@loomwork/compliance 0.0.0-stage → 0.1.0

package/dist/eraseSubject.js

@@ -0,0 +1,1294 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EraseCoordinator = exports.ControlStreamKeyError = exports.ContentCopiesRemainError = exports.SenderRedactionUnsupportedError = exports.ArchivedCopiesRemainError = exports.defaultSenderMatches = exports.ERASURE_STREAM = void 0;
+exports.claimCheckRefsOf = claimCheckRefsOf;
+exports.trustedClaimCheckRefsOf = trustedClaimCheckRefsOf;
+const node_crypto_1 = require("node:crypto");
+const event_runtime_1 = require("@loomwork/event-runtime");
+const replay_vm_1 = require("@loomwork/replay-vm");
+const snapshot_runtime_1 = require("@loomwork/snapshot-runtime");
+const SubjectIndex_1 = require("./SubjectIndex");
+// ── T3-R3/R4.5 — subject erasure (GDPR Art. 17, right to be forgotten) ─────────
+//
+// Erasure destroys a subject's crypto key so its sensitive fields become unrecoverable
+// (K10.2). The one hard rule (R4.5): NEVER shred a fold that is still in flight — a live
+// execution reading the just-destroyed key would fail. So erasure is liveness-gated:
+//   • all of a subject's executions terminal  → shred now.
+//   • any still live                          → PARK the request (durable ERASURE_PENDING on a
+//                                               control stream) and complete it automatically
+//                                               when the last live execution terminates.
+// Parking is honest (the request is recorded, not silently dropped) and survives a restart
+// (the control stream folds back to the pending set).
+/** Reserved control stream carrying deferred-erasure facts (ERASURE_PENDING). */
+exports.ERASURE_STREAM = "__loom_erasure__";
+const TERMINAL_STATUS = new Set([
+    "completed",
+    "failed",
+    "cancelled",
+    "continued",
+]);
+const TERMINAL_STATUS_OF_EVENT = new Map([
+    ["EXECUTION_COMPLETED", "completed"],
+    ["EXECUTION_FAILED", "failed"],
+    ["EXECUTION_CANCELLED", "cancelled"],
+    ["EXECUTION_CONTINUED", "continued"],
+]);
+const TERMINAL_EVENTS = new Set([
+    "EXECUTION_COMPLETED",
+    "EXECUTION_FAILED",
+    "EXECUTION_CANCELLED",
+    "EXECUTION_CONTINUED",
+]);
+/** The default: the sender's `actor` is the subject id (and, in a tenant partition, the tenant agrees). */
+const defaultSenderMatches = (subjectId, tenant, sender) => sender.actor === subjectId && (tenant === SubjectIndex_1.DEFAULT_TENANT || sender.tenant === tenant);
+exports.defaultSenderMatches = defaultSenderMatches;
+/**
+ * The staging prefix an EARLIER build used to rewrite a segment list (read, stage, delete, re-add). The
+ * rewrite is now one atomic `ArchiveStore.replaceSegments` (SPI 1.1.0) and nothing writes a stage any
+ * more; {@link EraseCoordinator.recoverRedactions} still restores one such a build left behind.
+ */
+const REDACT_STAGE = "__loom_redact__:";
+/** The control-stream event types of the erasure's archive work (intent first, then the completion). */
+const ARCHIVE_DELETE_INTENDED = "ERASURE_ARCHIVE_DELETE_INTENDED";
+const ARCHIVE_DELETED = "ERASURE_ARCHIVE_DELETED";
+const CONTENT_DELETE_INTENDED = "ERASURE_CONTENT_DELETE_INTENDED";
+const CONTENT_DELETED = "ERASURE_CONTENT_DELETED";
+const SENDER_REDACTION_INTENDED = "ERASURE_SENDER_REDACTION_INTENDED";
+const SENDER_REDACTED = "ERASURE_SENDER_REDACTED";
+/**
+ * Closes `ERASURE_PENDING` rows once their subject is erased: `{ pendingIds }`, the ids of the rows it
+ * closes (never a subject). Without it every park ever written was reloaded as parked after a restart,
+ * and a later execution of an erased subject was erased automatically when it ended.
+ */
+const PENDING_CLEARED = "ERASURE_PENDING_CLEARED";
+/** ADR 0143 D5: how many distinct citing executions per address the ownership proof is tried under. */
+const MAX_CITERS_PER_ADDRESS = 16;
+/** How many times a redaction of one key retries a concurrent writer's conflict before it gives up loudly. */
+const REDACT_RETRIES = 16;
+/**
+ * Erasure cannot complete while a plaintext archive still holds the subject's segments and offers no
+ * way to delete them. Thrown BEFORE the key is destroyed (nothing was shredded).
+ */
+class ArchivedCopiesRemainError extends Error {
+    streams;
+    retryable = false;
+    constructor(streams) {
+        super(`refusing to erase: a plaintext archive holds the subject's archived copies (${streams.slice(0, 5).join(", ")}${streams.length > 5 ? ` (+${streams.length - 5} more)` : ""}) and has no deleteExecution, so erasure could not remove them (a key's destruction does not reach plaintext). Use an archive that can delete (the in-memory, SQLite and Postgres archives can), or seal the archive under the event store's KeyStore (EncryptingArchiveStore). Nothing was shredded.`);
+        this.streams = streams;
+        this.name = "ArchivedCopiesRemainError";
+        Object.setPrototypeOf(this, ArchivedCopiesRemainError.prototype);
+    }
+}
+exports.ArchivedCopiesRemainError = ArchivedCopiesRemainError;
+/**
+ * Erasure cannot complete: a plaintext archive holds other chains' archived inbox envelopes naming the
+ * subject as their sender, and it cannot rewrite a segment atomically (`replaceSegments`, ArchiveStore SPI
+ * 1.1.0), so the identity could not be redacted. Thrown BEFORE the key is destroyed (nothing was shredded).
+ */
+class SenderRedactionUnsupportedError extends Error {
+    streams;
+    retryable = false;
+    constructor(streams) {
+        super(`refusing to erase: a plaintext archive holds the subject's identity as the sender of archived inbox envelopes (${streams.slice(0, 5).join(", ")}${streams.length > 5 ? ` (+${streams.length - 5} more)` : ""}) and has no replaceSegments (ArchiveStore SPI 1.1.0), so erasure could not redact it. Use an archive that can (the in-memory, SQLite and Postgres archives can), or seal the archive and the senders under the event store's KeyStore (EncryptingArchiveStore). Nothing was shredded.`);
+        this.streams = streams;
+        this.name = "SenderRedactionUnsupportedError";
+        Object.setPrototypeOf(this, SenderRedactionUnsupportedError.prototype);
+    }
+}
+exports.SenderRedactionUnsupportedError = SenderRedactionUnsupportedError;
+/**
+ * Erasure cannot complete: the subject's logs cite claim-checked blobs (ADR 0140) in a content store that
+ * erasure cannot delete from, or cannot prove other executions do not cite. Thrown BEFORE the key is
+ * destroyed (nothing was shredded).
+ */
+class ContentCopiesRemainError extends Error {
+    count;
+    retryable = false;
+    constructor(count, why) {
+        super(`refusing to erase: the subject's executions cite ${count} claim-checked blob(s) in a PLAINTEXT content store and ${why}, so a key's destruction would leave the subject's tool outputs behind. Nothing was shredded.`);
+        this.count = count;
+        this.name = "ContentCopiesRemainError";
+        Object.setPrototypeOf(this, ContentCopiesRemainError.prototype);
+    }
+}
+exports.ContentCopiesRemainError = ContentCopiesRemainError;
+/** Every claim-check envelope ref `value` cites (iterative, cycle-safe; the `ref` leaf is not descended). */
+function claimCheckRefsOf(value, into = new Set()) {
+    const stack = [value];
+    const seen = new WeakSet();
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (typeof current !== "object" || current === null || seen.has(current))
+            continue;
+        seen.add(current);
+        const env = current;
+        const address = env.__loomClaimCheck === true ? env.ref?.__loomContent : undefined;
+        if (typeof address === "string")
+            into.add(address);
+        for (const [key, item] of Object.entries(current)) {
+            if (typeof address === "string" && key === "ref")
+                continue;
+            stack.push(item);
+        }
+    }
+    return into;
+}
+/**
+ * ADR 0140 D11 - the claim-check refs an execution cites at a TRUSTED position: the top-level `output`
+ * of a recorded `STEP_COMPLETED` (through a taint wrapper). An envelope the opt-in preset wrote sits
+ * exactly there; one NESTED inside a tool's result is tool-authored data and may be forged, so it is not
+ * evidence that anyone cites the blob.
