@plinth-music/cli 0.22.0 → 0.23.1

package/dist/cli.js

@@ -7584,7 +7584,7 @@ function _getBuiltinFlags(long, short, userNames, userAliases) {
 // package.json
 var package_default = {
   name: "@plinth-music/cli",
-  version: "0.22.0",
+  version: "0.23.1",
   description: "Plinth capstone sync daemon and CLI",
   type: "module",
   private: false,
@@ -22148,12 +22148,28 @@ var BASE_ROW = {
 };
 var TombstoneSchema = exports_external.object({
   ...BASE_ROW,
-  deleted_at: exports_external.string().datetime({ offset: true })
+  deleted_at: exports_external.string().datetime({ offset: true }),
+  permanent_delete: exports_external.literal(true).optional(),
+  purge_generation: exports_external.string().uuid().optional(),
+  retirement_sequence: exports_external.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
+}).superRefine((row, ctx) => {
+  const present = [
+    row.permanent_delete !== undefined,
+    row.purge_generation !== undefined,
+    row.retirement_sequence !== undefined
+  ];
+  if (present.some(Boolean) && !present.every(Boolean)) {
+    ctx.addIssue({
+      code: "custom",
+      message: "permanent tombstone fields must be present together"
+    });
+  }
 });
 function makePageResponseSchema(responseKey, liveSchema) {
   return exports_external.object({
     [responseKey]: exports_external.array(exports_external.union([liveSchema, TombstoneSchema])),
-    next_cursor: exports_external.string().nullable()
+    next_cursor: exports_external.string().nullable(),
+    high_water: exports_external.string().nullable().optional()
   });
 }
 function makeParsePageResponse(schema, responseKey) {
@@ -22161,7 +22177,8 @@ function makeParsePageResponse(schema, responseKey) {
     const parsed = schema.parse(json2);
     return {
       rows: parsed[responseKey],
-      next_cursor: parsed.next_cursor
+      next_cursor: parsed.next_cursor,
+      high_water: parsed.high_water ?? null
     };
   };
 }
@@ -23893,6 +23910,17 @@ function moveEntityFile(workspaceSlug, entityType, fromSlug, toSlug, beforeMove)
     throw err;
   }
 }
+function deleteMirrorFile(workspaceSlug, entityType, entitySlug) {
+  const target = entityFilePath(workspaceSlug, entityType, entitySlug);
+  try {
+    unlinkSync(target);
+    return true;
+  } catch (err) {
+    if (err?.code === "ENOENT")
+      return false;
+    throw err;
+  }
+}
 var ARTIST_MEMORY_ANCHOR = "memory.md";
 function artistMemoryFilePath(workspaceSlug, entitySlug) {
   assertSlug("entity slug", entitySlug);
@@ -25319,7 +25347,8 @@ var WorkspaceEntrySchema = exports_external.object({
   last_synced_at: exports_external.string().datetime({ offset: true }).nullable(),
   workspace_name: exports_external.string().min(1).optional(),
   member: MemberPrincipalSchema.optional(),
-  sync_cursors: SyncCursorsSchema.optional()
+  sync_cursors: SyncCursorsSchema.optional(),
+  sync_high_water: SyncCursorsSchema.optional()
 });
 var ConfigFileSchema = exports_external.object({
   version: exports_external.literal(1),
@@ -25381,7 +25410,8 @@ function carryForwardSyncState(prior, entry) {
   return {
     ...entry,
     last_synced_at: prior.last_synced_at,
-    ...prior.sync_cursors !== undefined ? { sync_cursors: prior.sync_cursors } : {}
+    ...prior.sync_cursors !== undefined ? { sync_cursors: prior.sync_cursors } : {},
+    ...prior.sync_high_water !== undefined ? { sync_high_water: prior.sync_high_water } : {}
   };
 }
 function upsertWorkspace(slug, entry, options2 = {}) {
@@ -25422,6 +25452,23 @@ function updateSyncCursor(slug, entityType, cursor) {
   writeAtomic(next);
   return next;
 }
+function updateSyncHighWater(slug, entityType, mark) {
+  const existing = loadConfig();
+  if (!existing) {
+    throw new Error(`No config. Run \`plinth login --workspace ${slug}\` first.`);
+  }
+  const entry = requireWorkspace(existing, slug);
+  if ((entry.sync_high_water?.[entityType] ?? null) === mark)
+    return;
+  const nextEntry = {
+    ...entry,
+    sync_high_water: { ...entry.sync_high_water, [entityType]: mark }
+  };
+  writeAtomic({
+    ...existing,
+    workspaces: { ...existing.workspaces, [slug]: nextEntry }
+  });
+}
 function setMemberPrincipal(slug, member) {
   const existing = loadConfig();
   if (!existing)
@@ -26709,7 +26756,7 @@ function allFileEntries(state) {
   return Object.values(state.files ?? {});
 }
 function fileEntriesEqual(a, b) {
-  return a.id === b.id && a.path === b.path && a.content_hash === b.content_hash && a.size_bytes === b.size_bytes && a.mime_type === b.mime_type && a.updated_at === b.updated_at && a.inode === b.inode;
+  return a.id === b.id && a.path === b.path && a.content_hash === b.content_hash && a.size_bytes === b.size_bytes && a.mime_type === b.mime_type && a.updated_at === b.updated_at && a.inode === b.inode && a.text_hash === b.text_hash;
 }
 function clearFrontmatterIdBackfillMarker(state) {
   if (state.frontmatter_id_backfill_version === undefined) {
@@ -29609,6 +29656,13 @@ class ApiError extends Error {
     this.name = "ApiError";
   }
 }
+var PermanentNameRetiredSchema = exports_external.object({
+  code: exports_external.literal("permanent_name_retired"),
+  entity_kind: exports_external.enum(["document", "workspace_file"]),
+  logical_key: exports_external.string().min(1),
+  action: exports_external.literal("refresh_required"),
+  error: exports_external.string().optional()
+});
 function parseRetryAfterMs(headerValue, now = () => Date.now()) {
   if (!headerValue)
     return;
@@ -29622,6 +29676,92 @@ function parseRetryAfterMs(headerValue, now = () => Date.now()) {
   const delta = dateMs - now();
   return delta > 0 ? delta : 0;
 }
+var OperationEnvelopeBase = exports_external.object({
+  entity_kind: exports_external.enum(["document", "workspace_file"]),
+  operation_id: exports_external.string().uuid()
+});
+var OperationBoundBase = OperationEnvelopeBase.extend({
+  logical_key: exports_external.string().min(1),
+  payload_digest: exports_external.string().regex(/^[0-9a-f]{64}$/)
+});
+var OperationResolutionSchema = exports_external.discriminatedUnion("status", [
+  OperationBoundBase.extend({ status: exports_external.literal("pending") }),
+  OperationBoundBase.extend({ status: exports_external.literal("finalized"), live: exports_external.unknown() }),
+  OperationBoundBase.extend({ status: exports_external.literal("terminal_cleaned") }),
+  OperationEnvelopeBase.extend({ status: exports_external.literal("retired_not_found") })
+]);
+var CurrentNamespaceSchema = exports_external.object({
+  entity_kind: exports_external.enum(["document", "workspace_file"]),
+  logical_key: exports_external.string().min(1),
+  latest_retirement: exports_external.object({
+    purge_generation: exports_external.string().uuid(),
+    retirement_sequence: exports_external.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+  }).nullable(),
+  live_owner: exports_external.object({ id: exports_external.string().uuid() }).nullable()
+});
+async function resolvePermanentDeletionOperation(args) {
+  const { baseUrl, pat, entityKind, operationId, fetchImpl = fetch } = args;
+  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/permanent-deletions/operations/resolve`;
+  let res;
+  try {
+    res = await fetchImpl(url2, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${pat}`,
+        Accept: "application/json",
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ entity_kind: entityKind, operation_id: operationId })
+    });
+  } catch (error52) {
+    const detail = error52 instanceof Error ? error52.message : "network error";
+    throw new ApiError(0, `Could not reach ${url2}: ${detail}`);
+  }
+  if (res.status === 401)
+    throw new ApiError(401, "Token was rejected by the server.");
+  if (res.status === 429) {
+    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+  }
+  if (!res.ok) {
+    throw new ApiError(res.status, `resolve permanent deletion operation failed with HTTP ${res.status}`);
+  }
+  const parsed = OperationResolutionSchema.safeParse(await res.json());
+  if (!parsed.success) {
+    throw new ApiError(res.status, `operation resolution response did not match the expected shape: ${parsed.error.message}`);
+  }
+  return parsed.data;
+}
+async function getCurrentPermanentNamespace(args) {
+  const { baseUrl, pat, entityKind, logicalKey, fetchImpl = fetch } = args;
+  const params = new URLSearchParams({ entity_kind: entityKind, logical_key: logicalKey });
+  const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/permanent-deletions/namespaces/current?${params}`;
+  let res;
+  try {
+    res = await fetchImpl(url2, {
+      method: "GET",
+      headers: { Authorization: `Bearer ${pat}`, Accept: "application/json" }
+    });
+  } catch (error52) {
+    const detail = error52 instanceof Error ? error52.message : "network error";
+    throw new ApiError(0, `Could not reach ${url2}: ${detail}`);
+  }
+  if (res.status === 401)
+    throw new ApiError(401, "Token was rejected by the server.");
+  if (res.status === 429) {
+    throw new ApiError(429, "Rate limited by the server.", parseRetryAfterMs(res.headers.get("retry-after")));
+  }
+  if (!res.ok) {
+    throw new ApiError(res.status, `get current permanent namespace failed with HTTP ${res.status}`);
+  }
+  const parsed = CurrentNamespaceSchema.safeParse(await res.json());
+  if (!parsed.success) {
+    throw new ApiError(res.status, `current permanent namespace response did not match the expected shape: ${parsed.error.message}`);
+  }
+  if (parsed.data.entity_kind !== entityKind || parsed.data.logical_key !== logicalKey) {
+    throw new ApiError(res.status, "current permanent namespace response identity mismatch");
+  }
+  return parsed.data;
+}
 async function whoami(baseUrl, pat, fetchImpl = fetch) {
   const url2 = `${baseUrl.replace(/\/$/, "")}/api/auth/cli/whoami`;
   let res;
@@ -29797,6 +29937,16 @@ async function patchEntity(args) {
   }
   if (res.status === 409) {
     const json2 = await res.json();
+    const retiredParse = PermanentNameRetiredSchema.safeParse(json2);
+    if (retiredParse.success) {
+      return {
+        ok: false,
+        code: 409,
+        reason: "permanent_name_retired",
+        entityKind: retiredParse.data.entity_kind,
+        logicalKey: retiredParse.data.logical_key
+      };
+    }
     const contextParse = ContextDocConflictResponseSchema.safeParse(json2);
     if (contextParse.success) {
       const existing = strategy.singleResponseSchema.safeParse(contextParse.data.existing);
@@ -29853,17 +30003,33 @@ async function patchEntity(args) {
   throw new ApiError(res.status, `patch ${strategy.type} failed with HTTP ${res.status}`);
 }
 async function createEntity(args) {
-  const { strategy, baseUrl, pat, payload, fetchImpl = fetch } = args;
+  const {
+    strategy,
+    baseUrl,
+    pat,
+    payload,
+    retiredGeneration,
+    operationId,
+    fetchImpl = fetch
+  } = args;
   const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/${strategy.apiSegment}`;
+  if (retiredGeneration === undefined !== (operationId === undefined)) {
+    throw new Error("retired generation and create operation id must be supplied together");
+  }
+  const headers = {
+    Authorization: `Bearer ${pat}`,
+    Accept: "application/json",
+    "Content-Type": "application/json"
+  };
+  if (retiredGeneration) {
+    headers["X-Plinth-Retired-Generation"] = retiredGeneration;
+    headers["X-Plinth-Create-Operation-Id"] = operationId;
+  }
   let res;
   try {
     res = await fetchImpl(url2, {
       method: "POST",
-      headers: {
-        Authorization: `Bearer ${pat}`,
-        Accept: "application/json",
-        "Content-Type": "application/json"
-      },
+      headers,
       body: JSON.stringify(payload)
     });
   } catch (err) {
@@ -29880,6 +30046,16 @@ async function createEntity(args) {
   }
   if (res.status === 409) {
     const json2 = await res.json();
+    const retiredParse = PermanentNameRetiredSchema.safeParse(json2);
+    if (retiredParse.success) {
+      return {
+        ok: false,
+        code: 409,
+        reason: "permanent_name_retired",
+        entityKind: retiredParse.data.entity_kind,
+        logicalKey: retiredParse.data.logical_key
+      };
+    }
     const contextParse = ContextDocConflictResponseSchema.safeParse(json2);
     if (contextParse.success) {
       const existing2 = strategy.singleResponseSchema.safeParse(contextParse.data.existing);
@@ -30023,12 +30199,25 @@ var FileTombstoneSchema = exports_external.object({
   id: exports_external.string().uuid(),
   path: exports_external.string().min(1),
   updated_at: exports_external.string().datetime({ offset: true }),
-  deleted_at: exports_external.string().datetime({ offset: true })
+  deleted_at: exports_external.string().datetime({ offset: true }),
+  permanent_delete: exports_external.literal(true).optional(),
+  purge_generation: exports_external.string().uuid().optional(),
+  retirement_sequence: exports_external.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
+}).superRefine((row, ctx) => {
+  const present2 = [
+    row.permanent_delete !== undefined,
+    row.purge_generation !== undefined,
+    row.retirement_sequence !== undefined
+  ];
+  if (present2.some(Boolean) && !present2.every(Boolean)) {
+    ctx.addIssue({ code: "custom", message: "permanent tombstone fields must be present together" });
+  }
 });
 var FileRowSchema = exports_external.union([FileLiveSchema, FileTombstoneSchema]);
 var FilesPageSchema = exports_external.object({
   files: exports_external.array(FileRowSchema),
-  next_cursor: exports_external.string().nullable()
+  next_cursor: exports_external.string().nullable(),
+  high_water: exports_external.string().nullable().optional()
 });
 var FileWithDownloadSchema = FileLiveSchema.extend({
   download_url: exports_external.string().url().nullable()
@@ -30081,7 +30270,11 @@ async function syncFilesPage(args) {
   if (!parsed.success) {
     throw new ApiError(res.status, `sync files response did not match the expected shape: ${parsed.error.message}`);
   }
-  return { rows: parsed.data.files, next_cursor: parsed.data.next_cursor };
+  return {
+    rows: parsed.data.files,
+    next_cursor: parsed.data.next_cursor,
+    high_water: parsed.data.high_water ?? null
+  };
 }
 async function getFile(args) {
   const { baseUrl, pat, id, fetchImpl = fetch } = args;
@@ -30162,6 +30355,8 @@ async function postFile(args) {
     contentHash,
     mimeType,
     expectedUpdatedAt,
+    retiredGeneration,
+    operationId,
     fetchImpl = fetch
   } = args;
   const url2 = `${baseUrl.replace(/\/$/, "")}/api/sync/files`;
@@ -30174,6 +30369,13 @@ async function postFile(args) {
   };
   if (expectedUpdatedAt)
     headers["X-Plinth-Expected-Updated-At"] = expectedUpdatedAt;
+  if (retiredGeneration === undefined !== (operationId === undefined)) {
+    throw new Error("retired generation and create operation id must be supplied together");
+  }
+  if (retiredGeneration) {
+    headers["X-Plinth-Retired-Generation"] = retiredGeneration;
+    headers["X-Plinth-Create-Operation-Id"] = operationId;
+  }
   let res;
   try {
     res = await fetchImpl(url2, { method: "POST", headers, body: bytes });
@@ -30200,6 +30402,22 @@ async function postFile(args) {
   }
   if (res.status === 409) {
     const json2 = await res.json();
+    const retired = exports_external.object({
+      code: exports_external.literal("permanent_name_retired"),
+      entity_kind: exports_external.literal("workspace_file"),
+      logical_key: exports_external.string().min(1),
+      action: exports_external.literal("refresh_required"),
+      error: exports_external.string().optional()
+    }).safeParse(json2);
+    if (retired.success) {
+      return {
+        ok: false,
+        code: 409,
+        reason: "permanent_name_retired",
+        entityKind: retired.data.entity_kind,
+        logicalKey: retired.data.logical_key
+      };
+    }
     const parsed = PreconditionSchema.safeParse(json2);
     if (!parsed.success) {
       throw new ApiError(409, `post file 409 body did not match precondition_failed shape`);
@@ -30327,6 +30545,12 @@ function fileDeleteSuppressedLine(f) {
 function entityDeleteSuppressedLine(f) {
   return `[ENTITY_DELETE_SUPPRESSED entityType=${f.entityType} slug=${f.slug} reason=${f.reason}]`;
 }
+function entityRestoreDeferredLine(f) {
+  return `[ENTITY_RESTORE_DEFERRED entityType=${f.entityType} slug=${f.slug} wait_s=${f.waitSeconds}]`;
+}
+function fileRestoreDeferredLine(f) {
+  return `[FILE_RESTORE_DEFERRED path=${f.path} wait_s=${f.waitSeconds}]`;
+}
 function fileOverCapLine(f) {
   return `[FILE_OVER_CAP path=${f.path} size=${f.size} max=${f.max} max_from=${f.source}]`;
 }
@@ -34096,7 +34320,7 @@ var sessionCommand = defineCommand({
 
 // src/commands/start.ts
 var import_gray_matter14 = __toESM(require_gray_matter(), 1);
-import { existsSync as existsSync9, readFileSync as readFileSync28, statSync as statSync18 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync30, statSync as statSync18 } from "node:fs";
 
 // src/lib/daemon-log.ts
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync9, renameSync as renameSync7, statSync as statSync4 } from "node:fs";
@@ -34340,7 +34564,7 @@ class DestructiveGate {
 }
 
 // src/lib/resolve-pending.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 
 // src/lib/conflicts.ts
 import { mkdirSync as mkdirSync10, readFileSync as readFileSync15, readdirSync as readdirSync6, statSync as statSync6, writeFileSync as writeFileSync7 } from "node:fs";
@@ -34359,6 +34583,26 @@ function stashConflict(args) {
   writeFileSync7(target, args.contents, { mode: 384 });
   return target;
 }
+function stashEntityConflictOnce(args) {
+  const dir = conflictsRoot(args.workspaceSlug);
+  const head = `${args.entityType}.${args.entitySlug}.`;
+  const tail = new RegExp(`^\\d{4}-\\d{2}-\\d{2}T\\d{2}-\\d{2}-\\d{2}-\\d{3}Z\\.${args.side}\\.md$`);
+  let names = [];
+  try {
+    names = readdirSync6(dir);
+  } catch {
+    names = [];
+  }
+  const newest = names.filter((name) => name.startsWith(head) && tail.test(name.slice(head.length))).sort().pop();
+  if (newest !== undefined) {
+    const path5 = join12(dir, newest);
+    try {
+      if (readFileSync15(path5, "utf8") === args.contents)
+        return { path: path5, reused: true };
+    } catch {}
+  }
+  return { path: stashConflict(args), reused: false };
+}
 function fileConflictPath(args) {
   const { workspaceSlug, relPath, timestamp, side } = args;
   const iso = timestamp.toISOString().replace(/[:.]/g, "-");
@@ -34448,12 +34692,646 @@ function listConflictStashes(workspaceSlug) {
 }
 
