The RETENTION IS LOAD-BEARING comment sits directly above _quarantine_entry()
in digest.sh — the actual writer of dead-letter.jsonl (issue #953 names
store.sh, but store.sh only READS the ledger; the write site is here).
The ledger is append-only history AND the sole evidence base for store.sh
quarantine-audit's conviction predicate (#946). Rotation/pruning/caps would
silently convert provable rows into unprovable ones with no signal at either
end — the audit's clean sweep reads identically before and after evidence
disappears. The comment records the requirements any future retention limit
must ship with (loud prune-time signal + audit residual-class reporting
updated in the same change), and that nothing pruning this file is a
recorded decision, not an omission.
Comment-only: zero behavior delta. manifest.txt deliberately NOT touched —
keeps the declared #964/#967 version collision two-way.
Closes#953
Written-by: pepper (sb-it-1-dt)
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB