Keep retained records out of everyday work
A retained record should not quietly reappear in search results or continue contributing to an everyday total. Wildo carries the retained-state boundary through its ordinary data paths, keeping those records hidden and immutable.
Exceptional review uses a separate accountable read, rather than weakening the normal rules.
Example — Keep a dashboard consistent with erasure
A record is retained after its personal fields are scrubbed. It no longer appears in the normal list or contributes through the framework’s retained-row filtering to a chart. The row still exists for its declared retention purpose.
For engineers
Opting a resource into retentionPolicy gives it a retention marker. Repository filtering and aggregation consume one predicate authority. This actual operation set limits which read operations may suppress hiding; carrying the flag into a write does not unlock the row:
Source: retention-hide-predicate.backend.ts (selected excerpt).
export const RETENTION_SEE_THROUGH_SUPPRESSIBLE_CORE_OPERATIONS: readonly CoreResourceOperation[] = [
CoreResourceOperation.READ,
CoreResourceOperation.LIST,
CoreResourceOperation.SEARCH,
CoreResourceOperation.COUNT,
];
Ordinary resource operations inherit the predicate. The MongoDB representation uses a negative comparison that includes records whose marker is missing; PostgreSQL compiles the same meaning with NULL-inclusive semantics. This matters when introducing retention to existing records: unmarked active rows must not disappear.
Use the framework repositories and chart/query mechanisms. A custom raw database read is a separate disclosure surface and must consume the canonical predicate; authoring a similar-looking condition creates a second policy that can drift. The repository guards and check-retention-hide-reach check cover the framework’s known alternate paths.
Treat the marker as lifecycle state, not a UI filter. Hiding a table row in the browser leaves direct requests and aggregates unaffected. For a justified retained-data inspection, use readRetainedAsSystem or its list sibling with human attribution; the exception remains read-only and scoped.