@powerhousedao/reactor 6.2.3-dev.34 → 6.2.3-dev.36

package/dist/index.js

@@ -1,7 +1,7 @@
-import { $ as OptimisticLockError, A as DEFAULT_DEFERRED_JOB_TTL_MS, B as summarizeSubmittedActions, C as SettledWatermark, D as snapshotFunctionsFor, E as parseSnapshot, F as ModuleNotFoundError, G as authDecisionModel, H as decideAtHead, I as GATED_DOCUMENT_ACTIONS, J as APPEND_CONDITION_FAILED_PREFIX, K as buildDecisionModel, L as createConsistencyToken, M as DuplicateManifestError, N as DuplicateModuleError, O as DocumentMetaCache, P as InvalidModuleError, Q as DuplicateOperationError, R as createEmptyConsistencyToken, S as ProbeSettler, T as describeWaitingSessions, U as selectDecisionModel, V as targetDocumentId, W as documentDecisionModel, X as DocumentAlreadyExistsError, Y as AppendConditionFailedError, Z as DocumentExistence, _ as KyselyExecutionScope, _t as throwIfAborted, a as DEFAULT_DRIVE_CONTAINER_TYPES, at as DocumentNotFoundError, b as KyselyWriteCache, c as runMigrations, ct as InvalidSignatureError, d as KyselyOperationStore, dt as UnsupportedStoredProtocolError, et as RevisionMismatchError, f as KyselyKeyframeStore, ft as UpgradePreconditionFailedError, g as PassthroughSigner, gt as parsePagingOptions, h as verifyActionSignature, ht as matchesScope, it as DocumentDeletedError, j as JobExecutorEventTypes, k as CollectionMembershipCache, l as createForwardingPoolInstrumentation, lt as RelationshipNotFoundError, m as SimpleJobExecutor, mt as ReactorEventTypes, n as errorToInfo, nt as AuthTimestampNotMonotonicError, o as REACTOR_SCHEMA, ot as ExcessiveReshuffleError, p as DocumentModelRegistry, pt as EventBusAggregateError, q as DriveCollectionId, r as sanitizeArg, rt as AuthorizationDeniedError, s as getMigrationStatus, st as InvalidOperationTimestampError, t as createForwardingLogger, tt as AuthEnforcementDisabledError, u as instrumentPgPool, ut as UnsupportedProtocolVersionError, v as resolveFeatureFlags, w as createKyselyWatermarkProbe, x as KyselyOperationIndex, y as EventBus, yt as __exportAll, z as submittedActionIds } from "./forwarding-logger-BkwlvD9W.js";
+import { $ as selectDecisionModel, A as ProbeSettler, At as matchesScope, B as JobExecutorEventTypes, C as KyselyWriteCache, Ct as RelationshipNotFoundError, D as acquirePurgeLocks, Dt as UpgradePreconditionFailedError, E as PURGE_NS, Et as UnsupportedStoredProtocolError, F as snapshotFunctionsFor, G as GATED_DOCUMENT_ACTIONS, H as DuplicateModuleError, I as DocumentMetaCache, J as createEmptyConsistencyToken, K as createConsistencyToken, L as CollectionMembershipCache, M as createKyselyWatermarkProbe, Mt as throwIfAborted, N as describeWaitingSessions, O as findPurged, Ot as EventBusAggregateError, P as parseSnapshot, Pt as __exportAll, Q as decideAtHead, R as DEFAULT_DEFERRED_JOB_TTL_MS, S as EventBus, St as PurgeTooLargeError, T as PURGE_LOCK_BUCKETS, Tt as UnsupportedProtocolVersionError, U as InvalidModuleError, V as DuplicateManifestError, W as ModuleNotFoundError, X as summarizeSubmittedActions, Y as submittedActionIds, Z as targetDocumentId, _ as KyselyExecutionScope, _t as DocumentPurgedError, a as DEFAULT_DRIVE_CONTAINER_TYPES, at as AppendConditionFailedError, b as appliedDelete, bt as InvalidOperationTimestampError, c as runMigrations, ct as DuplicateOperationError, d as KyselyOperationStore, dt as AuthEnforcementDisabledError, et as documentDecisionModel, f as KyselyKeyframeStore, ft as AuthTimestampNotMonotonicError, g as PassthroughSigner, gt as DocumentNotFoundError, h as verifyActionSignature, ht as DocumentNotDeletedError, it as APPEND_CONDITION_FAILED_PREFIX, j as SettledWatermark, jt as parsePagingOptions, k as listPurged, kt as ReactorEventTypes, l as createForwardingPoolInstrumentation, lt as OptimisticLockError, m as SimpleJobExecutor, mt as DocumentDeletedError, n as errorToInfo, nt as buildDecisionModel, o as REACTOR_SCHEMA, ot as DocumentAlreadyExistsError, p as DocumentModelRegistry, pt as AuthorizationDeniedError, q as createDocumentFromAction, r as sanitizeArg, rt as DriveCollectionId, s as getMigrationStatus, st as DocumentExistence, t as createForwardingLogger, tt as authDecisionModel, u as instrumentPgPool, ut as RevisionMismatchError, v as DEFAULT_PURGE_DELETE_BATCH, vt as ExcessiveReshuffleError, w as KyselyOperationIndex, wt as ReservedActionError, x as resolveFeatureFlags, xt as InvalidSignatureError, y as KyselyDocumentPurger, yt as GroupInUseError, z as DEFAULT_MAX_PURGE_OPERATIONS } from "./forwarding-logger-DMqDs9tE.js";
 import { i as WorkerInitFailedError, r as WorkerExitedError, t as WorkerAbortTimeoutError } from "./errors-BM_ULVWd.js";
-import { _ as ContiguousCursor, a as KyselyDocumentView, b as isCatchUpConsumer, c as ReadModelCoordinator, d as reserveBatch, f as BaseReadModel, g as unchunkedReadModelIndexingConfig, h as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as indexReserved, m as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as DEFAULT_COMMIT_CHUNK_SIZE, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as releaseBatch, v as defaultCatchUpConfig, y as CatchUpScheduler } from "./document-indexer-I6i_YzsR.js";
-import { DEFAULT_SIGNATURE_POLICY, DowngradeNotSupportedError, MAX_AUTH_GRANTS, PEER_CAPABILITIES, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, canonicalJson, coversLocal, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, holdReason, isOlderManifest, legacySupports, localPeerManifest, localSupports, mergePeerCapabilities, normalizeDocumentModelVersion, peerSupports, readPeerManifest, requestedSignaturePolicy, selectProtocolVersions, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
+import { _ as ContiguousCursor, a as KyselyDocumentView, b as isCatchUpConsumer, c as ReadModelCoordinator, d as reserveBatch, f as BaseReadModel, g as unchunkedReadModelIndexingConfig, h as defaultReadModelIndexingConfig, i as DeletedDocumentRead, l as indexReserved, m as DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, n as ConsistencyTracker, o as DOCUMENT_INDEXER_READ_MODEL, p as DEFAULT_COMMIT_CHUNK_SIZE, r as makeConsistencyKey, s as DOCUMENT_VIEW_READ_MODEL, t as KyselyDocumentIndexer, u as releaseBatch, v as defaultCatchUpConfig, y as CatchUpScheduler } from "./document-indexer-CZqIpdz2.js";
+import { DEFAULT_SIGNATURE_POLICY, DOCUMENT_PURGE_PROTOCOL, DowngradeNotSupportedError, MARKER_REFUSAL_FEATURE, MAX_AUTH_GRANTS, PEER_CAPABILITIES, PURGE_DOCUMENT, UnsupportedDocumentModelVersionError, actionSignerIdentity, actionSigningTarget, actions, actions as documentActions, canonicalJson, coversLocal, createCopyHeader, decide, deserializeSignature, garbageCollect, generateId, groupDocumentType, groupMembershipActionTypes, hashDocumentStateForScope, holdReason, isOlderManifest, isPurgeMarker, isPurgeMarker as isPurgeMarker$1, legacySupports, localPeerManifest, localSupports, mergePeerCapabilities, normalizeDocumentModelVersion, peerSupports, purgedProtocolVersions, readPeerManifest, requestedSignaturePolicy, selectProtocolVersions, sortOperations, toTransportAction, withSignaturePolicy } from "@powerhousedao/shared/document-model";
 import { addFile, addFolder, copyNode, deleteNode, driveCreateDocument, generateNodesCopy, getDescendants, handleTargetNameCollisions, isFileNode, isFolderNode, moveNode, updateNode } from "@powerhousedao/shared/document-drive";
 import { v4 } from "uuid";
 import { ConsoleLogger, childLogger } from "document-model";
@@ -326,11 +326,13 @@ var DriveClient = class {
 	logger;
 	reactor;
 	signer;
-	constructor(client, logger, reactor, signer) {
+	resolveReference;
+	constructor(client, logger, reactor, signer, resolveReference) {
 		this.client = client;
 		this.logger = logger;
 		this.reactor = reactor;
 		this.signer = signer;
+		this.resolveReference = resolveReference;
 	}
 	async create(input, signal) {
 		this.logger.verbose("drives.create(@input)", input);
@@ -351,6 +353,7 @@ var DriveClient = class {
 	async addFile(driveIdentifier, document, parentFolder, signal) {
 		this.logger.verbose("drives.addFile(@driveIdentifier, @document, @parentFolder)", driveIdentifier, document.header.id, parentFolder);
 		const documentId = document.header.id;
+		const driveId = await this.resolveReference(driveIdentifier, signal);
 		const createInput = {
 			model: document.header.documentType,
 			version: 0,
@@ -377,7 +380,7 @@ var DriveClient = class {
 				toVersion: normalizeDocumentModelVersion(document.state.document?.version),
 				initialState: document.state
 			}),
-			addRelationshipAction(driveIdentifier, documentId, "child")
+			addRelationshipAction(driveId, documentId, "child")
 		], this.signer, {
 			documentId,
 			branch: "main"
@@ -388,7 +391,7 @@ var DriveClient = class {
 			documentType: document.header.documentType,
 			parentFolder
 		})], this.signer, {
-			documentId: driveIdentifier,
+			documentId: driveId,
 			branch: "main"
 		}, signal);
 		await this.runJobs([{
@@ -401,7 +404,7 @@ var DriveClient = class {
 		}], signal);
 		await this.runJobs([{
 			key: "drive",
-			documentId: driveIdentifier,
+			documentId: driveId,
 			scope: getSharedActionScope(driveActions),
 			branch: "main",
 			actions: driveActions,
@@ -420,22 +423,24 @@ var DriveClient = class {
 		if (!node || !isFolderNode(node)) throw new Error("Folder creation failed");
 		return node;
 	}
-	async removeNode(driveIdentifier, nodeId, signal) {
-		this.logger.verbose("drives.removeNode(@driveIdentifier, @nodeId)", driveIdentifier, nodeId);
-		const drive = await this.client.get(driveIdentifier, void 0, signal);
+	async removeNode(driveIdentifier, nodeIdentifier, signal) {
+		this.logger.verbose("drives.removeNode(@driveIdentifier, @nodeIdentifier)", driveIdentifier, nodeIdentifier);
+		const driveId = await this.resolveReference(driveIdentifier, signal);
+		const nodeId = await this.resolveReference(nodeIdentifier, signal);
+		const drive = await this.client.get(driveId, void 0, signal);
 		const node = drive.state.global.nodes.find((n) => n.id === nodeId);
 		if (!node) {
 			if (!await this.documentExists(nodeId, signal)) throw new Error(`Node ${nodeId} not found in drive ${driveIdentifier}`);
-			await this.removeFileNode(driveIdentifier, nodeId, signal);
+			await this.removeFileNode(driveId, nodeId, signal);
 			return;
 		}
 		if (isFolderNode(node)) {
 			const fileDescendants = getDescendants(node, drive.state.global.nodes).filter(isFileNode);
-			for (const file of fileDescendants) await this.removeFileNode(driveIdentifier, file.id, signal);
-			await this.client.execute(driveIdentifier, "main", [deleteNode({ id: nodeId })], signal);
+			for (const file of fileDescendants) await this.removeFileNode(driveId, file.id, signal);
+			await this.client.execute(driveId, "main", [deleteNode({ id: nodeId })], signal);
 			return;
 		}
-		await this.removeFileNode(driveIdentifier, nodeId, signal);
+		await this.removeFileNode(driveId, nodeId, signal);
 	}
 	async renameNode(driveIdentifier, nodeId, name, signal) {
 		this.logger.verbose("drives.renameNode(@driveIdentifier, @nodeId, @name)", driveIdentifier, nodeId, name);
@@ -546,34 +551,41 @@ var DriveClient = class {
 		}
 	}
 	async removeFileNode(driveId, fileId, signal) {
-		const relationshipActions = await signActions([removeRelationshipAction(driveId, fileId, "child")], this.signer, {
+		const driveActions = await signActions([deleteNode({ id: fileId })], this.signer, {
 			documentId: driveId,
 			branch: "main"
 		}, signal);
-		const driveActions = await signActions([deleteNode({ id: fileId })], this.signer, {
+		await this.runJobs([{
+			key: "drive",
 			documentId: driveId,
+			scope: getSharedActionScope(driveActions),
+			branch: "main",
+			actions: driveActions,
+			dependsOn: []
+		}], signal);
+		const deleteActions = await signActions([deleteDocumentAction(fileId)], this.signer, {
+			documentId: fileId,
 			branch: "main"
 		}, signal);
-		const batchResult = await this.reactor.executeBatch({ jobs: [{
-			key: "relationship",
+		const relationshipActions = await signActions([removeRelationshipAction(driveId, fileId, "child")], this.signer, {
 			documentId: driveId,
-			scope: getSharedActionScope(relationshipActions),
+			branch: "main"
+		}, signal);
+		await this.runJobs([{
+			key: "delete",
+			documentId: fileId,
+			scope: getSharedActionScope(deleteActions),
 			branch: "main",
-			actions: relationshipActions,
+			actions: deleteActions,
 			dependsOn: []
 		}, {
-			key: "drive",
+			key: "relationship",
 			documentId: driveId,
-			scope: getSharedActionScope(driveActions),
+			scope: getSharedActionScope(relationshipActions),
 			branch: "main",
-			actions: driveActions,
-			dependsOn: ["relationship"]
-		}] }, signal);
-		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.client.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === "FAILED") throw new Error(job.error?.message);
-		const deleteJob = await this.reactor.deleteDocument(fileId, this.signer, signal);
-		const deleteCompleted = await this.client.waitForJob(deleteJob, signal);
-		if (deleteCompleted.status === "FAILED") throw new Error(deleteCompleted.error?.message);
+			actions: relationshipActions,
+			dependsOn: ["delete"]
+		}], signal);
 	}
 };
 //#endregion
@@ -849,8 +861,8 @@ var BareReadGate = class {
 	}
 };
 /**
-* Rethrows a failed read unless the document is confirmed not live. The read
-* side reports absence as a plain Error, so absence is checked rather than
+* Rethrows a failed read unless the document is confirmed not live. Any error
+* other than DocumentNotFoundError is checked against `exists` rather than
 * inferred from the message, and a failed check surfaces the read's own error.
 */
 async function assertAbsent(documentView, documentId, error, signal) {
@@ -885,7 +897,7 @@ var SeededStateReader = class {
 	* A stream this replica does not hold has to reach buildDecisionModel as the
 	* absence it recognises, or the whole read fails instead of leaving the group
 	* out of the model, where its principal does not match and the policy fails
-	* closed. The read side reports absence as a plain Error, so the absence is
+	* closed. An error other than DocumentNotFoundError has its absence
 	* confirmed rather than inferred from the message: a transient failure must
 	* surface, not silently deny.
