Forget On Schedule — a Nightly Retention Sweeper You Can Actually Prove

What you'll do

A nightly retention sweeper you own end to end: a plain-text retention schedule that states, per class of data, which date starts its clock and how long it lives; a read-only plan mode that is the default and shows you every candidate before anything moves; guardrails that refuse to leave your declared roots, refuse to follow symlinks, refuse to cross filesystems, and stop the run cold when a rule would act on more than your cap allows; a two-phase expiry where items first move atomically into a dated waiting area and only become permanently gone after a grace window and a verified-backup gate; holds that outrank every rule and are re-checked in the last instant before the irreversible step; an append-only JSONL ledger plus an explain command that reconstructs any single decision months later; a restore command you have actually used; and three drills you have actually run — a runaway rule stopped by the cap, a sweeper killed mid-apply and repaired by reconcile, and a held item that survived its own due date.