@plinth-music/cli 0.22.0 → 0.23.0

package/dist/cli.js

@@ -7584,7 +7584,7 @@ function _getBuiltinFlags(long, short, userNames, userAliases) {
 // package.json
 var package_default = {
   name: "@plinth-music/cli",
-  version: "0.22.0",
+  version: "0.23.0",
   description: "Plinth capstone sync daemon and CLI",
   type: "module",
   private: false,
@@ -22148,7 +22148,22 @@ var BASE_ROW = {
 };
 var TombstoneSchema = exports_external.object({
   ...BASE_ROW,
-  deleted_at: exports_external.string().datetime({ offset: true })
+  deleted_at: exports_external.string().datetime({ offset: true }),
+  permanent_delete: exports_external.literal(true).optional(),
+  purge_generation: exports_external.string().uuid().optional(),
+  retirement_sequence: exports_external.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
+}).superRefine((row, ctx) => {
+  const present = [
+    row.permanent_delete !== undefined,
+    row.purge_generation !== undefined,
+    row.retirement_sequence !== undefined
+  ];
+  if (present.some(Boolean) && !present.every(Boolean)) {
+    ctx.addIssue({
+      code: "custom",
+      message: "permanent tombstone fields must be present together"
+    });
+  }
 });
 function makePageResponseSchema(responseKey, liveSchema) {
   return exports_external.object({
@@ -23893,6 +23908,17 @@ function moveEntityFile(workspaceSlug, entityType, fromSlug, toSlug, beforeMove)
     throw err;
   }
 }
+function deleteMirrorFile(workspaceSlug, entityType, entitySlug) {
+  const target = entityFilePath(workspaceSlug, entityType, entitySlug);
+  try {
+    unlinkSync(target);
+    return true;
+  } catch (err) {
+    if (err?.code === "ENOENT")
+      return false;
+    throw err;
+  }
+}
 var ARTIST_MEMORY_ANCHOR = "memory.md";
 function artistMemoryFilePath(workspaceSlug, entitySlug) {
   assertSlug("entity slug", entitySlug);
@@ -29609,6 +29635,13 @@ class ApiError extends Error {
     this.name = "ApiError";
   }
 }
+var PermanentNameRetiredSchema = exports_external.object({
+  code: exports_external.literal("permanent_name_retired"),
+  entity_kind: exports_external.enum(["document", "workspace_file"]),
+  logical_key: exports_external.string().min(1),
+  action: exports_external.literal("refresh_required"),
+  error: exports_external.string().optional()
+});
 function parseRetryAfterMs(headerValue, now = () => Date.now()) {
   if (!headerValue)
     return;
@@ -29622,6 +29655,92 @@ function parseRetryAfterMs(headerValue, now = () => Date.now()) {
   const delta = dateMs - now();
   return delta > 0 ? delta : 0;
 }
+var OperationEnvelopeBase = exports_external.object({
+  entity_kind: exports_external.enum(["document", "workspace_file"]),
+  operation_id: exports_external.string().uuid()
+});
+var OperationBoundBase = OperationEnvelopeBase.extend({
+  logical_key: exports_external.string().min(1),
+  payload_digest: exports_external.string().regex(/^[0-9a-f]{64}$/)
+});
+var OperationResolutionSchema = exports_external.discriminatedUnion("status", [
+  OperationBoundBase.extend({ status: exports_external.literal("pending") }),
+  OperationBoundBase.extend({ status: exports_external.literal("finalized"), live: exports_external.unknown() }),
+  OperationBoundBase.extend({ status: exports_external.literal("terminal_cleaned") }),
+  OperationEnvelopeBase.extend({ status: exports_external.literal("retired_not_found") })
+]);
+var CurrentNamespaceSchema = exports_external.object({
+  entity_kind: exports_external.enum(["document", "workspace_file"]),
+  logical_key: exports_external.string().min(1),
+  latest_retirement: exports_external.object({
+    purge_generation: exports_external.string().uuid(),
+    retirement_sequence: exports_external.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+  }).nullable(),
+  live_owner: exports_external.object({ id: exports_external.string().uuid() }).nullable()
+});
+async function resolvePermanentDeletionOperation(args) {
+  const { baseUrl, pat, entityKind, operationId, fetchImpl = fetch } = args;
+  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/permanent-deletions/operations/resolve`;
+  let res;
+  try {
+    res = await fetchImpl(url2, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${pat}`,
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ entity_kind: entityKind, operation_id: operationId })
+    });
+  } catch (error52) {
+    const detail = error52 instanceof Error ? error52.message : "network error";
+    throw new ApiError(0, `Could not reach ${url2}: ${detail}`);
+  }
+  if (res.status === 401)
+    throw new ApiError(401, "Token was rejected by the server.");
+  if (res.status === 429) {
+    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+  }
+  if (!res.ok) {
+    throw new ApiError(res.status, `resolve permanent deletion operation failed with HTTP ${res.status}`);
+  }
+  const parsed = OperationResolutionSchema.safeParse(await res.json());
+  if (!parsed.success) {
+    throw new ApiError(res.status, `operation resolution response did not match the expected shape: ${parsed.error.message}`);
+  }
+  return parsed.data;
+}
+async function getCurrentPermanentNamespace(args) {
+  const { baseUrl, pat, entityKind, logicalKey, fetchImpl = fetch } = args;
+  const params = new URLSearchParams({ entity_kind: entityKind, logical_key: logicalKey });
+  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/permanent-deletions/namespaces/current?${params}`;
+  let res;
+  try {
+    res = await fetchImpl(url2, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${pat}`, Accept: "application/json" }
+    });
+  } catch (error52) {
+    const detail = error52 instanceof Error ? error52.message : "network error";
+    throw new ApiError(0, `Could not reach ${url2}: ${detail}`);
+  }
+  if (res.status === 401)
+    throw new ApiError(401, "Token was rejected by the server.");
+  if (res.status === 429) {
+    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+  }
+  if (!res.ok) {
+    throw new ApiError(res.status, `get current permanent namespace failed with HTTP ${res.status}`);
+  }
+  const parsed = CurrentNamespaceSchema.safeParse(await res.json());
+  if (!parsed.success) {
+    throw new ApiError(res.status, `current permanent namespace response did not match the expected shape: ${parsed.error.message}`);
+  }
+  if (parsed.data.entity_kind !== entityKind || parsed.data.logical_key !== logicalKey) {
+    throw new ApiError(res.status, "current permanent namespace response identity mismatch");
+  }
+  return parsed.data;
+}
 async function whoami(baseUrl, pat, fetchImpl = fetch) {
   const url2 = `${baseUrl.replace(/\/$/, "")}/api/auth/cli/whoami`;
   let res;
@@ -29797,6 +29916,16 @@ async function patchEntity(args) {
   }
   if (res.status === 409) {
     const json2 = await res.json();
+    const retiredParse = PermanentNameRetiredSchema.safeParse(json2);
+    if (retiredParse.success) {
+      return {
+        ok: false,
+        code: 409,
+        reason: "permanent_name_retired",
+        entityKind: retiredParse.data.entity_kind,
+        logicalKey: retiredParse.data.logical_key
+      };
+    }
     const contextParse = ContextDocConflictResponseSchema.safeParse(json2);
     if (contextParse.success) {
       const existing = strategy.singleResponseSchema.safeParse(contextParse.data.existing);
@@ -29853,17 +29982,33 @@ async function patchEntity(args) {
   throw new ApiError(res.status, `patch ${strategy.type} failed with HTTP ${res.status}`);
 }
 async function createEntity(args) {
-  const { strategy, baseUrl, pat, payload, fetchImpl = fetch } = args;
+  const {
+    strategy,
+    baseUrl,
+    pat,
+    payload,
+    retiredGeneration,
+    operationId,
+    fetchImpl = fetch
+  } = args;
   const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/${strategy.apiSegment}`;
+  if (retiredGeneration === undefined !== (operationId === undefined)) {
+    throw new Error("retired generation and create operation id must be supplied together");
+  }
+  const headers = {
+    Authorization: `Bearer ${pat}`,
+    Accept: "application/json",
+    "Content-Type": "application/json"
+  };
+  if (retiredGeneration) {
+    headers["X-Plinth-Retired-Generation"] = retiredGeneration;
+    headers["X-Plinth-Create-Operation-Id"] = operationId;
+  }
   let res;
   try {
     res = await fetchImpl(url2, {
       method: "POST",
-      headers: {
-        Authorization: `Bearer ${pat}`,
-        Accept: "application/json",
-        "Content-Type": "application/json"
-      },
+      headers,
       body: JSON.stringify(payload)
     });
   } catch (err) {
@@ -29880,6 +30025,16 @@ async function createEntity(args) {
   }
   if (res.status === 409) {
     const json2 = await res.json();
+    const retiredParse = PermanentNameRetiredSchema.safeParse(json2);
+    if (retiredParse.success) {
+      return {
+        ok: false,
+        code: 409,
+        reason: "permanent_name_retired",
+        entityKind: retiredParse.data.entity_kind,
+        logicalKey: retiredParse.data.logical_key
+      };
+    }
     const contextParse = ContextDocConflictResponseSchema.safeParse(json2);
     if (contextParse.success) {
       const existing2 = strategy.singleResponseSchema.safeParse(contextParse.data.existing);
@@ -30023,7 +30178,19 @@ var FileTombstoneSchema = exports_external.object({
   id: exports_external.string().uuid(),
   path: exports_external.string().min(1),
   updated_at: exports_external.string().datetime({ offset: true }),
-  deleted_at: exports_external.string().datetime({ offset: true })
+  deleted_at: exports_external.string().datetime({ offset: true }),
+  permanent_delete: exports_external.literal(true).optional(),
+  purge_generation: exports_external.string().uuid().optional(),
+  retirement_sequence: exports_external.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
+}).superRefine((row, ctx) => {
+  const present2 = [
+    row.permanent_delete !== undefined,
+    row.purge_generation !== undefined,
+    row.retirement_sequence !== undefined
+  ];
+  if (present2.some(Boolean) && !present2.every(Boolean)) {
+    ctx.addIssue({ code: "custom", message: "permanent tombstone fields must be present together" });
+  }
 });
 var FileRowSchema = exports_external.union([FileLiveSchema, FileTombstoneSchema]);
 var FilesPageSchema = exports_external.object({
@@ -30162,6 +30329,8 @@ async function postFile(args) {
     contentHash,
     mimeType,
     expectedUpdatedAt,
+    retiredGeneration,
+    operationId,
     fetchImpl = fetch
   } = args;
   const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files`;
@@ -30174,6 +30343,13 @@ async function postFile(args) {
   };
   if (expectedUpdatedAt)
     headers["X-Plinth-Expected-Updated-At"] = expectedUpdatedAt;
+  if (retiredGeneration === undefined !== (operationId === undefined)) {
+    throw new Error("retired generation and create operation id must be supplied together");
+  }
+  if (retiredGeneration) {
+    headers["X-Plinth-Retired-Generation"] = retiredGeneration;
+    headers["X-Plinth-Create-Operation-Id"] = operationId;
+  }
   let res;
   try {
     res = await fetchImpl(url2, { method: "POST", headers, body: bytes });
@@ -30200,6 +30376,22 @@ async function postFile(args) {
   }
   if (res.status === 409) {
     const json2 = await res.json();
+    const retired = exports_external.object({
+      code: exports_external.literal("permanent_name_retired"),
+      entity_kind: exports_external.literal("workspace_file"),
+      logical_key: exports_external.string().min(1),
+      action: exports_external.literal("refresh_required"),
+      error: exports_external.string().optional()
+    }).safeParse(json2);
+    if (retired.success) {
+      return {
+        ok: false,
+        code: 409,
+        reason: "permanent_name_retired",
+        entityKind: retired.data.entity_kind,
+        logicalKey: retired.data.logical_key
+      };
+    }
     const parsed = PreconditionSchema.safeParse(json2);
     if (!parsed.success) {
       throw new ApiError(409, `post file 409 body did not match precondition_failed shape`);
@@ -34096,7 +34288,7 @@ var sessionCommand = defineCommand({
 
 // src/commands/start.ts
 var import_gray_matter14 = __toESM(require_gray_matter(), 1);
-import { existsSync as existsSync9, readFileSync as readFileSync28, statSync as statSync18 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync30, statSync as statSync18 } from "node:fs";
 
 // src/lib/daemon-log.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9, renameSync as renameSync7, statSync as statSync4 } from "node:fs";
@@ -34340,7 +34532,7 @@ class DestructiveGate {
 }
 
 // src/lib/resolve-pending.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 
 // src/lib/conflicts.ts
 import { mkdirSync as mkdirSync10, readFileSync as readFileSync15, readdirSync as readdirSync6, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
@@ -34359,6 +34551,26 @@ function stashConflict(args) {
   writeFileSync7(target, args.contents, { mode: 384 });
   return target;
 }
+function stashEntityConflictOnce(args) {
+  const dir = conflictsRoot(args.workspaceSlug);
+  const head = `${args.entityType}.${args.entitySlug}.`;
+  const tail = new RegExp(`^\\d{4}-\\d{2}-\\d{2}T\\d{2}-\\d{2}-\\d{2}-\\d{3}Z\\.${args.side}\\.md$`);
+  let names = [];
+  try {
+    names = readdirSync6(dir);
+  } catch {
+    names = [];
+  }
+  const newest = names.filter((name) => name.startsWith(head) && tail.test(name.slice(head.length))).sort().pop();
+  if (newest !== undefined) {
+    const path5 = join12(dir, newest);
+    try {
+      if (readFileSync15(path5, "utf8") === args.contents)
+        return { path: path5, reused: true };
+    } catch {}
+  }
+  return { path: stashConflict(args), reused: false };
+}
 function fileConflictPath(args) {
   const { workspaceSlug, relPath, timestamp, side } = args;
   const iso = timestamp.toISOString().replace(/[:.]/g, "-");
@@ -34448,12 +34660,646 @@ function listConflictStashes(workspaceSlug) {
 }
 