 	*/
@@ -1203,6 +1215,9 @@ function keepReadableScopes(scopes, readable) {
 }
 //#endregion
 //#region src/client/reactor-client.ts
+function deletePlanKey(documentId) {
+	return `delete:${documentId}`;
+}
 /**
 * The document a candidate is decided against. Routed on the action type alone,
 * which is what the executor routes on: every action the reactor reduces onto
@@ -1275,7 +1290,7 @@ var ReactorClient = class {
 		this.eventReads = new EventReadsSource(reactor, documentView, readGate);
 		this.actionEvaluation = actionEvaluation;
 		this.createSignaturePolicy = createSignaturePolicy;
-		this.drives = new DriveClient(this, logger, reactor, signer);
+		this.drives = new DriveClient(this, logger, reactor, signer, (id, signal) => this.resolveReference(id, "main", signal));
 		this.logger.verbose("ReactorClient initialized");
 	}
 	/**
@@ -1523,8 +1538,23 @@ var ReactorClient = class {
 	*/
 	async create(document, parentIdentifier, signal) {
 		this.logger.verbose("create(@id, @parentIdentifier)", document.header.id, parentIdentifier);
+		const batchResult = await this.submitCreate(document, parentIdentifier, signal);
+		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
+		for (const job of completedJobs) if (job.status === "FAILED") throw new Error(job.error?.message);
+		const created = await this.reactor.get(document.header.id);
+		return this.gateDocument(created, void 0, signal);
+	}
+	/**
+	* Submits a document's create batch without waiting for it
+	*/
+	async createAsync(document, parentIdentifier, signal) {
+		this.logger.verbose("createAsync(@id, @parentIdentifier)", document.header.id, parentIdentifier);
+		return this.submitCreate(document, parentIdentifier, signal);
+	}
+	async submitCreate(document, parentIdentifier, signal) {
 		const documentId = document.header.id;
 		const branch = document.header.branch || "main";
+		const parentId = parentIdentifier ? await this.resolveReference(parentIdentifier, "main", signal) : void 0;
 		const createInput = {
 			model: document.header.documentType,
 			version: 0,
@@ -1560,31 +1590,39 @@ var ReactorClient = class {
 			actions: createActions,
 			dependsOn: []
 		}];
-		if (parentIdentifier) {
-			const parentActions = await signActions([addRelationshipAction(parentIdentifier, documentId, "child")], this.signer, {
-				documentId: parentIdentifier,
+		if (parentId) {
+			const parentActions = await signActions([addRelationshipAction(parentId, documentId, "child")], this.signer, {
+				documentId: parentId,
 				branch: "main"
 			}, signal);
 			jobs.push({
 				key: "parent",
-				documentId: parentIdentifier,
+				documentId: parentId,
 				scope: getSharedActionScope(parentActions),
 				branch: "main",
 				actions: parentActions,
 				dependsOn: ["create"]
 			});
 		}
-		const batchResult = await this.reactor.executeBatch({ jobs }, signal);
-		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
-		for (const job of completedJobs) if (job.status === "FAILED") throw new Error(job.error?.message);
-		const created = await this.reactor.get(documentId);
-		return this.gateDocument(created, void 0, signal);
+		return this.reactor.executeBatch({ jobs }, signal);
 	}
 	/**
 	* Creates an empty document and waits for completion
 	*/
 	async createEmpty(documentModelType, options, signal) {
 		this.logger.verbose("createEmpty(@documentModelType, @options)", documentModelType, options);
+		const document = await this.emptyDocument(documentModelType, options, signal);
+		return this.create(document, options?.parentIdentifier, signal);
+	}
+	/**
+	* Submits an empty document's create batch without waiting for it
+	*/
+	async createEmptyAsync(documentModelType, options, signal) {
+		this.logger.verbose("createEmptyAsync(@documentModelType, @options)", documentModelType, options);
+		const document = await this.emptyDocument(documentModelType, options, signal);
+		return this.submitCreate(document, options?.parentIdentifier, signal);
+	}
+	async emptyDocument(documentModelType, options, signal) {
 		const matchingModules = (await this.reactor.getDocumentModels(void 0, void 0, signal)).results.filter((m) => m.documentModel.global.id === documentModelType);
 		let module;
 		if (options?.documentModelVersion !== void 0) {
@@ -1604,7 +1642,7 @@ var ReactorClient = class {
 			...options?.protocolVersions
 		} });
 		document.state.document.version = normalizeDocumentModelVersion(module.version);
-		return this.create(document, options?.parentIdentifier, signal);
+		return document;
 	}
 	/**
 	* Upgrades a document to a newer document model version by dispatching an
@@ -1739,10 +1777,12 @@ var ReactorClient = class {
 	*/
 	async addRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch = "main", signal) {
 		this.logger.verbose("addRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @metadata, @branch)", sourceIdentifier, targetIdentifier, relationshipType, metadata, branch);
-		const jobInfo = await this.reactor.addRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
+		const sourceId = await this.resolveReference(sourceIdentifier, branch, signal);
+		const targetId = await this.resolveReference(targetIdentifier, branch, signal);
+		const jobInfo = await this.reactor.addRelationship(sourceId, targetId, relationshipType, metadata, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
-		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		const result = await this.reactor.getByIdOrSlug(sourceId, { branch }, completedJob.consistencyToken, signal);
 		return this.gateDocument(result, { branch }, signal);
 	}
 	/**
@@ -1750,11 +1790,13 @@ var ReactorClient = class {
 	*/
 	async updateRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch = "main", signal) {
 		this.logger.verbose("updateRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @metadata, @branch)", sourceIdentifier, targetIdentifier, relationshipType, metadata, branch);
-		if (!await this.readRelationshipEdge(sourceIdentifier, targetIdentifier, relationshipType, { branch }, signal)) throw new RelationshipNotFoundError(sourceIdentifier, targetIdentifier, relationshipType);
-		const jobInfo = await this.reactor.updateRelationship(sourceIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
+		const sourceId = await this.resolveReference(sourceIdentifier, branch, signal);
+		const targetId = await this.resolveReference(targetIdentifier, branch, signal);
+		if (!await this.readRelationshipEdge(sourceId, targetId, relationshipType, { branch }, signal)) throw new RelationshipNotFoundError(sourceIdentifier, targetIdentifier, relationshipType);
+		const jobInfo = await this.reactor.updateRelationship(sourceId, targetId, relationshipType, metadata, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
-		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		const result = await this.reactor.getByIdOrSlug(sourceId, { branch }, completedJob.consistencyToken, signal);
 		return this.gateDocument(result, { branch }, signal);
 	}
 	/**
@@ -1762,10 +1804,12 @@ var ReactorClient = class {
 	*/
 	async removeRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch = "main", signal) {
 		this.logger.verbose("removeRelationship(@sourceIdentifier, @targetIdentifier, @relationshipType, @branch)", sourceIdentifier, targetIdentifier, relationshipType, branch);
-		const jobInfo = await this.reactor.removeRelationship(sourceIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
+		const sourceId = await this.resolveReference(sourceIdentifier, branch, signal);
+		const targetId = await this.resolveReference(targetIdentifier, branch, signal);
+		const jobInfo = await this.reactor.removeRelationship(sourceId, targetId, relationshipType, branch, this.signer, signal);
 		const completedJob = await this.waitForJob(jobInfo, signal);
 		if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
-		const result = await this.reactor.getByIdOrSlug(sourceIdentifier, { branch }, completedJob.consistencyToken, signal);
+		const result = await this.reactor.getByIdOrSlug(sourceId, { branch }, completedJob.consistencyToken, signal);
 		return this.gateDocument(result, { branch }, signal);
 	}
 	/**
@@ -1773,15 +1817,18 @@ var ReactorClient = class {
 	*/
 	async moveRelationship(sourceParentIdentifier, targetParentIdentifier, targetIdentifier, relationshipType, branch = "main", signal) {
 		this.logger.verbose("moveRelationship(@sourceParentIdentifier, @targetParentIdentifier, @targetIdentifier, @relationshipType, @branch)", sourceParentIdentifier, targetParentIdentifier, targetIdentifier, relationshipType, branch);
-		const metadata = (await this.readRelationshipEdge(sourceParentIdentifier, targetIdentifier, relationshipType, { branch }, signal))?.metadata;
-		const removeJobInfo = await this.reactor.removeRelationship(sourceParentIdentifier, targetIdentifier, relationshipType, branch, this.signer, signal);
+		const sourceParentId = await this.resolveReference(sourceParentIdentifier, branch, signal);
+		const targetParentId = await this.resolveReference(targetParentIdentifier, branch, signal);
+		const targetId = await this.resolveReference(targetIdentifier, branch, signal);
+		const metadata = (await this.readRelationshipEdge(sourceParentId, targetId, relationshipType, { branch }, signal))?.metadata;
+		const removeJobInfo = await this.reactor.removeRelationship(sourceParentId, targetId, relationshipType, branch, this.signer, signal);
 		const removeCompletedJob = await this.waitForJob(removeJobInfo, signal);
 		if (removeCompletedJob.status === "FAILED") throw new Error(removeCompletedJob.error?.message);
-		const addJobInfo = await this.reactor.addRelationship(targetParentIdentifier, targetIdentifier, relationshipType, metadata, branch, this.signer, signal);
+		const addJobInfo = await this.reactor.addRelationship(targetParentId, targetId, relationshipType, metadata, branch, this.signer, signal);
 		const addCompletedJob = await this.waitForJob(addJobInfo, signal);
 		if (addCompletedJob.status === "FAILED") throw new Error(addCompletedJob.error?.message);
-		const sourceResult = await this.reactor.getByIdOrSlug(sourceParentIdentifier, { branch }, removeCompletedJob.consistencyToken, signal);
-		const targetResult = await this.reactor.getByIdOrSlug(targetParentIdentifier, { branch }, addCompletedJob.consistencyToken, signal);
+		const sourceResult = await this.reactor.getByIdOrSlug(sourceParentId, { branch }, removeCompletedJob.consistencyToken, signal);
+		const targetResult = await this.reactor.getByIdOrSlug(targetParentId, { branch }, addCompletedJob.consistencyToken, signal);
 		return {
 			source: await this.gateDocument(sourceResult, { branch }, signal),
 			target: await this.gateDocument(targetResult, { branch }, signal)
@@ -1801,9 +1848,9 @@ var ReactorClient = class {
 	*/
 	async deleteDocument(identifier, propagate, signal) {
 		this.logger.verbose("deleteDocument(@identifier, @propagate)", identifier, propagate);
-		const jobs = [];
+		const rootId = await this.resolveReference(identifier, "main", signal);
+		const toDelete = /* @__PURE__ */ new Set([rootId]);
 		if (propagate === "cascade") {
-			const toDelete = /* @__PURE__ */ new Set([identifier]);
 			let changed = true;
 			while (changed) {
 				if (signal?.aborted) throw new Error("Operation aborted");
@@ -1814,19 +1861,33 @@ var ReactorClient = class {
 					changed = true;
 				}
 			}
-			for (const descendantId of toDelete) {
-				if (descendantId === identifier) continue;
-				const removalJobs = await this.removeAllIncomingRelationships(descendantId, signal);
-				jobs.push(...removalJobs);
-				const jobInfo = await this.reactor.deleteDocument(descendantId, this.signer, signal);
-				jobs.push(jobInfo);
-			}
 		}
-		const removalJobs = await this.removeAllIncomingRelationships(identifier, signal);
-		jobs.push(...removalJobs);
-		const jobInfo = await this.reactor.deleteDocument(identifier, this.signer, signal);
-		jobs.push(jobInfo);
-		const completedJobs = await Promise.all(jobs.map((job) => this.waitForJob(job, signal)));
+		const order = [...toDelete].reverse();
+		const position = new Map(order.map((id, index) => [id, index]));
+		const incoming = /* @__PURE__ */ new Map();
+		for (const documentId of order) {
+			const page = await this.documentIndexer.getIncoming(documentId, void 0, void 0, void 0, signal);
+			incoming.set(documentId, page.results);
+		}
+		const waitsForTarget = (rel) => {
+			const source = position.get(rel.sourceId);
+			return source === void 0 || source > position.get(rel.targetId);
+		};
+		const leadingBySource = /* @__PURE__ */ new Map();
+		for (const rels of incoming.values()) for (const rel of rels) {
+			if (waitsForTarget(rel)) continue;
+			const leading = leadingBySource.get(rel.sourceId) ?? [];
+			leading.push(rel);
+			leadingBySource.set(rel.sourceId, leading);
+		}
+		const plans = [];
+		for (const documentId of order) {
+			for (const rel of leadingBySource.get(documentId) ?? []) plans.push(await this.planRemoval(rel, [], plans.length, signal));
+			plans.push(await this.planDelete(documentId, signal));
+			for (const rel of incoming.get(documentId)) if (waitsForTarget(rel)) plans.push(await this.planRemoval(rel, [deletePlanKey(documentId)], plans.length, signal));
+		}
+		const batchResult = await this.reactor.executeBatch({ jobs: plans }, signal);
+		const completedJobs = await Promise.all(Object.values(batchResult.jobs).map((job) => this.waitForJob(job, signal)));
 		for (const completedJob of completedJobs) if (completedJob.status === "FAILED") throw new Error(completedJob.error?.message);
 	}
 	/**
@@ -1896,12 +1957,16 @@ var ReactorClient = class {
 				return served("created", documents, reads);
 			})());
 		}, search);
-		const unsubscribeDeleted = this.subscriptionManager.onDocumentDeleted((documentIds) => {
+		const unsubscribeDeleted = this.subscriptionManager.onDocumentDeleted((documentIds, info) => {
 			const reads = this.eventReads.forEvent();
+			const purged = info?.purged ? { purged: true } : {};
 			for (const childId of documentIds) deliver((async () => await this.servesEvery([childId], view, reads) ? {
 				type: "deleted",
 				documents: [],
-				context: { childId }
+				context: {
+					childId,
+					...purged
+				}
 			} : void 0)());
 		}, search);
 		const unsubscribeUpdated = this.subscriptionManager.onDocumentStateUpdated((result) => {
@@ -2102,11 +2167,18 @@ var ReactorClient = class {
 	}
 	/**
 	* The id a write on `identifier` is stored under, which its signatures bind.
-	* A create names its own id, and an id no slug maps to is taken as given, so
-	* a document still in flight resolves to itself.
+	* A create names its own id.
 	*/
 	async resolveWriteTarget(identifier, branch, actions, signal) {
 		if (actions.some((action) => action.type === "CREATE_DOCUMENT")) return identifier;
+		return this.resolveReference(identifier, branch, signal);
+	}
+	/**
+	* The id a document reference names. An id no slug maps to is taken as
+	* given, so a document still in flight resolves to itself; an id that is
+	* another document's slug is refused as ambiguous.
+	*/
+	async resolveReference(identifier, branch, signal) {
 		const view = { branch };
 		const bySlug = await this.documentView.resolveSlug(identifier, view, void 0, signal);
 		if (bySlug === void 0 || bySlug === identifier) return identifier;
@@ -2145,14 +2217,33 @@ var ReactorClient = class {
 			scopeStates: document.state ?? {}
 		};
 	}
-	async removeAllIncomingRelationships(documentId, signal) {
-		const incoming = await this.documentIndexer.getIncoming(documentId, void 0, void 0, void 0, signal);
-		const jobs = [];
-		for (const rel of incoming.results) {
-			const jobInfo = await this.reactor.removeRelationship(rel.sourceId, documentId, rel.relationshipType, "main", this.signer, signal);
-			jobs.push(jobInfo);
-		}
-		return jobs;
+	async planDelete(documentId, signal) {
+		const signed = await signActions([deleteDocumentAction(documentId)], this.signer, {
+			documentId,
+			branch: "main"
+		}, signal);
+		return {
+			key: deletePlanKey(documentId),
+			documentId,
+			scope: "document",
+			branch: "main",
+			actions: signed,
+			dependsOn: []
+		};
+	}
+	async planRemoval(rel, dependsOn, index, signal) {
+		const signed = await signActions([removeRelationshipAction(rel.sourceId, rel.targetId, rel.relationshipType)], this.signer, {
+			documentId: rel.sourceId,
+			branch: "main"
+		}, signal);
+		return {
+			key: `remove:${index}`,
+			documentId: rel.sourceId,
+			scope: "document",
+			branch: "main",
+			actions: signed,
+			dependsOn
+		};
 	}
 };
 //#endregion
@@ -2178,11 +2269,15 @@ const QueueEventTypes = { JOB_AVAILABLE: 1e4 };
 /** Conflict retries a job may take without charging its retry limit. */
 const MAX_EXEMPT_CONFLICT_RETRIES = 20;
 function toErrorInfo(error) {
-	if (error instanceof Error) return {
-		name: error.name,
-		message: error.message,
-		stack: error.stack || (/* @__PURE__ */ new Error()).stack || ""
-	};
+	if (error instanceof Error) {
+		const documentId = error.documentId;
+		return {
+			name: error.name,
+			message: error.message,
+			stack: error.stack || (/* @__PURE__ */ new Error()).stack || "",
+			...typeof documentId === "string" ? { documentId } : {}
+		};
+	}
 	return {
 		name: "Error",
 		message: error,
@@ -2229,12 +2324,12 @@ var JobResultHandler = class {
 				return;
 			} catch {}
 		}
-		if (result.error && DocumentNotFoundError.isError(result.error) && handle.job.kind === "load") {
+		if (result.error && DocumentNotFoundError.isError(result.error) && !DocumentPurgedError.isError(result.error) && handle.job.kind === "load") {
 			handle.defer();
 			callbacks.deferJob(result.error.documentId, handle.job);
 			return;
 		}
-		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentAlreadyExistsError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || InvalidSignatureError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error) || UnsupportedProtocolVersionError.isError(result.error))) {
+		if (result.error && (DocumentDeletedError.isError(result.error) || DocumentAlreadyExistsError.isError(result.error) || DocumentNotFoundError.isError(result.error) || AuthorizationDeniedError.isError(result.error) || AuthTimestampNotMonotonicError.isError(result.error) || InvalidOperationTimestampError.isError(result.error) || ExcessiveReshuffleError.isError(result.error) || InvalidSignatureError.isError(result.error) || UpgradePreconditionFailedError.isError(result.error) || UnsupportedProtocolVersionError.isError(result.error) || DocumentPurgedError.isError(result.error) || DocumentNotDeletedError.isError(result.error) || GroupInUseError.isError(result.error) || PurgeTooLargeError.isError(result.error) || ReservedActionError.isError(result.error))) {
 			const errorInfo = toErrorInfo(result.error);
 			this.jobTracker.markFailed(handle.job.id, errorInfo, handle.job);
 			this.eventBus.emit(ReactorEventTypes.JOB_FAILED, {
@@ -2654,9 +2749,12 @@ var WorkerPoolJobExecutorManager = class {
 			};
 			this.eventBus.emit(JobExecutorEventTypes.JOB_FAILED, failedEvent).catch(() => {});
 		}
-		if (outcome.result.success && outcome.writeReady) this.emitWriteReady(handle.job, outcome.writeReady).catch((error) => {
-			this.logger.error("emitWriteReady failed for job @jobId: @Error", { jobId: handle.job.id }, error);
-		});
+		if (outcome.result.success && outcome.writeReady) {
+			this.evictPurged(outcome.writeReady);
+			this.emitWriteReady(handle.job, outcome.writeReady).catch((error) => {
+				this.logger.error("emitWriteReady failed for job @jobId: @Error", { jobId: handle.job.id }, error);
+			});
+		}
 		await this.resultHandler.handleResult(handle, outcome.result, {
 			deferJob: (documentId, job) => this.deferredJobs.add(documentId, job),
 			flushDeferredFor: (documentId) => this.deferredJobs.flush(documentId)
@@ -2664,6 +2762,12 @@ var WorkerPoolJobExecutorManager = class {
 		this.activeJobs--;
 		await this.tryDispatchFor(worker);
 	}
+	/** Every worker drops a committed purge's id; routing covers only its own. */
+	evictPurged(payload) {
+		const documentIds = [...new Set(payload.operations.filter((operation) => isPurgeMarker$1(operation)).map((operation) => operation.context.documentId))];
+		if (documentIds.length === 0) return;
+		for (const worker of this.workers) worker.evictPurged(documentIds);
+	}
 	async emitWriteReady(job, payload) {
 		const documentIds = [...new Set(payload.operations.map((op) => op.context.documentId))];
 		let collectionMemberships = {};
@@ -2755,8 +2859,78 @@ function fillMissingMemberships(documentIds, found) {
 	return result;
 }
 //#endregion
