fix(p2p): replicate content deletion

[trvon]

Stack

• Parent: feat(p2p): add authenticated direct replication #68 (fix/p2p-correctness-pr → experimental)
• This draft targets fix/p2p-correctness-pr and must be reviewed/landed as part of that stack.
• Do not merge or deploy independently from the parent correctness series.

Summary

Closes the deletion-integrity P1 disclosed on #68: a production document deletion previously published only document/<hash>, leaving content-blob/<hash> remotely retrievable by hash.

This layer now:

• durably reserves document and content-blob erase intents before local mutation;
• bounds both single and batch staging against the durable outbox limit;
• publishes the blob tombstone before the document tombstone;
• serializes request publication against restart/background draining;
• makes repeated publication idempotent from committed tombstone state;
• preserves unready document intent after an interrupted content-first deletion;
• carries --keep-refs as an explicit document-only deletion mode;
• keeps committed local tombstones visible without waiting for another reconciliation;
• registers the production deletion gate with Meson.

AI disclosure

This change was developed with extensive AI assistance, including test design, implementation, and adversarial review. It has not yet received full human maintainer review.

No merge, deployment, production restart, remote corpus mutation, SourceHut push, force update, or promotion to main is part of this PR.

[Copilot]

🟡 Changes recommended

The new integration test installs a ServiceManager observer that captures stack references but isn’t reliably cleared on failure paths, risking use-after-scope and teardown hangs.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR closes a P2P deletion-integrity gap by ensuring production document deletion replicates both the document/<hash> tombstone and the independently retrievable content-blob/<hash> tombstone, with durable/atomic staging and serialized publication/draining to remain crash- and restart-safe.

Changes:

• Add atomic/bounded batch staging for erase intents (stageErases) so multi-key deletions reserve outbox capacity before any local mutation.
• Update daemon deletion flow to stage/publish both blob+document tombstones (or document-only when --keep-refs is used), with idempotent behavior based on committed tombstone state and serialization against background draining.
• Add/extend unit + integration tests and register an integration gate covering deletion integrity.

File summaries

File	Description
tests/unit/memory_sync/memory_sync_catch2_test.cpp	Adds a unit test asserting atomic, bounded capacity reservation for batched erase staging.
tests/unit/daemon/daemon_metrics_status_test.cpp	Extends delete handler test to expect both content-blob and document tombstones and updates stub content existence behavior.
tests/integration/daemon/meson.build	Registers a new integration test gate for production deletion integrity.
tests/integration/daemon/memory_sync_service_integration_test.cpp	Adds an end-to-end integration test exercising real IPC delete flow, serialization, idempotency, --keep-refs, and interrupted deletion recovery.
src/daemon/components/ServiceManager.cpp	Implements two-key staging (blob then document), serialized publish/drain, and idempotent publication based on committed tombstones.
src/daemon/components/dispatcher/request_dispatcher_documents.cpp	Threads keepRefs through pre-delete staging and post-delete publication hooks.
include/yams/memory_sync/memory_sync.h	Introduces EraseStageRequest and MemorySyncLoop::stageErases, plus preserves committed tombstone winners during outbox cleanup.
include/yams/memory_sync/memory_sync_service.h	Exposes stageErases and hasCommittedTombstone through the service wrapper.
include/yams/daemon/components/ServiceManager.h	Updates delete staging/publication APIs to include retainContent and adds a test observer hook + serialization mutex.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.