 // src/lib/files/push.ts
-import { readFileSync as readFileSync16, statSync as statSync7 } from "node:fs";
+import { readFileSync as readFileSync17, statSync as statSync7 } from "node:fs";
+
+// src/lib/permanent-deletions.ts
+import { createHash as createHash3, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  closeSync as closeSync4,
+  constants as constants2,
+  existsSync as existsSync4,
+  fsyncSync as fsyncSync2,
+  fstatSync as fstatSync2,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync11,
+  openSync as openSync4,
+  readFileSync as readFileSync16,
+  renameSync as renameSync8,
+  unlinkSync as unlinkSync8,
+  writeSync as writeSync2
+} from "node:fs";
+import { dirname as dirname10, join as join13 } from "node:path";
+var PERMANENT_DELETE_KINDS = ["document", "workspace_file"];
+var UUID = exports_external.string().uuid();
+var SHA256 = exports_external.string().regex(/^[0-9a-f]{64}$/);
+function canonicalLogicalKey(kind, logicalKey) {
+  return kind === "document" ? isValidWorkspaceSlug(logicalKey) : validateFilesRelPath(logicalKey) === logicalKey;
+}
+var PendingOperationSchema = exports_external.object({
+  operation_id: UUID,
+  payload_digest: SHA256,
+  state: exports_external.enum(["pending", "transport_unknown", "finalized", "terminal_cleaned"]),
+  row_id: UUID.optional(),
+  updated_at: exports_external.string().datetime({ offset: true })
+}).superRefine((value, ctx) => {
+  if (value.state === "finalized" && value.row_id === undefined) {
+    ctx.addIssue({ code: "custom", message: "finalized operation requires row_id" });
+  }
+  if (value.state !== "finalized" && value.row_id !== undefined) {
+    ctx.addIssue({ code: "custom", message: "row_id is valid only for finalized operations" });
+  }
+});
+var RetirementRecordSchema = exports_external.object({
+  kind: exports_external.enum(PERMANENT_DELETE_KINDS),
+  logical_key: exports_external.string().min(1),
+  row_id: UUID,
+  purge_generation: UUID,
+  retirement_sequence: exports_external.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  retired_at: exports_external.string().datetime({ offset: true }),
+  disposition: exports_external.enum(["pending", "complete"]),
+  completed_at: exports_external.string().datetime({ offset: true }).optional(),
+  stash_path: exports_external.string().min(1).optional(),
+  stash_hash: SHA256.optional(),
+  operation: PendingOperationSchema.optional()
+}).superRefine((value, ctx) => {
+  if (!canonicalLogicalKey(value.kind, value.logical_key)) {
+    ctx.addIssue({ code: "custom", message: "retirement logical key is not canonical" });
+  }
+  if (value.disposition === "complete" && value.completed_at === undefined) {
+    ctx.addIssue({ code: "custom", message: "complete retirement requires completed_at" });
+  }
+  if (value.disposition === "pending" && value.completed_at !== undefined) {
+    ctx.addIssue({ code: "custom", message: "pending retirement cannot have completed_at" });
+  }
+  if (value.stash_path === undefined !== (value.stash_hash === undefined)) {
+    ctx.addIssue({ code: "custom", message: "stash_path and stash_hash must be written together" });
+  }
+});
+var RefreshMarkerSchema = exports_external.object({
+  kind: exports_external.enum(PERMANENT_DELETE_KINDS),
+  logical_key: exports_external.string().min(1),
+  required_generation: UUID.optional(),
+  started_at: exports_external.string().datetime({ offset: true }),
+  attempts: exports_external.number().int().nonnegative(),
+  retry_after: exports_external.string().datetime({ offset: true }).optional(),
+  state: exports_external.enum(["required", "retention_missing"])
+}).superRefine((value, ctx) => {
+  if (!canonicalLogicalKey(value.kind, value.logical_key)) {
+    ctx.addIssue({ code: "custom", message: "refresh logical key is not canonical" });
+  }
+});
+var JournalBodySchema = exports_external.object({
+  version: exports_external.literal(1),
+  revision: exports_external.number().int().nonnegative(),
+  workspace_slug: exports_external.string().min(1),
+  records: exports_external.array(RetirementRecordSchema),
+  refresh: exports_external.array(RefreshMarkerSchema)
+});
+var JournalFileSchema = JournalBodySchema.extend({ checksum: SHA256 });
+
+class PermanentDeletionJournalError extends Error {
+  stage;
+  constructor(message, stage) {
+    super(message);
+    this.stage = stage;
+    this.name = "PermanentDeletionJournalError";
+  }
+}
+function permanentDeletionJournalPath(workspaceSlug) {
+  if (!isValidWorkspaceSlug(workspaceSlug)) {
+    throw new PermanentDeletionJournalError(`refusing unsafe workspace slug: ${JSON.stringify(workspaceSlug)}`, "validate");
+  }
+  return join13(plinthHome(), workspaceSlug, "permanent-deletions.json");
+}
+function recordKey2(kind, logicalKey) {
+  return `${kind}\x00${logicalKey}`;
+}
+function canonical(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${canonical(obj[key])}`).join(",")}}`;
+}
+function canonicalPayloadDigest(value) {
+  return createHash3("sha256").update(canonical(value), "utf8").digest("hex");
+}
+function fileCreatePayloadDigest(contentHash, mimeType) {
+  return canonicalPayloadDigest({ content_hash: contentHash, mime_type: mimeType });
+}
+function checksum(body) {
+  return createHash3("sha256").update(canonical(body), "utf8").digest("hex");
+}
+function emptyJournal(workspaceSlug) {
+  return { version: 1, revision: 0, workspace_slug: workspaceSlug, records: [], refresh: [] };
+}
+function validateUniqueness(journal) {
+  const records = new Set;
+  for (const record2 of journal.records) {
+    const key = recordKey2(record2.kind, record2.logical_key);
+    if (records.has(key)) {
+      throw new PermanentDeletionJournalError(`permanent deletion journal contains duplicate record ${record2.kind}:${record2.logical_key}`, "validate");
+    }
+    records.add(key);
+  }
+  const refresh = new Set;
+  for (const marker of journal.refresh) {
+    const key = recordKey2(marker.kind, marker.logical_key);
+    if (refresh.has(key)) {
+      throw new PermanentDeletionJournalError(`permanent deletion journal contains duplicate refresh marker ${marker.kind}:${marker.logical_key}`, "validate");
+    }
+    refresh.add(key);
+  }
+}
+function assertOwnerOnlyFile(path5) {
+  const stat = lstatSync4(path5);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new PermanentDeletionJournalError(`${path5} is not a regular file`, "validate");
+  }
+  if ((stat.mode & 511) !== 384) {
+    throw new PermanentDeletionJournalError(`${path5} must have mode 0600`, "validate");
+  }
+  const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+  if (uid !== undefined && stat.uid !== uid) {
+    throw new PermanentDeletionJournalError(`${path5} is not owned by the current user`, "validate");
+  }
+}
+function assertPrivateDirectory(path5) {
+  const stat = lstatSync4(path5);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new PermanentDeletionJournalError(`${path5} is not a private directory`, "validate");
+  }
+  if ((stat.mode & 511) !== 448) {
+    throw new PermanentDeletionJournalError(`${path5} must have mode 0700`, "validate");
+  }
+  const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+  if (uid !== undefined && stat.uid !== uid) {
+    throw new PermanentDeletionJournalError(`${path5} is not owned by the current user`, "validate");
+  }
+}
+function parseJournal(workspaceSlug, raw) {
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch (error52) {
+    const detail = error52 instanceof Error ? error52.message : String(error52);
+    throw new PermanentDeletionJournalError(`permanent deletion journal is not valid JSON: ${detail}`, "validate");
+  }
+  const parsed = JournalFileSchema.safeParse(json2);
+  if (!parsed.success) {
+    throw new PermanentDeletionJournalError(`permanent deletion journal does not match schema v1: ${parsed.error.message}`, "validate");
+  }
+  const { checksum: storedChecksum, ...body } = parsed.data;
+  if (body.workspace_slug !== workspaceSlug) {
+    throw new PermanentDeletionJournalError(`permanent deletion journal belongs to ${body.workspace_slug}, not ${workspaceSlug}`, "validate");
+  }
+  if (checksum(body) !== storedChecksum) {
+    throw new PermanentDeletionJournalError("permanent deletion journal checksum mismatch", "validate");
+  }
+  validateUniqueness(body);
+  return body;
+}
+function fsyncDirectory(path5) {
+  const fd = openSync4(path5, constants2.O_RDONLY);
+  try {
+    fsyncSync2(fd);
+  } finally {
+    closeSync4(fd);
+  }
+}
+function loadPermanentDeletionJournal(workspaceSlug) {
+  const target = permanentDeletionJournalPath(workspaceSlug);
+  if (!existsSync4(target))
+    return emptyJournal(workspaceSlug);
+  assertPrivateDirectory(dirname10(target));
+  assertOwnerOnlyFile(target);
+  const journal = parseJournal(workspaceSlug, readFileSync16(target, "utf8"));
+  try {
+    fsyncDirectory(dirname10(target));
+  } catch (error52) {
+    const detail = error52 instanceof Error ? error52.message : String(error52);
+    throw new PermanentDeletionJournalError(`permanent deletion journal durability remains indeterminate: ${detail}`, "durability_indeterminate");
+  }
+  return journal;
+}
+function validatedCurrentRevision(workspaceSlug, expected) {
+  const current = loadPermanentDeletionJournal(workspaceSlug);
+  if (current.revision !== expected) {
+    throw new PermanentDeletionJournalError(`permanent deletion journal revision changed from ${expected} to ${current.revision}`, "validate");
+  }
+  return current;
+}
+function writePermanentDeletionJournal(prior, next) {
+  if (prior.workspace_slug !== next.workspace_slug) {
+    throw new PermanentDeletionJournalError("journal workspace cannot change", "validate");
+  }
+  validatedCurrentRevision(prior.workspace_slug, prior.revision);
+  const body = JournalBodySchema.parse({ ...next, revision: prior.revision + 1 });
+  validateUniqueness(body);
+  const target = permanentDeletionJournalPath(body.workspace_slug);
+  const parent = dirname10(target);
+  mkdirSync11(parent, { recursive: true, mode: 448 });
+  chmodSync(parent, 448);
+  assertPrivateDirectory(parent);
+  if (existsSync4(target))
+    assertOwnerOnlyFile(target);
+  const tmp = join13(parent, `.permanent-deletions.${process.pid}.${randomUUID()}.tmp`);
+  const wire = JSON.stringify({ ...body, checksum: checksum(body) }, null, 2) + `
+`;
+  let fd;
+  try {
+    fd = openSync4(tmp, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | (constants2.O_NOFOLLOW ?? 0), 384);
+    const stat = fstatSync2(fd);
+    if (!stat.isFile() || (stat.mode & 511) !== 384) {
+      throw new PermanentDeletionJournalError("journal temporary file is not owner-only", "prepare");
+    }
+    const bytes = Buffer.from(wire, "utf8");
+    let offset = 0;
+    while (offset < bytes.length)
+      offset += writeSync2(fd, bytes, offset, bytes.length - offset);
+    fsyncSync2(fd);
+    closeSync4(fd);
+    fd = undefined;
+  } catch (error52) {
+    if (fd !== undefined) {
+      try {
+        closeSync4(fd);
+      } catch {}
+    }
+    try {
+      unlinkSync8(tmp);
+    } catch {}
+    if (error52 instanceof PermanentDeletionJournalError)
+      throw error52;
+    const detail = error52 instanceof Error ? error52.message : String(error52);
+    throw new PermanentDeletionJournalError(`could not prepare journal write: ${detail}`, "write");
+  }
+  try {
+    renameSync8(tmp, target);
+  } catch (error52) {
+    let installed2 = false;
+    try {
+      assertOwnerOnlyFile(target);
+      const candidate = parseJournal(body.workspace_slug, readFileSync16(target, "utf8"));
+      installed2 = candidate.revision === body.revision && checksum(candidate) === checksum(body);
+    } catch {
+      installed2 = false;
+    }
+    try {
+      unlinkSync8(tmp);
+    } catch {}
+    if (!installed2) {
+      const detail = error52 instanceof Error ? error52.message : String(error52);
+      throw new PermanentDeletionJournalError(`could not rename journal: ${detail}`, "rename");
+    }
+  }
+  assertOwnerOnlyFile(target);
+  const installed = parseJournal(body.workspace_slug, readFileSync16(target, "utf8"));
+  if (installed.revision !== body.revision || checksum(installed) !== checksum(body)) {
+    throw new PermanentDeletionJournalError("renamed journal revision did not validate", "durability_indeterminate");
+  }
+  try {
+    fsyncDirectory(parent);
+  } catch (firstError) {
+    assertOwnerOnlyFile(target);
+    const reopened = parseJournal(body.workspace_slug, readFileSync16(target, "utf8"));
+    if (reopened.revision !== body.revision || checksum(reopened) !== checksum(body)) {
+      throw new PermanentDeletionJournalError("journal changed after rename", "durability_indeterminate");
+    }
+    try {
+      fsyncDirectory(parent);
+    } catch (secondError) {
+      const first = firstError instanceof Error ? firstError.message : String(firstError);
+      const second = secondError instanceof Error ? secondError.message : String(secondError);
+      throw new PermanentDeletionJournalError(`journal renamed but parent directory sync failed (${first}; retry: ${second})`, "durability_indeterminate");
+    }
+  }
+  return body;
+}
+function updatePermanentDeletionJournal(workspaceSlug, update) {
+  const prior = loadPermanentDeletionJournal(workspaceSlug);
+  const next = update(prior);
+  if (next === prior)
+    return prior;
+  return writePermanentDeletionJournal(prior, next);
+}
+function findRetirement(journal, kind, logicalKey) {
+  return journal.records.find((record2) => record2.kind === kind && record2.logical_key === logicalKey);
+}
+function findRefreshMarker(journal, kind, logicalKey) {
+  return journal.refresh.find((marker) => marker.kind === kind && marker.logical_key === logicalKey);
+}
+function replaceRecord(journal, record2) {
+  return {
+    ...journal,
+    records: [
+      ...journal.records.filter((item) => recordKey2(item.kind, item.logical_key) !== recordKey2(record2.kind, record2.logical_key)),
+      record2
+    ]
+  };
+}
+function requireFeedRefresh(args) {
+  const now = args.now ?? (() => new Date);
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRefreshMarker(journal, args.kind, args.logicalKey);
+    if (existing)
+      return journal;
+    return {
+      ...journal,
+      refresh: [...journal.refresh, {
+        kind: args.kind,
+        logical_key: args.logicalKey,
+        ...args.requiredGeneration ? { required_generation: args.requiredGeneration } : {},
+        started_at: now().toISOString(),
+        attempts: 0,
+        state: "required"
+      }]
+    };
+  });
+}
+function markRetentionMissing(args) {
+  const now = args.now ?? (() => new Date);
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRefreshMarker(journal, args.kind, args.logicalKey);
+    if (!existing)
+      return journal;
+    const attempts = existing.attempts + 1;
+    const backoffMs = Math.min(3600000, 1000 * 2 ** Math.min(attempts, 12));
+    return {
+      ...journal,
+      refresh: journal.refresh.map((marker) => marker === existing ? {
+        ...marker,
+        attempts,
+        state: "retention_missing",
+        retry_after: new Date(now().getTime() + backoffMs).toISOString()
+      } : marker)
+    };
+  });
+}
+function clearFeedRefresh(args) {
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const record2 = findRetirement(journal, args.kind, args.logicalKey);
+    if (!record2 || record2.disposition !== "complete" || record2.purge_generation !== args.generation) {
+      throw new PermanentDeletionJournalError("cannot clear refresh before matching disposition is complete", "validate");
+    }
+    const next = journal.refresh.filter((marker) => recordKey2(marker.kind, marker.logical_key) !== recordKey2(args.kind, args.logicalKey));
+    return next.length === journal.refresh.length ? journal : { ...journal, refresh: next };
+  });
+}
+function recordRetirementPending(args) {
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRetirement(journal, args.kind, args.logicalKey);
+    if (existing && existing.retirement_sequence > args.retirementSequence)
+      return journal;
+    if (existing && existing.retirement_sequence === args.retirementSequence && existing.purge_generation !== args.purgeGeneration) {
+      throw new PermanentDeletionJournalError("one retirement_sequence maps to multiple generations", "validate");
+    }
+    if (existing?.purge_generation === args.purgeGeneration)
+      return journal;
+    return replaceRecord(journal, {
+      kind: args.kind,
+      logical_key: args.logicalKey,
+      row_id: args.rowId,
+      purge_generation: args.purgeGeneration,
+      retirement_sequence: args.retirementSequence,
+      retired_at: args.retiredAt,
+      disposition: "pending"
+    });
+  });
+}
+function completeRetirement(args) {
+  if (args.stashPath === undefined !== (args.stashHash === undefined)) {
+    throw new PermanentDeletionJournalError("stash path and hash must be supplied together", "validate");
+  }
+  const now = args.now ?? (() => new Date);
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRetirement(journal, args.kind, args.logicalKey);
+    if (!existing || existing.purge_generation !== args.generation) {
+      throw new PermanentDeletionJournalError("cannot complete an unknown retirement generation", "validate");
+    }
+    if (existing.disposition === "complete")
+      return journal;
+    return replaceRecord(journal, {
+      ...existing,
+      disposition: "complete",
+      completed_at: now().toISOString(),
+      ...args.stashPath ? { stash_path: args.stashPath, stash_hash: args.stashHash } : {}
+    });
+  });
+}
+function recordRetirementStash(args) {
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRetirement(journal, args.kind, args.logicalKey);
+    if (!existing || existing.purge_generation !== args.generation) {
+      throw new PermanentDeletionJournalError("cannot attach a stash to an unknown retirement", "validate");
+    }
+    if (existing.stash_path === args.stashPath && existing.stash_hash === args.stashHash) {
+      return journal;
+    }
+    if (existing.stash_path && existing.stash_hash !== args.stashHash) {
+      throw new PermanentDeletionJournalError("retirement stash changed after it was recorded", "validate");
+    }
+    return replaceRecord(journal, {
+      ...existing,
+      stash_path: args.stashPath,
+      stash_hash: args.stashHash
+    });
+  });
+}
+function prepareGenerationCreate(args) {
+  const now = args.now ?? (() => new Date);
+  let decision = { kind: "ordinary" };
+  updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    if (findRefreshMarker(journal, args.kind, args.logicalKey)) {
+      decision = { kind: "blocked", reason: "refresh_required" };
+      return journal;
+    }
+    const retirement = findRetirement(journal, args.kind, args.logicalKey);
+    if (!retirement) {
+      decision = { kind: "ordinary" };
+      return journal;
+    }
+    if (retirement.disposition !== "complete") {
+      decision = { kind: "blocked", reason: "disposition_pending" };
+      return journal;
+    }
+    const operation = retirement.operation;
+    if (operation) {
+      if (operation.payload_digest === args.payloadDigest && (operation.state === "pending" || operation.state === "transport_unknown")) {
+        decision = {
+          kind: "authorised",
+          retiredGeneration: retirement.purge_generation,
+          operationId: operation.operation_id,
+          payloadDigest: operation.payload_digest
+        };
+        return journal;
+      }
+      if (operation.state !== "terminal_cleaned") {
+        decision = { kind: "blocked", reason: "operation_unresolved" };
+        return journal;
+      }
+    }
+    const nextOperation = {
+      operation_id: randomUUID(),
+      payload_digest: args.payloadDigest,
+      state: "pending",
+      updated_at: now().toISOString()
+    };
+    decision = {
+      kind: "authorised",
+      retiredGeneration: retirement.purge_generation,
+      operationId: nextOperation.operation_id,
+      payloadDigest: nextOperation.payload_digest
+    };
+    return replaceRecord(journal, { ...retirement, operation: nextOperation });
+  });
+  return decision;
+}
+function updateCreateOperation(args) {
+  const now = args.now ?? (() => new Date);
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const retirement = findRetirement(journal, args.kind, args.logicalKey);
+    if (!retirement?.operation || retirement.operation.operation_id !== args.operationId) {
+      throw new PermanentDeletionJournalError("operation update does not match the journal", "validate");
+    }
+    const from = retirement.operation.state;
+    const allowed = {
+      pending: new Set(["pending", "transport_unknown", "finalized", "terminal_cleaned"]),
+      transport_unknown: new Set(["transport_unknown", "pending", "finalized", "terminal_cleaned"]),
+      finalized: new Set(["finalized", "terminal_cleaned"]),
+      terminal_cleaned: new Set(["terminal_cleaned"])
+    };
+    if (!allowed[from].has(args.state)) {
+      throw new PermanentDeletionJournalError(`invalid create operation transition ${from} -> ${args.state}`, "validate");
+    }
+    if (args.state === "finalized" && args.rowId === undefined) {
+      throw new PermanentDeletionJournalError("finalized operation requires a row id", "validate");
+    }
+    return replaceRecord(journal, {
+      ...retirement,
+      operation: {
+        operation_id: retirement.operation.operation_id,
+        payload_digest: retirement.operation.payload_digest,
+        state: args.state,
+        ...args.state === "finalized" && args.rowId ? { row_id: args.rowId } : {},
+        updated_at: now().toISOString()
+      }
+    });
+  });
+}
+
+// src/lib/permanent-mutex.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+
+// src/lib/per-id-mutex.ts
+class PerIdMutex {
+  chains = new Map;
+  async run(key, fn) {
+    const prior = this.chains.get(key) ?? Promise.resolve();
+    const next = prior.then(fn, fn);
+    this.chains.set(key, next);
+    const cleanup = () => {
+      if (this.chains.get(key) === next) {
+        this.chains.delete(key);
+      }
+    };
+    next.then(cleanup, cleanup);
+    return next;
+  }
+  size() {
+    return this.chains.size;
+  }
+}
+
+// src/lib/permanent-mutex.ts
+var mutex = new PerIdMutex;
+var heldKeys = new AsyncLocalStorage;
+function permanentDeletionMutexKey(kind, logicalKey) {
+  return `permanent:${kind}:${logicalKey}`;
+}
+function withPermanentDeletionLock(kind, logicalKey, run) {
+  const key = permanentDeletionMutexKey(kind, logicalKey);
+  const held = heldKeys.getStore();
+  if (held?.has(key))
+    return run();
+  return mutex.run(key, () => heldKeys.run(new Set([...held ?? [], key]), run));
+}
+
+// src/lib/permanent-create.ts
+async function prepareOrResolveGenerationCreate(args) {
+  return withPermanentDeletionLock(args.kind, args.logicalKey, () => prepareOrResolveGenerationCreateLocked(args));
+}
+async function prepareOrResolveGenerationCreateLocked(args) {
+  let decision = prepareGenerationCreate(args);
+  if (decision.kind !== "blocked" || decision.reason !== "operation_unresolved") {
+    return decision;
+  }
+  const journal = loadPermanentDeletionJournal(args.workspaceSlug);
+  const retirement = findRetirement(journal, args.kind, args.logicalKey);
+  const operation = retirement?.operation;
+  if (!operation)
+    return decision;
+  const entityKind = args.kind;
+  const resolved = await resolvePermanentDeletionOperation({
+    baseUrl: args.baseUrl,
+    pat: args.pat,
+    entityKind,
+    operationId: operation.operation_id,
+    fetchImpl: args.fetchImpl
+  });
+  if (resolved.entity_kind !== entityKind || resolved.operation_id !== operation.operation_id) {
+    throw new Error("operation resolution identity does not match the local journal");
+  }
+  if (resolved.status === "retired_not_found") {
+    updateCreateOperation({
+      workspaceSlug: args.workspaceSlug,
+      kind: args.kind,
+      logicalKey: args.logicalKey,
+      operationId: operation.operation_id,
+      state: "terminal_cleaned",
+      now: args.now
+    });
+    return prepareGenerationCreate(args);
+  }
+  if (resolved.logical_key !== args.logicalKey || resolved.payload_digest !== operation.payload_digest) {
+    throw new Error("operation resolution binding does not match the local journal");
+  }
+  if (resolved.status === "pending") {
+    updateCreateOperation({
+      workspaceSlug: args.workspaceSlug,
+      kind: args.kind,
+      logicalKey: args.logicalKey,
+      operationId: operation.operation_id,
+      state: "pending",
+      now: args.now
+    });
+    return { kind: "blocked", reason: "operation_unresolved" };
+  }
+  if (resolved.status === "terminal_cleaned") {
+    updateCreateOperation({
+      workspaceSlug: args.workspaceSlug,
+      kind: args.kind,
+      logicalKey: args.logicalKey,
+      operationId: operation.operation_id,
+      state: "terminal_cleaned",
+      now: args.now
+    });
+    return prepareGenerationCreate(args);
+  }
+  const id = exports_external.object({ id: exports_external.string().uuid() }).parse(resolved.live).id;
+  updateCreateOperation({
+    workspaceSlug: args.workspaceSlug,
+    kind: args.kind,
+    logicalKey: args.logicalKey,
+    operationId: operation.operation_id,
+    state: "finalized",
+    rowId: id,
+    now: args.now
+  });
+  return {
+    kind: "finalized",
+    live: resolved.live,
+    operationId: operation.operation_id,
+    payloadDigest: operation.payload_digest
+  };
+}
 
