| 1 | -- Purge work is committed with the destructive transaction, never after it. |
| 2 | -- A successful publish means delivery to the event bus, not consumer completion. |
| 3 | CREATE TABLE purge_jobs ( |
| 4 | subject_id TEXT NOT NULL, |
| 5 | kind TEXT NOT NULL CHECK (kind IN ('user', 'workspace')), |
| 6 | target TEXT NOT NULL, |
| 7 | payload TEXT NOT NULL, |
| 8 | created_at TEXT NOT NULL, |
| 9 | completed_at TEXT, |
| 10 | attempts INTEGER NOT NULL DEFAULT 0, |
| 11 | retry_at TEXT NOT NULL, |
| 12 | last_error TEXT, |
| 13 | PRIMARY KEY (subject_id, target) |
| 14 | ); |
| 15 | CREATE INDEX purge_jobs_pending ON purge_jobs(completed_at, retry_at); |
| 16 | |
| 17 | -- No FK: the case and minimal deletion ledger must survive account erasure. |
| 18 | CREATE TABLE erasure_requests ( |
| 19 | id TEXT PRIMARY KEY, |
| 20 | user_id TEXT NOT NULL, |
| 21 | username TEXT NOT NULL, |
| 22 | requested_at TEXT NOT NULL, |
| 23 | due_at TEXT NOT NULL, |
| 24 | status TEXT NOT NULL DEFAULT 'received' CHECK (status IN ('received','reviewing','completed','refused')), |
| 25 | scope TEXT NOT NULL, |
| 26 | evidence TEXT NOT NULL DEFAULT '', |
| 27 | updated_at TEXT NOT NULL, |
| 28 | updated_by TEXT, |
| 29 | closed_at TEXT |
| 30 | ); |
| 31 | CREATE UNIQUE INDEX erasure_requests_open ON erasure_requests(user_id) WHERE closed_at IS NULL; |
| 32 | |
| 33 | CREATE TABLE erasure_reviews ( |
| 34 | id INTEGER PRIMARY KEY AUTOINCREMENT, |
| 35 | request_id TEXT NOT NULL REFERENCES erasure_requests(id), |
| 36 | at TEXT NOT NULL, |
| 37 | staff TEXT NOT NULL, |
| 38 | status TEXT NOT NULL, |
| 39 | evidence TEXT NOT NULL |
| 40 | ); |