+ */
+function trustedClaimCheckRefsOf(events, into = new Set()) {
+    let sawStep = false;
+    for (const e of events) {
+        if (e.eventType !== "STEP_COMPLETED")
+            continue;
+        sawStep = true;
+        let out = e.payload?.output;
+        if (typeof out === "object" &&
+            out !== null &&
+            out.__loomTainted !== undefined) {
+            out = out.value;
+        }
+        if (typeof out !== "object" || out === null)
+            continue;
+        const env = out;
+        const address = env.__loomClaimCheck === true ? env.ref?.__loomContent : undefined;
+        if (typeof address === "string")
+            into.add(address);
+    }
+    return { refs: into, sawStep };
+}
+/**
+ * An erasure met an OPEN control-stream intent written under a `controlStreamKey` this coordinator
+ * does not hold, so it cannot tell whether the intent is this subject's. Fail closed: pass the key
+ * that wrote it in `previousControlStreamKeys` (`keyId` names it) and retry.
+ */
+class ControlStreamKeyError extends Error {
+    keyId;
+    intentId;
+    constructor(keyId, intentId) {
+        super(`erasure control stream: open intent ${intentId} was written under controlStreamKey ${keyId}, which this coordinator does not hold; pass that key in previousControlStreamKeys and retry`);
+        this.keyId = keyId;
+        this.intentId = intentId;
+        this.name = "ControlStreamKeyError";
+    }
+}
+exports.ControlStreamKeyError = ControlStreamKeyError;
+const MIN_CONTROL_KEY_BYTES = 16;
+const defaultWarn = (message) => {
+    console.warn(`[loom] ${message}`);
+};
+/**
+ * Coordinates liveness-gated subject erasure and the auto-completion of parked requests.
+ * Feed `handleEvent` the event stream (e.g. from `defineConfig`'s `onEvent`) so a parked
+ * erasure completes the moment the subject's last live execution terminates.
+ */
+class EraseCoordinator {
+    options;
+    // Parked requests keyed by `tenant\x00subject` (T3-R2.4 — two tenants may share a subject
+    // id; they must not collide into one park entry). Authoritative live view; also durable.
+    parked = new Set();
+    // Parked requests restored from a `subjectRef` row (`controlStreamKey`): only the digest is durable.
+    parkedRefs = new Set();
+    // The control-stream keys (`controlStreamKey` first, then the previous ones) and their fingerprints.
+    controlKeys;
+    constructor(options) {
+        this.options = options;
+        const keys = [
+            ...(options.controlStreamKey !== undefined ? [options.controlStreamKey] : []),
+            ...(options.previousControlStreamKeys ?? []),
+        ];
+        if (options.controlStreamKey === undefined && keys.length > 0) {
+            throw new TypeError("previousControlStreamKeys needs a controlStreamKey: new rows are written under the current key");
+        }
+        for (const key of keys) {
+            const bytes = typeof key === "string" ? Buffer.byteLength(key) : key.byteLength;
+            if (bytes < MIN_CONTROL_KEY_BYTES) {
+                throw new TypeError(`controlStreamKey must be a secret of at least ${MIN_CONTROL_KEY_BYTES} bytes (got ${bytes}): a short key lets anyone test guessed subject ids against the control stream`);
+            }
+        }
+        this.controlKeys = keys.map((key) => ({
+            key,
+            id: (0, node_crypto_1.createHmac)("sha256", key).update("loom-erasure-key-id").digest("hex").slice(0, 16),
+        }));
+    }
+    /** Best-effort: repopulate the parked set from the durable control stream (restart recovery). */
+    async loadParked() {
+        // The parked set FIRST: it is what the key-window guard reads, so a failure of the archive recovery
+        // below must never leave it empty (that would fail open).
+        const control = await this.options.eventStore.read(exports.ERASURE_STREAM);
+        const cleared = clearedPendingIds(control);
+        for (const event of control) {
+            if (event.eventType === "ERASURE_PENDING" && !cleared.has(event.id)) {
+                const p = event.payload;
+                if (typeof p.subjectRef === "string") {
+                    this.parkedRefs.add(p.subjectRef);
+                    if (!this.controlKeys.some((k) => k.id === p.keyId)) {
+                        (this.options.onWarn ?? defaultWarn)(`erasure coordinator: parked request ${event.id} was written under controlStreamKey ${String(p.keyId)}, which this coordinator does not hold; it will not auto-complete until that key is passed in previousControlStreamKeys (or the erasure is re-issued)`);
+                    }
+                }
+                else if (typeof p.subjectId === "string") {
+                    this.parked.add(parkKey(p.tenant ?? SubjectIndex_1.DEFAULT_TENANT, p.subjectId));
+                }
+            }
+        }
+        // ADR 0139 N1: a stage an earlier build left (a crash mid-redaction) is restored at BOOT, not at the
+        // next erasure that happens to scan the archive. A failing archive (down, unreadable) is LOUD but not
+        // fatal here: recovery stays pending, to be retried by `recoverRedactions` (the operator verb
+        // `app.recoverArchiveRedactions`) and by the next redaction.
+        try {
+            await this.recoverRedactions();
+        }
+        catch (err) {
+            (this.options.onWarn ?? defaultWarn)(`erasure coordinator: restoring interrupted archive redactions failed (${err instanceof Error ? err.message : String(err)}); the parked erasures were loaded, and the recovery stays pending - retry it with recoverArchiveRedactions() once the archive is reachable`);
+        }
+    }
+    /**
+     * ADR 0139 D22 (owner ruling 2026-10-31) - REINSTATE an erased message sender: the explicit, RECORDED
+     * operator verb that lets a sender erased by {@link eraseSubject} send again, under a NEW handle (their
+     * old messages stay erased and unlinkable to it). Without it a send from an erased sender keeps throwing
+     * `SenderErasedError`. Journaled on the control stream: `SENDER_REINSTATE_INTENDED` first, then
+     * `SENDER_REINSTATED` with the keyed non-identifying `ref`, the epoch, who (`options.by`) and when;
+     * NEVER the plaintext identity. Resolves with whether anything was reinstated (`false`: the sender is
+     * not erased, or never sent). Throws unless the coordinator was given `reinstateSender`.
+     */
+    async reinstateSender(actor, tenant = SubjectIndex_1.DEFAULT_TENANT, options = {}) {
+        const reinstate = this.options.reinstateSender;
+        if (reinstate === undefined) {
+            throw new TypeError("reinstateSender needs the crypto layer's default sender handles: pass `reinstateSender` to the EraseCoordinator (defineConfig wires it from the crypto event store)");
+        }
+        const by = options.by ?? "operator";
+        const intentId = await this.appendControl("SENDER_REINSTATE_INTENDED", {
+            ...(tenant !== SubjectIndex_1.DEFAULT_TENANT && { tenant }),
+            by,
+            at: Date.now(),
+        });
+        const result = await reinstate(actor, tenant);
+        await this.appendControl("SENDER_REINSTATED", {
+            ...(tenant !== SubjectIndex_1.DEFAULT_TENANT && { tenant }),
+            intentId,
+            by,
+            at: Date.now(),
+            reinstated: result.reinstated,
+            ...(result.ref !== undefined && { ref: result.ref }),
+            ...(result.epoch !== undefined && { epoch: result.epoch }),
+        });
+        return result;
+    }
+    /** Request erasure of a subject within a tenant. Shreds now if all executions are terminal, else parks. */
+    async eraseSubject(subjectId, tenant = SubjectIndex_1.DEFAULT_TENANT, options = {}) {
+        const executions = this.options.index.executionsOf(subjectId, tenant);
+        if (executions.length === 0) {
+            return { subjectId, outcome: "unknown", erased: [], pending: [] };
+        }
+        const shredParked = options.parked === "shred";
+        if (shredParked && this.options.cancel === undefined) {
+            throw new TypeError('eraseSubject({ parked: "shred" }) cancels each parked owner before shredding: pass `cancel` to the EraseCoordinator (defineConfig wires it)');
+        }
+        const proof = this.proofFor(options.force);
+        let nonTerminal = await this.liveExecutions(executions, proof);
+        // `defer`: every non-terminal execution blocks. `shred`: only a RUNNING one does.