 // src/lib/files/content-hash.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function sha256Bytes(bytes) {
-  return createHash3("sha256").update(bytes).digest("hex");
+  return createHash4("sha256").update(bytes).digest("hex");
 }
 
 // src/lib/files/mime.ts
@@ -34552,6 +35398,9 @@ async function restoreFileFromCloud(args) {
   });
 }
 async function pushFilesUpsert(args) {
+  return withPermanentDeletionLock("workspace_file", args.relPath, () => pushFilesUpsertLocked(args));
+}
+async function pushFilesUpsertLocked(args) {
   const { workspaceSlug, baseUrl, pat, absolutePath, relPath, state, prepared, deps } = args;
   const fetchImpl = deps?.fetchImpl;
   const now = deps?.now ?? (() => new Date);
@@ -34604,7 +35453,7 @@ async function pushFilesUpsert(args) {
         state: next
       };
     }
-    bytes = readFileSync16(absolutePath);
+    bytes = readFileSync17(absolutePath);
     hash2 = sha256Bytes(bytes);
     inode = st.ino;
   }
@@ -34619,7 +35468,61 @@ async function pushFilesUpsert(args) {
     return { outcome: { kind: "noop", relPath }, state };
   }
   const mimeType = inferMime(relPath);
+  const createProtocol = existing ? { kind: "ordinary" } : await prepareOrResolveGenerationCreate({
+    workspaceSlug,
+    baseUrl,
+    pat,
+    kind: "workspace_file",
+    logicalKey: relPath,
+    payloadDigest: fileCreatePayloadDigest(hash2, mimeType),
+    now,
+    fetchImpl
+  });
+  if (createProtocol.kind === "blocked") {
+    output?.warn(`files/${relPath} is held by permanent-delete reconciliation (${createProtocol.reason}).`);
+    return {
+      outcome: { kind: "permanent_delete_blocked", relPath, reason: createProtocol.reason },
+      state
+    };
+  }
+  if (createProtocol.kind === "finalized") {
+    const parsed = FileLiveSchema.safeParse(createProtocol.live);
+    if (!parsed.success) {
+      throw new ApiError(200, "finalized file create operation live projection did not match the file schema");
+    }
+    if (parsed.data.path !== relPath) {
+      throw new ApiError(200, "finalized file create operation live projection had the wrong path");
+    }
+    const adoptedState = persistFiles(state, {
+      id: parsed.data.id,
+      path: relPath,
+      content_hash: parsed.data.content_hash,
+      size_bytes: parsed.data.size_bytes,
+      mime_type: parsed.data.mime_type,
+      updated_at: parsed.data.updated_at,
+      inode
+    });
+    return pushFilesUpsert({
+      ...args,
+      state: adoptedState,
+      prepared: { bytes, hash: hash2, size, inode }
+    });
+  }
   const acceptPush = (row, action) => {
+    if (createProtocol.kind === "authorised" && row.path !== relPath) {
+      throw new ApiError(200, "generation-bearing file create response had the wrong path");
+    }
+    if (createProtocol.kind === "authorised") {
+      updateCreateOperation({
+        workspaceSlug,
+        kind: "workspace_file",
+        logicalKey: relPath,
+        operationId: createProtocol.operationId,
+        state: "finalized",
+        rowId: row.id,
+        now
+      });
+    }
     output?.log(filePushLine({ path: relPath, id: row.id, action }));
     return {
       outcome: { kind: action, relPath, id: row.id },
@@ -34655,22 +35558,57 @@ async function pushFilesUpsert(args) {
     output?.log(fileFailedLine({ path: relPath, status: 400, reason: "hash_mismatch" }));
     return { outcome: { kind: "ignored", relPath, reason: "hash_mismatch" }, state };
   };
-  const res = await postFile({
-    baseUrl,
-    pat,
-    relPath,
-    bytes,
-    contentHash: hash2,
-    mimeType,
-    expectedUpdatedAt: existing?.updated_at ?? null,
-    fetchImpl
-  });
+  let res;
+  try {
+    res = await postFile({
+      baseUrl,
+      pat,
+      relPath,
+      bytes,
+      contentHash: hash2,
+      mimeType,
+      expectedUpdatedAt: existing?.updated_at ?? null,
+      ...createProtocol.kind === "authorised" ? {
+        retiredGeneration: createProtocol.retiredGeneration,
+        operationId: createProtocol.operationId
+      } : {},
+      fetchImpl
+    });
+  } catch (error52) {
+    if (createProtocol.kind === "authorised" && (!(error52 instanceof ApiError) || error52.status === 0 || error52.status >= 500 || error52.status >= 200 && error52.status < 300)) {
+      updateCreateOperation({
+        workspaceSlug,
+        kind: "workspace_file",
+        logicalKey: relPath,
+        operationId: createProtocol.operationId,
+        state: "transport_unknown",
+        now
+      });
+    }
+    throw error52;
+  }
   if (res.ok)
     return acceptPush(res.row, existing ? "updated" : "created");
   if (res.code === 413)
     return rejectOverCap(res.maxBytes);
   if (res.code === 400)
     return rejectHashMismatch();
+  if ("reason" in res && res.reason === "permanent_name_retired") {
+    if (res.entityKind !== "workspace_file" || res.logicalKey !== relPath) {
+      throw new ApiError(409, "permanent-name refusal identity did not match the file create");
+    }
+    requireFeedRefresh({
+      workspaceSlug,
+      kind: "workspace_file",
+      logicalKey: res.logicalKey,
+      now
+    });
+    output?.warn(`files/${res.logicalKey} was permanently deleted in Plinth; local bytes are held while the file feed is refreshed.`);
+    return {
+      outcome: { kind: "permanent_delete_blocked", relPath: res.logicalKey, reason: "refresh_required" },
+      state
+    };
+  }
   let nextState = state;
   let cloudRow;
   if (existing) {
@@ -34692,6 +35630,25 @@ async function pushFilesUpsert(args) {
         return rejectOverCap(retry.maxBytes);
       if (retry.code === 400)
         return rejectHashMismatch();
+      if ("reason" in retry && retry.reason === "permanent_name_retired") {
+        if (retry.entityKind !== "workspace_file" || retry.logicalKey !== relPath) {
+          throw new ApiError(409, "permanent-name refusal identity did not match the file retry");
+        }
+        requireFeedRefresh({
+          workspaceSlug,
+          kind: "workspace_file",
+          logicalKey: retry.logicalKey,
+          now
+        });
+        return {
+          outcome: {
+            kind: "permanent_delete_blocked",
+            relPath: retry.logicalKey,
+            reason: "refresh_required"
+          },
+          state
+        };
+      }
       cloudRow = undefined;
     }
   }
@@ -34757,29 +35714,9 @@ async function pushFilesDelete(args) {
   return { outcome: { kind: "conflict", relPath, stashPath: "" }, state: nextState };
 }
 
-// src/lib/per-id-mutex.ts
-class PerIdMutex {
-  chains = new Map;
-  async run(key, fn) {
-    const prior = this.chains.get(key) ?? Promise.resolve();
-    const next = prior.then(fn, fn);
-    this.chains.set(key, next);
-    const cleanup = () => {
-      if (this.chains.get(key) === next) {
-        this.chains.delete(key);
-      }
-    };
-    next.then(cleanup, cleanup);
-    return next;
-  }
-  size() {
-    return this.chains.size;
-  }
-}
-
 // src/lib/push.ts
 var import_gray_matter10 = __toESM(require_gray_matter(), 1);
-import { existsSync as existsSync4, readFileSync as readFileSync18, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync19, statSync as statSync8 } from "node:fs";
 import { basename as basename5, relative as relative5 } from "node:path";
 
 // src/lib/frontmatter-id.ts
@@ -34829,7 +35766,7 @@ function frontmatterIdWriteIsSound(next, id, expectedBody) {
 
 // src/lib/pull-write.ts
 var import_gray_matter9 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 function computeMirrorHashes(strategy, content) {
   const parsed = import_gray_matter9.default(content);
   const fm = parsed.data ?? {};
@@ -34873,7 +35810,7 @@ function relocateForSlugChange(args) {
   }
   let raw = null;
   try {
-    raw = readFileSync17(fromPath, "utf8");
+    raw = readFileSync18(fromPath, "utf8");
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
@@ -34939,12 +35876,21 @@ function relocateForSlugChange(args) {
 }
 function writeMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, suppressor, pathSlug) {
   const targetSlug = pathSlug ?? doc2.slug;
+  const content = renderMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, targetSlug);
+  if (suppressor) {
+    const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
+    suppressor.registerWrite(target, computeMirrorHashes(strategy, content));
+  }
+  writeMirrorFile(workspaceSlug, strategy.type, targetSlug, content);
+  return content;
+}
+function renderMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, targetSlug) {
   let content = strategy.serialise(doc2);
   if (strategy.preserveLocalBodyOnPull) {
     const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
     let existing = null;
     try {
-      existing = readFileSync17(target, "utf8");
+      existing = readFileSync18(target, "utf8");
     } catch (err) {
       if (err?.code !== "ENOENT")
         throw err;
@@ -34958,11 +35904,6 @@ function writeMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, suppressor,
 `;
     }
   }
-  if (suppressor) {
-    const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
-    suppressor.registerWrite(target, computeMirrorHashes(strategy, content));
-  }
-  writeMirrorFile(workspaceSlug, strategy.type, targetSlug, content);
   return content;
 }
 
