Sync: after a read from the beginning, remove what the server no longer has, and flag an edit that brings a forgotten item back

The server now forgets a deletion past its retention and refuses cursors
from before it. The client then reads everything again, but everything
again says nothing about what went. So a machine away for longer than the
retention kept those items for good, and its next edit of one put it back
on the server for everyone.

A read from the beginning now marks each item it reads, keeping the mark in
the sync state because the read can span passes. When it finishes, it
removes the items of the synced types it never marked. Two kinds are kept:
items newer than the read's bound, which this machine pushed during it, and
items with a change still waiting, which are the user's work. For those,
the push finds the server without the item and sends it as a create, as
before, but now records a RecreatedAfterCollection conflict and counts it,
so the sync message says so instead of undoing someone's deletion silently.

The bound is the highest sequence the cache held when the read began, or
anything higher it has read since. Taking only what the read returned would
have left the last item of a vault in place for ever.

src/DodoSSH.Client.Shell/ViewModels/VaultViewModel.cs

@@ -6451,6 +6451,8 @@ internal sealed partial class VaultViewModel(
             || pass.PushedItems > 0
             || pass.Merged > 0
             || pass.Resurrected > 0
+            || pass.Recreated > 0
+            || pass.Pruned > 0
             || pass.DeletesAbandoned > 0
             || pass.Parked > 0
             || pass.ResyncedFromStart);
@@ -13159,13 +13161,27 @@ internal sealed partial class VaultViewModel(
                 + "the beginning. "
             : string.Empty;
 
+        // Not a matter for attention — the server had already deleted these, and the machine is only catching
+        // up — but said, because items going from the list unannounced looks like losing them.
+        var pruned = report.Pruned > 0
+            ? $" {report.Pruned} item(s) deleted elsewhere while this machine was away were removed."
+            : string.Empty;
+
         if (!report.NeedsAttention)
         {
-            return replayed + (report.Pulled == 0 && report.Pushed == 0
+            return replayed + (report.Pulled == 0 && report.Pushed == 0 && report.Pruned == 0
                 ? "Already up to date."
-                : $"Synchronised: {report.Pulled} in, {report.Pushed} out.");
+                : $"Synchronised: {report.Pulled} in, {report.Pushed} out.") + pruned;
         }
 
+        var notes = AttentionNotes(report);
+
+        return replayed + "Synchronised, but: " + string.Join("; ", notes) + "." + pruned;
+    }
+
+    /// <summary>What a pass that needs attention says, one clause per thing.</summary>
+    private static List<string> AttentionNotes(SyncReport report)
+    {
         var notes = new List<string>();
 
         // "item(s)", not "host(s)": a vault now holds keys as well, and a report that named the wrong kind
@@ -13175,6 +13191,11 @@ internal sealed partial class VaultViewModel(
             notes.Add($"{report.Resurrected} item(s) deleted elsewhere were kept under a new name");
         }
 
+        if (report.Recreated > 0)
+        {
+            notes.Add($"{report.Recreated} item(s) deleted elsewhere long ago were put back, with this machine's changes");
+        }
+
         if (report.DeletesAbandoned > 0)
         {
             notes.Add($"{report.DeletesAbandoned} deletion(s) were not applied because of a newer edit");
@@ -13200,7 +13221,7 @@ internal sealed partial class VaultViewModel(
                 + "before you can see anything written since");
         }
 
-        return replayed + "Synchronised, but: " + string.Join("; ", notes) + ".";
+        return notes;
     }
 
     private async Task RunAsync(string busyMessage, Func<Task> work)

src/DodoSSH.Client.Storage/CacheRows.cs

@@ -240,6 +240,15 @@ internal sealed class CachedItemRow
     public bool IsDeleted { get; set; }
 
     public DateTimeOffset UpdatedAtUtc { get; set; }
+
+    /// <summary>The last full pull that saw this item on the server; null if none has since this was kept.</summary>
+    /// <remarks>
+    /// The server collects tombstones after their retention (ADR 0003), so a machine away longer than that
+    /// is never told of some deletions: it is refused, starts over, and pulls everything that still exists.
+    /// What the pull from nothing did not mark is what the server no longer has. See
+    /// <c>ItemStore.SweepAsync</c>.
+    /// </remarks>
+    public long? SweepMark { get; set; }
 }
 