 // src/lib/files/push.ts
-import { readFileSync as readFileSync16, statSync as statSync7 } from "node:fs";
+import { readFileSync as readFileSync17, statSync as statSync7 } from "node:fs";
+
+// src/lib/permanent-deletions.ts
+import { createHash as createHash3, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  closeSync as closeSync4,
+  constants as constants2,
+  existsSync as existsSync4,
+  fsyncSync as fsyncSync2,
+  fstatSync as fstatSync2,
+  lstatSync as lstatSync4,
+  mkdirSync as mkdirSync11,
+  openSync as openSync4,
+  readFileSync as readFileSync16,
+  renameSync as renameSync8,
+  unlinkSync as unlinkSync8,
+  writeSync as writeSync2
+} from "node:fs";
+import { dirname as dirname10, join as join13 } from "node:path";
+var PERMANENT_DELETE_KINDS = ["document", "workspace_file"];
+var UUID = exports_external.string().uuid();
+var SHA256 = exports_external.string().regex(/^[0-9a-f]{64}$/);
+function canonicalLogicalKey(kind, logicalKey) {
+  return kind === "document" ? isValidWorkspaceSlug(logicalKey) : validateFilesRelPath(logicalKey) === logicalKey;
+}
+var PendingOperationSchema = exports_external.object({
+  operation_id: UUID,
+  payload_digest: SHA256,
+  state: exports_external.enum(["pending", "transport_unknown", "finalized", "terminal_cleaned"]),
+  row_id: UUID.optional(),
+  updated_at: exports_external.string().datetime({ offset: true })
+}).superRefine((value, ctx) => {
+  if (value.state === "finalized" && value.row_id === undefined) {
+    ctx.addIssue({ code: "custom", message: "finalized operation requires row_id" });
+  }
+  if (value.state !== "finalized" && value.row_id !== undefined) {
+    ctx.addIssue({ code: "custom", message: "row_id is valid only for finalized operations" });
+  }
+});
+var RetirementRecordSchema = exports_external.object({
+  kind: exports_external.enum(PERMANENT_DELETE_KINDS),
+  logical_key: exports_external.string().min(1),
+  row_id: UUID,
+  purge_generation: UUID,
+  retirement_sequence: exports_external.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  retired_at: exports_external.string().datetime({ offset: true }),
+  disposition: exports_external.enum(["pending", "complete"]),
+  completed_at: exports_external.string().datetime({ offset: true }).optional(),
+  stash_path: exports_external.string().min(1).optional(),
+  stash_hash: SHA256.optional(),
+  operation: PendingOperationSchema.optional()
+}).superRefine((value, ctx) => {
+  if (!canonicalLogicalKey(value.kind, value.logical_key)) {
+    ctx.addIssue({ code: "custom", message: "retirement logical key is not canonical" });
+  }
+  if (value.disposition === "complete" && value.completed_at === undefined) {
+    ctx.addIssue({ code: "custom", message: "complete retirement requires completed_at" });
+  }
+  if (value.disposition === "pending" && value.completed_at !== undefined) {
+    ctx.addIssue({ code: "custom", message: "pending retirement cannot have completed_at" });
+  }
+  if (value.stash_path === undefined !== (value.stash_hash === undefined)) {
+    ctx.addIssue({ code: "custom", message: "stash_path and stash_hash must be written together" });
+  }
+});
+var RefreshMarkerSchema = exports_external.object({
+  kind: exports_external.enum(PERMANENT_DELETE_KINDS),
+  logical_key: exports_external.string().min(1),
+  required_generation: UUID.optional(),
+  started_at: exports_external.string().datetime({ offset: true }),
+  attempts: exports_external.number().int().nonnegative(),
+  retry_after: exports_external.string().datetime({ offset: true }).optional(),
+  state: exports_external.enum(["required", "retention_missing"])
+}).superRefine((value, ctx) => {
+  if (!canonicalLogicalKey(value.kind, value.logical_key)) {
+    ctx.addIssue({ code: "custom", message: "refresh logical key is not canonical" });
+  }
+});
+var JournalBodySchema = exports_external.object({
+  version: exports_external.literal(1),
+  revision: exports_external.number().int().nonnegative(),
+  workspace_slug: exports_external.string().min(1),
+  records: exports_external.array(RetirementRecordSchema),
+  refresh: exports_external.array(RefreshMarkerSchema)
+});
+var JournalFileSchema = JournalBodySchema.extend({ checksum: SHA256 });
+
+class PermanentDeletionJournalError extends Error {
+  stage;
+  constructor(message, stage) {
+    super(message);
+    this.stage = stage;
+    this.name = "PermanentDeletionJournalError";
+  }
+}
+function permanentDeletionJournalPath(workspaceSlug) {
+  if (!isValidWorkspaceSlug(workspaceSlug)) {
+    throw new PermanentDeletionJournalError(`refusing unsafe workspace slug: ${JSON.stringify(workspaceSlug)}`, "validate");
+  }
+  return join13(plinthHome(), workspaceSlug, "permanent-deletions.json");
+}
+function recordKey2(kind, logicalKey) {
+  return `${kind}\x00${logicalKey}`;
+}
+function canonical(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value);
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  const obj = value;
+  return `{${Object.keys(obj).sort().map((key) => `${JSON.stringify(key)}:${canonical(obj[key])}`).join(",")}}`;
+}
+function canonicalPayloadDigest(value) {
+  return createHash3("sha256").update(canonical(value), "utf8").digest("hex");
+}
+function fileCreatePayloadDigest(contentHash, mimeType) {
+  return canonicalPayloadDigest({ content_hash: contentHash, mime_type: mimeType });
+}
+function checksum(body) {
+  return createHash3("sha256").update(canonical(body), "utf8").digest("hex");
+}
+function emptyJournal(workspaceSlug) {
+  return { version: 1, revision: 0, workspace_slug: workspaceSlug, records: [], refresh: [] };
+}
+function validateUniqueness(journal) {
+  const records = new Set;
+  for (const record2 of journal.records) {
+    const key = recordKey2(record2.kind, record2.logical_key);
+    if (records.has(key)) {
+      throw new PermanentDeletionJournalError(`permanent deletion journal contains duplicate record ${record2.kind}:${record2.logical_key}`, "validate");
+    }
+    records.add(key);
+  }
+  const refresh = new Set;
+  for (const marker of journal.refresh) {
+    const key = recordKey2(marker.kind, marker.logical_key);
+    if (refresh.has(key)) {
+      throw new PermanentDeletionJournalError(`permanent deletion journal contains duplicate refresh marker ${marker.kind}:${marker.logical_key}`, "validate");
+    }
+    refresh.add(key);
+  }
+}
+function assertOwnerOnlyFile(path5) {
+  const stat = lstatSync4(path5);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new PermanentDeletionJournalError(`${path5} is not a regular file`, "validate");
+  }
+  if ((stat.mode & 511) !== 384) {
+    throw new PermanentDeletionJournalError(`${path5} must have mode 0600`, "validate");
+  }
+  const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+  if (uid !== undefined && stat.uid !== uid) {
+    throw new PermanentDeletionJournalError(`${path5} is not owned by the current user`, "validate");
+  }
+}
+function assertPrivateDirectory(path5) {
+  const stat = lstatSync4(path5);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new PermanentDeletionJournalError(`${path5} is not a private directory`, "validate");
+  }
+  if ((stat.mode & 511) !== 448) {
+    throw new PermanentDeletionJournalError(`${path5} must have mode 0700`, "validate");
+  }
+  const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+  if (uid !== undefined && stat.uid !== uid) {
+    throw new PermanentDeletionJournalError(`${path5} is not owned by the current user`, "validate");
+  }
+}
+function parseJournal(workspaceSlug, raw) {
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch (error52) {
+    const detail = error52 instanceof Error ? error52.message : String(error52);
+    throw new PermanentDeletionJournalError(`permanent deletion journal is not valid JSON: ${detail}`, "validate");
+  }
+  const parsed = JournalFileSchema.safeParse(json2);
+  if (!parsed.success) {
+    throw new PermanentDeletionJournalError(`permanent deletion journal does not match schema v1: ${parsed.error.message}`, "validate");
+  }
+  const { checksum: storedChecksum, ...body } = parsed.data;
+  if (body.workspace_slug !== workspaceSlug) {
+    throw new PermanentDeletionJournalError(`permanent deletion journal belongs to ${body.workspace_slug}, not ${workspaceSlug}`, "validate");
+  }
+  if (checksum(body) !== storedChecksum) {
+    throw new PermanentDeletionJournalError("permanent deletion journal checksum mismatch", "validate");
+  }
+  validateUniqueness(body);
+  return body;
+}
+function fsyncDirectory(path5) {
+  const fd = openSync4(path5, constants2.O_RDONLY);
+  try {
+    fsyncSync2(fd);
+  } finally {
+    closeSync4(fd);
+  }
+}
+function loadPermanentDeletionJournal(workspaceSlug) {
+  const target = permanentDeletionJournalPath(workspaceSlug);
+  if (!existsSync4(target))
+    return emptyJournal(workspaceSlug);
+  assertPrivateDirectory(dirname10(target));
+  assertOwnerOnlyFile(target);
+  const journal = parseJournal(workspaceSlug, readFileSync16(target, "utf8"));
+  try {
+    fsyncDirectory(dirname10(target));
+  } catch (error52) {
+    const detail = error52 instanceof Error ? error52.message : String(error52);
+    throw new PermanentDeletionJournalError(`permanent deletion journal durability remains indeterminate: ${detail}`, "durability_indeterminate");
+  }
+  return journal;
+}
+function validatedCurrentRevision(workspaceSlug, expected) {
+  const current = loadPermanentDeletionJournal(workspaceSlug);
+  if (current.revision !== expected) {
+    throw new PermanentDeletionJournalError(`permanent deletion journal revision changed from ${expected} to ${current.revision}`, "validate");
+  }
+  return current;
+}
+function writePermanentDeletionJournal(prior, next) {
+  if (prior.workspace_slug !== next.workspace_slug) {
+    throw new PermanentDeletionJournalError("journal workspace cannot change", "validate");
+  }
+  validatedCurrentRevision(prior.workspace_slug, prior.revision);
+  const body = JournalBodySchema.parse({ ...next, revision: prior.revision + 1 });
+  validateUniqueness(body);
+  const target = permanentDeletionJournalPath(body.workspace_slug);
+  const parent = dirname10(target);
+  mkdirSync11(parent, { recursive: true, mode: 448 });
+  chmodSync(parent, 448);
+  assertPrivateDirectory(parent);
+  if (existsSync4(target))
+    assertOwnerOnlyFile(target);
+  const tmp = join13(parent, `.permanent-deletions.${process.pid}.${randomUUID()}.tmp`);
+  const wire = JSON.stringify({ ...body, checksum: checksum(body) }, null, 2) + `
+`;
+  let fd;
+  try {
+    fd = openSync4(tmp, constants2.O_WRONLY | constants2.O_CREAT | constants2.O_EXCL | (constants2.O_NOFOLLOW ?? 0), 384);
+    const stat = fstatSync2(fd);
+    if (!stat.isFile() || (stat.mode & 511) !== 384) {
+      throw new PermanentDeletionJournalError("journal temporary file is not owner-only", "prepare");
+    }
+    const bytes = Buffer.from(wire, "utf8");
+    let offset = 0;
+    while (offset < bytes.length)
+      offset += writeSync2(fd, bytes, offset, bytes.length - offset);
+    fsyncSync2(fd);
+    closeSync4(fd);
+    fd = undefined;
+  } catch (error52) {
+    if (fd !== undefined) {
+      try {
+        closeSync4(fd);
+      } catch {}
+    }
+    try {
+      unlinkSync8(tmp);
+    } catch {}
+    if (error52 instanceof PermanentDeletionJournalError)
+      throw error52;
+    const detail = error52 instanceof Error ? error52.message : String(error52);
+    throw new PermanentDeletionJournalError(`could not prepare journal write: ${detail}`, "write");
+  }
+  try {
+    renameSync8(tmp, target);
+  } catch (error52) {
+    let installed2 = false;
+    try {
+      assertOwnerOnlyFile(target);
+      const candidate = parseJournal(body.workspace_slug, readFileSync16(target, "utf8"));
+      installed2 = candidate.revision === body.revision && checksum(candidate) === checksum(body);
+    } catch {
+      installed2 = false;
+    }
+    try {
+      unlinkSync8(tmp);
+    } catch {}
+    if (!installed2) {
+      const detail = error52 instanceof Error ? error52.message : String(error52);
+      throw new PermanentDeletionJournalError(`could not rename journal: ${detail}`, "rename");
+    }
+  }
+  assertOwnerOnlyFile(target);
+  const installed = parseJournal(body.workspace_slug, readFileSync16(target, "utf8"));
+  if (installed.revision !== body.revision || checksum(installed) !== checksum(body)) {
+    throw new PermanentDeletionJournalError("renamed journal revision did not validate", "durability_indeterminate");
+  }
+  try {
+    fsyncDirectory(parent);
+  } catch (firstError) {
+    assertOwnerOnlyFile(target);
+    const reopened = parseJournal(body.workspace_slug, readFileSync16(target, "utf8"));
+    if (reopened.revision !== body.revision || checksum(reopened) !== checksum(body)) {
+      throw new PermanentDeletionJournalError("journal changed after rename", "durability_indeterminate");
+    }
+    try {
+      fsyncDirectory(parent);
+    } catch (secondError) {
+      const first = firstError instanceof Error ? firstError.message : String(firstError);
+      const second = secondError instanceof Error ? secondError.message : String(secondError);
+      throw new PermanentDeletionJournalError(`journal renamed but parent directory sync failed (${first}; retry: ${second})`, "durability_indeterminate");
+    }
+  }
+  return body;
+}
+function updatePermanentDeletionJournal(workspaceSlug, update) {
+  const prior = loadPermanentDeletionJournal(workspaceSlug);
+  const next = update(prior);
+  if (next === prior)
+    return prior;
+  return writePermanentDeletionJournal(prior, next);
+}
+function findRetirement(journal, kind, logicalKey) {
+  return journal.records.find((record2) => record2.kind === kind && record2.logical_key === logicalKey);
+}
+function findRefreshMarker(journal, kind, logicalKey) {
+  return journal.refresh.find((marker) => marker.kind === kind && marker.logical_key === logicalKey);
+}
+function replaceRecord(journal, record2) {
+  return {
+    ...journal,
+    records: [
+      ...journal.records.filter((item) => recordKey2(item.kind, item.logical_key) !== recordKey2(record2.kind, record2.logical_key)),
+      record2
+    ]
+  };
+}
+function requireFeedRefresh(args) {
+  const now = args.now ?? (() => new Date);
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRefreshMarker(journal, args.kind, args.logicalKey);
+    if (existing)
+      return journal;
+    return {
+      ...journal,
+      refresh: [...journal.refresh, {
+        kind: args.kind,
+        logical_key: args.logicalKey,
+        ...args.requiredGeneration ? { required_generation: args.requiredGeneration } : {},
+        started_at: now().toISOString(),
+        attempts: 0,
+        state: "required"
+      }]
+    };
+  });
+}
+function markRetentionMissing(args) {
+  const now = args.now ?? (() => new Date);
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRefreshMarker(journal, args.kind, args.logicalKey);
+    if (!existing)
+      return journal;
+    const attempts = existing.attempts + 1;
+    const backoffMs = Math.min(3600000, 1000 * 2 ** Math.min(attempts, 12));
+    return {
+      ...journal,
+      refresh: journal.refresh.map((marker) => marker === existing ? {
+        ...marker,
+        attempts,
+        state: "retention_missing",
+        retry_after: new Date(now().getTime() + backoffMs).toISOString()
+      } : marker)
+    };
+  });
+}
+function clearFeedRefresh(args) {
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const record2 = findRetirement(journal, args.kind, args.logicalKey);
+    if (!record2 || record2.disposition !== "complete" || record2.purge_generation !== args.generation) {
+      throw new PermanentDeletionJournalError("cannot clear refresh before matching disposition is complete", "validate");
+    }
+    const next = journal.refresh.filter((marker) => recordKey2(marker.kind, marker.logical_key) !== recordKey2(args.kind, args.logicalKey));
+    return next.length === journal.refresh.length ? journal : { ...journal, refresh: next };
+  });
+}
+function recordRetirementPending(args) {
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRetirement(journal, args.kind, args.logicalKey);
+    if (existing && existing.retirement_sequence > args.retirementSequence)
+      return journal;
+    if (existing && existing.retirement_sequence === args.retirementSequence && existing.purge_generation !== args.purgeGeneration) {
+      throw new PermanentDeletionJournalError("one retirement_sequence maps to multiple generations", "validate");
+    }
+    if (existing?.purge_generation === args.purgeGeneration)
+      return journal;
+    return replaceRecord(journal, {
+      kind: args.kind,
+      logical_key: args.logicalKey,
+      row_id: args.rowId,
+      purge_generation: args.purgeGeneration,
+      retirement_sequence: args.retirementSequence,
+      retired_at: args.retiredAt,
+      disposition: "pending"
+    });
+  });
+}
+function completeRetirement(args) {
+  if (args.stashPath === undefined !== (args.stashHash === undefined)) {
+    throw new PermanentDeletionJournalError("stash path and hash must be supplied together", "validate");
+  }
+  const now = args.now ?? (() => new Date);
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRetirement(journal, args.kind, args.logicalKey);
+    if (!existing || existing.purge_generation !== args.generation) {
+      throw new PermanentDeletionJournalError("cannot complete an unknown retirement generation", "validate");
+    }
+    if (existing.disposition === "complete")
+      return journal;
+    return replaceRecord(journal, {
+      ...existing,
+      disposition: "complete",
+      completed_at: now().toISOString(),
+      ...args.stashPath ? { stash_path: args.stashPath, stash_hash: args.stashHash } : {}
+    });
+  });
+}
+function recordRetirementStash(args) {
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const existing = findRetirement(journal, args.kind, args.logicalKey);
+    if (!existing || existing.purge_generation !== args.generation) {
+      throw new PermanentDeletionJournalError("cannot attach a stash to an unknown retirement", "validate");
+    }
+    if (existing.stash_path === args.stashPath && existing.stash_hash === args.stashHash) {
+      return journal;
+    }
+    if (existing.stash_path && existing.stash_hash !== args.stashHash) {
+      throw new PermanentDeletionJournalError("retirement stash changed after it was recorded", "validate");
+    }
+    return replaceRecord(journal, {
+      ...existing,
+      stash_path: args.stashPath,
+      stash_hash: args.stashHash
+    });
+  });
+}
+function prepareGenerationCreate(args) {
+  const now = args.now ?? (() => new Date);
+  let decision = { kind: "ordinary" };
+  updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    if (findRefreshMarker(journal, args.kind, args.logicalKey)) {
+      decision = { kind: "blocked", reason: "refresh_required" };
+      return journal;
+    }
+    const retirement = findRetirement(journal, args.kind, args.logicalKey);
+    if (!retirement) {
+      decision = { kind: "ordinary" };
+      return journal;
+    }
+    if (retirement.disposition !== "complete") {
+      decision = { kind: "blocked", reason: "disposition_pending" };
+      return journal;
+    }
+    const operation = retirement.operation;
+    if (operation) {
+      if (operation.payload_digest === args.payloadDigest && (operation.state === "pending" || operation.state === "transport_unknown")) {
+        decision = {
+          kind: "authorised",
+          retiredGeneration: retirement.purge_generation,
+          operationId: operation.operation_id,
+          payloadDigest: operation.payload_digest
+        };
+        return journal;
+      }
+      if (operation.state !== "terminal_cleaned") {
+        decision = { kind: "blocked", reason: "operation_unresolved" };
+        return journal;
+      }
+    }
+    const nextOperation = {
+      operation_id: randomUUID(),
+      payload_digest: args.payloadDigest,
+      state: "pending",
+      updated_at: now().toISOString()
+    };
+    decision = {
+      kind: "authorised",
+      retiredGeneration: retirement.purge_generation,
+      operationId: nextOperation.operation_id,
+      payloadDigest: nextOperation.payload_digest
+    };
+    return replaceRecord(journal, { ...retirement, operation: nextOperation });
+  });
+  return decision;
+}
+function updateCreateOperation(args) {
+  const now = args.now ?? (() => new Date);
+  return updatePermanentDeletionJournal(args.workspaceSlug, (journal) => {
+    const retirement = findRetirement(journal, args.kind, args.logicalKey);
+    if (!retirement?.operation || retirement.operation.operation_id !== args.operationId) {
+      throw new PermanentDeletionJournalError("operation update does not match the journal", "validate");
+    }
+    const from = retirement.operation.state;
+    const allowed = {
+      pending: new Set(["pending", "transport_unknown", "finalized", "terminal_cleaned"]),
+      transport_unknown: new Set(["transport_unknown", "pending", "finalized", "terminal_cleaned"]),
+      finalized: new Set(["finalized", "terminal_cleaned"]),
+      terminal_cleaned: new Set(["terminal_cleaned"])
+    };
+    if (!allowed[from].has(args.state)) {
+      throw new PermanentDeletionJournalError(`invalid create operation transition ${from} -> ${args.state}`, "validate");
+    }
+    if (args.state === "finalized" && args.rowId === undefined) {
+      throw new PermanentDeletionJournalError("finalized operation requires a row id", "validate");
+    }
+    return replaceRecord(journal, {
+      ...retirement,
+      operation: {
+        operation_id: retirement.operation.operation_id,
+        payload_digest: retirement.operation.payload_digest,
+        state: args.state,
+        ...args.state === "finalized" && args.rowId ? { row_id: args.rowId } : {},
+        updated_at: now().toISOString()
+      }
+    });
+  });
+}
+
+// src/lib/permanent-mutex.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+
+// src/lib/per-id-mutex.ts
+class PerIdMutex {
+  chains = new Map;
+  async run(key, fn) {
+    const prior = this.chains.get(key) ?? Promise.resolve();
+    const next = prior.then(fn, fn);
+    this.chains.set(key, next);
+    const cleanup = () => {
+      if (this.chains.get(key) === next) {
+        this.chains.delete(key);
+      }
+    };
+    next.then(cleanup, cleanup);
+    return next;
+  }
+  size() {
+    return this.chains.size;
+  }
+}
+
+// src/lib/permanent-mutex.ts
+var mutex = new PerIdMutex;
+var heldKeys = new AsyncLocalStorage;
+function permanentDeletionMutexKey(kind, logicalKey) {
+  return `permanent:${kind}:${logicalKey}`;
+}
+function withPermanentDeletionLock(kind, logicalKey, run) {
+  const key = permanentDeletionMutexKey(kind, logicalKey);
+  const held = heldKeys.getStore();
+  if (held?.has(key))
+    return run();
+  return mutex.run(key, () => heldKeys.run(new Set([...held ?? [], key]), run));
+}
+
+// src/lib/permanent-create.ts
+async function prepareOrResolveGenerationCreate(args) {
+  return withPermanentDeletionLock(args.kind, args.logicalKey, () => prepareOrResolveGenerationCreateLocked(args));
+}
+async function prepareOrResolveGenerationCreateLocked(args) {
+  let decision = prepareGenerationCreate(args);
+  if (decision.kind !== "blocked" || decision.reason !== "operation_unresolved") {
+    return decision;
+  }
+  const journal = loadPermanentDeletionJournal(args.workspaceSlug);
+  const retirement = findRetirement(journal, args.kind, args.logicalKey);
+  const operation = retirement?.operation;
+  if (!operation)
+    return decision;
+  const entityKind = args.kind;
+  const resolved = await resolvePermanentDeletionOperation({
+    baseUrl: args.baseUrl,
+    pat: args.pat,
+    entityKind,
+    operationId: operation.operation_id,
+    fetchImpl: args.fetchImpl
+  });
+  if (resolved.entity_kind !== entityKind || resolved.operation_id !== operation.operation_id) {
+    throw new Error("operation resolution identity does not match the local journal");
+  }
+  if (resolved.status === "retired_not_found") {
+    updateCreateOperation({
+      workspaceSlug: args.workspaceSlug,
+      kind: args.kind,
+      logicalKey: args.logicalKey,
+      operationId: operation.operation_id,
+      state: "terminal_cleaned",
+      now: args.now
+    });
+    return prepareGenerationCreate(args);
+  }
+  if (resolved.logical_key !== args.logicalKey || resolved.payload_digest !== operation.payload_digest) {
+    throw new Error("operation resolution binding does not match the local journal");
+  }
+  if (resolved.status === "pending") {
+    updateCreateOperation({
+      workspaceSlug: args.workspaceSlug,
+      kind: args.kind,
+      logicalKey: args.logicalKey,
+      operationId: operation.operation_id,
+      state: "pending",
+      now: args.now
+    });
+    return { kind: "blocked", reason: "operation_unresolved" };
+  }
+  if (resolved.status === "terminal_cleaned") {
+    updateCreateOperation({
+      workspaceSlug: args.workspaceSlug,
+      kind: args.kind,
+      logicalKey: args.logicalKey,
+      operationId: operation.operation_id,
+      state: "terminal_cleaned",
+      now: args.now
+    });
+    return prepareGenerationCreate(args);
+  }
+  const id = exports_external.object({ id: exports_external.string().uuid() }).parse(resolved.live).id;
+  updateCreateOperation({
+    workspaceSlug: args.workspaceSlug,
+    kind: args.kind,
+    logicalKey: args.logicalKey,
+    operationId: operation.operation_id,
+    state: "finalized",
+    rowId: id,
+    now: args.now
+  });
+  return {
+    kind: "finalized",
+    live: resolved.live,
+    operationId: operation.operation_id,
+    payloadDigest: operation.payload_digest
+  };
+}
 
