Erasure requests and legal holds

Delete telemetry rows on request (GDPR right to erasure) with an audit trail.

• POST /v1/projects/{prj}/deletions (DeleteTelemetry): kind is filter (a Lucene query over logs or traces) or user (attribute subject.key, default user.id and enduser.id; logs, traces and error tags). from is inclusive, to exclusive. preview: true only counts matching rows per signal.

• States: pending_approval, queued, running, verifying, completed, failed, cancelled. Projects with deletion_approval = second_admin (default) need POST .../{id}/approve from a different user with ManageSecurity; self-approval is 422. POST .../{id}/cancel stops a request that has not started.

• The janitor deletes the rows in ClickHouse, verifies none match, marks overlapping archive_objects as erased_at (the archiver rewrites them) and completes the request with a SHA-256 ledger hash. The request's compiled conditions stay in deletion_requests.filter; wt_query::erasure::rules_from_ledger and predicate_for give rehydration the predicate that drops erased rows. traces erasure leaves trace_index_v1 summaries (no payload).

• Audit actions: deletion.create|approve|cancel|complete, legal_hold.create|release. Metadata holds the filter text and the subject key, never matched data or the subject value.

Legal holds

POST|GET /v1/orgs/{org}/legal-holds, DELETE .../{id} (ManageSecurity). A hold covers a project (or the whole org), optional signals and an optional filter. While active, deletions, retention shortening and project delete or purge answer 409 legal_hold (detail names the hold id). The janitor sets retention_days = 36500 on held rows hourly so TTL cannot drop them. A hold with a filter narrows only the TTL extension; overlap checks for blocking are by project and signal.