 /// <summary>
@@ -361,6 +370,20 @@ internal sealed class SyncStateRow
     /// beside the cursor so a change of list starts the pull over; see <c>SyncEngine.PullAsync</c>.
     /// </remarks>
     public string? PulledTypes { get; set; }
+
+    /// <summary>The mark of the pull from nothing in progress, or null when none is.</summary>
+    /// <remarks>
+    /// Kept here rather than in memory because a pull from nothing can take several passes — the pages per
+    /// pass are capped — and what it has seen has to survive between them. See <see cref="CachedItemRow.SweepMark"/>.
+    /// </remarks>
+    public long? SweepMark { get; set; }
+
+    /// <summary>The highest change sequence that pull has read so far.</summary>
+    /// <remarks>
+    /// The sweep's upper bound: an item written here later than this — one this machine pushed while the
+    /// pull was under way — is newer than anything the pull has read, and not evidence of anything.
+    /// </remarks>
+    public long SweepSeenUpTo { get; set; }
 }
 
 /// <summary>Something the merge had to override, or an item that could not be processed.</summary>

src/DodoSSH.Client.Storage/ItemStore.cs

@@ -177,6 +177,94 @@ public sealed class ItemStore(
         await context.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
     }
 
+    /// <summary>Marks the items a pull from nothing has just read as ones the server still has.</summary>
+    /// <remarks>One update per type in the page; see <see cref="SweepAsync"/>.</remarks>
+    public async Task MarkSeenAsync(
+        Guid vaultId,
+        long mark,
+        IReadOnlyCollection<(SyncEntityType Type, Guid Id)> seen,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(seen);
+
+        if (seen.Count == 0)
+        {
+            return;
+        }
+
+        var context = contexts.CreateDbContext();
+        await using var scope = context.ConfigureAwait(false);
+
+        foreach (var group in seen.GroupBy(item => item.Type))
+        {
+            var type = group.Key;
+            var ids = group.Select(item => item.Id).Distinct().ToList();
+
+            await context.Set<CachedItemRow>()
+                .Where(row => row.VaultId == vaultId && row.EntityType == type && ids.Contains(row.EntityId))
+                .ExecuteUpdateAsync(set => set.SetProperty(row => row.SweepMark, mark), cancellationToken)
+                .ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>The highest change sequence held for a vault, or zero for none.</summary>
+    /// <remarks>Where a pull from nothing starts its sweep's upper bound; see <see cref="SweepAsync"/>.</remarks>
+    public async Task<long> HighestSequenceAsync(Guid vaultId, CancellationToken cancellationToken)
+    {
+        var context = contexts.CreateDbContext();
+        await using var scope = context.ConfigureAwait(false);
+
+        return await context.Set<CachedItemRow>()
+            .Where(row => row.VaultId == vaultId)
+            .MaxAsync(row => (long?)row.ChangeSequence, cancellationToken)
+            .ConfigureAwait(false) ?? 0;
+    }
+
+    /// <summary>
+    /// Removes the items a completed pull from nothing did not see, which are the ones the server no longer has.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The other half of the server's tombstone collection. A machine that missed a deletion for longer than
+    /// the retention is refused its cursor and pulls everything again — and everything again does not include
+    /// the item, so its copy here would otherwise last for ever, and its next edit would push it back.
+    /// </para>
+    /// <para>
+    /// ◆ Two kinds of row are not evidence and are kept. One newer than <paramref name="seenUpTo"/> was
+    /// written by this machine's own push during the pull: the bound is the higher of what the cache held
+    /// when the pull began and what it has read since, and the server's head is past both, so a push lands
+    /// above it. One with a change still waiting to go is the user's work: it is
+    /// left for the push, which finds the server without the item and says so — see
+    /// <c>SyncEngine.RetryAsCreateAsync</c> — rather than being thrown away here unseen.
+    /// </para>
+    /// </remarks>
+    /// <returns>How many items went.</returns>
+    public async Task<int> SweepAsync(
+        Guid vaultId,
+        IReadOnlyCollection<SyncEntityType> types,
+        long mark,
+        long seenUpTo,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(types);
+
+        var context = contexts.CreateDbContext();
+        await using var scope = context.ConfigureAwait(false);
+
+        // Only the types the pull asked for: a row of any other type was never going to be marked.
+        return await context.Set<CachedItemRow>()
+            .Where(row => row.VaultId == vaultId
+                && types.Contains(row.EntityType)
+                && (row.SweepMark == null || row.SweepMark != mark)
+                && row.ChangeSequence <= seenUpTo
+                && !context.Set<OutboxRow>().Any(pending =>
+                    pending.VaultId == row.VaultId
+                    && pending.EntityType == row.EntityType
+                    && pending.EntityId == row.EntityId))
+            .ExecuteDeleteAsync(cancellationToken)
+            .ConfigureAwait(false);
+    }
+
     /// <summary>Removes a tombstone whose change has been seen by everything that needed it.</summary>
     /// <remarks>
     /// Only ever called for a row that is already a tombstone. Collecting a live item here would make