@@ -35076,7 +36017,7 @@ function stampStateFromMirror(args) {
   const { strategy, workspaceSlug, doc: doc2, state, priorMemoryHash } = args;
   const targetSlug = args.pathSlug ?? doc2.slug;
   const mirrorPath = entityFilePath(workspaceSlug, strategy.type, targetSlug);
-  const mirrorRaw = readFileSync18(mirrorPath, "utf8");
+  const mirrorRaw = readFileSync19(mirrorPath, "utf8");
   const mirrorParsed = import_gray_matter10.default(mirrorRaw);
   const mirrorFm = mirrorParsed.data ?? {};
   const mirrorLifted = splitUserFrontmatter(strategy, mirrorFm);
@@ -35196,7 +36137,7 @@ async function pushFile(args) {
   const identity = args.identity ?? "auto";
   const fetchImpl = deps?.fetchImpl;
   const now = deps?.now ?? (() => new Date);
-  const mutex = deps?.mutex ?? new PerIdMutex;
+  const mutex2 = deps?.mutex ?? new PerIdMutex;
   const output = deps?.output;
   const suppressor = deps?.suppressor;
   const echo = deps?.echo;
@@ -35222,14 +36163,14 @@ async function pushFile(args) {
       absolutePath,
       state,
       unlinkContext,
-      mutex,
+      mutex: mutex2,
       fetchImpl,
       output
     });
   }
   let raw;
   try {
-    raw = readFileSync18(absolutePath, "utf8");
+    raw = readFileSync19(absolutePath, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") {
       return runPushDelete({
@@ -35242,7 +36183,7 @@ async function pushFile(args) {
         absolutePath,
         state,
         unlinkContext: null,
-        mutex,
+        mutex: mutex2,
         fetchImpl,
         output
       });
@@ -35304,7 +36245,7 @@ async function pushFile(args) {
       raw,
       parsed,
       state,
-      mutex,
+      mutex: mutex2,
       fetchImpl,
       now,
       output,
@@ -35325,7 +36266,7 @@ async function pushFile(args) {
     parsed,
     stateEntry,
     state,
-    mutex,
+    mutex: mutex2,
     fetchImpl,
     now,
     output,
@@ -35579,7 +36520,7 @@ async function runPushUpsert(args) {
     if (liveEntry !== snapshotEntry) {
       let onDisk = null;
       try {
-        onDisk = readFileSync18(args.absolutePath, "utf8");
+        onDisk = readFileSync19(args.absolutePath, "utf8");
       } catch {
         onDisk = null;
       }
@@ -35788,6 +36729,28 @@ async function runPushUpsert(args) {
         base: workingState
       };
     }
+    if (patchResult.reason === "permanent_name_retired") {
+      if (strategy.type !== "documents" || patchResult.entityKind !== "document" || patchResult.logicalKey !== args.stateEntry.slug) {
+        throw new ApiError(409, "permanent-name refusal identity did not match the document update");
+      }
+      requireFeedRefresh({
+        workspaceSlug: args.workspaceSlug,
+        kind: "document",
+        logicalKey: patchResult.logicalKey,
+        now: args.now
+      });
+      args.output?.warn(`${strategy.type}/${patchResult.logicalKey} was permanently deleted in Plinth; local content is held while the document feed is refreshed.`);
+      return {
+        outcome: {
+          kind: "permanent_delete_blocked",
+          entityType: strategy.type,
+          entitySlug: patchResult.logicalKey,
+          reason: "refresh_required"
+        },
+        state: workingState,
+        base: workingState
+      };
+    }
     if (patchResult.reason === "slug_conflict") {
       throw new Error(`patch ${strategy.type} returned slug_conflict for a body+frontmatter PATCH (no slug sent)`);
     }
@@ -36019,7 +36982,7 @@ function writeCreatedIdBack(args) {
     if (entityFilePath(args.workspaceSlug, args.strategy.type, args.slug) !== args.absolutePath) {
       return;
     }
-    const readBack = args.readBack ?? ((p) => readFileSync18(p, "utf8"));
+    const readBack = args.readBack ?? ((p) => readFileSync19(p, "utf8"));
     if (readBack(args.absolutePath) !== args.raw)
       return;
     args.suppressor?.registerWrite(args.absolutePath, computeMirrorHashes(args.strategy, write.content));
@@ -36027,6 +36990,12 @@ function writeCreatedIdBack(args) {
   } catch {}
 }
 async function runPushCreate(args) {
+  if (args.strategy.type === "documents") {
+    return withPermanentDeletionLock("document", args.slug, () => runPushCreateLocked(args));
+  }
+  return runPushCreateLocked(args);
+}
+async function runPushCreateLocked(args) {
   const strategy = args.strategy;
   const key = `create:${strategy.type}:${args.slug}`;
   return args.mutex.run(key, async () => {
@@ -36064,15 +37033,108 @@ async function runPushCreate(args) {
       else
         payload.body = normalised;
     }
-    const createResult = await createEntity({
-      strategy,
+    const createProtocol = strategy.type === "documents" ? await prepareOrResolveGenerationCreate({
+      workspaceSlug: args.workspaceSlug,
       baseUrl: args.baseUrl,
       pat: args.pat,
-      payload,
+      kind: "document",
+      logicalKey: args.slug,
+      payloadDigest: canonicalPayloadDigest(payload),
+      now: args.now,
       fetchImpl: args.fetchImpl
-    });
+    }) : { kind: "ordinary" };
+    if (createProtocol.kind === "blocked") {
+      args.output?.warn(`${strategy.type}/${args.slug} is held by permanent-delete reconciliation (${createProtocol.reason}).`);
+      return {
+        outcome: {
+          kind: "permanent_delete_blocked",
+          entityType: strategy.type,
+          entitySlug: args.slug,
+          reason: createProtocol.reason
+        },
+        state: args.state,
+        base: args.state
+      };
+    }
+    if (createProtocol.kind === "finalized") {
+      const parsedLive = strategy.singleResponseSchema.safeParse(createProtocol.live);
+      if (!parsedLive.success) {
+        throw new ApiError(200, "finalized create operation live projection did not match the entity schema");
+      }
+      if (parsedLive.data.slug !== args.slug) {
+        throw new ApiError(200, "finalized create operation live projection had the wrong slug");
+      }
+      const acknowledged = computeMirrorHashes(strategy, strategy.serialise(parsedLive.data));
+      const adoptedEntry = {
+        id: parsedLive.data.id,
+        slug: parsedLive.data.slug,
+        updated_at: parsedLive.data.updated_at,
+        revision: parsedLive.data.revision,
+        body_hash: acknowledged.bodyHash,
+        frontmatter_hash: acknowledged.frontmatterHash,
+        inode: safeInode2(args.absolutePath)
+      };
+      const adoptedState = persistEntry(args.state, strategy.type, adoptedEntry);
+      return runPushUpsert({
+        echo: args.echo,
+        strategy,
+        workspaceSlug: args.workspaceSlug,
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        absolutePath: args.absolutePath,
+        raw: args.raw,
+        parsed: args.parsed,
+        stateEntry: adoptedEntry,
+        state: adoptedState,
+        mutex: args.mutex,
+        fetchImpl: args.fetchImpl,
+        now: args.now,
+        output: args.output,
+        quarantinedKeys: args.quarantinedKeys
+      });
+    }
+    let createResult;
+    try {
+      createResult = await createEntity({
+        strategy,
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        payload,
+        ...createProtocol.kind === "authorised" ? {
+          retiredGeneration: createProtocol.retiredGeneration,
+          operationId: createProtocol.operationId
+        } : {},
+        fetchImpl: args.fetchImpl
+      });
+    } catch (error52) {
+      if (createProtocol.kind === "authorised" && (!(error52 instanceof ApiError) || error52.status === 0 || error52.status >= 500 || error52.status >= 200 && error52.status < 300)) {
+        updateCreateOperation({
+          workspaceSlug: args.workspaceSlug,
+          kind: "document",
+          logicalKey: args.slug,
+          operationId: createProtocol.operationId,
+          state: "transport_unknown",
+          now: args.now
+        });
+      }
+      throw error52;
+    }
     if (createResult.ok) {
       const doc2 = createResult.doc;
+      if (createProtocol.kind === "authorised" && doc2.slug !== args.slug) {
+        throw new ApiError(200, "generation-bearing create response had the wrong slug");
+      }
+      if (createProtocol.kind === "authorised") {
+        updateCreateOperation({
+          workspaceSlug: args.workspaceSlug,
+          kind: "document",
+          logicalKey: args.slug,
+          operationId: createProtocol.operationId,
+          state: "finalized",
+          rowId: doc2.id,
+          now: args.now
+        });
+      }
       const createFm = args.parsed.data ?? {};
       const createLifted = splitUserFrontmatter(strategy, createFm);
       const userFm = userFrontmatter(strategy, createLifted.frontmatter);
@@ -36130,6 +37192,27 @@ async function runPushCreate(args) {
         base: args.state
       };
     }
+    if (createResult.reason === "permanent_name_retired") {
+      if (strategy.type !== "documents" || createResult.entityKind !== "document" || createResult.logicalKey !== args.slug) {
+        throw new ApiError(409, "permanent-name refusal identity did not match the document create");
+      }
+      requireFeedRefresh({
+        workspaceSlug: args.workspaceSlug,
+        kind: "document",
+        logicalKey: createResult.logicalKey,
+        now: args.now
+      });
+      return {
+        outcome: {
+          kind: "permanent_delete_blocked",
+          entityType: strategy.type,
+          entitySlug: createResult.logicalKey,
+          reason: "refresh_required"
+        },
+        state: args.state,
+        base: args.state
+      };
+    }
     if (createResult.reason === "context_doc_conflict") {
       return reconcileContextDocConflict({
         echo: args.echo,
@@ -36218,7 +37301,7 @@ async function runPushDelete(args) {
   return args.mutex.run(id, async () => {
     const snapshot = getEntry(args.state, strategy.type, id) ?? null;
     const live = snapshot ? committedEntryIfNewer(args.workspaceSlug, strategy.type, snapshot) ?? snapshot : null;
-    if (existsSync4(args.absolutePath)) {
+    if (existsSync5(args.absolutePath)) {
       args.output?.log(entityDeleteSuppressedLine({
         entityType: strategy.type,
         slug,
@@ -36310,7 +37393,7 @@ async function pushRename(args) {
   } = args;
   const fetchImpl = deps?.fetchImpl;
   const now = deps?.now ?? (() => new Date);
-  const mutex = deps?.mutex ?? new PerIdMutex;
+  const mutex2 = deps?.mutex ?? new PerIdMutex;
   const output = deps?.output;
   const echo = deps?.echo;
   const strategy = requireStrategy(entityType);
@@ -36321,7 +37404,7 @@ async function pushRename(args) {
   } catch {
     toSlug = basename5(toPath, ".md");
   }
-  return mutex.run(id, async () => {
+  return mutex2.run(id, async () => {
     const snapshot = getEntry(state, entityType, id);
     const live = snapshot ? committedEntryIfNewer(workspaceSlug, entityType, snapshot) ?? snapshot : undefined;
     const effectiveExpected = live?.updated_at ?? expectedUpdatedAt;
@@ -36371,7 +37454,7 @@ async function pushRename(args) {
       };
       if (!updated.body_hash || !updated.frontmatter_hash) {
         try {
-          const mirrorRaw = readFileSync18(toPath, "utf8");
+          const mirrorRaw = readFileSync19(toPath, "utf8");
           const mirrorParsed = import_gray_matter10.default(mirrorRaw);
           const renameFm = mirrorParsed.data ?? {};
           const renameLifted = splitUserFrontmatter(strategy, renameFm);
@@ -36408,7 +37491,7 @@ async function pushRename(args) {
     if (patchResult.reason === "slug_conflict") {
       let contents2 = "";
       try {
-        contents2 = readFileSync18(toPath, "utf8");
+        contents2 = readFileSync19(toPath, "utf8");
       } catch {}
       const stashPath2 = stashConflict({
         workspaceSlug,
@@ -36456,7 +37539,7 @@ async function pushRename(args) {
     }
     let contents = "";
     try {
-      contents = readFileSync18(toPath, "utf8");
+      contents = readFileSync19(toPath, "utf8");
     } catch {}
     const stashPath = stashConflict({
       workspaceSlug,
@@ -36493,14 +37576,14 @@ async function pushRename(args) {
 
 // src/lib/resolve-pending.ts
 async function drainResolvedBatches(deps) {
-  const mutex = deps.mutex ?? new PerIdMutex;
+  const mutex2 = deps.mutex ?? new PerIdMutex;
   let applied = 0;
   let discarded = 0;
   for (const batch of listPendingBatches(deps.workspaceSlug)) {
     if (batch.status === "pending")
       continue;
     if (batch.status === "approved") {
-      await applyBatch(batch, deps, mutex);
+      await applyBatch(batch, deps, mutex2);
       deps.output?.log(`[DESTRUCTIVE_APPLIED batch=${batch.batch_id} ops=${batch.ops.length}]`);
       applied++;
     } else {
@@ -36515,7 +37598,7 @@ async function drainResolvedBatches(deps) {
 function opLabel(op) {
   return op.target === "file" ? `files/${op.path}` : `${op.entityType}/${op.slug}`;
 }
-async function applyBatch(batch, deps, mutex) {
+async function applyBatch(batch, deps, mutex2) {
   for (const op of batch.ops) {
     try {
       if (op.target === "file") {
@@ -36535,7 +37618,7 @@ async function applyBatch(batch, deps, mutex) {
         deps: {
           fetchImpl: deps.fetchImpl,
           now: deps.now,
-          mutex,
+          mutex: mutex2,
           output: deps.output,
           echo: deps.echo
         }
@@ -36589,7 +37672,7 @@ async function discardBatchOps(batch, deps) {
         const path5 = opPath(deps.workspaceSlug, op);
         let local = null;
         try {
-          local = readFileSync19(path5, "utf8");
+          local = readFileSync20(path5, "utf8");
         } catch {
           local = null;
         }
@@ -36628,7 +37711,7 @@ async function discardFileOp(op, deps) {
   const abs = filesSubtreePath(deps.workspaceSlug, op.path);
   let local = null;
   try {
-    local = readFileSync19(abs);
+    local = readFileSync20(abs);
   } catch {
     local = null;
   }
@@ -37597,10 +38680,10 @@ class FileDestructiveGate {
 }
 
 // src/lib/files/reconcile.ts
-import { readFileSync as readFileSync20, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync21, statSync as statSync10 } from "node:fs";
 
