@powerhousedao/reactor 6.2.3-dev.33 → 6.2.3-dev.35

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { Action, ActionSigner, AuthRequest, AuthSubject, CreateDocumentActionInput, DocumentModelModule, HoldReason, ISigner, Operation, OperationContext, OperationOutcome, OperationWithContext, OperationWithContext as OperationWithContext$1, PHAuthState, PHDocument, PHDocumentState, PeerCapability, PeerCapabilityFlags, PeerManifest, ProtocolVersions, SignaturePolicy, SignatureVerificationHandler, Supports, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions } from "@powerhousedao/shared/document-model";
+import { Action, ActionSigner, AuthRequest, AuthSubject, CreateDocumentActionInput, DocumentModelModule, HoldReason, ISigner, Operation, OperationContext, OperationContext as OperationContext$1, OperationOutcome, OperationWithContext, OperationWithContext as OperationWithContext$1, PHAuthState, PHDocument, PHDocumentState, PURGE_DOCUMENT, PeerCapability, PeerCapabilityFlags, PeerManifest, ProtocolVersions, PurgeDocumentAction, PurgeDocumentActionInput, PurgeMarkerOperation, SignaturePolicy, SignatureVerificationHandler, Supports, UpgradeDocumentActionInput, UpgradeManifest, UpgradeReducer, UpgradeTransition, actions as documentActions, isPurgeMarker } from "@powerhousedao/shared/document-model";
 import { DocumentDriveDocument, DriveInput, FolderNode, Node } from "@powerhousedao/shared/document-drive";
 import { ILogger } from "document-model";
-import { ColumnType, Generated, Insertable, Kysely, Transaction } from "kysely";
+import { ColumnType, Generated, Insertable, Kysely, Selectable, Transaction } from "kysely";
 import { IProcessor, IProcessorHostModuleBase, IProcessorHostModuleBase as IProcessorHostModuleBase$1, IProcessorManager, IProcessorManager as IProcessorManager$1, IRelationalDb, ProcessorApp, ProcessorFactory, ProcessorFactory as ProcessorFactory$1, ProcessorFactoryBuilder, ProcessorFilter, ProcessorRecord, ProcessorRecord as ProcessorRecord$1, ProcessorStatus, RelationalDbProcessor, TrackedProcessor, TrackedProcessor as TrackedProcessor$1, createRelationalDb } from "@powerhousedao/shared/processors";
 import "node:worker_threads";
 import { Pool } from "pg";
@@ -55,106 +55,73 @@ export declare function updateRelationshipAction(sourceId: string, targetId: str
  */
 export declare function removeRelationshipAction(sourceId: string, targetId: string, relationshipType?: string): Action;
 //#endregion
-//#region src/queue/types.d.ts
-/**
- * What a job carries: a mutation applies actions, a load imports synced
- * operations, and a reevaluation re-judges a document's stored operations
- * because a read-set stream elsewhere (a group document) changed. A
- * reevaluation job carries no actions or operations; its work is derived
- * from what is already stored.
- */
-type JobKind = "mutation" | "load" | "reevaluation";
-/**
- * State of a job in the queue
- */
-declare enum JobQueueState {
-  UNKNOWN = -1,
-  PREPROCESSING = 0,
-  PENDING = 1,
-  READY = 2,
-  RUNNING = 3,
-  RESOLVED = 4
-}
-/**
- * How a retry is accounted against the job's retry limit.
- * - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
- *   retries and fails terminally.
- * - `ExemptFromLimit`: not a fault, so the attempt is not charged to the job.
- *   Used for concurrency conflicts, where the retry does new work.
- */
-export declare enum RetryAccounting {
-  CountAgainstLimit = "count-against-limit",
-  ExemptFromLimit = "exempt-from-limit"
-}
-/**
- * Interface for a job execution handle
- */
-interface IJobExecutionHandle {
-  readonly job: Job;
-  readonly state: JobQueueState;
-  start(): void;
-  complete(): void;
-  fail(error: ErrorInfo$1): void;
-  defer(): void;
+//#region src/catch-up/types.d.ts
+type WatermarkStatus = {
+  head: number;
+  settledThrough: number;
+  waitingOn: string[];
+  stalledSinceUtcMs?: number;
+};
+interface ISettledWatermark {
+  /** Every ordinal at or below this is visible or will never exist. */
+  readonly settledThrough: number;
+  /** Probes, coalesced with one in flight; resolves with settledThrough. */
+  refresh(signal?: AbortSignal): Promise<number>;
+  onAdvance(listener: (settledThrough: number) => void): Unsubscribe;
+  status(): WatermarkStatus;
 }
-/**
- * Represents a job to be executed by the job executor
- */
-type Job = {
-  /** Unique identifier for the job */
-  id: string;
-  /** Classification of the job so executors can switch behavior */
-  kind: JobKind;
-  /** The document ID this job operates on */
+type SweepBlockedAt = {
+  ordinal: number;
   documentId: string;
-  /** The scope of the operations */
   scope: string;
-  /** The branch of the operations */
   branch: string;
-  /** The actions to be executed (processed sequentially) */
-  actions: Action[];
-  /** Pre-existing operations to import (used for load jobs) */
-  operations: Operation[];
-  /** Timestamp when the job was created */
-  createdAt: string;
-  /** The hint for the queue to use for ordering the job */
-  queueHint: string[];
-  /** Number of retry attempts */
-  retryCount?: number;
-  /** Maximum number of retries allowed */
-  maxRetries?: number;
-  /** Last error if job failed */
-  lastError?: ErrorInfo$1;
-  /** History of all errors from each attempt (ordered) */
-  errorHistory: ErrorInfo$1[];
-  /** Metadata that flows through the job lifecycle */
-  meta: JobMeta;
+  type: string;
+  error: string;
 };
-/**
- * Event types for the queue system
- */
-export declare const QueueEventTypes: {
-  readonly JOB_AVAILABLE: 10000;
+type SweepResult = {
+  consumerId: string;
+  from: number;
+  to: number;
+  durationMs: number;
+  /** Late operations applied. */
+  replayed: number;
+  /** Later operations of their streams applied again. */
+  reapplied: number;
+  blockedAt?: SweepBlockedAt;
 };
-/**
- * Minimal projection of a Job used by IQueue.dequeueNextMatching predicates.
- * Exposes only the routing-relevant fields so routing logic (e.g. hash(documentId) % numWorkers)
- * can live outside the queue without leaking the full Job.
- */
-type JobRoutingMeta = {
-  documentId: string;
-  scope: string;
-  branch: string;
+interface ICatchUpConsumer {
+  readonly consumerId: string;
+  readonly appliedThrough: number;
+  /** Ordinals above the cursor this consumer holds in memory. */
+  readonly trackedAbove: number;
+  sweep(settledThrough: number, present: readonly number[], signal?: AbortSignal): Promise<SweepResult>;
+}
+type CatchUpThread = "host" | "projection";
+type CatchUpConsumerStatus = {
+  consumerId: string;
+  thread: CatchUpThread;
+  appliedThrough: number;
+  trackedAbove: number;
+  blockedAt?: SweepBlockedAt;
+  lastAdvanceUtcMs: number;
 };
-/**
- * Event data for job available events
- */
-type JobAvailableEvent = {
-  documentId: string;
-  scope: string;
-  branch: string;
-  jobId: string;
+type CatchUpStatus = {
+  watermark: WatermarkStatus;
+  consumers: CatchUpConsumerStatus[];
 };
+type CatchUpConfig = {
+  intervalMs: number;
+  stuckWarnMs: number;
+  maxTrackedAboveCursor: number;
+  /** Present ordinals read per tick. */
+  sweepPageSize: number;
+};
+export declare const defaultCatchUpConfig: CatchUpConfig;
+/** The catch-up surface a reactor module exposes. */
+interface ICatchUp {
+  status(): CatchUpStatus;
+  sweepNow(): Promise<SweepResult[]>;
+}
 //#endregion
 //#region src/shared/types.d.ts
 /**
@@ -168,6 +135,8 @@ type ErrorInfo$1 = {
   name: string;
   message: string;
   stack: string;
+  /** The document the error names, when it carries one. */
+  documentId?: string;
 };
 /**
  * Describes the status of a shutdown operation.
@@ -352,6 +321,117 @@ type ConsistencyToken = {
   coordinates: ConsistencyCoordinate[];
 };
 //#endregion
+//#region src/queue/types.d.ts
+/**
+ * What a job carries: a mutation applies actions, a load imports synced
+ * operations, and a reevaluation re-judges a document's stored operations
+ * because a read-set stream elsewhere (a group document) changed. A
+ * reevaluation job carries no actions or operations; its work is derived
+ * from what is already stored. A purge job erases a deleted document and
+ * writes its PURGE_DOCUMENT marker; only DocumentPurgeService enqueues one.
+ */
+type JobKind = "mutation" | "load" | "reevaluation" | "purge";
+/** What a purge job carries beyond its document id. */
+type PurgeJobOptions = {
+  /** The erasure request that ordered the purge; the marker's requestId. */
+  requestId: string;
+  /** Lifts the maxPurgeOperations cap for this document. */
+  allowLarge: boolean;
+};
+/**
+ * State of a job in the queue
+ */
+declare enum JobQueueState {
+  UNKNOWN = -1,
+  PREPROCESSING = 0,
+  PENDING = 1,
+  READY = 2,
+  RUNNING = 3,
+  RESOLVED = 4
+}
+/**
+ * How a retry is accounted against the job's retry limit.
+ * - `CountAgainstLimit` (default): a fault; the job eventually exhausts its
+ *   retries and fails terminally.
+ * - `ExemptFromLimit`: not a fault, so the attempt is not charged to the job.
+ *   Used for concurrency conflicts, where the retry does new work.
+ */
+export declare enum RetryAccounting {
+  CountAgainstLimit = "count-against-limit",
+  ExemptFromLimit = "exempt-from-limit"
+}
+/**
+ * Interface for a job execution handle
+ */
+interface IJobExecutionHandle {
+  readonly job: Job;
+  readonly state: JobQueueState;
+  start(): void;
+  complete(): void;
+  fail(error: ErrorInfo$1): void;
+  defer(): void;
+}
+/**
+ * Represents a job to be executed by the job executor
+ */
+type Job = {
+  /** Unique identifier for the job */
+  id: string;
+  /** Classification of the job so executors can switch behavior */
+  kind: JobKind;
+  /** The document ID this job operates on */
+  documentId: string;
+  /** The scope of the operations */
+  scope: string;
+  /** The branch of the operations */
+  branch: string;
+  /** The actions to be executed (processed sequentially) */
+  actions: Action[];
+  /** Pre-existing operations to import (used for load jobs) */
+  operations: Operation[];
+  /** Timestamp when the job was created */
+  createdAt: string;
+  /** The hint for the queue to use for ordering the job */
+  queueHint: string[];
+  /** Number of retry attempts */
+  retryCount?: number;
+  /** Maximum number of retries allowed */
+  maxRetries?: number;
+  /** Last error if job failed */
+  lastError?: ErrorInfo$1;
+  /** History of all errors from each attempt (ordered) */
+  errorHistory: ErrorInfo$1[];
+  /** Metadata that flows through the job lifecycle */
+  meta: JobMeta;
+  /** Set on a purge job only. */
+  purge?: PurgeJobOptions;
+};
+/**
+ * Event types for the queue system
+ */
+export declare const QueueEventTypes: {
+  readonly JOB_AVAILABLE: 10000;
+};
+/**
+ * Minimal projection of a Job used by IQueue.dequeueNextMatching predicates.
+ * Exposes only the routing-relevant fields so routing logic (e.g. hash(documentId) % numWorkers)
+ * can live outside the queue without leaking the full Job.
+ */
+type JobRoutingMeta = {
+  documentId: string;
+  scope: string;
+  branch: string;
+};
+/**
+ * Event data for job available events
+ */
+type JobAvailableEvent = {
+  documentId: string;
+  scope: string;
+  branch: string;
+  jobId: string;
+};
+//#endregion
 //#region src/read-models/interfaces.d.ts
 /**
  * Generic interface for any read model that can index operations.