 // src/lib/files/content-hash.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function sha256Bytes(bytes) {
-  return createHash3("sha256").update(bytes).digest("hex");
+  return createHash4("sha256").update(bytes).digest("hex");
 }
 
 // src/lib/files/mime.ts
@@ -34552,6 +35430,9 @@ async function restoreFileFromCloud(args) {
   });
 }
 async function pushFilesUpsert(args) {
+  return withPermanentDeletionLock("workspace_file", args.relPath, () => pushFilesUpsertLocked(args));
+}
+async function pushFilesUpsertLocked(args) {
   const { workspaceSlug, baseUrl, pat, absolutePath, relPath, state, prepared, deps } = args;
   const fetchImpl = deps?.fetchImpl;
   const now = deps?.now ?? (() => new Date);
@@ -34604,7 +35485,7 @@ async function pushFilesUpsert(args) {
         state: next
       };
     }
-    bytes = readFileSync16(absolutePath);
+    bytes = readFileSync17(absolutePath);
     hash2 = sha256Bytes(bytes);
     inode = st.ino;
   }
@@ -34619,7 +35500,61 @@ async function pushFilesUpsert(args) {
     return { outcome: { kind: "noop", relPath }, state };
   }
   const mimeType = inferMime(relPath);
+  const createProtocol = existing ? { kind: "ordinary" } : await prepareOrResolveGenerationCreate({
+    workspaceSlug,
+    baseUrl,
+    pat,
+    kind: "workspace_file",
+    logicalKey: relPath,
+    payloadDigest: fileCreatePayloadDigest(hash2, mimeType),
+    now,
+    fetchImpl
+  });
+  if (createProtocol.kind === "blocked") {
+    output?.warn(`files/${relPath} is held by permanent-delete reconciliation (${createProtocol.reason}).`);
+    return {
+      outcome: { kind: "permanent_delete_blocked", relPath, reason: createProtocol.reason },
+      state
+    };
+  }
+  if (createProtocol.kind === "finalized") {
+    const parsed = FileLiveSchema.safeParse(createProtocol.live);
+    if (!parsed.success) {
+      throw new ApiError(200, "finalized file create operation live projection did not match the file schema");
+    }
+    if (parsed.data.path !== relPath) {
+      throw new ApiError(200, "finalized file create operation live projection had the wrong path");
+    }
+    const adoptedState = persistFiles(state, {
+      id: parsed.data.id,
+      path: relPath,
+      content_hash: parsed.data.content_hash,
+      size_bytes: parsed.data.size_bytes,
+      mime_type: parsed.data.mime_type,
+      updated_at: parsed.data.updated_at,
+      inode
+    });
+    return pushFilesUpsert({
+      ...args,
+      state: adoptedState,
+      prepared: { bytes, hash: hash2, size, inode }
+    });
+  }
   const acceptPush = (row, action) => {
+    if (createProtocol.kind === "authorised" && row.path !== relPath) {
+      throw new ApiError(200, "generation-bearing file create response had the wrong path");
+    }
+    if (createProtocol.kind === "authorised") {
+      updateCreateOperation({
+        workspaceSlug,
+        kind: "workspace_file",
+        logicalKey: relPath,
+        operationId: createProtocol.operationId,
+        state: "finalized",
+        rowId: row.id,
+        now
+      });
+    }
     output?.log(filePushLine({ path: relPath, id: row.id, action }));
     return {
       outcome: { kind: action, relPath, id: row.id },
@@ -34655,22 +35590,57 @@ async function pushFilesUpsert(args) {
     output?.log(fileFailedLine({ path: relPath, status: 400, reason: "hash_mismatch" }));
     return { outcome: { kind: "ignored", relPath, reason: "hash_mismatch" }, state };
   };
-  const res = await postFile({
-    baseUrl,
-    pat,
-    relPath,
-    bytes,
-    contentHash: hash2,
-    mimeType,
-    expectedUpdatedAt: existing?.updated_at ?? null,
-    fetchImpl
-  });
+  let res;
+  try {
+    res = await postFile({
+      baseUrl,
+      pat,
+      relPath,
+      bytes,
+      contentHash: hash2,
+      mimeType,
+      expectedUpdatedAt: existing?.updated_at ?? null,
+      ...createProtocol.kind === "authorised" ? {
+        retiredGeneration: createProtocol.retiredGeneration,
+        operationId: createProtocol.operationId
+      } : {},
+      fetchImpl
+    });
+  } catch (error52) {
+    if (createProtocol.kind === "authorised" && (!(error52 instanceof ApiError) || error52.status === 0 || error52.status >= 500 || error52.status >= 200 && error52.status < 300)) {
+      updateCreateOperation({
+        workspaceSlug,
+        kind: "workspace_file",
+        logicalKey: relPath,
+        operationId: createProtocol.operationId,
+        state: "transport_unknown",
+        now
+      });
+    }
+    throw error52;
+  }
   if (res.ok)
     return acceptPush(res.row, existing ? "updated" : "created");
   if (res.code === 413)
     return rejectOverCap(res.maxBytes);
   if (res.code === 400)
     return rejectHashMismatch();
+  if ("reason" in res && res.reason === "permanent_name_retired") {
+    if (res.entityKind !== "workspace_file" || res.logicalKey !== relPath) {
+      throw new ApiError(409, "permanent-name refusal identity did not match the file create");
+    }
+    requireFeedRefresh({
+      workspaceSlug,
+      kind: "workspace_file",
+      logicalKey: res.logicalKey,
+      now
+    });
+    output?.warn(`files/${res.logicalKey} was permanently deleted in Plinth; local bytes are held while the file feed is refreshed.`);
+    return {
+      outcome: { kind: "permanent_delete_blocked", relPath: res.logicalKey, reason: "refresh_required" },
+      state
+    };
+  }
   let nextState = state;
   let cloudRow;
   if (existing) {
@@ -34692,6 +35662,25 @@ async function pushFilesUpsert(args) {
         return rejectOverCap(retry.maxBytes);
       if (retry.code === 400)
         return rejectHashMismatch();
+      if ("reason" in retry && retry.reason === "permanent_name_retired") {
+        if (retry.entityKind !== "workspace_file" || retry.logicalKey !== relPath) {
+          throw new ApiError(409, "permanent-name refusal identity did not match the file retry");
+        }
+        requireFeedRefresh({
+          workspaceSlug,
+          kind: "workspace_file",
+          logicalKey: retry.logicalKey,
+          now
+        });
+        return {
+          outcome: {
+            kind: "permanent_delete_blocked",
+            relPath: retry.logicalKey,
+            reason: "refresh_required"
+          },
+          state
+        };
+      }
       cloudRow = undefined;
     }
   }
@@ -34757,29 +35746,9 @@ async function pushFilesDelete(args) {
   return { outcome: { kind: "conflict", relPath, stashPath: "" }, state: nextState };
 }
 
-// src/lib/per-id-mutex.ts
-class PerIdMutex {
-  chains = new Map;
-  async run(key, fn) {
-    const prior = this.chains.get(key) ?? Promise.resolve();
-    const next = prior.then(fn, fn);
-    this.chains.set(key, next);
-    const cleanup = () => {
-      if (this.chains.get(key) === next) {
-        this.chains.delete(key);
-      }
-    };
-    next.then(cleanup, cleanup);
-    return next;
-  }
-  size() {
-    return this.chains.size;
-  }
-}
-
 // src/lib/push.ts
 var import_gray_matter10 = __toESM(require_gray_matter(), 1);
-import { existsSync as existsSync4, readFileSync as readFileSync18, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync19, statSync as statSync8 } from "node:fs";
 import { basename as basename5, relative as relative5 } from "node:path";
 
 // src/lib/frontmatter-id.ts
@@ -34829,7 +35798,7 @@ function frontmatterIdWriteIsSound(next, id, expectedBody) {
 
 // src/lib/pull-write.ts
 var import_gray_matter9 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 function computeMirrorHashes(strategy, content) {
   const parsed = import_gray_matter9.default(content);
   const fm = parsed.data ?? {};
@@ -34873,7 +35842,7 @@ function relocateForSlugChange(args) {
   }
   let raw = null;
   try {
-    raw = readFileSync17(fromPath, "utf8");
+    raw = readFileSync18(fromPath, "utf8");
   } catch (err) {
     const code = err?.code;
     if (code === "ENOENT") {
@@ -34939,12 +35908,21 @@ function relocateForSlugChange(args) {
 }
 function writeMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, suppressor, pathSlug) {
   const targetSlug = pathSlug ?? doc2.slug;
+  const content = renderMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, targetSlug);
+  if (suppressor) {
+    const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
+    suppressor.registerWrite(target, computeMirrorHashes(strategy, content));
+  }
+  writeMirrorFile(workspaceSlug, strategy.type, targetSlug, content);
+  return content;
+}
+function renderMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, targetSlug) {
   let content = strategy.serialise(doc2);
   if (strategy.preserveLocalBodyOnPull) {
     const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
     let existing = null;
     try {
-      existing = readFileSync17(target, "utf8");
+      existing = readFileSync18(target, "utf8");
     } catch (err) {
       if (err?.code !== "ENOENT")
         throw err;
@@ -34958,11 +35936,6 @@ function writeMirrorWithBodyPreserve(workspaceSlug, strategy, doc2, suppressor,
 `;
     }
   }
-  if (suppressor) {
-    const target = entityFilePath(workspaceSlug, strategy.type, targetSlug);
-    suppressor.registerWrite(target, computeMirrorHashes(strategy, content));
-  }
-  writeMirrorFile(workspaceSlug, strategy.type, targetSlug, content);
   return content;
 }
 
@@ -35076,7 +36049,7 @@ function stampStateFromMirror(args) {
   const { strategy, workspaceSlug, doc: doc2, state, priorMemoryHash } = args;
   const targetSlug = args.pathSlug ?? doc2.slug;
   const mirrorPath = entityFilePath(workspaceSlug, strategy.type, targetSlug);
-  const mirrorRaw = readFileSync18(mirrorPath, "utf8");
+  const mirrorRaw = readFileSync19(mirrorPath, "utf8");
   const mirrorParsed = import_gray_matter10.default(mirrorRaw);
   const mirrorFm = mirrorParsed.data ?? {};
   const mirrorLifted = splitUserFrontmatter(strategy, mirrorFm);
@@ -35196,7 +36169,7 @@ async function pushFile(args) {
   const identity = args.identity ?? "auto";
   const fetchImpl = deps?.fetchImpl;
   const now = deps?.now ?? (() => new Date);
-  const mutex = deps?.mutex ?? new PerIdMutex;
+  const mutex2 = deps?.mutex ?? new PerIdMutex;
   const output = deps?.output;
   const suppressor = deps?.suppressor;
   const echo = deps?.echo;
@@ -35222,14 +36195,14 @@ async function pushFile(args) {
       absolutePath,
       state,
       unlinkContext,
-      mutex,
+      mutex: mutex2,
       fetchImpl,
       output
     });
   }
   let raw;
   try {
-    raw = readFileSync18(absolutePath, "utf8");
+    raw = readFileSync19(absolutePath, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") {
       return runPushDelete({
@@ -35242,7 +36215,7 @@ async function pushFile(args) {
         absolutePath,
         state,
         unlinkContext: null,
-        mutex,
+        mutex: mutex2,
         fetchImpl,
         output
       });
@@ -35304,7 +36277,7 @@ async function pushFile(args) {
       raw,
       parsed,
       state,
-      mutex,
+      mutex: mutex2,
       fetchImpl,
       now,
       output,
@@ -35325,7 +36298,7 @@ async function pushFile(args) {
     parsed,
     stateEntry,
     state,
-    mutex,
+    mutex: mutex2,
     fetchImpl,
     now,
     output,
@@ -35579,7 +36552,7 @@ async function runPushUpsert(args) {
     if (liveEntry !== snapshotEntry) {
       let onDisk = null;
       try {
-        onDisk = readFileSync18(args.absolutePath, "utf8");
+        onDisk = readFileSync19(args.absolutePath, "utf8");
       } catch {
         onDisk = null;
       }
@@ -35788,6 +36761,28 @@ async function runPushUpsert(args) {
         base: workingState
       };
     }
+    if (patchResult.reason === "permanent_name_retired") {
+      if (strategy.type !== "documents" || patchResult.entityKind !== "document" || patchResult.logicalKey !== args.stateEntry.slug) {
+        throw new ApiError(409, "permanent-name refusal identity did not match the document update");
+      }
+      requireFeedRefresh({
+        workspaceSlug: args.workspaceSlug,
+        kind: "document",
+        logicalKey: patchResult.logicalKey,
+        now: args.now
+      });
+      args.output?.warn(`${strategy.type}/${patchResult.logicalKey} was permanently deleted in Plinth; local content is held while the document feed is refreshed.`);
+      return {
+        outcome: {
+          kind: "permanent_delete_blocked",
+          entityType: strategy.type,
+          entitySlug: patchResult.logicalKey,
+          reason: "refresh_required"
+        },
+        state: workingState,
+        base: workingState
+      };
+    }
     if (patchResult.reason === "slug_conflict") {
       throw new Error(`patch ${strategy.type} returned slug_conflict for a body+frontmatter PATCH (no slug sent)`);
     }
@@ -36019,7 +37014,7 @@ function writeCreatedIdBack(args) {
     if (entityFilePath(args.workspaceSlug, args.strategy.type, args.slug) !== args.absolutePath) {
       return;
     }
-    const readBack = args.readBack ?? ((p) => readFileSync18(p, "utf8"));
+    const readBack = args.readBack ?? ((p) => readFileSync19(p, "utf8"));
     if (readBack(args.absolutePath) !== args.raw)
       return;
     args.suppressor?.registerWrite(args.absolutePath, computeMirrorHashes(args.strategy, write.content));
@@ -36027,6 +37022,12 @@ function writeCreatedIdBack(args) {
   } catch {}
 }
 async function runPushCreate(args) {
+  if (args.strategy.type === "documents") {
+    return withPermanentDeletionLock("document", args.slug, () => runPushCreateLocked(args));
+  }
+  return runPushCreateLocked(args);
+}
+async function runPushCreateLocked(args) {
   const strategy = args.strategy;
   const key = `create:${strategy.type}:${args.slug}`;
   return args.mutex.run(key, async () => {
@@ -36064,15 +37065,108 @@ async function runPushCreate(args) {
       else
         payload.body = normalised;
     }
-    const createResult = await createEntity({
-      strategy,
+    const createProtocol = strategy.type === "documents" ? await prepareOrResolveGenerationCreate({
+      workspaceSlug: args.workspaceSlug,
       baseUrl: args.baseUrl,
       pat: args.pat,
-      payload,
+      kind: "document",
+      logicalKey: args.slug,
+      payloadDigest: canonicalPayloadDigest(payload),
+      now: args.now,
       fetchImpl: args.fetchImpl
-    });
+    }) : { kind: "ordinary" };
+    if (createProtocol.kind === "blocked") {
+      args.output?.warn(`${strategy.type}/${args.slug} is held by permanent-delete reconciliation (${createProtocol.reason}).`);
+      return {
+        outcome: {
+          kind: "permanent_delete_blocked",
+          entityType: strategy.type,
+          entitySlug: args.slug,
+          reason: createProtocol.reason
+        },
+        state: args.state,
+        base: args.state
+      };
+    }
+    if (createProtocol.kind === "finalized") {
+      const parsedLive = strategy.singleResponseSchema.safeParse(createProtocol.live);
+      if (!parsedLive.success) {
+        throw new ApiError(200, "finalized create operation live projection did not match the entity schema");
+      }
+      if (parsedLive.data.slug !== args.slug) {
+        throw new ApiError(200, "finalized create operation live projection had the wrong slug");
+      }
+      const acknowledged = computeMirrorHashes(strategy, strategy.serialise(parsedLive.data));
+      const adoptedEntry = {
+        id: parsedLive.data.id,
+        slug: parsedLive.data.slug,
+        updated_at: parsedLive.data.updated_at,
+        revision: parsedLive.data.revision,
+        body_hash: acknowledged.bodyHash,
+        frontmatter_hash: acknowledged.frontmatterHash,
+        inode: safeInode2(args.absolutePath)
+      };
+      const adoptedState = persistEntry(args.state, strategy.type, adoptedEntry);
+      return runPushUpsert({
+        echo: args.echo,
+        strategy,
+        workspaceSlug: args.workspaceSlug,
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        absolutePath: args.absolutePath,
+        raw: args.raw,
+        parsed: args.parsed,
+        stateEntry: adoptedEntry,
+        state: adoptedState,
+        mutex: args.mutex,
+        fetchImpl: args.fetchImpl,
+        now: args.now,
+        output: args.output,
+        quarantinedKeys: args.quarantinedKeys
+      });
+    }
+    let createResult;
+    try {
+      createResult = await createEntity({
+        strategy,
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        payload,
+        ...createProtocol.kind === "authorised" ? {
+          retiredGeneration: createProtocol.retiredGeneration,
+          operationId: createProtocol.operationId
+        } : {},
+        fetchImpl: args.fetchImpl
+      });
+    } catch (error52) {
+      if (createProtocol.kind === "authorised" && (!(error52 instanceof ApiError) || error52.status === 0 || error52.status >= 500 || error52.status >= 200 && error52.status < 300)) {
+        updateCreateOperation({
+          workspaceSlug: args.workspaceSlug,
+          kind: "document",
+          logicalKey: args.slug,
+          operationId: createProtocol.operationId,
+          state: "transport_unknown",
+          now: args.now
+        });
+      }
+      throw error52;
+    }
     if (createResult.ok) {
       const doc2 = createResult.doc;
+      if (createProtocol.kind === "authorised" && doc2.slug !== args.slug) {
+        throw new ApiError(200, "generation-bearing create response had the wrong slug");
+      }
+      if (createProtocol.kind === "authorised") {
+        updateCreateOperation({
+          workspaceSlug: args.workspaceSlug,
+          kind: "document",
+          logicalKey: args.slug,
+          operationId: createProtocol.operationId,
+          state: "finalized",
+          rowId: doc2.id,
+          now: args.now
+        });
+      }
       const createFm = args.parsed.data ?? {};
       const createLifted = splitUserFrontmatter(strategy, createFm);
       const userFm = userFrontmatter(strategy, createLifted.frontmatter);
@@ -36130,6 +37224,27 @@ async function runPushCreate(args) {
         base: args.state
       };
     }
+    if (createResult.reason === "permanent_name_retired") {
+      if (strategy.type !== "documents" || createResult.entityKind !== "document" || createResult.logicalKey !== args.slug) {
+        throw new ApiError(409, "permanent-name refusal identity did not match the document create");
+      }
+      requireFeedRefresh({
+        workspaceSlug: args.workspaceSlug,
+        kind: "document",
+        logicalKey: createResult.logicalKey,
+        now: args.now
+      });
+      return {
+        outcome: {
+          kind: "permanent_delete_blocked",
+          entityType: strategy.type,
+          entitySlug: createResult.logicalKey,
+          reason: "refresh_required"
+        },
+        state: args.state,
+        base: args.state
+      };
+    }
     if (createResult.reason === "context_doc_conflict") {
       return reconcileContextDocConflict({
         echo: args.echo,
@@ -36218,7 +37333,7 @@ async function runPushDelete(args) {
   return args.mutex.run(id, async () => {
     const snapshot = getEntry(args.state, strategy.type, id) ?? null;
     const live = snapshot ? committedEntryIfNewer(args.workspaceSlug, strategy.type, snapshot) ?? snapshot : null;
-    if (existsSync4(args.absolutePath)) {
+    if (existsSync5(args.absolutePath)) {
       args.output?.log(entityDeleteSuppressedLine({
         entityType: strategy.type,
         slug,
@@ -36310,7 +37425,7 @@ async function pushRename(args) {
   } = args;
   const fetchImpl = deps?.fetchImpl;
   const now = deps?.now ?? (() => new Date);
-  const mutex = deps?.mutex ?? new PerIdMutex;
+  const mutex2 = deps?.mutex ?? new PerIdMutex;
   const output = deps?.output;
   const echo = deps?.echo;
   const strategy = requireStrategy(entityType);
@@ -36321,7 +37436,7 @@ async function pushRename(args) {
   } catch {
     toSlug = basename5(toPath, ".md");
   }
-  return mutex.run(id, async () => {
+  return mutex2.run(id, async () => {
     const snapshot = getEntry(state, entityType, id);
     const live = snapshot ? committedEntryIfNewer(workspaceSlug, entityType, snapshot) ?? snapshot : undefined;
     const effectiveExpected = live?.updated_at ?? expectedUpdatedAt;
@@ -36371,7 +37486,7 @@ async function pushRename(args) {
       };
       if (!updated.body_hash || !updated.frontmatter_hash) {
         try {
-          const mirrorRaw = readFileSync18(toPath, "utf8");
+          const mirrorRaw = readFileSync19(toPath, "utf8");
           const mirrorParsed = import_gray_matter10.default(mirrorRaw);
           const renameFm = mirrorParsed.data ?? {};
           const renameLifted = splitUserFrontmatter(strategy, renameFm);
@@ -36408,7 +37523,7 @@ async function pushRename(args) {
     if (patchResult.reason === "slug_conflict") {
       let contents2 = "";
       try {
-        contents2 = readFileSync18(toPath, "utf8");
+        contents2 = readFileSync19(toPath, "utf8");
       } catch {}
       const stashPath2 = stashConflict({
         workspaceSlug,
@@ -36456,7 +37571,7 @@ async function pushRename(args) {
     }
     let contents = "";
     try {
-      contents = readFileSync18(toPath, "utf8");
+      contents = readFileSync19(toPath, "utf8");
     } catch {}
     const stashPath = stashConflict({
       workspaceSlug,
@@ -36493,14 +37608,14 @@ async function pushRename(args) {
 
