@wildo-ai/saas-models 1.1.5 → 1.1.7

package/dist/esm/compliance/privacy/subject-erasure.shared.schemas.d.ts

@@ -1,6 +1,9 @@
 import { type ResourceRelationship } from '../../resources/resources.shared.schemas';
 import type { ResourceType } from '../../resources/resources.shared.core.definitions';
-import { ErasureRetentionMode } from './impersonalization.shared.schemas';
+import { ErasureRetentionMode, type StatutoryRetentionGround } from './impersonalization.shared.schemas';
+import type { ApplicationRetentionSchedule, DataRetentionClass, ResourceRetentionBinding, RetentionStartPoint } from './retention-schedule.shared.schemas';
+import type { SubjectErasureLegalHoldRetention } from './legal-holds.shared.schemas';
+import type { SubjectDataRecipientsStatement, SubjectErasureRecipientOutcome } from './subject-data-recipients.shared.schemas';
 /**
  * What a SUBJECT ERASURE does to one child-direction edge of the subject.
  *
@@ -67,6 +70,28 @@ export declare enum SubjectErasureDisposition {
      * Like the other leave-alone dispositions, the erasure does not walk below these rows.
      */
     RESTRICTED_BY_DECLARATION = "restricted_by_declaration",
+    /**
+     * KEEP THE ROWS, RESTRICTED, UNTIL THE LAW LETS THEM GO (#1635) — the child resource declares
+     * `retentionPolicy.statutoryRetention`: its rows are business records a statute requires kept, bound to
+     * `DataRetentionClass.BUSINESS_RECORDS`.
+     *
+     * GDPR Art. 17(3)(b) exempts them from erasure while the statutory period runs, and the erasure applies
+     * the Art. 18(2) restriction instead: each row takes the resource's declared `retentionPolicy.mode`
+     * treatment (scrubbed where the mode says so) and is flipped to `RETAINED`, which the retention
+     * row-hide chokepoints exclude from every ordinary read and write. The rows are LISTED in
+     * `SubjectErasureReport.restrictedUnderStatutoryRetention` with their ground and the instant their period
+     * ends, and the retention-class sweep deletes them then. Every other edge of the request is erased as
+     * usual — a statutory row never refuses the erasure.
+     *
+     * An EXECUTING disposition, like {@link IMPERSONALIZE_AND_RETAIN}, whose treatment it shares. Kept apart
+     * from it, and from {@link RETAINED_BY_DECLARATION}, because the CLAIM differs: those say the author chose
+     * to keep the rows; this says the law requires it, names the ground, and has an end. A reviewer asking
+     * "why is this row still here, and until when?" needs that difference in the receipt, not inferred.
+     *
+     * Like the other retain dispositions, the erasure does not walk below these rows: a kept row still
+     * anchors its own dependents.
+     */
+    RESTRICTED_UNDER_STATUTORY_RETENTION = "restricted_under_statutory_retention",
     /**
      * LEAVE THE ROWS ALONE — the edge is not an ownership edge at all
      * (`lifecycleModelMode` is `INDEPENDENT` or `LINK_ONLY`, or the relationship is disabled). The
@@ -115,7 +140,21 @@ export interface SubjectErasureEdgeClassification {
  */
 export interface SubjectErasureChildRetentionDeclaration {
     readonly mode?: ErasureRetentionMode;
+    /**
+     * The statutory ground the child keeps its rows on (#1635). Present only on a `BUSINESS_RECORDS`-bound
+     * resource — the resource factory refuses it anywhere else. Its presence is what turns the retain
+     * disposition into {@link SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION}.
+     */
+    readonly statutoryRetention?: {
+        readonly ground: StatutoryRetentionGround;
+    };
 }
+/**
+ * True when the erasure runs a teardown for an edge of this disposition, so `executed: false` on it is a
+ * DECLINE — personal data possibly still live — and never an expected leave-alone. Read an edge's
+ * `executed` through this, never through a hand-written list of members.
+ */
+export declare function isExecutingSubjectErasureDisposition(disposition: SubjectErasureDisposition): boolean;
 /**
  * True when a disposition must stop the erasure before any write lands.
  *
@@ -211,7 +250,8 @@ export interface SubjectErasureDescendantEdgePlan {
  *   gone, so whatever depended on them has lost its owner; an erasure that stops at a depth budget
  *   leaves the subject's data one level down with nothing left to reach it. `maxDepth` is a
  *   parent-DELETE performance budget and keeps meaning exactly that on the delete cascade.
- * - **Below an `IMPERSONALIZE_AND_RETAIN` edge — nothing.** The retained row survives, scrubbed, so
+ * - **Below an `IMPERSONALIZE_AND_RETAIN` or `RESTRICTED_UNDER_STATUTORY_RETENTION` edge — nothing.**
+ *   The retained row survives, scrubbed where its mode says so, so
  *   its own dependents still have their owner and remain bound to THAT row's future lifecycle. The
  *   retention obligation that keeps the row is the obligation that keeps what hangs off it; tearing
  *   those down would destroy records a legal obligation required keeping, and scrubbing them would
@@ -250,7 +290,10 @@ export declare function planSubjectErasureDescendantEdges(directChildResourceTyp
 export interface SubjectErasureRetainDeleteConflict<TEdge> {
     /** The resource on the far side of every edge below. */
     resourceType: ResourceType;
-    /** Edges that scrub these rows and keep them (`IMPERSONALIZE_AND_RETAIN`), in plan order. */
+    /**
+     * Edges that keep these rows under a treatment (`IMPERSONALIZE_AND_RETAIN`, or
+     * `RESTRICTED_UNDER_STATUTORY_RETENTION` since #1635), in plan order.