+        let live = shredParked
+            ? nonTerminal.filter((x) => x.status !== "suspended").map((x) => x.id)
+            : nonTerminal.map((x) => x.id);
+        let parkedOwners = [];
+        if (shredParked && live.length === 0 && nonTerminal.length > 0) {
+            // No owner may be left stuck: cancel every parked one FIRST (the log is still readable and
+            // the fence is the runtime's own). A failure, or an owner that is not terminal afterwards,
+            // defers the subject.
+            parkedOwners = nonTerminal.map((x) => x.id);
+            try {
+                for (const id of parkedOwners)
+                    await this.options.cancel(id, "erased");
+            }
+            catch {
+                // fall through to the recheck: whatever did not become terminal blocks the shred
+            }
+            nonTerminal = await this.liveExecutions(executions, proof);
+            live = nonTerminal.map((x) => x.id);
+        }
+        if (live.length === 0) {
+            // Resolved BEFORE the key is destroyed: a decrypting store cannot read these logs afterwards.
+            const chains = await this.finishedChains(executions, proof);
+            // ADR 0138 / 0139: a plaintext archive that cannot delete would outlive the erasure - refuse BEFORE
+            // the key is destroyed.
+            await this.assertArchivesErasable(subjectId, tenant, executions, chains);
+            // ADR 0140: the claim-checked blobs the subject's logs cite, collected (and the intent journaled)
+            // BEFORE the key is destroyed - afterwards the logs are unreadable.
+            const content = await this.planContentDeletion(subjectId, tenant, executions, proof);
+            if (options.force !== undefined) {
+                await this.options.shred(subjectId, executions, { force: options.force });
+            }
+            else {
+                await this.options.shred(subjectId, executions);
+            }
+            await this.options.eraseSender?.(subjectId, tenant);
+            await this.purgeInboxStreams(chains);
+            const archived = await this.deleteArchivedCopies(subjectId, tenant, executions, chains);
+            const contentDeleted = await this.finishContentDeletion(subjectId, tenant, content);
+            const redactions = await this.redactSenderCopies(subjectId, tenant);
+            await this.clearPending(subjectId, tenant);
+            this.unpark(subjectId, tenant);
+            return {
+                subjectId,
+                outcome: "erased",
+                erased: executions,
+                pending: [],
+                ...(archived !== undefined && { archivedCopiesDeleted: archived }),
+                ...(contentDeleted !== undefined && { contentDeleted }),
+                ...(redactions.length > 0 && { senderRedactions: redactions }),
+                ...(shredParked && { parkedShredded: parkedOwners }),
+            };
+        }
+        // R4.5 — a live fold is in flight; record the request durably and defer (unless the caller owns
+        // the retry: `record: false` writes nothing and registers nothing).
+        if (options.record !== false && !this.isParked(subjectId, tenant)) {
+            this.parked.add(parkKey(tenant, subjectId));
+            await this.appendPending(subjectId, tenant);
+        }
+        return { subjectId, outcome: "parked", erased: [], pending: live };
+    }
+    /** Complete a parked erasure when the subject's last live execution terminates. */
+    async handleEvent(event) {
+        if (!TERMINAL_EVENTS.has(event.eventType))
+            return;
+        if (this.parked.size === 0 && this.parkedRefs.size === 0)
+            return;
+        const subjectId = this.options.index.subjectOfExecution(event.executionId);
+        if (subjectId === undefined)
+            return;
+        const tenant = this.options.index.tenantOfExecution(event.executionId) ?? SubjectIndex_1.DEFAULT_TENANT;
+        if (!this.isParked(subjectId, tenant))
+            return;
+        const executions = this.options.index.executionsOf(subjectId, tenant);
+        if ((await this.liveExecutions(executions, this.options.destroyed)).length > 0)
+            return; // still blocked
+        const chains = await this.finishedChains(executions, this.options.destroyed);
+        await this.assertArchivesErasable(subjectId, tenant, executions, chains);
+        const content = await this.planContentDeletion(subjectId, tenant, executions, this.options.destroyed);
+        await this.options.shred(subjectId, executions);
+        await this.options.eraseSender?.(subjectId, tenant);
+        await this.purgeInboxStreams(chains);
+        await this.deleteArchivedCopies(subjectId, tenant, executions, chains);
+        await this.finishContentDeletion(subjectId, tenant, content);
+        await this.redactSenderCopies(subjectId, tenant);
+        await this.clearPending(subjectId, tenant);
+        this.unpark(subjectId, tenant);
+    }
+    /**
+     * Close the subject's open `ERASURE_PENDING` rows (either form) now that it is erased, so a restart
+     * does not park it again. Written LAST: a crash before it leaves the request parked, and completing
+     * it again is idempotent. Names the rows, never the subject.
+     */
+    async clearPending(subjectId, tenant) {
+        const control = await this.options.eventStore.read(exports.ERASURE_STREAM);
+        const cleared = clearedPendingIds(control);
+        const pendingIds = control
+            .filter((e) => e.eventType === "ERASURE_PENDING" &&
+            !cleared.has(e.id) &&
+            this.rowNames(e.payload, subjectId, tenant))
+            .map((e) => e.id);
+        if (pendingIds.length > 0)
+            await this.appendControl(PENDING_CLEARED, { pendingIds });
+    }
+    /** Whether a request to erase the subject is parked (registered in memory or restored from either row form). */
+    isParked(subjectId, tenant) {
+        if (this.parked.has(parkKey(tenant, subjectId)))
+            return true;
+        return this.subjectRefs(subjectId, tenant).some((ref) => this.parkedRefs.has(ref));
+    }
+    unpark(subjectId, tenant) {
+        this.parked.delete(parkKey(tenant, subjectId));
+        for (const ref of this.subjectRefs(subjectId, tenant))
+            this.parkedRefs.delete(ref);
+    }
+    /**
+     * The keyed digests a control row may name the subject by: one per held key, the current key's first
+     * (`[]` without `controlStreamKey`). Each part is length-prefixed, so no (tenant, subject) pair can
+     * be spelled as another.
+     */
+    subjectRefs(subjectId, tenant) {
+        const input = `loom-erasure-subject:${tenant.length}:${tenant}:${subjectId.length}:${subjectId}`;
+        return this.controlKeys.map(({ key }) => `hmac-sha256:${(0, node_crypto_1.createHmac)("sha256", key).update(input).digest("hex")}`);
+    }
+    /** How a control row names the subject: the current key's digest and its id, or (no key) the plaintext id and tenant. */
+    subjectFields(subjectId, tenant) {
+        const current = this.controlKeys[0];
+        if (current !== undefined) {
+            return { subjectRef: this.subjectRefs(subjectId, tenant)[0], keyId: current.id };
+        }
+        return { subjectId, ...(tenant !== SubjectIndex_1.DEFAULT_TENANT && { tenant }) };
+    }
+    /** Whether a control row names the subject, in either form (a plaintext row predates the key). */
+    rowNames(payload, subjectId, tenant) {
+        const p = payload;
+        if (p === null || typeof p !== "object")
+            return false;
+        if (typeof p.subjectRef === "string") {
+            return this.subjectRefs(subjectId, tenant).includes(p.subjectRef);
+        }
+        return p.subjectId === subjectId && (p.tenant ?? SubjectIndex_1.DEFAULT_TENANT) === tenant;
+    }
+    /**
+     * ADR 0139 D12 - a PLAINTEXT archive holds other chains' reserved segments naming the erased subject as
+     * the sender. Each is rewritten with the identity replaced by an erased marker (the segment digest masks
+     * the sender, so it still verifies; the segment's sender digest is recomputed in the same swap) through
+     * ONE atomic `ArchiveStore.replaceSegments` per key (ADR 0139 N1: a trim on another node that appends a
+     * segment after this read makes the swap fail, and the key is re-read and retried - never lost, never
+     * restored over). The INTENT (the keys) is journaled first (`ERASURE_SENDER_REDACTION_INTENDED`) and the
+     * completion after (`ERASURE_SENDER_REDACTED`), so a crash between the two is finished by the retry from
+     * the intent and a redaction is never unrecorded. Cost: ONE pass over the archive's reserved keys per
+     * erasure (a `listExecutions` prefix walk and a `read` of each key; not indexed - an erasure is rare).