src/DodoSSH.Client.Storage/Migrations/20261002152108_AddSweepMarks.Designer.cs

@@ -0,0 +1,481 @@
+// <auto-generated />
+using System;
+using DodoSSH.Client.Storage;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace DodoSSH.Client.Storage.Migrations
+{
+    [DbContext(typeof(ClientCacheContext))]
+    [Migration("20261002152108_AddSweepMarks")]
+    partial class AddSweepMarks
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.10");
+
+            modelBuilder.Entity("DodoSSH.Client.Storage.CachedItemRow", b =>
+                {
+                    b.Property<Guid>("VaultId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("vault_id");
+
+                    b.Property<int>("EntityType")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("entity_type");
+
+                    b.Property<Guid>("EntityId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("entity_id");
+
+                    b.Property<byte>("AadVersion")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("aad_version");
+
+                    b.Property<long>("ChangeSequence")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("change_sequence");
+
+                    b.Property<Guid?>("DataKeyId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("data_key_id");
+
+                    b.Property<bool>("IsDeleted")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("is_deleted");
+
+                    b.Property<uint>("KeyGeneration")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("key_generation");
+
+                    b.Property<byte[]>("Payload")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("payload");
+
+                    b.Property<byte[]>("ProtectedFields")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("protected_fields");
+
+                    b.Property<long?>("SweepMark")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("sweep_mark");
+
+                    b.Property<long>("UpdatedAtUtc")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("updated_at_utc");
+
+                    b.Property<int>("Version")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("version");
+
+                    b.Property<byte[]>("WrappedDataKey")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("wrapped_data_key");
+
+                    b.HasKey("VaultId", "EntityType", "EntityId")
+                        .HasName("pk_item");
+
+                    b.HasIndex("VaultId", "ChangeSequence")
+                        .HasDatabaseName("ix_item_vault_id_change_sequence");
+
+                    b.HasIndex("VaultId", "EntityType")
+                        .HasDatabaseName("ix_item_vault_id_entity_type");
+
+                    b.ToTable("item", (string)null);
+                });
+
+            modelBuilder.Entity("DodoSSH.Client.Storage.CachedVaultKeyWrapRow", b =>
+                {
+                    b.Property<Guid>("VaultId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("vault_id");
+
+                    b.Property<uint>("KeyGeneration")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("key_generation");
+
+                    b.Property<byte[]>("WrappedKey")
+                        .IsRequired()
+                        .HasColumnType("BLOB")
+                        .HasColumnName("wrapped_key");
+
+                    b.HasKey("VaultId", "KeyGeneration")
+                        .HasName("pk_vault_key_wrap");
+
+                    b.ToTable("vault_key_wrap", (string)null);
+                });
+
+            modelBuilder.Entity("DodoSSH.Client.Storage.CachedVaultRow", b =>
+                {
+                    b.Property<Guid>("VaultId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("vault_id");
+
+                    b.Property<bool>("Hidden")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("hidden");
+
+                    b.Property<bool>("IsPersonal")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("is_personal");
+
+                    b.Property<uint>("KeyGeneration")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("key_generation");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT")
+                        .HasColumnName("name");
+
+                    b.Property<int>("Permissions")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("permissions");
+
+                    b.Property<bool>("RekeyRequired")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("rekey_required");
+
+                    b.Property<Guid?>("TeamId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("team_id");
+
+                    b.Property<long>("UpdatedAtUtc")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("updated_at_utc");
+
+                    b.Property<byte[]>("WrappedVaultKey")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("wrapped_vault_key");
+
+                    b.HasKey("VaultId")
+                        .HasName("pk_vault");
+
+                    b.ToTable("vault", (string)null);
+                });
+
+            modelBuilder.Entity("DodoSSH.Client.Storage.ConflictRow", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("id");
+
+                    b.Property<bool>("Acknowledged")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("acknowledged");
+
+                    b.Property<byte[]>("Detail")
+                        .IsRequired()
+                        .HasColumnType("BLOB")
+                        .HasColumnName("detail");
+
+                    b.Property<long>("DetectedAtUtc")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("detected_at_utc");
+
+                    b.Property<Guid>("EntityId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("entity_id");
+
+                    b.Property<int>("EntityType")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("entity_type");
+
+                    b.Property<int>("Kind")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("kind");
+
+                    b.Property<Guid>("VaultId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("vault_id");
+
+                    b.HasKey("Id")
+                        .HasName("pk_conflict");
+
+                    b.HasIndex("VaultId", "Acknowledged")
+                        .HasDatabaseName("ix_conflict_vault_id_acknowledged");
+
+                    b.HasIndex("VaultId", "EntityType", "EntityId")
+                        .HasDatabaseName("ix_conflict_vault_id_entity_type_entity_id");
+
+                    b.ToTable("conflict", (string)null);
+                });
+
+            modelBuilder.Entity("DodoSSH.Client.Storage.OutboxRow", b =>
+                {
+                    b.Property<long>("Sequence")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("sequence");
+
+                    b.Property<byte>("AadVersion")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("aad_version");
+
+                    b.Property<byte?>("AncestorAadVersion")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("ancestor_aad_version");
+
+                    b.Property<Guid?>("AncestorDataKeyId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("ancestor_data_key_id");
+
+                    b.Property<uint?>("AncestorKeyGeneration")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("ancestor_key_generation");
+
+                    b.Property<byte[]>("AncestorPayload")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("ancestor_payload");
+
+                    b.Property<byte[]>("AncestorProtectedFields")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("ancestor_protected_fields");
+
+                    b.Property<int?>("AncestorVersion")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("ancestor_version");
+
+                    b.Property<byte[]>("AncestorWrappedDataKey")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("ancestor_wrapped_data_key");
+
+                    b.Property<int>("Attempts")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("attempts");