+     */
     retainingEdges: TEdge[];
     /** Edges that hard-delete these rows (`DELETE`), in plan order. */
     deletingEdges: TEdge[];
@@ -305,7 +348,8 @@ export interface SubjectErasureRetainDeleteConflict<TEdge> {
  *
  * ## What is NOT a conflict
  *
- * Only `DELETE` against `IMPERSONALIZE_AND_RETAIN` — the two treatments the erasure EXECUTES. Two deleting or
+ * Only `DELETE` against a retaining treatment the erasure EXECUTES — `IMPERSONALIZE_AND_RETAIN`, and
+ * `RESTRICTED_UNDER_STATUTORY_RETENTION` (#1635), which keeps its rows by the same treatment. Two deleting or
  * two retaining edges agree. `NOT_OWNED` rows are not the subject's, and the erasure never discovers them.
  * Two cases are deliberately NOT refused here. Each is an open decision, not an answer this rule gives:
  *
@@ -488,9 +532,10 @@ export interface SubjectErasureReport {
     /** Every child-direction edge of the subject, classified, in registry order. */
     edges: SubjectErasureEdgeOutcome[];
     /**
-     * `true` once the subject rows themselves were scrubbed and flipped to `RETAINED`. Always `true`
-     * on a successful erasure — an erasure that could not retain its subject throws rather than
-     * returning a report.
+     * `true` once EVERY subject row was scrubbed and flipped to `RETAINED`. An erasure that could not retain its
+     * subject throws rather than returning a report — with one exception: a subject row under an active legal hold
+     * (#1634) is left as it is, reported in {@link heldByLegalHold}, and this is `false` while the rest completes.
+     * Also `false` when no subject row was found (`subjectIds` empty).
      */
     subjectImpersonalized: boolean;
     /**
@@ -528,43 +573,101 @@ export interface SubjectErasureReport {
      * complete erasure.
      */
     externalEffects: SubjectErasureExternalEffectOutcome[];
+    /**
+     * Every row the erasure KEPT because a statute requires it, with the ground and the instant it may go
+     * (#1635) — what an operator tells the data subject under GDPR Art. 12(4) and Art. 19: what was not
+     * erased, why, and until when.
+     *
+     * One entry per row of a {@link SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION} edge
+     * (direct or below a deleted dependent) whose statutory period had NOT ended at the erasure: still
+     * running, or not yet started. Rows only; no field of the row travels here. Empty when nothing
+     * statutory was reached — which is the ordinary answer, and not a sign the capability is off.
+     */
+    restrictedUnderStatutoryRetention: SubjectErasureStatutoryRestriction[];
+    /**
+     * Rows of a statutory edge whose period had ALREADY ended when the erasure reached them (#1635).
+     *
+     * No longer exempt, so they are NOT listed under a legal ground above. The erasure does not delete them
+     * inline: it gives them the same restriction (hidden, frozen, processed for nothing) and the NEXT run of the
+     * retention-class sweep disposes of them through the service layer, cascades included — the one mechanism
+     * that deletes bound rows at period end. Deleting inline was rejected because the erasure's pre-flight
+     * plans walks only below DELETE edges, so the refusals that guard an erasure would not cover the cascades
+     * below these rows. The window is one sweep interval.
+     */
+    releasedToRetentionSweep: SubjectErasureReleasedToRetentionSweep[];
+    /**
+     * Every row the erasure left EXACTLY as it was because a legal hold covers it (#1634) — neither deleted
+     * nor scrubbed, since impersonalization destroys what a hold preserves. One entry per row, with the
+     * grounds, which are what the data subject is told (Art. 17(3)(b)/(e)). The rest of the erasure
+     * completes; an edge whose rows were held reports `executed: false`, and a held subject row leaves
+     * `subjectImpersonalized: false`.
+     */
+    heldByLegalHold: SubjectErasureLegalHoldRetention[];
+    /**
+     * Every recipient that may hold the erased subject's data, and what the erasure did about each (#1710) — the list
+     * Art. 19 asks the controller to communicate to, and to give the data subject on request.
+     *
+     * `statement` names the recipients and the operator's role for the subject's resource type; `outcomes` gives each
+     * operator-account recipient a status (a registered effect's, or the one its declared stance decides — UNMEASURED
+     * when it declares none), and names each tenant-account recipient for the tenant to notify. A recipient no
+     * registered effect reached ALSO appears in {@link externalEffects} under `recipient:<ref>`, so completeness is
+     * judged by the one predicate every reader already uses.