 // src/lib/resolve-pending.ts
 async function drainResolvedBatches(deps) {
-  const mutex = deps.mutex ?? new PerIdMutex;
+  const mutex2 = deps.mutex ?? new PerIdMutex;
   let applied = 0;
   let discarded = 0;
   for (const batch of listPendingBatches(deps.workspaceSlug)) {
     if (batch.status === "pending")
       continue;
     if (batch.status === "approved") {
-      await applyBatch(batch, deps, mutex);
+      await applyBatch(batch, deps, mutex2);
       deps.output?.log(`[DESTRUCTIVE_APPLIED batch=${batch.batch_id} ops=${batch.ops.length}]`);
       applied++;
     } else {
@@ -36515,7 +37630,7 @@ async function drainResolvedBatches(deps) {
 function opLabel(op) {
   return op.target === "file" ? `files/${op.path}` : `${op.entityType}/${op.slug}`;
 }
-async function applyBatch(batch, deps, mutex) {
+async function applyBatch(batch, deps, mutex2) {
   for (const op of batch.ops) {
     try {
       if (op.target === "file") {
@@ -36535,7 +37650,7 @@ async function applyBatch(batch, deps, mutex) {
         deps: {
           fetchImpl: deps.fetchImpl,
           now: deps.now,
-          mutex,
+          mutex: mutex2,
           output: deps.output,
           echo: deps.echo
         }
@@ -36589,7 +37704,7 @@ async function discardBatchOps(batch, deps) {
         const path5 = opPath(deps.workspaceSlug, op);
         let local = null;
         try {
-          local = readFileSync19(path5, "utf8");
+          local = readFileSync20(path5, "utf8");
         } catch {
           local = null;
         }
@@ -36628,7 +37743,7 @@ async function discardFileOp(op, deps) {
   const abs = filesSubtreePath(deps.workspaceSlug, op.path);
   let local = null;
   try {
-    local = readFileSync19(abs);
+    local = readFileSync20(abs);
   } catch {
     local = null;
   }
@@ -36971,7 +38086,7 @@ function unknownBecause(reason) {
     case "no_watermark":
       return "The last download carried no freshness marker, so there is nothing to compare against.";
     case "incomplete_apply":
-      return "The last download did not fully land, so this copy is not the one the freshness marker describes.";
+      return "The last download either did not fully land or carried a correction trail this copy could not use, so this copy is not one the freshness marker can vouch for.";
     case "check_failed":
       return "The freshness check did not complete.";
     default:
@@ -37128,6 +38243,9 @@ function resolveTrail(row, slugById) {
       consistent: true
     };
   }
+  if (outcome === "current" && successor === row.id) {
+    return { trail: "current", consistent: true };
+  }
   if (successor !== null)
     return { trail: UNKNOWN, consistent: false };
   return { trail: outcome, consistent: true };
@@ -37597,10 +38715,10 @@ class FileDestructiveGate {
 }
 
 // src/lib/files/reconcile.ts
-import { readFileSync as readFileSync20, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync21, statSync as statSync10 } from "node:fs";
 
 // src/lib/unsynced.ts
-import { join as join13, relative as relative8 } from "node:path";
+import { join as join14, relative as relative8 } from "node:path";
 var RECORDABLE_REASONS = new Set([
   "rate_limit",
   "server",
@@ -37645,7 +38763,7 @@ function recordFileUnsynced(args) {
   });
 }
 async function drainUnsyncedOps(args) {
-  const { workspaceSlug, baseUrl, pat, getState, applyState, fetchImpl, mutex, output, echo } = args;
+  const { workspaceSlug, baseUrl, pat, getState, applyState, fetchImpl, mutex: mutex2, output, echo } = args;
   const now = args.now ?? (() => new Date);
   const ops = listUnsynced(getState());
   let attempted = 0;
@@ -37662,7 +38780,7 @@ async function drainUnsyncedOps(args) {
     attempted += 1;
     try {
       if (op.target === "entity") {
-        const absolutePath = join13(workspaceMirrorPath(workspaceSlug), op.path);
+        const absolutePath = join14(workspaceMirrorPath(workspaceSlug), op.path);
         const classified = classifyMirrorPath({ workspaceSlug, absolutePath });
         if (!classified) {
           clear("entity", op.path);
@@ -37679,7 +38797,7 @@ async function drainUnsyncedOps(args) {
           state: base2,
           exists: op.op === "upsert",
           unlinkContext: null,
-          deps: { fetchImpl, now, mutex, output, echo }
+          deps: { fetchImpl, now, mutex: mutex2, output, echo }
         });
         applyState(result.base ?? base2, result.state);
         if (result.outcome.kind === "ignored" && result.outcome.reason === DELETE_DECLINED_PATH_EXISTS) {
@@ -37707,7 +38825,7 @@ async function drainUnsyncedOps(args) {
             deps: { fetchImpl, now, output }
           });
         };
-        const result = mutex ? await mutex.run(`files:${op.path}`, doFile) : await doFile();
+        const result = mutex2 ? await mutex2.run(`files:${op.path}`, doFile) : await doFile();
         applyState(base2, result.state);
       }
       clear(op.target, op.path);
@@ -38475,9 +39593,9 @@ class NodeFsHandler {
     if (this.fsw.closed) {
       return;
     }
-    const dirname11 = sp.dirname(file2);
+    const dirname12 = sp.dirname(file2);
     const basename7 = sp.basename(file2);
-    const parent = this.fsw._getWatchedDir(dirname11);
+    const parent = this.fsw._getWatchedDir(dirname12);
     let prevStats = stats;
     if (parent.has(basename7))
       return;
@@ -38504,7 +39622,7 @@ class NodeFsHandler {
             prevStats = newStats2;
           }
         } catch (error52) {
-          this.fsw._remove(dirname11, basename7);
+          this.fsw._remove(dirname12, basename7);
         }
       } else if (parent.has(basename7)) {
         const at = newStats.atimeMs;
@@ -39592,7 +40710,12 @@ function startWatcher(opts, handler) {
   });
   watcher.on("add", (p) => classifier.onAdd(p));
   watcher.on("change", (p) => classifier.onChange(p));
-  watcher.on("unlink", (p) => classifier.onUnlink(p));
+  watcher.on("unlink", (p) => {
+    try {
+      opts.onUnlink?.(p);
+    } catch {}
+    classifier.onUnlink(p);
+  });
   return {
     async stop() {
       classifier.shutdown();
@@ -39631,7 +40754,7 @@ function readBlobForPush(args) {
   }
   let bytes;
   try {
-    bytes = readFileSync20(absolutePath);
+    bytes = readFileSync21(absolutePath);
   } catch (err) {
     if (err?.code === "ENOENT")
       return { kind: "gone" };
@@ -39941,7 +41064,7 @@ function applyArtistMemoryOnPull(args) {
   const cloudMemory = live.memory;
   const generated = live.memory_generated === true;
   const local = readArtistMemoryFile(workspaceSlug, slug);
-  const refuse = (localContent, canonical) => {
+  const refuse = (localContent, canonical2) => {
     const refused = refuseGeneratedMemoryEdit({
       state,
       workspaceSlug,
@@ -39951,7 +41074,7 @@ function applyArtistMemoryOnPull(args) {
       conflictEntity: ENTITY_TYPE,
       conflictSlug: conflictSlug(slug),
       localContent,
-      canonicalBody: canonical,
+      canonicalBody: canonical2,
       writeCanonical: (body) => writeMemory(workspaceSlug, slug, body, suppressor),
       now,
       output: out
@@ -40055,7 +41178,7 @@ async function pushArtistMemory(args) {
         id: entry2.id,
         fetchImpl
       });
-      const canonical = row.memory ?? "";
+      const canonical2 = row.memory ?? "";
       const refused = refuseGeneratedMemoryEdit({
         state: base2,
         workspaceSlug,
@@ -40065,7 +41188,7 @@ async function pushArtistMemory(args) {
         conflictEntity: ENTITY_TYPE,
         conflictSlug: conflictSlug(slug),
         localContent: local,
-        canonicalBody: canonical,
+        canonicalBody: canonical2,
         writeCanonical: (body) => writeMemory(workspaceSlug, slug, body, suppressor),
         now,
         output
@@ -40074,7 +41197,7 @@ async function pushArtistMemory(args) {
         ...entry2,
         updated_at: row.updated_at,
         revision: row.revision,
-        memory_hash: stableHash(canonical),
+        memory_hash: stableHash(canonical2),
         memory_generated: row.memory_generated
       };
       return {
@@ -40170,7 +41293,7 @@ function adoptCloudMemory(args) {
   return persistEntry2(state, updated);
 }
 async function reconcileArtistMemory(args) {
-  const { workspaceSlug, baseUrl, pat, fetchImpl, output, suppressor, mutex } = args;
+  const { workspaceSlug, baseUrl, pat, fetchImpl, output, suppressor, mutex: mutex2 } = args;
   const now = args.now ?? (() => new Date);
   let state = args.state;
   let transitioned = 0;
@@ -40212,7 +41335,7 @@ async function reconcileArtistMemory(args) {
         now,
         output,
         suppressor,
-        mutex
+        mutex: mutex2
       });
       state = result.state;
       if (result.outcome.kind === "pushed")
@@ -40692,10 +41815,10 @@ function anyUnknown(state) {
 }
 
 // src/lib/memory/write.ts
-import { readFileSync as readFileSync21, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync22, statSync as statSync11 } from "node:fs";
 
 // src/lib/files/extracted-text.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 var DERIVED_TEXT_VERSION = 2;
 function yamlString3(value) {
   return JSON.stringify(value);
@@ -40769,7 +41892,7 @@ ${doc2.text}
 `;
 }
 function extractedTextHash(rendered) {
-  return createHash4("sha256").update(rendered, "utf8").digest("hex");
+  return createHash5("sha256").update(rendered, "utf8").digest("hex");
 }
 
 // src/lib/memory/splice.ts
@@ -40887,7 +42010,7 @@ function writeDocumentAnnotation(args) {
   }
   let current;
   try {
-    current = readFileSync21(target, "utf8");
+    current = readFileSync22(target, "utf8");
   } catch {
     return { kind: "absent" };
   }
@@ -41716,6 +42839,109 @@ class PullLoop {
   }
 }
 
+// src/lib/high-water.ts
+var HIGH_WATER_BASE_READ_MS = 60 * 60 * 1000;
+function baseReadIntervalMs(env2 = process.env) {
+  const raw = Number(env2.PLINTH_HIGH_WATER_BASE_READ_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : HIGH_WATER_BASE_READ_MS;
+}
+function provenMark(args) {
+  if (!args.clean)
+    return null;
+  return args.finalHighWater ?? args.advancedTo;
+}
+function createBaseReadSchedule(bootMs, intervalMs = HIGH_WATER_BASE_READ_MS) {
+  let lastBaseReadMs = bootMs;
+  let restoresWaiting = false;
+  let lastUsedHighWater = false;
+  return {
+    useHighWater(nowMs) {
+      if (restoresWaiting)
+        return lastUsedHighWater;
+      return nowMs - lastBaseReadMs < intervalMs;
+    },
+    completed(nowMs, usedHighWater, ok, restoresDeferred = 0) {
+      if (!ok)
+        return;
+      if (!usedHighWater)
+        lastBaseReadMs = nowMs;
+      restoresWaiting = restoresDeferred > 0;
+      lastUsedHighWater = usedHighWater;
+    }
+  };
+}
+
+// src/lib/restore-deferral.ts
+var RESTORE_DEFERRAL_MS = 5 * 60000;
+var UNEXPLAINED_GRACE_MS = 5000;
+function keyOf(absolutePath) {
+  return absolutePath.normalize("NFC");
+}
+function sightingKey(key, version2) {
+  return `${key}\x00${version2}`;
+}
+function forgetSightings(recent, key) {
+  const prefix = `${key}\x00`;
+  for (const k of recent.keys())
+    if (k.startsWith(prefix))
+      recent.delete(k);
+}
+function noteUnlink(recent, absolutePath, nowMs) {
+  forgetExpired(recent, nowMs);
+  const key = keyOf(absolutePath);
+  forgetSightings(recent, key);
+  recent.set(key, { kind: "unlink", at: nowMs, logged: false });
+}
+function deferRestore(recent, absolutePath, version2, nowMs) {
+  if (!recent)
+    return { defer: false, first: false };
+  forgetExpired(recent, nowMs);
+  const key = keyOf(absolutePath);
+  const unlinked = recent.get(key);
+  if (unlinked?.kind === "unlink") {
+    if (unlinked.logged)
+      return { defer: true, first: false };
+    recent.set(key, { ...unlinked, logged: true });
+    return { defer: true, first: true };
+  }
+  const sighting = sightingKey(key, version2);
+  const seen = recent.get(sighting);
+  if (seen === undefined) {
+    recent.set(sighting, { kind: "missing", at: nowMs });
+    return { defer: true, first: false };
+  }
+  if (nowMs - seen.at < UNEXPLAINED_GRACE_MS)
+    return { defer: true, first: false };
+  recent.delete(sighting);
+  return { defer: false, first: false };
+}
+function presentAgain(recent, absolutePath) {
+  if (recent)
+    forgetSightings(recent, keyOf(absolutePath));
+}
+function forgetExpired(recent, nowMs) {
+  for (const [key, seen] of recent) {
+    if (seen.kind === "unlink" && nowMs - seen.at >= RESTORE_DEFERRAL_MS)
+      recent.delete(key);
+  }
+}
+
+// src/lib/ambient-poll.ts
+function createAmbientPollWiring(opts) {
+  const recentUnlinks = new Map;
+  const baseReads = createBaseReadSchedule(opts.now(), opts.baseReadIntervalMs);
+  return {
+    onUnlink: (absolutePath) => noteUnlink(recentUnlinks, absolutePath, opts.now()),
+    async poll(run) {
+      const startMs = opts.now();
+      const useHighWater = baseReads.useHighWater(startMs);
+      const result = await run({ useHighWater, recentUnlinks });
+      baseReads.completed(startMs, useHighWater, result.exitCode === 0, result.restoresDeferred ?? 0);
+      return result;
+    }
+  };
+}
+
 // src/lib/calendar-loop.ts
 var DEFAULT_CALENDAR_INTERVAL_MS = 900000;
 var CALENDAR_BACKOFF_CAP_MS = 3600000;
@@ -41876,6 +43102,12 @@ var CALENDAR_STATUSES = [
   "token-expired",
   "google-error"
 ];
+var KNOWN_TRUNCATED_REASONS = ["page_limit", "time_limit"];
+var TruncatedReasonSchema = exports_external.string().nullish().transform((v) => {
+  if (v === null || v === undefined)
+    return null;
+  return KNOWN_TRUNCATED_REASONS.includes(v) ? v : "other";
+});
 var CalendarRowSchema = exports_external.object({
   artist_id: exports_external.string().nullable(),
   artist_slug: exports_external.string().nullable(),
@@ -41884,8 +43116,13 @@ var CalendarRowSchema = exports_external.object({
   calendar_name: exports_external.string(),
   status: exports_external.enum(CALENDAR_STATUSES),
   events: exports_external.array(CalendarEventSchema).nullable(),
-  error: exports_external.object({ upstream_status: exports_external.number(), message: exports_external.string() }).nullish().transform((v) => v ?? null),
-  truncated: exports_external.boolean().optional().default(false)
+  error: exports_external.object({
+    upstream_status: exports_external.number().nullable(),
+    message: exports_external.string()
+  }).nullish().transform((v) => v ?? null),
+  truncated: exports_external.boolean().optional().default(false),
+  truncated_reason: TruncatedReasonSchema,
+  resume_from: exports_external.string().nullish().transform((v) => v ?? null)
 });
 var CalendarResponseSchema = exports_external.object({
   generated_at: exports_external.string().min(1),
@@ -42073,6 +43310,62 @@ function readAsOf(text, today) {
   return { parts, yearInferred: first.yearInferred };
 }
 
