An automated review of #1189 flagged a retention gap in the review retention pass. In crates/registry-casework/src/review.rs, casework_review_clock_occurrences rows are deleted only where accountability_retained_until <= now, while the request context, tasks, drafts and history are scrubbed at the earlier result expiry.
Failure scenario: a review kind configured with terminalDays < accountabilityDays keeps completed activity-clock rows until the later accountability deadline. Those rows still carry the source, subject type and subject identifiers, the clock policy and the evaluated effects, so source-linked review data survives well past the declared terminal retention, potentially by years at the allowed bounds.
Suggested fix:
- Delete terminal-only activity occurrences at result expiry, keeping the existing carve-out for subject clocks that genuinely continue across review rounds (those move their request binding to the latest round).
- Add a Postgres retention test for a kind with
terminalDays < accountabilityDays.
Filed from the review of #1189; not merge-blocking.
An automated review of #1189 flagged a retention gap in the review retention pass. In
crates/registry-casework/src/review.rs,casework_review_clock_occurrencesrows are deleted only whereaccountability_retained_until <= now, while the request context, tasks, drafts and history are scrubbed at the earlier result expiry.Failure scenario: a review kind configured with
terminalDays < accountabilityDayskeeps completed activity-clock rows until the later accountability deadline. Those rows still carry the source, subject type and subject identifiers, the clock policy and the evaluated effects, so source-linked review data survives well past the declared terminal retention, potentially by years at the allowed bounds.Suggested fix:
terminalDays < accountabilityDays.Filed from the review of #1189; not merge-blocking.