+     */
+    recipients: {
+        statement: SubjectDataRecipientsStatement;
+        outcomes: SubjectErasureRecipientOutcome[];
+    };
+}
+/** One row a subject erasure restricted under a statutory ground instead of erasing (#1635). */
+export interface SubjectErasureStatutoryRestriction {
+    resourceType: ResourceType;
+    rowId: string;
+    /** The GDPR Art. 17(3) exemption the resource declares. */
+    ground: StatutoryRetentionGround;
+    /** The class whose period applies — `BUSINESS_RECORDS` by construction; carried so the entry reads alone. */
+    retentionClass: DataRetentionClass;
+    /** Where the period is counted from — what an operator names when {@link retainedUntil} is `null`. */
+    retentionStartPoint: RetentionStartPoint;
+    /**
+     * The instant after which the row is deleted, under the schedule in force at the erasure.
+     *
+     * `null` when that instant is not yet knowable: the start point has not occurred (a `SCOPE_DELETED`
+     * row whose organization still exists), or the application declares no `BUSINESS_RECORDS` period.
+     * Never a guess — the row stays restricted either way, and the sweep deletes it once both are known.
+     */
+    retainedUntil: Date | null;
+}
+/** One row of a statutory edge whose period had already ended at the erasure (#1635). */
+export interface SubjectErasureReleasedToRetentionSweep {
+    resourceType: ResourceType;
+    rowId: string;
+    /** The instant its statutory period ended — at or before the erasure. */
+    retentionEndedAt: Date;
 }
 /**
- * Edges whose DELETE would reach the SUBJECT'S OWN resource type (#1085).
- *
- * ## The hazard
- *
- * A subject erasure SCRUBS the subject row and keeps it — that is the erasure's contract with the data
- * subject, and it is unconditional: `eraseSubjectInPlace` refuses outright when the subject resource
- * declares no `retentionPolicy`. Since #976 the walk also descends below every dependent it deletes, so
- * a DELETE closure that comes back round to the subject's own type would delete the very row the
- * erasure promised to retain — and the receipt would still report it retained.
- *
- * That last part is why this refuses rather than skips. `SubjectErasureDescendantWalk`'s accounting is
- * written so a receipt can never OVERSTATE an erasure; deleting the scrubbed subject would overstate in
- * the one way nothing downstream can detect, because every edge reports exactly what it did.
- *
- * ## Why the sibling detector cannot do this
- *
- * {@link findSubjectErasureRetainDeleteConflicts} compares two EDGE dispositions. The subject's retention
- * is not an edge — no relationship declares it — so the subject's type is passed in here rather than
- * inferred. It is the whole reason this is a second function and not a case in the first.
+ * Split the rows a statutory edge reached into those still under the statute and those already released
+ * (#1635). Pure: the executor passes the discovered rows, the resource's binding and ground, the schedule it
+ * read, and the erasure instant.
  *
- * ## Measured 2026-09-17: the population is EMPTY, and that is the point
+ * The rule, and its one boundary: a row is released only when `retainedUntil < now` — exactly the rows the
+ * retention-class sweep's strict `start < now − days` (`resolveBoundRetentionCutoff`) selects, because
+ * `start + days < now` is the same inequality. A row whose period ends AT this instant is still under the
+ * statute and the sweep keeps it, so it is listed as restricted. Everything else is restricted too,
+ * including a row whose instant is unknown (`null`): an unknown end is never an ended one.
  *
- * In the engine's core graph `USERS` is never the CHILD of a composition. The one relationship naming it
- * second — `ORGANIZATIONS → USERS` — is a `RelationshipNature.ASSOCIATION` through
- * `ORGANIZATION_MEMBERS`, and an association carries no `onParentDelete` teardown, so no closure can
- * reach it. A guard over an empty population costs nothing at runtime and is exactly the shape worth
- * having: it cannot regress silently, and an application that later declares such an edge meets a
- * refusal before any read or write instead of an erasure that quietly contradicts itself.
- *
- * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.
- *
- * @param plannedEdges - every edge of ONE erasure, each carrying its classification.
- * @param subjectResourceType - the resource being erased, whose row is retained.
- * @returns the offending edges, in plan order. Empty is the healthy answer.
+ * A row without an id is skipped rather than listed: an entry the operator cannot find is not evidence.
  */
+export declare function partitionStatutoryRetentionRows(input: {
+    resourceType: ResourceType;
+    rows: readonly Record<string, unknown>[];
+    binding: ResourceRetentionBinding;
+    ground: StatutoryRetentionGround;
+    schedule: ApplicationRetentionSchedule | undefined;
+    now: Date;
+}): {
+    restricted: SubjectErasureStatutoryRestriction[];
+    released: SubjectErasureReleasedToRetentionSweep[];
+};
 /**
  * Edges that DELETE a resource whose OWN `retentionPolicy` says an erasure keeps its rows (#1279).
  *
@@ -606,6 +709,42 @@ export interface SubjectErasureReport {
 export declare function findSubjectErasureRetentionContradictedEdges<TEdge extends {
     classification: SubjectErasureEdgeClassification;
 }>(plannedEdges: readonly TEdge[], resolveChildRetentionPolicy: (resourceType: ResourceType) => SubjectErasureChildRetentionDeclaration | undefined): TEdge[];
+/**
+ * Edges whose DELETE would reach the SUBJECT'S OWN resource type (#1085).
+ *
+ * ## The hazard
+ *
+ * A subject erasure SCRUBS the subject row and keeps it — that is the erasure's contract with the data
+ * subject, and it is unconditional: `eraseSubjectInPlace` refuses outright when the subject resource
+ * declares no `retentionPolicy`. Since #976 the walk also descends below every dependent it deletes, so
+ * a DELETE closure that comes back round to the subject's own type would delete the very row the
+ * erasure promised to retain — and the receipt would still report it retained.