@@ -512,6 +592,14 @@ type SyncOperationErrorType = "SIGNATURE_INVALID" | "HASH_MISMATCH" | "LIBRARY_E
 "PEER_PROTOCOL_UNSUPPORTED" |
 /** An arriving operation carried a timestamp that is not an ISO-8601 instant. */
 "INVALID_TIMESTAMP" |
+/** The document was purged here; its operations are dropped, not kept. */
+"DOCUMENT_PURGED" |
+/** A purge's precondition failed; the document itself is unaffected. */
+"PURGE_PRECONDITION" |
+/** A peer sent a reserved action type as a regular write. */
+"RESERVED_ACTION" |
+/** A peer's purge marker was refused; the document keeps syncing. */
+"MARKER_REFUSED" |
 /** No classification applies, including rows written before the field. */
 "UNCLASSIFIED";
 type ChannelHealth = {
@@ -560,6 +648,12 @@ type LocalPeer = {
   protocolVersionsOf?: (documentId: string, branch: string) => Promise<{
     [protocol: string]: number;
   } | undefined>;
+  /** Drops a purged document from the host cache behind protocolVersionsOf. */
+  forgetDocument?: (documentId: string) => void;
+};
+/** The tombstone index, as the sync manager reads it at startup. */
+type PurgeLookup = {
+  listPurged(): Promise<string[]>;
 };
 /** What the peer announced, and when; a null manifest is a silent peer. */
 type RemotePeer = {
@@ -590,6 +684,7 @@ export declare const SyncEventTypes: {
   readonly CONNECTION_STATE_CHANGED: 20005;
   readonly SYNC_HELD: 20006;
   readonly SYNC_RELEASED: 20007;
+  readonly PURGE_REFUSED: 20008;
 };
 /** A document held back from one remote because its peer cannot run it. */
 type SyncHold = {
@@ -605,6 +700,13 @@ type SyncHeldEvent = {
   branch: string;
   reason: HoldReason;
 };
+/** A remote reported it could not apply a purged document's marker. */
+type SyncPurgeRefusedEvent = {
+  remoteName: string;
+  documentId: string;
+  branch: string;
+  errorMessage: string;
+};
 type SyncReleasedEvent = {
   remoteName: string;
   documentId: string;
@@ -1018,6 +1120,7 @@ interface IDocumentView extends IReadModel {
    * @param view - Optional filter containing branch and scopes information
    * @param consistencyToken - Optional token for read-after-write consistency
    * @param signal - Optional abort signal to cancel the request
+   * @throws {DocumentNotFoundError} If the view does not hold the document
    */
   get<TDocument extends PHDocument>(documentId: string, view?: ViewFilter$1, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
   /**
@@ -1037,6 +1140,7 @@ interface IDocumentView extends IReadModel {
    * @param view - Optional filter containing branch and scopes information
    * @param consistencyToken - Optional token for read-after-write consistency
    * @param signal - Optional abort signal to cancel the request
+   * @throws {DocumentNotFoundError} If neither an id nor a slug matches
    * @throws {Error} If identifier matches both an ID and slug referring to different documents
    */
   getByIdOrSlug<TDocument extends PHDocument>(identifier: string, view?: ViewFilter$1, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
@@ -1080,7 +1184,8 @@ interface IDocumentView extends IReadModel {
    * @param consistencyToken - Optional token for read-after-write consistency
    * @param signal - Optional abort signal to cancel the request
    * @returns The document ID
-   * @throws {Error} If document not found or identifier matches both an ID and slug referring to different documents
+   * @throws {DocumentNotFoundError} If neither an id nor a slug matches
+   * @throws {Error} If identifier matches both an ID and slug referring to different documents
    */
   resolveIdOrSlug(identifier: string, view?: ViewFilter$1, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<string>;
 }
@@ -1238,10 +1343,41 @@ interface ISyncHoldStorage {
     remoteName?: string;
     documentId?: string;
   }): Promise<SyncHoldRecord[]>;
+  /** Throws DocumentPurgedError for a purged id, except for its marker's hold. */
   upsert(hold: SyncHoldRecord): Promise<void>;
   remove(remoteName: string, documentId: string, branch: string): Promise<void>;
   removeRemote(remoteName: string): Promise<void>;
 }
+/** A purge marker received from a remote, kept until its outcome. */
+type ReceivedMarkerRecord = {
+  remoteName: string;
+  /** The marker operation's id. */
+  markerId: string;
+  documentId: string;
+  branch: string;
+  operation: OperationWithContext$1;
+  receivedAtUtcMs: number;
+};
+/** Received markers that survive a restart, so the inbox ack stays below them. */
+interface ISyncReceivedMarkerStorage {
+  list(remoteName: string): Promise<ReceivedMarkerRecord[]>;
+  upsert(record: ReceivedMarkerRecord): Promise<void>;
+  remove(remoteName: string, markerId: string): Promise<void>;
+  removeRemote(remoteName: string): Promise<void>;
+}
+/** A remote's refusal of a purge marker; no message, which may name a signer. */
+type PurgeRefusalRecord = {
+  remoteName: string;
+  documentId: string;
+  branch: string;
+  refusedAtUtcMs: number;
+};
+/** Marker refusals, kept after the remote goes so the erasure can report them. */
+interface ISyncPurgeRefusalStorage {
+  list(documentId: string): Promise<PurgeRefusalRecord[]>;
+  /** One statement; the first time per remote, document and branch is kept. */
+  record(refusals: readonly PurgeRefusalRecord[]): Promise<void>;
+}
 /**
  * Persistent storage for sync remote configurations. Each remote represents
  * a connection to an external system that operations can be synced with.
@@ -1349,7 +1485,8 @@ interface ISyncDeadLetterStorage {
    */
   list(remoteName: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DeadLetterRecord>>;
   /**
-   * Adds a dead letter. Duplicate ids are silently ignored.
+   * Adds a dead letter. Duplicate ids are silently ignored. Throws
+   * DocumentPurgedError, persisting nothing, when the document is purged.
    *
    * @param deadLetter - The dead letter record to persist
    * @param signal - Optional abort signal to cancel the request
@@ -1495,12 +1632,14 @@ interface IOperationIndex {
    * reference other groups.
    */
   getGroupReferencers(groupId: string, signal?: AbortSignal): Promise<string[]>;
+  /** Collections with a member with a row in (after, through], within `among`. */
+  getCollectionsInRange(after: number, through: number, among?: readonly string[], signal?: AbortSignal): Promise<string[]>;
   /** Ordinals in (after, through], ascending, at most `limit`. */
   getOrdinalsInRange(after: number, through: number, limit: number, signal?: AbortSignal): Promise<number[]>;
   /** Rows for these ordinals, ascending; a missing row is left out. */
   getByOrdinals(ordinals: readonly number[], signal?: AbortSignal): Promise<OperationWithContext$1[]>;
-  /** A stream's rows above an ordinal, ascending. */
-  getStreamAfter(stream: DocumentStreamKey, after: number, signal?: AbortSignal): Promise<OperationWithContext$1[]>;
+  /** A stream's rows above an ordinal, ascending, at most `limit` if given. */
+  getStreamAfter(stream: DocumentStreamKey, after: number, signal?: AbortSignal, limit?: number): Promise<OperationWithContext$1[]>;
   /** The latest ordinal of each of `opIds` indexed in one stream. */
   getOrdinalsByOpIds(documentId: string, scope: string, branch: string, opIds: string[], signal?: AbortSignal): Promise<Map<string, number>>;
 }
@@ -1531,125 +1670,6 @@ export declare class DriveCollectionId {
   equals(other: DriveCollectionId): boolean;
 }
 //#endregion
-//#region src/cache/write/interfaces.d.ts
-/**
- * IWriteCache is a write-side projection that optimizes document state retrieval
- * for the job executor. This is separate from IDocumentView (read-side projection) which optimizes
- * queries and searches.
- */
-interface IWriteCache {
-  /**
-   * Retrieves or builds the document at the specified revision.
-   * If targetRevision is not provided, retrieves the latest state.
-   *
-   * @param documentId - The document identifier
-   * @param scope - Operation scope
-   * @param branch - Branch name
-   * @param targetRevision - Index of the last operation to apply, defaulting
-   *   to latest. An operation index, never `header.revision[scope]`.
-   * @param signal - Optional abort signal to cancel the operation
-   * @returns The complete document at the specified revision
-   *
-   * @example
-   * ```typescript
-   * // Get latest document state
-   * const doc = await cache.getState(docId, 'global', 'main');
-   *
-   * // Get document at specific revision
-   * const doc = await cache.getState(docId, 'global', 'main', 42);
-   * ```
-   */
-  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
-  /**
-   * Stores a document snapshot in the cache at the specified revision.
-   * Implementations may truncate the stored document (e.g. strip operation
-   * history beyond the last entry per scope, clear clipboard) to bound memory
-   * and copy cost. Callers must not assume that the document returned by a
-   * subsequent getState() call will have a complete operations array; the only
-   * guaranteed invariant is that operations[scope].at(-1) holds the latest
-   * operation index for each scope present in the cached document.
-   *
-   * @param documentId - The document identifier
-   * @param scope - Operation scope
-   * @param branch - Branch name
-   * @param revision - Index of the last operation this document reflects, so
-   *   `header.revision[scope]` is one greater. -1 for an empty scope.
-   * @param document - The document to cache
-   * @param position - Whether `revision` is the stream's head. Nothing checks
-   *   it: claiming `Head` for an earlier revision makes a getState() with no
-   *   target return stale state.
-   *
-   * @example
-   * ```typescript
-   * cache.putState(docId, 'global', 'main', 42, document, SnapshotPosition.Head);
-   * ```
-   */
-  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
-  /**
-   * Records a run of revisions written together, the last of which is the
-   * stream's head. Only the head is cached as state: an earlier revision in
-   * the run is not the head, and caching it as one would answer a later head
-   * read with state from the middle of the run. The earlier ones are still
-   * offered to whatever the implementation persists at intervals, because a
-   * run that writes past a boundary passed through it just the same.
-   *
-   * @param documentId - The document identifier
-   * @param scope - Operation scope
-   * @param branch - Branch name
-   * @param run - Each revision the run produced, in order, with the document
-   *   as it stood at that revision. The last entry is the head.
-   *
-   * @example
-   * ```typescript
-   * cache.putRun(docId, 'global', 'main', [
-   *   { revision: 9, document: at9 },
-   *   { revision: 10, document: at10 },
-   * ]);
-   * ```
-   */
-  putRun(documentId: string, scope: string, branch: string, run: readonly {
-    revision: number;
-    document: PHDocument;
-  }[]): void;
-  /**
-   * Invalidates (removes) cached entries for a document stream.
-   *
-   * - If only documentId is provided: invalidates all scopes and branches for that document
-   * - If documentId + scope provided: invalidates all branches for that document and scope
-   * - If all parameters provided: invalidates the specific stream
-   *
-   * @param documentId - The document identifier
-   * @param scope - Optional scope to narrow invalidation
-   * @param branch - Optional branch to narrow invalidation
-   * @returns Number of ring buffers evicted
-   *
-   * @example
-   * ```typescript
-   * // Invalidate all streams for a document
-   * cache.invalidate(docId);
-   *
-   * // Invalidate all branches for a specific scope
-   * cache.invalidate(docId, 'global');
-   *
-   * // Invalidate specific stream
-   * cache.invalidate(docId, 'global', 'main');
-   * ```
-   */
-  invalidate(documentId: string, scope?: string, branch?: string): number;
-  /**
-   * Clears all cached data from the in-memory cache.
-   */
-  clear(): void;
-  /**
-   * Performs startup initialization.
-   */
-  startup(): Promise<void>;
-  /**
-   * Performs graceful shutdown.
-   */
-  shutdown(): Promise<void>;
-}
-//#endregion
 //#region src/cache/collection-membership-cache.d.ts
 interface ICollectionMembershipCache {
   getCollectionsForDocuments(documentIds: string[]): Promise<Record<string, string[]>>;
@@ -1674,7 +1694,10 @@ type CachedDocumentMeta = {
    * The document type (from header), cached for convenience.
    */
   documentType: string;
-  /** From the CREATE_DOCUMENT input, which fixes them for the document's life. */
+  /**
+   * From the CREATE_DOCUMENT input, which fixes them for the document's life;
+   * derived, not stored, once the document is purged.
+   */
   protocolVersions: {
     [protocol: string]: number;
   } | undefined;
@@ -1710,7 +1733,10 @@ interface IDocumentMetaCache {
    * @param signal - Optional abort signal to cancel the operation
    * @returns The cached or rebuilt document metadata
    * @throws {Error} "Operation aborted" if signal is aborted
-   * @throws {Error} If document not found (no CREATE_DOCUMENT operation)
+   * @throws {DocumentNotFoundError} If the document has no operations
+   *
+   * A purged document, whose only operation is its marker, yields deleted
+   * metadata built from the marker's input.
    */
   getDocumentMeta(documentId: string, branch: string, signal?: AbortSignal): Promise<CachedDocumentMeta>;
   /**
@@ -1872,6 +1898,22 @@ interface SyncHoldTable {
   version: number;
   held_at_utc_ms: ColumnType<string | number, number, number>;
 }
+/** A received purge marker awaiting its outcome (migration 025). */
+interface SyncReceivedMarkerTable {
+  remote_name: string;
+  marker_id: string;
+  document_id: string;
+  branch: string;
+  operation: ColumnType<unknown, string, string>;
+  received_at_utc_ms: ColumnType<string | number, number, number>;
+}
+/** A remote's refusal of a purge marker (migration 026). */
+interface SyncPurgeRefusalTable {
+  remote_name: string;
+  document_id: string;
+  branch: string;
+  refused_at_utc_ms: ColumnType<string | number, number, number>;
+}
 /**
  * One (document, group) reference ever discovered from an auth operation's
  * input. Rows are never updated or deleted (see migration 017).
