How do we reconcile immutable audit trails with data erasure?

The apparent conflict: regulators want tamper-evident records and the right to erasure. The resolution is in what the chain actually commits to.

Receipts commit to content hashes, not content. So scoped forget (the daemon's GDPR Article 17 operation) can erase the underlying data while every receipt and every chain link remains intact and verifiable. The trail still proves an action happened, by whom, under which grants; what it no longer contains is the erased content itself.

The operational shape:

• Dry-run first. Preview exactly what a scoped forget will remove before committing. No surprises, and the preview supports your Article 17 response.
• Erasure is receipted. The forget operation mints its own receipt, so "we deleted it on this date, to this scope" is provable later.
• Local-first helps. Data that stayed on your machines under the free daemon never entered anyone else's retention problem.

Audit integrity and erasure stop being a trade-off; they are two properties of the same spine.