Subject Deletion
The platform-wide cascade triggered when an End User Directory row is deleted. ADR 0012 (LtM tombstone + 30d hard-delete) and ADR 0014 (Trajectory Store crypto-erase) wired to one audit bus.
Sync SLA
< 24h
end-to-end across both stores
Object lock preserved
WORM 7y
ciphertext stays; DEK destroyed
Hard-delete window
+30 days
Compliance forensics buffer (LtM)
Deletion fan-out
Two stores, two mechanisms, one bus. Future per-end_user_id stores wire into this same cascade.
Long-term Memory
Two-phase: tombstone + read filter (sync, ≤24h) → OpenSearch hard delete (+30d)
Trajectory Store
Crypto-erase per-(agent, end_user) DEK in customer KMS. Object lock preserved on ciphertext.
Recent requests
Each row is a SubjectDeletionRequested → SubjectDeletionFinalized lifecycle. Audit bus events are object-locked.
eu_8c2f4a1b
Customer Operationssync-completeRequested 11d ago · sync complete 11d ago · finalisation due 2026-06-21
sd-2026-05-22-001
Long-term Memory
Tombstone + read-time filter (Phase 1)
Trajectory Store
Crypto-erase per-(agent,end_user) DEK
eu_3f0a8d77
Claimssync-completeRequested 1mo ago · sync complete 1mo ago · finalisation due 2026-05-30
sd-2026-04-30-007
Long-term Memory
Tombstone + read-time filter (Phase 1)
Trajectory Store
Crypto-erase per-(agent,end_user) DEK
eu_b66c10a2
Customer OperationsfinalisedRequested 1mo ago · sync complete 1mo ago
sd-2026-04-04-019
Long-term Memory
Phase 2 hard-delete via OpenSearch delete-by-query
Trajectory Store
Crypto-erase per-(agent,end_user) DEK