maybe as a new event type

the best you can do now is

select *

the table with

removed: false

but that still has to go through the interval of the scheduler, diff logic after getting the results out of rocksdb, etc

rocksdb should still be involved for the durability of process restarts, network failure, etc but i think a lot of the rest of it can be peeled back and added to the logging subsystem directly in a plugin agnostic way

probably a micro-optimization for something like

usb_devices

but for audit or ebpf, it seems like it would be a fair bit more efficient to marry these two systems together