+// src/lib/calendar/limits.ts
+var CALENDAR_RANGE_TOOL = "list_calendar_events";
+function spanPhrase(timeMin, timeMax) {
+  const ms = Date.parse(timeMax) - Date.parse(timeMin);
+  if (!Number.isFinite(ms) || ms <= 0)
+    return null;
+  const weeks = ms / (7 * DAY_MS);
+  if (Number.isInteger(weeks))
+    return `${weeks} ${weeks === 1 ? "week" : "weeks"}`;
+  const days = ms / DAY_MS;
+  if (Number.isInteger(days))
+    return `${days} ${days === 1 ? "day" : "days"}`;
+  return null;
+}
+function coverageLine(timeMin, timeMax) {
+  const span = spanPhrase(timeMin, timeMax);
+  return `**This file holds only the window above${span ? ` (${span})` : ""}.** ` + `When a question needs a date outside it, past or future, call the Plinth ` + `tool \`${CALENDAR_RANGE_TOOL}\` for just that range.`;
+}
+var TRUNCATION_CAUSE = {
+  page_limit: "Google had more entries in this window than one refresh reads.",
+  time_limit: "The read from Google ran out of time.",
+  other: "The read stopped before the end of the window."
+};
+var TRUNCATION_SHORT = {
+  page_limit: "stopped at the page limit",
+  time_limit: "ran out of time",
+  other: "stopped before the end of the window"
+};
+var OFFSET_TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})$/i;
+function resumeRange(resumeFrom, window2) {
+  if (resumeFrom === null || !OFFSET_TIMESTAMP_RE.test(resumeFrom))
+    return null;
+  if (!OFFSET_TIMESTAMP_RE.test(window2.time_min) || !OFFSET_TIMESTAMP_RE.test(window2.time_max)) {
+    return null;
+  }
+  const at = Date.parse(resumeFrom);
+  const min = Date.parse(window2.time_min);
+  const max = Date.parse(window2.time_max);
+  if (!(at > min && at < max))
+    return null;
+  return { from: new Date(at).toISOString(), to: new Date(max).toISOString() };
+}
+function incompleteLine(args) {
+  const { stamp: stamp2, eventCount, reason, resumeFrom, window: window2 } = args;
+  const kept = eventCount === 0 ? "No entries were collected before the read stopped, so this is NOT a clear diary." : `${eventCount} ${eventCount === 1 ? "entry was" : "entries were"} collected before the read stopped.`;
+  const range = resumeRange(resumeFrom, window2);
+  const pointer = range ? ` For the rest, call the Plinth tool \`${CALENDAR_RANGE_TOOL}\` from ` + `\`${range.from}\` to \`${range.to}\` (a few entries repeat).` : ` For the rest, call the Plinth tool \`${CALENDAR_RANGE_TOOL}\` for a ` + `narrower range inside the window.`;
+  return `**Read as of ${stamp2}, but this list is INCOMPLETE.** ` + `${TRUNCATION_CAUSE[reason ?? "other"]} ${kept} ` + `The rest of the window is not included: unknown, not absent.${pointer}`;
+}
+function sentence(text) {
+  return /[.!?\u2026]$/.test(text) ? text : `${text}.`;
+}
+function truncationShort(reason) {
+  return TRUNCATION_SHORT[reason ?? "other"];
+}
+
 // src/lib/calendar/render.ts
 var CALENDAR_BODY_MARKER = "<!-- PLINTH:CALENDAR-BODY -->";
 var OWNERSHIP_NOTE2 = [
@@ -42176,37 +43469,61 @@ function windowLine(timeMin, timeMax) {
     return `${timeMin} to ${timeMax}`;
   return `${formatDay(from, -1)} to ${formatDay(to, -1)}`;
 }
+function isRefusal(error52) {
+  return error52.upstream_status !== null && error52.upstream_status >= 400;
+}
+function googleErrorLine(error52) {
+  if (error52 !== null && !isRefusal(error52)) {
+    return `**NOT READ - the read from Google did not complete.** ` + `${sentence(oneLine2(error52.message, 300))} The next refresh retries; until then ` + `nothing below is current, so treat this calendar as unknown rather than empty. ` + `For a date on it you need now, call the Plinth tool \`${CALENDAR_RANGE_TOOL}\` ` + `for a narrower range.`;
+  }
+  return `**NOT READ - Google refused the request` + `${error52 ? ` (HTTP ${error52.upstream_status})` : ""}.** ` + `${error52 ? sentence(oneLine2(error52.message, 300)) : "No detail was returned."} ` + `A calendar that was unshared or deleted in Google reads exactly like this. ` + `Nothing below is current; treat this calendar as unknown rather than empty.`;
+}
 function statusLine(args) {
   const { status, eventCount, error: error52, truncated, stamp: stamp2, userLabel } = args;
   switch (status) {
     case "fetched": {
+      if (truncated) {
+        return incompleteLine({
+          stamp: stamp2,
+          eventCount,
+          reason: args.truncatedReason,
+          resumeFrom: args.resumeFrom,
+          window: args.window
+        });
+      }
       if (eventCount === 0) {
         return `**Read fine as of ${stamp2}. Nothing in this window.** The diary really ` + `is clear across the dates above. This is a successful read of an empty ` + `calendar, not a failed read - if it had failed, this line would say so.`;
       }
-      const truncatedNote = truncated ? " **This list is INCOMPLETE**: Google had more entries than one page and the rest were not collected." : "";
-      return `**Read fine as of ${stamp2}.** ${eventCount} ` + `${eventCount === 1 ? "entry" : "entries"} in the window.${truncatedNote}`;
+      return `**Read fine as of ${stamp2}.** ${eventCount} ` + `${eventCount === 1 ? "entry" : "entries"} in the window.`;
     }
     case "no-token":
       return `**NOT READ - Google is not connected for ${userLabel}.** Nothing is listed ` + `below because Plinth could not look, NOT because the diary is clear. ` + `Connect Google in Plinth to fill this in, and until then treat this ` + `calendar as unknown rather than empty.`;
     case "token-expired":
       return `**NOT READ - the Google connection for ${userLabel} has expired.** Plinth ` + `still holds a connection but could not refresh it, so nothing below is ` + `current. Reconnect Google in Plinth. Treat this calendar as unknown ` + `rather than empty.`;
     case "google-error":
-      return `**NOT READ - Google refused the request` + `${error52 ? ` (HTTP ${error52.upstream_status})` : ""}.** ` + `${error52 ? oneLine2(error52.message, 300) : "No detail was returned."} ` + `A calendar that was unshared or deleted in Google reads exactly like this. ` + `Nothing below is current; treat this calendar as unknown rather than empty.`;
+      return googleErrorLine(error52);
   }
 }
 function shortStatus(row) {
   switch (row.status) {
     case "fetched": {
       const n = row.events?.length ?? 0;
+      const count = `${n} ${n === 1 ? "entry" : "entries"}`;
+      if (row.truncated) {
+        return `read, ${count}, INCOMPLETE (${truncationShort(row.truncated_reason)}); ` + `the rest of the window is unknown, not empty`;
+      }
       if (n === 0)
         return "read fine, nothing in this window";
-      return `read fine, ${n} ${n === 1 ? "entry" : "entries"}${row.truncated ? " (INCOMPLETE - more than one page)" : ""}`;
+      return `read fine, ${count}`;
     }
     case "no-token":
       return "NOT READ - Google is not connected; unknown, not empty";
     case "token-expired":
       return "NOT READ - the Google connection has expired; unknown, not empty";
     case "google-error":
+      if (row.error !== null && !isRefusal(row.error)) {
+        return `NOT READ - the read from Google did not complete: ` + `${oneLine2(row.error.message, 120)}; the next refresh retries; unknown, not empty`;
+      }
       return `NOT READ - Google refused` + `${row.error ? ` (HTTP ${row.error.upstream_status}): ${oneLine2(row.error.message, 120)}` : ""}` + `; unknown, not empty`;
   }
 }
@@ -42264,21 +43581,25 @@ function renderArtistCalendar(args) {
       eventCount: events.length,
       error: row.error,
       truncated: row.truncated,
+      truncatedReason: row.truncated_reason,
+      resumeFrom: row.resume_from,
+      window: window2,
       stamp: stamp2,
       userLabel
     }),
     "",
     `**Window:** ${windowLine(window2.time_min, window2.time_max)}.`,
     "",
+    ...row.status === "fetched" ? [coverageLine(window2.time_min, window2.time_max), ""] : [],
     "**Dates are read here and changed in Plinth's calendar view, by a person.** If something below needs moving, say what the change is and hand it over.",
     "",
-    renderBands(events, generatedAt, referenceYear, "")
+    renderBands(events, generatedAt, referenceYear, "", row.truncated)
   ].join(`
 `);
   return `${header}${CALENDAR_BODY_MARKER}
 ${body}`;
 }
-function renderBands(events, generatedAt, referenceYear, artistPrefix) {
+function renderBands(events, generatedAt, referenceYear, artistPrefix, truncated) {
   if (events.length === 0)
     return "";
   const { full, rest } = splitBands(events, generatedAt);
@@ -42292,7 +43613,7 @@ function renderBands(events, generatedAt, referenceYear, artistPrefix) {
   }
   out.push("", "## Rest of the window", "");
   if (rest.length === 0) {
-    out.push("_Nothing further in the window._");
+    out.push(truncated ? "_Nothing further was collected: the read stopped before the end of the window._" : "_Nothing further in the window._");
   } else {
     for (const e of rest)
       out.push(compactLine(e, referenceYear, artistPrefix));
@@ -42301,6 +43622,9 @@ function renderBands(events, generatedAt, referenceYear, artistPrefix) {
   return out.join(`
 `);
 }
+function lacksConnection(row) {
+  return row.status === "no-token" || row.status === "token-expired";
+}
 function renderUpcoming(args) {
   const {
     rows,
@@ -42316,6 +43640,7 @@ function renderUpcoming(args) {
   const fetched = rows.filter((r) => r.status === "fetched");
   const failed = rows.filter((r) => r.status !== "fetched");
   const truncatedAnywhere = rows.some((r) => r.truncated);
+  const cutShort = fetched.filter((r) => r.truncated).length;
   const merged = fetched.flatMap((row) => (row.events ?? []).map((event) => ({ event, row }))).sort((a, b) => sortInstant(a.event) - sortInstant(b.event));
   const { full, rest } = splitBands(merged.map((m) => m.event), generatedAt);
   const fullSet = new Set(full);
@@ -42346,7 +43671,12 @@ function renderUpcoming(args) {
     "",
     `**As of ${stamp2}.** Window ${windowLine(window2.time_min, window2.time_max)}.`,
     "",
+    ...rows.length > 0 && !rows.every(lacksConnection) ? [coverageLine(window2.time_min, window2.time_max), ""] : [],
     failed.length === 0 ? `**All ${fetched.length} mapped ${fetched.length === 1 ? "calendar was" : "calendars were"} read.**` : `**${fetched.length} of ${rows.length} mapped ${rows.length === 1 ? "calendar" : "calendars"} read; ${failed.length} could NOT be read.**` + ` Anything on an unread calendar is missing from the lists below - unknown, not absent.`,
+    ...cutShort === 0 ? [] : [
+      "",
+      `**${cutShort} of the calendars read ${cutShort === 1 ? "was" : "were"} cut short** before the end ` + `of the window, so entries past the point where ${cutShort === 1 ? "it" : "each"} stopped are ` + `missing from the lists below - unknown, not absent. The status list says which.`
+    ],
     "",
     `${artistCount} ${artistCount === 1 ? "artist" : "artists"} in the roster; ` + `${mappedArtistCount} ${mappedArtistCount === 1 ? "has" : "have"} a calendar mapped in Plinth.`,
     "",
@@ -42363,7 +43693,7 @@ function renderUpcoming(args) {
   body.push(`## Next ${FULL_BAND_DAYS} days`, "", "_Links are in the per-artist file named beside each calendar above._", "");
   const fullMerged = merged.filter((m) => fullSet.has(m.event));
   if (fullMerged.length === 0) {
-    body.push(fetched.length === 0 ? `_No calendar could be read, so nothing can be listed for the next ${FULL_BAND_DAYS} days._` : `_Nothing in the next ${FULL_BAND_DAYS} days on any calendar that was read._`);
+    body.push(fetched.length === 0 ? `_No calendar could be read, so nothing can be listed for the next ${FULL_BAND_DAYS} days._` : cutShort > 0 ? `_Nothing collected for the next ${FULL_BAND_DAYS} days on any calendar that was read; the ones cut short may be missing entries._` : `_Nothing in the next ${FULL_BAND_DAYS} days on any calendar that was read._`);
   } else {
     for (const { event, row } of fullMerged) {
       body.push(fullLine(event, referenceYear, `**${rowDisplayName(row)}**`, false));
@@ -42372,7 +43702,7 @@ function renderUpcoming(args) {
   body.push("", "## Rest of the window", "");
   const restMerged = merged.filter((m) => restSet.has(m.event));
   if (restMerged.length === 0) {
-    body.push(fetched.length === 0 ? "_No calendar could be read, so nothing can be listed._" : "_Nothing further in the window on any calendar that was read._");
+    body.push(fetched.length === 0 ? "_No calendar could be read, so nothing can be listed._" : cutShort > 0 ? "_Nothing further was collected on any calendar that was read; the ones cut short may be missing entries past where they stopped._" : "_Nothing further in the window on any calendar that was read._");
   } else {
     for (const { event, row } of restMerged) {
       body.push(compactLine(event, referenceYear, `**${rowDisplayName(row)}**`));
@@ -42619,7 +43949,7 @@ class PullSuppressor {
 
 // src/lib/discover-entities.ts
 var import_gray_matter12 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync22, statSync as statSync12 } from "node:fs";
+import { readFileSync as readFileSync23, statSync as statSync12 } from "node:fs";
 var DISCOVERY_WRITE_CAP_DEFAULT = 10;
 function discoveryWriteCap() {
   const raw = process.env.PLINTH_DISCOVERY_WRITE_CAP;
@@ -42718,7 +44048,7 @@ function planDiscoveryWrites(args) {
     counts.discovered++;
     let frontmatter;
     try {
-      frontmatter = import_gray_matter12.default(readFileSync22(absolutePath, "utf8")).data ?? {};
+      frontmatter = import_gray_matter12.default(readFileSync23(absolutePath, "utf8")).data ?? {};
     } catch {
       counts.discovered--;
       continue;
@@ -42947,7 +44277,7 @@ function recordDiscoveryFailure(args) {
 
 // src/lib/frontmatter-id-backfill.ts
 var import_gray_matter13 = __toESM(require_gray_matter(), 1);
-import { readFileSync as readFileSync23, statSync as statSync13 } from "node:fs";
+import { readFileSync as readFileSync24, statSync as statSync13 } from "node:fs";
 var FRONTMATTER_ID_BACKFILL_VERSION = 1;
 function backfillWorthReporting(r) {
   return r.written > 0 || r.failed > 0 || r.skipped.foreignId > 0 || r.skipped.unwritable > 0 || r.skipped.slugCollision > 0;
@@ -42990,7 +44320,7 @@ function safeInode3(path5) {
 function backfillFrontmatterIds(args) {
   const { workspaceSlug, state } = args;
   const compose = args.compose ?? withFrontmatterId;
-  const readRaw = args.readFile ?? ((p) => readFileSync23(p, "utf8"));
+  const readRaw = args.readFile ?? ((p) => readFileSync24(p, "utf8"));
   const result = emptyResult();
   if (state.frontmatter_id_backfill_version === FRONTMATTER_ID_BACKFILL_VERSION) {
     return result;
@@ -43118,7 +44448,7 @@ function backfillFrontmatterIds(args) {
 }
 
 // src/lib/reconcile.ts
-import { readFileSync as readFileSync24, statSync as statSync14 } from "node:fs";
+import { readFileSync as readFileSync25, statSync as statSync14 } from "node:fs";
 async function reconcileDivergedRows(args) {
   const { workspaceSlug, baseUrl, pat, fetchImpl, output, isFrozen } = args;
   const now = args.now ?? (() => new Date);
@@ -43230,7 +44560,7 @@ async function reconcileDivergedRows(args) {
       }
       let content;
       try {
-        content = readFileSync24(absolutePath, "utf8");
+        content = readFileSync25(absolutePath, "utf8");
       } catch (err) {
         if (err?.code === "ENOENT") {
           state = clearEntityCloudRowDeleted(state, strategy.mirrorRelativePath(entry2.slug));
@@ -43331,7 +44661,7 @@ async function reconcileDivergedRows(args) {
 }
 
 // src/lib/workspace-rules/sync.ts
-import { existsSync as existsSync5 } from "node:fs";
+import { existsSync as existsSync6 } from "node:fs";
 import { relative as relative12 } from "node:path";
 
 // src/lib/workspace-rules/api.ts
@@ -43480,9 +44810,9 @@ function migrateHouseStyleFile(workspaceSlug) {
       return false;
     throw err;
   }
-  if (existsSync5(target))
+  if (existsSync6(target))
     return false;
-  if (!existsSync5(legacy))
+  if (!existsSync6(legacy))
     return false;
   return renameContextFile(workspaceSlug, HOUSE_STYLE_LEGACY_FILENAME, WORKSPACE_RULES_FILENAME);
 }
@@ -44580,17 +45910,18 @@ function createThrottledFetch(baseFetch, opts = {}) {
 
 // src/commands/sync.ts
 import {
-  existsSync as existsSync8,
+  existsSync as existsSync9,
+  lstatSync as lstatSync6,
   readdirSync as readdirSync7,
-  readFileSync as readFileSync27,
+  readFileSync as readFileSync29,
   statSync as statSync17,
-  unlinkSync as unlinkSync8
+  unlinkSync as unlinkSync9
 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 
 // src/lib/conflicts-view.ts
-import { existsSync as existsSync6 } from "node:fs";
-import { join as join16 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
+import { join as join17 } from "node:path";
 var NO_GENERATED_MEMORY = {
   artistMemoryGenerated: () => false,
   workspaceMemoryGenerated: () => false,
@@ -44636,7 +45967,7 @@ function resolveConflictRows(workspaceSlug, stashes, generatedMemory = NO_GENERA
     if (validateFilesRelPath(rel) === null) {
       return { kind: "unsafe-path", stash };
     }
-    const abs = join16(root, "files", rel);
+    const abs = join17(root, "files", rel);
     if (hasSymlinkedComponent(workspaceSlug, abs)) {
       return { kind: "unsafe-path", stash };
     }
@@ -44644,7 +45975,7 @@ function resolveConflictRows(workspaceSlug, stashes, generatedMemory = NO_GENERA
       kind: "restorable",
       stash,
       mirrorPath: abs,
-      mirrorPathExists: existsSync6(abs)
+      mirrorPathExists: existsSync7(abs)
     };
   });
 }
@@ -44766,9 +46097,385 @@ function refreshConflictsView(workspaceSlug) {
 }
 