+     * A live, not yet archived envelope keeps its sender until it is trimmed (a plaintext store has no key to
+     * shred; the sender is sealed by default in a sealing deployment, ADR 0139 N6).
+     */
+    async redactSenderCopies(subjectId, tenant) {
+        const ref = (0, node_crypto_1.randomBytes)(8).toString("hex"); // one stable non-identifying reference per erased sender
+        await this.recoverRedactions(); // (a stage an earlier build left; a no-op on a clean archive)
+        const open = await this.openIntent(SENDER_REDACTION_INTENDED, SENDER_REDACTED, subjectId, tenant);
+        // 1. PLAN: one pass over the reserved keys, reading each once.
+        const plan = [];
+        for (const archive of this.plaintextArchives()) {
+            if (archive.replaceSegments === undefined)
+                continue; // refused before the shred if it held a copy
+            for (const key of await this.reservedArchiveKeys(archive)) {
+                const segments = await archive.read(key);
+                const changed = this.redactedSegments(segments, subjectId, tenant, ref).changed;
+                if (changed > 0) {
+                    plan.push({
+                        archive: archive,
+                        key,
+                        segments,
+                        changed,
+                    });
+                }
+            }
+        }
+        const intended = open?.payload?.redactions;
+        if (plan.length === 0 && open === undefined)
+            return [];
+        // 2. INTENT first (what is about to be rewritten), unless an interrupted attempt already journaled it.
+        const intentId = open?.id ??
+            (await this.appendIntent(SENDER_REDACTION_INTENDED, subjectId, tenant, {
+                redactions: plan.map((p) => ({ streamId: p.key, envelopes: p.changed })),
+            }));
+        // 3. APPLY: one atomic swap per key; a concurrent append makes it conflict, and the key is re-read.
+        const done = new Map();
+        for (const item of plan) {
+            let segments = item.segments;
+            for (let attempt = 0;; attempt++) {
+                const next = this.redactedSegments(segments, subjectId, tenant, ref);
+                if (next.changed === 0)
+                    break; // another writer redacted it already
+                try {
+                    await item.archive.replaceSegments(item.key, segments.map(event_runtime_1.headerOf), next.segments);
+                    done.set(item.key, next.changed);
+                    this.options.onArchiveKeyChanged?.(item.key);
+                    break;
+                }
+                catch (err) {
+                    if (!(err instanceof event_runtime_1.ArchiveConflictError) || attempt + 1 >= REDACT_RETRIES)
+                        throw err;
+                    segments = await item.archive.read(item.key);
+                }
+            }
+        }
+        // 4. COMPLETION: the planned redactions, plus any key this pass found beyond the intent.
+        const all = new Map();
+        for (const r of intended ?? [])
+            all.set(r.streamId, r.envelopes);
+        for (const p of plan)
+            all.set(p.key, Math.max(all.get(p.key) ?? 0, done.get(p.key) ?? p.changed));
+        const redactions = [...all].map(([streamId, envelopes]) => ({ streamId, envelopes }));
+        await this.appendCompletion(SENDER_REDACTED, subjectId, tenant, intentId, { redactions });
+        return redactions;
+    }
+    /** `segments` with the matching senders replaced by the erased marker, and the sender digest recomputed. */
+    redactedSegments(segments, subjectId, tenant, ref) {
+        const matches = this.options.senderMatches ?? exports.defaultSenderMatches;
+        let changed = 0;
+        const out = segments.map((seg) => {
+            let here = 0;
+            const envelopes = seg.envelopes.map((e) => {
+                const sender = e.payload?.sender;
+                if (e.eventType !== "INBOX_MESSAGE" ||
+                    typeof sender !== "object" ||
+                    sender === null ||
+                    !matches(subjectId, tenant, sender)) {
+                    return e;
+                }
+                here++;
+                return {
+                    ...e,
+                    payload: { ...e.payload, sender: (0, event_runtime_1.senderErasedMarker)(ref) },
+                };
+            });
+            if (here === 0)
+                return seg;
+            changed += here;
+            return { ...seg, envelopes, senderDigest: (0, event_runtime_1.senderDigestOf)(envelopes) };
+        });
+        return { segments: out, changed };
+    }
+    /** Every reserved key (inbox, quarantine, late run) the archive holds, by prefix walk. */
+    async reservedArchiveKeys(archive) {
+        const keys = [];
+        for (const prefix of ["__loom_inbox__:", "__loom_quarantine__:", "__loom_late__:"]) {
+            let cursor = prefix.slice(0, -1);
+            for (;;) {
+                const page = await archive.listExecutions({ cursor, limit: 200 });
+                let past = false;
+                for (const key of page.executionIds) {
+                    if (!key.startsWith(prefix)) {
+                        if (key < prefix)
+                            continue;
+                        past = true;
+                        break;
+                    }
+                    keys.push(key);
+                }
+                if (past || page.nextCursor === undefined || page.nextCursor === cursor)
+                    break;
+                cursor = page.nextCursor;
+            }
+        }
+        return keys;
+    }
+    /**
+     * Restore what an EARLIER build's staged rewrite left behind (a `__loom_redact__:<key>` whose original
+     * is gone is copied back; a stage whose original is whole is dropped). The current rewrite is one atomic
+     * `replaceSegments` and leaves no stage, so this is a no-op on a clean archive. Run at boot (`loadParked`)
+     * and exposed as an operator verb (`app.recoverArchiveRedactions`). Returns the keys restored.
+     */
+    async recoverRedactions() {
+        const restored = [];
+        for (const archive of this.plaintextArchives()) {
+            const del = archive.deleteExecution?.bind(archive);
+            if (del === undefined)
+                continue;
+            let cursor = REDACT_STAGE.slice(0, -1);
+            for (;;) {
+                const page = await archive.listExecutions({ cursor, limit: 200 });
+                let past = false;
+                for (const stage of page.executionIds) {
+                    if (!stage.startsWith(REDACT_STAGE)) {
+                        if (stage < REDACT_STAGE)
+                            continue;
+                        past = true;
+                        break;
+                    }
+                    const key = stage.slice(REDACT_STAGE.length);
+                    if ((await archive.headers(key)).length === 0) {
+                        for (const seg of await archive.read(stage))
+                            await archive.append(key, seg);
+                        restored.push(key);
+                        this.options.onArchiveKeyChanged?.(key);
+                    }
+                    await del(stage);
+                }
+                if (past || page.nextCursor === undefined || page.nextCursor === cursor)
+                    break;
+                cursor = page.nextCursor;
+            }
+        }
+        return restored;
+    }
+    /**
+     * The open intent of `intentType` for the subject: journaled and not yet completed by a `completionType`
+     * event naming it (`intentId`). The latest one, or `undefined`.
+     */
+    async openIntent(intentType, completionType, subjectId, tenant) {
+        const events = await this.options.eventStore.read(exports.ERASURE_STREAM);
+        const done = new Set();
+        for (const e of events) {
+            if (e.eventType === completionType) {
+                const id = e.payload?.intentId;
+                if (typeof id === "string")
+                    done.add(id);
+            }
+        }
+        let found;
+        let foreign;
+        for (const e of events) {
+            if (e.eventType !== intentType || done.has(e.id))
+                continue;
+            if (this.rowNames(e.payload, subjectId, tenant))
+                found = e;
+            else {
+                const p = e.payload;
+                const keyId = typeof p?.keyId === "string" ? p.keyId : "(none)";
+                if (typeof p?.subjectRef === "string" && !this.controlKeys.some((k) => k.id === keyId)) {
+                    foreign = { keyId, intentId: e.id };
+                }
+            }
+        }
+        // An open keyed intent this coordinator cannot attribute might be this subject's: never re-plan past it.