+//#region src/admin/document-purge-service.ts
+/** The only local origin of a purge: one purge job per erased document. */
+var DocumentPurgeService = class DocumentPurgeService {
+	queue;
+	jobTracker;
+	eventBus;
+	constructor(queue, jobTracker, eventBus) {
+		this.queue = queue;
+		this.jobTracker = jobTracker;
+		this.eventBus = eventBus;
+	}
+	static fromModule(module) {
+		return new DocumentPurgeService(module.queue, module.jobTracker, module.eventBus);
+	}
+	/** One purge job per id; resolves once enqueued, not once complete. */
+	async enqueuePurge(ids, requestId, opts = {}) {
+		const requestDocumentIds = [...new Set(ids)];
+		const infos = [];
+		for (const documentId of requestDocumentIds) {
+			const jobId = v4();
+			const createdAtUtcIso = (/* @__PURE__ */ new Date()).toISOString();
+			const meta = buildSingleJobMeta(jobId, {
+				purgeRequestId: requestId,
+				purgeRequestDocumentIds: requestDocumentIds
+			});
+			const job = {
+				id: jobId,
+				kind: "purge",
+				documentId,
+				scope: "document",
+				branch: "main",
+				actions: [],
+				operations: [],
+				createdAt: createdAtUtcIso,
+				queueHint: [],
+				maxRetries: 3,
+				errorHistory: [],
+				meta,
+				purge: {
+					requestId,
+					allowLarge: opts.allowLarge ?? false
+				}
+			};
+			const info = {
+				id: jobId,
+				documentId,
+				status: "PENDING",
+				createdAtUtcIso,
+				consistencyToken: {
+					version: 1,
+					createdAtUtcIso,
+					coordinates: []
+				},
+				meta
+			};
+			this.jobTracker.registerJob(info);
+			const pending = {
+				jobId,
+				jobMeta: meta
+			};
+			this.eventBus.emit(ReactorEventTypes.JOB_PENDING, pending).catch(() => {});
+			const dispatched = this.queue.enqueue(job);
+			dispatched.catch(() => {});
+			await Promise.race([dispatched, Promise.resolve()]);
+			infos.push(info);
+		}
+		return infos;
+	}
+};
+//#endregion
 //#region src/storage/kysely/stored-protocol-versions.ts
-const created = sql.raw(`scope = 'document' and "index" = 0 and (action->'input'->'protocolVersions') is not null`);
+const created = sql.raw(`scope = 'document' and "index" = 0 and (action->'input'->'protocolVersions') is not null and action->>'type' <> 'PURGE_DOCUMENT'`);
 const key = sql.raw(`md5((action->'input'->'protocolVersions')::text)`);
 /** Distinct creation protocolVersions, one index probe per value. */
 async function storedProtocolVersions(db, schema) {
@@ -3108,14 +3282,23 @@ var InMemoryJobTracker = class {
 	}
 };
 //#endregion
+//#region src/read-models/types.ts
+/** A cursor row whose factory is unregistered; it only records a drive's data. */
+const RELEASED_CURSOR_STATUS = "released";
+//#endregion
 //#region src/processors/utils.ts
 function isDriveDeletion(op) {
-	return op.operation.action.type === "DELETE_DOCUMENT";
+	const type = op.operation.action.type;
+	return type === "DELETE_DOCUMENT" || type === "PURGE_DOCUMENT";
 }
 function extractDriveHeader(op) {
 	if (!op.context.resultingState) return void 0;
 	return JSON.parse(op.context.resultingState).header;
 }
+function extractCreationHeader(op) {
+	if (op.operation.action.type !== "CREATE_DOCUMENT") return void 0;
+	return extractDriveHeader(op) ?? createDocumentFromAction(op.operation.action).header;
+}
 function extractDeletedDocumentId(op) {
 	return op.operation.action.input.documentId ?? op.context.documentId;
 }
@@ -3183,11 +3366,25 @@ function lowestOf(ops) {
 	for (const op of ops) lowest = Math.min(lowest, op.context.ordinal);
 	return lowest;
 }
+/** Drops operations of tombstoned ids; the marker always passes. */
+function withoutPurged(ops, purged, keep) {
+	if (purged.size === 0) return ops;
+	return ops.filter((op) => isPurgeMarker$1(op.operation) || !purged.has(op.context.documentId) || keep?.has(op.context.ordinal) === true);
+}
+/** The ids whose tombstone would drop an operation of `ops`. */
+function purgeCandidates(ops) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const op of ops) if (!isPurgeMarker$1(op.operation)) ids.add(op.context.documentId);
+	return [...ids];
+}
 function highestOf(ops) {
 	let highest = 0;
 	for (const op of ops) highest = Math.max(highest, op.context.ordinal);
 	return highest;
 }
+const LOOKUP_RETRY_MS = 100;
+const MAX_LOOKUP_RETRY_MS = 3e4;
+const LOOKUP_RETRIES = 10;
 var ProcessorQueue = class {
 	options;
 	tasks = [];
@@ -3195,17 +3392,24 @@ var ProcessorQueue = class {
 	closed = false;
 	replaysAhead = 0;
 	unrouted = /* @__PURE__ */ new Set();
+	wake;
+	parked = false;
 	constructor(options) {
 		this.options = options;
 	}
 	get isClosed() {
 		return this.closed;
 	}
+	/** True while a backfill or retry is queued or running. */
+	get replaying() {
+		return this.replaysAhead > 0;
+	}
 	/** Resolves at once behind a replay, so a pass never waits out a backfill. */
-	live(ops) {
+	live(ops, check) {
 		const delivered = this.push((done) => ({
 			kind: "live",
 			ops,
+			check,
 			done
 		}));
 		return this.replaysAhead > 0 ? Promise.resolve() : delivered;
@@ -3223,6 +3427,21 @@ var ProcessorQueue = class {
 			done
 		}));
 	}
+	/** `share` if active, then `deletion` whatever the status; true once delivered. */
+	erase(share, deletion, check) {
+		if (this.closed) return Promise.resolve(false);
+		let delivered = false;
+		const task = {
+			kind: "erase",
+			ops: share,
+			deletion,
+			check,
+			run: async () => {
+				delivered = await this.runErase(task);
+			}
+		};
+		return this.push((done) => Object.assign(task, { done })).then(() => delivered);
+	}
 	/** Replays from the cursor as it stands when the task runs. */
 	backfill() {
 		return this.replay("backfill", () => this.runBackfill());
@@ -3250,6 +3469,7 @@ var ProcessorQueue = class {
 			}
 		});
 		this.closed = true;
+		this.wake?.();
 		return disconnect;
 	}
 	replay(kind, run) {
@@ -3320,19 +3540,121 @@ var ProcessorQueue = class {
 			await this.raiseCursor(through);
 			return;
 		}
-		if (cursor.status !== "active") {
+		if (cursor.status !== "active" || this.parked) {
 			await this.parkBelow(fresh);
 			return;
 		}
-		if (!await this.deliver(fresh)) {
+		const live = await this.dropPurgedLive(batch, fresh);
+		if (live === void 0) {
+			await this.parkBelow(fresh);
+			return;
+		}
+		if (live.length > 0 && !await this.deliver(live)) {
 			await this.parkBelow(fresh);
 			return;
 		}
 		await this.raiseCursor(Math.max(highestOf(fresh), through));
 	}
+	/** Undefined once closed, or parked after the lookup's last retry. */
+	async dropPurgedLive(batch, fresh) {
+		const keep = /* @__PURE__ */ new Set();
+		const checks = [];
+		for (const task of batch) {
+			if (task.kind !== "live" || !task.check) continue;
+			checks.push(task.check.purged);
+			for (const ordinal of task.check.keep ?? []) keep.add(ordinal);
+		}
+		let purged;
+		try {
+			const sets = await Promise.all(checks);
+			purged = new Set(sets.flatMap((set) => [...set]));
+		} catch (error) {
+			purged = await this.retryLookup(fresh, error);
+		}
+		return purged && withoutPurged(fresh, purged, keep);
+	}
+	async retryLookup(ops, error) {
+		const ids = purgeCandidates(ops);
+		let wait = this.options.lookupRetryMs ?? LOOKUP_RETRY_MS;
+		const retries = this.options.lookupRetries ?? LOOKUP_RETRIES;
+		for (let attempt = 0; attempt < retries; attempt++) {
+			this.options.logger.error("Processor '@ProcessorId' failed checking tombstones, retrying in @Wait ms: @Error", this.options.processorId, wait, error);
+			await this.sleep(wait);
+			if (this.closed) return void 0;
+			try {
+				return await this.options.purged(ids);
+			} catch (retryError) {
+				error = retryError;
+				wait = Math.min(wait * 2, MAX_LOOKUP_RETRY_MS);
+			}
+		}
+		await this.park(ops, ids, wait, error);
+	}
+	async park(ops, ids, wait, error) {
+		this.parked = true;
+		this.noteLookupError(error);
+		this.options.logger.error("Processor '@ProcessorId' parked: tombstones unread after @Retries retries, retrying every @Wait ms: @Error", this.options.processorId, this.options.lookupRetries ?? LOOKUP_RETRIES, wait, error);
+		this.replay("backfill", () => this.resume(ids, wait));
+		await this.parkBelow(ops);
+	}
+	async resume(ids, wait) {
+		for (;;) {
+			if (this.closed) return;
+			await this.sleep(wait);
+			if (this.closed) return;
+			try {
+				await this.options.purged(ids);
+				break;
+			} catch (error) {
+				this.noteLookupError(error);
+				this.options.logger.error("Processor '@ProcessorId' still parked, tombstones unread; retrying in @Wait ms: @Error", this.options.processorId, wait, error);
+			}
+		}
+		this.parked = false;
+		const { cursor } = this.options;
+		cursor.lastError = void 0;
+		cursor.lastErrorTimestamp = void 0;
+		await this.persist();
+		this.options.logger.info("Processor '@ProcessorId' resumed from ordinal @Ordinal", this.options.processorId, cursor.lastOrdinal);
+		await this.runBackfill();
+	}
+	noteLookupError(error) {
+		const { cursor } = this.options;
+		cursor.lastError = errorMessage(error);
+		cursor.lastErrorTimestamp = /* @__PURE__ */ new Date();
+	}
+	sleep(ms) {
+		return new Promise((resolve) => {
+			const done = () => {
+				clearTimeout(timer);
+				this.wake = void 0;
+				resolve();
+			};
+			const timer = setTimeout(done, ms);
+			timer.unref?.();
+			this.wake = done;
+		});
+	}
+	async runErase(task) {
+		const { cursor, floor } = this.options;
+		const fresh = task.ops.filter((op) => {
+			const ordinal = op.context.ordinal;
+			if (ordinal <= floor) return false;
+			return !this.unrouted.delete(ordinal);
+		});
+		const deletion = task.deletion && !this.unrouted.delete(task.deletion.context.ordinal) ? task.deletion : void 0;
+		let ops = [];
+		if (cursor.status === "active" && !this.parked && fresh.length > 0) try {
+			ops = withoutPurged(fresh, await task.check.purged);
+		} catch (error) {
+			this.options.logger.error("Processor '@ProcessorId' skipped its drive's last batch, tombstones unread: @Error", this.options.processorId, error);
+		}
+		if (deletion) ops.push(deletion);
+		return ops.length === 0 || await this.deliver(ops);
+	}
 	async runBackfill() {
 		const { cursor, filter, floor } = this.options;
-		if (cursor.status !== "active") return;
+		if (cursor.status !== "active" || this.parked) return;
 		let page;
 		try {
 			page = await this.options.readSince(cursor.lastOrdinal);
@@ -3343,13 +3665,28 @@ var ProcessorQueue = class {
 		while (page.results.length > 0) {
 			if (this.closed) return;
 			const matching = page.results.filter((op) => op.context.ordinal > floor && matchesFilter(op, filter));
+			let live = matching;
 			if (matching.length > 0) {
-				if (!await this.deliver(matching)) {
+				const ids = purgeCandidates(matching);
+				let purged;
+				try {
+					purged = await this.options.purged(ids);
+				} catch (error) {
+					purged = await this.retryLookup(matching, error);
+				}
+				if (purged === void 0) {
 					await this.persist();
 					return;
 				}
-				this.dedupeQueued(matching);
+				live = withoutPurged(matching, purged);
 			}
+			if (live.length > 0) {
+				if (!await this.deliver(live)) {
+					await this.persist();
+					return;
+				}
+			}
+			if (matching.length > 0) this.dedupeQueued(matching);
 			await this.raiseCursor(highestOf(page.results));
 			if (!page.next) break;
 			try {
@@ -3370,7 +3707,10 @@ var ProcessorQueue = class {
 		}
 		if (queued.size === 0) return;
 		for (const task of this.tasks) {
-			if (task.kind !== "live") continue;
+			if (task.kind === "erase") {
+				const { deletion } = task;
+				if (deletion && queued.has(deletion.context.ordinal)) task.deletion = void 0;
+			} else if (task.kind !== "live") continue;
 			task.ops = task.ops.filter((op) => !queued.has(op.context.ordinal));
 		}
 	}
@@ -3398,7 +3738,8 @@ var ProcessorQueue = class {
 	async raiseCursor(through) {
 		const { cursor } = this.options;
 		const capped = Math.min(through, this.options.confirmedThrough());
-		if (cursor.status !== "active" || capped <= cursor.lastOrdinal) return;
+		if (cursor.status !== "active" || this.parked) return;
+		if (capped <= cursor.lastOrdinal) return;
 		cursor.lastOrdinal = capped;
 		await this.persist();
 	}
@@ -3424,6 +3765,8 @@ var ProcessorQueue = class {
 };
 //#endregion
 //#region src/processors/processor-manager.ts
+const DRIVE_STREAM_PAGE = 500;
+const SHUTDOWN_GRACE_MS = 5e3;
 var ProcessorManager = class extends BaseReadModel {
 	factoryRegistry = /* @__PURE__ */ new Map();
 	processorsByDrive = /* @__PURE__ */ new Map();
@@ -3435,6 +3778,14 @@ var ProcessorManager = class extends BaseReadModel {
 	advancing = Promise.resolve();
 	cursorWrites = /* @__PURE__ */ new Map();
 	draining = /* @__PURE__ */ new Map();
+	deletedDrives = /* @__PURE__ */ new Map();
+	erasing = /* @__PURE__ */ new Map();
+	driveHeaders = /* @__PURE__ */ new Map();
+	headerReads = /* @__PURE__ */ new Map();
+	headerSlots = 8;
+	headerWaiters = [];
+	stopped = false;
+	owedFailures = /* @__PURE__ */ new Map();
 	logger;
 	driveContainerTypes;
 	legacyProcessorIds;
@@ -3442,7 +3793,8 @@ var ProcessorManager = class extends BaseReadModel {
 		super(db, operationIndex, writeCache, consistencyTracker, {
 			readModelId: "processor-manager",
 			rebuildStateOnInit: true,
-			indexing: unchunkedReadModelIndexingConfig
+			indexing: unchunkedReadModelIndexingConfig,
+			purgeFence: "none"
 		});
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
@@ -3452,29 +3804,48 @@ var ProcessorManager = class extends BaseReadModel {
 		await this.loadAllCursors();
 		await super.init();
 		await this.discoverExistingDrives();
+		await this.discoverDeletedDrives();
+		for (const [identifier, factory] of this.factoryRegistry) this.eraseOwed(identifier, factory);
 	}
 	async commitOperations(items) {
 		const { runs, reserved } = this.detectNewDrives(items);
-		const disconnects = this.detectDeletedDrives(items);
-		const deliveries = this.enqueueRouted(items, reserved);
-		await Promise.all([
-			...runs.map((run) => run()),
-			...disconnects,
-			...deliveries
-		]);
+		const deletions = this.findDriveDeletions(items);
+		const deliveries = this.enqueueRouted(items, reserved, deletions);
+		this.detectDeletedDrives(items);
+		this.forgetPurgedHeaders(items);
+		await Promise.all([...runs.map((run) => run()), ...deliveries]);
 	}
 	async registerFactory(identifier, factory) {
+		if (this.stopped) return;
 		const removals = this.removeFactory(identifier);
 		this.factoryRegistry.set(identifier, factory);
 		const previous = this.draining.get(identifier);
 		const creationOrdinal = this.highWater() + 1;
 		const runs = [];
-		for (const [driveId, documentType] of this.knownDrives) runs.push(this.reserveSlot(identifier, factory, driveId, createMinimalDriveHeader(driveId, documentType), creationOrdinal, void 0, false, previous).run);
+		for (const [driveId, documentType] of this.knownDrives) runs.push(this.reserveSlot(identifier, factory, driveId, this.headerOf(driveId, documentType), creationOrdinal, void 0, false, previous).run);
+		this.eraseOwed(identifier, factory, previous);
 		await Promise.all([...removals, ...runs.map((run) => run())]);
 	}
 	async unregisterFactory(identifier) {
 		await Promise.all(this.removeFactory(identifier));
 	}
+	/** Closes every processor queue; the reactor's kill() calls it. */
+	async shutdown() {
+		if (this.stopped) return;
+		this.stopped = true;
+		this.pendingSlots.clear();
+		this.owedFailures.clear();
+		const closing = [...this.allBound()].map(({ queue }) => queue.close());
+		this.processorsByDrive.clear();
+		let timer;
+		const grace = new Promise((resolve) => {
+			timer = setTimeout(() => resolve(false), SHUTDOWN_GRACE_MS);
+			timer.unref?.();
+		});
+		const closed = await Promise.race([Promise.all(closing).then(() => true), grace]);
+		clearTimeout(timer);
+		if (!closed) this.logger.warn("Processors still busy @Ms ms into shutdown; not waiting for them", SHUTDOWN_GRACE_MS);
+	}
 	get(processorId) {
 		for (const tracked of this.allTrackedProcessors()) if (tracked.processorId === processorId) return tracked;
 	}
@@ -3492,6 +3863,7 @@ var ProcessorManager = class extends BaseReadModel {
 			this.knownDrives.set(driveId, op.context.documentType);
 			const driveHeader = extractDriveHeader(op);
 			if (!driveHeader) continue;
+			this.driveHeaders.set(driveId, driveHeader);
 			for (const [identifier, factory] of this.factoryRegistry) {
 				const { slot, run } = this.reserveSlot(identifier, factory, driveId, driveHeader, op.context.ordinal, items, true);
 				reserved.add(slot);
@@ -3503,23 +3875,85 @@ var ProcessorManager = class extends BaseReadModel {
 			reserved
 		};
 	}
-	/** Synchronous: drops a deleted drive's processors from the tables. */
+	/** Synchronous: drops a deleted drive's processors; their rows stay owed. */
 	detectDeletedDrives(items) {
-		const pending = [];
 		for (const op of items) {
 			if (!isDriveDeletion(op)) continue;
 			const driveId = extractDeletedDocumentId(op);
 			if (!driveId || !this.knownDrives.has(driveId)) continue;
 			this.knownDrives.delete(driveId);
+			this.deletedDrives.set(driveId, op);
 			for (const slot of this.pendingSlots) if (slot.driveId === driveId) this.pendingSlots.delete(slot);
 			for (const { queue } of this.processorsByDrive.get(driveId) ?? []) queue.close();
 			this.processorsByDrive.delete(driveId);
-			pending.push(...this.deleteCursors((row) => row.driveId === driveId));
+			this.pruneDeletedDrive(driveId);
+		}
+	}
+	/** Synchronous: a purged drive's header is erased data. */
+	forgetPurgedHeaders(items) {
+		for (const op of items) if (isPurgeMarker$1(op.operation)) {
+			this.driveHeaders.delete(op.context.documentId);
+			const read = this.headerReads.get(op.context.documentId);
+			if (read) read.purged = true;
+		}
+	}
+	/** A drive's creation header; minimal once the drive's stream is purged. */
+	headerOf(driveId, documentType) {
+		const cached = this.driveHeaders.get(driveId);
+		if (cached) return Promise.resolve(cached);
+		const inFlight = this.headerReads.get(driveId)?.header;
+		if (inFlight) return inFlight;
+		const read = { purged: false };
+		this.headerReads.set(driveId, read);
+		read.header = this.readHeader(driveId, documentType, read);
+		return read.header;
+	}
+	async readHeader(driveId, documentType, read) {
+		let first;
+		await this.takeHeaderSlot();
+		try {
+			[first] = await this.operationIndex.getStreamAfter({
+				documentId: driveId,
+				scope: "document",
+				branch: "main"
+			}, 0, void 0, 1);
+		} catch (error) {
+			this.logger.error("Failed reading drive '@DriveId' header: @Error", driveId, error);
+		} finally {
+			this.releaseHeaderSlot();
+			if (this.headerReads.get(driveId) === read) this.headerReads.delete(driveId);
 		}
-		return pending;
+		const header = first && extractCreationHeader(first);
+		if (!header || read.purged) return createMinimalDriveHeader(driveId, documentType);
+		if (this.knownDrives.has(driveId) || this.deletedDrives.has(driveId)) this.driveHeaders.set(driveId, header);
+		return header;
+	}
+	async takeHeaderSlot() {
+		if (this.headerSlots > 0) {
+			this.headerSlots--;
+			return;
+		}
+		await new Promise((resolve) => this.headerWaiters.push(resolve));
+	}
+	releaseHeaderSlot() {
+		const next = this.headerWaiters.shift();
+		if (next) next();
+		else this.headerSlots++;
+	}
+	/** Synchronous: the known drives this batch deletes. */
+	findDriveDeletions(items) {
+		const deletions = /* @__PURE__ */ new Map();
+		for (const op of items) {
+			if (!isDriveDeletion(op)) continue;
+			const driveId = extractDeletedDocumentId(op);
+			if (!driveId || !this.knownDrives.has(driveId)) continue;
+			const first = deletions.get(driveId);
+			if (!first || op.context.ordinal < first.context.ordinal) deletions.set(driveId, op);
+		}
+		return deletions;
 	}
 	/** Synchronous: puts each processor's share of the batch on its queue. */
-	enqueueRouted(items, reserved) {
+	enqueueRouted(items, reserved, deletions = /* @__PURE__ */ new Map()) {
 		if (items.length === 0) return [];
 		let lowest = items[0].context.ordinal;
 		let highest = 0;
@@ -3532,14 +3966,179 @@ var ProcessorManager = class extends BaseReadModel {
 			if (reserved.has(slot)) continue;
 			slot.lowestRoutedOrdinal = Math.min(slot.lowestRoutedOrdinal ?? lowest, lowest);
 		}
+		let check;
+		const checkOf = () => check ??= this.checkPurged(items);
 		const deliveries = [];
 		for (const { tracked, queue } of this.allBound()) {
+			const deletion = deletions.get(tracked.driveId);
+			if (deletion) {
+				deliveries.push(this.deliverDeletion(tracked, queue, items, deletion, checkOf()));
+				continue;
+			}