 // src/lib/files/pull.ts
-import { existsSync as existsSync7, lstatSync as lstatSync4, readFileSync as readFileSync25, statSync as statSync15 } from "node:fs";
-import { dirname as dirname12 } from "node:path";
+import { existsSync as existsSync8, lstatSync as lstatSync5, readFileSync as readFileSync27, statSync as statSync15 } from "node:fs";
+import { dirname as dirname13 } from "node:path";
+
+// src/lib/permanent-disposition.ts
+import { createHash as createHash6 } from "node:crypto";
+import { readFileSync as readFileSync26 } from "node:fs";
+function sha256(value) {
+  return createHash6("sha256").update(value).digest("hex");
+}
+function verifyStash(path5, expectedHash) {
+  const actual = sha256(readFileSync26(path5));
+  if (actual !== expectedHash) {
+    throw new Error(`permanent deletion stash verification failed for ${path5}`);
+  }
+}
+function disposePermanentDocument(args) {
+  return withPermanentDeletionLock("document", args.tombstone.logicalKey, async () => disposePermanentDocumentLocked(args));
+}
+function disposePermanentDocumentLocked(args) {
+  const now = args.now ?? (() => new Date);
+  const t = args.tombstone;
+  recordRetirementPending({
+    workspaceSlug: args.workspaceSlug,
+    kind: "document",
+    logicalKey: t.logicalKey,
+    rowId: t.id,
+    purgeGeneration: t.purgeGeneration,
+    retirementSequence: t.retirementSequence,
+    retiredAt: t.deletedAt
+  });
+  let journal = loadPermanentDeletionJournal(args.workspaceSlug);
+  let record2 = findRetirement(journal, "document", t.logicalKey);
+  if (record2.purge_generation !== t.purgeGeneration) {
+    return { state: args.state, deleted: false };
+  }
+  if (args.liveOwnerId === t.id) {
+    throw new Error("permanent document namespace reports the retired row as live owner");
+  }
+  if (record2.disposition === "complete") {
+    const stale = args.liveOwnerId === null ? getEntryBySlug(args.state, args.strategy.type, t.logicalKey) : getEntry(args.state, args.strategy.type, t.id);
+    const state2 = stale ? removeEntry(args.state, args.strategy.type, stale.id).state : args.state;
+    return { state: state2, deleted: false, stashPath: record2.stash_path };
+  }
+  const retiredEntry = getEntry(args.state, args.strategy.type, t.id);
+  const stateOwner = getEntryBySlug(args.state, args.strategy.type, t.logicalKey);
+  const protectedOwner = args.liveOwnerId !== null && args.liveOwnerId !== t.id;
+  let state = args.state;
+  let deleted = false;
+  let stashPath = record2.stash_path;
+  let stashHash = record2.stash_hash;
+  if (!protectedOwner) {
+    const target = entityFilePath(args.workspaceSlug, args.strategy.type, retiredEntry?.slug ?? t.logicalKey);
+    let raw;
+    try {
+      raw = readFileSync26(target, "utf8");
+    } catch (error52) {
+      if (error52?.code !== "ENOENT")
+        throw error52;
+    }
+    if (raw !== undefined && !stashPath) {
+      let matchesAcknowledged = false;
+      if (retiredEntry) {
+        try {
+          const hashes = computeMirrorHashes(args.strategy, raw);
+          matchesAcknowledged = hashes.bodyHash === retiredEntry.body_hash && hashes.frontmatterHash === retiredEntry.frontmatter_hash;
+        } catch {
+          matchesAcknowledged = false;
+        }
+      }
+      if (!matchesAcknowledged) {
+        const stash = stashEntityConflictOnce({
+          workspaceSlug: args.workspaceSlug,
+          entityType: args.strategy.type,
+          entitySlug: t.logicalKey,
+          timestamp: now(),
+          contents: raw,
+          side: "local"
+        });
+        stashPath = stash.path;
+        stashHash = sha256(raw);
+        verifyStash(stash.path, stashHash);
+        recordRetirementStash({
+          workspaceSlug: args.workspaceSlug,
+          kind: "document",
+          logicalKey: t.logicalKey,
+          generation: t.purgeGeneration,
+          stashPath,
+          stashHash
+        });
+        args.output?.warn(`${args.strategy.type}/${t.logicalKey}: permanently deleted; recoverable local content was moved to ${stashPath}.`);
+      }
+    }
+    args.suppressor?.registerDelete(target);
+    deleted = deleteMirrorFile(args.workspaceSlug, args.strategy.type, retiredEntry?.slug ?? t.logicalKey);
+  }
+  const staleEntry = args.liveOwnerId === null ? stateOwner : retiredEntry;
+  if (staleEntry)
+    state = removeEntry(state, args.strategy.type, staleEntry.id).state;
+  completeRetirement({
+    workspaceSlug: args.workspaceSlug,
+    kind: "document",
+    logicalKey: t.logicalKey,
+    generation: t.purgeGeneration,
+    ...stashPath && stashHash ? { stashPath, stashHash } : {},
+    now
+  });
+  return { state, deleted, ...stashPath ? { stashPath } : {} };
+}
+function disposePermanentFile(args) {
+  return withPermanentDeletionLock("workspace_file", args.tombstone.logicalKey, async () => disposePermanentFileLocked(args));
+}
+function disposePermanentFileLocked(args) {
+  const now = args.now ?? (() => new Date);
+  const t = args.tombstone;
+  recordRetirementPending({
+    workspaceSlug: args.workspaceSlug,
+    kind: "workspace_file",
+    logicalKey: t.logicalKey,
+    rowId: t.id,
+    purgeGeneration: t.purgeGeneration,
+    retirementSequence: t.retirementSequence,
+    retiredAt: t.deletedAt
+  });
+  const journal = loadPermanentDeletionJournal(args.workspaceSlug);
+  const record2 = findRetirement(journal, "workspace_file", t.logicalKey);
+  if (record2.purge_generation !== t.purgeGeneration) {
+    return { state: args.state, deleted: false, textDeleted: false };
+  }
+  if (args.liveOwnerId === t.id) {
+    throw new Error("permanent file namespace reports the retired row as live owner");
+  }
+  if (record2.disposition === "complete") {
+    const stale = getFileEntry(args.state, t.logicalKey);
+    const state2 = stale && (args.liveOwnerId === null || stale.id === t.id) ? removeFileEntry(args.state, t.logicalKey).state : args.state;
+    return {
+      state: state2,
+      deleted: false,
+      textDeleted: false,
+      ...record2.stash_path ? { stashPath: record2.stash_path } : {}
+    };
+  }
+  const existing = getFileEntry(args.state, t.logicalKey);
+  const protectedOwner = args.liveOwnerId !== null && args.liveOwnerId !== t.id;
+  let state = args.state;
+  let deleted = false;
+  let textDeleted = false;
+  let stashPath = record2.stash_path;
+  let stashHash = record2.stash_hash;
+  if (!protectedOwner) {
+    const target = filesSubtreePath(args.workspaceSlug, t.logicalKey);
+    let bytes;
+    try {
+      bytes = readFileSync26(target);
+    } catch (error52) {
+      if (error52?.code !== "ENOENT")
+        throw error52;
+    }
+    if (bytes !== undefined && !stashPath) {
+      const matchesAcknowledged = existing !== undefined && sha256Bytes(bytes) === existing.content_hash;
+      if (!matchesAcknowledged) {
+        const stash = stashFileConflictOnce({
+          workspaceSlug: args.workspaceSlug,
+          relPath: t.logicalKey,
+          timestamp: now(),
+          bytes,
+          side: "local"
+        });
+        stashPath = stash.path;
+        stashHash = sha256(bytes);
+        verifyStash(stash.path, stashHash);
+        recordRetirementStash({
+          workspaceSlug: args.workspaceSlug,
+          kind: "workspace_file",
+          logicalKey: t.logicalKey,
+          generation: t.purgeGeneration,
+          stashPath,
+          stashHash
+        });
+        args.output?.warn(`files/${t.logicalKey}: permanently deleted; recoverable local bytes were moved to ${stashPath}.`);
+      }
+    }
+    args.suppressor?.registerDelete(target);
+    deleted = deleteFilesFile(args.workspaceSlug, t.logicalKey);
+    textDeleted = deleteExtractedText(args.workspaceSlug, t.logicalKey);
+  }
+  if (existing && (args.liveOwnerId === null || existing.id === t.id)) {
+    state = removeFileEntry(state, t.logicalKey).state;
+  }
+  completeRetirement({
+    workspaceSlug: args.workspaceSlug,
+    kind: "workspace_file",
+    logicalKey: t.logicalKey,
+    generation: t.purgeGeneration,
+    ...stashPath && stashHash ? { stashPath, stashHash } : {},
+    now
+  });
+  return { state, deleted, textDeleted, ...stashPath ? { stashPath } : {} };
+}
+
+// src/lib/files/pull.ts
+function dueFileRefreshMarkers(workspaceSlug, now) {
+  try {
+    return loadPermanentDeletionJournal(workspaceSlug).refresh.filter((marker) => marker.kind === "workspace_file" && (marker.retry_after === undefined || new Date(marker.retry_after).getTime() <= now.getTime()));
+  } catch {
+    return null;
+  }
+}
+async function replayPermanentFiles(args, markers) {
+  const now = args.now ?? (() => new Date);
+  const rows = [];
+  let cursor = null;
+  const savedCursor = args.baseCursor === undefined ? args.cursor : args.baseCursor;
+  let resultingCursor = savedCursor;
+  while (true) {
+    const page = await syncFilesPage({
+      baseUrl: args.baseUrl,
+      pat: args.pat,
+      cursor,
+      fetchImpl: args.fetchImpl
+    });
+    rows.push(...page.rows);
+    if (page.next_cursor === null)
+      break;
+    resultingCursor = page.next_cursor;
+    cursor = page.next_cursor;
+  }
+  let state = args.state;
+  let written = 0;
+  let deleted = 0;
+  let textWritten = 0;
+  let textDeleted = 0;
+  let textUnknown = 0;
+  let pointerRows = 0;
+  let symlinkRefused = 0;
+  let stashFailed = 0;
+  let restoresDeferred = 0;
+  let completePass = true;
+  let lastCommittedState = args.state;
+  const completed = [];
+  for (const marker of markers) {
+    const candidates = rows.filter((row) => row.path === marker.logical_key && row.deleted_at !== null && row.permanent_delete === true && typeof row.purge_generation === "string" && typeof row.retirement_sequence === "number");
+    candidates.sort((a, b) => b.retirement_sequence - a.retirement_sequence);
+    const candidate = candidates[0];
+    const ambiguousLatest = candidate !== undefined && candidates.some((row) => row.retirement_sequence === candidate.retirement_sequence && row.purge_generation !== candidate.purge_generation);
+    const stateBefore = state;
+    const outcome = await withPermanentDeletionLock("workspace_file", marker.logical_key, async () => {
+      const namespace = await getCurrentPermanentNamespace({
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        entityKind: "workspace_file",
+        logicalKey: marker.logical_key,
+        fetchImpl: args.fetchImpl
+      });
+      if (!candidate || ambiguousLatest || namespace.latest_retirement === null || namespace.latest_retirement.purge_generation !== candidate.purge_generation || namespace.latest_retirement.retirement_sequence !== candidate.retirement_sequence) {
+        markRetentionMissing({
+          workspaceSlug: args.workspaceSlug,
+          kind: "workspace_file",
+          logicalKey: marker.logical_key,
+          now
+        });
+        args.output?.warn(`files/${marker.logical_key}: permanent-delete replay could not prove one unambiguous current retained tombstone; creates remain fenced and the replay will retry.`);
+        return { state: stateBefore, deleted: false, textDeleted: false, complete: false };
+      }
+      const liveOwnerId = namespace.live_owner?.id ?? null;
+      const disposition = await disposePermanentFile({
+        workspaceSlug: args.workspaceSlug,
+        tombstone: {
+          id: candidate.id,
+          logicalKey: marker.logical_key,
+          deletedAt: candidate.deleted_at,
+          purgeGeneration: candidate.purge_generation,
+          retirementSequence: candidate.retirement_sequence
+        },
+        liveOwnerId,
+        state: stateBefore,
+        now,
+        output: args.output,
+        suppressor: args.suppressor
+      });
+      const committedState = args.commit && disposition.state !== stateBefore ? args.commit(stateBefore, disposition.state) : disposition.state;
+      const current = await getCurrentPermanentNamespace({
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        entityKind: "workspace_file",
+        logicalKey: marker.logical_key,
+        fetchImpl: args.fetchImpl
+      });
+      const complete = current.latest_retirement?.purge_generation === candidate.purge_generation && current.latest_retirement?.retirement_sequence === candidate.retirement_sequence && (current.live_owner?.id ?? null) === liveOwnerId;
+      return {
+        state: committedState,
+        deleted: disposition.deleted,
+        textDeleted: disposition.textDeleted,
+        complete
+      };
+    });
+    state = outcome.state;
+    if (args.commit && state !== stateBefore)
+      lastCommittedState = state;
+    if (outcome.deleted)
+      deleted++;
+    if (outcome.textDeleted)
+      textDeleted++;
+    if (outcome.complete && candidate) {
+      completed.push({ logicalKey: marker.logical_key, generation: candidate.purge_generation });
+    } else {
+      completePass = false;
+    }
+  }
+  for (const row of rows) {
+    if (row.deleted_at !== null && row.permanent_delete === true)
+      continue;
+    const outcome = await applyFileRow({
+      workspaceSlug: args.workspaceSlug,
+      baseUrl: args.baseUrl,
+      pat: args.pat,
+      row,
+      state,
+      fetchImpl: args.fetchImpl,
+      now,
+      output: args.output,
+      suppressor: args.suppressor,
+      isFileFrozen: args.isFileFrozen,
+      loggedTombstoneSkips: args.loggedTombstoneSkips,
+      forceTextRewalk: args.forceTextRewalk,
+      loggedStashNotices: args.loggedStashNotices,
+      recentUnlinks: args.recentUnlinks
+    });
+    state = outcome.state;
+    if (outcome.action === "written")
+      written++;
+    else if (outcome.action === "deleted")
+      deleted++;
+    textWritten += outcome.textWritten ?? 0;
+    textDeleted += outcome.textDeleted ?? 0;
+    if (outcome.textUnknown)
+      textUnknown++;
+    if (outcome.pointer)
+      pointerRows++;
+    if (outcome.symlinkRefused) {
+      symlinkRefused++;
+      completePass = false;
+    }
+    if (outcome.stashFailed || outcome.textFailed || outcome.integrityFailed) {
+      if (outcome.stashFailed)
+        stashFailed++;
+      completePass = false;
+    }
+    if (outcome.restoreDeferred) {
+      restoresDeferred++;
+      completePass = false;
+    }
+  }
+  if (args.commit && state !== lastCommittedState)
+    state = args.commit(lastCommittedState, state);
+  return {
+    state,
+    fetched: rows.length,
+    written,
+    deleted,
+    textWritten,
+    textDeleted,
+    textUnknown,
+    pointerRows,
+    symlinkRefused,
+    stashFailed,
+    lastCursor: completePass ? resultingCursor : savedCursor,
+    restoresDeferred,
+    permanentRefreshes: completed,
+    permanentReplayComplete: completePass
+  };
+}
 async function pullFiles(args) {
+  const dueMarkers = dueFileRefreshMarkers(args.workspaceSlug, (args.now ?? (() => new Date))());
+  if (dueMarkers && dueMarkers.length > 0)
+    return replayPermanentFiles(args, dueMarkers);
+  const permanentJournalBlocked = dueMarkers === null;
+  if (permanentJournalBlocked) {
+    args.output?.warn(`files: permanent deletion journal is invalid or unreadable; ordinary rows may apply, but the files cursor and permanent dispositions are held. Run \`plinth status\` for the journal path.`);
+  }
   const { workspaceSlug, baseUrl, pat, fetchImpl } = args;
   let state = args.state;
   let fetched = 0;
@@ -44780,15 +46487,47 @@ async function pullFiles(args) {
   let pointerRows = 0;
   let symlinkRefused = 0;
   let stashFailed = 0;
+  let restoresDeferred = 0;
+  let permanentEncountered = false;
+  const baseCursor = args.baseCursor === undefined ? args.cursor : args.baseCursor;
   let cursor = args.cursor;
   let lastCursor = args.cursor;
-  let cursorBlocked = false;
+  let finalHighWater = null;
+  let markRefused = false;
+  let cursorBlocked = permanentJournalBlocked;
   while (true) {
-    const page = await syncFilesPage({ baseUrl, pat, cursor, fetchImpl });
+    let page;
+    try {
+      page = await syncFilesPage({ baseUrl, pat, cursor, fetchImpl });
+    } catch (err) {
+      if (!markRefused && cursor === args.cursor && args.cursor !== baseCursor && err instanceof ApiError && err.status === 400) {
+        markRefused = true;
+        cursor = baseCursor;
+        lastCursor = baseCursor;
+        continue;
+      }
+      throw err;
+    }
     const pageBase = state;
     let pageTextFailed = false;
     for (const row of page.rows) {
       fetched++;
+      if (row.deleted_at !== null && row.permanent_delete === true && row.purge_generation !== undefined) {
+        if (permanentJournalBlocked) {
+          pageTextFailed = true;
+          continue;
+        }
+        requireFeedRefresh({
+          workspaceSlug,
+          kind: "workspace_file",
+          logicalKey: row.path,
+          requiredGeneration: row.purge_generation,
+          now: args.now
+        });
+        permanentEncountered = true;
+        pageTextFailed = true;
+        continue;
+      }
       const outcome = await applyFileRow({
         workspaceSlug,
         baseUrl,
@@ -44802,7 +46541,8 @@ async function pullFiles(args) {
         isFileFrozen: args.isFileFrozen,
         loggedTombstoneSkips: args.loggedTombstoneSkips,
         forceTextRewalk: args.forceTextRewalk,
-        loggedStashNotices: args.loggedStashNotices
+        loggedStashNotices: args.loggedStashNotices,
+        recentUnlinks: args.recentUnlinks
       });
       state = outcome.state;
       if (!outcome.symlinkRefused) {
@@ -44828,17 +46568,34 @@ async function pullFiles(args) {
         stashFailed++;
         pageTextFailed = true;
       }
+      if (outcome.integrityFailed)
+        pageTextFailed = true;
+      if (outcome.restoreDeferred) {
+        restoresDeferred++;
+        pageTextFailed = true;
+      }
     }
     if (args.commit && state !== pageBase)
       state = args.commit(pageBase, state);
     if (pageTextFailed)
       cursorBlocked = true;
-    if (page.next_cursor === null)
+    if (page.next_cursor === null) {
+      finalHighWater = page.high_water ?? null;
       break;
+    }
     if (!cursorBlocked)
       lastCursor = page.next_cursor;
     cursor = page.next_cursor;
   }
+  if (permanentEncountered) {
+    const markers = dueFileRefreshMarkers(workspaceSlug, (args.now ?? (() => new Date))());
+    if (!markers) {
+      throw new Error("permanent deletion journal became unreadable during file replay");
+    }
+    if (markers.length > 0) {
+      return replayPermanentFiles({ ...args, state }, markers);
+    }
+  }
   if (textUnknown > 0) {
     args.output?.warn(`${textUnknown} file ${textUnknown === 1 ? "row" : "rows"} arrived without a readable \`has_extracted_text\` — this server predates the extracted-text contract, or the field was dropped from the payload. Derived text under views/extracted/ was left untouched rather than deleted, and is not being updated either.`);
   }
@@ -44862,7 +46619,14 @@ async function pullFiles(args) {
     pointerRows,
     symlinkRefused,
     stashFailed,
-    lastCursor
+    lastCursor,
+    highWater: provenMark({
+      clean: !cursorBlocked && textUnknown === 0,
+      finalHighWater,
+      advancedTo: lastCursor !== (markRefused ? baseCursor : args.cursor) ? lastCursor : null
+    }),
+    markRefused,
+    restoresDeferred
   };
 }
 async function applyExtractedText(args) {
@@ -44977,7 +46741,7 @@ async function applyFileRow(args) {
     }
     let localBytes;
     try {
-      localBytes = readFileSync25(abs);
+      localBytes = readFileSync27(abs);
     } catch {
       localBytes = undefined;
     }
@@ -45023,7 +46787,18 @@ async function applyFileRow(args) {
       output
     });
   }
-  if (existing && existing.content_hash === row.content_hash && existsSync7(abs)) {
+  if (existing && existing.content_hash === row.content_hash && !existsSync8(abs)) {
+    const verdict = deferRestore(args.recentUnlinks, abs, row.updated_at, now().getTime());
+    if (verdict.defer) {
+      if (verdict.first) {
+        output?.log(fileRestoreDeferredLine({ path: relPath, waitSeconds: RESTORE_DEFERRAL_MS / 1000 }));
+      }
+      return { state, action: "noop", textUnknown, restoreDeferred: true };
+    }
+  } else {
+    presentAgain(args.recentUnlinks, abs);
+  }
+  if (existing && existing.content_hash === row.content_hash && existsSync8(abs)) {
     if (!args.forceTextRewalk && textIsCurrent(existing, row, workspaceSlug, relPath)) {
       return { state, action: "noop", textUnknown };
     }
@@ -45075,7 +46850,7 @@ async function applyFileRow(args) {
   const bytes = await downloadBytes(got.row.download_url, fetchImpl);
   if (sha256Bytes(bytes) !== row.content_hash) {
     output?.warn(`Integrity check failed for files/${relPath} (hash mismatch) — skipped this pull.`);
-    return { state, action: "skipped" };
+    return { state, action: "skipped", integrityFailed: true };
   }
   const stashFailure = stashUnpushedLocalEdit({
     workspaceSlug,
@@ -45153,7 +46928,7 @@ async function applyPointerRow(args) {
   if (textSignal === "absent") {
     args.output?.warn(`files/${relPath}: Plinth holds neither bytes nor text for this file — it has no local representation in the mirror.`);
   }
-  const bytesInMirror = existsSync7(filesSubtreePath(workspaceSlug, relPath));
+  const bytesInMirror = existsSync8(filesSubtreePath(workspaceSlug, relPath));
   if (bytesInMirror) {
     args.output?.warn(`files/${relPath}: Plinth holds no bytes for this file, but a local copy is present at that path — left exactly as it is. Plinth will not update it.`);
   }
@@ -45179,11 +46954,11 @@ async function applyPointerRow(args) {
 }
 function stashUnpushedLocalEdit(args) {
   const { workspaceSlug, relPath, abs, existing, output } = args;
-  if (hasSymlinkedComponent(workspaceSlug, dirname12(abs)))
+  if (hasSymlinkedComponent(workspaceSlug, dirname13(abs)))
     return { reason: "symlink" };
   let st;
   try {
-    st = lstatSync4(abs);
+    st = lstatSync5(abs);
   } catch (err) {
     if (err?.code === "ENOENT")
       return null;
@@ -45193,7 +46968,7 @@ function stashUnpushedLocalEdit(args) {
     return { reason: "not_a_file" };
   let localBytes;
   try {
-    localBytes = readFileSync25(abs);
+    localBytes = readFileSync27(abs);
   } catch (err) {
     return { reason: "unreadable", code: errCode(err) };
   }
@@ -45230,10 +47005,12 @@ function textIsCurrent(existing, row, workspaceSlug, relPath) {
   if (signal === "unknown")
     return true;
   if (signal === "absent") {
-    return existing.text_hash === undefined && !existsSync7(extractedTextPath(workspaceSlug, relPath));
+    return existing.text_hash === undefined && !existsSync8(extractedTextPath(workspaceSlug, relPath));
   }
   if (existing.text_hash === undefined)
     return false;
+  if (existing.updated_at !== row.updated_at)
+    return false;
   const onDisk = readExtractedText(workspaceSlug, relPath);
   if (onDisk === null)
     return false;
@@ -45241,7 +47018,7 @@ function textIsCurrent(existing, row, workspaceSlug, relPath) {
 }
 
 // src/lib/files/rejection-sync.ts
-import { readFileSync as readFileSync26, statSync as statSync16 } from "node:fs";
+import { readFileSync as readFileSync28, statSync as statSync16 } from "node:fs";
 