@@ -1880,6 +1922,18 @@ interface GroupReferenceTable {
   documentId: string;
   groupId: string;
 }
+/** Rows a purge removed, per table. */
+type PurgeRemovedRows = {
+  [table: string]: number;
+};
+/** The tombstone of a purged document (migration 024). */
+interface DocumentPurgeTable {
+  documentId: string;
+  ordinal: ColumnType<string | number, number, number>;
+  removedRows: ColumnType<PurgeRemovedRows, string, string>;
+  purgedAtUtc: ColumnType<Date, Date | string, Date | string>;
+  requestId: string;
+}
 interface Database$1 {
   Operation: OperationTable;
   Keyframe: KeyframeTable;
@@ -1890,6 +1944,9 @@ interface Database$1 {
   sync_cursors: SyncCursorTable;
   sync_dead_letters: SyncDeadLetterTable;
   sync_holds: SyncHoldTable;
+  sync_received_markers: SyncReceivedMarkerTable;
+  sync_purge_refusals: SyncPurgeRefusalTable;
+  document_purges: DocumentPurgeTable;
 }
 interface DocumentTable {
   id: string;
@@ -1915,6 +1972,7 @@ interface DocumentIndexerDatabase {
   DocumentRelationship: DocumentRelationshipTable;
   IndexerState: IndexerStateTable;
 }
+type DocumentPurgeRow = Selectable<DocumentPurgeTable>;
 //#endregion
 //#region src/core/model-sources.d.ts
 /** An importable file holding one or more document-model exports. */
@@ -2100,7 +2158,126 @@ declare class RingBuffer<T> {
   /**
    * Gets the current number of items in the buffer.
    */
-  get length(): number;
+  get length(): number;
+}
+//#endregion
+//#region src/cache/write/interfaces.d.ts
+/**
+ * IWriteCache is a write-side projection that optimizes document state retrieval
+ * for the job executor. This is separate from IDocumentView (read-side projection) which optimizes
+ * queries and searches.
+ */
+interface IWriteCache {
+  /**
+   * Retrieves or builds the document at the specified revision.
+   * If targetRevision is not provided, retrieves the latest state.
+   *
+   * @param documentId - The document identifier
+   * @param scope - Operation scope
+   * @param branch - Branch name
+   * @param targetRevision - Index of the last operation to apply, defaulting
+   *   to latest. An operation index, never `header.revision[scope]`.
+   * @param signal - Optional abort signal to cancel the operation
+   * @returns The complete document at the specified revision
+   *
+   * @example
+   * ```typescript
+   * // Get latest document state
+   * const doc = await cache.getState(docId, 'global', 'main');
+   *
+   * // Get document at specific revision
+   * const doc = await cache.getState(docId, 'global', 'main', 42);
+   * ```
+   */
+  getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  /**
+   * Stores a document snapshot in the cache at the specified revision.
+   * Implementations may truncate the stored document (e.g. strip operation
+   * history beyond the last entry per scope, clear clipboard) to bound memory
+   * and copy cost. Callers must not assume that the document returned by a
+   * subsequent getState() call will have a complete operations array; the only
+   * guaranteed invariant is that operations[scope].at(-1) holds the latest
+   * operation index for each scope present in the cached document.
+   *
+   * @param documentId - The document identifier
+   * @param scope - Operation scope
+   * @param branch - Branch name
+   * @param revision - Index of the last operation this document reflects, so
+   *   `header.revision[scope]` is one greater. -1 for an empty scope.
+   * @param document - The document to cache
+   * @param position - Whether `revision` is the stream's head. Nothing checks
+   *   it: claiming `Head` for an earlier revision makes a getState() with no
+   *   target return stale state.
+   *
+   * @example
+   * ```typescript
+   * cache.putState(docId, 'global', 'main', 42, document, SnapshotPosition.Head);
+   * ```
+   */
+  putState(documentId: string, scope: string, branch: string, revision: number, document: PHDocument, position: SnapshotPosition): void;
+  /**
+   * Records a run of revisions written together, the last of which is the
+   * stream's head. Only the head is cached as state: an earlier revision in
+   * the run is not the head, and caching it as one would answer a later head
+   * read with state from the middle of the run. The earlier ones are still
+   * offered to whatever the implementation persists at intervals, because a
+   * run that writes past a boundary passed through it just the same.
+   *
+   * @param documentId - The document identifier
+   * @param scope - Operation scope
+   * @param branch - Branch name
+   * @param run - Each revision the run produced, in order, with the document
+   *   as it stood at that revision. The last entry is the head.
+   *
+   * @example
+   * ```typescript
+   * cache.putRun(docId, 'global', 'main', [
+   *   { revision: 9, document: at9 },
+   *   { revision: 10, document: at10 },
+   * ]);
+   * ```
+   */
+  putRun(documentId: string, scope: string, branch: string, run: readonly {
+    revision: number;
+    document: PHDocument;
+  }[]): void;
+  /**
+   * Invalidates (removes) cached entries for a document stream.
+   *
+   * - If only documentId is provided: invalidates all scopes and branches for that document
+   * - If documentId + scope provided: invalidates all branches for that document and scope
+   * - If all parameters provided: invalidates the specific stream
+   *
+   * @param documentId - The document identifier
+   * @param scope - Optional scope to narrow invalidation
+   * @param branch - Optional branch to narrow invalidation
+   * @returns Number of ring buffers evicted
+   *
+   * @example
+   * ```typescript
+   * // Invalidate all streams for a document
+   * cache.invalidate(docId);
+   *
+   * // Invalidate all branches for a specific scope
+   * cache.invalidate(docId, 'global');
+   *
+   * // Invalidate specific stream
+   * cache.invalidate(docId, 'global', 'main');
+   * ```
+   */
+  invalidate(documentId: string, scope?: string, branch?: string): number;
+  /**
+   * Clears all cached data from the in-memory cache.
+   */
+  clear(): void;
+  /**
+   * Performs startup initialization.
+   */
+  startup(): Promise<void>;
+  /**
+   * Performs graceful shutdown.
+   */
+  shutdown(): Promise<void>;
 }
 //#endregion
 //#region src/cache/kysely-write-cache.d.ts
@@ -2108,42 +2285,6 @@ type DocumentStream = {
   key: string;
   ringBuffer: RingBuffer<CachedSnapshot>;
 };
-/**
- * In-memory write cache with keyframe persistence for PHDocuments.
- *
- * Caches document snapshots in ring buffers with LRU eviction. On cache miss,
- * rebuilds documents from nearest keyframe or full operation history.
- *
- * **Performance Characteristics:**
- * - Cache hit: O(1) lookup in ring buffer
- * - Cold miss: O(n) where n is total operation count, or O(k) where k is operations since keyframe
- * - Warm miss: O(m) where m is operations since cached revision
- * - Eviction: O(1) for LRU tracking and removal
- *
- * **Thread Safety:**
- * Not thread-safe. Designed for single-threaded job executor environment.
- * External synchronization required for concurrent access across multiple executors.
- *
- * **Example:**
- * ```typescript
- * const cache = new KyselyWriteCache(
- *   keyframeStore,
- *   operationStore,
- *   registry,
- *   { maxDocuments: 1000, ringBufferSize: 10, keyframeInterval: 10 }
- * );
- *
- * await cache.startup();
- *
- * // Retrieve or rebuild document
- * const doc = await cache.getState(docId, docType, scope, branch, revision);
- *
- * // Cache result after job execution
- * cache.putState(docId, docType, scope, branch, newRevision, updatedDoc);
- *
- * await cache.shutdown();
- * ```
- */
 export declare class KyselyWriteCache implements IWriteCache {
   private streams;
   private lruTracker;
@@ -2151,6 +2292,7 @@ export declare class KyselyWriteCache implements IWriteCache {
   private operationStore;
   private registry;
   private config;
+  private reads;
   constructor(keyframeStore: IKeyframeStore, operationStore: IOperationStore, registry: IDocumentModelRegistry, config: WriteCacheConfig);
   withScopedStores(operationStore: IOperationStore, keyframeStore: IKeyframeStore): KyselyWriteCache;
   /**
@@ -2180,11 +2322,13 @@ export declare class KyselyWriteCache implements IWriteCache {
    * @returns The document at the target revision
    * @throws {Error} "Operation aborted" if signal is aborted
    * @throws {ModuleNotFoundError} If document type not registered in registry
+   * @throws {DocumentPurgedError} If the stream's only row is a purge marker
    * @throws {Error} "Failed to rebuild document" if operation store fails
    * @throws {Error} If reducer throws during operation application
    * @throws {Error} If document serialization fails
    */
   getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  private readState;
   /**
    * Stores a document snapshot in the cache at a specific revision.
    *
@@ -2215,6 +2359,7 @@ export declare class KyselyWriteCache implements IWriteCache {
     revision: number;
     document: PHDocument;
   }[]): void;
+  private storeUnlessEvicted;
   private store;
   /** Persists the snapshot if this revision is one the interval falls on. */
   private persistKeyframe;
@@ -2306,9 +2451,11 @@ export declare class KyselyWriteCache implements IWriteCache {
 export declare class KyselyOperationStore implements IOperationStore {
   private db;
   private trx?;
+  private liveIds?;
   constructor(db: Kysely<Database$1>);
   private get queryExecutor();
-  withTransaction(trx: Transaction<Database$1>): KyselyOperationStore;
+  /** `liveIds`: ids the transaction read untombstoned under its shared lock. */
+  withTransaction(trx: Transaction<Database$1>, liveIds?: ReadonlySet<string>): KyselyOperationStore;
   apply(documentId: string, documentType: string, scope: string, branch: string, revision: number, fn: (txn: AtomicTxn) => void | Promise<void>, signal?: AbortSignal, condition?: AppendCondition): Promise<Operation[]>;
   private resolveUniqueConstraint;
   private executeApply;
@@ -2327,6 +2474,10 @@ export declare class KyselyOperationStore implements IOperationStore {
    */
   private insertGuarded;
   private findIdempotentReplay;
+  /** A purged stream refuses appends; a marker gets the stored one back. */
+  private refusePurgedAppend;
+  private isMarker;
+  private actionType;
   /** True when the staged write creates a document rather than appending to one. */
   private isCreate;
   /**
@@ -2375,13 +2526,71 @@ export declare class KyselyKeyframeStore implements IKeyframeStore {
   deleteKeyframes(documentId: string, scope?: string, branch?: string, signal?: AbortSignal): Promise<number>;
 }
 //#endregion
+//#region src/storage/kysely/document-purger.d.ts
+/** An `Operation` row whose DELETE_DOCUMENT applied: not errored, not denied. */
+export declare const appliedDelete: import("kysely").RawBuilder<boolean>;
+/** Rows removed per statement from the tables a document can fill. */
+export declare const DEFAULT_PURGE_DELETE_BATCH = 5000;
+type PurgeStream = {
+  scope: string;
+  branch: string;
+};
+/** A document of a drive's collection, and whether the drive's purge needs it gone. */
+type CollectionMember = {
+  documentId: string;
+  openElsewhere: boolean;
+  /** Not open elsewhere, and still open here or deleted; a live former member lives on. */
+  required: boolean;
+};
+/** A purge transaction's statements; bound to the job's transaction. */
+export declare class KyselyDocumentPurger {
+  private readonly batchSize;
+  private readonly db;
+  constructor(db: Kysely<Database$1> | Transaction<Database$1>, batchSize?: number);
+  /** Every stream the document holds operations in. */
+  streams(documentId: string): Promise<PurgeStream[]>;
+  operationCount(documentId: string): Promise<number>;
+  /** Untombstoned documents group_references records as naming the group. */
+  groupReferencers(groupId: string): Promise<string[]>;
+  /** Survivors whose accepted auth history names the group; refusals do not. */
+  groupReferencersInHistory(groupId: string): Promise<string[]>;
+  /** The document's auth-scope operations, per branch, in index order. */
+  authOperations(documentId: string): Promise<Map<string, Operation[]>>;
+  /** Every document ever in the collection, but its owner and its own row. */
+  collectionMembers(collectionId: string, ownerId: string, branch: string): Promise<CollectionMember[]>;
+  remoteCollection(remoteName: string): Promise<string | undefined>;
+  /** Deletes every row about the document; the counts are per table. */
+  deleteRows(documentId: string): Promise<PurgeRemovedRows>;
+  writeTombstone(tombstone: {
+    documentId: string;
+    ordinal: number;
+    removedRows: PurgeRemovedRows;
+    purgedAtUtc: Date | string;
+    requestId: string;
+  }): Promise<void>;
+  /** Reopens every membership at the marker ordinal, plus `collectionIds`. */
+  reopenMemberships(documentId: string, ordinal: number, collectionIds?: Iterable<string>): Promise<string[]>;
+  private deleteBatched;
+  private deleteWhere;
+}
+//#endregion
 //#region src/executor/execution-scope.d.ts
+/** Per-document purge locks, held until the job's transaction ends. */
+interface DocumentLocks {
+  shared(ids: Iterable<string>): Promise<void>;
+  exclusive(id: string): Promise<void>;
+  /** The tombstoned ids among `ids`, read in the job's transaction. */
+  purged(ids: Iterable<string>): Promise<Set<string>>;
+}
 interface ExecutionStores {
   operationStore: IOperationStore;
   operationIndex: IOperationIndex;
   writeCache: IWriteCache;
   documentMetaCache: IDocumentMetaCache;
   collectionMembershipCache: ICollectionMembershipCache;
+  documentLocks: DocumentLocks;
+  /** Absent without a transaction, which a purge cannot run outside of. */
+  purger?: KyselyDocumentPurger;
 }
 interface IExecutionScope {
   run<T>(fn: (stores: ExecutionStores) => Promise<T>, signal?: AbortSignal): Promise<T>;
@@ -2443,6 +2652,8 @@ type ReactorFeatureFlags = {
    */
   authConditions: boolean;
 };
+/** 200k operations purge in 1.6 s on local Postgres; jobs time out at 30 s. */
+export declare const DEFAULT_MAX_PURGE_OPERATIONS = 200000;
 /**
  * Configuration options for the job executor
  */
@@ -2488,6 +2699,8 @@ type JobExecutorConfig = {
   signatureVerification?: SignatureVerificationMode;
   /** Versions run per registered protocol; defaults to the registry's. */
   protocolSupport?: ProtocolSupport;
+  /** Index rows a purge may remove without allowLarge. */
+  maxPurgeOperations?: number;
 };
 /** Cloneable, so a pooled worker refuses exactly what the host refuses. */
 type ProtocolSupport = {
@@ -2582,6 +2795,7 @@ type ErrorInfo = {
   message: string;
   stack?: string;
   cause?: ErrorInfo;
+  documentId?: string;
 };
 /**
  * Reference to a module that the worker should `import()` at runtime,
@@ -2773,13 +2987,18 @@ type LoadModelMessage = {
   correlationId: string;
   model: ModelManifestEntry;
 };
+/** Evicts purged ids from the worker's caches; the worker does not reply. */
+type EvictPurgedMessage = {
+  type: "evict-purged";
+  documentIds: string[];
+};
 /**
  * Union of all messages the parent may send to a worker.