 // src/lib/unsynced.ts
-import { join as join13, relative as relative8 } from "node:path";
+import { join as join14, relative as relative8 } from "node:path";
 var RECORDABLE_REASONS = new Set([
   "rate_limit",
   "server",
@@ -37645,7 +38728,7 @@ function recordFileUnsynced(args) {
   });
 }
 async function drainUnsyncedOps(args) {
-  const { workspaceSlug, baseUrl, pat, getState, applyState, fetchImpl, mutex, output, echo } = args;
+  const { workspaceSlug, baseUrl, pat, getState, applyState, fetchImpl, mutex: mutex2, output, echo } = args;
   const now = args.now ?? (() => new Date);
   const ops = listUnsynced(getState());
   let attempted = 0;
@@ -37662,7 +38745,7 @@ async function drainUnsyncedOps(args) {
     attempted += 1;
     try {
       if (op.target === "entity") {
-        const absolutePath = join13(workspaceMirrorPath(workspaceSlug), op.path);
+        const absolutePath = join14(workspaceMirrorPath(workspaceSlug), op.path);
         const classified = classifyMirrorPath({ workspaceSlug, absolutePath });
         if (!classified) {
           clear("entity", op.path);
@@ -37679,7 +38762,7 @@ async function drainUnsyncedOps(args) {
           state: base2,
           exists: op.op === "upsert",
           unlinkContext: null,
-          deps: { fetchImpl, now, mutex, output, echo }
+          deps: { fetchImpl, now, mutex: mutex2, output, echo }
         });
         applyState(result.base ?? base2, result.state);
         if (result.outcome.kind === "ignored" && result.outcome.reason === DELETE_DECLINED_PATH_EXISTS) {
@@ -37707,7 +38790,7 @@ async function drainUnsyncedOps(args) {
             deps: { fetchImpl, now, output }
           });
         };
-        const result = mutex ? await mutex.run(`files:${op.path}`, doFile) : await doFile();
+        const result = mutex2 ? await mutex2.run(`files:${op.path}`, doFile) : await doFile();
         applyState(base2, result.state);
       }
       clear(op.target, op.path);
@@ -38475,9 +39558,9 @@ class NodeFsHandler {
     if (this.fsw.closed) {
       return;
     }
-    const dirname11 = sp.dirname(file2);
+    const dirname12 = sp.dirname(file2);
     const basename7 = sp.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname11);
+    const parent = this.fsw._getWatchedDir(dirname12);
     let prevStats = stats;
     if (parent.has(basename7))
       return;
@@ -38504,7 +39587,7 @@ class NodeFsHandler {
             prevStats = newStats2;
           }
         } catch (error52) {
-          this.fsw._remove(dirname11, basename7);
+          this.fsw._remove(dirname12, basename7);
         }
       } else if (parent.has(basename7)) {
         const at = newStats.atimeMs;
@@ -39631,7 +40714,7 @@ function readBlobForPush(args) {
   }
   let bytes;
   try {
-    bytes = readFileSync20(absolutePath);
+    bytes = readFileSync21(absolutePath);
   } catch (err) {
     if (err?.code === "ENOENT")
       return { kind: "gone" };
@@ -39941,7 +41024,7 @@ function applyArtistMemoryOnPull(args) {
   const cloudMemory = live.memory;
   const generated = live.memory_generated === true;
   const local = readArtistMemoryFile(workspaceSlug, slug);
-  const refuse = (localContent, canonical) => {
+  const refuse = (localContent, canonical2) => {
     const refused = refuseGeneratedMemoryEdit({
       state,
       workspaceSlug,
@@ -39951,7 +41034,7 @@ function applyArtistMemoryOnPull(args) {
       conflictEntity: ENTITY_TYPE,
       conflictSlug: conflictSlug(slug),
       localContent,
-      canonicalBody: canonical,
+      canonicalBody: canonical2,
       writeCanonical: (body) => writeMemory(workspaceSlug, slug, body, suppressor),
       now,
       output: out
@@ -40055,7 +41138,7 @@ async function pushArtistMemory(args) {
         id: entry2.id,
         fetchImpl
       });
-      const canonical = row.memory ?? "";
+      const canonical2 = row.memory ?? "";
       const refused = refuseGeneratedMemoryEdit({
         state: base2,
         workspaceSlug,
@@ -40065,7 +41148,7 @@ async function pushArtistMemory(args) {
         conflictEntity: ENTITY_TYPE,
         conflictSlug: conflictSlug(slug),
         localContent: local,
-        canonicalBody: canonical,
+        canonicalBody: canonical2,
         writeCanonical: (body) => writeMemory(workspaceSlug, slug, body, suppressor),
         now,
         output
@@ -40074,7 +41157,7 @@ async function pushArtistMemory(args) {
         ...entry2,
         updated_at: row.updated_at,
         revision: row.revision,
-        memory_hash: stableHash(canonical),
+        memory_hash: stableHash(canonical2),
         memory_generated: row.memory_generated
       };
       return {
@@ -40170,7 +41253,7 @@ function adoptCloudMemory(args) {
   return persistEntry2(state, updated);
 }
 async function reconcileArtistMemory(args) {
-  const { workspaceSlug, baseUrl, pat, fetchImpl, output, suppressor, mutex } = args;
+  const { workspaceSlug, baseUrl, pat, fetchImpl, output, suppressor, mutex: mutex2 } = args;
   const now = args.now ?? (() => new Date);
   let state = args.state;
   let transitioned = 0;
@@ -40212,7 +41295,7 @@ async function reconcileArtistMemory(args) {
         now,
         output,
         suppressor,
-        mutex
+        mutex: mutex2
       });
       state = result.state;
       if (result.outcome.kind === "pushed")
@@ -40692,10 +41775,10 @@ function anyUnknown(state) {
 }
 
 // src/lib/memory/write.ts
-import { readFileSync as readFileSync21, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync22, statSync as statSync11 } from "node:fs";
 
 // src/lib/files/extracted-text.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 var DERIVED_TEXT_VERSION = 2;
 function yamlString3(value) {
   return JSON.stringify(value);
@@ -40769,7 +41852,7 @@ ${doc2.text}
 `;
 }
 function extractedTextHash(rendered) {
-  return createHash4("sha256").update(rendered, "utf8").digest("hex");
+  return createHash5("sha256").update(rendered, "utf8").digest("hex");
 }
 
 // src/lib/memory/splice.ts
@@ -40887,7 +41970,7 @@ function writeDocumentAnnotation(args) {
   }
   let current;
   try {
-    current = readFileSync21(target, "utf8");
+    current = readFileSync22(target, "utf8");
   } catch {
     return { kind: "absent" };
   }
@@ -42619,7 +43702,7 @@ class PullSuppressor {
 
 // src/lib/discover-entities.ts
 var import_gray_matter12 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync22, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync23, statSync as statSync12 } from "node:fs";
 var DISCOVERY_WRITE_CAP_DEFAULT = 10;
 function discoveryWriteCap() {
   const raw = process.env.PLINTH_DISCOVERY_WRITE_CAP;
@@ -42718,7 +43801,7 @@ function planDiscoveryWrites(args) {
     counts.discovered++;
     let frontmatter;
     try {
-      frontmatter = import_gray_matter12.default(readFileSync22(absolutePath, "utf8")).data ?? {};
+      frontmatter = import_gray_matter12.default(readFileSync23(absolutePath, "utf8")).data ?? {};
     } catch {
       counts.discovered--;
       continue;
@@ -42947,7 +44030,7 @@ function recordDiscoveryFailure(args) {
 
 // src/lib/frontmatter-id-backfill.ts
 var import_gray_matter13 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync23, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync24, statSync as statSync13 } from "node:fs";
 var FRONTMATTER_ID_BACKFILL_VERSION = 1;
 function backfillWorthReporting(r) {
   return r.written > 0 || r.failed > 0 || r.skipped.foreignId > 0 || r.skipped.unwritable > 0 || r.skipped.slugCollision > 0;
@@ -42990,7 +44073,7 @@ function safeInode3(path5) {
 function backfillFrontmatterIds(args) {
   const { workspaceSlug, state } = args;
   const compose = args.compose ?? withFrontmatterId;
-  const readRaw = args.readFile ?? ((p) => readFileSync23(p, "utf8"));
+  const readRaw = args.readFile ?? ((p) => readFileSync24(p, "utf8"));
   const result = emptyResult();
   if (state.frontmatter_id_backfill_version === FRONTMATTER_ID_BACKFILL_VERSION) {
     return result;
@@ -43118,7 +44201,7 @@ function backfillFrontmatterIds(args) {
 }
 
 // src/lib/reconcile.ts
-import { readFileSync as readFileSync24, statSync as statSync14 } from "node:fs";
+import { readFileSync as readFileSync25, statSync as statSync14 } from "node:fs";
 async function reconcileDivergedRows(args) {
   const { workspaceSlug, baseUrl, pat, fetchImpl, output, isFrozen } = args;
   const now = args.now ?? (() => new Date);
@@ -43230,7 +44313,7 @@ async function reconcileDivergedRows(args) {
       }
       let content;
       try {
-        content = readFileSync24(absolutePath, "utf8");
+        content = readFileSync25(absolutePath, "utf8");
       } catch (err) {
         if (err?.code === "ENOENT") {
           state = clearEntityCloudRowDeleted(state, strategy.mirrorRelativePath(entry2.slug));
@@ -43331,7 +44414,7 @@ async function reconcileDivergedRows(args) {
 }
 
 // src/lib/workspace-rules/sync.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { relative as relative12 } from "node:path";
 
 // src/lib/workspace-rules/api.ts
@@ -43480,9 +44563,9 @@ function migrateHouseStyleFile(workspaceSlug) {
       return false;
     throw err;
   }
-  if (existsSync5(target))
+  if (existsSync6(target))
     return false;
-  if (!existsSync5(legacy))
+  if (!existsSync6(legacy))
     return false;
   return renameContextFile(workspaceSlug, HOUSE_STYLE_LEGACY_FILENAME, WORKSPACE_RULES_FILENAME);
 }
@@ -44580,17 +45663,18 @@ function createThrottledFetch(baseFetch, opts = {}) {
 
 // src/commands/sync.ts
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync9,
+  lstatSync as lstatSync6,
   readdirSync as readdirSync7,
-  readFileSync as readFileSync27,
+  readFileSync as readFileSync29,
   statSync as statSync17,
-  unlinkSync as unlinkSync8
+  unlinkSync as unlinkSync9
 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 
 // src/lib/conflicts-view.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join17 } from "node:path";
 var NO_GENERATED_MEMORY = {
   artistMemoryGenerated: () => false,
   workspaceMemoryGenerated: () => false,
@@ -44636,7 +45720,7 @@ function resolveConflictRows(workspaceSlug, stashes, generatedMemory = NO_GENERA
     if (validateFilesRelPath(rel) === null) {
       return { kind: "unsafe-path", stash };
     }
-    const abs = join16(root, "files", rel);
+    const abs = join17(root, "files", rel);
     if (hasSymlinkedComponent(workspaceSlug, abs)) {
       return { kind: "unsafe-path", stash };
     }
@@ -44644,7 +45728,7 @@ function resolveConflictRows(workspaceSlug, stashes, generatedMemory = NO_GENERA
       kind: "restorable",
       stash,
       mirrorPath: abs,
-      mirrorPathExists: existsSync6(abs)
+      mirrorPathExists: existsSync7(abs)
     };
   });
 }
@@ -44766,9 +45850,377 @@ function refreshConflictsView(workspaceSlug) {
 }
 