+ *
+ * That last part is why this refuses rather than skips. `SubjectErasureDescendantWalk`'s accounting is
+ * written so a receipt can never OVERSTATE an erasure; deleting the scrubbed subject would overstate in
+ * the one way nothing downstream can detect, because every edge reports exactly what it did.
+ *
+ * ## Why the sibling detector cannot do this
+ *
+ * {@link findSubjectErasureRetainDeleteConflicts} compares two EDGE dispositions. The subject's retention
+ * is not an edge — no relationship declares it — so the subject's type is passed in here rather than
+ * inferred. It is the whole reason this is a second function and not a case in the first.
+ *
+ * ## Measured 2026-09-17: the population is EMPTY, and that is the point
+ *
+ * In the engine's core graph `USERS` is never the CHILD of a composition. The one relationship naming it
+ * second — `ORGANIZATIONS → USERS` — is a `RelationshipNature.ASSOCIATION` through
+ * `ORGANIZATION_MEMBERS`, and an association carries no `onParentDelete` teardown, so no closure can
+ * reach it. A guard over an empty population costs nothing at runtime and is exactly the shape worth
+ * having: it cannot regress silently, and an application that later declares such an edge meets a
+ * refusal before any read or write instead of an erasure that quietly contradicts itself.
+ *
+ * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.
+ *
+ * @param plannedEdges - every edge of ONE erasure, each carrying its classification.
+ * @param subjectResourceType - the resource being erased, whose row is retained.
+ * @returns the offending edges, in plan order. Empty is the healthy answer.
+ */
 export declare function findSubjectErasureSubjectTypeDeleteEdges<TEdge extends {
     classification: SubjectErasureEdgeClassification;
 }>(plannedEdges: readonly TEdge[], subjectResourceType: string): TEdge[];

package/dist/esm/compliance/privacy/subject-erasure.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subject-erasure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,MAAM,WAAW;IAEjB;;;;OAIG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;OAKG;IACH,SAAS,cAAc;IAEvB;;;;;OAKG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,0DAA0D;IAC1D,iBAAiB,EAAE,YAAY,CAAC;IAChC,2DAA2D;IAC3D,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAQD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,oBAAoB,EAClC,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,gCAAgC,CA4MlC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,2EAA2E;IAC3E,YAAY,EAAE,oBAAoB,CAAC;IACnC,yFAAyF;IACzF,kBAAkB,EAAE,YAAY,CAAC;IACjC,cAAc,EAAE,gCAAgC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,iCAAiC,CAC/C,uBAAuB,EAAE,YAAY,EACrC,kCAAkC,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,oBAAoB,EAAE,GAAG,SAAS,EACtG,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,gCAAgC,EAAE,CAoBpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC,CAAC,KAAK;IACvD,wDAAwD;IACxD,YAAY,EAAE,YAAY,CAAC;IAC3B,6FAA6F;IAC7F,cAAc,EAAE,KAAK,EAAE,CAAC;IACxB,mEAAmE;IACnE,aAAa,EAAE,KAAK,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EACxH,YAAY,EAAE,SAAS,KAAK,EAAE,GAC7B,KAAK,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAclD;AAED;;;GAGG;AACH,MAAM,WAAW,mCAAoC,SAAQ,gCAAgC;IAC3F,wCAAwC;IACxC,kBAAkB,EAAE,YAAY,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,gCAAgC;IACjF;;;;OAIG;IACH,eAAe,EAAE,mCAAmC,EAAE,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kCAAkC;IAC5C,sEAAsE;IACtE,SAAS,cAAc;IACvB;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,YAAY;IACnB,mGAAmG;IACnG,MAAM,WAAW;IACjB;;;OAGG;IACH,cAAc,mBAAmB;IAEjC;;;;OAIG;IACH,UAAU,eAAe;IAEzB;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;CACtD;AAED,gGAAgG;AAChG,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAQT;AAED,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kCAAkC,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,mBAAmB,EAAE,YAAY,CAAC;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE;QAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;IACF;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE,mCAAmC,EAAE,CAAC;CACxD;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,4CAA4C,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EAC7H,YAAY,EAAE,SAAS,KAAK,EAAE,EAC9B,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,KAAK,EAAE,CAIT;AAED,wBAAgB,wCAAwC,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EACzH,YAAY,EAAE,SAAS,KAAK,EAAE,EAC9B,mBAAmB,EAAE,MAAM,GAC1B,KAAK,EAAE,CAIT"}