 			const matching = items.filter((op) => matchesFilter(op, tracked.record.filter));
-			if (matching.length > 0) deliveries.push(queue.live(matching));
+			if (matching.length > 0) deliveries.push(queue.live(matching, checkOf()));
 			else queue.advance(highest);
 		}
 		return deliveries;
 	}
+	deliverDeletion(tracked, queue, items, deletion, check) {
+		const through = deletion.context.ordinal;
+		const share = items.filter((op) => op.context.ordinal < through && matchesFilter(op, tracked.record.filter));
+		const behindReplay = queue.replaying;
+		const settled = queue.erase(share, deletion, check).then((delivered) => this.settleErased(tracked, delivered, deletion));
+		this.holdErasure(tracked.factoryId, tracked.driveId, settled);
+		return behindReplay ? Promise.resolve() : settled;
+	}
+	/** A delivered deletion deletes the row; a failed one keeps it, errored. */
+	settleErased(tracked, delivered, deletion) {
+		if (!delivered) {
+			this.deletedDrives.set(tracked.driveId, deletion);
+			this.trackOwedFailure(tracked, tracked.record, tracked);
+			return this.writeCursor(tracked, tracked);
+		}
+		const deleted = this.deleteCursors((row) => row.processorId === tracked.processorId);
+		this.pruneDeletedDrive(tracked.driveId);
+		return Promise.all(deleted).then(() => void 0);
+	}
+	/** Keeps a failed deletion in getAll(); retry() delivers it again. */
+	trackOwedFailure(owner, record, state) {
+		const { processorId, factoryId, driveId, processorIndex } = owner;
+		this.owedFailures.set(processorId, {
+			processorId,
+			factoryId,
+			driveId,
+			processorIndex,
+			record,
+			lastOrdinal: state.lastOrdinal,
+			status: "errored",
+			lastError: state.lastError,
+			lastErrorTimestamp: state.lastErrorTimestamp,
+			retry: () => this.retryOwed(factoryId, driveId)
+		});
+	}
+	async retryOwed(factoryId, driveId) {
+		const factory = this.factoryRegistry.get(factoryId);
+		const deletion = this.deletedDrives.get(driveId);
+		if (!factory || !deletion || this.stopped) return;
+		await this.eraseDrive(factoryId, factory, driveId, deletion);
+	}
+	/** Forgets a deleted drive once no cursor row owes its deletion. */
+	pruneDeletedDrive(driveId) {
+		for (const row of this.cursorCache.values()) if (row.driveId === driveId) return;
+		this.deletedDrives.delete(driveId);
+		if (!this.knownDrives.has(driveId)) this.driveHeaders.delete(driveId);
+	}
+	/** Delivers each deleted drive's deletion its rows of `factoryId` still owe. */
+	eraseOwed(factoryId, factory, previous) {
+		if (![...this.cursorCache.values()].some((row) => row.factoryId === factoryId && this.deletedDrives.has(row.driveId)) || this.stopped) return;
+		(async () => {
+			await previous;
+			if (this.factoryRegistry.get(factoryId) !== factory) return;
+			const owed = /* @__PURE__ */ new Set();
+			for (const row of this.cursorCache.values()) if (row.factoryId === factoryId && this.deletedDrives.has(row.driveId)) owed.add(row.driveId);
+			await Promise.all([...owed].map((driveId) => this.eraseOwedDrive(factoryId, factory, driveId)));
+		})().catch((error) => {
+			this.logger.error("Owed deletions of '@FactoryId' failed: @Error", factoryId, error);
+		});
+	}
+	/** After any delivery of the pair's deletion in flight, if still owed. */
+	async eraseOwedDrive(factoryId, factory, driveId) {
+		const key = `${factoryId}:${driveId}`;
+		for (let held = this.erasing.get(key); held; held = this.erasing.get(key)) await held;
+		if (this.stopped || this.factoryRegistry.get(factoryId) !== factory) return;
+		const owes = [...this.cursorCache.values()].some((row) => row.factoryId === factoryId && row.driveId === driveId);
+		const deletion = this.deletedDrives.get(driveId);
+		if (!owes || !deletion) return;
+		await this.eraseDrive(factoryId, factory, driveId, deletion);
+	}
+	/** Marks the pair's deletion as being delivered until `erasure` settles. */
+	holdErasure(factoryId, driveId, erasure) {
+		const key = `${factoryId}:${driveId}`;
+		const held = Promise.allSettled([this.erasing.get(key), erasure]).then(() => void 0);
+		this.erasing.set(key, held);
+		held.then(() => {
+			if (this.erasing.get(key) === held) this.erasing.delete(key);
+		});
+	}
+	/** Runs `erase` unless the pair's deletion is already being delivered. */
+	async claimErasure(factoryId, driveId, erase) {
+		if (this.erasing.has(`${factoryId}:${driveId}`)) return false;
+		let release;
+		this.holdErasure(factoryId, driveId, new Promise((resolve) => {
+			release = resolve;
+		}));
+		try {
+			await erase();
+		} finally {
+			release();
+		}
+		return true;
+	}
+	async eraseDrive(factoryId, factory, driveId, deletion) {
+		await this.claimErasure(factoryId, driveId, async () => {
+			const header = await this.headerOf(driveId, deletion.context.documentType);
+			const slot = {
+				factoryId,
+				driveId
+			};
+			const records = await this.runFactory(slot, factory, header);
+			if (!records) return;
+			await this.eraseRecords(factoryId, driveId, deletion, records);
+		});
+	}
+	/** The deletion to each record a row owes it to, then every disconnect. */
+	async eraseRecords(factoryId, driveId, deletion, records) {
+		const ids = resolveProcessorSlots(records, this.legacyProcessorIds);
+		const delivered = /* @__PURE__ */ new Set();
+		const failed = /* @__PURE__ */ new Map();
+		const recordOf = /* @__PURE__ */ new Map();
+		await Promise.all(records.map(async (record, i) => {
+			const processorId = `${factoryId}:${driveId}:${ids[i]}`;
+			if (this.cursorCache.has(processorId)) {
+				recordOf.set(processorId, record);
+				try {
+					await record.processor.onOperations([deletion]);
+					delivered.add(processorId);
+				} catch (error) {
+					failed.set(processorId, error);
+					this.logger.error("Processor '@ProcessorId' failed on its drive's deletion: @Error", processorId, error);
+				}
+			}
+			await this.discard({
+				factoryId,
+				driveId
+			}, record.processor.onDisconnect.bind(record.processor));
+		}));
+		const writes = [];
+		for (const row of this.cursorCache.values()) {
+			if (row.factoryId !== factoryId || row.driveId !== driveId) continue;
+			if (delivered.has(row.processorId)) continue;
+			if (!failed.has(row.processorId)) {
+				this.logger.warn("Factory '@FactoryId' made no processor '@ProcessorId' for deleted drive '@DriveId'; its deletion stays owed", factoryId, row.processorId, driveId);
+				continue;
+			}
+			const error = failed.get(row.processorId);
+			const state = {
+				lastOrdinal: row.lastOrdinal,
+				status: "errored",
+				lastError: error instanceof Error ? error.message : String(error),
+				lastErrorTimestamp: /* @__PURE__ */ new Date()
+			};
+			this.trackOwedFailure(row, recordOf.get(row.processorId), state);
+			writes.push(this.writeCursor(row, state));
+		}
+		for (const processorId of delivered) this.owedFailures.delete(processorId);
+		writes.push(...this.deleteCursors((row) => delivered.has(row.processorId)));
+		this.pruneDeletedDrive(driveId);
+		await Promise.all(writes);
+	}
+	/** Started at routing; takes no purge lock, since processors hold none. */
+	checkPurged(items) {
+		const ids = purgeCandidates(items);
+		const purged = ids.length === 0 ? Promise.resolve(/* @__PURE__ */ new Set()) : findPurged(this.db, ids);
+		purged.catch(() => void 0);
+		return { purged };
+	}
 	/** Synchronous: binds records, or discards them if the slot was cancelled. */
 	bind(slot, records, creationOrdinal, creationItems) {
 		const released = this.pendingSlots.delete(slot);
@@ -3550,9 +4149,8 @@ var ProcessorManager = class extends BaseReadModel {
 				delivered: settled
 			};
 		}
-		if (!released) {
-			const discarded = records.map((record) => this.discard(slot, record.processor.onDisconnect.bind(record.processor)));
-			const settled = Promise.all(discarded).then(() => void 0);
+		if (!released || this.stopped) {
+			const settled = this.discardRecords(slot, records);
 			return {
 				persisted: settled,
 				delivered: settled
@@ -3571,16 +4169,24 @@ var ProcessorManager = class extends BaseReadModel {
 			const missed = tracked.lastOrdinal < slot.reservedAt || lowestRoutedOrdinal !== void 0;
 			if (tracked.status === "active" && missed) deliveries.push(queue.backfill());
 			const matching = creationItems?.filter((op) => matchesFilter(op, tracked.record.filter));
-			if (matching && matching.length > 0) deliveries.push(queue.live(matching));
+			if (matching && matching.length > 0) deliveries.push(queue.live(matching, this.checkPurged(matching)));
 		}
 		return {
 			persisted: Promise.all(writes).then(() => void 0),
 			delivered: Promise.all(deliveries).then(() => void 0)
 		};
 	}
-	/** Synchronous: removes a factory's slots, processors and cursor rows. */
+	/** A cancelled slot's records; on a deleted drive they pay what rows owe. */
+	async discardRecords(slot, records) {
+		const { factoryId, driveId } = slot;
+		const deletion = this.stopped ? void 0 : this.deletedDrives.get(driveId);
+		if (deletion !== void 0 && await this.claimErasure(factoryId, driveId, () => this.eraseRecords(factoryId, driveId, deletion, records))) return;
+		await Promise.all(records.map((record) => this.discard(slot, record.processor.onDisconnect.bind(record.processor))));
+	}
+	/** Synchronous: removes a factory's slots and processors; releases its rows. */
 	removeFactory(identifier) {
 		if (!this.factoryRegistry.delete(identifier)) return [];
+		for (const [processorId, failure] of this.owedFailures) if (failure.factoryId === identifier) this.owedFailures.delete(processorId);
 		const closing = [];
 		for (const slot of this.pendingSlots) {
 			if (slot.factoryId !== identifier) continue;
@@ -3601,7 +4207,25 @@ var ProcessorManager = class extends BaseReadModel {
 				if (this.draining.get(identifier) === drained) this.draining.delete(identifier);
 			});
 		}
-		return this.deleteCursors((row) => row.factoryId === identifier);
+		return this.releaseCursors(identifier);
+	}
+	releaseCursors(factoryId) {
+		const writes = [];
+		for (const row of this.cursorCache.values()) {
+			if (row.factoryId !== factoryId) continue;
+			if (row.status === "released") continue;
+			if (this.deletedDrives.has(row.driveId)) continue;
+			const released = {
+				...row,
+				status: RELEASED_CURSOR_STATUS
+			};
+			this.cursorCache.set(row.processorId, released);
+			writes.push(this.lane(row.processorId, () => this.db.updateTable("ProcessorCursor").set({
+				status: RELEASED_CURSOR_STATUS,
+				updatedAt: /* @__PURE__ */ new Date()
+			}).where("processorId", "=", row.processorId).execute()));
+		}
+		return writes;
 	}
 	reserveSlot(factoryId, factory, driveId, driveHeader, creationOrdinal, creationItems, awaitDelivery, previous) {
 		const slot = {
@@ -3615,7 +4239,8 @@ var ProcessorManager = class extends BaseReadModel {
 		const run = async () => {
 			const bound = (async () => {
 				await previous;
-				const records = await this.runFactory(slot, factory, driveHeader);
+				const header = await driveHeader;
+				const records = await this.runFactory(slot, factory, header);
 				return this.bind(slot, records, creationOrdinal, creationItems);
 			})();
 			slot.settled = bound.then(({ persisted }) => persisted);
@@ -3639,13 +4264,15 @@ var ProcessorManager = class extends BaseReadModel {
 		const cached = this.cursorCache.get(processorId);
 		let floor = 0;
 		let cursor;
-		if (cached) cursor = {
-			lastOrdinal: cached.lastOrdinal,
-			status: cached.status,
-			lastError: cached.lastError ?? void 0,
-			lastErrorTimestamp: cached.lastErrorTimestamp ?? void 0
-		};
-		else {
+		if (cached && cached.status !== "released") {
+			const errored = cached.status !== "active";
+			cursor = {
+				lastOrdinal: cached.lastOrdinal,
+				status: cached.status,
+				lastError: errored ? cached.lastError ?? void 0 : void 0,
+				lastErrorTimestamp: errored ? cached.lastErrorTimestamp ?? void 0 : void 0
+			};
+		} else {
 			if (record.startFrom === "current") floor = creationOrdinal - 1;
 			cursor = {
 				lastOrdinal: floor,
@@ -3674,6 +4301,7 @@ var ProcessorManager = class extends BaseReadModel {
 			routedThrough: () => this.highWater(),
 			confirmedThrough: () => this.lastOrdinal,
 			persist: (state) => this.writeCursor(tracked, state),
+			purged: (ids) => findPurged(this.db, ids),
 			logger: this.logger
 		});
 		return {
@@ -3706,6 +4334,7 @@ var ProcessorManager = class extends BaseReadModel {
 	}
 	*allTrackedProcessors() {
 		for (const { tracked } of this.allBound()) yield tracked;
+		yield* this.owedFailures.values();
 	}
 	isDriveCreation(op) {
 		return op.operation.action.type === "CREATE_DOCUMENT" && this.driveContainerTypes.has(op.context.documentType);
@@ -3714,6 +4343,38 @@ var ProcessorManager = class extends BaseReadModel {
 		const drives = await this.db.selectFrom("DocumentSnapshot").select(["documentId", "documentType"]).where("documentType", "in", [...this.driveContainerTypes]).where("isDeleted", "=", false).execute();
 		for (const drive of drives) this.knownDrives.set(drive.documentId, drive.documentType);
 	}
+	/** Cursor rows of a drive that is gone: find the deletion they still owe. */
+	async discoverDeletedDrives() {
+		const driveIds = /* @__PURE__ */ new Set();
+		for (const row of this.cursorCache.values()) if (!this.knownDrives.has(row.driveId)) driveIds.add(row.driveId);
+		for (const driveId of driveIds) try {
+			await this.discoverDeletedDrive(driveId);
+		} catch (error) {
+			this.logger.error("Failed reading deleted drive '@DriveId': @Error", driveId, error);
+		}
+	}
+	async discoverDeletedDrive(driveId) {
+		const key = {
+			documentId: driveId,
+			scope: "document",
+			branch: "main"
+		};
+		let header;
+		let deletion;
+		let after = 0;
+		for (;;) {
+			const page = await this.operationIndex.getStreamAfter(key, after, void 0, DRIVE_STREAM_PAGE);
+			for (const op of page) {
+				header ??= extractCreationHeader(op);
+				if (!deletion && isDriveDeletion(op) && extractDeletedDocumentId(op) === driveId) deletion = op;
+			}
+			if (page.length < DRIVE_STREAM_PAGE) break;
+			after = page.at(-1).context.ordinal;
+		}
+		if (!deletion) return;
+		this.deletedDrives.set(driveId, deletion);
+		if (header) this.driveHeaders.set(driveId, header);
+	}
 	async loadAllCursors() {
 		const rows = await this.db.selectFrom("ProcessorCursor").selectAll().execute();
 		for (const row of rows) {
@@ -4576,11 +5237,12 @@ var ReactorSubscriptionManager = class {
 	/**
 	* Notify subscribers about deleted documents
 	*/
-	notifyDocumentsDeleted(documentIds, documentTypes, parentIds) {
+	notifyDocumentsDeleted(documentIds, documentTypes, parentIds, info) {
 		for (const subscription of this.deletedSubscriptions.values()) {
 			const filteredIds = this.filterDocumentIds(documentIds, subscription.search, documentTypes, parentIds);
 			if (filteredIds.length > 0) try {
-				subscription.callback(filteredIds);
+				if (info) subscription.callback(filteredIds, info);
+				else subscription.callback(filteredIds);
 			} catch (error) {
 				this.errorHandler.handleError(error, {
 					eventType: "deleted",
@@ -4695,14 +5357,19 @@ var SubscriptionNotificationReadModel = class {
 		if (operations.length === 0) return;
 		const created = [];
 		const deleted = [];
+		const purgeDeleted = [];
 		const updatedIds = /* @__PURE__ */ new Set();
+		const purgedIds = /* @__PURE__ */ new Set();
 		const documentTypes = /* @__PURE__ */ new Map();
 		const parentIds = /* @__PURE__ */ new Map();
 		for (const item of operations) {
 			const { operation, context } = item;
 			const actionType = operation.action.type;
 			documentTypes.set(context.documentId, context.documentType);
-			if (actionType === "CREATE_DOCUMENT") created.push(context.documentId);
+			if (isPurgeMarker$1(operation)) {
+				purgedIds.add(context.documentId);
+				if (context.appliedDeletion) purgeDeleted.push(context.documentId);
+			} else if (actionType === "CREATE_DOCUMENT") created.push(context.documentId);
 			else if (actionType === "DELETE_DOCUMENT") {
 				const deletedId = operation.action.input.documentId ?? context.documentId;
 				deleted.push(deletedId);
@@ -4716,9 +5383,21 @@ var SubscriptionNotificationReadModel = class {
 		}
 		if (created.length > 0) this.subscriptionManager.notifyDocumentsCreated(created, documentTypes, parentIds);
 		if (deleted.length > 0) this.subscriptionManager.notifyDocumentsDeleted(deleted, documentTypes, parentIds);
+		if (purgeDeleted.length > 0) this.subscriptionManager.notifyDocumentsDeleted(purgeDeleted, documentTypes, parentIds, { purged: true });
+		for (const id of purgedIds) updatedIds.delete(id);
 		if (updatedIds.size > 0 && this.documentView) {
-			const documents = await Promise.all(Array.from(updatedIds).map((id) => this.documentView.get(id)));
-			this.subscriptionManager.notifyDocumentsUpdated(documents);
+			const documentView = this.documentView;
+			const present = (await Promise.all(Array.from(updatedIds).map((id) => this.readUpdated(documentView, id)))).filter((document) => document !== void 0);
+			if (present.length > 0) this.subscriptionManager.notifyDocumentsUpdated(present);
+		}
+	}
+	/** Undefined for a document gone since its update; others still notify. */
+	async readUpdated(documentView, id) {
+		try {
+			return await documentView.get(id);
+		} catch (error) {
+			if (DocumentNotFoundError.isError(error)) return void 0;
+			throw error;
 		}
 	}
 };
@@ -4750,7 +5429,8 @@ var GroupReevaluationTrigger = class extends BaseReadModel {
 			rebuildStateOnInit: false,
 			indexing: unchunkedReadModelIndexingConfig,
 			startFrom: "head",
-			replayStreamSuffix: false
+			replayStreamSuffix: false,
+			purgeFence: "none"
 		});
 		this.logger = logger;
 		this.eventBus = eventBus;
@@ -4878,7 +5558,8 @@ const SyncEventTypes = {
 	DEAD_LETTER_ADDED: 20004,
 	CONNECTION_STATE_CHANGED: 20005,
 	SYNC_HELD: 20006,
-	SYNC_RELEASED: 20007
+	SYNC_RELEASED: 20007,
+	PURGE_REFUSED: 20008
 };
 //#endregion
 //#region src/sync/mailbox.ts
@@ -4892,7 +5573,10 @@ var MailboxAggregateError = class extends Error {
 	}
 };
 var Mailbox = class {
+	holdAckBelowMarkers;
 	itemsMap = /* @__PURE__ */ new Map();
+	/** Unapplied items carrying a marker, so the held ack reads only these. */
+	heldMarkers = /* @__PURE__ */ new Set();
 	addedCallbacks = [];
 	removedCallbacks = [];
 	paused = false;
@@ -4900,6 +5584,9 @@ var Mailbox = class {
 	removedBuffer = [];
 	_ack = 0;
 	_latestOrdinal = 0;
+	constructor(options = {}) {
+		this.holdAckBelowMarkers = options.holdAckBelowMarkers ?? false;
+	}
 	init(ackOrdinal) {
 		this._ack = this._latestOrdinal = ackOrdinal;
 	}
@@ -4910,7 +5597,13 @@ var Mailbox = class {
 		return Array.from(this.itemsMap.values());
 	}
 	get ackOrdinal() {
-		return this._ack;
+		if (!this.holdAckBelowMarkers) return this._ack;
+		let floor = Number.POSITIVE_INFINITY;
+		for (const item of this.heldMarkers) for (const op of item.operations) {
+			const ordinal = op.context.ordinal;
+			if (ordinal > 0 && ordinal < floor) floor = ordinal;
+		}
+		return Math.min(this._ack, floor - 1);
 	}
 	get latestOrdinal() {
 		return this._latestOrdinal;
@@ -4920,10 +5613,20 @@ var Mailbox = class {
 	}
 	add(...items) {
 		for (const item of items) {
+			const replaced = this.itemsMap.get(item.id);
+			if (replaced !== void 0) this.heldMarkers.delete(replaced);
 			this.itemsMap.set(item.id, item);
-			for (const op of item.operations) this._latestOrdinal = Math.max(this._latestOrdinal, op.context.ordinal);
+			let marker = false;
+			for (const op of item.operations) {
+				this._latestOrdinal = Math.max(this._latestOrdinal, op.context.ordinal);
+				if (isPurgeMarker$1(op)) marker = true;
+			}
+			if (this.holdAckBelowMarkers && marker && item.status !== 2) this.heldMarkers.add(item);
 			item.on((syncOp, _, next) => {
-				if (next === 2) for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
+				if (next === 2) {
+					this.heldMarkers.delete(syncOp);
+					for (const op of syncOp.operations) this._ack = Math.max(this._ack, op.context.ordinal);
+				}
 			});
 		}
 		if (this.paused) {
@@ -4940,7 +5643,10 @@ var Mailbox = class {
 		if (errors.length > 0) throw new MailboxAggregateError(errors);
 	}
 	remove(...items) {
-		for (const item of items) this.itemsMap.delete(item.id);
+		for (const item of items) {
+			this.itemsMap.delete(item.id);
+			this.heldMarkers.delete(item);
+		}
 		if (this.paused) {
 			this.removedBuffer.push(...items);
 			return;
@@ -5151,14 +5857,20 @@ var GraphQLRequestError = class extends Error {
 * difference between a channel that recovers and one that is dead for the
 * process lifetime.