  *
  * @see Wire Protocol Reference wiki page
  *   (Powerhouse board wiki id: 64c03e51-1aa4-4fa9-93d8-daa45642484d)
  */
-type ParentMessage = InitMessage | ExecuteMessage | AbortMessage | ShutdownMessage | LoadModelMessage;
+type ParentMessage = InitMessage | ExecuteMessage | AbortMessage | ShutdownMessage | LoadModelMessage | EvictPurgedMessage;
 /**
  * Announces that the worker has finished `init` and is ready to accept
  * `execute` messages.
@@ -3074,6 +3293,10 @@ type JobWriteReadyEvent = {
    */
   collectionMemberships?: Record<string, string[]>;
 };
+/** Set on a marker's context when its purge deleted a live document. */
+type PurgeMarkerContext = OperationContext$1 & {
+  appliedDeletion?: true;
+};
 /**
  * Event emitted after all read models have finished processing operations.
  * This event fires after JOB_WRITE_READY and guarantees that:
@@ -3145,99 +3368,203 @@ type CatchUpSweptEvent = SweepResult & {
   thread: CatchUpThread;
 };
 //#endregion
-//#region src/catch-up/types.d.ts
-type WatermarkStatus = {
-  head: number;
-  settledThrough: number;
-  waitingOn: string[];
-  stalledSinceUtcMs?: number;
-};
-interface ISettledWatermark {
-  /** Every ordinal at or below this is visible or will never exist. */
-  readonly settledThrough: number;
-  /** Probes, coalesced with one in flight; resolves with settledThrough. */
-  refresh(signal?: AbortSignal): Promise<number>;
-  onAdvance(listener: (settledThrough: number) => void): Unsubscribe;
-  status(): WatermarkStatus;
-}
-type SweepBlockedAt = {
-  ordinal: number;
-  documentId: string;
-  scope: string;
-  branch: string;
-  type: string;
-  error: string;
-};
-type SweepResult = {
-  consumerId: string;
-  from: number;
-  to: number;
-  durationMs: number;
-  /** Late operations applied. */
-  replayed: number;
-  /** Later operations of their streams applied again. */
-  reapplied: number;
-  blockedAt?: SweepBlockedAt;
-};
-interface ICatchUpConsumer {
-  readonly consumerId: string;
-  readonly appliedThrough: number;
-  /** Ordinals above the cursor this consumer holds in memory. */
-  readonly trackedAbove: number;
-  sweep(settledThrough: number, present: readonly number[], signal?: AbortSignal): Promise<SweepResult>;
-}
-type CatchUpThread = "host" | "projection";
-type CatchUpConsumerStatus = {
-  consumerId: string;
-  thread: CatchUpThread;
-  appliedThrough: number;
-  trackedAbove: number;
-  blockedAt?: SweepBlockedAt;
-  lastAdvanceUtcMs: number;
-};
-type CatchUpStatus = {
-  watermark: WatermarkStatus;
-  consumers: CatchUpConsumerStatus[];
-};
-type CatchUpConfig = {
-  intervalMs: number;
-  stuckWarnMs: number;
-  maxTrackedAboveCursor: number;
-  /** Present ordinals read per tick. */
-  sweepPageSize: number;
-};
-export declare const defaultCatchUpConfig: CatchUpConfig;
-/** The catch-up surface a reactor module exposes. */
-interface ICatchUp {
-  status(): CatchUpStatus;
-  sweepNow(): Promise<SweepResult[]>;
-}
-//#endregion
 //#region src/events/interfaces.d.ts
 /**
  * Describes an object that manages event subscriptions and emissions.
  */
 interface IEventBus {
   /**
-   * Register a new subscriber.
-   * Order is preserved by pushing to the end of the per-type array.
-   *
-   * @param type - The type of event to subscribe to.
-   * @param subscriber - The subscriber function to call when the event is emitted.
-   *
-   * @returns A function to unsubscribe from the event.
+   * Register a new subscriber.
+   * Order is preserved by pushing to the end of the per-type array.
+   *
+   * @param type - The type of event to subscribe to.
+   * @param subscriber - The subscriber function to call when the event is emitted.
+   *
+   * @returns A function to unsubscribe from the event.
+   */
+  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
+  /**
+   * Emits an event and waits until **all** subscribers finish.
+   *  - Every subscriber present at emit-start is called, in registration order.
+   *  - Calls are invoked and settled sequentially.
+   *  - If subscribers throw/reject, `emit` rejects with an aggregate error of all errors.
+   *
+   * @param type - The type of event to emit.
+   * @param data - The data to pass to the subscribers.
+   */
+  emit(type: number, data: any): Promise<void>;
+}
+//#endregion
+//#region src/job-tracker/interfaces.d.ts
+/**
+ * Interface for tracking job lifecycle status.
+ * Maintains job state throughout execution: PENDING → RUNNING → COMPLETED/FAILED.
+ */
+interface IJobTracker {
+  /**
+   * Register a new job with PENDING status.
+   *
+   * @param jobInfo - The job information to register
+   */
+  registerJob(jobInfo: JobInfo): void;
+  /**
+   * Update a job's status to RUNNING.
+   *
+   * @param jobId - The job ID to mark as running
+   */
+  markRunning(jobId: string): void;
+  /**
+   * Mark a job as failed.
+   *
+   * @param jobId - The job ID to mark as failed
+   * @param error - Error information including message and stack trace
+   * @param job - Optional full job object for debugging purposes
+   */
+  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
+  /**
+   * Retrieve the current status of a job.
+   *
+   * @param jobId - The job ID to query
+   * @returns The job information, or null if the job is not found
+   */
+  getJobStatus(jobId: string): JobInfo | null;
+  /**
+   * Shutdown the job tracker and clean up resources.
+   * Unsubscribes from all event bus subscriptions.
+   */
+  shutdown(): void;
+}
+//#endregion
+//#region src/queue/interfaces.d.ts
+/**
+ * Interface for a job queue that manages write operations.
+ * Internally organizes jobs by documentId, scope, and branch to ensure proper ordering.
+ * Emits events to the event bus when new jobs are available for consumption.
+ */
+interface IQueue {
+  /**
+   * Add a new job to the queue.
+   * Jobs are automatically organized by documentId, scope, and branch internally.
+   * Emits a 'jobAvailable' event to the event bus when the job is queued.
+   * @param job - The job to add to the queue
+   * @returns Promise that resolves when the job is queued
+   */
+  enqueue(job: Job): Promise<void>;
+  /**
+   * Get the next job to execute for a specific document/scope/branch combination.
+   * @param documentId - The document ID to get jobs for
+   * @param scope - The scope to get jobs for
+   * @param branch - The branch to get jobs for
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   */
+  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  /**
+   * Get the next available job from any queue.
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Promise that resolves to the next job execution handle or null if no jobs available
+   */
+  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  /**
+   * Get the next available job whose routing metadata satisfies the predicate.
+   * Walks ready sub-queue heads in queue insertion order, skips heads whose document
+   * is currently executing (same isDocumentExecuting gate as dequeueNext), and returns
+   * the first head for which predicate returns true.
+   * Returns null when paused, when nothing matches, or when the queue is empty.
+   * Rejects if signal is already aborted.
+   * @param predicate - Filter applied to JobRoutingMeta of each candidate head
+   * @param signal - Optional abort signal to cancel the request
+   * @returns Promise that resolves to the first matching job execution handle or null
+   */
+  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
+  /**
+   * Get the current size of the queue for a specific document/scope/branch.
+   * @param documentId - The document ID
+   * @param scope - The scope
+   * @param branch - The branch
+   * @returns Promise that resolves to the number of jobs in the queue
+   */
+  size(documentId: string, scope: string, branch: string): Promise<number>;
+  /**
+   * Get the total size of all queues.
+   * @returns Promise that resolves to the total number of jobs across all queues
+   */
+  totalSize(): Promise<number>;
+  /**
+   * Remove a specific job from the queue.
+   * @param jobId - The ID of the job to remove
+   * @returns Promise that resolves to true if job was removed, false if not found
+   */
+  remove(jobId: string): Promise<boolean>;
+  /**
+   * Clear all jobs for a specific document/scope/branch combination.
+   * @param documentId - The document ID
+   * @param scope - The scope
+   * @param branch - The branch
+   * @returns Promise that resolves when the queue is cleared
+   */
+  clear(documentId: string, scope: string, branch: string): Promise<void>;
+  /**
+   * Clear all jobs from all queues.
+   * @returns Promise that resolves when all queues are cleared
+   */
+  clearAll(): Promise<void>;
+  /**
+   * Check if there are any jobs in the queue.
+   * @returns Promise that resolves to true if there are jobs, false otherwise
+   */
+  hasJobs(): Promise<boolean>;
+  /**
+   * Mark a job as completed.
+   * @param jobId - The ID of the job to mark as completed
+   * @returns Promise that resolves when the job is marked as completed
+   */
+  completeJob(jobId: string): Promise<void>;
+  /**
+   * Mark a job as failed.
+   * @param jobId - The ID of the job to mark as failed
+   * @param error - Optional error information
+   * @returns Promise that resolves when the job is marked as failed
+   */
+  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
+  /**
+   * Retry a failed job.
+   * @param jobId - The ID of the job to retry
+   * @param error - Optional error information from the failure
+   * @param accounting - Whether the attempt counts against the job's retry
+   * limit; defaults to {@link RetryAccounting.CountAgainstLimit}
+   * @returns Promise that resolves when the job is requeued for retry
+   */
+  retryJob(jobId: string, error?: ErrorInfo$1, accounting?: RetryAccounting): Promise<void>;
+  /**
+   * Returns true if and only if all jobs have been resolved.
+   */
+  get isDrained(): boolean;
+  /**
+   * Blocks the queue from accepting new jobs.
+   * @param onDrained - Optional callback to call when the queue is drained
    */
-  subscribe<K>(type: number, subscriber: (type: number, event: K) => void | Promise<void>): Unsubscribe;
+  block(onDrained?: () => void): void;
   /**
-   * Emits an event and waits until **all** subscribers finish.
-   *  - Every subscriber present at emit-start is called, in registration order.
-   *  - Calls are invoked and settled sequentially.
-   *  - If subscribers throw/reject, `emit` rejects with an aggregate error of all errors.
-   *
-   * @param type - The type of event to emit.
-   * @param data - The data to pass to the subscribers.
+   * Unblocks the queue from accepting new jobs.
    */
-  emit(type: number, data: any): Promise<void>;
+  unblock(): void;
+}
+//#endregion
+//#region src/admin/document-purge-service.d.ts
+type EnqueuePurgeOptions = {
+  /** Lifts the executor's maxPurgeOperations cap for every id. */
+  allowLarge?: boolean;
+};
+/** The only local origin of a purge: one purge job per erased document. */
+export declare class DocumentPurgeService {
+  private readonly queue;
+  private readonly jobTracker;
+  private readonly eventBus;
+  constructor(queue: IQueue, jobTracker: IJobTracker, eventBus: IEventBus);
+  static fromModule(module: InProcessReactorModule): DocumentPurgeService;
+  /** One purge job per id; resolves once enqueued, not once complete. */
+  enqueuePurge(ids: string[], requestId: string, opts?: EnqueuePurgeOptions): Promise<JobInfo[]>;
 }
 //#endregion
 //#region src/shared/awaiter.d.ts
@@ -3297,6 +3624,10 @@ interface SubscriptionErrorContext {
   /** Optional additional data about the event */
   eventData?: unknown;
 }
+/** Set on a deletion notice when a purge marker applied the deletion. */
+type DocumentDeletedInfo = {
+  purged?: true;
+};
 /**
  * Interface for subscribing to document events in the reactor.