+{"version":3,"file":"subject-erasure.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/compliance/privacy/subject-erasure.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAMlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACzG,OAAO,KAAK,EACV,4BAA4B,EAC5B,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,KAAK,EAAE,8BAA8B,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAE/H;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,oBAAY,yBAAyB;IACnC;;;;;OAKG;IACH,MAAM,WAAW;IAEjB;;;;OAIG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;OAQG;IACH,uBAAuB,4BAA4B;IAEnD;;;;;;;;;;;;;;;OAeG;IACH,yBAAyB,8BAA8B;IAEvD;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,oCAAoC,yCAAyC;IAE7E;;;;;OAKG;IACH,SAAS,cAAc;IAEvB;;;;;OAKG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,oBAAoB,yBAAyB;CAC9C;AAED,4EAA4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,0DAA0D;IAC1D,iBAAiB,EAAE,YAAY,CAAC;IAChC,2DAA2D;IAC3D,WAAW,EAAE,yBAAyB,CAAC;IACvC;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;KAAE,CAAC;CAC7E;AAuBD;;;;GAIG;AACH,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAWD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,WAAW,EAAE,yBAAyB,GACrC,OAAO,CAET;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,oBAAoB,EAClC,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,gCAAgC,CAqOlC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gCAAgC;IAC/C,2EAA2E;IAC3E,YAAY,EAAE,oBAAoB,CAAC;IACnC,yFAAyF;IACzF,kBAAkB,EAAE,YAAY,CAAC;IACjC,cAAc,EAAE,gCAAgC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iCAAiC,CAC/C,uBAAuB,EAAE,YAAY,EACrC,kCAAkC,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,oBAAoB,EAAE,GAAG,SAAS,EACtG,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,gCAAgC,EAAE,CAoBpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC,CAAC,KAAK;IACvD,wDAAwD;IACxD,YAAY,EAAE,YAAY,CAAC;IAC3B;;;OAGG;IACH,cAAc,EAAE,KAAK,EAAE,CAAC;IACxB,mEAAmE;IACnE,aAAa,EAAE,KAAK,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AACH,wBAAgB,uCAAuC,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EACxH,YAAY,EAAE,SAAS,KAAK,EAAE,GAC7B,KAAK,CAAC,kCAAkC,CAAC,KAAK,CAAC,CAAC,CAclD;AAED;;;GAGG;AACH,MAAM,WAAW,mCAAoC,SAAQ,gCAAgC;IAC3F,wCAAwC;IACxC,kBAAkB,EAAE,YAAY,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,gGAAgG;AAChG,MAAM,WAAW,yBAA0B,SAAQ,gCAAgC;IACjF;;;;OAIG;IACH,eAAe,EAAE,mCAAmC,EAAE,CAAC;IACvD;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,oBAAY,kCAAkC;IAC5C,sEAAsE;IACtE,SAAS,cAAc;IACvB;;;;OAIG;IACH,gBAAgB,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,YAAY;IACnB,mGAAmG;IACnG,MAAM,WAAW;IACjB;;;OAGG;IACH,cAAc,mBAAmB;IAEjC;;;;OAIG;IACH,UAAU,eAAe;IAEzB;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IAErD;;;;;;;;;OASG;IACH,wBAAwB,6BAA6B;CACtD;AAED,gGAAgG;AAChG,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAQT;AAED,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kCAAkC,CAAC;IAC3C;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzF;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,mBAAmB,EAAE,YAAY,CAAC;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gFAAgF;IAChF,KAAK,EAAE,yBAAyB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE;QAClB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,OAAO,CAAC;KACvB,CAAC;IACF;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE,mCAAmC,EAAE,CAAC;IACvD;;;;;;;;;OASG;IACH,iCAAiC,EAAE,kCAAkC,EAAE,CAAC;IACxE;;;;;;;;;OASG;IACH,wBAAwB,EAAE,sCAAsC,EAAE,CAAC;IACnE;;;;;;OAMG;IACH,eAAe,EAAE,gCAAgC,EAAE,CAAC;IACpD;;;;;;;;;OASG;IACH,UAAU,EAAE;QACV,SAAS,EAAE,8BAA8B,CAAC;QAC1C,QAAQ,EAAE,8BAA8B,EAAE,CAAC;KAC5C,CAAC;CACH;AAED,gGAAgG;AAChG,MAAM,WAAW,kCAAkC;IACjD,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,MAAM,EAAE,wBAAwB,CAAC;IACjC,6GAA6G;IAC7G,cAAc,EAAE,kBAAkB,CAAC;IACnC,sGAAsG;IACtG,mBAAmB,EAAE,mBAAmB,CAAC;IACzC;;;;;;OAMG;IACH,aAAa,EAAE,IAAI,GAAG,IAAI,CAAC;CAC5B;AAED,yFAAyF;AACzF,MAAM,WAAW,sCAAsC;IACrD,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,gBAAgB,EAAE,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,YAAY,EAAE,YAAY,CAAC;IAC3B,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACzC,OAAO,EAAE,wBAAwB,CAAC;IAClC,MAAM,EAAE,wBAAwB,CAAC;IACjC,QAAQ,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACnD,GAAG,EAAE,IAAI,CAAC;CACX,GAAG;IAAE,UAAU,EAAE,kCAAkC,EAAE,CAAC;IAAC,QAAQ,EAAE,sCAAsC,EAAE,CAAA;CAAE,CAsB3G;AAGD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,4CAA4C,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EAC7H,YAAY,EAAE,SAAS,KAAK,EAAE,EAC9B,2BAA2B,EAAE,CAC3B,YAAY,EAAE,YAAY,KACvB,uCAAuC,GAAG,SAAS,GACvD,KAAK,EAAE,CAIT;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,wCAAwC,CAAC,KAAK,SAAS;IAAE,cAAc,EAAE,gCAAgC,CAAA;CAAE,EACzH,YAAY,EAAE,SAAS,KAAK,EAAE,EAC9B,mBAAmB,EAAE,MAAM,GAC1B,KAAK,EAAE,CAIT"}

package/dist/esm/compliance/privacy/subject-erasure.shared.schemas.js

@@ -2,6 +2,7 @@ import { RelationshipLifecycleModel, } from '../../resources/resources.shared.sc
 import { Resources_SharedUtils } from '../../resources/resources.shared.utils.js';
 import { ChildLifecycleMode, ChildLifecycleStrategy, } from '../../resources/child-operations.shared.schemas.js';
 import { ErasureRetentionMode } from './impersonalization.shared.schemas.js';
+import { resolveRetentionExpiresAt } from './retention-binding.shared.utils.js';
 /**
  * What a SUBJECT ERASURE does to one child-direction edge of the subject.