+
+                    b.Property<Guid?>("DataKeyId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("data_key_id");
+
+                    b.Property<Guid>("EntityId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("entity_id");
+
+                    b.Property<int>("EntityType")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("entity_type");
+
+                    b.Property<int?>("ExpectedVersion")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("expected_version");
+
+                    b.Property<bool>("IsParked")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("is_parked");
+
+                    b.Property<uint>("KeyGeneration")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("key_generation");
+
+                    b.Property<string>("LastError")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("last_error");
+
+                    b.Property<int>("Operation")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("operation");
+
+                    b.Property<Guid>("OperationId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("operation_id");
+
+                    b.Property<byte[]>("Payload")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("payload");
+
+                    b.Property<byte[]>("ProtectedFields")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("protected_fields");
+
+                    b.Property<long>("QueuedAtUtc")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("queued_at_utc");
+
+                    b.Property<Guid>("VaultId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("vault_id");
+
+                    b.Property<byte[]>("WrappedDataKey")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("wrapped_data_key");
+
+                    b.HasKey("Sequence")
+                        .HasName("pk_outbox");
+
+                    b.HasIndex("OperationId")
+                        .IsUnique()
+                        .HasDatabaseName("ix_outbox_operation_id");
+
+                    b.HasIndex("VaultId", "EntityType", "EntityId")
+                        .IsUnique()
+                        .HasDatabaseName("ix_outbox_vault_id_entity_type_entity_id");
+
+                    b.HasIndex("VaultId", "IsParked", "Sequence")
+                        .HasDatabaseName("ix_outbox_vault_id_is_parked_sequence");
+
+                    b.ToTable("outbox", (string)null);
+                });
+
+            modelBuilder.Entity("DodoSSH.Client.Storage.RememberedSignInRow", b =>
+                {
+                    b.Property<int>("Id")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("id");
+
+                    b.Property<byte[]>("SealedRefreshToken")
+                        .IsRequired()
+                        .HasColumnType("BLOB")
+                        .HasColumnName("sealed_refresh_token");
+
+                    b.Property<long>("UpdatedAtUtc")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("updated_at_utc");
+
+                    b.HasKey("Id")
+                        .HasName("pk_remembered_sign_in");
+
+                    b.ToTable("remembered_sign_in", null, t =>
+                        {
+                            t.HasCheckConstraint("ck_remembered_sign_in_singleton", "id = 1");
+                        });
+                });
+
+            modelBuilder.Entity("DodoSSH.Client.Storage.SyncStateRow", b =>
+                {
+                    b.Property<Guid>("VaultId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("vault_id");
+
+                    b.Property<string>("Cursor")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("cursor");
+
+                    b.Property<uint>("KeyGeneration")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("key_generation");
+
+                    b.Property<long?>("LastPulledAtUtc")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("last_pulled_at_utc");
+
+                    b.Property<long?>("LastPushedAtUtc")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("last_pushed_at_utc");
+
+                    b.Property<string>("PulledTypes")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("pulled_types");
+
+                    b.Property<long>("ServerTimeSkewMs")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("server_time_skew_ms");
+
+                    b.Property<long?>("SweepMark")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("sweep_mark");
+
+                    b.Property<long>("SweepSeenUpTo")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("sweep_seen_up_to");
+
+                    b.HasKey("VaultId")
+                        .HasName("pk_sync_state");
+
+                    b.ToTable("sync_state", (string)null);
+                });
+
+            modelBuilder.Entity("DodoSSH.Client.Storage.UnlockMaterialRow", b =>
+                {
+                    b.Property<int>("Id")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("id");
+
+                    b.Property<Guid?>("DeviceId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("device_id");
+
+                    b.Property<byte[]>("DeviceWrappedPrivateKey")
+                        .HasColumnType("BLOB")
+                        .HasColumnName("device_wrapped_private_key");
+
+                    b.Property<string>("DisplayName")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("display_name");
+
+                    b.Property<string>("Email")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("email");
+
+                    b.Property<string>("Issuer")
+                        .IsRequired()
+                        .HasColumnType("TEXT")
+                        .HasColumnName("issuer");
+
+                    b.Property<string>("KdfAlgorithm")
+                        .IsRequired()
+                        .HasColumnType("TEXT")
+                        .HasColumnName("kdf_algorithm");
+
+                    b.Property<int>("KdfMemoryKibibytes")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("kdf_memory_kibibytes");
+
+                    b.Property<int>("KdfParallelism")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("kdf_parallelism");
+
+                    b.Property<int>("KdfPasses")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("kdf_passes");
+
+                    b.Property<byte[]>("KdfSalt")
+                        .IsRequired()
+                        .HasColumnType("BLOB")
+                        .HasColumnName("kdf_salt");
+
+                    b.Property<uint>("KeyGeneration")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("key_generation");
+
+                    b.Property<string>("ServerUrl")
+                        .IsRequired()
+                        .HasColumnType("TEXT")
+                        .HasColumnName("server_url");
+
+                    b.Property<string>("Subject")
+                        .IsRequired()
+                        .HasColumnType("TEXT")
+                        .HasColumnName("subject");
+
+                    b.Property<long>("UpdatedAtUtc")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("updated_at_utc");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT")
+                        .HasColumnName("user_id");
+
+                    b.Property<byte[]>("WrappedPrivateKey")
+                        .IsRequired()
+                        .HasColumnType("BLOB")
+                        .HasColumnName("wrapped_private_key");
+
+                    b.HasKey("Id")
+                        .HasName("pk_unlock_material");
+
+                    b.ToTable("unlock_material", null, t =>
+                        {
+                            t.HasCheckConstraint("ck_unlock_material_singleton", "id = 1");
+                        });
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/DodoSSH.Client.Storage/Migrations/20261002152108_AddSweepMarks.cs