+        if (found === undefined && foreign !== undefined) {
+            throw new ControlStreamKeyError(foreign.keyId, foreign.intentId);
+        }
+        return found;
+    }
+    async appendIntent(type, subjectId, tenant, body) {
+        return this.appendControl(type, { ...this.subjectFields(subjectId, tenant), ...body });
+    }
+    async appendCompletion(type, subjectId, tenant, intentId, body) {
+        await this.appendControl(type, {
+            ...this.subjectFields(subjectId, tenant),
+            ...(intentId !== undefined && { intentId }),
+            ...body,
+        });
+    }
+    async appendControl(type, payload) {
+        const prior = await this.options.eventStore.read(exports.ERASURE_STREAM);
+        const id = `erasure-${prior.length}`;
+        await this.options.eventStore.append({
+            id,
+            workflowId: exports.ERASURE_STREAM,
+            executionId: exports.ERASURE_STREAM,
+            eventType: type,
+            sequence: prior.length,
+            timestamp: 0,
+            payload,
+        });
+        return id;
+    }
+    /** The plaintext archives (`sealsSegments` is not `true`); a sealing one is erased by the shred. */
+    plaintextArchives() {
+        return (this.options.archives ?? []).filter((a) => a.sealsSegments !== true);
+    }
+    /** Every archive key holding the subject's copies: its executions' compaction segments and its chains' reserved segments. */
+    async archivedKeys(archive, executions, chains) {
+        const held = [];
+        for (const id of executions) {
+            if ((await archive.headers(id)).length > 0)
+                held.push(id);
+        }
+        const reserved = [];
+        for (const { chainId } of chains) {
+            reserved.push(...(await (0, event_runtime_1.archivedReservedStreams)(archive, chainId)));
+        }
+        return { executions: held, reservedStreams: reserved };
+    }
+    async assertArchivesErasable(subjectId, tenant, executions, chains) {
+        for (const archive of this.plaintextArchives()) {
+            if (archive.deleteExecution === undefined) {
+                const keys = await this.archivedKeys(archive, executions, chains);
+                const all = [...keys.executions, ...keys.reservedStreams];
+                if (all.length > 0)
+                    throw new ArchivedCopiesRemainError(all);
+            }
+            // ADR 0139 N5: an archive that cannot swap a segment atomically cannot redact the subject's identity
+            // out of OTHER chains' archived envelopes. Refuse BEFORE the shred when it holds any (the scan is the
+            // price of finding out; an archive that can redact is scanned once, after the shred).
+            if (archive.replaceSegments === undefined) {
+                const held = [];
+                for (const key of await this.reservedArchiveKeys(archive)) {
+                    const segments = await archive.read(key);
+                    if (this.redactedSegments(segments, subjectId, tenant, "").changed > 0)
+                        held.push(key);
+                }
+                if (held.length > 0)
+                    throw new SenderRedactionUnsupportedError(held);
+            }
+        }
+    }
+    // ── ADR 0140 - claim-checked blobs ──────────────────────────────────────────────
+    /** Does the content store seal per subject (so the shred already erased its blobs)? */
+    sealsContent() {
+        return this.options.content?.sealsContent === true;
+    }
+    /** Every claim-check ref one execution cites: its live log, its archive segments and its snapshot. */
+    async refsOfExecution(executionId, proof, out, 
+    /**
+     * `true` (OTHER executions' citations): count only TRUSTED positions (see
+     * {@link trustedClaimCheckRefsOf}); a snapshot's refs count only when the execution has no recorded
+     * step left to vouch for them (history gone: the snapshot is the sole evidence, so fail closed).
+     */
+    trustedOnly = false, 
+    /**
+     * ADR 0143: where each address was first cited (the citing execution + its workflow), so a sealing
+     * store can be asked whether the address is OWNED by that citer's subject.
+     */
+    citedBy) {
+        const events = await this.readErasedOk(executionId, proof);
+        // With `citedBy`, collect THIS execution's refs separately so EVERY distinct citer of an address is
+        // recorded (not only the first): the ownership proof may hold under any of the subject's executions.
+        const into = citedBy === undefined ? out : new Set();
+        let workflowId = events[0]?.workflowId;
+        let sawStep = false;
+        const visit = (list) => {
+            if (!trustedOnly) {
+                for (const e of list)
+                    claimCheckRefsOf(e.payload, into);
+            }
+            else if (trustedClaimCheckRefsOf(list, into).sawStep) {
+                sawStep = true;
+            }
+        };
+        visit(events);
+        for (const archive of this.options.archives ?? []) {
+            try {
+                if ((await archive.headers(executionId)).length === 0)
+                    continue;
+                for (const seg of await archive.read(executionId)) {
+                    workflowId ??= seg.envelopes[0]?.workflowId;
+                    visit(seg.envelopes);
+                }
+            }
+            catch (err) {
+                // A sealed segment whose key is already gone cites nothing anyone can read.
+                if (!(0, event_runtime_1.isPayloadShredded)(err) && !(0, event_runtime_1.isKeyUnavailable)(err))
+                    throw err;
+            }
+        }
+        const read = await this.readSnapshotErasedOk(executionId, events, proof);
+        if (read.snapshot !== null && !read.opaque && (!trustedOnly || !sawStep)) {
+            workflowId ??= read.snapshot.state.workflowId;
+            claimCheckRefsOf(read.snapshot.state, into);
+        }
+        if (citedBy !== undefined) {
+            for (const a of into) {
+                out.add(a);
+                const citers = citedBy.get(a) ?? [];
+                citedBy.set(a, citers);
+                // Bounded: a proof is tried per citer, so a pathological fan-in cannot make erasure quadratic.
+                if (citers.length < MAX_CITERS_PER_ADDRESS &&
+                    !citers.some((c) => c.executionId === executionId)) {
+                    citers.push({ executionId, workflowId: workflowId ?? "" });
+                }
+            }
+        }
+    }
+    /**
+     * BEFORE the shred: collect the claim-check refs the subject's executions cite, drop every one another
+     * (non-erased) execution still cites, refuse when the remainder cannot be deleted, and journal the INTENT
+     * (`ERASURE_CONTENT_DELETE_INTENDED`: the addresses and the touch cutoff). A retry after a crash finds the
+     * open intent and finishes it. `undefined`: nothing to do (no content store sealing, no refs, no intent).
+     */
+    async planContentDeletion(subjectId, tenant, executions, proof) {
+        const open = await this.openIntent(CONTENT_DELETE_INTENDED, CONTENT_DELETED, subjectId, tenant);
+        const mine = new Set();
+        const citedBy = new Map();
+        for (const id of executions)
+            await this.refsOfExecution(id, proof, mine, false, citedBy);
+        if (mine.size === 0 && open === undefined)
+            return undefined;
+        if (this.sealsContent()) {
+            // ADR 0143: a store that seals each blob under a subject's key. The SHRED erases the subject's own
+            // blobs (no plaintext copy exists to remove). But a log CITES addresses it never put (an input, a
+            // resume payload, another execution's result): citation is not ownership. Each cited address is
+            // PROVEN owned by the subject (the store decrypts it under the subject's key and discards the
+            // plaintext) before it is planned for deletion; a blob that does not prove is never deleted and is
+            // journaled as foreign/retained. Erasure still RECORDS what it covered (the intent, BEFORE the shred;
+            // the completion after) and deletes the now-unreadable ciphertext where the store can.
+            const prior = open?.payload ?? {};
+            // The journaled intent names the foreign/unprovable addresses too, so a retry after the shred (when
+            // every proof now throws PayloadShreddedError) neither reclassifies nor double counts them.