  *
@@ -69,6 +70,28 @@ export var SubjectErasureDisposition;
      * Like the other leave-alone dispositions, the erasure does not walk below these rows.
      */
     SubjectErasureDisposition["RESTRICTED_BY_DECLARATION"] = "restricted_by_declaration";
+    /**
+     * KEEP THE ROWS, RESTRICTED, UNTIL THE LAW LETS THEM GO (#1635) — the child resource declares
+     * `retentionPolicy.statutoryRetention`: its rows are business records a statute requires kept, bound to
+     * `DataRetentionClass.BUSINESS_RECORDS`.
+     *
+     * GDPR Art. 17(3)(b) exempts them from erasure while the statutory period runs, and the erasure applies
+     * the Art. 18(2) restriction instead: each row takes the resource's declared `retentionPolicy.mode`
+     * treatment (scrubbed where the mode says so) and is flipped to `RETAINED`, which the retention
+     * row-hide chokepoints exclude from every ordinary read and write. The rows are LISTED in
+     * `SubjectErasureReport.restrictedUnderStatutoryRetention` with their ground and the instant their period
+     * ends, and the retention-class sweep deletes them then. Every other edge of the request is erased as
+     * usual — a statutory row never refuses the erasure.
+     *
+     * An EXECUTING disposition, like {@link IMPERSONALIZE_AND_RETAIN}, whose treatment it shares. Kept apart
+     * from it, and from {@link RETAINED_BY_DECLARATION}, because the CLAIM differs: those say the author chose
+     * to keep the rows; this says the law requires it, names the ground, and has an end. A reviewer asking
+     * "why is this row still here, and until when?" needs that difference in the receipt, not inferred.
+     *
+     * Like the other retain dispositions, the erasure does not walk below these rows: a kept row still
+     * anchors its own dependents.
+     */
+    SubjectErasureDisposition["RESTRICTED_UNDER_STATUTORY_RETENTION"] = "restricted_under_statutory_retention";
     /**
      * LEAVE THE ROWS ALONE — the edge is not an ownership edge at all
      * (`lifecycleModelMode` is `INDEPENDENT` or `LINK_ONLY`, or the relationship is disabled). The
@@ -96,6 +119,36 @@ const BLOCKING_DISPOSITIONS = new Set([
     SubjectErasureDisposition.UNCLASSIFIED,
     SubjectErasureDisposition.UNSUPPORTED_DEFERRED,
 ]);
+/**
+ * Dispositions whose edge the erasure DISPATCHES a teardown for — the ones whose `executed: false` means the
+ * subject's data is partly still live, rather than that the rows were deliberately left alone (#1635).
+ *
+ * THE one list. It was re-derived by hand at four sites (the descendant walk's accounting, the executor's
+ * decline log, the HTTP_API erasure-coherence check in the resources registry, and Wonder Todos'
+ * COMPLETED/FAILED predicate), which is exactly how a new executing member would have been read as
+ * "left alone" by the one site nobody updated.
+ */
+const EXECUTING_DISPOSITIONS = new Set([
+    SubjectErasureDisposition.DELETE,
+    SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN,
+    SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION,
+]);
+/**
+ * True when the erasure runs a teardown for an edge of this disposition, so `executed: false` on it is a
+ * DECLINE — personal data possibly still live — and never an expected leave-alone. Read an edge's
+ * `executed` through this, never through a hand-written list of members.
+ */
+export function isExecutingSubjectErasureDisposition(disposition) {
+    return EXECUTING_DISPOSITIONS.has(disposition);
+}
+/**
+ * Dispositions that KEEP the rows they reach while running a treatment on them — the retaining side of
+ * {@link findSubjectErasureRetainDeleteConflicts}.
+ */
+function isRetainingExecutedDisposition(disposition) {
+    return disposition === SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN
+        || disposition === SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION;
+}
 /**
  * True when a disposition must stop the erasure before any write lands.
  *
@@ -259,6 +312,24 @@ export function classifySubjectErasureDisposition(relationship, resolveChildRete
     const childRetentionPolicy = resolveChildRetentionPolicy(childResourceType);
     if (childRetentionPolicy?.mode !== undefined) {
         const retentionMode = childRetentionPolicy.mode;
+        /*
+         * #1635 — a STATUTORY ground outranks the author's own retain choice, and agrees with an authored
+         * IMPERSONALIZE_AND_RETAIN: both keep the rows; the ground adds WHY and UNTIL WHEN. The treatment the
+         * executor runs is the same retain-and-scrub core, and under `RETAIN_ONLY` it scrubs nothing and still
+         * flips the row to RETAINED — which RETAINED_BY_DECLARATION would not do: that disposition leaves rows
+         * exactly as they are, VISIBLE, and a statutory row must be restricted, not merely left.