@@ -0,0 +1,49 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace DodoSSH.Client.Storage.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddSweepMarks : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<long>(
+                name: "sweep_mark",
+                table: "sync_state",
+                type: "INTEGER",
+                nullable: true);
+
+            migrationBuilder.AddColumn<long>(
+                name: "sweep_seen_up_to",
+                table: "sync_state",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: 0L);
+
+            migrationBuilder.AddColumn<long>(
+                name: "sweep_mark",
+                table: "item",
+                type: "INTEGER",
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "sweep_mark",
+                table: "sync_state");
+
+            migrationBuilder.DropColumn(
+                name: "sweep_seen_up_to",
+                table: "sync_state");
+
+            migrationBuilder.DropColumn(
+                name: "sweep_mark",
+                table: "item");
+        }
+    }
+}

src/DodoSSH.Client.Storage/Migrations/ClientCacheContextModelSnapshot.cs

@@ -59,6 +59,10 @@ namespace DodoSSH.Client.Storage.Migrations
                         .HasColumnType("BLOB")
                         .HasColumnName("protected_fields");
 
+                    b.Property<long?>("SweepMark")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("sweep_mark");
+
                     b.Property<long>("UpdatedAtUtc")
                         .HasColumnType("INTEGER")
                         .HasColumnName("updated_at_utc");
@@ -370,6 +374,14 @@ namespace DodoSSH.Client.Storage.Migrations
                         .HasColumnType("INTEGER")
                         .HasColumnName("server_time_skew_ms");
 