+            const known = new Set([
+                ...(prior.addresses ?? []),
+                ...(prior.foreignAddresses ?? []),
+                ...(prior.unprovableAddresses ?? []),
+            ]);
+            const owned = new Set(prior.addresses ?? []);
+            const foreign = new Set(prior.foreignAddresses ?? []);
+            const unprovable = new Set(prior.unprovableAddresses ?? []);
+            const fresh = [...mine].filter((a) => !known.has(a));
+            const content = this.options.content;
+            if (fresh.length > 0 && typeof content?.ownedBy !== "function") {
+                throw new ContentCopiesRemainError(fresh.length, "the sealing content store offers no ownedBy(ref, access), so erasure cannot prove which cited blobs the subject owns and which another subject's log merely cites (a sealing store without the proof is refused rather than guessed at)");
+            }
+            for (const address of fresh) {
+                // The putter may be ANY execution of the subject that cites the address (the compliance subject
+                // can span executions with distinct crypto subjects): owned if the proof holds under any of them.
+                let isOwned = false;
+                let sawShredded = false;
+                for (const access of citedBy.get(address) ?? []) {
+                    try {
+                        isOwned = await content.ownedBy({ __loomContent: address }, access);
+                    }
+                    catch (err) {
+                        // The key is already destroyed (a re-erasure): ownership under that key is unprovable. Any other
+                        // failure (a key merely absent from this node) is loud: nothing is shredded.
+                        if (!(0, event_runtime_1.isPayloadShredded)(err))
+                            throw err;
+                        sawShredded = true;
+                    }
+                    if (isOwned)
+                        break;
+                }
+                if (isOwned)
+                    owned.add(address);
+                else if (sawShredded)
+                    unprovable.add(address);
+                else
+                    foreign.add(address);
+            }
+            const foreignCount = Math.max(prior.foreign ?? 0, foreign.size);
+            const unprovableCount = Math.max(prior.unprovable ?? 0, unprovable.size);
+            const retained = foreignCount + unprovableCount;
+            const addresses = [...owned];
+            const intentId = open?.id ??
+                (await this.appendIntent(CONTENT_DELETE_INTENDED, subjectId, tenant, {
+                    addresses,
+                    retained,
+                    foreign: foreignCount,
+                    unprovable: unprovableCount,
+                    foreignAddresses: [...foreign],
+                    unprovableAddresses: [...unprovable],
+                    sealed: true,
+                }));
+            return {
+                intentId,
+                addresses,
+                retained,
+                foreign: foreignCount,
+                unprovable: unprovableCount,
+                sealed: true,
+            };
+        }
+        const content = this.options.content;
+        const store = this.options.eventStore;
+        const enumerable = store.listExecutionsPage !== undefined || store.listExecutions !== undefined;
+        if (mine.size > 0) {
+            if (content === undefined) {
+                throw new ContentCopiesRemainError(mine.size, "no content store is wired to the erasure");
+            }
+            if (typeof content.delete !== "function") {
+                throw new ContentCopiesRemainError(mine.size, "the content store cannot delete");
+            }
+            if (typeof content.deleteIfUntouchedSince !== "function" ||
+                typeof content.touchClock !== "function") {
+                throw new ContentCopiesRemainError(mine.size, "the content store has no deleteIfUntouchedSince/touchClock (ContentStore SPI 1.3.0), so a blob another execution cites after this plan could be deleted while cited (an unconditional delete of a shared-addressable blob is never made)");
+            }
+            if (!enumerable) {
+                throw new ContentCopiesRemainError(mine.size, "the event store cannot be enumerated, so erasure cannot tell whether another execution still cites them");
+            }
+        }
+        const openAddresses = open?.payload?.addresses ?? [];
+        if (mine.size === 0 &&
+            openAddresses.length > 0 &&
+            (content === undefined ||
+                typeof content.deleteIfUntouchedSince !== "function" ||
+                typeof content.touchClock !== "function")) {
+            throw new ContentCopiesRemainError(openAddresses.length, "the content store lacks the conditional delete (deleteIfUntouchedSince/touchClock) the journaled intent needs");
+        }
+        // The blobs another, non-erased execution still cites STAY (a deduplicated identical blob).
+        const cutoff = content?.touchClock !== undefined ? await content.touchClock() : undefined;
+        const stillCited = new Set();
+        if (mine.size > 0) {
+            const own = new Set(executions);
+            const ids = new Set();
+            for await (const id of (0, event_runtime_1.iterateExecutionIds)(store))
+                ids.add(id);
+            for (const archive of this.options.archives ?? []) {
+                let cursor;
+                for (;;) {
+                    const page = await archive.listExecutions({
+                        ...(cursor !== undefined && { cursor }),
+                        limit: 500,
+                    });
+                    for (const id of page.executionIds)
+                        ids.add(id);
+                    if (page.nextCursor === undefined || page.nextCursor === cursor)
+                        break;
+                    cursor = page.nextCursor;
+                }
+            }
+            for (const id of ids) {
+                if (own.has(id) || id === exports.ERASURE_STREAM)
+                    continue;
+                const cited = new Set();
+                await this.refsOfExecution(id, proof, cited, true);
+                for (const a of cited)
+                    if (mine.has(a))
+                        stillCited.add(a);
+                if (stillCited.size === mine.size)
+                    break;
+            }
+        }
+        const addresses = new Set();
+        const prior = open?.payload;
+        for (const a of prior?.addresses ?? [])
+            addresses.add(a);
+        for (const a of mine)
+            if (!stillCited.has(a))
+                addresses.add(a);
+        const retained = stillCited.size;
+        const intentId = open?.id ??
+            (addresses.size > 0 || retained > 0
+                ? await this.appendIntent(CONTENT_DELETE_INTENDED, subjectId, tenant, {
+                    addresses: [...addresses],
+                    retained,
+                    ...(cutoff !== undefined && { cutoff }),
+                })
+                : undefined);
+        return {
+            ...(intentId !== undefined && { intentId }),
+            addresses: [...addresses],
+            retained,
+            ...(prior?.cutoff !== undefined
+                ? { cutoff: Math.min(prior.cutoff, cutoff ?? prior.cutoff) }
+                : cutoff !== undefined
+                    ? { cutoff }
+                    : {}),
+        };
+    }
+    /** AFTER the shred: delete the planned blobs, then journal the completion naming the intent. */
+    async finishContentDeletion(subjectId, tenant, plan) {
+        if (plan === undefined || plan.intentId === undefined)
+            return undefined;
+        const content = this.options.content;
+        let deleted = 0;
+        if (plan.sealed === true) {
+            // The shred already made every blob unreadable. Reclaim the ciphertext where the store can delete.
+            for (const address of plan.addresses) {
+                if (typeof content?.delete !== "function")
+                    break;
+                await content.delete({ __loomContent: address });
+                deleted++;
+            }
+            const foreign = plan.foreign ?? 0;
+            const unprovable = plan.unprovable ?? 0;
+            const retained = foreign + unprovable;
+            await this.appendCompletion(CONTENT_DELETED, subjectId, tenant, plan.intentId, {
+                deleted,
+                retained,
+                sealed: plan.addresses.length,
+                foreign,
+                unprovable,
+            });
+            return { deleted, retained, sealed: plan.addresses.length, foreign, unprovable };
+        }
+        for (const address of plan.addresses) {
+            const ref = { __loomContent: address };
+            if (content === undefined)
+                break; // planned only when a store was wired
+            if (plan.cutoff === undefined || content.deleteIfUntouchedSince === undefined) {
+                // Planned only with the conditional delete (planContentDeletion refuses otherwise); an intent
+                // finished against a store that lost it must not fall back to an unconditional delete.
+                throw new ContentCopiesRemainError(plan.addresses.length, "the content store no longer offers deleteIfUntouchedSince/touchClock, so the journaled deletion cannot be finished safely");
+            }
+            // A concurrent re-put (another subject's identical blob) bumped the touch time: spared.