+         *
+         * An authored DELETE is NOT absorbed here: it falls through to the switch and is refused by
+         * `findSubjectErasureRetentionContradictedEdges`, for the reason on that function — two declarations
+         * disagree about the same rows and nothing ranks them.
+         */
+        if (childRetentionPolicy.statutoryRetention !== undefined
+            && (authoredStrategy === undefined || authoredStrategy === ChildLifecycleStrategy.IMPERSONALIZE_AND_RETAIN)) {
+            return classify(SubjectErasureDisposition.RESTRICTED_UNDER_STATUTORY_RETENTION, `the child resource declares retentionPolicy.statutoryRetention (ground '${childRetentionPolicy.statutoryRetention.ground}'): ` +
+                `its rows are business records a statute requires kept, so the erasure keeps each row inside its ` +
+                `statutory period RESTRICTED (retained, hidden from ordinary processing) and lists it with the ` +
+                `instant its period ends; the retention-class sweep deletes it then`);
+        }
         const retainDisposition = retentionMode === ErasureRetentionMode.RETAIN_AND_IMPERSONALIZE
             ? SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN
             : SubjectErasureDisposition.RETAINED_BY_DECLARATION;
@@ -331,7 +402,8 @@ export function classifySubjectErasureDisposition(relationship, resolveChildRete
  *   gone, so whatever depended on them has lost its owner; an erasure that stops at a depth budget
  *   leaves the subject's data one level down with nothing left to reach it. `maxDepth` is a
  *   parent-DELETE performance budget and keeps meaning exactly that on the delete cascade.
- * - **Below an `IMPERSONALIZE_AND_RETAIN` edge — nothing.** The retained row survives, scrubbed, so
+ * - **Below an `IMPERSONALIZE_AND_RETAIN` or `RESTRICTED_UNDER_STATUTORY_RETENTION` edge — nothing.**
+ *   The retained row survives, scrubbed where its mode says so, so
  *   its own dependents still have their owner and remain bound to THAT row's future lifecycle. The
  *   retention obligation that keeps the row is the obligation that keeps what hangs off it; tearing
  *   those down would destroy records a legal obligation required keeping, and scrubbing them would
@@ -429,7 +501,8 @@ export function planSubjectErasureDescendantEdges(directChildResourceType, resol
  *
  * ## What is NOT a conflict
  *
- * Only `DELETE` against `IMPERSONALIZE_AND_RETAIN` — the two treatments the erasure EXECUTES. Two deleting or
+ * Only `DELETE` against a retaining treatment the erasure EXECUTES — `IMPERSONALIZE_AND_RETAIN`, and
+ * `RESTRICTED_UNDER_STATUTORY_RETENTION` (#1635), which keeps its rows by the same treatment. Two deleting or
  * two retaining edges agree. `NOT_OWNED` rows are not the subject's, and the erasure never discovers them.
  * Two cases are deliberately NOT refused here. Each is an open decision, not an answer this rule gives:
  *
@@ -455,7 +528,7 @@ export function findSubjectErasureRetainDeleteConflicts(plannedEdges) {
     const byResourceType = new Map();
     for (const edge of plannedEdges) {
         const { disposition, childResourceType } = edge.classification;
-        if (disposition !== SubjectErasureDisposition.DELETE && disposition !== SubjectErasureDisposition.IMPERSONALIZE_AND_RETAIN) {
+        if (disposition !== SubjectErasureDisposition.DELETE && !isRetainingExecutedDisposition(disposition)) {
             continue;
         }
         const key = String(childResourceType);
@@ -540,41 +613,42 @@ export function isIncompleteSubjectErasureExternalEffect(status) {
         || status === SubjectErasureExternalEffectStatus.ACKNOWLEDGED_NON_ERASURE;
 }
 /**
- * Edges whose DELETE would reach the SUBJECT'S OWN resource type (#1085).
- *
- * ## The hazard
- *
- * A subject erasure SCRUBS the subject row and keeps it — that is the erasure's contract with the data
- * subject, and it is unconditional: `eraseSubjectInPlace` refuses outright when the subject resource
- * declares no `retentionPolicy`. Since #976 the walk also descends below every dependent it deletes, so
- * a DELETE closure that comes back round to the subject's own type would delete the very row the
- * erasure promised to retain — and the receipt would still report it retained.
- *
- * That last part is why this refuses rather than skips. `SubjectErasureDescendantWalk`'s accounting is
- * written so a receipt can never OVERSTATE an erasure; deleting the scrubbed subject would overstate in
- * the one way nothing downstream can detect, because every edge reports exactly what it did.
- *
- * ## Why the sibling detector cannot do this
- *
- * {@link findSubjectErasureRetainDeleteConflicts} compares two EDGE dispositions. The subject's retention
- * is not an edge — no relationship declares it — so the subject's type is passed in here rather than
- * inferred. It is the whole reason this is a second function and not a case in the first.
