Retention Policy Check

Reliability

Fully deterministic and independent of the machine: no clock is read, and the same request gives the same answer on any host, in any default zone or locale. Every window is half-open, so the action fires exactly when asOf reaches dueAt, not a second later. Day-and-above duration components add as calendar amounts in your declared zone while PT components add on the exact instant timeline, which is why P1D and PT24H differ across a daylight-saving transition — that difference is deliberate, and it is why a Y, M, W or D duration needs a zone. A legal hold is answered before any clause is consulted, so there is no predicate for it to test: metadata.legalHold true returns LEGAL_HOLD_BLOCKED whatever your clauses say. Refusals, and what to do about each. GOV_RETENTION_INPUT_TOO_LARGE means the declared request is past the 65,536-byte inline limit, so send fewer clauses or shorter attributes. GOV_RETENTION_METADATA_INVALID means a metadata field is the wrong shape or past its length — a non-scalar attribute value, an attribute string over 256 characters, an empty timestamps object — and the message names the path. GOV_RETENTION_FIELD_UNKNOWN means a property we do not declare turned up, which we refuse rather than ignore so a stray key can never carry a credential in, so delete it. GOV_RETENTION_POLICY_INVALID means a clause is the wrong shape, such as a missing retention block or a non-string predicate value, so fix the named path. GOV_RETENTION_CLAUSE_ID_DUPLICATE means two clauses share an id, which would make the receipt ambiguous, so make them unique. GOV_RETENTION_CLAUSE_LIMIT_EXCEEDED means more than 100 clauses arrived, so split the policy. GOV_RETENTION_PREDICATE_LIMIT_EXCEEDED means one clause carries more than 16 predicates, so split that clause in two. GOV_RETENTION_PREDICATE_UNSUPPORTED means a predicate name is not one of the three, so correct the name — we accept no regular expression or glob as a predicate, and there is no legal-hold predicate because a hold is answered before matching. GOV_RETENTION_ACTION_UNSUPPORTED means a clause action or your defaultAction is not RETAIN, REVIEW or DELETE; LEGAL_HOLD_BLOCKED is ours to produce and cannot be declared. GOV_RETENTION_MEASURED_FROM_UNSUPPORTED means measuredFrom is not one of the five timestamp names, so pick one of them. GOV_RETENTION_TIMESTAMP_MISSING means a matching clause measures from a timestamp your metadata does not carry, and we refuse rather than fall back to createdAt or skip the clause, so supply that timestamp. GOV_RETENTION_TIMESTAMP_INVALID means a timestamp is not an ISO-8601 instant with an explicit offset, and a local time is never assumed to be UTC, so add the offset. GOV_RETENTION_DURATION_INVALID means a duration is not ISO-8601, is negative, or exceeds the P36500D equivalent, so correct it. GOV_RETENTION_ASOF_INVALID means asOf is missing its offset or is not an instant we can parse, so send the full form. GOV_RETENTION_TIMEZONE_REQUIRED means a clause duration carries a Y, M, W or D component but no timeZone came with it, and calendar addition depends on the zone, so declare one. GOV_RETENTION_TIMEZONE_UNKNOWN means the zone id is not one the platform knows, so use an IANA name such as Europe/Amsterdam rather than an abbreviation. GOV_RETENTION_WORK_REFUSED means the projected predicate evaluations went past 1600, and the refusal reports both the projection and the budget, so reduce clauses or predicates per clause.