 */
-const RECOVERABLE_GRAPHQL_ERROR_CODES = { 
-/**
-* A stored operation cannot be represented in the schema - an action with no
-* id, say. The document holding it needs repairing, but the channel serves
-* every other document, and a peer that stopped polling would stop receiving
-* those too.
-*/
-malformedStoredOperation: "MALFORMED_STORED_OPERATION" };
+const RECOVERABLE_GRAPHQL_ERROR_CODES = {
+	/**
+	* A stored operation cannot be represented in the schema - an action with no
+	* id, say. The document holding it needs repairing, but the channel serves
+	* every other document, and a peer that stopped polling would stop receiving
+	* those too.
+	*/
+	malformedStoredOperation: "MALFORMED_STORED_OPERATION",
+	/**
+	* The poll's marker refusals could not be recorded, so nothing was served.
+	* The client keeps them pending and reports them on its next poll.
+	*/
+	refusalNotRecorded: "REFUSAL_NOT_RECORDED"
+};
 const RECOVERABLE_CODES = new Set(Object.values(RECOVERABLE_GRAPHQL_ERROR_CODES));
 /**
 * True when every error the response carried named a recoverable code.
@@ -5344,6 +6056,11 @@ function filterOperations(operations, filter) {
 		return true;
 	});
 }
+/** Markers pass every remote filter, as they pass sinceTimestamp. */
+function filterForRemote(operations, filter) {
+	const kept = new Set(filterOperations(operations, filter));
+	return operations.filter((op) => kept.has(op) || isPurgeMarker$1(op));
+}
 /**
 * Creates an idle channel health status.
 *
@@ -5621,6 +6338,11 @@ function classifyJobFailure(errorName) {
 		case "InvalidSignatureError": return "SIGNATURE_INVALID";
 		case "HashMismatchError": return "HASH_MISMATCH";
 		case "UnsupportedProtocolVersionError": return "UNSUPPORTED_PROTOCOL";
+		case "DocumentPurgedError": return "DOCUMENT_PURGED";
+		case "DocumentNotDeletedError":
+		case "GroupInUseError":
+		case "PurgeTooLargeError": return "PURGE_PRECONDITION";
+		case "ReservedActionError": return "RESERVED_ACTION";
 		default: return "UNCLASSIFIED";
 	}
 }
@@ -5632,7 +6354,10 @@ function syncOperationErrorType(error) {
 const NON_QUARANTINING_ERROR_TYPES = /* @__PURE__ */ new Set([
 	"AUTH_TIMESTAMP_NOT_MONOTONIC",
 	"UNSUPPORTED_PROTOCOL",
-	"PEER_PROTOCOL_UNSUPPORTED"
+	"PEER_PROTOCOL_UNSUPPORTED",
+	"DOCUMENT_PURGED",
+	"PURGE_PRECONDITION",
+	"MARKER_REFUSED"
 ]);
 /**
 * A held auth operation must not quarantine: reconciling the two policies needs
@@ -5752,6 +6477,13 @@ var IntervalPollTimer = class {
 	}
 };
 //#endregion
+//#region src/sync/purge-refusals.ts
+/** The most refusals a poll reports; the rest wait for the next poll. */
+const MAX_POLLED_REFUSALS = 100;
+function supportsPurgeRefusals(x) {
+	return typeof x === "object" && x !== null && typeof x.recordPurgeRefusal === "function" && typeof x.recordPolledMarkerRefusals === "function";
+}
+//#endregion
 //#region src/sync/channels/utils.ts
 let syncOpCounter = 0;
 /**
@@ -5879,6 +6611,9 @@ const AGREEMENT_FIELDS = [
 	"refusals",
 	"SyncRefusalInput"
 ];
+function refusalKey(refusal) {
+	return `${refusal.documentId}\u0000${refusal.branch}\u0000${refusal.kind ?? ""}`;
+}
 /** How often a channel whose remote went silent asks again whether it serves agreement. */
 const AGREEMENT_PROBE_INTERVAL_MS = 3e5;
 function pushMutation(withGatedUnder) {
@@ -5932,6 +6667,10 @@ var GqlRequestChannel = class {
 	manifestRefresh;
 	/** Polled rows this reactor could not run, reported on the next poll. */
 	pendingRefusals = /* @__PURE__ */ new Map();
+	/** When each pushed, unacknowledged marker entry was last pushed. */
+	markerPushedAt = /* @__PURE__ */ new Map();
+	/** Documents whose marker the remote refused; its report repeats per poll. */
+	refusedMarkers = /* @__PURE__ */ new Set();
 	isRecovering = false;
 	connectionState = "connecting";
 	/** Latest unrecoverable error was an auth rejection; cleared on connect. */
@@ -5955,21 +6694,30 @@ var GqlRequestChannel = class {
 		};
 		this.isShutdown = false;
 		this.failureCount = 0;
-		this.inbox = new Mailbox();
+		this.inbox = new Mailbox({ holdAckBelowMarkers: true });
 		this.bufferedOutbox = new BufferedMailbox(500, 25);
 		this.outbox = this.bufferedOutbox;
 		this.deadLetter = new Mailbox();
 		this.deadLetter.onAdded((syncOps) => {
 			for (const syncOp of syncOps) {
 				this.logger.warn("Dead letter added for document @DocumentId on channel @ChannelId", syncOp.documentId, this.channelId);
-				if (syncOp.error?.source === "inbox" && syncOperationErrorType(syncOp.error) === "UNSUPPORTED_PROTOCOL") this.pendingRefusals.set(`${syncOp.documentId}:${syncOp.branch}`, {
+				if (syncOp.error?.source !== "inbox") continue;
+				const errorType = syncOperationErrorType(syncOp.error);
+				const refusal = errorType === "UNSUPPORTED_PROTOCOL" ? {
 					documentId: syncOp.documentId,
 					branch: syncOp.branch
-				});
+				} : errorType === "MARKER_REFUSED" ? {
+					documentId: syncOp.documentId,
+					branch: syncOp.branch,
+					kind: "marker"
+				} : void 0;
+				if (refusal) this.pendingRefusals.set(refusalKey(refusal), refusal);
 			}
 		});
-		this.outbox.onAdded((syncOps) => {
+		this.outbox.onAdded((added) => {
 			if (this.isShutdown) return;
+			const syncOps = added.filter((op) => this.outbox.get(op.id) === op);
+			if (syncOps.length === 0) return;
 			if (this.isPushing) {
 				this.pendingDrain = true;
 				return;
@@ -5982,6 +6730,7 @@ var GqlRequestChannel = class {
 			this.attemptPush(syncOps);
 		});
 		this.outbox.onRemoved((syncOps) => {
+			for (const syncOp of syncOps) this.markerPushedAt.delete(syncOp.id);
 			const ordinal = Math.min(getLatestAppliedOrdinal(syncOps), this.unappliedFloor() - 1);
 			if (ordinal > this.lastPersistedOutboxOrdinal) {
 				this.lastPersistedOutboxOrdinal = ordinal;
@@ -5995,8 +6744,8 @@ var GqlRequestChannel = class {
 				});
 			}
 		});
-		this.inbox.onRemoved((syncOps) => {
-			const maxOrdinal = getLatestAppliedOrdinal(syncOps);
+		this.inbox.onRemoved(() => {
+			const maxOrdinal = this.inbox.ackOrdinal;
 			if (maxOrdinal > this.lastPersistedInboxOrdinal) {
 				this.lastPersistedInboxOrdinal = maxOrdinal;
 				this.cursorStorage.upsert({
@@ -6060,6 +6809,9 @@ var GqlRequestChannel = class {
 			this.peerManifestCallbacks.delete(callback);
 		};
 	}
+	forgetMarkerRefusal(documentId, branch) {
+		this.refusedMarkers.delete(`${documentId}\u0000${branch}`);
+	}
 	async hearPeer(manifest, undelivered) {
 		if (this.peerManifest !== void 0 && (this.peerManifest?.revision ?? null) === (manifest?.revision ?? null) || isOlderManifest(manifest, this.peerManifest)) return;
 		this.peerManifest = manifest;
@@ -6146,6 +6898,8 @@ var GqlRequestChannel = class {
 		}
 		const { envelopes, ackOrdinal, deadLetters, hasMore, manifestRevision, peerManifestRevision } = response;
 		if (ackOrdinal > 0) trimMailboxFromAckOrdinal(this.outbox, ackOrdinal);
+		this.retireRefusedMarkers(deadLetters);
+		this.repushUnackedMarkers();
 		if (!await this.refreshManifestsIfStale(manifestRevision, peerManifestRevision)) return;
 		const allSyncOps = [];
 		for (const envelope of envelopes) if (envelope.type.toLowerCase() === "operations" && envelope.operations) {
@@ -6169,7 +6923,15 @@ var GqlRequestChannel = class {
 	* Handles dead letters reported by the remote server.
 	* Creates local dead letter SyncOperations so the channel quiesces.
 	*/
-	handleRemoteDeadLetters(deadLetters) {
+	handleRemoteDeadLetters(wire) {
+		const deadLetters = wire.filter((dl) => {
+			if (dl.errorType !== "MARKER_REFUSED") return true;
+			const key = `${dl.documentId}\u0000${dl.branch}`;
+			if (this.refusedMarkers.has(key)) return false;
+			this.refusedMarkers.add(key);
+			return true;
+		});
+		if (deadLetters.length === 0) return;
 		for (const dl of deadLetters) this.logger.error("Remote dead letter on @ChannelId: document @DocumentId failed with: @Error", this.channelId, dl.documentId, dl.error);
 		const syncOps = [];
 		for (const dl of deadLetters) {
@@ -6275,7 +7037,7 @@ var GqlRequestChannel = class {
 		let refusals = [];
 		for (;;) {
 			const revision = this.peerServesAgreement ? this.localManifestProvider?.().revision : void 0;
-			refusals = this.peerServesAgreement ? [...this.pendingRefusals.values()] : [];
+			refusals = this.peerServesAgreement ? [...this.pendingRefusals.values()].filter((refusal) => refusal.kind === void 0 || this.peerTakesMarkerRefusals()).slice(0, 100) : [];
 			try {
 				response = await this.executeGraphQL(this.pollQuery(this.peerServesDecisionFields, this.peerServesAgreement), this.peerServesAgreement ? {
 					...variables,
@@ -6293,7 +7055,7 @@ var GqlRequestChannel = class {
 				this.peerServesDecisionFields = false;
 			}
 		}
-		for (const refusal of refusals) this.pendingRefusals.delete(`${refusal.documentId}:${refusal.branch}`);
+		for (const refusal of refusals) this.pendingRefusals.delete(refusalKey(refusal));
 		return {
 			envelopes: response.pollSyncEnvelopes.envelopes,
 			ackOrdinal: response.pollSyncEnvelopes.ackOrdinal,
@@ -6303,11 +7065,15 @@ var GqlRequestChannel = class {
 			peerManifestRevision: response.pollSyncEnvelopes.peerManifestRevision
 		};
 	}
+	/** A peer before the feature would reject the field; its refusals wait. */
+	peerTakesMarkerRefusals() {
+		return this.peerManifest?.features[MARKER_REFUSAL_FEATURE]?.includes(1) === true;
+	}
 	rejectsAgreementFields(error) {
 		return this.peerServesAgreement && this.isAgreementRejection(error);
 	}
 	isAgreementRejection(error) {
-		if (!(error instanceof GraphQLRequestError) || error.category !== "graphql") return false;
+		if (!(error instanceof GraphQLRequestError) || error.category !== "graphql" || isRecoverableGraphQLError(error)) return false;
 		return AGREEMENT_FIELDS.some((field) => error.message.includes(field));
 	}
 	/** Resolves once what the silent peer cannot run is held. */
@@ -6491,6 +7257,25 @@ var GqlRequestChannel = class {
 			}
 		});
 	}
+	/** Stops pushing a marker entry the remote refused; its wire has no op id. */
+	retireRefusedMarkers(deadLetters) {
+		const refused = deadLetters.filter((dl) => dl.errorType === "MARKER_REFUSED");
+		if (refused.length === 0) return;
+		const retired = this.outbox.items.filter((syncOp) => this.markerPushedAt.has(syncOp.id) && syncOp.status !== 2 && refused.some((dl) => dl.documentId === syncOp.documentId && dl.branch === syncOp.branch));
+		if (retired.length === 0) return;
+		for (const syncOp of retired) syncOp.failed(new ChannelError("outbox", /* @__PURE__ */ new Error(`Remote refused the purge marker of ${syncOp.documentId}`), "MARKER_REFUSED"));
+		this.outbox.remove(...retired);
+	}
+	/** Re-pushes markers unacked for retryMaxDelayMs: a restarted remote lost them. */
+	repushUnackedMarkers() {
+		if (this.isPushing || this.pushBlocked || this.receivingPages) return;
+		const due = Date.now() - this.config.retryMaxDelayMs;
+		const stale = this.outbox.items.filter((syncOp) => {
+			const pushedAt = this.markerPushedAt.get(syncOp.id);
+			return pushedAt !== void 0 && pushedAt <= due && syncOp.status !== 2;
+		});
+		if (stale.length > 0) this.attemptPush(stale);
+	}
 	/**
 	* Schedules a retry of all current outbox items using exponential backoff.
 	*/
@@ -6543,7 +7328,11 @@ var GqlRequestChannel = class {
 	* Creates one SyncEnvelope per SyncOperation with key/dependsOn for batch ordering.
