Deleting the file is the one thing the journal never forgets

Litigation hold lands on a Tuesday. The IT question is the usual one: did anyone delete anything after the notice went out?

With journaling enabled on the container, GET /api/v1/journal?op=delete&since=<notice> answers it. Every delete entry carries the file's before hash and blob_before: true: the content the deletion was meant to remove is still addressable. Nobody set that up. The filesystem keeps it.

Before the custodian signs the preservation certificate, one call: POST /api/v1/journal/flush. It returns flushed: true or a 503: the certificate is signed against a durable log, not a buffered one. Outside counsel pulls the same journal by after_id cursor into their own container, so the record of the record isn't in your custody either.

For any exhibit, ?at=<hold date>&hash returns the SHA256 as it stood that day.