The timed-ledger spectrum.

{ "ttl": "T5" }           // 2 592 000 s — Monthly preset
{ "ttl": "90d" }          // 7 776 000 s — ninety days
{ "ttl": "5m" }           // 300 s — five minutes
{ "ttl": "2h30m" }        // 9 000 s — compound duration
{ "ttl": "forever" }      // 0 — unbounded (equivalent to T7)
{ "ttl": 7776000 }        // 90 days as canonical seconds

// Take the head of a T2 operational ledger, re-sign every entry with Falcon-1024,
// and emit a permanent T6 anchor. Existing T2 Ed25519 signatures remain
// valid for offline replay; the durable copy uses post-quantum cryptography.

fn promote_t2_to_t6(src: LedgerHandle, dst_spec: TierSpec) -> Result[Promotion, Error] {
    assert(dst_spec.sig_scheme == Falcon1024);
    let head = src.head();
    let checkpoint = build_checkpoint(src, head);
    let dst = open_ledger(dst_spec);
    dst.append_attested(checkpoint, hatp_host_key());
    anchor_now(dst, AnchorPolicy::MerklePermanent);
    Ok(Promotion { src_head: head, dst_head: dst.head() })
}

// Destroy the per-record AES key in the vault. The header (with its hash
// chain & signature) survives; the payload becomes unrecoverable bytes.

fn shred_entry(handle: LedgerHandle, cid: bytes32) -> Result[ShredReceipt, Error] {
    let entry_key = vault_key_for(cid);
    vault_destroy(entry_key);
    handle.mark_shredded(cid, ts_now());
    Ok(ShredReceipt { cid, ts_ms: ts_now(), proof: handle.head_attestation() })
}

// Parse accepts a preset name, duration string, "forever", or raw ms integer.
// Returns the canonical TTLSpec with resolved TTLMs.

spec, err := ttlspec.Parse("T5")
// → TTLSpec{ TTLMs: 2_592_000_000, Preset: &Preset{Name:"t5"}, SourceStr:"T5" }

spec, err = ttlspec.Parse("90d")
// → TTLSpec{ TTLMs: 7_776_000_000, SourceStr:"90d" }

spec, err = ttlspec.Parse("forever")
// → TTLSpec{ TTLMs: 0, SourceStr:"forever" }   // unbounded

// Auto-bucket to nearest policy triple (RFC-EPH-TTL-001 §4)
policy := ttlspec.DeriveTierPolicyV2(spec.TTLMs)
// → AnchorPolicy, SigScheme, StoreClass derived from resolved TTL

// ExpiryHeap is a thread-safe min-heap over (expiresAtMs, ledgerID).
// O(1) peek, O(K log N) for K expired ledgers per tick.

h := retention.NewExpiryHeap()
h.Push(ledgerHex, expiresAtMs)

// Garbage-collection tick — called by the scheduler
expired := h.PopExpired(time.Now().UnixMilli())
for _, e := range expired {
    engine.GC(e.LedgerHex)
}