 	*/
 	async pushSyncOperations(syncOps) {
-		for (const syncOp of syncOps) syncOp.started();
+		const now = Date.now();
+		for (const syncOp of syncOps) {
+			syncOp.started();
+			if (syncOp.operations.some((op) => isPurgeMarker$1(op))) this.markerPushedAt.set(syncOp.id, now);
+		}
 		const gatedUnder = this.peerServesAgreement ? this.peerManifest?.revision : void 0;
 		try {
 			await this.executeGraphQL(pushMutation(gatedUnder !== void 0), {
@@ -6766,7 +7555,7 @@ var GqlResponseChannel = class {
 		this.remoteName = remoteName;
 		this.cursorStorage = cursorStorage;
 		this.isShutdown = false;
-		this.inbox = new Mailbox();
+		this.inbox = new Mailbox({ holdAckBelowMarkers: true });
 		this.outbox = new Mailbox();
 		this.deadLetter = new Mailbox();
 		this.outbox.onRemoved((syncOps) => {
@@ -6776,8 +7565,8 @@ var GqlResponseChannel = class {
 		this.outbox.onAdded((syncOps) => {
 			this.forgetEvictedBelow(syncOps);
 		});
-		this.inbox.onRemoved((syncOps) => {
-			const maxOrdinal = getLatestAppliedOrdinal(syncOps);
+		this.inbox.onRemoved(() => {
+			const maxOrdinal = this.inbox.ackOrdinal;
 			if (maxOrdinal > this.lastPersistedInboxOrdinal) {
 				this.lastPersistedInboxOrdinal = maxOrdinal;
 				this.cursorStorage.upsert({
@@ -6928,6 +7717,40 @@ var GqlResponseChannelFactory = class {
 	}
 };
 //#endregion
+//#region src/storage/kysely/delivery-lookup.ts
+/** The index row at `ordinal` and every membership of its document. */
+async function deliveryAt(db, documentId, ordinal) {
+	const row = await db.selectFrom("operation_index_operations").selectAll().where("ordinal", "=", ordinal).where("documentId", "=", documentId).executeTakeFirst();
+	if (!row) return void 0;
+	const memberships = await db.selectFrom("document_collections").select([
+		"collectionId",
+		"joinedOrdinal",
+		"leftOrdinal"
+	]).where("documentId", "=", documentId).execute();
+	return {
+		entry: {
+			ordinal: row.ordinal,
+			documentId: row.documentId,
+			documentType: row.documentType,
+			branch: row.branch,
+			scope: row.scope,
+			index: row.index,
+			timestampUtcMs: row.timestampUtcMs,
+			hash: row.hash,
+			skip: row.skip,
+			action: row.action,
+			deniedReason: row.deniedReason ?? void 0,
+			id: row.opId,
+			sourceRemote: row.sourceRemote
+		},
+		memberships: memberships.map((membership) => ({
+			collectionId: membership.collectionId,
+			joinedOrdinal: Number(membership.joinedOrdinal),
+			leftOrdinal: membership.leftOrdinal === null ? null : Number(membership.leftOrdinal)
+		}))
+	};
+}
+//#endregion
 //#region src/storage/kysely/sync-cursor-storage.ts
 function rowToRemoteCursor(row) {
 	return {
@@ -7052,6 +7875,8 @@ var KyselySyncDeadLetterStorage = class {
 	async add(deadLetter, signal) {
 		if (signal?.aborted) throw new Error("Operation aborted");
 		await this.db.transaction().execute(async (trx) => {
+			await acquirePurgeLocks(trx, [deadLetter.documentId], "shared");
+			if ((await findPurged(trx, [deadLetter.documentId])).size > 0) throw new DocumentPurgedError(deadLetter.documentId);
 			const insertable = deadLetterRecordToRow(deadLetter);
 			await trx.insertInto("sync_dead_letters").values(insertable).onConflict((oc) => oc.column("id").doNothing()).execute();
 		});
@@ -7109,14 +7934,20 @@ var KyselySyncHoldStorage = class {
 			version: hold.version,
 			held_at_utc_ms: hold.heldAtUtcMs
 		};
-		await this.db.insertInto("sync_holds").values(row).onConflict((oc) => oc.columns([
-			"remote_name",
-			"document_id",
-			"branch"
-		]).doUpdateSet({
-			protocol: row.protocol,
-			version: row.version
-		})).execute();
+		await this.db.transaction().execute(async (trx) => {
+			await acquirePurgeLocks(trx, [hold.documentId], "shared");
+			if (hold.protocol !== DOCUMENT_PURGE_PROTOCOL) {
+				if ((await findPurged(trx, [hold.documentId])).size > 0) throw new DocumentPurgedError(hold.documentId);
+			}
+			await trx.insertInto("sync_holds").values(row).onConflict((oc) => oc.columns([
+				"remote_name",
+				"document_id",
+				"branch"
+			]).doUpdateSet({
+				protocol: row.protocol,
+				version: row.version
+			})).execute();
+		});
 	}
 	async remove(remoteName, documentId, branch) {
 		await this.db.deleteFrom("sync_holds").where("remote_name", "=", remoteName).where("document_id", "=", documentId).where("branch", "=", branch).execute();
@@ -7126,6 +7957,69 @@ var KyselySyncHoldStorage = class {
 	}
 };
 //#endregion
+//#region src/storage/kysely/sync-purge-refusal-storage.ts
+var KyselySyncPurgeRefusalStorage = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async list(documentId) {
+		return (await this.db.selectFrom("sync_purge_refusals").selectAll().where("document_id", "=", documentId).orderBy("refused_at_utc_ms").orderBy("remote_name").execute()).map((row) => ({
+			remoteName: row.remote_name,
+			documentId: row.document_id,
+			branch: row.branch,
+			refusedAtUtcMs: Number(row.refused_at_utc_ms)
+		}));
+	}
+	async record(refusals) {
+		if (refusals.length === 0) return;
+		await this.db.insertInto("sync_purge_refusals").values(refusals.map((refusal) => ({
+			remote_name: refusal.remoteName,
+			document_id: refusal.documentId,
+			branch: refusal.branch,
+			refused_at_utc_ms: refusal.refusedAtUtcMs
+		}))).onConflict((oc) => oc.columns([
+			"remote_name",
+			"document_id",
+			"branch"
+		]).doNothing()).execute();
+	}
+};
+//#endregion
+//#region src/storage/kysely/sync-received-marker-storage.ts
+var KyselySyncReceivedMarkerStorage = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async list(remoteName) {
+		return (await this.db.selectFrom("sync_received_markers").selectAll().where("remote_name", "=", remoteName).orderBy("received_at_utc_ms").execute()).map((row) => ({
+			remoteName: row.remote_name,
+			markerId: row.marker_id,
+			documentId: row.document_id,
+			branch: row.branch,
+			operation: row.operation,
+			receivedAtUtcMs: Number(row.received_at_utc_ms)
+		}));
+	}
+	async upsert(record) {
+		await this.db.insertInto("sync_received_markers").values({
+			remote_name: record.remoteName,
+			marker_id: record.markerId,
+			document_id: record.documentId,
+			branch: record.branch,
+			operation: JSON.stringify(record.operation),
+			received_at_utc_ms: record.receivedAtUtcMs
+		}).onConflict((oc) => oc.columns(["remote_name", "marker_id"]).doNothing()).execute();
+	}
+	async remove(remoteName, markerId) {
+		await this.db.deleteFrom("sync_received_markers").where("remote_name", "=", remoteName).where("marker_id", "=", markerId).execute();
+	}
+	async removeRemote(remoteName) {
+		await this.db.deleteFrom("sync_received_markers").where("remote_name", "=", remoteName).execute();
+	}
+};
+//#endregion
 //#region src/storage/kysely/sync-remote-storage.ts
 function rowToPeer(row) {
 	if (row.peer_manifest_at_utc_ms === null) return;
@@ -7244,6 +8138,8 @@ var KyselySyncRemoteStorage = class {
 //#region src/sync/batch-aggregator.ts
 /** Queued between write-ready events when the settled watermark advances. */
 const SETTLED = Symbol("settled");
+/** Batches remembered as finished, so a repeated JOB_FAILED is ignored. */
+const FINISHED_BATCH_MEMORY = 1024;
 var BatchAggregator = class {
 	logger;
 	driveContainerTypes;
@@ -7252,6 +8148,7 @@ var BatchAggregator = class {
 	queue = [];
 	processing = false;
 	pendingBatches = /* @__PURE__ */ new Map();
+	finishedBatches = /* @__PURE__ */ new Set();
 	constructor(logger, driveContainerTypes, onBatchReady, onSettled) {
 		this.logger = logger;
 		this.driveContainerTypes = driveContainerTypes;
@@ -7268,16 +8165,13 @@ var BatchAggregator = class {
 		await this.processQueue();
 	}
 	async handleJobFailed(event) {
-		const batchId = event.job?.meta.batchId;
-		if (!batchId) return;
-		const pending = this.pendingBatches.get(batchId);
-		if (!pending) return;
-		this.pendingBatches.delete(batchId);
-		if (pending.events.length > 0) await this.onBatchReady(this.prepareBatch(pending.events));
+		this.queue.push({ failed: event });
+		await this.processQueue();
 	}
 	clear() {
 		this.queue = [];
 		this.pendingBatches.clear();
+		this.finishedBatches.clear();
 	}
 	async processQueue() {
 		if (this.processing) return;
@@ -7293,6 +8187,14 @@ var BatchAggregator = class {
 					}
 					continue;
 				}
+				if ("failed" in item) {
+					try {
+						await this.handleFailed(item.failed);
+					} catch (error) {
+						this.logger.error("Failed to process job-failed event (@jobId, @error)", item.failed.jobId, error instanceof Error ? error.message : String(error));
+					}
+					continue;
+				}
 				try {
 					await this.handleWriteReady(item);
 				} catch (error) {
@@ -7306,25 +8208,49 @@ var BatchAggregator = class {
 	}
 	async handleWriteReady(event) {
 		const { batchId, batchJobIds } = event.jobMeta;
-		if (batchJobIds.length <= 1) {
+		const pending = batchJobIds.length > 1 ? this.pendingFor(batchId, batchJobIds) : void 0;
+		if (!pending) {
 			await this.onBatchReady(this.prepareBatch([event]));
 			return;
 		}
+		pending.resolvedJobIds.add(event.jobId);
+		pending.events.push(event);
+		if (this.finishIfResolved(batchId, pending)) await this.onBatchReady(this.prepareBatch(pending.events));
+	}
+	/** A failed job never arrives, so what its batch holds goes now. */
+	async handleFailed(event) {
+		const meta = event.job?.meta;
+		if (!meta?.batchId || meta.batchJobIds.length <= 1) return;
+		const pending = this.pendingFor(meta.batchId, meta.batchJobIds);
+		if (!pending) return;
+		pending.resolvedJobIds.add(event.jobId);
+		this.finishIfResolved(meta.batchId, pending);
+		const events = pending.events;
+		pending.events = [];
+		if (events.length > 0) await this.onBatchReady(this.prepareBatch(events));
+	}
+	pendingFor(batchId, batchJobIds) {
+		if (this.finishedBatches.has(batchId)) return;
 		let pending = this.pendingBatches.get(batchId);
 		if (!pending) {
 			pending = {
 				expectedJobIds: new Set(batchJobIds),
-				arrivedJobIds: /* @__PURE__ */ new Set(),
+				resolvedJobIds: /* @__PURE__ */ new Set(),
 				events: []
 			};
 			this.pendingBatches.set(batchId, pending);
 		}
-		pending.arrivedJobIds.add(event.jobId);
-		pending.events.push(event);
-		if (pending.arrivedJobIds.size >= pending.expectedJobIds.size) {
-			this.pendingBatches.delete(batchId);
-			await this.onBatchReady(this.prepareBatch(pending.events));
+		return pending;
+	}
+	finishIfResolved(batchId, pending) {
+		for (const id of pending.expectedJobIds) if (!pending.resolvedJobIds.has(id)) return false;
+		this.pendingBatches.delete(batchId);
+		this.finishedBatches.add(batchId);
+		if (this.finishedBatches.size > FINISHED_BATCH_MEMORY) {
+			const oldest = this.finishedBatches.values().next().value;
+			this.finishedBatches.delete(oldest);
 		}
+		return true;
 	}
 	prepareBatch(events) {
 		const collectionMemberships = this.mergeCollectionMemberships(events);
@@ -7365,8 +8291,42 @@ var BatchAggregator = class {
 	}
 };
 //#endregion
+//#region src/sync/delivery-tracking.ts
+function supportsDeliveryTracking(x) {
+	return typeof x === "object" && x !== null && typeof x.pendingDelivery === "function";
+}
+/** The outbox's rule: remotes it would serve the row to, not yet acknowledged. */
+async function pendingDelivery(deps, documentId, ordinal) {
+	const row = await deps.lookup.at(documentId, ordinal);
+	if (!row) throw new Error(`No operation of document ${documentId} at ordinal ${ordinal}`);
+	const { entry, memberships } = row;
+	const operation = toOperationWithContext(entry);
+	const holds = await deps.holds.list({ documentId });
+	const pending = [];
+	for (const remote of deps.remotes) {
+		const name = remote.meta.name;
+		const membership = memberships.find((candidate) => candidate.collectionId === remote.meta.collectionId.key && (candidate.leftOrdinal === null || ordinal < candidate.leftOrdinal));
+		if (!membership) continue;
+		if (entry.sourceRemote === name) continue;
+		if (filterForRemote([operation], remote.meta.filter).length === 0) continue;
+		if (holds.some((hold) => hold.remoteName === name && hold.branch === entry.branch)) {
+			pending.push({
+				remote: name,
+				state: "held"
+			});
+			continue;
+		}
+		const owedThrough = Math.max(ordinal, membership.joinedOrdinal);
+		if ((await deps.cursors.get(name, "outbox")).cursorOrdinal < owedThrough) pending.push({
+			remote: name,
+			state: remote.channel.getConnectionState().state
+		});
+	}
+	return pending;
+}
+//#endregion
 //#region src/sync/memory-hold-storage.ts
-const keyOf = (remoteName, documentId, branch) => `${remoteName}\u0000${documentId}\u0000${branch}`;
+const keyOf$2 = (remoteName, documentId, branch) => `${remoteName}\u0000${documentId}\u0000${branch}`;
 /** For a sync manager built without a database. */
 var InMemorySyncHoldStorage = class {
 	holds = /* @__PURE__ */ new Map();
@@ -7374,7 +8334,7 @@ var InMemorySyncHoldStorage = class {
 		return Promise.resolve([...this.holds.values()].filter((hold) => (filter.remoteName === void 0 || hold.remoteName === filter.remoteName) && (filter.documentId === void 0 || hold.documentId === filter.documentId)));
 	}
 	upsert(hold) {
-		const key = keyOf(hold.remoteName, hold.documentId, hold.branch);
+		const key = keyOf$2(hold.remoteName, hold.documentId, hold.branch);
 		const known = this.holds.get(key);
 		this.holds.set(key, {
 			...hold,
@@ -7383,7 +8343,7 @@ var InMemorySyncHoldStorage = class {
 		return Promise.resolve();
 	}
 	remove(remoteName, documentId, branch) {
-		this.holds.delete(keyOf(remoteName, documentId, branch));
+		this.holds.delete(keyOf$2(remoteName, documentId, branch));
 		return Promise.resolve();
 	}
 	removeRemote(remoteName) {
@@ -7392,6 +8352,46 @@ var InMemorySyncHoldStorage = class {
 	}
 };
 //#endregion
+//#region src/sync/memory-purge-refusal-storage.ts
+const keyOf$1 = (refusal) => `${refusal.remoteName}\u0000${refusal.documentId}\u0000${refusal.branch}`;
+/** For a sync manager built without a database. */
+var InMemorySyncPurgeRefusalStorage = class {
+	records = /* @__PURE__ */ new Map();
+	list(documentId) {
+		return Promise.resolve([...this.records.values()].filter((record) => record.documentId === documentId));
+	}
+	record(refusals) {
+		for (const refusal of refusals) {
+			const key = keyOf$1(refusal);
+			if (!this.records.has(key)) this.records.set(key, refusal);
+		}
+		return Promise.resolve();
+	}
+};
+//#endregion
+//#region src/sync/memory-received-marker-storage.ts
+const keyOf = (remoteName, markerId) => `${remoteName}\u0000${markerId}`;
+/** For a sync manager built without a database. */
+var InMemorySyncReceivedMarkerStorage = class {
+	records = /* @__PURE__ */ new Map();
+	list(remoteName) {
+		return Promise.resolve([...this.records.values()].filter((record) => record.remoteName === remoteName));
+	}
+	upsert(record) {
+		const key = keyOf(record.remoteName, record.markerId);
+		if (!this.records.has(key)) this.records.set(key, record);
+		return Promise.resolve();
+	}
+	remove(remoteName, markerId) {
+		this.records.delete(keyOf(remoteName, markerId));
+		return Promise.resolve();
+	}
+	removeRemote(remoteName) {
+		for (const [key, record] of this.records) if (record.remoteName === remoteName) this.records.delete(key);
+		return Promise.resolve();
+	}
+};
+//#endregion
 //#region src/sync/peer-agreement.ts
 /** Pure over the remote records it is given, live or not. */
 function createPeerAgreement(basis, remotes) {
@@ -7637,7 +8637,9 @@ const defaultSyncManagerConfig = {
 	maxDeadLettersPerRemote: 100,
 	maxInboxBatchSize: 32,
 	maxHeldOperationsPerRemote: 1e4,
-	staleRemotePollWindowMs: 3e5
+	staleRemotePollWindowMs: 3e5,
+	markerRetryBaseDelayMs: 1e3,
+	markerRetryMaxDelayMs: 6e4
 };
 const PLAN_KEY_TO_JOB_UUID_CAP = 1e4;
 /**
@@ -7655,6 +8657,20 @@ const VERSION_CACHE_CAP = 1e4;
 function createdVersions(operations, documentId) {
 	for (const { operation, context } of operations) if (context.documentId === documentId && operation.action.type === "CREATE_DOCUMENT") return operation.action.input.protocolVersions ?? {};
 }
+/** The load was refused because this very id is purged here: a drop. */
+function isPurgedFailure(error, documentId) {
+	return error?.name === "DocumentPurgedError" && error.documentId === documentId;
+}
+function carriesMarker(syncOp) {
+	return syncOp.operations.some((op) => isPurgeMarker$1(op));
+}
+function markerIdsOf(syncOp) {
+	return syncOp.operations.filter((op) => isPurgeMarker$1(op)).map((op) => op.operation.id);
+}
+/** Refused, or purged under another id: final, unlike an outage. */
+function isRefusedMarker(error) {
+	return error?.name === "InvalidSignatureError" || error?.name === "DocumentPurgedError";
+}
 /** Where a sync operation's run of ordinals begins. */
 function firstOrdinalOf(syncOp) {
 	return syncOp.operations.length > 0 ? syncOp.operations[0].context.ordinal : 0;
@@ -7680,6 +8696,10 @@ var SyncManager = class {
 	config;
 	connectionStateUnsubscribes = /* @__PURE__ */ new Map();
 	quarantinedDocumentIds = /* @__PURE__ */ new Set();
+	purgedDocumentIds = /* @__PURE__ */ new Set();
+	purges;
+	delivery;
+	forgetDocument;
 	backfillAbortControllers = /* @__PURE__ */ new Map();
 	planKeyToJobUuid = /* @__PURE__ */ new Map();
 	evictedOutboxFloors = /* @__PURE__ */ new Map();
@@ -7691,6 +8711,8 @@ var SyncManager = class {
 	lastEnqueuedJobIdByKey = /* @__PURE__ */ new Map();
 	watermark;
 	owed = /* @__PURE__ */ new Map();
+	derivedThrough = /* @__PURE__ */ new Map();
+	sweptThrough = 0;
 	settledUnsubscribe;
 	inboxChunkChain = Promise.resolve();
 	capabilities;
@@ -7705,17 +8727,29 @@ var SyncManager = class {
 	protocolVersionsOf;
 	peerUpdates = /* @__PURE__ */ new Map();
 	peerUnsubscribes = /* @__PURE__ */ new Map();
+	receivedMarkers = /* @__PURE__ */ new Map();
+	markerStorage;
+	refusalStorage;
+	markerWrites = /* @__PURE__ */ new Map();
+	restoredMarkers = /* @__PURE__ */ new WeakSet();
+	markerRetries = /* @__PURE__ */ new Map();
 	constructor(logger, remoteStorage, cursorStorage, deadLetterStorage, channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, watermark, config = {}, localPeer = {
 		capabilities: PEER_CAPABILITIES,
 		flags: {}
-	}, holds = new InMemorySyncHoldStorage()) {
+	}, holds = new InMemorySyncHoldStorage(), purges, receivedMarkers = new InMemorySyncReceivedMarkerStorage(), delivery, refusals = new InMemorySyncPurgeRefusalStorage()) {
+		this.markerStorage = receivedMarkers;
+		this.refusalStorage = refusals;
 		this.watermark = watermark;
+		this.purges = purges;
+		this.delivery = delivery;
+		this.forgetDocument = localPeer.forgetDocument;
 		this.capabilities = localPeer.capabilities;
 		this.manifest = localPeerManifest(localPeer.capabilities, localPeer.flags, localPeer.appKey, localPeer.sequence ?? Date.now());
 		this.localSupport = localSupports(localPeer.capabilities, localPeer.flags);
 		this.legacy = legacySupports(localPeer.capabilities);
 		for (const capability of localPeer.capabilities) {
 			if (capability.kind !== "protocol") continue;
+			if (capability.name === DOCUMENT_PURGE_PROTOCOL) continue;
 			const supported = capability.supported(localPeer.flags);
 			const wanted = capability.preferred?.(localPeer.flags) ?? (supported.length > 0 ? Math.max(...supported) : void 0);
 			if (wanted !== void 0) this.wanted[capability.name] = wanted;
@@ -7749,6 +8783,11 @@ var SyncManager = class {
 		} catch (error) {
 			this.logger.error("Failed to load quarantined document IDs (@error)", error instanceof Error ? error.message : String(error));
 		}
+		try {
+			for (const id of await this.purges?.listPurged() ?? []) this.purgedDocumentIds.add(id);
+		} catch (error) {
+			this.logger.error("Failed to load purged document IDs (@error)", error instanceof Error ? error.message : String(error));
+		}
 		try {
 			for (const hold of await this.holds.list()) this.heldFor(hold.remoteName).set(holdKey(hold.documentId, hold.branch), hold);
 		} catch (error) {
@@ -7756,6 +8795,7 @@ var SyncManager = class {
 		}
 		const remoteRecords = await this.remoteStorage.list();
 		const head = await this.watermarkHead();
+		this.sweptThrough = Math.max(this.sweptThrough, head);
 		for (const record of remoteRecords) {
 			const channel = this.channelFactory.instance(record.id, record.name, record.channelConfig, this.cursorStorage, record.collectionId, record.filter, this.operationIndex, record.options);
 			const remote = {
@@ -7774,6 +8814,8 @@ var SyncManager = class {
 			this.owe(record.name, head);
 			this.records.set(record.name, remote.meta);
 			await this.loadDeadLetters(remote);
+			await this.restoreReceivedMarkers(remote);
+			const unheard = [...remote.channel.inbox.items];
 			this.wireChannelCallbacks(remote);
 			try {
 				await channel.init();
@@ -7782,6 +8824,7 @@ var SyncManager = class {
 				await this.dropRemoteAfterFailedInit(remote, false);
 				continue;
 			}
+			if (unheard.length > 0) this.handleInboxAdded(remote, unheard);
 			await this.peerUpdates.get(record.name);
 			const outboxAckOrdinal = remote.channel.outbox.ackOrdinal;
 			if (outboxAckOrdinal > 0) {
@@ -7811,6 +8854,8 @@ var SyncManager = class {
 		this.pruneDrainDeferred = false;
 		this.batchAggregator.clear();
 		this.owed.clear();
+		for (const retry of this.markerRetries.values()) clearTimeout(retry.timer);
+		this.markerRetries.clear();
 		this.settledUnsubscribe?.();
 		this.settledUnsubscribe = void 0;
 		if (this.eventUnsubscribe) {
@@ -7903,6 +8948,47 @@ var SyncManager = class {
 			heldAtUtcMs: record.heldAtUtcMs
 		}));
 	}
+	async pendingDelivery(documentId, ordinal) {
+		if (!this.delivery) throw new Error("Delivery tracking needs a delivery lookup");
+		return pendingDelivery({
+			remotes: [...this.remotes.values()].filter((remote) => !this.removing.has(remote.meta.name)),
+			cursors: this.cursorStorage,
+			holds: this.holds,
+			lookup: this.delivery
+		}, documentId, ordinal);
+	}
+	recordPurgeRefusal(refusal) {
+		return this.persistRefusals([refusal]);
+	}
+	async recordPolledMarkerRefusals(remoteName, refusals) {
+		const remote = this.getByName(remoteName);
+		const tombstoned = refusals.slice(0, 100).filter((refusal) => this.purgedDocumentIds.has(refusal.documentId));
+		if (tombstoned.length === 0) return;