 // src/lib/files/pull.ts
-import { existsSync as existsSync7, lstatSync as lstatSync4, readFileSync as readFileSync25, statSync as statSync15 } from "node:fs";
-import { dirname as dirname12 } from "node:path";
+import { existsSync as existsSync8, lstatSync as lstatSync5, readFileSync as readFileSync27, statSync as statSync15 } from "node:fs";
+import { dirname as dirname13 } from "node:path";
+
+// src/lib/permanent-disposition.ts
+import { createHash as createHash6 } from "node:crypto";
+import { readFileSync as readFileSync26 } from "node:fs";
+function sha256(value) {
+  return createHash6("sha256").update(value).digest("hex");
+}
+function verifyStash(path5, expectedHash) {
+  const actual = sha256(readFileSync26(path5));
+  if (actual !== expectedHash) {
+    throw new Error(`permanent deletion stash verification failed for ${path5}`);
+  }
+}
+function disposePermanentDocument(args) {
+  return withPermanentDeletionLock("document", args.tombstone.logicalKey, async () => disposePermanentDocumentLocked(args));
+}
+function disposePermanentDocumentLocked(args) {
+  const now = args.now ?? (() => new Date);
+  const t = args.tombstone;
+  recordRetirementPending({
+    workspaceSlug: args.workspaceSlug,
+    kind: "document",
+    logicalKey: t.logicalKey,
+    rowId: t.id,
+    purgeGeneration: t.purgeGeneration,
+    retirementSequence: t.retirementSequence,
+    retiredAt: t.deletedAt
+  });
+  let journal = loadPermanentDeletionJournal(args.workspaceSlug);
+  let record2 = findRetirement(journal, "document", t.logicalKey);
+  if (record2.purge_generation !== t.purgeGeneration) {
+    return { state: args.state, deleted: false };
+  }
+  if (args.liveOwnerId === t.id) {
+    throw new Error("permanent document namespace reports the retired row as live owner");
+  }
+  if (record2.disposition === "complete") {
+    const stale = args.liveOwnerId === null ? getEntryBySlug(args.state, args.strategy.type, t.logicalKey) : getEntry(args.state, args.strategy.type, t.id);
+    const state2 = stale ? removeEntry(args.state, args.strategy.type, stale.id).state : args.state;
+    return { state: state2, deleted: false, stashPath: record2.stash_path };
+  }
+  const retiredEntry = getEntry(args.state, args.strategy.type, t.id);
+  const stateOwner = getEntryBySlug(args.state, args.strategy.type, t.logicalKey);
+  const protectedOwner = args.liveOwnerId !== null && args.liveOwnerId !== t.id;
+  let state = args.state;
+  let deleted = false;
+  let stashPath = record2.stash_path;
+  let stashHash = record2.stash_hash;
+  if (!protectedOwner) {
+    const target = entityFilePath(args.workspaceSlug, args.strategy.type, retiredEntry?.slug ?? t.logicalKey);
+    let raw;
+    try {
+      raw = readFileSync26(target, "utf8");
+    } catch (error52) {
+      if (error52?.code !== "ENOENT")
+        throw error52;
+    }
+    if (raw !== undefined && !stashPath) {
+      let matchesAcknowledged = false;
+      if (retiredEntry) {
+        try {
+          const hashes = computeMirrorHashes(args.strategy, raw);
+          matchesAcknowledged = hashes.bodyHash === retiredEntry.body_hash && hashes.frontmatterHash === retiredEntry.frontmatter_hash;
+        } catch {
+          matchesAcknowledged = false;
+        }
+      }
+      if (!matchesAcknowledged) {
+        const stash = stashEntityConflictOnce({
+          workspaceSlug: args.workspaceSlug,
+          entityType: args.strategy.type,
+          entitySlug: t.logicalKey,
+          timestamp: now(),
+          contents: raw,
+          side: "local"
+        });
+        stashPath = stash.path;
+        stashHash = sha256(raw);
+        verifyStash(stash.path, stashHash);
+        recordRetirementStash({
+          workspaceSlug: args.workspaceSlug,
+          kind: "document",
+          logicalKey: t.logicalKey,
+          generation: t.purgeGeneration,
+          stashPath,
+          stashHash
+        });
+        args.output?.warn(`${args.strategy.type}/${t.logicalKey}: permanently deleted; recoverable local content was moved to ${stashPath}.`);
+      }
+    }
+    args.suppressor?.registerDelete(target);
+    deleted = deleteMirrorFile(args.workspaceSlug, args.strategy.type, retiredEntry?.slug ?? t.logicalKey);
+  }
+  const staleEntry = args.liveOwnerId === null ? stateOwner : retiredEntry;
+  if (staleEntry)
+    state = removeEntry(state, args.strategy.type, staleEntry.id).state;
+  completeRetirement({
+    workspaceSlug: args.workspaceSlug,
+    kind: "document",
+    logicalKey: t.logicalKey,
+    generation: t.purgeGeneration,
+    ...stashPath && stashHash ? { stashPath, stashHash } : {},
+    now
+  });
+  return { state, deleted, ...stashPath ? { stashPath } : {} };
+}
+function disposePermanentFile(args) {
+  return withPermanentDeletionLock("workspace_file", args.tombstone.logicalKey, async () => disposePermanentFileLocked(args));
+}
+function disposePermanentFileLocked(args) {
+  const now = args.now ?? (() => new Date);
+  const t = args.tombstone;
+  recordRetirementPending({
+    workspaceSlug: args.workspaceSlug,
+    kind: "workspace_file",
+    logicalKey: t.logicalKey,
+    rowId: t.id,
+    purgeGeneration: t.purgeGeneration,
+    retirementSequence: t.retirementSequence,
+    retiredAt: t.deletedAt
+  });
+  const journal = loadPermanentDeletionJournal(args.workspaceSlug);
+  const record2 = findRetirement(journal, "workspace_file", t.logicalKey);
+  if (record2.purge_generation !== t.purgeGeneration) {
+    return { state: args.state, deleted: false, textDeleted: false };
+  }
+  if (args.liveOwnerId === t.id) {
+    throw new Error("permanent file namespace reports the retired row as live owner");
+  }
+  if (record2.disposition === "complete") {
+    const stale = getFileEntry(args.state, t.logicalKey);
+    const state2 = stale && (args.liveOwnerId === null || stale.id === t.id) ? removeFileEntry(args.state, t.logicalKey).state : args.state;
+    return {
+      state: state2,
+      deleted: false,
+      textDeleted: false,
+      ...record2.stash_path ? { stashPath: record2.stash_path } : {}
+    };
+  }
+  const existing = getFileEntry(args.state, t.logicalKey);
+  const protectedOwner = args.liveOwnerId !== null && args.liveOwnerId !== t.id;
+  let state = args.state;
+  let deleted = false;
+  let textDeleted = false;
+  let stashPath = record2.stash_path;
+  let stashHash = record2.stash_hash;
+  if (!protectedOwner) {
+    const target = filesSubtreePath(args.workspaceSlug, t.logicalKey);
+    let bytes;
+    try {
+      bytes = readFileSync26(target);
+    } catch (error52) {
+      if (error52?.code !== "ENOENT")
+        throw error52;
+    }
+    if (bytes !== undefined && !stashPath) {
+      const matchesAcknowledged = existing !== undefined && sha256Bytes(bytes) === existing.content_hash;
+      if (!matchesAcknowledged) {
+        const stash = stashFileConflictOnce({
+          workspaceSlug: args.workspaceSlug,
+          relPath: t.logicalKey,
+          timestamp: now(),
+          bytes,
+          side: "local"
+        });
+        stashPath = stash.path;
+        stashHash = sha256(bytes);
+        verifyStash(stash.path, stashHash);
+        recordRetirementStash({
+          workspaceSlug: args.workspaceSlug,
+          kind: "workspace_file",
+          logicalKey: t.logicalKey,
+          generation: t.purgeGeneration,
+          stashPath,
+          stashHash
+        });
+        args.output?.warn(`files/${t.logicalKey}: permanently deleted; recoverable local bytes were moved to ${stashPath}.`);
+      }
+    }
+    args.suppressor?.registerDelete(target);
+    deleted = deleteFilesFile(args.workspaceSlug, t.logicalKey);
+    textDeleted = deleteExtractedText(args.workspaceSlug, t.logicalKey);
+  }
+  if (existing && (args.liveOwnerId === null || existing.id === t.id)) {
+    state = removeFileEntry(state, t.logicalKey).state;
+  }
+  completeRetirement({
+    workspaceSlug: args.workspaceSlug,
+    kind: "workspace_file",
+    logicalKey: t.logicalKey,
+    generation: t.purgeGeneration,
+    ...stashPath && stashHash ? { stashPath, stashHash } : {},
+    now
+  });
+  return { state, deleted, textDeleted, ...stashPath ? { stashPath } : {} };
+}
+
+// src/lib/files/pull.ts
+function dueFileRefreshMarkers(workspaceSlug, now) {
+  try {
+    return loadPermanentDeletionJournal(workspaceSlug).refresh.filter((marker) => marker.kind === "workspace_file" && (marker.retry_after === undefined || new Date(marker.retry_after).getTime() <= now.getTime()));
+  } catch {
+    return null;
+  }
+}
+async function replayPermanentFiles(args, markers) {
+  const now = args.now ?? (() => new Date);
+  const rows = [];
+  let cursor = null;
+  let resultingCursor = args.cursor;
+  while (true) {
+    const page = await syncFilesPage({
+      baseUrl: args.baseUrl,
+      pat: args.pat,
+      cursor,
+      fetchImpl: args.fetchImpl
+    });
+    rows.push(...page.rows);
+    if (page.next_cursor === null)
+      break;
+    resultingCursor = page.next_cursor;
+    cursor = page.next_cursor;
+  }
+  let state = args.state;
+  let written = 0;
+  let deleted = 0;
+  let textWritten = 0;
+  let textDeleted = 0;
+  let textUnknown = 0;
+  let pointerRows = 0;
+  let symlinkRefused = 0;
+  let stashFailed = 0;
+  let completePass = true;
+  let lastCommittedState = args.state;
+  const completed = [];
+  for (const marker of markers) {
+    const candidates = rows.filter((row) => row.path === marker.logical_key && row.deleted_at !== null && row.permanent_delete === true && typeof row.purge_generation === "string" && typeof row.retirement_sequence === "number");
+    candidates.sort((a, b) => b.retirement_sequence - a.retirement_sequence);
+    const candidate = candidates[0];
+    const ambiguousLatest = candidate !== undefined && candidates.some((row) => row.retirement_sequence === candidate.retirement_sequence && row.purge_generation !== candidate.purge_generation);
+    const stateBefore = state;
+    const outcome = await withPermanentDeletionLock("workspace_file", marker.logical_key, async () => {
+      const namespace = await getCurrentPermanentNamespace({
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        entityKind: "workspace_file",
+        logicalKey: marker.logical_key,
+        fetchImpl: args.fetchImpl
+      });
+      if (!candidate || ambiguousLatest || namespace.latest_retirement === null || namespace.latest_retirement.purge_generation !== candidate.purge_generation || namespace.latest_retirement.retirement_sequence !== candidate.retirement_sequence) {
+        markRetentionMissing({
+          workspaceSlug: args.workspaceSlug,
+          kind: "workspace_file",
+          logicalKey: marker.logical_key,
+          now
+        });
+        args.output?.warn(`files/${marker.logical_key}: permanent-delete replay could not prove one unambiguous current retained tombstone; creates remain fenced and the replay will retry.`);
+        return { state: stateBefore, deleted: false, textDeleted: false, complete: false };
+      }
+      const liveOwnerId = namespace.live_owner?.id ?? null;
+      const disposition = await disposePermanentFile({
+        workspaceSlug: args.workspaceSlug,
+        tombstone: {
+          id: candidate.id,
+          logicalKey: marker.logical_key,
+          deletedAt: candidate.deleted_at,
+          purgeGeneration: candidate.purge_generation,
+          retirementSequence: candidate.retirement_sequence
+        },
+        liveOwnerId,
+        state: stateBefore,
+        now,
+        output: args.output,
+        suppressor: args.suppressor
+      });
+      const committedState = args.commit && disposition.state !== stateBefore ? args.commit(stateBefore, disposition.state) : disposition.state;
+      const current = await getCurrentPermanentNamespace({
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        entityKind: "workspace_file",
+        logicalKey: marker.logical_key,
+        fetchImpl: args.fetchImpl
+      });
+      const complete = current.latest_retirement?.purge_generation === candidate.purge_generation && current.latest_retirement?.retirement_sequence === candidate.retirement_sequence && (current.live_owner?.id ?? null) === liveOwnerId;
+      return {
+        state: committedState,
+        deleted: disposition.deleted,
+        textDeleted: disposition.textDeleted,
+        complete
+      };
+    });
+    state = outcome.state;
+    if (args.commit && state !== stateBefore)
+      lastCommittedState = state;
+    if (outcome.deleted)
+      deleted++;
+    if (outcome.textDeleted)
+      textDeleted++;
+    if (outcome.complete && candidate) {
+      completed.push({ logicalKey: marker.logical_key, generation: candidate.purge_generation });
+    } else {
+      completePass = false;
+    }
+  }
+  for (const row of rows) {
+    if (row.deleted_at !== null && row.permanent_delete === true)
+      continue;
+    const outcome = await applyFileRow({
+      workspaceSlug: args.workspaceSlug,
+      baseUrl: args.baseUrl,
+      pat: args.pat,
+      row,
+      state,
+      fetchImpl: args.fetchImpl,
+      now,
+      output: args.output,
+      suppressor: args.suppressor,
+      isFileFrozen: args.isFileFrozen,
+      loggedTombstoneSkips: args.loggedTombstoneSkips,
+      forceTextRewalk: args.forceTextRewalk,
+      loggedStashNotices: args.loggedStashNotices
+    });
+    state = outcome.state;
+    if (outcome.action === "written")
+      written++;
+    else if (outcome.action === "deleted")
+      deleted++;
+    textWritten += outcome.textWritten ?? 0;
+    textDeleted += outcome.textDeleted ?? 0;
+    if (outcome.textUnknown)
+      textUnknown++;
+    if (outcome.pointer)
+      pointerRows++;
+    if (outcome.symlinkRefused) {
+      symlinkRefused++;
+      completePass = false;
+    }
+    if (outcome.stashFailed || outcome.textFailed) {
+      if (outcome.stashFailed)
+        stashFailed++;
+      completePass = false;
+    }
+  }
+  if (args.commit && state !== lastCommittedState)
+    state = args.commit(lastCommittedState, state);
+  return {
+    state,
+    fetched: rows.length,
+    written,
+    deleted,
+    textWritten,
+    textDeleted,
+    textUnknown,
+    pointerRows,
+    symlinkRefused,
+    stashFailed,
+    lastCursor: completePass ? resultingCursor : args.cursor,
+    permanentRefreshes: completed,
+    permanentReplayComplete: completePass
+  };
+}
 async function pullFiles(args) {
+  const dueMarkers = dueFileRefreshMarkers(args.workspaceSlug, (args.now ?? (() => new Date))());
+  if (dueMarkers && dueMarkers.length > 0)
+    return replayPermanentFiles(args, dueMarkers);
+  const permanentJournalBlocked = dueMarkers === null;
+  if (permanentJournalBlocked) {
+    args.output?.warn(`files: permanent deletion journal is invalid or unreadable; ordinary rows may apply, but the files cursor and permanent dispositions are held. Run \`plinth status\` for the journal path.`);
+  }
   const { workspaceSlug, baseUrl, pat, fetchImpl } = args;
   let state = args.state;
   let fetched = 0;
@@ -44780,15 +46232,32 @@ async function pullFiles(args) {
   let pointerRows = 0;
   let symlinkRefused = 0;
   let stashFailed = 0;
+  let permanentEncountered = false;
   let cursor = args.cursor;
   let lastCursor = args.cursor;
-  let cursorBlocked = false;
+  let cursorBlocked = permanentJournalBlocked;
   while (true) {
     const page = await syncFilesPage({ baseUrl, pat, cursor, fetchImpl });
     const pageBase = state;
     let pageTextFailed = false;
     for (const row of page.rows) {
       fetched++;
+      if (row.deleted_at !== null && row.permanent_delete === true && row.purge_generation !== undefined) {
+        if (permanentJournalBlocked) {
+          pageTextFailed = true;
+          continue;
+        }
+        requireFeedRefresh({
+          workspaceSlug,
+          kind: "workspace_file",
+          logicalKey: row.path,
+          requiredGeneration: row.purge_generation,
+          now: args.now
+        });
+        permanentEncountered = true;
+        pageTextFailed = true;
+        continue;
+      }
       const outcome = await applyFileRow({
         workspaceSlug,
         baseUrl,
@@ -44839,6 +46308,15 @@ async function pullFiles(args) {
       lastCursor = page.next_cursor;
     cursor = page.next_cursor;
   }
+  if (permanentEncountered) {
+    const markers = dueFileRefreshMarkers(workspaceSlug, (args.now ?? (() => new Date))());
+    if (!markers) {
+      throw new Error("permanent deletion journal became unreadable during file replay");
+    }
+    if (markers.length > 0) {
+      return replayPermanentFiles({ ...args, state }, markers);
+    }
+  }
   if (textUnknown > 0) {
     args.output?.warn(`${textUnknown} file ${textUnknown === 1 ? "row" : "rows"} arrived without a readable \`has_extracted_text\` — this server predates the extracted-text contract, or the field was dropped from the payload. Derived text under views/extracted/ was left untouched rather than deleted, and is not being updated either.`);
   }
@@ -44977,7 +46455,7 @@ async function applyFileRow(args) {
     }
     let localBytes;
     try {
-      localBytes = readFileSync25(abs);
+      localBytes = readFileSync27(abs);
     } catch {
       localBytes = undefined;
     }
@@ -45023,7 +46501,7 @@ async function applyFileRow(args) {
       output
     });
   }
-  if (existing && existing.content_hash === row.content_hash && existsSync7(abs)) {
+  if (existing && existing.content_hash === row.content_hash && existsSync8(abs)) {
     if (!args.forceTextRewalk && textIsCurrent(existing, row, workspaceSlug, relPath)) {
       return { state, action: "noop", textUnknown };
     }
@@ -45153,7 +46631,7 @@ async function applyPointerRow(args) {
   if (textSignal === "absent") {
     args.output?.warn(`files/${relPath}: Plinth holds neither bytes nor text for this file — it has no local representation in the mirror.`);
   }
-  const bytesInMirror = existsSync7(filesSubtreePath(workspaceSlug, relPath));
+  const bytesInMirror = existsSync8(filesSubtreePath(workspaceSlug, relPath));
   if (bytesInMirror) {
     args.output?.warn(`files/${relPath}: Plinth holds no bytes for this file, but a local copy is present at that path — left exactly as it is. Plinth will not update it.`);
   }
@@ -45179,11 +46657,11 @@ async function applyPointerRow(args) {
 }
 function stashUnpushedLocalEdit(args) {
   const { workspaceSlug, relPath, abs, existing, output } = args;
-  if (hasSymlinkedComponent(workspaceSlug, dirname12(abs)))
+  if (hasSymlinkedComponent(workspaceSlug, dirname13(abs)))
     return { reason: "symlink" };
   let st;
   try {
-    st = lstatSync4(abs);
+    st = lstatSync5(abs);
   } catch (err) {
     if (err?.code === "ENOENT")
       return null;
@@ -45193,7 +46671,7 @@ function stashUnpushedLocalEdit(args) {
     return { reason: "not_a_file" };
   let localBytes;
   try {
-    localBytes = readFileSync25(abs);
+    localBytes = readFileSync27(abs);
   } catch (err) {
     return { reason: "unreadable", code: errCode(err) };
   }
@@ -45230,7 +46708,7 @@ function textIsCurrent(existing, row, workspaceSlug, relPath) {
   if (signal === "unknown")
     return true;
   if (signal === "absent") {
-    return existing.text_hash === undefined && !existsSync7(extractedTextPath(workspaceSlug, relPath));
+    return existing.text_hash === undefined && !existsSync8(extractedTextPath(workspaceSlug, relPath));
   }
   if (existing.text_hash === undefined)
     return false;
@@ -45241,7 +46719,7 @@ function textIsCurrent(existing, row, workspaceSlug, relPath) {
 }
 
 // src/lib/files/rejection-sync.ts
-import { readFileSync as readFileSync26, statSync as statSync16 } from "node:fs";
+import { readFileSync as readFileSync28, statSync as statSync16 } from "node:fs";
 