 // src/lib/files/rejections-api.ts
 var RejectionsFeedSchema = exports_external.object({
@@ -45374,7 +47151,7 @@ function settledDisposition(args) {
     return null;
   let bytes;
   try {
-    bytes = readFileSync26(absolute2);
+    bytes = readFileSync28(absolute2);
   } catch {
     return null;
   }
@@ -45451,7 +47228,7 @@ function classifyApiError(err) {
   return { kind: "transient", status: err.status };
 }
 function hasExistingContent(workspacePath) {
-  if (!existsSync8(workspacePath))
+  if (!existsSync9(workspacePath))
     return false;
   try {
     return readdirSync7(workspacePath, { withFileTypes: true }).some((e) => {
@@ -45460,7 +47237,7 @@ function hasExistingContent(workspacePath) {
       if (!e.isDirectory())
         return true;
       try {
-        return readdirSync7(join17(workspacePath, e.name)).length > 0;
+        return readdirSync7(join18(workspacePath, e.name)).length > 0;
       } catch {
         return true;
       }
@@ -45490,7 +47267,7 @@ function unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor) {
   }
   let raw;
   try {
-    raw = readFileSync27(target, "utf8");
+    raw = readFileSync29(target, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") {
       return { didUnlink: false };
@@ -45508,7 +47285,7 @@ function unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor) {
   }
   try {
     suppressor?.registerDelete(target);
-    unlinkSync8(target);
+    unlinkSync9(target);
     return { didUnlink: true };
   } catch (err) {
     if (err?.code === "ENOENT") {
@@ -45517,6 +47294,122 @@ function unlinkIfProvablyOurs(workspaceSlug, strategy, entry2, suppressor) {
     throw err;
   }
 }
+function dueDocumentRefreshMarkers(workspaceSlug, now) {
+  try {
+    return loadPermanentDeletionJournal(workspaceSlug).refresh.filter((marker) => marker.kind === "document" && (marker.retry_after === undefined || new Date(marker.retry_after).getTime() <= now.getTime()));
+  } catch {
+    return null;
+  }
+}
+async function replayPermanentDocuments(args) {
+  const rows = [];
+  let cursor = null;
+  let resultingCursor = args.savedCursor;
+  while (true) {
+    const page = await syncEntity({
+      strategy: args.strategy,
+      baseUrl: args.baseUrl,
+      pat: args.pat,
+      cursor,
+      fetchImpl: args.fetchImpl
+    });
+    rows.push(...page.rows);
+    if (page.next_cursor === null)
+      break;
+    resultingCursor = page.next_cursor;
+    cursor = page.next_cursor;
+  }
+  let state = args.state;
+  const completed = [];
+  let completePass = true;
+  let restoresDeferred = 0;
+  for (const marker of args.markers) {
+    const candidates = rows.filter((row) => row.deleted_at !== null && row.slug === marker.logical_key && row.permanent_delete === true && typeof row.purge_generation === "string" && typeof row.retirement_sequence === "number");
+    candidates.sort((a, b) => b.retirement_sequence - a.retirement_sequence);
+    const candidate = candidates[0];
+    const ambiguousLatest = candidate !== undefined && candidates.some((row) => row.retirement_sequence === candidate.retirement_sequence && row.purge_generation !== candidate.purge_generation);
+    const stateBefore = state;
+    const outcome = await withPermanentDeletionLock("document", marker.logical_key, async () => {
+      const namespace = await getCurrentPermanentNamespace({
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        entityKind: "document",
+        logicalKey: marker.logical_key,
+        fetchImpl: args.fetchImpl
+      });
+      if (!candidate || ambiguousLatest || namespace.latest_retirement === null || namespace.latest_retirement.purge_generation !== candidate.purge_generation || namespace.latest_retirement.retirement_sequence !== candidate.retirement_sequence) {
+        markRetentionMissing({
+          workspaceSlug: args.workspaceSlug,
+          kind: "document",
+          logicalKey: marker.logical_key,
+          now: args.now
+        });
+        args.output.warn(`documents/${marker.logical_key}: permanent-delete replay could not prove one unambiguous current retained tombstone; creates remain fenced and the replay will retry.`);
+        return { state: stateBefore, complete: false };
+      }
+      const liveOwnerId = namespace.live_owner?.id ?? null;
+      const disposed = await disposePermanentDocument({
+        workspaceSlug: args.workspaceSlug,
+        strategy: args.strategy,
+        tombstone: {
+          id: candidate.id,
+          logicalKey: marker.logical_key,
+          deletedAt: candidate.deleted_at,
+          purgeGeneration: candidate.purge_generation,
+          retirementSequence: candidate.retirement_sequence
+        },
+        liveOwnerId,
+        state: stateBefore,
+        now: args.now,
+        output: args.output,
+        suppressor: args.suppressor
+      });
+      const committedState = args.commit && disposed.state !== stateBefore ? args.commit(stateBefore, disposed.state) : disposed.state;
+      const current = await getCurrentPermanentNamespace({
+        baseUrl: args.baseUrl,
+        pat: args.pat,
+        entityKind: "document",
+        logicalKey: marker.logical_key,
+        fetchImpl: args.fetchImpl
+      });
+      const complete = current.latest_retirement?.purge_generation === candidate.purge_generation && current.latest_retirement?.retirement_sequence === candidate.retirement_sequence && (current.live_owner?.id ?? null) === liveOwnerId;
+      return { state: committedState, complete };
+    });
+    state = outcome.state;
+    if (outcome.complete && candidate) {
+      completed.push({ logicalKey: marker.logical_key, generation: candidate.purge_generation });
+    } else {
+      completePass = false;
+    }
+  }
+  const counters = {
+    fetched: rows.length,
+    written: 0,
+    deleted: 0,
+    moved: 0,
+    refused: 0
+  };
+  for (const row of rows) {
+    if (row.deleted_at !== null && row.permanent_delete === true)
+      continue;
+    const outcome = applyRow(args.workspaceSlug, args.strategy, row, state, args.output, args.suppressor, args.now, args.isFrozen, args.loggedTombstoneSkips, args.recentUnlinks);
+    state = outcome.state;
+    if (outcome.action === "written")
+      counters.written++;
+    else if (outcome.action === "deleted")
+      counters.deleted++;
+    else if (outcome.action === "moved")
+      counters.moved = (counters.moved ?? 0) + 1;
+    else if (outcome.action === "slug_refused") {
+      counters.refused = (counters.refused ?? 0) + 1;
+      completePass = false;
+    } else if (outcome.action === "restore_deferred") {
+      restoresDeferred++;
+      completePass = false;
+    }
+  }
+  return { state, counters, cursor: resultingCursor, completed, completePass, restoresDeferred };
+}
 async function runSync(workspaceSlug, deps = {}) {
   const out = new Output({
     sink: deps.sink,
@@ -45636,13 +47529,66 @@ async function runSync(workspaceSlug, deps = {}) {
     committed = state;
   };
   const counters = {};
+  let restoresDeferred = 0;
   try {
     for (const entityType of allEntityTypes()) {
       const strategy = requireStrategy(entityType);
       const startCursor = entry2.sync_cursors?.[entityType] ?? null;
-      let cursor = startCursor;
-      let lastAdvancedCursor = startCursor;
+      if (entityType === "documents") {
+        const markers = dueDocumentRefreshMarkers(slug, now());
+        if (markers && markers.length > 0) {
+          const replay = await replayPermanentDocuments({
+            workspaceSlug: slug,
+            baseUrl: entry2.api_base_url,
+            pat,
+            state,
+            savedCursor: startCursor,
+            strategy,
+            markers,
+            fetchImpl,
+            output: out,
+            suppressor: deps.suppressor,
+            now,
+            isFrozen: deps.isFrozen,
+            loggedTombstoneSkips: deps.loggedTombstoneSkips,
+            recentUnlinks: deps.recentUnlinks,
+            commit: (before, after) => {
+              const next = commitState(before, after);
+              committed = next;
+              return next;
+            }
+          });
+          state = replay.state;
+          commitPending();
+          counters[entityType] = replay.counters;
+          restoresDeferred += replay.restoresDeferred;
+          if (replay.completePass) {
+            updateSyncCursor(slug, entityType, replay.cursor);
+            updateSyncHighWater(slug, entityType, null);
+            for (const item of replay.completed) {
+              clearFeedRefresh({
+                workspaceSlug: slug,
+                kind: "document",
+                logicalKey: item.logicalKey,
+                generation: item.generation
+              });
+            }
+          }
+          continue;
+        }
+      }
+      const storedMark = entry2.sync_high_water?.[entityType] ?? null;
+      let walkStart = deps.useHighWater === true && storedMark !== null ? storedMark : startCursor;
+      let cursor = walkStart;
+      let lastAdvancedCursor = walkStart;
+      let finalHighWater = null;
       let cursorBlocked = false;
+      let permanentEncountered = false;
+      const permanentJournalBlocked = entityType === "documents" && dueDocumentRefreshMarkers(slug, now()) === null;
+      if (permanentJournalBlocked) {
+        cursorBlocked = true;
+        out.warn(`documents: permanent deletion journal is invalid or unreadable; ordinary rows may apply, but the document cursor and permanent dispositions are held. Run \`plinth status\` for the journal path.`);
+      }
       const ctr = {
         fetched: 0,
         written: 0,
@@ -45651,18 +47597,47 @@ async function runSync(workspaceSlug, deps = {}) {
         refused: 0
       };
       while (true) {
-        const page = await syncEntity({
-          strategy,
-          baseUrl: entry2.api_base_url,
-          pat,
-          cursor,
-          fetchImpl
-        });
+        let page;
+        try {
+          page = await syncEntity({
+            strategy,
+            baseUrl: entry2.api_base_url,
+            pat,
+            cursor,
+            fetchImpl
+          });
+        } catch (err) {
+          if (cursor === walkStart && walkStart !== startCursor && err instanceof ApiError && err.status === 400) {
+            updateSyncHighWater(slug, entityType, null);
+            out.warn(`${entityType}: the stored high-water mark was refused; reading from the cursor instead.`);
+            walkStart = startCursor;
+            cursor = startCursor;
+            lastAdvancedCursor = startCursor;
+            continue;
+          }
+          throw err;
+        }
         for (const row of page.rows) {
           ctr.fetched++;
+          if (entityType === "documents" && row.deleted_at !== null && row.permanent_delete === true && row.purge_generation !== undefined) {
+            if (permanentJournalBlocked) {
+              cursorBlocked = true;
+              continue;
+            }
+            requireFeedRefresh({
+              workspaceSlug: slug,
+              kind: "document",
+              logicalKey: row.slug,
+              requiredGeneration: row.purge_generation,
+              now
+            });
+            permanentEncountered = true;
+            cursorBlocked = true;
+            continue;
+          }
           let outcome;
           try {
-            outcome = applyRow(slug, strategy, row, state, out, deps.suppressor, now, deps.isFrozen, deps.loggedTombstoneSkips);
+            outcome = applyRow(slug, strategy, row, state, out, deps.suppressor, now, deps.isFrozen, deps.loggedTombstoneSkips, deps.recentUnlinks);
           } catch (err) {
             if (!(err instanceof MirrorSymlinkError))
               throw err;
@@ -45685,25 +47660,82 @@ async function runSync(workspaceSlug, deps = {}) {
             ctr.deleted++;
           else if (outcome.action === "moved")
             ctr.moved = (ctr.moved ?? 0) + 1;
-          else if (outcome.action === "slug_refused") {
+          else if (outcome.action === "restore_deferred") {
+            cursorBlocked = true;
+            restoresDeferred++;
+          } else if (outcome.action === "slug_refused") {
             ctr.refused = (ctr.refused ?? 0) + 1;
             cursorBlocked = true;
           }
         }
         commitPending();
-        if (page.next_cursor === null)
+        if (page.next_cursor === null) {
+          finalHighWater = page.high_water ?? null;
           break;
+        }
         if (!cursorBlocked)
           lastAdvancedCursor = page.next_cursor;
         cursor = page.next_cursor;
       }
       counters[entityType] = ctr;
-      if (lastAdvancedCursor !== startCursor) {
+      if (permanentEncountered && entityType === "documents") {
+        const markers = dueDocumentRefreshMarkers(slug, now());
+        if (!markers || markers.length === 0)
+          continue;
+        const replay = await replayPermanentDocuments({
+          workspaceSlug: slug,
+          baseUrl: entry2.api_base_url,
+          pat,
+          state,
+          savedCursor: startCursor,
+          strategy,
+          markers,
+          fetchImpl,
+          output: out,
+          suppressor: deps.suppressor,
+          now,
+          isFrozen: deps.isFrozen,
+          loggedTombstoneSkips: deps.loggedTombstoneSkips,
+          recentUnlinks: deps.recentUnlinks,
+          commit: (before, after) => {
+            const next = commitState(before, after);
+            committed = next;
+            return next;
+          }
+        });
+        state = replay.state;
+        commitPending();
+        counters[entityType] = replay.counters;
+        restoresDeferred += replay.restoresDeferred;
+        if (replay.completePass) {
+          updateSyncCursor(slug, entityType, replay.cursor);
+          updateSyncHighWater(slug, entityType, null);
+          for (const item of replay.completed) {
+            clearFeedRefresh({
+              workspaceSlug: slug,
+              kind: "document",
+              logicalKey: item.logicalKey,
+              generation: item.generation
+            });
+          }
+        }
+        continue;
+      }
+      if (walkStart === startCursor && lastAdvancedCursor !== walkStart) {
         updateSyncCursor(slug, entityType, lastAdvancedCursor);
       }
+      const mark = provenMark({
+        clean: !cursorBlocked,
+        finalHighWater,
+        advancedTo: lastAdvancedCursor !== walkStart ? lastAdvancedCursor : null
+      });
+      if (mark !== null)
+        updateSyncHighWater(slug, entityType, mark);
     }
     const needsDerivedTextRewalk = state.derived_text_version !== DERIVED_TEXT_VERSION;
-    const filesStartCursor = needsDerivedTextRewalk ? null : entry2.sync_cursors?.["files"] ?? null;
+    const filesBaseCursor = needsDerivedTextRewalk ? null : entry2.sync_cursors?.["files"] ?? null;
+    const filesMark = entry2.sync_high_water?.["files"] ?? null;
+    const filesStartCursor = !needsDerivedTextRewalk && deps.useHighWater === true && filesMark !== null ? filesMark : filesBaseCursor;
     if (needsDerivedTextRewalk) {
       out.info("Re-reading the file index once to refresh extracted text (template changed).");
     }
@@ -45713,6 +47745,8 @@ async function runSync(workspaceSlug, deps = {}) {
       pat,
       state,
       cursor: filesStartCursor,
+      baseCursor: filesBaseCursor,
+      recentUnlinks: deps.recentUnlinks,
       fetchImpl,
       now,
       output: out,
@@ -45726,7 +47760,8 @@ async function runSync(workspaceSlug, deps = {}) {
     if (filesResult.state !== state) {
       state = filesResult.state;
     }
-    if (needsDerivedTextRewalk && filesResult.textUnknown === 0) {
+    restoresDeferred += filesResult.restoresDeferred ?? 0;
+    if (needsDerivedTextRewalk && filesResult.textUnknown === 0 && (filesResult.restoresDeferred ?? 0) === 0) {
       state = { ...state, derived_text_version: DERIVED_TEXT_VERSION };
     }
     counters["files"] = {
@@ -45735,9 +47770,28 @@ async function runSync(workspaceSlug, deps = {}) {
       deleted: filesResult.deleted + filesResult.textDeleted
     };
     commitPending();
-    if (filesResult.lastCursor !== filesStartCursor) {
+    const filesWalkStart = filesResult.markRefused ? filesBaseCursor : filesStartCursor;
+    const filesWalkedFromCursor = filesWalkStart === filesBaseCursor || filesResult.permanentReplayComplete === true;
+    if (filesWalkedFromCursor && filesResult.lastCursor !== filesBaseCursor) {
       updateSyncCursor(slug, "files", filesResult.lastCursor);
     }
+    if (filesResult.markRefused) {
+      updateSyncHighWater(slug, "files", null);
+      out.warn("files: the stored high-water mark was refused; reading from the cursor instead.");
+    }
+    if (filesResult.highWater)
+      updateSyncHighWater(slug, "files", filesResult.highWater);
+    if (filesResult.permanentReplayComplete) {
+      updateSyncHighWater(slug, "files", null);
+      for (const item of filesResult.permanentRefreshes ?? []) {
+        clearFeedRefresh({
+          workspaceSlug: slug,
+          kind: "workspace_file",
+          logicalKey: item.logicalKey,
+          generation: item.generation
+        });
+      }
+    }
     const rulesResult = await pullWorkspaceRules({
       workspaceSlug: slug,
       baseUrl: entry2.api_base_url,
@@ -45916,7 +47970,7 @@ async function runSync(workspaceSlug, deps = {}) {
   const totalRefused = Object.values(counters).reduce((sum, c) => sum + (c.refused ?? 0), 0);
   if (totalWritten === 0 && totalDeleted === 0 && totalMoved === 0 && totalRefused === 0) {
     out.success("Already up to date.");
-    return { exitCode: 0, applied: 0 };
+    return { exitCode: 0, applied: 0, restoresDeferred };
   }
   const elapsed = ((now().getTime() - startedAt.getTime()) / 1000).toFixed(1);
   for (const [type, c] of Object.entries(counters)) {
@@ -45934,9 +47988,9 @@ async function runSync(workspaceSlug, deps = {}) {
     out.info(`  ${type}: ${parts.join(", ")}`);
   }
   out.success(`Done in ${elapsed}s.`);
-  return { exitCode: 0, applied: totalWritten + totalMoved + totalDeleted };
+  return { exitCode: 0, applied: totalWritten + totalMoved + totalDeleted, restoresDeferred };
 }
-function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = () => new Date, isFrozen, loggedTombstoneSkips) {
+function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = () => new Date, isFrozen, loggedTombstoneSkips, recentUnlinks) {
   if (isFrozen?.(strategy.type, row.id)) {
     return { state, action: "skipped" };
   }
@@ -45969,7 +48023,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
     if (!entry2) {
       let present2 = false;
       try {
-        present2 = existsSync8(entityFilePath(workspaceSlug, strategy.type, row.slug));
+        present2 = existsSync9(entityFilePath(workspaceSlug, strategy.type, row.slug));
       } catch (err) {
         if (!(err instanceof MirrorPathError))
           throw err;
@@ -46048,7 +48102,22 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
   const writeSlug = relocation.writeSlug;
   if (existingEntry && existingEntry.updated_at === live.updated_at && relocation.kind === "not_needed") {
     const path5 = entityFilePath(workspaceSlug, strategy.type, live.slug);
-    if (existsSync8(path5)) {
+    const present2 = existsSync9(path5);
+    if (!present2) {
+      const verdict = deferRestore(recentUnlinks, path5, live.updated_at, now().getTime());
+      if (verdict.defer) {
+        if (verdict.first) {
+          out.log(entityRestoreDeferredLine({
+            entityType: strategy.type,
+            slug: live.slug,
+            waitSeconds: RESTORE_DEFERRAL_MS / 1000
+          }));
+        }
+        return { state, action: "restore_deferred" };
+      }
+    }
+    if (present2) {
+      presentAgain(recentUnlinks, path5);
       if (strategy.type === "artists") {
         const artistLive = live;
         state = applyArtistMemoryOnPull({
@@ -46075,7 +48144,7 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
   if (!suppressor && existingEntry && existingEntry.updated_at !== live.updated_at && relocation.kind !== "moved") {
     let localRaw = null;
     try {
-      localRaw = readFileSync27(entityFilePath(workspaceSlug, strategy.type, writeSlug), "utf8");
+      localRaw = readFileSync29(entityFilePath(workspaceSlug, strategy.type, writeSlug), "utf8");
     } catch {
       localRaw = null;
     }
@@ -46095,6 +48164,38 @@ function applyRow(workspaceSlug, strategy, row, state, out, suppressor, now = ()
       }
     }
   }
+  if (!suppressor && !existingEntry) {
+    const target = entityFilePath(workspaceSlug, strategy.type, writeSlug);
+    let localRaw = null;
+    try {
+      localRaw = lstatSync6(target).isFile() ? readFileSync29(target, "utf8") : null;
+    } catch {
+      localRaw = null;
+    }
+    if (localRaw !== null) {
+      const hashStrategy = strategy;
+      const incomingHashes = computeMirrorHashes(hashStrategy, renderMirrorWithBodyPreserve(workspaceSlug, strategy, live, writeSlug));
+      let diverged = true;
+      try {
+        const localHashes = computeMirrorHashes(hashStrategy, localRaw);
+        diverged = localHashes.bodyHash !== incomingHashes.bodyHash || localHashes.frontmatterHash !== incomingHashes.frontmatterHash;
+      } catch {
+        diverged = true;
+      }
+      if (diverged) {
+        const stash = stashEntityConflictOnce({
+          workspaceSlug,
+          entityType: strategy.type,
+          entitySlug: live.slug,
+          timestamp: now(),
+          contents: localRaw,
+          side: "local"
+        });
+        const where = stash.reused ? `already stashed at` : `stashed it to`;
+        out.warn(`Conflict on ${strategy.type}/${live.slug} → the local file there was not tracked for ` + `the incoming row and differed from it; ${where} ${stash.path} (cloud-wins on boot).`);
+      }
+    }
+  }
   const content = writeMirrorWithBodyPreserve(workspaceSlug, strategy, live, suppressor, writeSlug);
   const hashes = computeMirrorHashes(strategy, content);
   let inode;
@@ -46233,7 +48334,7 @@ function backfillStateInodes(workspaceSlug, state, statFn = (p) => statSync18(p)
     return { state, changed: false };
   return { state: { ...state, entries: nextEntries }, changed: true };
 }
-function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync28(p, "utf8")) {
+function backfillBodyLengths(workspaceSlug, state, readFn = (p) => readFileSync30(p, "utf8")) {
   let changed = false;
   const nextEntries = {};
   for (const [entityType, bucket] of Object.entries(state.entries)) {
@@ -46264,7 +48365,7 @@ function makeWatchHandler(deps) {
     baseUrl,
     pat,
     spinner,
-    mutex,
+    mutex: mutex2,
     getState,
     applyState,
     fetchImpl,
@@ -46308,7 +48409,7 @@ function makeWatchHandler(deps) {
           output?.log(fileDeleteSuppressedLine({ path: relPath, reason: "pull_echo" }));
           return;
         }
-        if (existsSync9(absolutePath)) {
+        if (existsSync10(absolutePath)) {
           output?.log(fileDeleteSuppressedLine({ path: relPath, reason: "path_exists" }));
           return;
         }
@@ -46320,7 +48421,7 @@ function makeWatchHandler(deps) {
             return;
           }
         }
-        await mutex.run(`files:${relPath}`, async () => {
+        await mutex2.run(`files:${relPath}`, async () => {
           const base2 = getState();
           const result = await pushFilesDelete({
             workspaceSlug,
@@ -46374,7 +48475,7 @@ function makeWatchHandler(deps) {
         spinner.update(`Watching ${workspaceSlug} · ${watchingSummary(getState())}`);
         return;
       }
-      const bytes = readFileSync28(absolutePath);
+      const bytes = readFileSync30(absolutePath);
       const hash2 = sha256Bytes(bytes);
       if (suppressor?.shouldSuppressUpsert(absolutePath, {
         bodyHash: hash2,
@@ -46391,7 +48492,7 @@ function makeWatchHandler(deps) {
           return;
         }
       }
-      await mutex.run(`files:${relPath}`, async () => {
+      await mutex2.run(`files:${relPath}`, async () => {
         const base2 = getState();
         const result = await pushFilesUpsert({
           workspaceSlug,
@@ -46438,7 +48539,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46450,7 +48551,7 @@ function makeWatchHandler(deps) {
       }
     }
     try {
-      await mutex.run(WORKSPACE_RULES_MUTEX_KEY, async () => {
+      await mutex2.run(WORKSPACE_RULES_MUTEX_KEY, async () => {
         const base2 = getState();
         const result = await pushWorkspaceRules({
           workspaceSlug,
@@ -46477,7 +48578,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46489,7 +48590,7 @@ function makeWatchHandler(deps) {
       }
     }
     try {
-      await mutex.run(WORKSPACE_MEMORY_MUTEX_KEY, async () => {
+      await mutex2.run(WORKSPACE_MEMORY_MUTEX_KEY, async () => {
         const base2 = getState();
         const result = await pushWorkspaceMemory({
           workspaceSlug,
@@ -46516,7 +48617,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46528,7 +48629,7 @@ function makeWatchHandler(deps) {
       }
     }
     try {
-      await mutex.run(USER_MEMORY_MUTEX_KEY, async () => {
+      await mutex2.run(USER_MEMORY_MUTEX_KEY, async () => {
         const base2 = getState();
         const result = await pushUserMemory({
           workspaceSlug,
@@ -46555,7 +48656,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46567,7 +48668,7 @@ function makeWatchHandler(deps) {
       }
     }
     try {
-      await mutex.run(VOICE_MUTEX_KEY, async () => {
+      await mutex2.run(VOICE_MUTEX_KEY, async () => {
         const base2 = getState();
         const result = await pushVoice({
           workspaceSlug,
@@ -46594,7 +48695,7 @@ function makeWatchHandler(deps) {
     if (suppressor) {
       let raw = null;
       try {
-        raw = readFileSync28(absolutePath, "utf8");
+        raw = readFileSync30(absolutePath, "utf8");
       } catch {
         raw = null;
       }
@@ -46617,7 +48718,7 @@ function makeWatchHandler(deps) {
         now,
         output,
         suppressor,
-        mutex
+        mutex: mutex2
       });
       applyState(base2, result.state);
       reportArtistMemoryOutcome(spinner, workspaceSlug, result.state, result.outcome);
@@ -46640,7 +48741,7 @@ function makeWatchHandler(deps) {
           const strategy = getStrategy(classifiedFrom.entityType);
           let toRaw = null;
           try {
-            toRaw = readFileSync28(event.toPath, "utf8");
+            toRaw = readFileSync30(event.toPath, "utf8");
           } catch {
             toRaw = null;
           }
@@ -46667,7 +48768,7 @@ function makeWatchHandler(deps) {
           deps: {
             fetchImpl,
             now,
-            mutex,
+            mutex: mutex2,
             output,
             echo: suppressor ? { watcher: "live", suppressor } : undefined
           }
@@ -46709,7 +48810,7 @@ function makeWatchHandler(deps) {
         if (event.kind === "upsert") {
           try {
             ownEcho = suppressor?.shouldSuppressUpsert(absolutePath, {
-              bodyHash: stableHash(readFileSync28(absolutePath, "utf8")),
+              bodyHash: stableHash(readFileSync30(absolutePath, "utf8")),
               frontmatterHash: ""
             }) === true;
           } catch {
@@ -46764,7 +48865,7 @@ function makeWatchHandler(deps) {
           if (strategy) {
             let raw = null;
             try {
-              raw = readFileSync28(absolutePath, "utf8");
+              raw = readFileSync30(absolutePath, "utf8");
             } catch {
               raw = null;
             }
@@ -46774,7 +48875,7 @@ function makeWatchHandler(deps) {
           }
         }
       }
-      if (event.kind === "unlink" && existsSync9(absolutePath)) {
+      if (event.kind === "unlink" && existsSync10(absolutePath)) {
         output?.log(entityDeleteSuppressedLine({
           entityType: classified.entityType,
           slug: classified.entitySlug,
@@ -46813,7 +48914,7 @@ function makeWatchHandler(deps) {
         deps: {
           fetchImpl,
           now,
-          mutex,
+          mutex: mutex2,
           output,
           suppressor,
           echo: suppressor ? { watcher: "live", suppressor } : undefined
@@ -47235,7 +49336,7 @@ async function runStart(workspaceSlug, deps = {}) {
   }
   const spinner = (deps.spinnerFactory ?? (() => createSpinner({ noColor: deps.noColor })))();
   spinner.start(`Watching ${slug} · ${watchingSummary(state)}`);
-  const mutex = new PerIdMutex;
+  const mutex2 = new PerIdMutex;
   const bootDrain = await drainResolvedBatches({
     echo: { watcher: "none" },
     workspaceSlug: slug,
@@ -47247,7 +49348,7 @@ async function runStart(workspaceSlug, deps = {}) {
     },
     fetchImpl,
     now: deps.now,
-    mutex,
+    mutex: mutex2,
     output: out
   });
   if (bootDrain.applied > 0 || bootDrain.discarded > 0) {
@@ -47265,7 +49366,7 @@ async function runStart(workspaceSlug, deps = {}) {
     },
     fetchImpl,
     now: deps.now,
-    mutex,
+    mutex: mutex2,
     output: out
   });
   if (bootUnsynced.attempted > 0) {
@@ -47317,7 +49418,7 @@ async function runStart(workspaceSlug, deps = {}) {
     applyState: (base2, next) => {
       state = rebaseState(state, base2, next);
     },
-    mutex,
+    mutex: mutex2,
     fetchImpl,
     now: deps.now,
     output: out,
@@ -47381,7 +49482,7 @@ async function runStart(workspaceSlug, deps = {}) {
     applyState: (base2, next) => {
       state = rebaseState(state, base2, next);
     },
-    mutex,
+    mutex: mutex2,
     fetchImpl,
     now: deps.now,
     output: out,
@@ -47433,7 +49534,7 @@ async function runStart(workspaceSlug, deps = {}) {
     baseUrl: entry2.api_base_url,
     pat,
     spinner,
-    mutex,
+    mutex: mutex2,
     getState: () => state,
     applyState: (base2, next) => {
       state = rebaseState(state, base2, next);
@@ -47453,13 +49554,18 @@ async function runStart(workspaceSlug, deps = {}) {
     return { exitCode: 0 };
   }
   writeDaemonPid(slug, process.pid, (deps.now ?? (() => new Date))());
-  const watcher = startWatcher({ workspaceSlug: slug, getStateEntry, classifyPath }, handler);
+  const ambient = createAmbientPollWiring({
+    now: () => (deps.now?.() ?? new Date).getTime(),
+    baseReadIntervalMs: baseReadIntervalMs()
+  });
+  const watcher = startWatcher({ workspaceSlug: slug, getStateEntry, classifyPath, onUnlink: ambient.onUnlink }, handler);
   const quietSink = discardSink();
   let draining = false;
   let lastHeartbeatMs = 0;
   const pullLoop = new PullLoop({
     runOnce: async () => {
-      const result = await runSync(slug, {
+      const result = await ambient.poll((sc2) => runSync(slug, {
+        ...sc2,
         fetchImpl,
         keychain,
         now: deps.now,
@@ -47471,7 +49577,7 @@ async function runStart(workspaceSlug, deps = {}) {
         isFileFrozen,
         loggedTombstoneSkips,
         loggedStashNotices
-      });
+      }));
       if (result.exitCode === 0) {
         const applied = result.applied ?? 0;
         if (applied > 0) {
@@ -47497,7 +49603,7 @@ async function runStart(workspaceSlug, deps = {}) {
       workspaceSlug: slug,
       baseUrl: entry2.api_base_url,
       pat,
-      mutex,
+      mutex: mutex2,
       commitState,
       getState: () => state,
       setState: setDaemonState,
@@ -47525,7 +49631,7 @@ async function runStart(workspaceSlug, deps = {}) {
             },
             fetchImpl,
             now: deps.now,
-            mutex,
+            mutex: mutex2,
             output: out
           });
           if (drained.applied > 0 || drained.discarded > 0) {
@@ -47543,7 +49649,7 @@ async function runStart(workspaceSlug, deps = {}) {
             },
             fetchImpl,
             now: deps.now,
-            mutex,
+            mutex: mutex2,
             output: out
           });
           if (redriven.resolved > 0) {
@@ -47555,7 +49661,7 @@ async function runStart(workspaceSlug, deps = {}) {
             spinner.update(`Watching ${slug} · ${watchingSummary(state)}`);
           }
           let rulesBase = state;
-          const rulesRecon = await mutex.run(WORKSPACE_RULES_MUTEX_KEY, () => {
+          const rulesRecon = await mutex2.run(WORKSPACE_RULES_MUTEX_KEY, () => {
             rulesBase = state;
             return reconcileWorkspaceRules({
               workspaceSlug: slug,
@@ -47571,7 +49677,7 @@ async function runStart(workspaceSlug, deps = {}) {
           state = rebaseState(state, rulesBase, rulesRecon.state);
           reportSingletonReconcile(spinner, slug, state, WORKSPACE_RULES_FILENAME, rulesRecon.outcome);
           let memoryBase = state;
-          const memoryRecon = await mutex.run(WORKSPACE_MEMORY_MUTEX_KEY, () => {
+          const memoryRecon = await mutex2.run(WORKSPACE_MEMORY_MUTEX_KEY, () => {
             memoryBase = state;
             return reconcileWorkspaceMemory({
               workspaceSlug: slug,
@@ -47587,7 +49693,7 @@ async function runStart(workspaceSlug, deps = {}) {
           state = rebaseState(state, memoryBase, memoryRecon.state);
           reportSingletonReconcile(spinner, slug, state, WORKSPACE_MEMORY_FILENAME, memoryRecon.outcome);
           let userMemoryBase = state;
-          const userMemoryRecon = await mutex.run(USER_MEMORY_MUTEX_KEY, () => {
+          const userMemoryRecon = await mutex2.run(USER_MEMORY_MUTEX_KEY, () => {
             userMemoryBase = state;
             return reconcileUserMemory({
               workspaceSlug: slug,
@@ -47604,7 +49710,7 @@ async function runStart(workspaceSlug, deps = {}) {
           reportSingletonReconcile(spinner, slug, state, USER_MEMORY_FILENAME, userMemoryRecon.outcome);
           try {
             let voiceBase = state;
-            const voiceRecon = await mutex.run(VOICE_MUTEX_KEY, () => {
+            const voiceRecon = await mutex2.run(VOICE_MUTEX_KEY, () => {
               voiceBase = state;
               return reconcileVoice({
                 workspaceSlug: slug,
@@ -47635,7 +49741,7 @@ async function runStart(workspaceSlug, deps = {}) {
             now: deps.now,
             output: out,
             suppressor,
-            mutex
+            mutex: mutex2
           });
           state = rebaseState(state, memBase, memRecon.state);
           if (memRecon.pushed > 0) {
@@ -48291,12 +50397,12 @@ function assessContextWalls(workspaceSlug, deps = {}) {
 