+                    b.Property<long?>("SweepMark")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("sweep_mark");
+
+                    b.Property<long>("SweepSeenUpTo")
+                        .HasColumnType("INTEGER")
+                        .HasColumnName("sweep_seen_up_to");
+
                     b.HasKey("VaultId")
                         .HasName("pk_sync_state");
 

src/DodoSSH.Client.Storage/StoredTypes.cs

@@ -35,6 +35,12 @@ public enum ConflictKind
 
     /// <summary>The server refused the operation outright. Retrying will not help.</summary>
     Rejected = 6,
+
+    /// <summary>
+    /// Someone else deleted an item this machine had edited, so long ago that the server had already let go
+    /// of the deletion. The edit was sent as the item again, under its own name and id.
+    /// </summary>
+    RecreatedAfterCollection = 7,
 }
 
 /// <summary>What an offline unlock needs.</summary>
@@ -191,7 +197,9 @@ public sealed record StoredSyncState(
     DateTimeOffset? LastPulledAt = null,
     DateTimeOffset? LastPushedAt = null,
     long ServerTimeSkewMs = 0,
-    string? PulledTypes = null);
+    string? PulledTypes = null,
+    long? SweepMark = null,
+    long SweepSeenUpTo = 0);
 
 /// <summary>Something the merge overrode, or an item that could not be processed.</summary>
 /// <param name="Id">This record's own id, which its sealed detail is bound to.</param>

src/DodoSSH.Client.Storage/SyncStateStore.cs

@@ -47,7 +47,9 @@ public sealed class SyncStateStore(IDbContextFactory<ClientCacheContext> context
                 row.LastPulledAtUtc,
                 row.LastPushedAtUtc,
                 row.ServerTimeSkewMs,
-                row.PulledTypes);
+                row.PulledTypes,
+                row.SweepMark,
+                row.SweepSeenUpTo);
     }
 
     /// <summary>Records a vault's position.</summary>
@@ -74,6 +76,8 @@ public sealed class SyncStateStore(IDbContextFactory<ClientCacheContext> context
         row.LastPushedAtUtc = state.LastPushedAt;
         row.ServerTimeSkewMs = state.ServerTimeSkewMs;
         row.PulledTypes = state.PulledTypes;
+        row.SweepMark = state.SweepMark;
+        row.SweepSeenUpTo = state.SweepSeenUpTo;
 
         await context.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
     }

src/DodoSSH.Client.Sync/SyncEngine.cs

@@ -1,5 +1,6 @@
 using System.Globalization;
 using System.Runtime.InteropServices;
+using System.Security.Cryptography;
 using DodoSSH.Client.Api;
 using DodoSSH.Client.Storage;
 using DodoSSH.Contracts;
@@ -155,23 +156,12 @@ public sealed class SyncEngine
             }
 
             await ApplyPageAsync(vaultId, response.Changes, report, cancellationToken).ConfigureAwait(false);
-
-            foreach (var change in response.Changes)
-            {
-                report.Pulled++;
-
-                // Counted apart for the same reason the pushed ones are: a machine reads back the log
-                // entries it just wrote, so a pass that "pulled five changes" may have carried nothing
-                // anybody did. See SyncReport.PulledItems.
-                if (IsLog(change.EntityType))
-                {
-                    report.PulledLogEntries++;
-                }
-            }
+            CountPulled(response.Changes, report);
 
             var advanced = !string.Equals(state.Cursor, response.NextCursor, StringComparison.Ordinal);
 
             state = Record(vaultId, state, response, report);
+            state = await CarrySweepAsync(vaultId, state, response, report, cancellationToken).ConfigureAwait(false);
             await syncState.SaveAsync(state, cancellationToken).ConfigureAwait(false);
 
             if (!response.HasMore)
@@ -188,15 +178,22 @@ public sealed class SyncEngine
         }
     }
 
-    /// <summary>
-    /// Whether the server refused the cursor this client sent, rather than failing for some other reason.
-    /// </summary>
-    /// <remarks>
-    /// Read from the problem code and not from the prose, which is free to change, and never claimed for a
-    /// request that carried no cursor: "from the beginning" is the one position a client is allowed to ask
-    /// for, so a rejection of <em>that</em> is a server this code cannot reason about and has to surface.
-    /// It is also what keeps the retry from looping — the restarted request sends no cursor.
-    /// </remarks>
+    private static void CountPulled(IReadOnlyList<SyncChange> changes, SyncReportBuilder report)
+    {
+        foreach (var change in changes)
+        {
+            report.Pulled++;
+
+            // Counted apart for the same reason the pushed ones are: a machine reads back the log entries it
+            // just wrote, so a pass that "pulled five changes" may have carried nothing anybody did. See
+            // SyncReport.PulledItems.
+            if (IsLog(change.EntityType))
+            {
+                report.PulledLogEntries++;
+            }
+        }
+    }
+
     /// <summary>Whether a change is one the machine wrote about itself rather than one somebody made.</summary>
     /// <remarks>
     /// Used only for reporting. Log entries sync exactly like every other item — they are pulled, pushed,
@@ -206,10 +203,46 @@ public sealed class SyncEngine
     private static bool IsLog(SyncEntityType type) =>
         type is SyncEntityType.ConnectionLogEntry or SyncEntityType.ActivityLogEntry;
 