- *
- * ## Measured 2026-09-17: the population is EMPTY, and that is the point
- *
- * In the engine's core graph `USERS` is never the CHILD of a composition. The one relationship naming it
- * second — `ORGANIZATIONS → USERS` — is a `RelationshipNature.ASSOCIATION` through
- * `ORGANIZATION_MEMBERS`, and an association carries no `onParentDelete` teardown, so no closure can
- * reach it. A guard over an empty population costs nothing at runtime and is exactly the shape worth
- * having: it cannot regress silently, and an application that later declares such an edge meets a
- * refusal before any read or write instead of an erasure that quietly contradicts itself.
+ * Split the rows a statutory edge reached into those still under the statute and those already released
+ * (#1635). Pure: the executor passes the discovered rows, the resource's binding and ground, the schedule it
+ * read, and the erasure instant.
  *
- * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.
+ * The rule, and its one boundary: a row is released only when `retainedUntil < now` — exactly the rows the
+ * retention-class sweep's strict `start < now − days` (`resolveBoundRetentionCutoff`) selects, because
+ * `start + days < now` is the same inequality. A row whose period ends AT this instant is still under the
+ * statute and the sweep keeps it, so it is listed as restricted. Everything else is restricted too,
+ * including a row whose instant is unknown (`null`): an unknown end is never an ended one.
  *
- * @param plannedEdges - every edge of ONE erasure, each carrying its classification.
- * @param subjectResourceType - the resource being erased, whose row is retained.
- * @returns the offending edges, in plan order. Empty is the healthy answer.
+ * A row without an id is skipped rather than listed: an entry the operator cannot find is not evidence.
  */
+export function partitionStatutoryRetentionRows(input) {
+    const restricted = [];
+    const released = [];
+    for (const row of input.rows) {
+        const rawId = row._id ?? row.id;
+        const rowId = rawId === undefined || rawId === null ? undefined : String(rawId);
+        if (!rowId)
+            continue;
+        const expiresAt = resolveRetentionExpiresAt(row, input.binding, input.schedule);
+        if (expiresAt !== undefined && expiresAt.getTime() < input.now.getTime()) {
+            released.push({ resourceType: input.resourceType, rowId, retentionEndedAt: expiresAt });
+            continue;
+        }
+        restricted.push({
+            resourceType: input.resourceType,
+            rowId,
+            ground: input.ground,
+            retentionClass: input.binding.retentionClass,
+            retentionStartPoint: input.binding.startPoint,
+            retainedUntil: expiresAt ?? null,
+        });
+    }
+    return { restricted, released };
+}
 /**
  * Edges that DELETE a resource whose OWN `retentionPolicy` says an erasure keeps its rows (#1279).
  *
@@ -617,6 +691,42 @@ export function findSubjectErasureRetentionContradictedEdges(plannedEdges, resol
     return plannedEdges.filter((edge) => edge.classification.disposition === SubjectErasureDisposition.DELETE
         && resolveChildRetentionPolicy(edge.classification.childResourceType)?.mode !== undefined);
 }
+/**
+ * Edges whose DELETE would reach the SUBJECT'S OWN resource type (#1085).
+ *
+ * ## The hazard
+ *
+ * A subject erasure SCRUBS the subject row and keeps it — that is the erasure's contract with the data
+ * subject, and it is unconditional: `eraseSubjectInPlace` refuses outright when the subject resource
+ * declares no `retentionPolicy`. Since #976 the walk also descends below every dependent it deletes, so
+ * a DELETE closure that comes back round to the subject's own type would delete the very row the
+ * erasure promised to retain — and the receipt would still report it retained.
+ *
+ * That last part is why this refuses rather than skips. `SubjectErasureDescendantWalk`'s accounting is
+ * written so a receipt can never OVERSTATE an erasure; deleting the scrubbed subject would overstate in
+ * the one way nothing downstream can detect, because every edge reports exactly what it did.
+ *
+ * ## Why the sibling detector cannot do this
+ *
+ * {@link findSubjectErasureRetainDeleteConflicts} compares two EDGE dispositions. The subject's retention
+ * is not an edge — no relationship declares it — so the subject's type is passed in here rather than
+ * inferred. It is the whole reason this is a second function and not a case in the first.
+ *
+ * ## Measured 2026-09-17: the population is EMPTY, and that is the point
+ *
+ * In the engine's core graph `USERS` is never the CHILD of a composition. The one relationship naming it
+ * second — `ORGANIZATIONS → USERS` — is a `RelationshipNature.ASSOCIATION` through
+ * `ORGANIZATION_MEMBERS`, and an association carries no `onParentDelete` teardown, so no closure can
+ * reach it. A guard over an empty population costs nothing at runtime and is exactly the shape worth
+ * having: it cannot regress silently, and an application that later declares such an edge meets a
+ * refusal before any read or write instead of an erasure that quietly contradicts itself.
+ *
+ * Pure, so a boot-time guard can run it over the same plan the runtime refuses on.
+ *
+ * @param plannedEdges - every edge of ONE erasure, each carrying its classification.
+ * @param subjectResourceType - the resource being erased, whose row is retained.
+ * @returns the offending edges, in plan order. Empty is the healthy answer.
+ */
 export function findSubjectErasureSubjectTypeDeleteEdges(plannedEdges, subjectResourceType) {
     return plannedEdges.filter((edge) => edge.classification.disposition === SubjectErasureDisposition.DELETE
         && String(edge.classification.childResourceType) === String(subjectResourceType));