A retired SI's workstation carries the admin's choice — retire_disposition (KEEP, DELETE_NOW, DELETE_AFTER) and delete_after, written only by their own UPDATE (updatable = false, like the AI session columns, so a sweep's stale save cannot undo it); RetireChoice parses and validates it (none = KEEP, DELETE_AFTER 1-365 days, default 7); findDueForDeletion reads only due rows through the partial index, oldest first, LIMITed; AccessLogEventType gains AI_WORKSTATION_AUTO_DELETED