drop archive audit log export · detect purge bursts + hold bypass · runs locally
drop archive audit log export · local only
heuristic screener · vendor schema varies · not definitive proof