Remaining problem
sync_row_tombstones rows are retained indefinitely to suppress older upserts. This issue covers safe collection of those tombstone rows once no peer can still supply the row they suppress.
Signed-entry retention is resolved separately: #1326 adds per-chain tombstone statements and signed Restate batches, allowing the original delete entries to be compacted while preserving deletion identities. #1320 also removes summary-regeneration delete churn by keying memory_note_summaries by memory. Neither change establishes when a tombstone row itself can be forgotten.
Scope
Design and implement a durable causal-stability condition for tombstone-row collection. The proof must cover offline peers, removed and re-enrolled devices, restore/re-root, interrupted sync, and fresh peers bootstrapping from different retained sources. A roster-wide acknowledged frontier is a candidate, not an already-established protocol requirement.
Collection must not allow an older upsert to resurrect a deleted row or let a peer re-root past a delete while retaining the row. Define what evidence survives compaction, how that evidence is authenticated, and how older binaries behave before enabling deletion.
Acceptance
- State a locally checkable collection predicate and its cross-peer assumptions.
- Persist the evidence needed to evaluate it across restart, migration, and partial delivery.
- Add adversarial multi-peer tests for stale upserts, offline return, roster changes, source switching, and interruption/retry.
- Demonstrate that eligible tombstone rows are reclaimed while ineligible rows remain protective.
Outside this issue
Split from #1285.
Remaining problem
sync_row_tombstonesrows are retained indefinitely to suppress older upserts. This issue covers safe collection of those tombstone rows once no peer can still supply the row they suppress.Signed-entry retention is resolved separately: #1326 adds per-chain tombstone statements and signed
Restatebatches, allowing the original delete entries to be compacted while preserving deletion identities. #1320 also removes summary-regeneration delete churn by keyingmemory_note_summariesby memory. Neither change establishes when a tombstone row itself can be forgotten.Scope
Design and implement a durable causal-stability condition for tombstone-row collection. The proof must cover offline peers, removed and re-enrolled devices, restore/re-root, interrupted sync, and fresh peers bootstrapping from different retained sources. A roster-wide acknowledged frontier is a candidate, not an already-established protocol requirement.
Collection must not allow an older upsert to resurrect a deleted row or let a peer re-root past a delete while retaining the row. Define what evidence survives compaction, how that evidence is authenticated, and how older binaries behave before enabling deletion.
Acceptance
Outside this issue
Split from #1285.