  */
@@ -3317,7 +3648,7 @@ interface IReactorSubscriptionManager {
    * @param search - Optional search filter to limit which documents trigger events
    * @returns A function that unsubscribes from the events
    */
-  onDocumentDeleted(callback: (documentIds: string[]) => void, search?: SearchFilter): () => void;
+  onDocumentDeleted(callback: (documentIds: string[], info?: DocumentDeletedInfo) => void, search?: SearchFilter): () => void;
   /**
    * Subscribes to document state updates
    *
@@ -3368,6 +3699,11 @@ export declare const RECOVERABLE_GRAPHQL_ERROR_CODES: {
    * those too.
    */
   readonly malformedStoredOperation: "MALFORMED_STORED_OPERATION";
+  /**
+   * The poll's marker refusals could not be recorded, so nothing was served.
+   * The client keeps them pending and reports them on its next poll.
+   */
+  readonly refusalNotRecorded: "REFUSAL_NOT_RECORDED";
 };
 /**
  * True when every error the response carried named a recoverable code.
@@ -3464,6 +3800,7 @@ interface IMailbox {
   /**
    * The latest ordinal that has been acknowledged. Because acknowledged items
    * are removed from the mailbox, this is the last ordinal that has been removed.
+   * With holdAckBelowMarkers, never at or past an unapplied marker entry.
    */
   get ackOrdinal(): number;
   /**
@@ -3484,8 +3821,15 @@ interface IMailbox {
   flush(): void;
   isPaused(): boolean;
 }
+type MailboxOptions = {
+  /** An unapplied item carrying a purge marker keeps ackOrdinal below it. */
+  holdAckBelowMarkers?: boolean;
+};
 export declare class Mailbox implements IMailbox {
+  private readonly holdAckBelowMarkers;
   private itemsMap;
+  /** Unapplied items carrying a marker, so the held ack reads only these. */
+  private readonly heldMarkers;
   private addedCallbacks;
   private removedCallbacks;
   private paused;
@@ -3493,6 +3837,7 @@ export declare class Mailbox implements IMailbox {
   private removedBuffer;
   private _ack;
   private _latestOrdinal;
+  constructor(options?: MailboxOptions);
   init(ackOrdinal: number): void;
   advanceOrdinal(ordinal: number): void;
   get items(): ReadonlyArray<SyncOperation>;
@@ -3619,6 +3964,8 @@ interface IChannel {
    * fires.
    */
   onPeerManifest?(callback: PeerManifestListener): () => void;
+  /** Hears the remote's next report of this refused marker again. */
+  forgetMarkerRefusal?(documentId: string, branch: string): void;
 }
 /**
  * `undelivered`: outbox items the channel sent that the peer never received,
@@ -3747,6 +4094,12 @@ interface ISyncManager {
    * @throws Error if the remote does not exist, or is bound to another address
    */
   bindRemote(id: string, boundAddress: string): Promise<void>;
+  /**
+   * Settles once the named remotes' received markers are stored, or every
+   * remote's when none are named; rejects if a write failed. A push is
+   * answered after it.
+   */
+  receiptsStored?(remoteNames?: Iterable<string>): Promise<void>;
   /**
    * Triggers a one-shot pull for the named remote. Useful for Manual poll-behavior
    * remotes, where the channel is registered but does not poll on a schedule.
@@ -3841,6 +4194,8 @@ type StreamQuery = {
  */
 interface IStreamStateReader {
   getState(documentId: string, scope: string, branch: string, targetRevision?: number, signal?: AbortSignal): Promise<PHDocument>;
+  /** Readies the purge fence for ids about to be read, in one round trip. */
+  fence?(documentIds: readonly string[]): Promise<void>;
 }
 /** The document and branch a decision model is built for. */
 type DecisionTarget = {
@@ -3951,6 +4306,8 @@ type DocumentChangeEvent = {
   context?: {
     parentId?: string;
     childId?: string;
+    /** On a Deleted event: a purge marker applied the deletion. */
+    purged?: true;
   };
 };
 /**
@@ -4260,6 +4617,17 @@ interface IReactorClient {
    * @returns The created document
    */
   create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Submits what {@link create} submits and returns without waiting. The
+   * batch holds a `create` job and, with a parent, a `parent` job that
+   * depends on it; a failed `create` still releases `parent`.
+   *
+   * @param document - Document with optional id, slug, parent, model type, and initial state
+   * @param parentIdentifier - Optional "id" or "slug" of parent document
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The submitted jobs, keyed `create` and `parent`
+   */
+  createAsync(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<BatchExecutionResult>;
   /**
    * Creates an empty document and waits for completion
    *
@@ -4268,6 +4636,16 @@ interface IReactorClient {
    * @param signal - Optional abort signal to cancel the request
    */
   createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Submits what {@link createEmpty} submits and returns without waiting;
+   * see {@link createAsync}. The new document's id is `jobs.create.documentId`.
+   *
+   * @param documentModelType - Type of document to create
+   * @param options - Optional creation options (parentIdentifier, documentModelVersion)
+   * @param signal - Optional abort signal to cancel the request
+   * @returns The submitted jobs, keyed `create` and `parent`
+   */
+  createEmptyAsync(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<BatchExecutionResult>;
   /**
    * Retrieves the document model module matching the version a document is
    * stamped with. Use this instead of {@link getDocumentModelModule}
@@ -4616,7 +4994,7 @@ export declare class SeededStateReader implements IStreamStateReader {
    * A stream this replica does not hold has to reach buildDecisionModel as the
    * absence it recognises, or the whole read fails instead of leaving the group
    * out of the model, where its principal does not match and the policy fails
-   * closed. The read side reports absence as a plain Error, so the absence is
+   * closed. An error other than DocumentNotFoundError has its absence
    * confirmed rather than inferred from the message: a transient failure must
    * surface, not silently deny.
    */
@@ -4836,10 +5214,20 @@ export declare class ReactorClient implements IReactorClient {
    * Creates a document and waits for completion
    */
   create<TDocument extends PHDocument = PHDocument>(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Submits a document's create batch without waiting for it
+   */
+  createAsync(document: PHDocument, parentIdentifier?: string, signal?: AbortSignal): Promise<BatchExecutionResult>;
+  private submitCreate;
   /**
    * Creates an empty document and waits for completion
    */
   createEmpty<TDocument extends PHDocument>(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<TDocument>;
+  /**
+   * Submits an empty document's create batch without waiting for it
+   */
+  createEmptyAsync(documentModelType: string, options?: CreateDocumentOptions, signal?: AbortSignal): Promise<BatchExecutionResult>;
+  private emptyDocument;
   /**
    * Upgrades a document to a newer document model version by dispatching an
    * UPGRADE_DOCUMENT action. When toVersion is omitted, upgrades to the
@@ -4989,10 +5377,15 @@ export declare class ReactorClient implements IReactorClient {
   private readRelationshipEdge;
   /**
    * The id a write on `identifier` is stored under, which its signatures bind.
-   * A create names its own id, and an id no slug maps to is taken as given, so
-   * a document still in flight resolves to itself.
+   * A create names its own id.
    */
   private resolveWriteTarget;
+  /**
+   * The id a document reference names. An id no slug maps to is taken as
+   * given, so a document still in flight resolves to itself; an id that is
+   * another document's slug is refused as ambiguous.
+   */
+  private resolveReference;
   /**
    * The decision model for one target document, built at its stream heads.
    *
@@ -5014,7 +5407,8 @@ export declare class ReactorClient implements IReactorClient {
    * is why the answer is a prediction.
    */
   private buildEvaluationTarget;
-  private removeAllIncomingRelationships;
+  private planDelete;
+  private planRemoval;
 }
 //#endregion
 //#region src/executor/interfaces.d.ts
@@ -5084,6 +5478,8 @@ interface IExecutorWorker {
    * with `model-load-failed` or the worker exits before answering.
    */
   loadModel(entry: ModelManifestEntry, signal?: AbortSignal): Promise<void>;
+  /** Evicts purged ids from the worker's caches; a worker not ready skips it. */
+  evictPurged(documentIds: string[]): void;
   /** True when no job is currently in flight. */
   isIdle(): boolean;
   /** Snapshot of the in-flight slot, or null when idle. */
@@ -5136,162 +5532,6 @@ interface IJobExecutorManager {
   getStatus(): ExecutorManagerStatus;
 }
 //#endregion
-//#region src/job-tracker/interfaces.d.ts
-/**
- * Interface for tracking job lifecycle status.
- * Maintains job state throughout execution: PENDING → RUNNING → COMPLETED/FAILED.
- */
-interface IJobTracker {
-  /**
-   * Register a new job with PENDING status.
-   *
-   * @param jobInfo - The job information to register
-   */
-  registerJob(jobInfo: JobInfo): void;
-  /**
-   * Update a job's status to RUNNING.
-   *
-   * @param jobId - The job ID to mark as running
-   */
-  markRunning(jobId: string): void;
-  /**
-   * Mark a job as failed.
-   *
-   * @param jobId - The job ID to mark as failed
-   * @param error - Error information including message and stack trace
-   * @param job - Optional full job object for debugging purposes
-   */
-  markFailed(jobId: string, error: ErrorInfo$1, job?: Job): void;
-  /**
-   * Retrieve the current status of a job.
-   *
-   * @param jobId - The job ID to query
-   * @returns The job information, or null if the job is not found
-   */
-  getJobStatus(jobId: string): JobInfo | null;
-  /**
-   * Shutdown the job tracker and clean up resources.
-   * Unsubscribes from all event bus subscriptions.
-   */
-  shutdown(): void;
-}
-//#endregion
-//#region src/queue/interfaces.d.ts
-/**
- * Interface for a job queue that manages write operations.
- * Internally organizes jobs by documentId, scope, and branch to ensure proper ordering.
- * Emits events to the event bus when new jobs are available for consumption.
- */
-interface IQueue {
-  /**
-   * Add a new job to the queue.
-   * Jobs are automatically organized by documentId, scope, and branch internally.
-   * Emits a 'jobAvailable' event to the event bus when the job is queued.
-   * @param job - The job to add to the queue
-   * @returns Promise that resolves when the job is queued
-   */
-  enqueue(job: Job): Promise<void>;
-  /**
-   * Get the next job to execute for a specific document/scope/branch combination.
-   * @param documentId - The document ID to get jobs for
-   * @param scope - The scope to get jobs for
-   * @param branch - The branch to get jobs for
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Promise that resolves to the next job execution handle or null if no jobs available
-   */
-  dequeue(documentId: string, scope: string, branch: string, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  /**
-   * Get the next available job from any queue.
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Promise that resolves to the next job execution handle or null if no jobs available
-   */
-  dequeueNext(signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  /**
-   * Get the next available job whose routing metadata satisfies the predicate.
-   * Walks ready sub-queue heads in queue insertion order, skips heads whose document
-   * is currently executing (same isDocumentExecuting gate as dequeueNext), and returns
-   * the first head for which predicate returns true.
-   * Returns null when paused, when nothing matches, or when the queue is empty.
-   * Rejects if signal is already aborted.
-   * @param predicate - Filter applied to JobRoutingMeta of each candidate head
-   * @param signal - Optional abort signal to cancel the request
-   * @returns Promise that resolves to the first matching job execution handle or null
-   */
-  dequeueNextMatching(predicate: (meta: JobRoutingMeta) => boolean, signal?: AbortSignal): Promise<IJobExecutionHandle | null>;
-  /**
-   * Get the current size of the queue for a specific document/scope/branch.
-   * @param documentId - The document ID
-   * @param scope - The scope
-   * @param branch - The branch
-   * @returns Promise that resolves to the number of jobs in the queue
-   */
-  size(documentId: string, scope: string, branch: string): Promise<number>;
-  /**
-   * Get the total size of all queues.
-   * @returns Promise that resolves to the total number of jobs across all queues
-   */
-  totalSize(): Promise<number>;
-  /**
-   * Remove a specific job from the queue.
-   * @param jobId - The ID of the job to remove
-   * @returns Promise that resolves to true if job was removed, false if not found
-   */
-  remove(jobId: string): Promise<boolean>;
-  /**
-   * Clear all jobs for a specific document/scope/branch combination.
-   * @param documentId - The document ID
-   * @param scope - The scope
-   * @param branch - The branch
-   * @returns Promise that resolves when the queue is cleared
-   */
-  clear(documentId: string, scope: string, branch: string): Promise<void>;
-  /**
-   * Clear all jobs from all queues.
-   * @returns Promise that resolves when all queues are cleared
-   */
-  clearAll(): Promise<void>;
-  /**
-   * Check if there are any jobs in the queue.
-   * @returns Promise that resolves to true if there are jobs, false otherwise
-   */
-  hasJobs(): Promise<boolean>;
-  /**
-   * Mark a job as completed.
-   * @param jobId - The ID of the job to mark as completed
-   * @returns Promise that resolves when the job is marked as completed
-   */
-  completeJob(jobId: string): Promise<void>;
-  /**
-   * Mark a job as failed.