 // src/lib/build-stamp.ts
 import { execFileSync as execFileSync4 } from "node:child_process";
-import { existsSync as existsSync10, mkdirSync as mkdirSync11, readFileSync as readFileSync29, writeFileSync as writeFileSync8 } from "node:fs";
-import { dirname as dirname13, join as join18 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync12, readFileSync as readFileSync31, writeFileSync as writeFileSync8 } from "node:fs";
+import { dirname as dirname14, join as join19 } from "node:path";
 import { fileURLToPath } from "node:url";
 var BUILD_STAMP_FILENAME = "build-stamp.json";
 function stampPath(distDir) {
-  return join18(distDir, BUILD_STAMP_FILENAME);
+  return join19(distDir, BUILD_STAMP_FILENAME);
 }
 function readHead(repoDir) {
   try {
@@ -48315,7 +50421,7 @@ function readHead(repoDir) {
 }
 function readBuildStamp(distDir) {
   try {
-    const parsed = JSON.parse(readFileSync29(stampPath(distDir), "utf8"));
+    const parsed = JSON.parse(readFileSync31(stampPath(distDir), "utf8"));
     if (parsed && typeof parsed.sha === "string" && parsed.sha.length > 0 && typeof parsed.dirty === "boolean" && typeof parsed.built_at === "string") {
       return { sha: parsed.sha, dirty: parsed.dirty, built_at: parsed.built_at };
     }
@@ -48327,9 +50433,9 @@ function readBuildStamp(distDir) {
 function findRepoRoot(fromDir) {
   let dir = fromDir;
   for (;; ) {
-    if (existsSync10(join18(dir, ".git")))
+    if (existsSync11(join19(dir, ".git")))
       return dir;
-    const parent = dirname13(dir);
+    const parent = dirname14(dir);
     if (parent === dir)
       return null;
     dir = parent;
@@ -48353,7 +50459,7 @@ function checkBuildStaleness(deps = {}) {
   const metaUrl = deps.metaUrl ?? import.meta.url;
   let distDir;
   try {
-    distDir = dirname13(fileURLToPath(metaUrl));
+    distDir = dirname14(fileURLToPath(metaUrl));
   } catch {
     return { kind: "unknown" };
   }
@@ -48376,12 +50482,12 @@ function checkBuildStaleness(deps = {}) {
 }
 
 // src/lib/memory-links.ts
-import { readFileSync as readFileSync30 } from "node:fs";
+import { readFileSync as readFileSync32 } from "node:fs";
 import { relative as relative15, sep as sep8 } from "node:path";
 var MEMORY_FILE_RE = /^(workspace-memory\.md|user-memory\.md|artists\/[^/]+\/memory\.md|memory\/[^/]+\.md|memory\/private\/[^/]+\.md)$/i;
 function scanMemoryLinks(deps) {
   const listFiles = deps.listFiles ?? ((r) => walkSubtreeFiles(r, isVcsInternal));
-  const readFile = deps.readFile ?? ((p) => readFileSync30(p, "utf8"));
+  const readFile = deps.readFile ?? ((p) => readFileSync32(p, "utf8"));
   let root;
   let absPaths;
   try {
@@ -48425,7 +50531,7 @@ function scanMemoryLinks(deps) {
 init_output();
 
 // src/lib/pending-writes.ts
-import { readFileSync as readFileSync31, statSync as statSync19 } from "node:fs";
+import { readFileSync as readFileSync33, statSync as statSync19 } from "node:fs";
 import { relative as relative16 } from "node:path";
 var import_gray_matter15 = __toESM(require_gray_matter(), 1);
 var EMPTY3 = { writes: [], count: 0 };
@@ -48473,7 +50579,7 @@ function scanPendingWrites(args) {
         continue;
       let hash2;
       try {
-        hash2 = sha256Bytes(readFileSync31(absolutePath));
+        hash2 = sha256Bytes(readFileSync33(absolutePath));
       } catch {
         continue;
       }
@@ -48504,7 +50610,7 @@ function scanPendingWrites(args) {
       continue;
     let content;
     try {
-      content = readFileSync31(absolutePath, "utf8");
+      content = readFileSync33(absolutePath, "utf8");
     } catch {
       continue;
     }
@@ -48834,6 +50940,33 @@ async function runStatus(args, deps = {}) {
     }
   }
   out.info("");
+  let deletionJournal = null;
+  let deletionJournalError = null;
+  try {
+    deletionJournal = loadPermanentDeletionJournal(slug);
+  } catch (error52) {
+    deletionJournalError = error52 instanceof Error ? error52.message : String(error52);
+  }
+  if (deletionJournalError) {
+    out.info(row("Deletion", "BLOCKED — permanent deletion journal needs recovery."));
+    out.info(cont(`${permanentDeletionJournalPath(slug)}: ${deletionJournalError}`));
+  } else {
+    const pending2 = deletionJournal.records.filter((record2) => record2.disposition === "pending");
+    const refresh = deletionJournal.refresh;
+    const operations = deletionJournal.records.filter((record2) => record2.operation?.state === "pending" || record2.operation?.state === "transport_unknown");
+    if (pending2.length === 0 && refresh.length === 0 && operations.length === 0) {
+      out.info(row("Deletion", "No permanent deletion reconciliation pending."));
+    } else {
+      out.info(row("Deletion", `${pending2.length} disposition${pending2.length === 1 ? "" : "s"} pending; ` + `${refresh.length} feed refresh${refresh.length === 1 ? "" : "es"} required; ` + `${operations.length} create operation${operations.length === 1 ? "" : "s"} unresolved.`));
+      for (const marker of refresh.slice(0, 5)) {
+        out.info(cont(`${marker.kind}:${marker.logical_key} — ${marker.state}` + (marker.retry_after ? `, retry after ${marker.retry_after}` : "")));
+      }
+      for (const record2 of operations.slice(0, 5)) {
+        out.info(cont(`${record2.kind}:${record2.logical_key} — create ${record2.operation.state}`));
+      }
+    }
+  }
+  out.info("");
   const held = listPendingBatches(slug).filter((b) => b.status === "pending");
   if (held.length === 0) {
     out.info(row("Pending", "No destructive batches held."));
@@ -49388,7 +51521,7 @@ var versionCommand = defineCommand({
 });
 
 // src/commands/voice-gate.ts
-import { readFileSync as readFileSync34 } from "node:fs";
+import { readFileSync as readFileSync36 } from "node:fs";
 
 // src/lib/voice-gate/api.ts
 var VoiceGateSurfaces = [
@@ -49490,15 +51623,15 @@ async function callVoiceGate(req) {
 }
 
 // src/lib/voice-gate/attempts.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import {
-  mkdirSync as mkdirSync12,
-  readFileSync as readFileSync32,
-  renameSync as renameSync8,
-  unlinkSync as unlinkSync9,
+  mkdirSync as mkdirSync13,
+  readFileSync as readFileSync34,
+  renameSync as renameSync9,
+  unlinkSync as unlinkSync10,
   writeFileSync as writeFileSync9
 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 var MAX_REGENS = 2;
 var ENTRY_TTL_MS = 24 * 60 * 60 * 1000;
 var AttemptEntrySchema = exports_external.object({
@@ -49511,20 +51644,20 @@ var AttemptsFileSchema = exports_external.object({
   entries: exports_external.record(exports_external.string(), AttemptEntrySchema)
 });
 function attemptsDir(workspaceSlug) {
-  return join19(plinthHome(), "_voice_gate", workspaceSlug);
+  return join20(plinthHome(), "_voice_gate", workspaceSlug);
 }
 function attemptsPath(workspaceSlug) {
-  return join19(attemptsDir(workspaceSlug), "attempts.json");
+  return join20(attemptsDir(workspaceSlug), "attempts.json");
 }
 function attemptKey(identity) {
-  return createHash5("sha256").update(identity, "utf8").digest("hex").slice(0, 32);
+  return createHash7("sha256").update(identity, "utf8").digest("hex").slice(0, 32);
 }
 function emptyFile() {
   return { version: 1, entries: {} };
 }
 function load2(workspaceSlug) {
   try {
-    const raw = readFileSync32(attemptsPath(workspaceSlug), "utf8");
+    const raw = readFileSync34(attemptsPath(workspaceSlug), "utf8");
     const parsed = AttemptsFileSchema.safeParse(JSON.parse(raw));
     return parsed.success ? parsed.data : emptyFile();
   } catch {
@@ -49544,14 +51677,14 @@ function save(workspaceSlug, file2) {
   const dir = attemptsDir(workspaceSlug);
   const target = attemptsPath(workspaceSlug);
   const tmp = `${target}.${process.pid}.${tmpCounter2++}.tmp`;
-  mkdirSync12(dir, { recursive: true, mode: 448 });
+  mkdirSync13(dir, { recursive: true, mode: 448 });
   writeFileSync9(tmp, `${JSON.stringify(file2, null, 2)}
 `, { mode: 384 });
   try {
-    renameSync8(tmp, target);
+    renameSync9(tmp, target);
   } catch (err) {
     try {
-      unlinkSync9(tmp);
+      unlinkSync10(tmp);
     } catch {}
     throw err;
   }
@@ -49687,7 +51820,7 @@ function denyUngated(detail) {
 }
 
 // src/lib/voice-gate/payload.ts
-import { readFileSync as readFileSync33, statSync as statSync21 } from "node:fs";
+import { readFileSync as readFileSync35, statSync as statSync21 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import { isAbsolute as isAbsolute4, resolve as resolve6 } from "node:path";
 var MAX_BODY_BYTES = 256 * 1024;
@@ -49848,7 +51981,7 @@ function defaultReadBodyFile(path5) {
   if (stat4.size > MAX_BODY_BYTES) {
     throw new Error(`draft body is ${stat4.size} bytes, over the ${MAX_BODY_BYTES}-byte gate limit`);
   }
-  return readFileSync33(path5, "utf8");
+  return readFileSync35(path5, "utf8");
 }
 function parseRecipients(...raw) {
   const all = raw.filter((v) => typeof v === "string").flatMap((v) => v.split(",")).map((v) => v.trim().toLowerCase()).filter((v) => v.length > 0);
@@ -50208,7 +52341,7 @@ async function runVoiceGateDirect(args, deps = {}) {
   let text;
   if (args.file) {
     try {
-      text = readFileSync34(args.file, "utf8");
+      text = readFileSync36(args.file, "utf8");
     } catch (err) {
       const msg = err instanceof Error ? err.message : "unknown error";
       out.error(`Could not read ${args.file}: ${msg}`);