# What invariants preserve confidentiality survival after obligation discharge?

**Date of Record:** 2026 November 2

**Scope:** Applies to contracts that end with a confidentiality-survival clause — confidentiality obligations persist after the contract terminates. Does not apply to contracts where confidentiality terminates with the contract, or where no confidential information was exchanged.

## Core Distinction

When a contract ends, substantive obligations discharge. Confidentiality often survives — but the survival period is a single number in the contract, while the information it protects has a lifetime that depends on content: trade secrets persist indefinitely, personal data has statutory limits, and regulatory disclosure duties compel release.

**Invariant.** Confidentiality remains sound after discharge if and only if `survival_years >= max(trade_secret_lifetime, personal_data_statutory_limit)` AND `survival_years <= disclosure_duty_window + grace`, where the two bounds are the lower and upper limits respectively.

**Violation.** The **Post-Discharge Leak**. The survival period was set for the average information in the contract; the actual contents include trade secrets (bound has no upper limit) or personal data (bound has a statutory minimum), and either the survival period is too short to protect them, or the survival period blocks a duty to disclose.

**Asymmetry.** Leak is visible in the contract that survives; the mismatch between survival period and actual content is not, because no system tracks what survives against what the survival was meant to protect.

**Recorded elements.** The `survival-clause-receipt` (survival period), the `content-classification-receipt` (what classes of information the contract touched), and the `disclosure-duty-window-signature` (external disclosure obligations that overlap the survival) make the soundness checkable.

## What Was Observed

**Signature.** Trade secrets released while "the contract is over, but the survival expired" is technically true; or disclosure of protected information demanded by a regulator while the survival period still binds, so the party is caught between two duties.

**Trace.** Survival period 3 years. Contract touched trade secrets expected to remain confidential 10+ years. At year 4, the survival expires and confidential material from the contract becomes releasable under the instance's internal rules. The trade secret is functionally disclosed.

**Why monitoring stays green.** The survival clause is in force for the period it specifies. It expires on schedule. No system tracks whether the information remains sensitive after that period.

## Condition of Validity

The instance must ensure at least one holds before it relies on the survival period:

1. **Must classify content.** Every contract touching confidentiality is classified by the lifetime of its most durable information.
2. **Must set survival to the maximum bound.** `survival_years >= max(trade_secret_lifetime, personal_data_statutory_limit)`, not to a generic "3 years" default.
3. **Must reserve for compelled disclosure.** Where a disclosure duty compels release, the survival clause is drafted with a carve-out that permits disclosure without breach.

## Decision Boundary

- Survival >= max(content lifetimes) and carve-out for compelled disclosure: sound.
- Survival = max lifetime, no carve-out: sound against leaks, but the party is caught between duties if compelled.
- Survival < max lifetime: leaks are structural; the survival period is shorter than the information remains sensitive.
- Survival period never linked to content classification: unknown; classify before relying on it.

## Operational Effect

The invariant couples a single contract figure (survival years) to a classification that varies by content and moves with regulation. The instance's correct posture is to derive survival from content, not to apply a default.

**Trap.** Extend survival forever. That protects trade secrets but converts the party into a permanent non-discloser even where the law requires release; the carve-out for compelled disclosure is the necessary complement.

```python
from dataclasses import dataclass


class PostDischargeLeakError(RuntimeError):
    """Raised when a confidentiality-survival period cannot protect the actual information content."""


@dataclass(frozen=True)
class SurvivalGate:
    survival_years: int
    max_content_lifetime_years: int
    disclosure_duty_compelled: bool = False
    compelled_disclosure_carve_out: bool = False

    def verify(self) -> bool:
        if self.disclosure_duty_compelled and not self.compelled_disclosure_carve_out:
            raise PostDischargeLeakError(
                "compelled disclosure duty exists but survival has no carve-out"
            )
        if self.survival_years < self.max_content_lifetime_years:
            raise PostDischargeLeakError(
                f"survival {self.survival_years}y < content lifetime {self.max_content_lifetime_years}y: "
                "protected information becomes releasable before it is non-sensitive"
            )
        return True


def dispatch_survival_mode(gate: SurvivalGate) -> str:
    try:
        gate.verify()
    except PostDischargeLeakError:
        return "extend-and-carve-out"
    return "survival-sound"
```