+            if (await content.deleteIfUntouchedSince(ref, plan.cutoff))
+                deleted++;
+            else
+                plan.retained++;
+        }
+        await this.appendCompletion(CONTENT_DELETED, subjectId, tenant, plan.intentId, {
+            deleted,
+            retained: plan.retained,
+        });
+        return { deleted, retained: plan.retained };
+    }
+    /**
+     * ADR 0138 / 0139 - the physical half of erasure for the ARCHIVES: delete the subject's compaction
+     * segments and its chains' reserved-stream segments from every plaintext archive. ADR 0139 N4: the
+     * INTENT (the keys) is journaled BEFORE anything is deleted (`ERASURE_ARCHIVE_DELETE_INTENDED`) and the
+     * completion after (`ERASURE_ARCHIVE_DELETED`, naming the intent), so a crash between the delete and the
+     * record is finished by the retry from the intent: a deletion is never unrecorded. Idempotent: a retry
+     * with nothing left and no open intent records nothing. Over a sealing archive the shred has already made
+     * the segments unreadable, so nothing is deleted.
+     */
+    async deleteArchivedCopies(subjectId, tenant, executions, chains) {
+        const deleted = { executions: [], reservedStreams: [] };
+        // 1. Finish an interrupted attempt from its journaled intent.
+        const open = await this.openIntent(ARCHIVE_DELETE_INTENDED, ARCHIVE_DELETED, subjectId, tenant);
+        const pending = new Set();
+        if (open !== undefined) {
+            const p = open.payload;
+            for (const id of p.executions ?? [])
+                deleted.executions.push(id);
+            for (const id of p.reservedStreams ?? [])
+                deleted.reservedStreams.push(id);
+            for (const id of [...deleted.executions, ...deleted.reservedStreams])
+                pending.add(id);
+        }
+        // 2. What is held now.
+        const fresh = { executions: [], reservedStreams: [] };
+        for (const archive of this.plaintextArchives()) {
+            if (archive.deleteExecution === undefined)
+                continue; // asserted before the shred
+            const keys = await this.archivedKeys(archive, executions, chains);
+            for (const id of keys.executions)
+                if (!pending.has(id))
+                    fresh.executions.push(id);
+            for (const id of keys.reservedStreams)
+                if (!pending.has(id))
+                    fresh.reservedStreams.push(id);
+        }
+        if (open === undefined && fresh.executions.length === 0 && fresh.reservedStreams.length === 0) {
+            return undefined;
+        }
+        deleted.executions.push(...fresh.executions);
+        deleted.reservedStreams.push(...fresh.reservedStreams);
+        // 3. INTENT first (only when this pass found something new), then delete, then the completion.
+        const intentId = open?.id ??
+            (await this.appendIntent(ARCHIVE_DELETE_INTENDED, subjectId, tenant, {
+                executions: deleted.executions,
+                reservedStreams: deleted.reservedStreams,
+            }));
+        for (const archive of this.plaintextArchives()) {
+            const del = archive.deleteExecution?.bind(archive);
+            if (del === undefined)
+                continue;
+            for (const id of [...deleted.executions, ...deleted.reservedStreams]) {
+                await del(id); // idempotent: an absent key is a no-op
+                this.options.onArchiveKeyChanged?.(id);
+            }
+        }
+        await this.appendCompletion(ARCHIVE_DELETED, subjectId, tenant, intentId, { ...deleted });
+        return deleted;
+    }
+    /**
+     * ADR 0110 follow-up — erasure reaches payloads still in flight in a RESERVED inbox stream.
+     *
+     * A chain's inbox (`__loom_inbox__:<chainId>`, and with per-topic streams `…#<hash>` and `…#reg`) holds undelivered messages for its owner. The
+     * runtime deletes it when the chain's head turns terminal, but a crash between a sender's append
+     * and its re-read can leave an orphan, and until it is reclaimed it holds the subject's data.
+     * Once the subject is erased (every execution of it terminal, so nothing can consume) the stream
+     * of each execution that is the HEAD of its chain (terminal and not `continued`: a continued
+     * execution's successor owns the stream) is deleted. Idempotent, and a no-op for a store that
+     * cannot delete or an execution whose stream is already gone.
+     *
+     * This is the physical half. The cryptographic half is the key: the crypto plugin seals inbox
+     * payloads under the OWNER's subject, so `shred` makes a payload unreadable even where a stream
+     * cannot be deleted (a consumer then receives the `{ $shredded: true }` marker, never the raw
+     * value).
+     */
+    async purgeInboxStreams(chains) {
+        const remove = this.options.eventStore.deleteExecution?.bind(this.options.eventStore);
+        if (remove === undefined)
+            return;
+        for (const { streams: { legacy, registry, topics, quarantine }, } of chains) {
+            // ADR 0110 D10b — EVERY stream of the chain: its per-topic streams, the legacy one and, last,
+            // the registry that names the topic streams (a crash midway leaves them findable).
+            for (const stream of topics)
+                await remove(stream);
+            await remove(legacy);
+            // ADR 0130 residuals D9: the chain's quarantine copies are in-flight payloads too.
+            await remove(quarantine);
+            if (registry !== undefined)
+                await remove(registry);
+        }
+    }
+    /**
+     * The inbox streams of the chains whose HEAD is among `executions`: terminal and not `continued`
+     * (a continued execution's successor owns the chain's inbox and is judged on its own events).
+     * Folded, and each chain's registry read, while the logs are still readable, so a decrypting store
+     * has not yet lost its key.
+     */
+    async finishedChains(executions, proof) {
+        // (a store that cannot delete streams still has chains whose ARCHIVED segments erasure removes)
+        const chains = new Set();
+        for (const executionId of executions) {
+            const folded = await this.foldExecution(executionId, proof);
+            if (folded === undefined)
+                continue;
+            if (!TERMINAL_STATUS.has(folded.status) || folded.status === "continued")
+                continue;
+            if (folded.head === false)
+                continue; // terminal, but not PROVEN a chain head: keep its streams
+            chains.add((0, event_runtime_1.chainIdOfFirst)(folded.first, executionId));
+        }
+        const streams = [];
+        const store = this.options.eventStore;
+        const view = {
+            read: (id) => this.readErasedOk(id, proof),
+            // The registry may miss a topic stream (a sender that died before it registered): the prefix
+            // scan is the backstop, so erasure reaches an unregistered stream too.
+            ...(store.listExecutionsPage !== undefined && {
+                listExecutionsPage: store.listExecutionsPage.bind(store),
+            }),
+        };
+        for (const chainId of chains) {
+            streams.push({ chainId, streams: await (0, event_runtime_1.inboxStreamsOfChainDeep)(view, chainId) });
+        }
+        return streams;
+    }
+    /** The window proof for one call: the operator's per-call `force` asserts it, else the configured proof. */
+    proofFor(force) {
+        return force === "key-destroyed-elsewhere" ? () => true : this.options.destroyed;
+    }
+    /** Subjects with a deferred erasure still awaiting completion (sorted, deduped across tenants). */
+    pendingSubjects() {
+        const out = new Set([...this.parked].map(subjectOfKey));
+        if (this.parkedRefs.size > 0) {
+            // A restored digest names its subject only through the index (one HMAC per indexed subject).
+            for (const tenant of this.options.index.tenants()) {
+                for (const subject of this.options.index.subjects(tenant)) {
+                    if (this.subjectRefs(subject, tenant).some((r) => this.parkedRefs.has(r))) {
+                        out.add(subject);
+                    }
+                }
+            }
+        }
+        return [...out].sort();
+    }
+    /** The subset of `executions` that are not yet terminal (a live fold reading the key), with status. */
+    async liveExecutions(executions, proof) {
+        const live = [];
+        for (const executionId of executions) {
+            const folded = await this.foldExecution(executionId, proof);
+            if (folded === undefined)
+                continue; // deleted by retention — nothing to protect
+            if (!TERMINAL_STATUS.has(folded.status))
+                live.push({ id: executionId, status: folded.status });
+        }
+        return live;
+    }
+    /**
+     * The log, or — when its subject is ALREADY shredded (a direct `shredSubject`, a retry, or the
+     * window between the key's destruction and its tombstone) — the redacted view the typed error
+     * carries: status and tip are plaintext, so liveness and the
+     * chain's head can still be judged, and a re-run of the erasure stays idempotent.
