opt out of TTL — every published version remains queryable indefinitely as the audit substrate for which code ran for which decision.

Entity	Content class	TTL	Grace	Disposal
action_module_bundle	OPERATIONS	None	30d	RETAIN_METADATA
module_approval_marker	OPERATIONS	None	30d	RETAIN_METADATA

Conversational records

Per ADR-043 — domain-scoped customer conversational records. Conversation persistence carries forward as substrate per ADR-078; the post-release World Agent customer-facing chat affordance (per ADR-081 D5) reuses this substrate. Two-year window matches audit-grade precedent for paired co-queryability with decision records.

Entity	Content class	TTL	Grace	Disposal
conversation	PLATFORM	730d	30d	STRIP_PAYLOAD
conversation_message	PLATFORM	730d	30d	STRIP_PAYLOAD
conversation_channel_binding	PLATFORM	730d	30d	HARD_DELETE
agent_task	PLATFORM	365d	30d	STRIP_PAYLOAD
agent_approval	PLATFORM	730d	30d	STRIP_PAYLOAD

These are domain-scoped activity records, not agent memory. They follow the four-state lifecycle and the RetentionPolicy registry — distinct from the universal three-tier memory schema in ADR-058.

Worlds-side operator-action records

Operator-action audit records persisted by enshrinement-gate, authoring, and distillation handlers. Operator-scoped (app.user_id per ADR-041 D4); no domain RLS.

Entity	Content class	TTL	Grace	Disposal
approval_decision	WORLDS	730d	30d	STRIP_PAYLOAD
world_authoring_audit	WORLDS	730d	30d	STRIP_PAYLOAD
source_material	WORLDS	1825d	30d	RETAIN_METADATA
distillation_run	WORLDS	730d	30d	STRIP_PAYLOAD
distillation_run_source_status	WORLDS	—	—	bound to parent
world_model_card	WORLDS	None	30d	RETAIN_METADATA
release_notes	WORLDS	None	30d	RETAIN_METADATA
release_notes_correction	WORLDS	—	—	bound to parent

source_material carries a five-year window comfortably exceeding domain authority-cycle horizons; the REFERENCED ⇌ ACTIVE transition holds rows cited by enshrined rules indefinitely. world_model_card and release_notes opt out of TTL per ADR-026 — published versions remain authoritative indefinitely.

World Agent memory + worlds-side consumer state

Per world-agent. Action-linked memory at any tier is retained regardless of tier; transient tiers (interaction, session) inherit lifecycle from enclosing scope per ADR-058 D6.

Entity	Content class	TTL	Grace	Disposal
world_agent_memory	WORLDS	tier-driven	—	append-only soft supersession
world_agent_memory_rule_refs	WORLDS	—	—	bound to parent
world_agent_rule_contradictions	WORLDS	status-driven	—	parent-aligned
world_agent_memory_corroborations	WORLDS	—	—	bound to parent
world_agent_memory_embeddings	WORLDS	—	—	bound to parent
rule_candidate_outcomes	WORLDS	730d	30d	STRIP_PAYLOAD
world_agent_t3_projection_replica	WORLDS	TBD	TBD	TBD

Platform-side consumer state

Platform-side projection replicas of worlds-side records. Operator-scoped (app.user_id); no domain RLS.

Entity	Content class	TTL	Grace	Disposal
rule_candidate_outcomes_replica	PLATFORM	730d	30d	STRIP_PAYLOAD