+		const collections = await this.operationIndex.getCollectionsForDocuments([...new Set(tombstoned.map((refusal) => refusal.documentId))]);
+		const key = remote.meta.collectionId.key;
+		const owed = /* @__PURE__ */ new Map();
+		for (const refusal of tombstoned) {
+			if (!collections[refusal.documentId]?.includes(key)) continue;
+			owed.set(`${refusal.documentId}\u0000${refusal.branch}`, {
+				remoteName,
+				documentId: refusal.documentId,
+				branch: refusal.branch,
+				errorMessage: `Marker refused by ${remoteName}`
+			});
+		}
+		await this.persistRefusals([...owed.values()]);
+	}
+	async persistRefusals(refusals) {
+		if (refusals.length === 0) return;
+		const refusedAtUtcMs = Date.now();
+		await this.refusalStorage.record(refusals.map((refusal) => ({
+			remoteName: refusal.remoteName,
+			documentId: refusal.documentId,
+			branch: refusal.branch,
+			refusedAtUtcMs
+		})));
+		for (const refusal of refusals) await this.eventBus.emit(SyncEventTypes.PURGE_REFUSED, refusal).catch(() => {});
+	}
 	agreement() {
 		return createPeerAgreement({
 			local: this.manifest,
@@ -7918,16 +9004,36 @@ var SyncManager = class {
 		}
 		return held;
 	}
+	/** Once per id: a second pass would drop the holds its marker earned. */
+	tombstone(documentId) {
+		if (this.purgedDocumentIds.has(documentId)) return;
+		this.purgedDocumentIds.add(documentId);
+		this.quarantinedDocumentIds.delete(documentId);
+		const prefix = holdKey(documentId, "");
+		for (const key of [...this.versionCache.keys()]) if (key.startsWith(prefix)) this.versionCache.delete(key);
+		this.forgetDocument?.(documentId);
+		for (const held of this.heldKeys.values()) for (const [key, record] of [...held]) if (record.documentId === documentId) held.delete(key);
+		for (const remote of this.remotes.values()) {
+			const stale = remote.channel.outbox.items.filter((item) => item.documentId === documentId && item.status < 2 && !carriesMarker(item));
+			for (const item of stale) item.executed();
+			if (stale.length > 0) remote.channel.outbox.remove(...stale);
+			const dead = remote.channel.deadLetter.items.filter((item) => item.documentId === documentId);
+			if (dead.length > 0) remote.channel.deadLetter.remove(...dead);
+		}
+	}
 	async forgetRemote(name) {
 		this.records.delete(name);
 		this.heldKeys.delete(name);
 		await this.holds.removeRemote(name);
+		await Promise.allSettled(this.markerWritesOf([name]));
+		await this.markerStorage.removeRemote(name);
 	}
 	peerSupportsOf(remote) {
 		return peerSupports(remote.meta.peer?.manifest ?? null, this.capabilities);
 	}
-	/** Cached once found: a document's versions never change. */
+	/** Cached once found: a document's versions change only by a purge. */
 	async versionsOf(documentId, branch) {
+		if (this.purgedDocumentIds.has(documentId)) return purgedProtocolVersions();
 		const key = holdKey(documentId, branch);
 		const cached = this.versionCache.get(key);
 		if (cached) return cached;
@@ -7972,6 +9078,11 @@ var SyncManager = class {
 		try {
 			await this.holds.upsert(record);
 		} catch (error) {
+			if (DocumentPurgedError.isError(error)) {
+				held.delete(key);
+				this.tombstone(documentId);
+				return;
+			}
 			this.logger.error("Failed to persist a sync hold (@remote, @documentId): @error", remote.meta.name, documentId, error instanceof Error ? error.message : String(error));
 		}
 		this.eventBus.emit(SyncEventTypes.SYNC_HELD, {
@@ -8036,7 +9147,7 @@ var SyncManager = class {
 			page = await page.next();
 		}
 		let operations = entries.filter((entry) => entry.sourceRemote !== remote.meta.name).map((entry) => toOperationWithContext(entry));
-		operations = filterOperations(operations, remote.meta.filter);
+		operations = filterForRemote(operations, remote.meta.filter);
 		if (operations.length === 0) return;
 		operations.sort((a, b) => {
 			if (a.context.scope !== b.context.scope) {
@@ -8069,6 +9180,7 @@ var SyncManager = class {
 		const peer = this.peerSupportsOf(remote);
 		const refused = /* @__PURE__ */ new Set();
 		for (const syncOp of syncOps) {
+			if (carriesMarker(syncOp)) continue;
 			const versions = createdVersions(syncOp.operations, syncOp.documentId) ?? await this.versionsOf(syncOp.documentId, syncOp.branch);
 			if (versions && this.refuse(remote, syncOp, versions, peer)) refused.add(syncOp);
 		}
@@ -8166,6 +9278,8 @@ var SyncManager = class {
 		this.remotes.set(name, remote);
 		this.records.set(name, meta);
 		await this.loadDeadLetters(remote);
+		await this.restoreReceivedMarkers(remote);
+		const unheard = [...remote.channel.inbox.items];
 		this.wireChannelCallbacks(remote);
 		try {
 			await channel.init();
@@ -8173,6 +9287,7 @@ var SyncManager = class {
 			await this.dropRemoteAfterFailedInit(remote, !isCredentialOrNetworkError(error));
 			throw error;
 		}
+		if (unheard.length > 0) this.handleInboxAdded(remote, unheard);
 		await this.peerUpdates.get(name);
 		this.owe(name, await this.watermarkHead());
 		const backfillController = new AbortController();
@@ -8196,6 +9311,7 @@ var SyncManager = class {
 		if (!remote) throw new Error(`Remote with name '${name}' does not exist`);
 		this.removing.add(name);
 		this.owed.delete(name);
+		this.derivedThrough.delete(name);
 		try {
 			await this.teardownRemoteResources(remote);
 			await this.remoteStorage.remove(name);
@@ -8253,7 +9369,14 @@ var SyncManager = class {
 				this.connectionStateUnsubscribes.delete(name);
 			}
 			this.evictedOutboxFloors.delete(name);
+			this.derivedThrough.delete(name);
 			this.prunePending.delete(name);
+			this.receivedMarkers.delete(name);
+			for (const [id, retry] of [...this.markerRetries]) {
+				if (retry.remoteName !== name) continue;
+				clearTimeout(retry.timer);
+				this.markerRetries.delete(id);
+			}
 			this.peerUnsubscribes.get(name)?.();
 			this.peerUnsubscribes.delete(name);
 			this.peerUpdates.delete(name);
@@ -8271,6 +9394,10 @@ var SyncManager = class {
 	onSyncStatusChange(callback) {
 		return this.syncStatusTracker.onChange(callback);
 	}
+	/** Settles once the remotes' received markers are stored; rejects if one failed. */
+	async receiptsStored(remoteNames) {
+		await Promise.all(this.markerWritesOf(remoteNames));
+	}
 	recordPlanKeyMapping(planKey, jobId) {
 		if (!this.planKeyToJobUuid.has(planKey) && this.planKeyToJobUuid.size >= PLAN_KEY_TO_JOB_UUID_CAP) {
 			const oldest = this.planKeyToJobUuid.keys().next().value;
@@ -8280,6 +9407,7 @@ var SyncManager = class {
 	}
 	wireChannelCallbacks(remote) {
 		remote.channel.inbox.onAdded((syncOps) => this.handleInboxAdded(remote, syncOps));
+		remote.channel.inbox.onRemoved((syncOps) => this.handleInboxRemoved(remote, syncOps));
 		remote.channel.setLocalManifest?.(() => this.manifest);
 		const unsubscribePeer = remote.channel.onPeerManifest?.((manifest, undelivered) => this.queuePeerManifest(remote, manifest, undelivered).catch(() => {}));
 		if (unsubscribePeer) this.peerUnsubscribes.set(remote.meta.name, unsubscribePeer);
@@ -8300,7 +9428,25 @@ var SyncManager = class {
 				remote.channel.deadLetter.remove(...refusals);
 				for (const syncOp of refusals) this.holdRefused(remote, syncOp).catch(() => {});
 			}
-			const syncOps = added.filter((syncOp) => !refusals.includes(syncOp));
+			const remaining = added.filter((syncOp) => !refusals.includes(syncOp));
+			const purged = remaining.filter((syncOp) => this.purgedDocumentIds.has(syncOp.documentId));
+			for (const syncOp of purged) {
+				this.logger.warn("Dead letter for purged document (@remote, @documentId, @error)", remote.meta.name, syncOp.documentId, syncOp.error?.message ?? "unknown");
+				if (syncOp.error?.source !== "outbox") continue;
+				if (syncOperationErrorType(syncOp.error) !== "MARKER_REFUSED") continue;
+				const refusal = {
+					remoteName: remote.meta.name,
+					documentId: syncOp.documentId,
+					branch: syncOp.branch,
+					errorMessage: syncOp.error.error.message
+				};
+				this.recordPurgeRefusal(refusal).catch((error) => {
+					this.logger.error("Recording a refused marker failed (@remote, @documentId, @error)", refusal.remoteName, refusal.documentId, error instanceof Error ? error.message : String(error));
+					remote.channel.forgetMarkerRefusal?.(refusal.documentId, refusal.branch);
+				});
+			}
+			if (purged.length > 0) remote.channel.deadLetter.remove(...purged);
+			const syncOps = remaining.filter((syncOp) => !purged.includes(syncOp));
 			for (const syncOp of syncOps) {
 				this.logger.error("Dead letter (@remote, @documentId, @jobId, @error, @dependencies)", remote.meta.name, syncOp.documentId, syncOp.jobId, syncOp.error?.message ?? "unknown", syncOp.jobDependencies);
 				const errorType = syncOperationErrorType(syncOp.error);
@@ -8313,12 +9459,16 @@ var SyncManager = class {
 					documentId: syncOp.documentId,
 					scopes: syncOp.scopes,
 					branch: syncOp.branch,
-					operations: syncOp.operations,
+					operations: carriesMarker(syncOp) ? syncOp.operations.filter((op) => isPurgeMarker$1(op)) : syncOp.operations,
 					errorSource: syncOp.error?.source ?? "none",
 					errorMessage: syncOp.error?.error.message ?? "unknown",
 					errorType
 				};
 				this.deadLetterStorage.add(record).catch((err) => {
+					if (DocumentPurgedError.isError(err)) {
+						this.tombstone(record.documentId);
+						return;
+					}
 					this.logger.error("Failed to persist dead letter (@id, @error)", record.id, err instanceof Error ? err.message : String(err));
 				});
 				this.eventBus.emit(SyncEventTypes.DEAD_LETTER_ADDED, {
@@ -8365,6 +9515,7 @@ var SyncManager = class {
 	}
 	async processCompleteBatch(batch) {
 		if (this.isShutdown) return;
+		for (const { event } of batch.entries) for (const op of event.operations) if (isPurgeMarker$1(op)) this.tombstone(op.context.documentId);
 		const collectionIds = [...new Set(Object.values(batch.collectionMemberships).flatMap((collections) => collections))];
 		const affectedRemotes = [];
 		for (const collectionId of collectionIds) {
@@ -8386,6 +9537,7 @@ var SyncManager = class {
 	async deriveSettled() {
 		if (this.isShutdown) return;
 		const through = this.watermark.settledThrough;
+		await this.oweSettledRange(through);
 		for (const [name, upTo] of [...this.owed]) {
 			const remote = this.remotes.get(name);
 			if (!remote || this.removing.has(name)) {
@@ -8397,6 +9549,27 @@ var SyncManager = class {
 		}
 		await this.drainPrunes();
 	}
+	/** Owes the remotes of every collection that moved, event or not. */
+	async oweSettledRange(through) {
+		if (through <= this.sweptThrough) return;
+		const among = [...new Set([...this.remotes.values()].filter((remote) => !this.removing.has(remote.meta.name) && (this.derivedThrough.get(remote.meta.name) ?? -1) < through).map((remote) => remote.meta.collectionId.key))];
+		if (among.length === 0) {
+			this.sweptThrough = through;
+			return;
+		}
+		let collectionIds;
+		try {
+			collectionIds = await this.operationIndex.getCollectionsInRange(this.sweptThrough, through, among, this.abortController.signal);
+		} catch (error) {
+			this.logger.warn("Settled range sweep failed; the next advance retries it: @error", error);
+			return;
+		}
+		for (const collectionId of collectionIds) for (const remote of this.getRemotesForCollection(collectionId)) {
+			const name = remote.meta.name;
+			if ((this.derivedThrough.get(name) ?? -1) < through) this.owe(name, through);
+		}
+		this.sweptThrough = through;
+	}
 	owe(name, upTo) {
 		this.owed.set(name, Math.max(this.owed.get(name) ?? 0, upTo));
 	}
@@ -8411,7 +9584,30 @@ var SyncManager = class {
 	}
 	handleInboxAdded(remote, syncOps) {
 		if (this.isShutdown) return;
-		const eligible = syncOps.filter((op) => !this.quarantinedDocumentIds.has(op.documentId));
+		const eligible = [];
+		const dropped = [];
+		const received = this.receivedMarkersOf(remote.meta.name);
+		const loading = (id, syncOp) => {
+			const item = received.get(id);
+			return item !== void 0 && item !== syncOp && item.status !== 2 && remote.channel.inbox.get(item.id) === item;
+		};
+		for (const syncOp of syncOps) if (carriesMarker(syncOp)) {
+			const ids = markerIdsOf(syncOp);
+			if (ids.every((id) => loading(id, syncOp))) {
+				this.storeReceivedMarker(remote, syncOp);
+				dropped.push(syncOp);
+			} else {
+				for (const id of ids) received.set(id, syncOp);
+				this.storeReceivedMarker(remote, syncOp);
+				eligible.push(syncOp);
+			}
+		} else if (this.purgedDocumentIds.has(syncOp.documentId)) dropped.push(syncOp);
+		else if (!this.quarantinedDocumentIds.has(syncOp.documentId)) eligible.push(syncOp);
+		for (const syncOp of dropped) {
+			this.logger.debug("Dropping received operations of a purged or already-loading document (@remote, @documentId)", remote.meta.name, syncOp.documentId);
+			syncOp.executed();
+		}
+		if (dropped.length > 0) remote.channel.inbox.remove(...dropped);
 		if (eligible.length === 0) return;
 		const keyed = [];
 		const nonKeyed = [];
@@ -8426,6 +9622,79 @@ var SyncManager = class {
 			this.processInboxChunks(chunks);
 		}
 	}
+	/** Forgets a marker once the item loading it leaves the inbox. */
+	handleInboxRemoved(remote, syncOps) {
+		const received = this.receivedMarkers.get(remote.meta.name);
+		if (received === void 0 || received.size === 0) return;
+		const name = remote.meta.name;
+		for (const syncOp of syncOps) for (const id of markerIdsOf(syncOp)) {
+			if (received.get(id) !== syncOp) continue;
+			received.delete(id);
+			this.writeMarker(name, id, () => this.markerStorage.remove(name, id));
+		}
+	}
+	markerWritesOf(remoteNames) {
+		if (remoteNames === void 0) return [...this.markerWrites.values()];
+		const prefixes = [...remoteNames].map((name) => `${name}\u0000`);
+		return [...this.markerWrites].filter(([key]) => prefixes.some((prefix) => key.startsWith(prefix))).map(([, write]) => write);
+	}
+	/** Kept until its outcome, so a restart does not ack past it unapplied. */
+	storeReceivedMarker(remote, syncOp) {
+		if (this.restoredMarkers.has(syncOp)) return;
+		if (this.purgedDocumentIds.has(syncOp.documentId)) return;
+		const name = remote.meta.name;
+		for (const operation of syncOp.operations) {
+			if (!isPurgeMarker$1(operation)) continue;
+			const markerId = operation.operation.id;
+			this.writeMarker(name, markerId, () => this.markerStorage.upsert({
+				remoteName: name,
+				markerId,
+				documentId: syncOp.documentId,
+				branch: syncOp.branch,
+				operation,
+				receivedAtUtcMs: Date.now()
+			}));
+		}
+	}
+	writeMarker(remoteName, markerId, write) {
+		const key = `${remoteName}\u0000${markerId}`;
+		const next = (this.markerWrites.get(key) ?? Promise.resolve()).catch(() => void 0).then(write);
+		this.markerWrites.set(key, next);
+		const settle = () => {
+			if (this.markerWrites.get(key) === next) this.markerWrites.delete(key);
+		};
+		next.then(settle, (error) => {
+			this.logger.error("Failed to store received marker (@remote, @markerId, @error)", remoteName, markerId, error instanceof Error ? error.message : String(error));
+			settle();
+		});
+	}
+	/** Queued before init resets latestOrdinal, so a puller is re-served above it. */
+	async restoreReceivedMarkers(remote) {
+		const name = remote.meta.name;
+		let records;
+		try {
+			records = await this.markerStorage.list(name);
+		} catch (error) {
+			this.logger.error("Failed to load received markers for remote (@name, @error)", name, error instanceof Error ? error.message : String(error));
+			return;
+		}
+		if (records.length === 0) return;
+		const syncOps = records.map((record) => {
+			const syncOp = new SyncOperation(crypto.randomUUID(), "", [], name, record.documentId, [record.operation.context.scope], record.branch, [record.operation]);
+			syncOp.transported();
+			this.restoredMarkers.add(syncOp);
+			return syncOp;
+		});
+		remote.channel.inbox.add(...syncOps);
+	}
+	receivedMarkersOf(name) {
+		let received = this.receivedMarkers.get(name);
+		if (received === void 0) {
+			received = /* @__PURE__ */ new Map();
+			this.receivedMarkers.set(name, received);
+		}
+		return received;
+	}
 	processInboxChunks(chunks) {
 		const next = this.inboxChunkChain.then(async () => {
 			for (const chunk of chunks) {
@@ -8448,12 +9717,17 @@ var SyncManager = class {
 			if (this.isShutdown) return;
 			const err = error instanceof Error ? error : new Error(String(error));
 			this.logger.error("Failed to load operations from inbox (@remote, @documentId, @error)", remote.meta.name, syncOp.documentId, err.message);
+			if (carriesMarker(syncOp)) {
+				this.retryMarker(remote, syncOp, err.message);
+				return;
+			}
 			const channelError = new ChannelError("inbox", err);
 			syncOp.failed(channelError);
 			remote.channel.deadLetter.add(syncOp);
 			remote.channel.inbox.remove(syncOp);
 			return;
 		}
+		if (syncOp.jobId) this.recordPlanKeyMapping(syncOp.jobId, jobInfo.id);
 		let completedJobInfo;
 		try {
 			completedJobInfo = await this.awaiter.waitForJob(jobInfo.id, this.abortController.signal);
@@ -8461,6 +9735,10 @@ var SyncManager = class {
 			if (this.isShutdown) return;
 			const err = error instanceof Error ? error : new Error(String(error));
 			this.logger.error("Failed to wait for job completion (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, jobInfo.id, err.message);
+			if (carriesMarker(syncOp)) {
+				this.retryMarker(remote, syncOp, err.message);
+				return;
+			}
 			const channelError = new ChannelError("inbox", err);
 			syncOp.failed(channelError);
 			remote.channel.deadLetter.add(syncOp);
@@ -8468,14 +9746,57 @@ var SyncManager = class {
 			return;
 		}
 		if (this.isShutdown) return;
-		if (completedJobInfo.status === "FAILED") {
+		if (completedJobInfo.status !== "FAILED") {
+			syncOp.executed();
+			if (carriesMarker(syncOp)) this.tombstone(syncOp.documentId);
+		} else if (isPurgedFailure(completedJobInfo.error, syncOp.documentId)) {
+			this.tombstone(syncOp.documentId);
+			syncOp.executed();
+		} else {
 			const errorMessage = completedJobInfo.error?.message || "Unknown error";
 			this.logger.error("Failed to apply operations from inbox (@remote, @documentId, @jobId, @error)", remote.meta.name, syncOp.documentId, completedJobInfo.id, errorMessage);
-			syncOp.failed(this.inboxFailure(completedJobInfo.error));
+			if (carriesMarker(syncOp) && !isRefusedMarker(completedJobInfo.error)) {
+				this.retryMarker(remote, syncOp, errorMessage);
+				return;
+			}
+			syncOp.failed(this.inboxFailure(syncOp, completedJobInfo.error));
 			remote.channel.deadLetter.add(syncOp);
-		} else syncOp.executed();
+		}
+		this.markerRetries.delete(syncOp.id);
 		remote.channel.inbox.remove(syncOp);
 	}
+	/** Reloads a marker with backoff; it stays in the inbox, not dead-lettered. */
+	retryMarker(remote, syncOp, reason) {
+		if (this.isShutdown) return;
+		const attempt = (this.markerRetries.get(syncOp.id)?.attempt ?? 0) + 1;
+		const delay = calculateBackoffDelay(attempt, this.config.markerRetryBaseDelayMs, this.config.markerRetryMaxDelayMs, Math.random());
+		this.logger.warn("Purge marker load failed; retrying (@remote, @documentId, @attempt, @delayMs, @error)", remote.meta.name, syncOp.documentId, attempt, Math.round(delay), reason);
+		const timer = setTimeout(() => {
+			this.redeliverMarker(remote, syncOp).catch((error) => {
+				this.logger.error("Purge marker retry failed (@remote, @documentId, @error)", remote.meta.name, syncOp.documentId, error instanceof Error ? error.message : String(error));
+			});
+		}, delay);
+		if (typeof timer === "object" && "unref" in timer) timer.unref();
+		this.markerRetries.set(syncOp.id, {
+			remoteName: remote.meta.name,
+			attempt,
+			timer
+		});
+	}
+	async redeliverMarker(remote, syncOp) {
+		const name = remote.meta.name;
+		if (this.isShutdown || this.remotes.get(name) !== remote || this.removing.has(name) || remote.channel.inbox.get(syncOp.id) !== syncOp) {
+			this.markerRetries.delete(syncOp.id);
+			return;
+		}
+		if (this.purgedDocumentIds.has(syncOp.documentId)) {
+			this.markerRetries.delete(syncOp.id);
+			syncOp.executed();
+			remote.channel.inbox.remove(syncOp);
+			return;
+		}
+		await this.applyInboxJob(remote, syncOp);
+	}
 	async applyInboxBatch(received) {
 		const refused = /* @__PURE__ */ new Set();
 		for (const { remote, syncOp } of received) {
@@ -8518,6 +9839,10 @@ var SyncManager = class {
 			if (this.isShutdown) return;
 			for (const { remote, syncOp } of items) {
 				const err = error instanceof Error ? error : new Error(String(error));
+				if (carriesMarker(syncOp)) {
+					this.retryMarker(remote, syncOp, err.message);
+					continue;
+				}
 				syncOp.failed(new ChannelError("inbox", err));
 				remote.channel.deadLetter.add(syncOp);
 				remote.channel.inbox.remove(syncOp);
@@ -8548,16 +9873,29 @@ var SyncManager = class {
 			} catch (error) {
 				if (this.isShutdown) continue;
 				const err = error instanceof Error ? error : new Error(String(error));
+				if (carriesMarker(syncOp)) {
+					this.retryMarker(remote, syncOp, err.message);
+					continue;
+				}
 				syncOp.failed(new ChannelError("inbox", err));
 				remote.channel.deadLetter.add(syncOp);
 				remote.channel.inbox.remove(syncOp);
 				continue;
 			}
 			if (this.isShutdown) return;
-			if (completedJobInfo.status === "FAILED") {
-				syncOp.failed(this.inboxFailure(completedJobInfo.error));
+			if (completedJobInfo.status !== "FAILED") {
+				syncOp.executed();
+				if (carriesMarker(syncOp)) this.tombstone(syncOp.documentId);
+			} else if (isPurgedFailure(completedJobInfo.error, syncOp.documentId)) {
+				this.tombstone(syncOp.documentId);
+				syncOp.executed();
+			} else if (carriesMarker(syncOp) && !isRefusedMarker(completedJobInfo.error)) {
+				this.retryMarker(remote, syncOp, completedJobInfo.error?.message || "Unknown error");
+				continue;
+			} else {
+				syncOp.failed(this.inboxFailure(syncOp, completedJobInfo.error));
 				remote.channel.deadLetter.add(syncOp);
-			} else syncOp.executed();
+			}
 			remote.channel.inbox.remove(syncOp);
 		}
 	}
@@ -8571,9 +9909,9 @@ var SyncManager = class {
 	* keep syncing, because reconciling the two policies needs the traffic a
 	* quarantine would stop.