-   * @param jobId - The ID of the job to mark as failed
-   * @param error - Optional error information
-   * @returns Promise that resolves when the job is marked as failed
-   */
-  failJob(jobId: string, error?: ErrorInfo$1): Promise<void>;
-  /**
-   * Retry a failed job.
-   * @param jobId - The ID of the job to retry
-   * @param error - Optional error information from the failure
-   * @param accounting - Whether the attempt counts against the job's retry
-   * limit; defaults to {@link RetryAccounting.CountAgainstLimit}
-   * @returns Promise that resolves when the job is requeued for retry
-   */
-  retryJob(jobId: string, error?: ErrorInfo$1, accounting?: RetryAccounting): Promise<void>;
-  /**
-   * Returns true if and only if all jobs have been resolved.
-   */
-  get isDrained(): boolean;
-  /**
-   * Blocks the queue from accepting new jobs.
-   * @param onDrained - Optional callback to call when the queue is drained
-   */
-  block(onDrained?: () => void): void;
-  /**
-   * Unblocks the queue from accepting new jobs.
-   */
-  unblock(): void;
-}
-//#endregion
 //#region src/shared/consistency-tracker.d.ts
 interface IConsistencyTracker {
   /**
@@ -5408,6 +5648,13 @@ export declare const DEFAULT_READ_MODEL_YIELD_DEADLINE_MS = 50;
 export declare const defaultReadModelIndexingConfig: ReadModelIndexingConfig;
 /** For read models whose callers can observe where a batch was split. */
 export declare const unchunkedReadModelIndexingConfig: ReadModelIndexingConfig;
+type PurgeFence =
+/** Commits in a purge-locked trx; see commitsInFenceTransaction. */
+"locked" |
+/** Drops tombstoned ids only, for rows that live on another database handle. */
+"skip" |
+/** No fence: ProcessorManager, and commits that open their own trx on this.db. */
+"none";
 type BaseReadModelConfig = {
   readModelId: string;
   /** Rebuilds resultingState for boot replay and sweeps. */
@@ -5418,6 +5665,8 @@ type BaseReadModelConfig = {
   startFrom?: "beginning" | "head";
   /** Re-applies the rest of a late operation's stream; defaults to true. */
   replayStreamSuffix?: boolean;
+  /** Defaults to "locked"; see {@link PurgeFence} for the opt-outs. */
+  purgeFence?: PurgeFence;
 };
 /** A read model whose cursor only sweeps and boot replay advance. */
 export declare class BaseReadModel implements IReadModel, ICatchUpConsumer {
@@ -5439,6 +5688,8 @@ export declare class BaseReadModel implements IReadModel, ICatchUpConsumer {
   private readonly liveInFlight;
   private readonly sweptListeners;
   constructor(db: Kysely<DocumentViewDatabase>, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker, config: BaseReadModelConfig);
+  /** Set by a subclass whose commitOperations writes through its trx argument. */
+  static readonly commitsInFenceTransaction: boolean;
   get consumerId(): string;
   get appliedThrough(): number;
   get trackedAbove(): number;
@@ -5461,7 +5712,14 @@ export declare class BaseReadModel implements IReadModel, ICatchUpConsumer {
   protected get lastOrdinal(): number;
   /** Called after the cursor advances. */
   protected onCursorAdvanced(appliedThrough: number): void;
-  protected commitOperations(items: OperationWithContext$1[]): Promise<void>;
+  /** Writes through `trx` when given: the purge fence's transaction. */
+  protected commitOperations(items: OperationWithContext$1[], trx?: Transaction<DocumentViewDatabase>): Promise<void>;
+  /** The handle document_purges is read through; `db` may be the fence trx. */
+  protected purgeLookup(db: Kysely<any>): Kysely<any>;
+  /** False when the batch writes no rows, so the fence opens no transaction. */
+  protected writesRows(items: OperationWithContext$1[]): boolean;
+  /** Every delivery commits through here. */
+  protected commitFenced(items: OperationWithContext$1[]): Promise<void>;
   /** Rebuilds resultingState as the executor writes it: scopes plus header. */
   protected rebuildStateForOperations(operations: OperationWithContext$1[]): Promise<OperationWithContext$1[]>;
   /**
@@ -5495,8 +5753,10 @@ export declare class BaseReadModel implements IReadModel, ICatchUpConsumer {
   private replayPage;
   private replayOwned;
   private sweepStream;
-  /** A document gone from the write cache is absent, not a failure. */
+  /** A document gone from the write cache, or purged, is absent. */
   private rebuildIfConfigured;
+  /** A failed lookup is no answer: the caller's own error stands. */
+  private isPurged;
   private block;
   private notifySwept;
   /** Compare-and-set against the value this process last wrote. */
@@ -5983,6 +6243,8 @@ interface InProcessReactorModule extends ReactorModule {
   catchUp: ICatchUp;
   /** The settled watermark this thread's catch-up sweeps up to. */
   settledWatermark: ISettledWatermark;
+  /** Enqueues purge jobs; the erasure scheduler is its only caller. */
+  documentPurgeService: DocumentPurgeService;
 }
 /**
  * Base reactor client contract — the client plus its reactor module. Satisfied
@@ -6014,11 +6276,12 @@ export declare class DriveClient implements IDriveClient {
   private readonly logger;
   private readonly reactor;
   private readonly signer;
-  constructor(client: IReactorClient, logger: ILogger, reactor: IReactor, signer: ISigner);
+  private readonly resolveReference;
+  constructor(client: IReactorClient, logger: ILogger, reactor: IReactor, signer: ISigner, resolveReference: (identifier: string, signal?: AbortSignal) => Promise<string>);
   create(input: DriveInput, signal?: AbortSignal): Promise<DocumentDriveDocument>;
   addFile<TDocument extends PHDocument = PHDocument>(driveIdentifier: string, document: PHDocument, parentFolder?: string, signal?: AbortSignal): Promise<TDocument>;
   addFolder(driveIdentifier: string, name: string, parentFolder?: string, signal?: AbortSignal): Promise<FolderNode>;
-  removeNode(driveIdentifier: string, nodeId: string, signal?: AbortSignal): Promise<void>;
+  removeNode(driveIdentifier: string, nodeIdentifier: string, signal?: AbortSignal): Promise<void>;
   renameNode(driveIdentifier: string, nodeId: string, name: string, signal?: AbortSignal): Promise<Node>;
   setPreferredEditorOnNode(nodeId: string, preferredEditor: string | null, signal?: AbortSignal): Promise<PHDocument>;
   moveNode(driveIdentifier: string, srcNodeId: string, targetParentFolderId: string | undefined, signal?: AbortSignal): Promise<DocumentDriveDocument>;
@@ -6548,12 +6811,16 @@ export declare class SyncBuilder {
   private cursorStorage?;
   private deadLetterStorage?;
   private holdStorage?;
+  private receivedMarkerStorage?;
+  private purgeRefusalStorage?;
   private config;
   withChannelFactory(factory: IChannelFactory): this;
   withRemoteStorage(storage: ISyncRemoteStorage): this;
   withCursorStorage(storage: ISyncCursorStorage): this;
   withDeadLetterStorage(storage: ISyncDeadLetterStorage): this;
   withHoldStorage(storage: ISyncHoldStorage): this;
+  withReceivedMarkerStorage(storage: ISyncReceivedMarkerStorage): this;
+  withPurgeRefusalStorage(storage: ISyncPurgeRefusalStorage): this;
   withMaxDeadLettersPerRemote(limit: number): this;
   withMaxInboxBatchSize(limit: number): this;
   withMaxHeldOperationsPerRemote(limit: number): this;
@@ -7079,6 +7346,8 @@ export declare class CatchUpScheduler implements ICatchUp {
  * for the new Reactor architecture.
  */
 export declare class Reactor implements IReactor {
+  private readonly disposers;
+  private readonly closers;
   private logger;
   private documentModelRegistry;
   private shutdownStatus;
@@ -7094,7 +7363,7 @@ export declare class Reactor implements IReactor {
   private eventBus;
   private executorManager;
   private catchUp;
-  constructor(logger: ILogger, documentModelRegistry: IDocumentModelRegistry, queue: IQueue, jobTracker: IJobTracker, readModelCoordinator: IReadModelCoordinator, features: ReactorFeatures, documentView: IDocumentView, documentIndexer: IDocumentIndexer, operationStore: IOperationStore, eventBus: IEventBus, executorManager: IJobExecutorManager, catchUp?: CatchUpScheduler);
+  constructor(logger: ILogger, documentModelRegistry: IDocumentModelRegistry, queue: IQueue, jobTracker: IJobTracker, readModelCoordinator: IReadModelCoordinator, features: ReactorFeatures, documentView: IDocumentView, documentIndexer: IDocumentIndexer, operationStore: IOperationStore, eventBus: IEventBus, executorManager: IJobExecutorManager, catchUp?: CatchUpScheduler, disposers?: Unsubscribe[], closers?: Array<() => Promise<void>>);
   kill(): ShutdownStatus;
   getDocumentModels(namespace?: string, paging?: PagingOptions, signal?: AbortSignal): Promise<PagedResults<DocumentModelModule>>;
   get<TDocument extends PHDocument>(id: string, view?: ViewFilter, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
@@ -7151,6 +7420,55 @@ export declare class InvalidSignatureError extends Error {
   constructor(documentId: string, code: SignatureRefusalCode, reason: string);
   static isError(error: unknown): error is InvalidSignatureError;
 }
+/**
+ * Error thrown when a document is not found (no operations exist for the document ID).
+ */
+declare class DocumentNotFoundError extends Error {
+  readonly documentId: string;
+  /**
+   * @param message Overrides the default text. A handler that knows which of
+   * several documents an action reads - a relationship's source, say - says so
+   * here rather than rewrapping in a bare Error, which would strip the name the
+   * executor classifies by.
+   */
+  constructor(documentId: string, message?: string);
+  /** Also true for DocumentPurgedError: only the name crosses the queue. */
+  static isError(error: unknown): error is DocumentNotFoundError;
+}
+/** The document was purged; readers treat it as absent. Terminal. */
+export declare class DocumentPurgedError extends DocumentNotFoundError {
+  readonly purged = true;
+  constructor(documentId: string, message?: string);
+  static isError(error: unknown): error is DocumentPurgedError;
+}
+/** A purge was asked for a document that is not deleted. Terminal. */
+export declare class DocumentNotDeletedError extends Error {
+  readonly documentId: string;
+  constructor(documentId: string, message?: string);
+  static isError(error: unknown): error is DocumentNotDeletedError;
+}
+/** A surviving document's accepted auth history names the group. Terminal. */
+export declare class GroupInUseError extends Error {
+  readonly groupId: string;
+  readonly referencingDocumentIds: readonly string[];
+  constructor(groupId: string, referencingDocumentIds: readonly string[]);
+  static isError(error: unknown): error is GroupInUseError;
+}
+/** A purge above maxPurgeOperations without allowLarge. Terminal. */
+export declare class PurgeTooLargeError extends Error {
+  readonly documentId: string;
+  readonly operationCount: number;
+  readonly maxPurgeOperations: number;
+  constructor(documentId: string, operationCount: number, maxPurgeOperations: number);
+  static isError(error: unknown): error is PurgeTooLargeError;
+}
+/** A regular write carried an action type only the reactor issues. Terminal. */
+export declare class ReservedActionError extends Error {
+  readonly documentId: string;
+  readonly actionType: string;
+  constructor(documentId: string, actionType: string);
+  static isError(error: unknown): error is ReservedActionError;
+}
 /**
  * An authorization preflight was asked for while the reactor's decision model
  * is off, so there is no model to answer from.
@@ -7249,7 +7567,7 @@ export declare class DefaultSubscriptionErrorHandler implements ISubscriptionErr
 //#endregion
 //#region src/subs/react-subscription-manager.d.ts
 type DocumentCreatedCallback = (result: PagedResults<string>) => void;
-type DocumentDeletedCallback = (documentIds: string[]) => void;
+type DocumentDeletedCallback = (documentIds: string[], info?: DocumentDeletedInfo) => void;
 type DocumentStateUpdatedCallback = (result: PagedResults<PHDocument>) => void;
 type RelationshipChangedCallback = (parentId: string, childId: string, changeType: RelationshipChangeType) => void;
 export declare class ReactorSubscriptionManager implements IReactorSubscriptionManager {
@@ -7271,7 +7589,7 @@ export declare class ReactorSubscriptionManager implements IReactorSubscriptionM
   /**
    * Notify subscribers about deleted documents
    */
-  notifyDocumentsDeleted(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>): void;
+  notifyDocumentsDeleted(documentIds: string[], documentTypes?: Map<string, string>, parentIds?: Map<string, string | null>, info?: DocumentDeletedInfo): void;
   /**
    * Notify subscribers about updated documents
    */
@@ -7514,6 +7832,21 @@ export declare class SimpleJobExecutor implements IJobExecutor {
    * has not committed yet has nothing to announce.
