Q127: erasure removes the subject's content and keeps only a receipt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/database/migrations/090-erasure-receipts.ts

@@ -0,0 +1,23 @@
+// Deletion records made before receipts copied the erased data into themselves; that copy is removed here.
+// Audit events stay immutable except for one change: an erasure may replace a payload with the redaction marker, nothing else.
+export const erasureReceiptsSchema = `
+  update compliance_exports
+  set payload_json = '{"erased":null,"note":"This record once held a copy of the erased data; it was removed."}'
+  where export_type = 'gdpr_delete';
+
+  drop trigger if exists trg_audit_events_no_update;
+  create trigger trg_audit_events_no_update
+  before update on audit_events
+  for each row
+  when not (
+    new.payload_json is '{"redacted":true}'
+    and new.id is old.id and new.org_id is old.org_id and new.entity_type is old.entity_type and new.entity_id is old.entity_id
+    and new.actor_type is old.actor_type and new.actor_id is old.actor_id and new.action is old.action and new.created_at is old.created_at
+  )
+  begin
+    select raise(abort, 'Audit events are immutable.');
+  end;
+
+  insert into schema_migrations(version, name, applied_at)
+  values (90, 'erasure_receipts', datetime('now'));
+`;

src/main/database/schema.ts

@@ -88,6 +88,7 @@ import { heldDeliverablesSchema } from "./migrations/086-held-deliverables";
 import { goalAuditorSchema } from "./migrations/087-goal-auditor";
 import { hostAccessNoteSchema } from "./migrations/088-host-access-note";
 import { fileVersionsSchema } from "./migrations/089-file-versions";
+import { erasureReceiptsSchema } from "./migrations/090-erasure-receipts";
 
 interface Migration {
   version: number;
@@ -185,6 +186,7 @@ const MIGRATIONS: Migration[] = [
   { version: 87, name: "goal_auditor", sql: goalAuditorSchema },
   { version: 88, name: "host_access_note", sql: hostAccessNoteSchema },
   { version: 89, name: "file_versions", sql: fileVersionsSchema },
+  { version: 90, name: "erasure_receipts", sql: erasureReceiptsSchema },
 ];
 
 const SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;