# Bilko — RetentionPurgeWorker DRY-RUN (B2, MC #105881)

# RetentionPurgeWorker DRY-RUN (B2)

**MC:** #105881 (parent #105872) · **Autor:** Bruce Momjian (CodeCraft) + Graff red-zone review · **Verdict:** PASS (FORGE MLX peer-verify PASS) · **Grana:** azdo (rebase tip 844fc11c, NIJE main-merge dok red-zone gate ne prođe)

## Šta radi

Dry-run purge worker: čita `document_retention_manifest` + `entity_type_mapping` (V133) + `entity_type_retention_policy` + `legal_retention_years`, **LOGUJE kandidate za purge, NIŠTA NE BRIŠE**. Sada kad je #105965 mapping integrisan, dry-run NALAZI kandidate (prije: fail-safe skip → 0).

## Dokaz

39/39 Testcontainers (postgres:16) zeleno end-to-end na merge-anoj grani: V131(9)+V132(9)+V133(5)+RetentionPurgeWorkerTest(16), uklj. `candidatesFound > 0` asertaciju + V121 companion "ukloni mapping → test pada". Evidence: `~/system/evidence/105881/verdict-b2-finalization-2026-07-19.md`.

## Cron mehanizam

`RetentionPurgeCronRoutes.kt` — POST `/api/v1/internal/retention/purge-dry-run`, `PURGE_CRON_SECRET` header auth, fail-closed 503, mounted u Routing.kt (isti pattern kao InvoiceCronRoutes/ComplianceCronRoutes). **INERTAN** dok se ne provisionira `PURGE_CRON_SECRET` + eksterni trigger. Odluka: app-cron fallback; pg_cron (Azure Flexible) optimizacija odgođena do #105964 RBAC.

## 🔴 Red-zone invarijante (7, svaka grep-verifikovana, ne pretpostavljena)

1. `DRY_RUN` hard-coded `true`, nema override. 2. Nula DELETE/UPDATE/DROP dodano #105965 integracijom (samo read-only SELECT lookup). 3. `purge_expired_partition()` i dalje bez ijednog caller-a, bez novog EXECUTE granta. 4. `bilko_purge_worker` write grant nepromijenjen/uzak. 5. mapping-miss fallback matchuje samo human-authored policy redove (companion test). 6. cron ruta fail-closed/inert. 7. `entity_type_mapping` + `entity_type_retention_policy` read-only kroz worker (svaki ref = .selectAll()). Graff review: `~/system/evidence/105881/graff-review.md`.

## Odnos prema B3

**B3 live purge (#105882) = jedina preostala CEO-sign-off tačka cijelog programa.** B2 ne dodaje nijedan EXECUTE/DELETE/DROP grant (grep-potvrđeno). Živi purge se ne može desiti dok CEO eksplicitno ne odobri B3 + ne provisionira live flag + PURGE_CRON_SECRET.