+    /// <summary>
+    /// Whether the server refused the cursor this client sent, rather than failing for some other reason.
+    /// </summary>
+    /// <remarks>
+    /// Read from the problem code and not from the prose, which is free to change, and never claimed for a
+    /// request that carried no cursor: "from the beginning" is the one position a client is allowed to ask
+    /// for, so a rejection of <em>that</em> is a server this code cannot reason about and has to surface.
+    /// It is also what keeps the retry from looping — the restarted request sends no cursor.
+    /// </remarks>
     private static bool WasTheCursorRefused(DodoSshApiException exception, string? cursor) =>
         !string.IsNullOrEmpty(cursor)
         && string.Equals(exception.Code, ProblemCodes.InvalidCursor, StringComparison.Ordinal);
 
+    /// <summary>Where the pull should carry on from, which is the start when the types it reads have changed.</summary>
+    /// <remarks>
+    /// A cursor read under a different list of types is past changes of the types it did not ask for, so an
+    /// upgrade that adds one — SpelunkKey, ObjectStore — would never receive the items of that type made
+    /// before it. Starting over once is the only way to see them; applying is idempotent, which is what makes
+    /// the restart for a refused cursor safe as well. A state from before the list was kept has none and
+    /// starts over once for the same reason: it may already have missed some.
+    /// </remarks>
+    private async Task<StoredSyncState> ReadStateAsync(
+        Guid vaultId,
+        SyncReportBuilder report,
+        CancellationToken cancellationToken)
+    {
+        var state = await syncState.ReadAsync(vaultId, cancellationToken).ConfigureAwait(false);
+
+        if (state.Cursor is not null && !string.Equals(state.PulledTypes, PulledTypes, StringComparison.Ordinal))
+        {
+            return await StartOverAsync(state, report, cancellationToken).ConfigureAwait(false);
+        }
+
+        // A pull from nothing that is not a restart — the vault's first, or a cache reset — sweeps as well.
+        // There is usually nothing to remove; the one time there is, it is the same case.
+        return state is { Cursor: null, SweepMark: null }
+            ? await SweepingAsync(state, cancellationToken).ConfigureAwait(false)
+            : state;
+    }
+
     /// <summary>
     /// Forgets this vault's position and reads the log again from the beginning.
     /// </summary>
@@ -234,44 +267,22 @@ public sealed class SyncEngine
     /// cache itself is the thing in doubt.
     /// </para>
     /// <para>
-    /// That leaves one gap, and it is worth naming rather than leaving to be discovered: once the server
-    /// starts collecting tombstones — <c>DodoOptions.TombstoneRetentionDays</c>, not implemented yet — a
-    /// replay no longer carries a deletion older than the retention window. A machine that missed such a
-    /// delete and then had its cursor refused would keep the row. Nothing here can tell that from a row
-    /// the server still has, so the answer when it matters will be to clear the mirror as well, not to
-    /// guess.
+    /// A replay does not carry a deletion the server has collected — <c>DodoOptions.TombstoneRetentionDays</c>
+    /// — and that is the commonest refusal of all: a machine away longer than the retention. The rows it no
+    /// longer hears about are the ones the replay does not mark, and are swept when it ends; see
+    /// <see cref="CarrySweepAsync"/>.
     /// </para>
     /// <para>
     /// Written down before the replay begins, so a process that dies mid-replay starts the next one from
     /// the beginning as well, rather than meeting the same refusal again.
     /// </para>
     /// </remarks>
-    /// <summary>Where the pull should carry on from, which is the start when the types it reads have changed.</summary>
-    /// <remarks>
-    /// A cursor read under a different list of types is past changes of the types it did not ask for, so an
-    /// upgrade that adds one — SpelunkKey, ObjectStore — would never receive the items of that type made
-    /// before it. Starting over once is the only way to see them; applying is idempotent, which is what makes
-    /// the restart for a refused cursor safe as well. A state from before the list was kept has none and
-    /// starts over once for the same reason: it may already have missed some.
-    /// </remarks>
-    private async Task<StoredSyncState> ReadStateAsync(
-        Guid vaultId,
-        SyncReportBuilder report,
-        CancellationToken cancellationToken)
-    {
-        var state = await syncState.ReadAsync(vaultId, cancellationToken).ConfigureAwait(false);
-
-        return state.Cursor is not null && !string.Equals(state.PulledTypes, PulledTypes, StringComparison.Ordinal)
-            ? await StartOverAsync(state, report, cancellationToken).ConfigureAwait(false)
-            : state;
-    }
-
     private async Task<StoredSyncState> StartOverAsync(
         StoredSyncState state,
         SyncReportBuilder report,
         CancellationToken cancellationToken)
     {
-        var restarted = state with { Cursor = null };
+        var restarted = await SweepingAsync(state with { Cursor = null }, cancellationToken).ConfigureAwait(false);
 
