Erasure Runbook: One Deletion Across Six Copies Diagram

Six copies, six weapons

Each leaf names its mechanism and its evidence
A copy with no weapon is the finding — register it, never drop it
Fast copies close left, slow copies close right

Two weapons for the log

Tombstone + compact: append delete-X, rewrite segments without the user
Or shred the per-user key: instant unreadability, destruction receipt
Data lingers until rewritten — say so, with the teaching retention

Slow copies stay honest

Backups expire by retention; restores replay through tombstones
Training excludes the user at the next retrain — lag documented, not hidden
Deadlines need a lawyer; the runbook names them uncertain