 // src/lib/files/rejections-api.ts
 var RejectionsFeedSchema = exports_external.object({
@@ -45374,7 +46852,7 @@ function settledDisposition(args) {
     return null;
   let bytes;
   try {
-    bytes = readFileSync26(absolute2);
+    bytes = readFileSync28(absolute2);
   } catch {
     return null;
   }
@@ -45451,7 +46929,7 @@ function classifyApiError(err) {
   return { kind: "transient", status: err.status };
 }
 function hasExistingContent(workspacePath) {
-  if (!existsSync8(workspacePath))
+  if (!existsSync9(workspacePath))
     return false;
   try {
     return readdirSync7(workspacePath, { withFileTypes: true }).some((e) => {
@@ -45460,7 +46938,7 @@ function hasExistingContent(workspacePath) {
       if (!e.isDirectory())
         return true;
       try {
-        return readdirSync7(join17(workspacePath, e.name)).length > 0;
+        return readdirSync7(join18(workspacePath, e.name)).length > 0;
       } catch {
         return true;
       }
@@ -45490,7 +46968,7 @@ function unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor) {
   }
   let raw;
   try {
-    raw = readFileSync27(target, "utf8");
+    raw = readFileSync29(target, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") {
       return { didUnlink: false };
@@ -45508,7 +46986,7 @@ function unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor) {
   }
   try {
     suppressor?.registerDelete(target);
-    unlinkSync8(target);
+    unlinkSync9(target);
     return { didUnlink: true };
   } catch (err) {
     if (err?.code === "ENOENT") {
@@ -45517,6 +46995,118 @@ function unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor) {
     throw err;
   }
 }
+function dueDocumentRefreshMarkers(workspaceSlug, now) {
+  try {
+    return loadPermanentDeletionJournal(workspaceSlug).refresh.filter((marker) => marker.kind === "document" && (marker.retry_after === undefined || new Date(marker.retry_after).getTime() <= now.getTime()));
+  } catch {
+    return null;
+  }
+}
+async function replayPermanentDocuments(args) {
+  const rows = [];
+  let cursor = null;
+  let resultingCursor = args.savedCursor;
+  while (true) {
+    const page = await syncEntity({
+      strategy: args.strategy,
+      baseUrl: args.baseUrl,
+      pat: args.pat,
+      cursor,
+      fetchImpl: args.fetchImpl
+    });
+    rows.push(...page.rows);
+    if (page.next_cursor === null)
+      break;
+    resultingCursor = page.next_cursor;
+    cursor = page.next_cursor;
+  }
+  let state = args.state;
+  const completed = [];
+  let completePass = true;
+  for (const marker of args.markers) {
+    const candidates = rows.filter((row) => row.deleted_at !== null && row.slug === marker.logical_key && row.permanent_delete === true && typeof row.purge_generation === "string" && typeof row.retirement_sequence === "number");
+    candidates.sort((a, b) => b.retirement_sequence - a.retirement_sequence);
+    const candidate = candidates[0];
+    const ambiguousLatest = candidate !== undefined && candidates.some((row) => row.retirement_sequence === candidate.retirement_sequence && row.purge_generation !== candidate.purge_generation);
+    const stateBefore = state;
+    const outcome = await withPermanentDeletionLock("document", marker.logical_key, async () => {
+      const namespace = await getCurrentPermanentNamespace({
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        entityKind: "document",
+        logicalKey: marker.logical_key,
+        fetchImpl: args.fetchImpl
+      });
+      if (!candidate || ambiguousLatest || namespace.latest_retirement === null || namespace.latest_retirement.purge_generation !== candidate.purge_generation || namespace.latest_retirement.retirement_sequence !== candidate.retirement_sequence) {
+        markRetentionMissing({
+          workspaceSlug: args.workspaceSlug,
+          kind: "document",
+          logicalKey: marker.logical_key,
+          now: args.now
+        });
+        args.output.warn(`documents/${marker.logical_key}: permanent-delete replay could not prove one unambiguous current retained tombstone; creates remain fenced and the replay will retry.`);
+        return { state: stateBefore, complete: false };
+      }
+      const liveOwnerId = namespace.live_owner?.id ?? null;
+      const disposed = await disposePermanentDocument({
+        workspaceSlug: args.workspaceSlug,
+        strategy: args.strategy,
+        tombstone: {
+          id: candidate.id,
+          logicalKey: marker.logical_key,
+          deletedAt: candidate.deleted_at,
+          purgeGeneration: candidate.purge_generation,
+          retirementSequence: candidate.retirement_sequence
+        },
+        liveOwnerId,
+        state: stateBefore,
+        now: args.now,
+        output: args.output,
+        suppressor: args.suppressor
+      });
+      const committedState = args.commit && disposed.state !== stateBefore ? args.commit(stateBefore, disposed.state) : disposed.state;
+      const current = await getCurrentPermanentNamespace({
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        entityKind: "document",
+        logicalKey: marker.logical_key,
+        fetchImpl: args.fetchImpl
+      });
+      const complete = current.latest_retirement?.purge_generation === candidate.purge_generation && current.latest_retirement?.retirement_sequence === candidate.retirement_sequence && (current.live_owner?.id ?? null) === liveOwnerId;
+      return { state: committedState, complete };
+    });
+    state = outcome.state;
+    if (outcome.complete && candidate) {
+      completed.push({ logicalKey: marker.logical_key, generation: candidate.purge_generation });
+    } else {
+      completePass = false;
+    }
+  }
+  const counters = {
+    fetched: rows.length,
+    written: 0,
+    deleted: 0,
+    moved: 0,
+    refused: 0
+  };
+  for (const row of rows) {
+    if (row.deleted_at !== null && row.permanent_delete === true)
+      continue;
+    const outcome = applyRow(args.workspaceSlug, args.strategy, row, state, args.output, args.suppressor, args.now, args.isFrozen, args.loggedTombstoneSkips);
+    state = outcome.state;
+    if (outcome.action === "written")
+      counters.written++;
+    else if (outcome.action === "deleted")
+      counters.deleted++;
+    else if (outcome.action === "moved")
+      counters.moved = (counters.moved ?? 0) + 1;
+    else if (outcome.action === "slug_refused") {
+      counters.refused = (counters.refused ?? 0) + 1;
+      completePass = false;
+    }
+  }
+  return { state, counters, cursor: resultingCursor, completed, completePass };
+}
 async function runSync(workspaceSlug, deps = {}) {
   const out = new Output({
     sink: deps.sink,
@@ -45640,9 +47230,55 @@ async function runSync(workspaceSlug, deps = {}) {
     for (const entityType of allEntityTypes()) {
       const strategy = requireStrategy(entityType);
       const startCursor = entry2.sync_cursors?.[entityType] ?? null;
+      if (entityType === "documents") {
+        const markers = dueDocumentRefreshMarkers(slug, now());
+        if (markers && markers.length > 0) {
+          const replay = await replayPermanentDocuments({
+            workspaceSlug: slug,
+            baseUrl: entry2.api_base_url,
+            pat,
+            state,
+            savedCursor: startCursor,
+            strategy,
+            markers,
+            fetchImpl,
+            output: out,
+            suppressor: deps.suppressor,
+            now,
+            isFrozen: deps.isFrozen,
+            loggedTombstoneSkips: deps.loggedTombstoneSkips,
+            commit: (before, after) => {
+              const next = commitState(before, after);
+              committed = next;
+              return next;
+            }
+          });
+          state = replay.state;
+          commitPending();
+          counters[entityType] = replay.counters;
+          if (replay.completePass) {
+            updateSyncCursor(slug, entityType, replay.cursor);
+            for (const item of replay.completed) {
+              clearFeedRefresh({
+                workspaceSlug: slug,
+                kind: "document",
+                logicalKey: item.logicalKey,
+                generation: item.generation
+              });
+            }
+          }
+          continue;
+        }
+      }
       let cursor = startCursor;
       let lastAdvancedCursor = startCursor;
       let cursorBlocked = false;
+      let permanentEncountered = false;
+      const permanentJournalBlocked = entityType === "documents" && dueDocumentRefreshMarkers(slug, now()) === null;
+      if (permanentJournalBlocked) {
+        cursorBlocked = true;
+        out.warn(`documents: permanent deletion journal is invalid or unreadable; ordinary rows may apply, but the document cursor and permanent dispositions are held. Run \`plinth status\` for the journal path.`);
+      }
       const ctr = {
         fetched: 0,
         written: 0,
@@ -45660,6 +47296,22 @@ async function runSync(workspaceSlug, deps = {}) {
         });
         for (const row of page.rows) {
           ctr.fetched++;
+          if (entityType === "documents" && row.deleted_at !== null && row.permanent_delete === true && row.purge_generation !== undefined) {
+            if (permanentJournalBlocked) {
+              cursorBlocked = true;
+              continue;
+            }
+            requireFeedRefresh({
+              workspaceSlug: slug,
+              kind: "document",
+              logicalKey: row.slug,
+              requiredGeneration: row.purge_generation,
+              now
+            });
+            permanentEncountered = true;
+            cursorBlocked = true;
+            continue;
+          }
           let outcome;
           try {
             outcome = applyRow(slug, strategy, row, state, out, deps.suppressor, now, deps.isFrozen, deps.loggedTombstoneSkips);
@@ -45698,6 +47350,46 @@ async function runSync(workspaceSlug, deps = {}) {
         cursor = page.next_cursor;
       }
       counters[entityType] = ctr;
+      if (permanentEncountered && entityType === "documents") {
+        const markers = dueDocumentRefreshMarkers(slug, now());
+        if (!markers || markers.length === 0)
+          continue;
+        const replay = await replayPermanentDocuments({
+          workspaceSlug: slug,
+          baseUrl: entry2.api_base_url,
+          pat,
+          state,
+          savedCursor: startCursor,
+          strategy,
+          markers,
+          fetchImpl,
+          output: out,
+          suppressor: deps.suppressor,
+          now,
+          isFrozen: deps.isFrozen,
+          loggedTombstoneSkips: deps.loggedTombstoneSkips,
+          commit: (before, after) => {
+            const next = commitState(before, after);
+            committed = next;
+            return next;
+          }
+        });
+        state = replay.state;
+        commitPending();
+        counters[entityType] = replay.counters;
+        if (replay.completePass) {
+          updateSyncCursor(slug, entityType, replay.cursor);
+          for (const item of replay.completed) {
+            clearFeedRefresh({
+              workspaceSlug: slug,
+              kind: "document",
+              logicalKey: item.logicalKey,
+              generation: item.generation
+            });
+          }
+        }
+        continue;
+      }
       if (lastAdvancedCursor !== startCursor) {
         updateSyncCursor(slug, entityType, lastAdvancedCursor);
       }
@@ -45738,6 +47430,16 @@ async function runSync(workspaceSlug, deps = {}) {
     if (filesResult.lastCursor !== filesStartCursor) {
       updateSyncCursor(slug, "files", filesResult.lastCursor);
     }
+    if (filesResult.permanentReplayComplete) {
+      for (const item of filesResult.permanentRefreshes ?? []) {
+        clearFeedRefresh({
+          workspaceSlug: slug,
+          kind: "workspace_file",
+          logicalKey: item.logicalKey,
+          generation: item.generation
+        });
+      }
+    }
     const rulesResult = await pullWorkspaceRules({
       workspaceSlug: slug,
       baseUrl: entry2.api_base_url,
@@ -45969,7 +47671,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
     if (!entry2) {
       let present2 = false;
       try {
-        present2 = existsSync8(entityFilePath(workspaceSlug, strategy.type, row.slug));
+        present2 = existsSync9(entityFilePath(workspaceSlug, strategy.type, row.slug));
       } catch (err) {
         if (!(err instanceof MirrorPathError))
           throw err;
@@ -46048,7 +47750,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
   const writeSlug = relocation.writeSlug;
   if (existingEntry && existingEntry.updated_at === live.updated_at && relocation.kind === "not_needed") {
     const path5 = entityFilePath(workspaceSlug, strategy.type, live.slug);
-    if (existsSync8(path5)) {
+    if (existsSync9(path5)) {
       if (strategy.type === "artists") {
         const artistLive = live;
         state = applyArtistMemoryOnPull({
@@ -46075,7 +47777,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
   if (!suppressor && existingEntry && existingEntry.updated_at !== live.updated_at && relocation.kind !== "moved") {
     let localRaw = null;
     try {
-      localRaw = readFileSync27(entityFilePath(workspaceSlug, strategy.type, writeSlug), "utf8");
+      localRaw = readFileSync29(entityFilePath(workspaceSlug, strategy.type, writeSlug), "utf8");
     } catch {
       localRaw = null;
     }
@@ -46095,6 +47797,38 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
       }
     }
   }
+  if (!suppressor && !existingEntry) {
+    const target = entityFilePath(workspaceSlug, strategy.type, writeSlug);
+    let localRaw = null;
+    try {
+      localRaw = lstatSync6(target).isFile() ? readFileSync29(target, "utf8") : null;
+    } catch {
+      localRaw = null;
+    }
+    if (localRaw !== null) {
+      const hashStrategy = strategy;
+      const incomingHashes = computeMirrorHashes(hashStrategy, renderMirrorWithBodyPreserve(workspaceSlug, strategy, live, writeSlug));
+      let diverged = true;
+      try {
+        const localHashes = computeMirrorHashes(hashStrategy, localRaw);
+        diverged = localHashes.bodyHash !== incomingHashes.bodyHash || localHashes.frontmatterHash !== incomingHashes.frontmatterHash;
+      } catch {
+        diverged = true;
+      }
+      if (diverged) {
+        const stash = stashEntityConflictOnce({
+          workspaceSlug,
+          entityType: strategy.type,
+          entitySlug: live.slug,
+          timestamp: now(),
+          contents: localRaw,
+          side: "local"
+        });
+        const where = stash.reused ? `already stashed at` : `stashed it to`;
+        out.warn(`Conflict on ${strategy.type}/${live.slug} → the local file there was not tracked for ` + `the incoming row and differed from it; ${where} ${stash.path} (cloud-wins on boot).`);
+      }
+    }
+  }
   const content = writeMirrorWithBodyPreserve(workspaceSlug, strategy, live, suppressor, writeSlug);
   const hashes = computeMirrorHashes(strategy, content);
   let inode;
@@ -46233,7 +47967,7 @@ function backfillStateInodes(workspaceSlug, state, statFn = (p) => statSync18(p)
     return { state, changed: false };
   return { state: { ...state, entries: nextEntries }, changed: true };
 }
-function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync28(p, "utf8")) {
+function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync30(p, "utf8")) {
   let changed = false;
   const nextEntries = {};
   for (const [entityType, bucket] of Object.entries(state.entries)) {
@@ -46264,7 +47998,7 @@ function makeWatchHandler(deps) {
     baseUrl,
     pat,
     spinner,
-    mutex,
+    mutex: mutex2,
     getState,
     applyState,
     fetchImpl,
@@ -46308,7 +48042,7 @@ function makeWatchHandler(deps) {
           output?.log(fileDeleteSuppressedLine({ path: relPath, reason: "pull_echo" }));
           return;
         }
-        if (existsSync9(absolutePath)) {
+        if (existsSync10(absolutePath)) {
           output?.log(fileDeleteSuppressedLine({ path: relPath, reason: "path_exists" }));
           return;
         }
@@ -46320,7 +48054,7 @@ function makeWatchHandler(deps) {
             return;
           }
         }
-        await mutex.run(`files:${relPath}`, async () => {
+        await mutex2.run(`files:${relPath}`, async () => {
           const base2 = getState();
           const result = await pushFilesDelete({
             workspaceSlug,
@@ -46374,7 +48108,7 @@ function makeWatchHandler(deps) {
         spinner.update(`Watching ${workspaceSlug} · ${watchingSummary(getState())}`);
         return;
       }
-      const bytes = readFileSync28(absolutePath);
+      const bytes = readFileSync30(absolutePath);
       const hash2 = sha256Bytes(bytes);
       if (suppressor?.shouldSuppressUpsert(absolutePath, {
         bodyHash: hash2,
@@ -46391,7 +48125,7 @@ function makeWatchHandler(deps) {
           return;
         }
       }
-      await mutex.run(`files:${relPath}`, async () => {
+      await mutex2.run(`files:${relPath}`, async () => {
         const base2 = getState();
         const result = await pushFilesUpsert({
           workspaceSlug,
@@ -46438,7 +48172,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46450,7 +48184,7 @@ function makeWatchHandler(deps) {
       }
     }
     try {
-      await mutex.run(WORKSPACE_RULES_MUTEX_KEY, async () => {
+      await mutex2.run(WORKSPACE_RULES_MUTEX_KEY, async () => {
         const base2 = getState();
         const result = await pushWorkspaceRules({
           workspaceSlug,
@@ -46477,7 +48211,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46489,7 +48223,7 @@ function makeWatchHandler(deps) {
       }
     }
     try {
-      await mutex.run(WORKSPACE_MEMORY_MUTEX_KEY, async () => {
+      await mutex2.run(WORKSPACE_MEMORY_MUTEX_KEY, async () => {
         const base2 = getState();
         const result = await pushWorkspaceMemory({
           workspaceSlug,
@@ -46516,7 +48250,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46528,7 +48262,7 @@ function makeWatchHandler(deps) {
       }
     }
     try {
-      await mutex.run(USER_MEMORY_MUTEX_KEY, async () => {
+      await mutex2.run(USER_MEMORY_MUTEX_KEY, async () => {
         const base2 = getState();
         const result = await pushUserMemory({
           workspaceSlug,
@@ -46555,7 +48289,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46567,7 +48301,7 @@ function makeWatchHandler(deps) {
       }
     }
     try {
-      await mutex.run(VOICE_MUTEX_KEY, async () => {
+      await mutex2.run(VOICE_MUTEX_KEY, async () => {
         const base2 = getState();
         const result = await pushVoice({
           workspaceSlug,
@@ -46594,7 +48328,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46617,7 +48351,7 @@ function makeWatchHandler(deps) {
         now,
         output,
         suppressor,
-        mutex
+        mutex: mutex2
       });
       applyState(base2, result.state);
       reportArtistMemoryOutcome(spinner, workspaceSlug, result.state, result.outcome);
@@ -46640,7 +48374,7 @@ function makeWatchHandler(deps) {
           const strategy = getStrategy(classifiedFrom.entityType);
           let toRaw = null;
           try {
-            toRaw = readFileSync28(event.toPath, "utf8");
+            toRaw = readFileSync30(event.toPath, "utf8");
           } catch {
             toRaw = null;
           }
@@ -46667,7 +48401,7 @@ function makeWatchHandler(deps) {
           deps: {
             fetchImpl,
             now,
-            mutex,
+            mutex: mutex2,
             output,
             echo: suppressor ? { watcher: "live", suppressor } : undefined
           }
@@ -46709,7 +48443,7 @@ function makeWatchHandler(deps) {
         if (event.kind === "upsert") {
           try {
             ownEcho = suppressor?.shouldSuppressUpsert(absolutePath, {
-              bodyHash: stableHash(readFileSync28(absolutePath, "utf8")),
+              bodyHash: stableHash(readFileSync30(absolutePath, "utf8")),
               frontmatterHash: ""
             }) === true;
           } catch {
@@ -46764,7 +48498,7 @@ function makeWatchHandler(deps) {
           if (strategy) {
             let raw = null;
             try {
-              raw = readFileSync28(absolutePath, "utf8");
+              raw = readFileSync30(absolutePath, "utf8");
             } catch {
               raw = null;
             }
@@ -46774,7 +48508,7 @@ function makeWatchHandler(deps) {
           }
         }
       }
-      if (event.kind === "unlink" && existsSync9(absolutePath)) {
+      if (event.kind === "unlink" && existsSync10(absolutePath)) {
         output?.log(entityDeleteSuppressedLine({
           entityType: classified.entityType,
           slug: classified.entitySlug,
@@ -46813,7 +48547,7 @@ function makeWatchHandler(deps) {
         deps: {
           fetchImpl,
           now,
-          mutex,
+          mutex: mutex2,
           output,
           suppressor,
           echo: suppressor ? { watcher: "live", suppressor } : undefined
@@ -47235,7 +48969,7 @@ async function runStart(workspaceSlug, deps = {}) {
   }
   const spinner = (deps.spinnerFactory ?? (() => createSpinner({ noColor: deps.noColor })))();
   spinner.start(`Watching ${slug} · ${watchingSummary(state)}`);
-  const mutex = new PerIdMutex;
+  const mutex2 = new PerIdMutex;
   const bootDrain = await drainResolvedBatches({
     echo: { watcher: "none" },
     workspaceSlug: slug,
@@ -47247,7 +48981,7 @@ async function runStart(workspaceSlug, deps = {}) {
     },
     fetchImpl,
     now: deps.now,
-    mutex,
+    mutex: mutex2,
     output: out
   });
   if (bootDrain.applied > 0 || bootDrain.discarded > 0) {
@@ -47265,7 +48999,7 @@ async function runStart(workspaceSlug, deps = {}) {
     },
     fetchImpl,
     now: deps.now,
-    mutex,
+    mutex: mutex2,
     output: out
   });
   if (bootUnsynced.attempted > 0) {
@@ -47317,7 +49051,7 @@ async function runStart(workspaceSlug, deps = {}) {
     applyState: (base2, next) => {
       state = rebaseState(state, base2, next);
     },
-    mutex,
+    mutex: mutex2,
     fetchImpl,
     now: deps.now,
     output: out,
@@ -47381,7 +49115,7 @@ async function runStart(workspaceSlug, deps = {}) {
     applyState: (base2, next) => {
       state = rebaseState(state, base2, next);
     },
-    mutex,
+    mutex: mutex2,
     fetchImpl,
     now: deps.now,
     output: out,
@@ -47433,7 +49167,7 @@ async function runStart(workspaceSlug, deps = {}) {
     baseUrl: entry2.api_base_url,
     pat,
     spinner,
-    mutex,
+    mutex: mutex2,
     getState: () => state,
     applyState: (base2, next) => {
       state = rebaseState(state, base2, next);
@@ -47497,7 +49231,7 @@ async function runStart(workspaceSlug, deps = {}) {
       workspaceSlug: slug,
       baseUrl: entry2.api_base_url,
       pat,
-      mutex,
+      mutex: mutex2,
       commitState,
       getState: () => state,
       setState: setDaemonState,
@@ -47525,7 +49259,7 @@ async function runStart(workspaceSlug, deps = {}) {
             },
             fetchImpl,
             now: deps.now,
-            mutex,
+            mutex: mutex2,
             output: out
           });
           if (drained.applied > 0 || drained.discarded > 0) {
@@ -47543,7 +49277,7 @@ async function runStart(workspaceSlug, deps = {}) {
             },
             fetchImpl,
             now: deps.now,
-            mutex,
+            mutex: mutex2,
             output: out
           });
           if (redriven.resolved > 0) {
@@ -47555,7 +49289,7 @@ async function runStart(workspaceSlug, deps = {}) {
             spinner.update(`Watching ${slug} · ${watchingSummary(state)}`);
           }
           let rulesBase = state;
-          const rulesRecon = await mutex.run(WORKSPACE_RULES_MUTEX_KEY, () => {
+          const rulesRecon = await mutex2.run(WORKSPACE_RULES_MUTEX_KEY, () => {
             rulesBase = state;
             return reconcileWorkspaceRules({
               workspaceSlug: slug,
@@ -47571,7 +49305,7 @@ async function runStart(workspaceSlug, deps = {}) {
           state = rebaseState(state, rulesBase, rulesRecon.state);
           reportSingletonReconcile(spinner, slug, state, WORKSPACE_RULES_FILENAME, rulesRecon.outcome);
           let memoryBase = state;
-          const memoryRecon = await mutex.run(WORKSPACE_MEMORY_MUTEX_KEY, () => {
+          const memoryRecon = await mutex2.run(WORKSPACE_MEMORY_MUTEX_KEY, () => {
             memoryBase = state;
             return reconcileWorkspaceMemory({
               workspaceSlug: slug,
@@ -47587,7 +49321,7 @@ async function runStart(workspaceSlug, deps = {}) {
           state = rebaseState(state, memoryBase, memoryRecon.state);
           reportSingletonReconcile(spinner, slug, state, WORKSPACE_MEMORY_FILENAME, memoryRecon.outcome);
           let userMemoryBase = state;
-          const userMemoryRecon = await mutex.run(USER_MEMORY_MUTEX_KEY, () => {
+          const userMemoryRecon = await mutex2.run(USER_MEMORY_MUTEX_KEY, () => {
             userMemoryBase = state;
             return reconcileUserMemory({
               workspaceSlug: slug,
@@ -47604,7 +49338,7 @@ async function runStart(workspaceSlug, deps = {}) {
           reportSingletonReconcile(spinner, slug, state, USER_MEMORY_FILENAME, userMemoryRecon.outcome);
           try {
             let voiceBase = state;
-            const voiceRecon = await mutex.run(VOICE_MUTEX_KEY, () => {
+            const voiceRecon = await mutex2.run(VOICE_MUTEX_KEY, () => {
               voiceBase = state;
               return reconcileVoice({
                 workspaceSlug: slug,
@@ -47635,7 +49369,7 @@ async function runStart(workspaceSlug, deps = {}) {
             now: deps.now,
             output: out,
             suppressor,
-            mutex
+            mutex: mutex2
           });
           state = rebaseState(state, memBase, memRecon.state);
           if (memRecon.pushed > 0) {
@@ -48291,12 +50025,12 @@ function assessContextWalls(workspaceSlug, deps = {}) {
 
