# OSHUN V1 Tombstone Semantics This document is generated from `libs/oshun/persistence/src/tombstone-semantics.ts`. Deletion in the V1 persistence layer is a soft tombstone. Rows are not physically deleted during user-data deletion flows, and backfills are guarded so tombstoned rows are not silently recreated. ## Invariants - Every V1 contract table has `tombstoned_at`, `tombstone_reason`, `tombstone_actor_id`, and `tombstone_source` fields. - Every tombstone write emits an idempotent audit event into `oshun_v1_tombstone_audit_events`. - Runtime tombstones fail closed when the audit delegate is not configured; the repository will not write an unaudited tombstone. - Tombstone updates use `COALESCE` and `WHERE tombstoned_at IS NULL` so retries do not rewrite the original deletion metadata. - Backfill upserts are allowed to insert missing live rows, but conflict updates are blocked when the target row is already tombstoned. - Live upserts refuse tombstoned identities. Re-activation requires an explicit audited restore workflow rather than a normal write path. - Propagation operates at the source-record scope first and then at the domain-tenant scope for bulk privacy/delete operations. - Domain-tenant propagation flows through `ContractPersistenceService.tombstoneDomainTenant`, which walks every registered contract table for that domain and records the propagation root in each audit event. | Domain | Contract | Table | Audit table | Propagation scopes | | ------------- | ---------------------------------- | -------------------------------------------- | --------------------------------- | ---------------------------- | | tara | `DurationBucketSchema` | `v1_tara_duration_bucket` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | tara | `LineageTaxonomySchema` | `v1_tara_lineage_taxonomy` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | tara | `RitualStepSchema` | `v1_tara_ritual_step` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | tara | `RitualTemplateSchema` | `v1_tara_ritual_template` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | tara | `ContinuationStateSchema` | `v1_tara_continuation_state` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | tara | `RitualSessionSchema` | `v1_tara_ritual_session` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `HabitSchema` | `v1_arete_habit` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `GoalSchema` | `v1_arete_goal` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `RoutineSchema` | `v1_arete_routine` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `CheckInSchema` | `v1_arete_check_in` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `JournalEntrySchema` | `v1_arete_journal_entry` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `WeeklyReviewSchema` | `v1_arete_weekly_review` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `StreakRecordSchema` | `v1_arete_streak_record` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `FrictionSignalSchema` | `v1_arete_friction_signal` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `InterventionSchema` | `v1_arete_intervention` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | arete | `CoachingSummarySchema` | `v1_arete_coaching_summary` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `StorySchema` | `v1_veritas_story` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `ClaimSchema` | `v1_veritas_claim` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `SourceSchema` | `v1_veritas_source` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `EvidencePackSchema` | `v1_veritas_evidence_pack` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `CounterclaimSchema` | `v1_veritas_counterclaim` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `TopicHubSchema` | `v1_veritas_topic_hub` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `TimelineSchema` | `v1_veritas_timeline` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `StoryUpdateSchema` | `v1_veritas_story_update` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `CorrectionNoteSchema` | `v1_veritas_correction_note` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | veritas | `RetractionCascadeSchema` | `v1_veritas_retraction_cascade` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nyx | `SkyEventSchema` | `v1_nyx_sky_event` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nyx | `ObservationWindowSchema` | `v1_nyx_observation_window` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nyx | `PredictionSourceRefSchema` | `v1_nyx_prediction_source_ref` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nyx | `CalendarSyncEntrySchema` | `v1_nyx_calendar_sync_entry` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nyx | `LoggedObservationSchema` | `v1_nyx_logged_observation` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | library | `LibraryCollectionSchema` | `v1_library_library_collection` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | atelier | `AtelierSceneSchema` | `v1_atelier_atelier_scene` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | studio | `StudioSceneSchema` | `v1_studio_studio_scene` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `MetisCourseProposalSchema` | `v1_metis_course_proposal` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | tara | `SittingCompletionEventSchema` | `v1_tara_sitting_completion_event` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | messaging | `MessagingAccountLinkSchema` | `v1_messaging_account_link` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | identity | `ScimIdentitySchema` | `v1_identity_scim_identity` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `PassageSchema` | `v1_nisaba_passage` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `ManuscriptSchema` | `v1_nisaba_manuscript` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `EditionSchema` | `v1_nisaba_edition` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `TranslationSchema` | `v1_nisaba_translation` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `LexiconEntrySchema` | `v1_nisaba_lexicon_entry` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `MorphologyEntrySchema` | `v1_nisaba_morphology_entry` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `AnnotationSchema` | `v1_nisaba_annotation` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `ConceptGraphNodeSchema` | `v1_nisaba_concept_graph_node` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `ConceptGraphEdgeSchema` | `v1_nisaba_concept_graph_edge` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `NotebookSchema` | `v1_nisaba_notebook` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `StudyPlanSchema` | `v1_nisaba_study_plan` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `CitationSchema` | `v1_nisaba_citation` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | nisaba | `ScholarProfileSchema` | `v1_nisaba_scholar_profile` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `LearningSourceBundleSchema` | `v1_metis_learning_source_bundle` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `GroundingPackSchema` | `v1_metis_grounding_pack` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `CourseBuildSchema` | `v1_metis_course_build` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `LessonAssetBundleSchema` | `v1_metis_lesson_asset_bundle` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `PublicationPackageSchema` | `v1_metis_publication_package` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `TutorPersonaProfileSchema` | `v1_metis_tutor_persona_profile` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `TutorSessionMemorySchema` | `v1_metis_tutor_session_memory` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `LearningObjectiveMapSchema` | `v1_metis_learning_objective_map` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `AssessmentEvidencePackSchema` | `v1_metis_assessment_evidence_pack` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `LearningTelemetryStatementSchema` | `v1_metis_learning_telemetry_statement` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | metis | `AcademicIntegrityVerdictSchema` | `v1_metis_academic_integrity_verdict` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `PersonaSchema` | `v1_cross_cutting_persona` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `VoiceProfileSchema` | `v1_cross_cutting_voice_profile` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `AvatarPackSchema` | `v1_cross_cutting_avatar_pack` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `ConsentRecordSchema` | `v1_cross_cutting_consent_record` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `MemoryScopeSchema` | `v1_cross_cutting_memory_scope` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `EvidencePackSchema` | `v1_cross_cutting_evidence_pack` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `CitationTrailSchema` | `v1_cross_cutting_citation_trail` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `GroundedAnswerEnvelopeSchema` | `v1_cross_cutting_grounded_answer_envelope` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `WorkflowTemplateSchema` | `v1_cross_cutting_workflow_template` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `ModelCardSchema` | `v1_cross_cutting_model_card` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `ModelVersionSchema` | `v1_cross_cutting_model_version` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `ProvenanceBundleSchema` | `v1_cross_cutting_provenance_bundle` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `ReviewPackageSchema` | `v1_cross_cutting_review_package` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `IncidentSchema` | `v1_cross_cutting_incident` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `PolicyBundleSchema` | `v1_cross_cutting_policy_bundle` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `SupportCaseSchema` | `v1_cross_cutting_support_case` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `TenantSchema` | `v1_cross_cutting_tenant` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `TenantHierarchyEdgeSchema` | `v1_cross_cutting_tenant_hierarchy_edge` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `TenantPolicyInheritanceSchema` | `v1_cross_cutting_tenant_policy_inheritance` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant | | cross-cutting | `AgentRunSchema` | `v1_cross_cutting_agent_run` | `oshun_v1_tombstone_audit_events` | source-record, domain-tenant |