Scheduled Retention Purge: Disposal at Window Close

What changed

The scheduled equivalent of organisation erasure, left disarmed in 5.82.0, is now armed. SpeyBooks can dispose of an organisation automatically once its seven-year custodial window has closed and it has been deactivated, without an administrator initiating each one by hand. Every disposal now records whether it was made by an administrator or by the scheduler, so the two are told apart in the record that outlives the data. The schedule itself is a separate, deliberate switch: the capability ships armed, and begins running only when it is turned on.

Why it matters

A custodial commitment to hold records for exactly seven years, no longer, is only as good as the thing that lets them go at the end. Doing that by hand for every organisation does not scale, and it makes the most destructive act in the system depend on someone remembering to perform it. This release makes the discharge of the commitment something the system does on its own, on the same gated and provable terms as the manual route, so storage limitation is honoured without a person in the loop for each case.

The terms are deliberately strict, because the act cannot be undone. An organisation is eligible for automatic disposal only when two things are both true: its seven-year window has closed, measured from its last closed accounting period, and it has been deactivated. Deactivation is not a convenience here, it is a safety property. A deactivated organisation cannot open a new accounting period, so its window cannot quietly re-open between the moment the scheduler judges it eligible and the moment it disposes of it. A live organisation, however old its records, is never selected. The asymmetry is the whole point. The customer’s statutory duty is to keep these records for six years; SpeyBooks holds them for seven, a deliberate year beyond it. Holding longer still is only a storage cost. Disposing early erodes the margin SpeyBooks committed to, and disposing before the sixth year destroys records the customer is still required to keep, which cannot be undone. So the schedule errs the only safe way.

Until 5.82.0, a disposal record could not say whether a disposal was an administrator’s decision or an automatic one. They are now distinguished in the surviving record, so an audit of disposals can tell a deliberate administrative erasure from a scheduled one at a glance.

How it is enforced

Eligibility asks the same question, the same way, as the manual route. The scheduler decides closure with the very component the manual erasure uses, computed from the latest closed accounting period on the database clock. An organisation with no closed period produces an indeterminate window and is never selected, exactly as the manual route refuses it. The schedule cannot reach a more permissive verdict than a person could, because it is the same verdict.

Both conditions are required, and the deactivation condition freezes the window. Disposal proceeds only when the window is closed and the organisation is deactivated. The deactivated condition does double duty: it is the operator’s confirmation that the organisation is finished, and it is what makes the eligibility check safe against a window re-opening underneath it, since a deactivated organisation cannot add the period that would re-open it.

Each disposal reuses the manual routine, not a parallel copy of it. The scheduler does not reimplement the irreversible act. It selects, then hands each organisation to the same two-phase, recoverable, data-layer-guarded routine that backs the manual erasure, so the disposal a schedule performs is identical in every safety property to one an administrator performs. One organisation is disposed of per pass, in order, and a failure on one does not stop the rest.

Every run leaves a receipt, even an empty one. Each pass of the scheduler records what it did: how many organisations were eligible, how many were disposed of, skipped, or failed. A run that finds nothing due still writes its receipt, so a quiet schedule is provably a schedule that ran and found nothing, never a schedule that has silently stopped. (Enforced at the data layer, migration 121.)

Automatic and administrative disposals are distinguished in the record. The disposal record now carries which kind of disposal it was, and the database requires that mark to be present on every organisation disposal and absent on everything else. A scheduled disposal cannot be recorded as an administrative one by omission, because the database refuses a disposal record that does not say which it is. (Enforced at the data layer, migration 121.)

How it is proven

Every guarantee above ships with an executable check that runs on each deploy, against the live database rather than a mock. The new anchors cover each reason an organisation is held back, an active organisation, a deactivated one still inside its window, a closed window on an organisation that was never deactivated, and one with no accounting period at all, and they prove the distinguishing mark lands correctly: a scheduled disposal is recorded as scheduled, an administrative one as administrative, in the surviving record.

The release went out with all sixteen pipeline phases green and zero violations: 292 executable checks across 27 files, the surface-money and schema-coverage and provenance gates all clean, and the migration self-registered and verified. The change rests on one database migration, applied under the same review the destructive routine earns, with a dry run proving every gate against the live schema before the real apply.

Operational impact

There is no change to the API surface; this is a scheduled operation, not an endpoint. The disposal record gains a field recording whether a disposal was administrative or scheduled, set on every organisation disposal from now on, and existing administrative disposals are classified as such. A successful scheduled disposal removes every dependent record in one cascade and leaves its disposal record behind, the same as the manual route. There are no breaking changes.

Deferred

The schedule arms the capability but does not start it. Turning the schedule on is a separate, deliberate act, and at this stage no organisation is yet old enough to be eligible, so there is no urgency to start it. The external timestamp proof on the disposal record, an OpenTimestamps receipt, remains deferred to its own release, as in 5.82.0. One boundary is recorded and held: where a customer holds capital items that carry a longer statutory retention than seven years under the VAT Capital Goods Scheme, that obligation sits with the customer as the controller of their records, and a setting to flag such organisations and hold them back from the schedule will ship before any customer in that position is taken on.