[kvlonge]

Why

Lowering time travel retention permanently discards history, but builds applied decreases with only a plan warning. Targets also could not set different retention per materialization without a project-wide default that also applied to other targets.

Changes

• New target setting time_travel_retention_decrease = "deny" | "require_confirmation" | "allow". Default: deny. Builds (direct, virtual, dbt interop) fail before any warehouse change when the plan would lower live retention. require_confirmation takes --allow-retention-decrease or an interactive phrase, like table-type downgrades.
• Execution never lowers retention outside a gated decrease: post-build reconciliation skips decreases it did not plan (for example, retention raised by someone else mid-build), except on tables created or recreated during the build. Clone namespace decreases run only when the target policy is allow.
• Target retention accepts a table: time_travel_retention = { table = "90d", incremental = "30d", snapshot = "365d" }. A plain string still sets a target-wide default. Priority: model header, then target plus materialization, then [materialization_defaults], then the target default.
• Plan JSON retention entries include decrease_policy.

Verification

• CLI build integration tests on DuckDB with faked live retention: default deny, confirmation with and without the flag, allow, increases never gated, and precedence. Checked that they fail with the gate or precedence disabled.
• Unit tests: gate, config parsing and errors, local overrides, reconciliation guard, clone namespace policy.
• make test and make check-ci pass, public-repo scan clean, one review cycle with findings fixed and re-verified.