 // src/lib/build-stamp.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync10, mkdirSync as mkdirSync11, readFileSync as readFileSync29, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname13, join as join18 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync31, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname14, join as join19 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUILD_STAMP_FILENAME = "build-stamp.json";
 function stampPath(distDir) {
-  return join18(distDir, BUILD_STAMP_FILENAME);
+  return join19(distDir, BUILD_STAMP_FILENAME);
 }
 function readHead(repoDir) {
   try {
@@ -48315,7 +50049,7 @@ function readHead(repoDir) {
 }
 function readBuildStamp(distDir) {
   try {
-    const parsed = JSON.parse(readFileSync29(stampPath(distDir), "utf8"));
+    const parsed = JSON.parse(readFileSync31(stampPath(distDir), "utf8"));
     if (parsed && typeof parsed.sha === "string" && parsed.sha.length > 0 && typeof parsed.dirty === "boolean" && typeof parsed.built_at === "string") {
       return { sha: parsed.sha, dirty: parsed.dirty, built_at: parsed.built_at };
     }
@@ -48327,9 +50061,9 @@ function readBuildStamp(distDir) {
 function findRepoRoot(fromDir) {
   let dir = fromDir;
   for (;; ) {
-    if (existsSync10(join18(dir, ".git")))
+    if (existsSync11(join19(dir, ".git")))
       return dir;
-    const parent = dirname13(dir);
+    const parent = dirname14(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -48353,7 +50087,7 @@ function checkBuildStaleness(deps = {}) {
   const metaUrl = deps.metaUrl ?? import.meta.url;
   let distDir;
   try {
-    distDir = dirname13(fileURLToPath(metaUrl));
+    distDir = dirname14(fileURLToPath(metaUrl));
   } catch {
     return { kind: "unknown" };
   }
@@ -48376,12 +50110,12 @@ function checkBuildStaleness(deps = {}) {
 }
 
 // src/lib/memory-links.ts
-import { readFileSync as readFileSync30 } from "node:fs";
+import { readFileSync as readFileSync32 } from "node:fs";
 import { relative as relative15, sep as sep8 } from "node:path";
 var MEMORY_FILE_RE = /^(workspace-memory\.md|user-memory\.md|artists\/[^/]+\/memory\.md|memory\/[^/]+\.md|memory\/private\/[^/]+\.md)$/i;
 function scanMemoryLinks(deps) {
   const listFiles = deps.listFiles ?? ((r) => walkSubtreeFiles(r, isVcsInternal));
-  const readFile = deps.readFile ?? ((p) => readFileSync30(p, "utf8"));
+  const readFile = deps.readFile ?? ((p) => readFileSync32(p, "utf8"));
   let root;
   let absPaths;
   try {
@@ -48425,7 +50159,7 @@ function scanMemoryLinks(deps) {
 init_output();
 
 // src/lib/pending-writes.ts
-import { readFileSync as readFileSync31, statSync as statSync19 } from "node:fs";
+import { readFileSync as readFileSync33, statSync as statSync19 } from "node:fs";
 import { relative as relative16 } from "node:path";
 var import_gray_matter15 = __toESM(require_gray_matter(), 1);
 var EMPTY3 = { writes: [], count: 0 };
@@ -48473,7 +50207,7 @@ function scanPendingWrites(args) {
         continue;
       let hash2;
       try {
-        hash2 = sha256Bytes(readFileSync31(absolutePath));
+        hash2 = sha256Bytes(readFileSync33(absolutePath));
       } catch {
         continue;
       }
@@ -48504,7 +50238,7 @@ function scanPendingWrites(args) {
       continue;
     let content;
     try {
-      content = readFileSync31(absolutePath, "utf8");
+      content = readFileSync33(absolutePath, "utf8");
     } catch {
       continue;
     }
@@ -48834,6 +50568,33 @@ async function runStatus(args, deps = {}) {
     }
   }
   out.info("");
+  let deletionJournal = null;
+  let deletionJournalError = null;
+  try {
+    deletionJournal = loadPermanentDeletionJournal(slug);
+  } catch (error52) {
+    deletionJournalError = error52 instanceof Error ? error52.message : String(error52);
+  }
+  if (deletionJournalError) {
+    out.info(row("Deletion", "BLOCKED — permanent deletion journal needs recovery."));
+    out.info(cont(`${permanentDeletionJournalPath(slug)}: ${deletionJournalError}`));
+  } else {
+    const pending2 = deletionJournal.records.filter((record2) => record2.disposition === "pending");
+    const refresh = deletionJournal.refresh;
+    const operations = deletionJournal.records.filter((record2) => record2.operation?.state === "pending" || record2.operation?.state === "transport_unknown");
+    if (pending2.length === 0 && refresh.length === 0 && operations.length === 0) {
+      out.info(row("Deletion", "No permanent deletion reconciliation pending."));
+    } else {
+      out.info(row("Deletion", `${pending2.length} disposition${pending2.length === 1 ? "" : "s"} pending; ` + `${refresh.length} feed refresh${refresh.length === 1 ? "" : "es"} required; ` + `${operations.length} create operation${operations.length === 1 ? "" : "s"} unresolved.`));
+      for (const marker of refresh.slice(0, 5)) {
+        out.info(cont(`${marker.kind}:${marker.logical_key} — ${marker.state}` + (marker.retry_after ? `, retry after ${marker.retry_after}` : "")));
+      }
+      for (const record2 of operations.slice(0, 5)) {
+        out.info(cont(`${record2.kind}:${record2.logical_key} — create ${record2.operation.state}`));
+      }
+    }
+  }
+  out.info("");
   const held = listPendingBatches(slug).filter((b) => b.status === "pending");
   if (held.length === 0) {
     out.info(row("Pending", "No destructive batches held."));
@@ -49388,7 +51149,7 @@ var versionCommand = defineCommand({
 });
 
 // src/commands/voice-gate.ts
-import { readFileSync as readFileSync34 } from "node:fs";
+import { readFileSync as readFileSync36 } from "node:fs";
 
 // src/lib/voice-gate/api.ts
 var VoiceGateSurfaces = [
@@ -49490,15 +51251,15 @@ async function callVoiceGate(req) {
 }
 
 // src/lib/voice-gate/attempts.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import {
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync32,
-  renameSync as renameSync8,
-  unlinkSync as unlinkSync9,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync34,
+  renameSync as renameSync9,
+  unlinkSync as unlinkSync10,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var MAX_REGENS = 2;
 var ENTRY_TTL_MS = 24 * 60 * 60 * 1000;
 var AttemptEntrySchema = exports_external.object({
@@ -49511,20 +51272,20 @@ var AttemptsFileSchema = exports_external.object({
   entries: exports_external.record(exports_external.string(), AttemptEntrySchema)
 });
 function attemptsDir(workspaceSlug) {
-  return join19(plinthHome(), "_voice_gate", workspaceSlug);
+  return join20(plinthHome(), "_voice_gate", workspaceSlug);
 }
 function attemptsPath(workspaceSlug) {
-  return join19(attemptsDir(workspaceSlug), "attempts.json");
+  return join20(attemptsDir(workspaceSlug), "attempts.json");
 }
 function attemptKey(identity) {
-  return createHash5("sha256").update(identity, "utf8").digest("hex").slice(0, 32);
+  return createHash7("sha256").update(identity, "utf8").digest("hex").slice(0, 32);
 }
 function emptyFile() {
   return { version: 1, entries: {} };
 }
 function load2(workspaceSlug) {
   try {
-    const raw = readFileSync32(attemptsPath(workspaceSlug), "utf8");
+    const raw = readFileSync34(attemptsPath(workspaceSlug), "utf8");
     const parsed = AttemptsFileSchema.safeParse(JSON.parse(raw));
     return parsed.success ? parsed.data : emptyFile();
   } catch {
@@ -49544,14 +51305,14 @@ function save(workspaceSlug, file2) {
   const dir = attemptsDir(workspaceSlug);
   const target = attemptsPath(workspaceSlug);
   const tmp = `${target}.${process.pid}.${tmpCounter2++}.tmp`;
-  mkdirSync12(dir, { recursive: true, mode: 448 });
+  mkdirSync13(dir, { recursive: true, mode: 448 });
   writeFileSync9(tmp, `${JSON.stringify(file2, null, 2)}
 `, { mode: 384 });
   try {
-    renameSync8(tmp, target);
+    renameSync9(tmp, target);
   } catch (err) {
     try {
-      unlinkSync9(tmp);
+      unlinkSync10(tmp);
     } catch {}
     throw err;
   }
@@ -49687,7 +51448,7 @@ function denyUngated(detail) {
 }
 
 // src/lib/voice-gate/payload.ts
-import { readFileSync as readFileSync33, statSync as statSync21 } from "node:fs";
+import { readFileSync as readFileSync35, statSync as statSync21 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { isAbsolute as isAbsolute4, resolve as resolve6 } from "node:path";
 var MAX_BODY_BYTES = 256 * 1024;
@@ -49848,7 +51609,7 @@ function defaultReadBodyFile(path5) {
   if (stat4.size > MAX_BODY_BYTES) {
     throw new Error(`draft body is ${stat4.size} bytes, over the ${MAX_BODY_BYTES}-byte gate limit`);
   }
-  return readFileSync33(path5, "utf8");
+  return readFileSync35(path5, "utf8");
 }
 function parseRecipients(...raw) {
   const all = raw.filter((v) => typeof v === "string").flatMap((v) => v.split(",")).map((v) => v.trim().toLowerCase()).filter((v) => v.length > 0);
@@ -50208,7 +51969,7 @@ async function runVoiceGateDirect(args, deps = {}) {
   let text;
   if (args.file) {
     try {
-      text = readFileSync34(args.file, "utf8");
+      text = readFileSync36(args.file, "utf8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : "unknown error";
       out.error(`Could not read ${args.file}: ${msg}`);