    */
   private executeInScope;
+  /** A load names only its own id purged; a foreign one is ID_MISMATCH. */
+  private purgedRefusal;
+  /** A purge job or a marker load: the exclusive lock is the job's only lock. */
+  private executePurge;
+  /** Preconditions 1-5, then the marker this host signs. */
+  private preparePurgeJob;
+  /** A peer's marker, admitted alone; a receiver cannot refuse an erasure. */
+  private preparePurgeLoad;
+  /** Execution: delete, write the marker and its twin, tombstone, reopen. */
+  private commitPurge;
+  private heldStreams;
+  /** Members a drive purge needs gone, and those living on elsewhere. */
+  private driveMembers;
+  /** The marker, signed by this executor's signer as any peer admits it. */
+  private signMarker;
   /** A stored document at a version this reactor does not run is read-only here. */
   private unsupportedStoredProtocol;
   /**
@@ -7821,10 +8154,13 @@ export declare function firstOutOfOrderPair(operations: Operation[], options?: {
 //#region src/storage/kysely/document-indexer.d.ts
 type IndexerDatabase = Database$1 & DocumentIndexerDatabase & DocumentViewDatabase;
 export declare class KyselyDocumentIndexer extends BaseReadModel implements IDocumentIndexer {
+  static readonly commitsInFenceTransaction = true;
   private _db;
   constructor(db: Kysely<IndexerDatabase>, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker, indexing?: ReadModelIndexingConfig);
+  protected writesRows(items: OperationWithContext$1[]): boolean;
   /** Opens no transaction for a batch carrying no relationship operation. */
-  protected commitOperations(items: OperationWithContext$1[]): Promise<void>;
+  protected commitOperations(items: OperationWithContext$1[], fenced?: Transaction<DocumentViewDatabase>): Promise<void>;
+  private writeRelationships;
   getOutgoing(documentId: string, types?: string[], paging?: PagingOptions, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<PagedResults<DocumentRelationship>>;
   getIncoming(documentId: string, types?: string[], paging?: PagingOptions, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<PagedResults<DocumentRelationship>>;
   getOrphanedChildren(parentIds: string[], types?: string[], signal?: AbortSignal): Promise<string[]>;
@@ -7900,6 +8236,7 @@ export declare enum DeletedDocumentRead {
 export declare class KyselyDocumentView extends BaseReadModel implements IDocumentView {
   private operationStore;
   private readonly deletedDocumentRead;
+  static readonly commitsInFenceTransaction = true;
   private _db;
   constructor(db: Kysely<Database$2>, operationStore: IOperationStore, operationIndex: IOperationIndex, writeCache: IWriteCache, consistencyTracker: IConsistencyTracker, deletedDocumentRead: DeletedDocumentRead, indexing?: ReadModelIndexingConfig);
   /**
@@ -7916,7 +8253,7 @@ export declare class KyselyDocumentView extends BaseReadModel implements IDocume
    * at least the one the row already carries, so an older duplicate from a
    * sweep, boot replay or chunk interleave never rolls a scope back.
    */
-  protected commitOperations(items: OperationWithContext$1[]): Promise<void>;
+  protected commitOperations(items: OperationWithContext$1[], fenced?: Transaction<DocumentViewDatabase>): Promise<void>;
   exists(documentIds: string[], existence: DocumentExistence, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<boolean[]>;
   get<TDocument extends PHDocument>(documentId: string, view?: ViewFilter$1, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument>;
   getMany<TDocument extends PHDocument>(documentIds: string[], view?: ViewFilter$1, consistencyToken?: ConsistencyToken, signal?: AbortSignal): Promise<TDocument[]>;
@@ -8008,6 +8345,24 @@ export declare class KyselySyncHoldStorage implements ISyncHoldStorage {
   removeRemote(remoteName: string): Promise<void>;
 }
 //#endregion
+//#region src/storage/kysely/sync-purge-refusal-storage.d.ts
+export declare class KyselySyncPurgeRefusalStorage implements ISyncPurgeRefusalStorage {
+  private readonly db;
+  constructor(db: Kysely<Database$1>);
+  list(documentId: string): Promise<PurgeRefusalRecord[]>;
+  record(refusals: readonly PurgeRefusalRecord[]): Promise<void>;
+}
+//#endregion
+//#region src/storage/kysely/sync-received-marker-storage.d.ts
+export declare class KyselySyncReceivedMarkerStorage implements ISyncReceivedMarkerStorage {
+  private readonly db;
+  constructor(db: Kysely<Database$1>);
+  list(remoteName: string): Promise<ReceivedMarkerRecord[]>;
+  upsert(record: ReceivedMarkerRecord): Promise<void>;
+  remove(remoteName: string, markerId: string): Promise<void>;
+  removeRemote(remoteName: string): Promise<void>;
+}
+//#endregion
 //#region src/storage/kysely/sync-remote-storage.d.ts
 export declare class KyselySyncRemoteStorage implements ISyncRemoteStorage {
   private readonly db;
@@ -8135,6 +8490,10 @@ export declare class GqlRequestChannel implements IChannel {
   private manifestRefresh;
   /** Polled rows this reactor could not run, reported on the next poll. */
   private readonly pendingRefusals;
+  /** When each pushed, unacknowledged marker entry was last pushed. */
+  private readonly markerPushedAt;
+  /** Documents whose marker the remote refused; its report repeats per poll. */
+  private readonly refusedMarkers;
   private isRecovering;
   private connectionState;
   /** Latest unrecoverable error was an auth rejection; cleared on connect. */
@@ -8154,6 +8513,7 @@ export declare class GqlRequestChannel implements IChannel {
   lastHolderPollUtcMs(): number | undefined;
   setLocalManifest(provider: () => PeerManifest): void;
   onPeerManifest(callback: PeerManifestListener): () => void;
+  forgetMarkerRefusal(documentId: string, branch: string): void;
   private hearPeer;
   /**
    * Re-touches once when either side's manifest moved; touching is idempotent.
@@ -8195,6 +8555,8 @@ export declare class GqlRequestChannel implements IChannel {
    * Queries the remote GraphQL endpoint for sync envelopes.
    */
   private pollSyncEnvelopes;
+  /** A peer before the feature would reject the field; its refusals wait. */
+  private peerTakesMarkerRefusals;
   private rejectsAgreementFields;
   private isAgreementRejection;
   /** Resolves once what the silent peer cannot run is held. */
@@ -8223,6 +8585,10 @@ export declare class GqlRequestChannel implements IChannel {
    * ops to deadLetter.
    */
   private attemptPush;
+  /** Stops pushing a marker entry the remote refused; its wire has no op id. */
+  private retireRefusedMarkers;
+  /** Re-pushes markers unacked for retryMaxDelayMs: a restarted remote lost them. */
+  private repushUnackedMarkers;
   /**
    * Schedules a retry of all current outbox items using exponential backoff.
    */
@@ -8382,6 +8748,31 @@ export declare class IntervalPollTimer implements IPollTimer {
  */
 export declare function envelopesToSyncOperations(envelope: SyncEnvelope, remoteName: string): SyncOperation[];
 //#endregion
+//#region src/sync/delivery-tracking.d.ts
+type PendingDelivery = {
+  remote: string;
+  state: ConnectionState | "held";
+};
+/** No sync manager while sync_remotes has rows means not converged. */
+interface IDeliveryTracking {
+  /** Remotes that have not acknowledged ordinal for documentId's collections. */
+  pendingDelivery(documentId: string, ordinal: number): Promise<PendingDelivery[]>;
+}
+export declare function supportsDeliveryTracking(x: unknown): x is IDeliveryTracking;
+type DeliveryMembership = {
+  collectionId: string;
+  joinedOrdinal: number;
+  leftOrdinal: number | null;
+};
+type DeliveryRow = {
+  entry: OperationIndexEntry;
+  memberships: DeliveryMembership[];
+};
+/** The index row at an ordinal and every membership of its document. */
+type DeliveryLookup = {
+  at(documentId: string, ordinal: number): Promise<DeliveryRow | undefined>;
+};
+//#endregion
 //#region src/sync/memory-hold-storage.d.ts
 /** For a sync manager built without a database. */
 export declare class InMemorySyncHoldStorage implements ISyncHoldStorage {
@@ -8395,6 +8786,44 @@ export declare class InMemorySyncHoldStorage implements ISyncHoldStorage {
   removeRemote(remoteName: string): Promise<void>;
 }
 //#endregion
+//#region src/sync/memory-purge-refusal-storage.d.ts
+/** For a sync manager built without a database. */
+export declare class InMemorySyncPurgeRefusalStorage implements ISyncPurgeRefusalStorage {
+  private readonly records;
+  list(documentId: string): Promise<PurgeRefusalRecord[]>;
+  record(refusals: readonly PurgeRefusalRecord[]): Promise<void>;
+}
+//#endregion
+//#region src/sync/purge-refusals.d.ts
+/** The most refusals a poll reports; the rest wait for the next poll. */
+export declare const MAX_POLLED_REFUSALS = 100;
+type PolledMarkerRefusal = {
+  documentId: string;
+  branch: string;
+};
+/** Refusals are persisted before PURGE_REFUSED fires, so a restart keeps them. */
+interface IPurgeRefusalRecorder {
+  /** Rejects when the refusal was not persisted; the caller reports it again. */
+  recordPurgeRefusal(refusal: SyncPurgeRefusedEvent): Promise<void>;
+  /**
+   * A poller's marker refusals, at most {@link MAX_POLLED_REFUSALS}. Only a
+   * tombstoned document in the remote's collection was owed its marker; any
+   * other is dropped. Rejects when the refusals were not persisted.
+   */
+  recordPolledMarkerRefusals(remoteName: string, refusals: readonly PolledMarkerRefusal[]): Promise<void>;
+}
+export declare function supportsPurgeRefusals(x: unknown): x is IPurgeRefusalRecorder;
+//#endregion
+//#region src/sync/memory-received-marker-storage.d.ts
+/** For a sync manager built without a database. */
+export declare class InMemorySyncReceivedMarkerStorage implements ISyncReceivedMarkerStorage {
+  private readonly records;
+  list(remoteName: string): Promise<ReceivedMarkerRecord[]>;
+  upsert(record: ReceivedMarkerRecord): Promise<void>;
+  remove(remoteName: string, markerId: string): Promise<void>;
+  removeRemote(remoteName: string): Promise<void>;
+}
+//#endregion
 //#region src/sync/utils.d.ts
 type OperationBatch = {
   documentId: string;
@@ -8541,6 +8970,8 @@ type PendingSlot = {
   settled: Promise<void> | undefined;
 };
 type FactoryRun = () => Promise<void>;
+/** Drives a batch deletes, each with its first deletion in the batch. */
+type DriveDeletions = ReadonlyMap<string, OperationWithContext$1>;
 type ProcessorManagerOptions = {
   legacyProcessorIds?: boolean;
 };
@@ -8555,6 +8986,14 @@ export declare class ProcessorManager extends BaseReadModel implements IProcesso
   private advancing;
   private cursorWrites;
   private draining;
+  private deletedDrives;
+  private erasing;
+  private driveHeaders;
+  private headerReads;
+  private headerSlots;
+  private headerWaiters;
+  private stopped;
+  private owedFailures;
   private logger;
   private driveContainerTypes;
   private legacyProcessorIds;
@@ -8563,6 +9002,8 @@ export declare class ProcessorManager extends BaseReadModel implements IProcesso
   protected commitOperations(items: OperationWithContext$1[]): Promise<void>;
   registerFactory(identifier: string, factory: ProcessorFactory$1): Promise<void>;
   unregisterFactory(identifier: string): Promise<void>;
+  /** Closes every processor queue; the reactor's kill() calls it. */
+  shutdown(): Promise<void>;
   get(processorId: string): TrackedProcessor$1 | undefined;
   getAll(): TrackedProcessor$1[];
   /** Synchronous: reserves a slot per registered factory for each new drive. */
@@ -8570,17 +9011,50 @@ export declare class ProcessorManager extends BaseReadModel implements IProcesso
     runs: FactoryRun[];
     reserved: Set<PendingSlot>;
   };
-  /** Synchronous: drops a deleted drive's processors from the tables. */
-  protected detectDeletedDrives(items: OperationWithContext$1[]): Promise<void>[];
+  /** Synchronous: drops a deleted drive's processors; their rows stay owed. */
+  protected detectDeletedDrives(items: OperationWithContext$1[]): void;
+  /** Synchronous: a purged drive's header is erased data. */
+  private forgetPurgedHeaders;
+  /** A drive's creation header; minimal once the drive's stream is purged. */
+  private headerOf;
+  private readHeader;
+  private takeHeaderSlot;
+  private releaseHeaderSlot;
+  /** Synchronous: the known drives this batch deletes. */
+  protected findDriveDeletions(items: OperationWithContext$1[]): DriveDeletions;
   /** Synchronous: puts each processor's share of the batch on its queue. */
-  protected enqueueRouted(items: OperationWithContext$1[], reserved: ReadonlySet<PendingSlot>): Promise<void>[];
+  protected enqueueRouted(items: OperationWithContext$1[], reserved: ReadonlySet<PendingSlot>, deletions?: DriveDeletions): Promise<void>[];
+  private deliverDeletion;
+  /** A delivered deletion deletes the row; a failed one keeps it, errored. */
+  private settleErased;
+  /** Keeps a failed deletion in getAll(); retry() delivers it again. */
+  private trackOwedFailure;
+  private retryOwed;
+  /** Forgets a deleted drive once no cursor row owes its deletion. */
+  private pruneDeletedDrive;
+  /** Delivers each deleted drive's deletion its rows of `factoryId` still owe. */