 	*/
-	inboxFailure(error) {
+	inboxFailure(syncOp, error) {
 		const message = error?.message || "Unknown error";
-		return new ChannelError("inbox", /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), classifyJobFailure(error?.name ?? "Error"));
+		return new ChannelError("inbox", /* @__PURE__ */ new Error(`Failed to apply operations: ${message}`), carriesMarker(syncOp) ? "MARKER_REFUSED" : classifyJobFailure(error?.name ?? "Error"));
 	}
 	/**
 	* Where the next outbox derivation starts: at the evicted floor when there is
@@ -8705,6 +10043,7 @@ var SyncManager = class {
 		}
 	}
 	emitBatches(remote, operations, mode, chain) {
+		operations = operations.filter((op) => isPurgeMarker$1(op) || !this.purgedDocumentIds.has(op.context.documentId));
 		if (operations.length === 0) return;
 		const batches = batchOperationsByDocument(operations);
 		const syncOps = [];
@@ -8725,13 +10064,14 @@ var SyncManager = class {
 	async deriveOutbox(remote, ackOrdinal, mode, signal) {
 		const composedSignal = signal ? AbortSignal.any([signal, this.abortController.signal]) : this.abortController.signal;
 		const startOrdinal = this.refillOrdinal(remote, ackOrdinal);
+		const throughOrdinal = this.watermark.settledThrough;
 		let maxOrdinal = startOrdinal;
 		const chain = { lastJobByDoc: /* @__PURE__ */ new Map() };
 		const sinceTimestamp = remote.meta.options.sinceTimestampUtcMs;
 		const emitBatches = (operations) => this.emitBatches(remote, operations, mode, chain);
 		let page = await this.operationIndex.find(remote.meta.collectionId.key, startOrdinal, {
 			excludeSourceRemote: remote.meta.name,
-			throughOrdinal: this.watermark.settledThrough
+			throughOrdinal
 		}, void 0, composedSignal);
 		let carry = [];
 		let hasMore;
@@ -8743,9 +10083,11 @@ var SyncManager = class {
 				operations = [...carry, ...operations];
 				carry = [];
 			}
-			if (sinceTimestamp && sinceTimestamp !== "0") operations = operations.filter((op) => op.operation.timestampUtcMs >= sinceTimestamp);
-			operations = filterOperations(operations, remote.meta.filter);
-			operations = operations.filter((op) => !this.quarantinedDocumentIds.has(op.context.documentId));
+			for (const op of operations) if (isPurgeMarker$1(op)) this.tombstone(op.context.documentId);
+			operations = operations.filter((op) => isPurgeMarker$1(op) || !this.purgedDocumentIds.has(op.context.documentId));
+			if (sinceTimestamp && sinceTimestamp !== "0") operations = operations.filter((op) => isPurgeMarker$1(op) || op.operation.timestampUtcMs >= sinceTimestamp);
+			operations = filterForRemote(operations, remote.meta.filter);
+			operations = operations.filter((op) => isPurgeMarker$1(op) || !this.quarantinedDocumentIds.has(op.context.documentId));
 			if (this.gates(remote)) operations = await this.gateOutbound(remote, operations);
 			hasMore = !!page.next;
 			if (operations.length > 0) {
@@ -8772,6 +10114,9 @@ var SyncManager = class {
 		} while (hasMore);
 		if (carry.length > 0) emitBatches(carry);
 		remote.channel.outbox.advanceOrdinal(maxOrdinal);
+		const name = remote.meta.name;
+		if (this.evictedOutboxFloors.has(name)) this.derivedThrough.delete(name);
+		else this.derivedThrough.set(name, Math.max(this.derivedThrough.get(name) ?? -1, throughOrdinal));
 	}
 };
 //#endregion
@@ -8782,6 +10127,8 @@ var SyncBuilder = class {
 	cursorStorage;
 	deadLetterStorage;
 	holdStorage;
+	receivedMarkerStorage;
+	purgeRefusalStorage;
 	config = {};
 	withChannelFactory(factory) {
 		this.channelFactory = factory;
@@ -8803,6 +10150,14 @@ var SyncBuilder = class {
 		this.holdStorage = storage;
 		return this;
 	}
+	withReceivedMarkerStorage(storage) {
+		this.receivedMarkerStorage = storage;
+		return this;
+	}
+	withPurgeRefusalStorage(storage) {
+		this.purgeRefusalStorage = storage;
+		return this;
+	}
 	withMaxDeadLettersPerRemote(limit) {
 		this.config.maxDeadLettersPerRemote = limit;
 		return this;
@@ -8828,7 +10183,9 @@ var SyncBuilder = class {
 		const cursorStorage = this.cursorStorage ?? new KyselySyncCursorStorage(db);
 		const deadLetterStorage = this.deadLetterStorage ?? new KyselySyncDeadLetterStorage(db);
 		const holdStorage = this.holdStorage ?? new KyselySyncHoldStorage(db);
-		const syncManager = new SyncManager(logger, remoteStorage, cursorStorage, deadLetterStorage, this.channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, watermark, this.config, localPeer, holdStorage);
+		const receivedMarkerStorage = this.receivedMarkerStorage ?? new KyselySyncReceivedMarkerStorage(db);
+		const purgeRefusalStorage = this.purgeRefusalStorage ?? new KyselySyncPurgeRefusalStorage(db);
+		const syncManager = new SyncManager(logger, remoteStorage, cursorStorage, deadLetterStorage, this.channelFactory, operationIndex, reactor, eventBus, driveContainerTypes, watermark, this.config, localPeer, holdStorage, { listPurged: () => listPurged(db) }, receivedMarkerStorage, { at: (documentId, ordinal) => deliveryAt(db, documentId, ordinal) }, purgeRefusalStorage);
 		return {
 			remoteStorage,
 			cursorStorage,
@@ -8893,6 +10250,8 @@ var AbortError = class extends Error {
 * for the new Reactor architecture.
 */
 var Reactor = class {
+	disposers;
+	closers;
 	logger;
 	documentModelRegistry;
 	shutdownStatus;
@@ -8908,7 +10267,9 @@ var Reactor = class {
 	eventBus;
 	executorManager;
 	catchUp;
-	constructor(logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, features, documentView, documentIndexer, operationStore, eventBus, executorManager, catchUp) {
+	constructor(logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, features, documentView, documentIndexer, operationStore, eventBus, executorManager, catchUp, disposers = [], closers = []) {
+		this.disposers = disposers;
+		this.closers = closers;
 		this.catchUp = catchUp;
 		this.logger = logger;
 		this.documentModelRegistry = documentModelRegistry;
@@ -8936,9 +10297,15 @@ var Reactor = class {
 		this.setShutdown(true);
 		const shutdownAsync = async () => {
 			await this.executorManager.stop(true);
+			for (const dispose of this.disposers) dispose();
 			await this.catchUp?.stop();
 			this.readModelCoordinator.stop();
 			this.jobTracker.shutdown();
+			for (const close of this.closers) try {
+				await close();
+			} catch (error) {
+				this.logger.error("Shutdown step failed: @Error", error);
+			}
 		};
 		this.setCompleted(shutdownAsync());
 		return this.shutdownStatus;
@@ -9823,6 +11190,13 @@ var ReactorBuilder = class {
 		});
 		const documentMetaCache = new DocumentMetaCache(operationStore, { maxDocuments: 1e3 });
 		await documentMetaCache.startup();
+		const unsubscribeMarkerEviction = eventBus.subscribe(ReactorEventTypes.JOB_WRITE_READY, (_type, event) => {
+			for (const item of event.operations) {
+				if (!isPurgeMarker$1(item)) continue;
+				writeCache.invalidate(item.context.documentId);
+				documentMetaCache.invalidate(item.context.documentId);
+			}
+		});
 		const collectionMembershipCache = new CollectionMembershipCache(operationIndex);
 		const executionScope = new KyselyExecutionScope(database, operationStore, operationIndex, keyframeStore, writeCache, documentMetaCache, collectionMembershipCache);
 		let executorManager = this.executorManager;
@@ -9918,7 +11292,7 @@ var ReactorBuilder = class {
 		const indexedReadModels = readModelCoordinator.indexedReadModels?.bind(readModelCoordinator);
 		if (indexedReadModels) catchUp.addSource(() => indexedReadModels().filter((model) => isCatchUpConsumer(model)), "host");
 		else this.logger.warn("The read model coordinator does not report indexedReadModels; the host runs no read-side catch-up sweep");
-		const reactor = new Reactor(this.logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, this.features, documentView, documentIndexer, operationStore, eventBus, executorManager, catchUp);
+		const reactor = new Reactor(this.logger, documentModelRegistry, queue, jobTracker, readModelCoordinator, this.features, documentView, documentIndexer, operationStore, eventBus, executorManager, catchUp, [unsubscribeMarkerEviction], [() => processorManager.shutdown()]);
 		const localPeer = {
 			capabilities: this.getPeerCapabilities(),
 			flags: featureFlags,
@@ -9929,6 +11303,9 @@ var ReactorBuilder = class {
 				} catch {
 					return;
 				}
+			},
+			forgetDocument: (documentId) => {
+				documentMetaCache.invalidate(documentId);
 			}
 		};
 		let syncModule = void 0;
@@ -9973,7 +11350,8 @@ var ReactorBuilder = class {
 			pools: this.instrumentedPools,
 			degradedComponents,
 			catchUp,
-			settledWatermark
+			settledWatermark,
+			documentPurgeService: new DocumentPurgeService(queue, jobTracker, eventBus)
 		};
 		catchUp.start();
 		if (degradedComponents.length > 0) this.logger.warn("Reactor started with @count degraded component(s): @components", degradedComponents.length, degradedComponents.map(({ component }) => component).join(", "));
@@ -10040,7 +11418,7 @@ var ReactorBuilder = class {
 			poolInstrumentations.push(forwarder);
 			this.instrumentedPools.push(forwarder);
 		}
-		const { ProjectionShardManager } = await import("./projection-shard-manager-CJIdjsd8.js");
+		const { ProjectionShardManager } = await import("./projection-shard-manager-BSK-GEyP.js");
 		const manager = new ProjectionShardManager({
 			shardCount: config.shardCount,
 			db,
@@ -10085,7 +11463,7 @@ var ReactorBuilder = class {
 	*/
 	async createDefaultWorkerFactory(numWorkers, db) {
 		const [{ WorkerHandle }, { createThreadTransport }, { workerEntryPath }] = await Promise.all([
-			import("./worker-handle-DjbEQkq-.js"),
+			import("./worker-handle-weNGCZme.js"),
 			import("./transport-CZDHzfvy.js"),
 			Promise.resolve().then(() => worker_exports)
 		]);
@@ -10834,6 +12212,6 @@ var DocumentIntegrityService = class {
 	}
 };
 //#endregion
-export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, CatchUpScheduler, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, ContiguousCursor, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, InMemorySyncHoldStorage, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncHoldStorage, KyselySyncRemoteStorage, KyselyWriteCache, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PollBehavior, PollingChannelError, ProbeSettler, ProcessorManager, PropagationMode, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SeededStateReader, SettledWatermark, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, UnsupportedStoredProtocolError, addRelationshipAction, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createKyselyWatermarkProbe, createMutableShutdownStatus, createPeerAgreement, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultCatchUpConfig, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isCatchUpConsumer, isDriveAuthError, isRecoverableGraphQLError, makeConsistencyKey, parseDriveUrl, parsePagingOptions, parseSnapshot, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, snapshotFunctionsFor, supportsLiveReadModelRegistration, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
+export { ALWAYS_READABLE_SCOPES, APPEND_CONDITION_FAILED_PREFIX, AppendConditionFailedError, AuthEnforcementDisabledError, BareReadGate, BaseReadModel, CatchUpScheduler, ChannelError, ChannelErrorSource, ChannelScheme, ConsistencyTracker, ContiguousCursor, DEFAULT_COMMIT_CHUNK_SIZE, DEFAULT_DRIVE_CONTAINER_TYPES, DEFAULT_MAX_PURGE_OPERATIONS, DEFAULT_PURGE_DELETE_BATCH, DEFAULT_READ_MODEL_YIELD_DEADLINE_MS, DOCUMENT_INDEXER_READ_MODEL, DOCUMENT_VIEW_READ_MODEL, DRIVE_AUTH_ERROR_MESSAGES, DefaultSubscriptionErrorHandler, DeletedDocumentRead, DocumentAlreadyExistsError, DocumentChangeType, DocumentExistence, DocumentIntegrityService, DocumentModelRegistry, DocumentModelResolver, DocumentNotDeletedError, DocumentPurgeService, DocumentPurgedError, DriveClient, DriveCollectionId, DriveRequestError, DuplicateManifestError, DuplicateModuleError, DuplicateOperationError, EventBus, EventBusAggregateError, GqlRequestChannel, GqlRequestChannelFactory, GqlResponseChannel, GqlResponseChannelFactory, GroupInUseError, HybridProjectionCoordinator, SimpleJobExecutor as InMemoryJobExecutor, SimpleJobExecutor, InMemoryJobTracker, InMemoryQueue, InMemorySyncHoldStorage, InMemorySyncPurgeRefusalStorage, InMemorySyncReceivedMarkerStorage, IntervalPollTimer, InvalidModuleError, InvalidSignatureError, JobAwaiter, JobExecutorEventTypes, JobStatus, KyselyDocumentIndexer, KyselyDocumentPurger, KyselyDocumentView, KyselyKeyframeStore, KyselyOperationStore, KyselySyncCursorStorage, KyselySyncHoldStorage, KyselySyncPurgeRefusalStorage, KyselySyncReceivedMarkerStorage, KyselySyncRemoteStorage, KyselyWriteCache, MAX_POLLED_REFUSALS, Mailbox, ModelReadGate, ModuleNotFoundError, NullDocumentModelResolver, OptimisticLockError, PURGE_DOCUMENT, PURGE_LOCK_BUCKETS, PURGE_NS, PollBehavior, PollingChannelError, ProbeSettler, ProcessorManager, PropagationMode, PurgeTooLargeError, QueueEventTypes, REACTOR_SCHEMA, RECOVERABLE_GRAPHQL_ERROR_CODES, Reactor, ReactorBuilder, ReactorClient, ReactorClientBuilder, ReactorEventTypes, ReactorSubscriptionManager, ReadModelCoordinator, RelationalDbProcessor, RelationshipChangeType, RelationshipNotFoundError, ReservedActionError, RetryAccounting, RevisionMismatchError, SIGNATURE_REFUSAL_CODES, SeededStateReader, SettledWatermark, SimpleJobExecutorManager, SyncBuilder, SyncEventTypes, SyncOperation, SyncOperationAggregateError, SyncOperationStatus, SyncScopeGate, SyncStatus, SyncStatusTracker, UnsupportedStoredProtocolError, acquirePurgeLocks, addRelationshipAction, appliedDelete, authDecisionModel, batchOperationsByDocument, buildDecisionModel, classifyJobFailure, consolidateSyncOperations, createDocumentAction, createForwardingLogger, createHybridProjectionCoordinatorFactory, createKyselyWatermarkProbe, createMutableShutdownStatus, createPeerAgreement, createReactorHostModuleBase, createRelationalDb, decideAtHead, defaultCatchUpConfig, defaultReadModelIndexingConfig, deleteDocumentAction, documentActions, documentDecisionModel, driveIdFromUrl, envelopesToSyncOperations, errorToInfo, findPurged, firstOutOfOrderPair, getMigrationStatus, instrumentPgPool, isCatchUpConsumer, isDriveAuthError, isPurgeMarker, isRecoverableGraphQLError, listPurged, makeConsistencyKey, parseDriveUrl, parsePagingOptions, parseSnapshot, quarantinesDocument, readDecisionModel, removeRelationshipAction, runMigrations, sanitizeArg, selectDecisionModel, snapshotFunctionsFor, supportsDeliveryTracking, supportsLiveReadModelRegistration, supportsPurgeRefusals, syncOperationErrorType, trimMailboxFromAckOrdinal, unchunkedReadModelIndexingConfig, updateRelationshipAction, upgradeDocumentAction, verifyActionSignature, workerEntryPath };
 
 //# sourceMappingURL=index.js.map