+     */
+    async readErasedOk(executionId, proof) {
+        try {
+            return await this.options.eventStore.read(executionId);
+        }
+        catch (err) {
+            const redacted = err?.redacted;
+            if ((0, event_runtime_1.isPayloadShredded)(err) && redacted) {
+                return redacted;
+            }
+            // The ShredIncomplete window (ADR 0130 D7): the key is destroyed but the tombstone append
+            // failed, so no PAYLOAD_SHREDDED exists yet and the read is `KeyUnavailableError`. Its
+            // redacted view (plaintext status and tip) lets the retry judge liveness and complete, but
+            // ONLY when the log records this subject's durable erase intent: without it the node merely
+            // lacks the key (wrong key, partitioned key store) and the error is rethrown.
+            const window = await (0, event_runtime_1.erasureWindowView)(err, proof);
+            if (window !== undefined)
+                return [...window];
+            throw err;
+        }
+    }
+    /**
+     * The latest checkpoint, or — in the destroy window — its at-rest form. A sealing snapshot store
+     * throws `KeyUnavailableError` for a sealed checkpoint whose key is destroyed while no
+     * `PAYLOAD_SHREDDED` exists yet (the crash between `keys.destroy` and the tombstones), and
+     * `PayloadShreddedError` once a shred is recorded. Both are handled exactly like the event read
+     * (`readErasedOk`) and `shredSubject` (`loadLatestSealed`): the proven shred reads sealed, the
+     * unavailable key only when the log holds this subject's erase intent AND `proof` shows the key
+     * store destroyed it. Anything else (a key merely missing, no intent) is rethrown: real key loss
+     * is never masked. `opaque` is set when the sealed state carries no plaintext status.
+     */
+    async readSnapshotErasedOk(executionId, events, proof) {
+        const store = this.options.snapshotStore;
+        if (store === undefined)
+            return { snapshot: null, opaque: false };
+        try {
+            return { snapshot: await store.loadLatest(executionId), opaque: false };
+        }
+        catch (err) {
+            const sealedRead = store.loadLatestSealed?.bind(store);
+            const inWindow = (0, event_runtime_1.isPayloadShredded)(err) || (await (0, event_runtime_1.isErasureWindow)(err, events, proof));
+            if (!inWindow || sealedRead === undefined)
+                throw err;
+            const snapshot = await sealedRead(executionId);
+            const opaque = typeof snapshot?.state?.status !== "string";
+            return { snapshot, opaque, ...((0, event_runtime_1.isKeyUnavailable)(err) && { subjectId: err.subjectId }) };
+        }
+    }
+    /** One execution's folded status and its first event, or `undefined` when its log is gone. */
+    async foldExecution(executionId, proof) {
+        const events = await this.readErasedOk(executionId, proof);
+        const first = events[0];
+        if (first === undefined)
+            return undefined;
+        const read = await this.readSnapshotErasedOk(executionId, events, proof);
+        const snapshot = read.snapshot;
+        // Fill a blank legacy identity; a NON-blank one naming another execution is a store or
+        // tenant-scoping defect, refused as everywhere else a fold is seeded (ADR 0106).
+        if (snapshot !== null) {
+            // The row's index columns are plaintext even when its state is sealed: always refuse a
+            // checkpoint of another execution (a store or tenant-scoping defect, ADR 0106).
+            if (snapshot.executionId !== undefined && snapshot.executionId !== executionId) {
+                throw new TypeError(`snapshot store returned a checkpoint of "${snapshot.executionId}" for "${executionId}"`);
+            }
+            if (!read.opaque)
+                (0, snapshot_runtime_1.assertSnapshotIdentity)(snapshot.state, executionId, first.workflowId ?? "");
+        }
+        if (read.opaque && snapshot !== null) {
+            // A whole-state sealed checkpoint whose key is gone: its status is unreadable.
+            // (1) The log is not compacted: gap-free from 0 AND reaching the checkpoint (compaction
+            // keeps only sequence 0 of the prefix). Then ignore the checkpoint and fold the WHOLE log by
+            // its plaintext event types, the no-snapshot path: continued, suspended and a re-open after
+            // the intent all read as they are.
+            const last0 = events[events.length - 1];
+            if (events.every((e, i) => e.sequence === i) &&
+                last0 !== undefined &&
+                last0.sequence >= snapshot.sequence) {
+                return { status: (0, replay_vm_1.foldEvents)(events, { executionId }).status, first };
+            }
+            // (2) Compacted: only the tail above the checkpoint is left. Judge it by the rule
+            // `shredSubject` uses (`isQuiescent`). A chain HEAD is claimed only when the tail itself shows
+            // a non-`continued` terminal kind; anything less keeps the inbox streams (the key's
+            // destruction already makes their payloads unreadable).
+            const tail = events.filter((e) => e.sequence > snapshot.sequence);
+            // The intent is looked for under THIS subject (the one whose key is gone), as shredSubject does.
+            const quiescent = (0, event_runtime_1.isQuiescent)(tail, undefined, (0, event_runtime_1.recordsErasureIntent)(events, read.subjectId));
+            const last = [...tail].reverse().find((e) => (0, event_runtime_1.isAnsweringKind)(e));
+            const status = !quiescent
+                ? (0, replay_vm_1.foldEvents)(tail, { executionId }).status
+                : last?.eventType === "EXECUTION_SUSPENDED"
+                    ? "suspended"
+                    : last === undefined
+                        ? "completed" // quiescent on the intent alone: terminal for liveness, head unproven
+                        : (TERMINAL_STATUS_OF_EVENT.get(last.eventType) ?? "completed");
+            const head = last !== undefined && status !== "continued" && TERMINAL_STATUS.has(status);
+            return { status, first, head };
+        }
+        const state = snapshot !== null
+            ? (0, replay_vm_1.foldEvents)(events.filter((e) => e.sequence > snapshot.sequence), 
+            // A pre-ADR-0106 checkpoint may carry a blank identity: fill it, as the kernel does.
+            // A pre-1.21.0 snapshot may read `failed` for a caught step failure: repair it
+            // (ADR 0105), or a live execution would read terminal and be shredded.
+            {
+                ...(0, replay_vm_1.normalizeSnapshotState)(snapshot.state),
+                executionId: snapshot.state.executionId || executionId,
+                workflowId: snapshot.state.workflowId || (first.workflowId ?? ""),
+            })
+            : (0, replay_vm_1.foldEvents)(events, { executionId });
+        return { status: state.status, first };
+    }
+    // `prior.length` is the next sequence only because a reserved stream is never compacted:
+    // `LogLifecycle.compact` refuses one (ADR 0106).
+    async appendPending(subjectId, tenant) {
+        const prior = await this.options.eventStore.read(exports.ERASURE_STREAM);
+        await this.options.eventStore.append({
+            id: `erasure-${prior.length}`,
+            workflowId: exports.ERASURE_STREAM,
+            executionId: exports.ERASURE_STREAM,
+            eventType: "ERASURE_PENDING",
+            sequence: prior.length,
+            timestamp: 0, // deterministic; the fact of the request is what matters
+            payload: this.subjectFields(subjectId, tenant),
+        });
+    }
+}
+exports.EraseCoordinator = EraseCoordinator;
+/** The ids of the `ERASURE_PENDING` rows an `ERASURE_PENDING_CLEARED` closed. */
+function clearedPendingIds(control) {
+    const out = new Set();
+    for (const e of control) {
+        if (e.eventType !== PENDING_CLEARED)
+            continue;
+        const ids = e.payload?.pendingIds;
+        if (Array.isArray(ids))
+            for (const id of ids)
+                if (typeof id === "string")
+                    out.add(id);
+    }
+    return out;
+}
+// `tenant\x00subject` — NUL separates the two id spaces (never appears in a real id), so a
+// tenant/subject boundary can't be spoofed by crafting an id that contains the separator.
+function parkKey(tenant, subject) {
+    return `${tenant}\x00${subject}`;
+}
+function subjectOfKey(key) {
+    return key.slice(key.indexOf("\x00") + 1);
+}
+//# sourceMappingURL=eraseSubject.js.map