+  private eraseOwed;
+  /** After any delivery of the pair's deletion in flight, if still owed. */
+  private eraseOwedDrive;
+  /** Marks the pair's deletion as being delivered until `erasure` settles. */
+  private holdErasure;
+  /** Runs `erase` unless the pair's deletion is already being delivered. */
+  private claimErasure;
+  private eraseDrive;
+  /** The deletion to each record a row owes it to, then every disconnect. */
+  private eraseRecords;
+  /** Started at routing; takes no purge lock, since processors hold none. */
+  private checkPurged;
   /** Synchronous: binds records, or discards them if the slot was cancelled. */
   protected bind(slot: PendingSlot, records: ProcessorRecord$1[] | undefined, creationOrdinal: number, creationItems: OperationWithContext$1[] | undefined): {
     persisted: Promise<void>;
     delivered: Promise<void>;
   };
-  /** Synchronous: removes a factory's slots, processors and cursor rows. */
+  /** A cancelled slot's records; on a deleted drive they pay what rows owe. */
+  private discardRecords;
+  /** Synchronous: removes a factory's slots and processors; releases its rows. */
   protected removeFactory(identifier: string): Promise<void>[];
+  private releaseCursors;
   private reserveSlot;
   private runFactory;
   private track;
@@ -8594,6 +9068,9 @@ export declare class ProcessorManager extends BaseReadModel implements IProcesso
   private allTrackedProcessors;
   private isDriveCreation;
   private discoverExistingDrives;
+  /** Cursor rows of a drive that is gone: find the deletion they still owe. */
+  private discoverDeletedDrives;
+  private discoverDeletedDrive;
   private loadAllCursors;
   private lane;
   private writeCursor;
@@ -8628,6 +9105,18 @@ export declare class ContiguousCursor {
   advance(to: number): void;
 }
 //#endregion
-export { type AbortMessage, type ActionCandidate, type ActionEvaluationConfig, type ActionEvaluations, type AdmissionDecision, type AdmissionPath, type AppendCondition, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, type BaseReadModelConfig, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type CatchUpConfig, type CatchUpConsumerStatus, type CatchUpStatus, type CatchUpSweptEvent, type CatchUpThread, type ChannelConfig, type ChannelHealth, type ChannelMeta, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, type DegradedComponent, type DocumentChangeEvent, type DocumentDecisionModel, type DocumentGraphEdge, type DocumentIndexerDatabase, type DocumentModelSource, type DocumentModelSpec, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, type Evaluation, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, type HeartbeatMessage, type HybridProjectionCoordinatorOptions, type HybridProjectionOptions, type ICatchUp, type ICatchUpConsumer, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPeerAgreement, type IPollTimer, type IProcessor, type IProcessorHostModuleBase, type IProcessorManager, type IProjectionTransport, type IQueue, type IReactor, type IReactorClient, type IReactorProcessorHostModuleBase, type IReactorSubscriptionManager, type IReadGate, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type ISettledWatermark, type IStreamStateReader, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncHoldStorage, type ISyncManager, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, type Job, type JobAvailableEvent, type JobCompletedEvent, type JobExecutorConfig, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobResultSummary, type JobRunningEvent, type JobStartedEvent, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, type LoadJobPlan, type LoadModelMessage, type LocalPeer, type LogMessage, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, type ModuleRef, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, type OutOfOrderPair, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, type ParsedSnapshot, type PeerAgreementBasis, type PoolInstrumentation, type PoolStats, type ProbeReading, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardHooks, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, type ProtocolSelection, type ReactorClientModule, type ReactorFeatureFlags, type ReactorFeatures, type ReactorHostModuleBaseOptions, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, type ReactorReadModels, type ReadGateOptions, type ReadModelBatchCompletedEvent, type ReadModelCoordinatorFactory, type ReadModelCoordinatorFactoryDeps, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingConfig, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type RegisteredDecisionModel, RelationalDbProcessor, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemotePeer, type RemoteRecord, type RemoteStatus, type ResultMessage, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureRefusalCode, type SignatureRefusedEvent, type SignatureScheme, type SignatureTrustPolicy, type SignatureVerificationHandler, type SignatureVerificationMode, type SignerConfig, type SnapshotFunctions, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubjectScopePredicate, type SubmittedActionResult, type SubscriptionErrorContext, type SweepBlockedAt, type SweepResult, type SyncEnvelope, type SyncEnvelopeType, type SyncFailedEvent, type SyncHeldEvent, type SyncHold, type SyncHoldRecord, type SyncModule, type SyncOperationErrorType, type SyncPendingEvent, type SyncReleasedEvent, type SyncStatusChangeCallback, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type UnsupportedStoredDocuments, type ValidationResult, type VerificationTarget, type ViewFilter, type WatermarkProbe, type WatermarkStatus, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, createRelationalDb, documentActions };
+//#region src/storage/kysely/document-purges.d.ts
+/** Class key of every purge lock; the stream locks use the single-key space. */
+export declare const PURGE_NS = 1347571013;
+/** Ids share this many lock keys, so a job's lock count stays bounded. */
+export declare const PURGE_LOCK_BUCKETS = 1024;
+type PurgeLockMode = "shared" | "exclusive";
+export declare function acquirePurgeLocks(trx: Transaction<any>, ids: Iterable<string>, mode: PurgeLockMode): Promise<void>;
+/** The ids among `ids` that have a tombstone, read in the handle's schema. */
+export declare function findPurged(db: Kysely<any>, ids: Iterable<string>): Promise<Set<string>>;
+/** Every tombstoned id, read in the handle's schema. */
+export declare function listPurged(db: Kysely<any>): Promise<string[]>;
+//#endregion
+export { type AbortMessage, type ActionCandidate, type ActionEvaluationConfig, type ActionEvaluations, type AdmissionDecision, type AdmissionPath, type AppendCondition, type AppendConditionStream, type AtomicTxn, type AttachmentHash, type AttachmentRef, type AuthDecisionModel, type BaseReadModelConfig, type BatchExecutionRequest, type BatchExecutionResult, type BatchLoadRequest, type BatchLoadResult, type BuiltDecisionModel, type BuiltInReadModelKind, type CachedSnapshot, type CatchUpConfig, type CatchUpConsumerStatus, type CatchUpStatus, type CatchUpSweptEvent, type CatchUpThread, type ChannelConfig, type ChannelHealth, type ChannelMeta, type CollectionMember, type ConnectionState, type ConnectionStateChangeCallback, type ConnectionStateChangedEvent, type ConnectionStateSnapshot, type ConsistencyCoordinate, type ConsistencyKey, type ConsistencyToken, type Database, type DbConfig, type DeadLetterAddedEvent, type DecisionContext, type DecisionModel, type DecisionTarget, type DegradedComponent, type DeliveryLookup, type DeliveryMembership, type DeliveryRow, type DocumentChangeEvent, type DocumentDecisionModel, type DocumentDeletedInfo, type DocumentGraphEdge, type DocumentIndexerDatabase, type DocumentModelSource, type DocumentModelSpec, type DocumentPurgeRow, type DocumentRelationship, type DocumentRevisions, type DocumentStreamKey, type DocumentViewDatabase, type EnqueuePurgeOptions, type Evaluation, type ExecuteMessage, type ExecutionJobPlan, type ExecutorStartedEvent, type ExecutorStoppedEvent, type FactorySpec, type FileModelSource, type GqlChannelConfig, type HeartbeatMessage, type HybridProjectionCoordinatorOptions, type HybridProjectionOptions, type ICatchUp, type ICatchUpConsumer, type IChannel, type IChannelFactory, type IConsistencyTracker, type IDeliveryTracking, type IDocumentGraph, type IDocumentIndexer, type IDocumentIntegrityService, type IDocumentModelLoader, type IDocumentModelRegistry, type IDocumentModelResolver, type IDocumentView, type IDriveClient, type IEventBus, type IJobAwaiter, type IJobExecutor, type IJobExecutorManager, type IJobTracker, type IKeyframeStore, type ILiveReadModelCoordinator, type IMailbox, type IOperationIndex, type IOperationStore, type IPeerAgreement, type IPollTimer, type IProcessor, type IProcessorHostModuleBase, type IProcessorManager, type IProjectionTransport, type IPurgeRefusalRecorder, type IQueue, type IReactor, type IReactorClient, type IReactorProcessorHostModuleBase, type IReactorSubscriptionManager, type IReadGate, type IReadModel, type IReadModelCoordinator, type IRelationalDb, type ISettledWatermark, type IStreamStateReader, type ISubscriptionErrorHandler, type ISyncCursorStorage, type ISyncHoldStorage, type ISyncManager, type ISyncPurgeRefusalStorage, type ISyncReceivedMarkerStorage, type ISyncRemoteStorage, type ISyncStatusTracker, type IWriteCache, SimpleJobExecutor as InMemoryJobExecutor, type InProcessReactorClientModule, type InProcessReactorModule, type InProcessSyncModule, type InitMessage, type InsertableDocumentSnapshot, type Job, type JobAvailableEvent, type JobCompletedEvent, type JobExecutorConfig, type JobExecutorFactory, type JobFailedEvent, type JobInfo, type JobKind, type JobPendingEvent, type JobReadReadyEvent, type JobResult, type JobResultSummary, type JobRunningEvent, type JobStartedEvent, type JobWriteReadyEvent, type JobWriteReadyPayload, type JwtHandler, type KeyframeSnapshot, type KeyframeValidationIssue, type LoadJobPlan, type LoadModelMessage, type LocalPeer, type LogMessage, type MetricsMessage, type ModelLoadFailedMessage, type ModelLoadedEvent, type ModelLoadedMessage, type ModelManifestEntry, type ModuleRef, type OperationBatch, type OperationContext, type OperationFilter, type OperationIndexEntry, type OperationTable, type OperationWithContext, type OutOfOrderPair, PURGE_DOCUMENT, type PackageModelSource, type PagedResults, type PagingOptions, type ParentMessage, type ParsedDriveUrl, type ParsedPaging, type ParsedSnapshot, type PeerAgreementBasis, type PendingDelivery, type PolledMarkerRefusal, type PoolInstrumentation, type PoolStats, type ProbeReading, type ProcessorApp, type ProcessorFactory, type ProcessorFactoryBuilder, type ProcessorFilter, type ProcessorRecord, type ProcessorStatus, type Projection, type ProjectionShardBuilderConfig, type ProjectionShardHooks, type ProjectionShardManagerConfig, type ProjectionWorkerFactory, type ProtocolSelection, type PurgeDocumentAction, type PurgeDocumentActionInput, type PurgeFence, type PurgeJobOptions, type PurgeLockMode, type PurgeLookup, type PurgeMarkerContext, type PurgeMarkerOperation, type PurgeRefusalRecord, type PurgeRemovedRows, type PurgeStream, type ReactorClientModule, type ReactorFeatureFlags, type ReactorFeatures, type ReactorHostModuleBaseOptions, type JobFailedEvent$1 as ReactorJobFailedEvent, type ReactorModule, type ReactorReadModels, type ReadGateOptions, type ReadModelBatchCompletedEvent, type ReadModelCoordinatorFactory, type ReadModelCoordinatorFactoryDeps, type ReadModelFactory, type ReadModelFactoryDeps, type ReadModelIndexedEvent, type ReadModelIndexingConfig, type ReadModelIndexingStage, type ReadModelRegistrationStage, type ReadModelStage, type ReadyMessage, type RebuildResult, type ReceivedMarkerRecord, type RegisteredDecisionModel, RelationalDbProcessor, type Remote, type RemoteCursor, type RemoteFilter, type RemoteMeta, type RemoteOptions, type RemotePeer, type RemoteRecord, type RemoteStatus, type ResultMessage, type SanitizedArg, type SearchFilter, type ShutdownMessage, type ShutdownStatus, type SignatureRefusalCode, type SignatureRefusedEvent, type SignatureScheme, type SignatureTrustPolicy, type SignatureVerificationHandler, type SignatureVerificationMode, type SignerConfig, type SnapshotFunctions, type SnapshotValidationIssue, type Database$1 as StorageDatabase, type StreamOrderIssue, type StreamQuery, type SubjectScopePredicate, type SubmittedActionResult, type SubscriptionErrorContext, type SweepBlockedAt, type SweepResult, type SyncEnvelope, type SyncEnvelopeType, type SyncFailedEvent, type SyncHeldEvent, type SyncHold, type SyncHoldRecord, type SyncModule, type SyncOperationErrorType, type SyncPendingEvent, type SyncPurgeRefusedEvent, type SyncReleasedEvent, type SyncStatusChangeCallback, type SyncSucceededEvent, type TrackedProcessor, type Unsubscribe, type UnsupportedStoredDocuments, type ValidationResult, type VerificationTarget, type ViewFilter, type WatermarkProbe, type WatermarkStatus, type ErrorInfo as WorkerErrorInfo, type WorkerMessage, type WorkerPoolConfig, type WorkerPoolOptions, type WriteCacheConfig, createRelationalDb, documentActions, isPurgeMarker };
 export {};
 //# sourceMappingURL=index.d.ts.map