The PII key that never enters the log

Time-travel storage has a compliance problem: if every write is logged, deleted personal data survives in the log. Hoody's KV history is per-write. Ordinary keys keep their full operation trail: that's the audit history your auditor loves. The keys holding personal data get written with ?history=false from day one: the value exists, the shadow copies don't. When a user invokes deletion, the delete: sent with the same flag: removes the only copy there ever was.

The system stays honest about the gap, too: point-in-time listings return those keys in gap_keys, recording that something was there without recording what. Retention for what must be kept, absence for what mustn't.