There is no audit-log retention setting, and adding one is not on the roadmap. That sentence is in the manual, verbatim, and it is a design position, not a gap. The retention policy governs housekeeping data — metrics, ACME session state, notification history. The audit log is deliberately outside it.
The reason is the chain itself: entry N commits to entry N−1. Deleting old entries would not trim the table — it would make every later entry unverifiable, because the first surviving entry refers to a predecessor that no longer exists, and the verdict becomes permanently broken with no way back. A "retention window" on a hash chain is a self-destruct timer with a friendlier name.
Two consequences worth planning for. Volume is managed by checkpointing and by anchoring proofs somewhere you can retire the source system without losing them — not by deletion. And the refusal is enforced, not advisory: a retention document naming auditLog is rejected as an unknown field rather than accepted and ignored, because a setting that silently enforced nothing would be worse than its absence. If your compliance regime demands deletable audit logs, goca is the wrong tool — on purpose.
Now I can explain why the audit log cannot be trimmed, ever.