         await syncState.SaveAsync(restarted, cancellationToken).ConfigureAwait(false);
 
@@ -280,6 +291,68 @@ public sealed class SyncEngine
         return restarted;
     }
 
+    /// <summary>The state with a sweep begun: a new mark, and the bound set from what the cache holds now.</summary>
+    /// <remarks>
+    /// The mark is random rather than the time, because a sweep must never share one with the last: rows that
+    /// one marked would count as seen by this one. A clock can stand still, or go back.
+    /// </remarks>
+    private async Task<StoredSyncState> SweepingAsync(StoredSyncState state, CancellationToken cancellationToken) =>
+        state with
+        {
+            SweepMark = BitConverter.ToInt64(RandomNumberGenerator.GetBytes(sizeof(long))),
+            SweepSeenUpTo = await items.HighestSequenceAsync(state.VaultId, cancellationToken).ConfigureAwait(false),
+        };
+
+    /// <summary>
+    /// Marks what a pull from nothing has read, and at its end removes what it never did.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The server forgets a deletion once it is past its retention. A machine that was away longer is
+    /// refused its cursor and reads everything again — and everything again is the items that still exist,
+    /// with nothing said about the ones that went. Without this their rows stayed here for good, and the
+    /// next edit of one put it back on the server for everybody.
+    /// </para>
+    /// <para>
+    /// A pull from nothing can take more than one pass, so the mark is in the stored state, not in memory.
+    /// Every pull from nothing sweeps — the first one ever as well, where there is nothing to remove. What
+    /// is kept, and why, is <see cref="ItemStore.SweepAsync"/>'s to say.
+    /// </para>
+    /// </remarks>
+    private async Task<StoredSyncState> CarrySweepAsync(
+        Guid vaultId,
+        StoredSyncState state,
+        SyncPullResponse response,
+        SyncReportBuilder report,
+        CancellationToken cancellationToken)
+    {
+        if (state.SweepMark is not { } mark)
+        {
+            return state;
+        }
+
+        var read = response.Changes.Where(change => reconcilers.ContainsKey(change.EntityType)).ToList();
+
+        await items.MarkSeenAsync(
+            vaultId,
+            mark,
+            read.Select(change => (change.EntityType, change.EntityId)).ToList(),
+            cancellationToken).ConfigureAwait(false);
+
+        var seenUpTo = read.Aggregate(state.SweepSeenUpTo, (highest, change) => Math.Max(highest, change.ChangeSequence));
+
+        if (response.HasMore)
+        {
+            return state with { SweepSeenUpTo = seenUpTo };
+        }
+
+        report.Pruned += await items
+            .SweepAsync(vaultId, ItemKinds.SyncedTypes, mark, seenUpTo, cancellationToken)
+            .ConfigureAwait(false);
+
+        return state with { SweepMark = null, SweepSeenUpTo = 0 };
+    }
+
     private StoredSyncState Record(
         Guid vaultId,
         StoredSyncState state,
@@ -794,6 +867,26 @@ public sealed class SyncEngine
 
         if (failure is null)
         {
+            // An edit of a version this machine once saw means the server had the item and has since let go
+            // of it: deleted elsewhere, and the deletion collected past its retention before this machine
+            // heard of it. The edit is the user's work and goes back, but not silently — somebody deleted
+            // this on purpose. A create has no expected version and is the ordinary case.
+            if (operation.ExpectedVersion is not null)
+            {
+                await conflicts.RecordAsync(
+                    vaultId,
+                    operation.EntityType,
+                    operation.EntityId,
+                    ConflictKind.RecreatedAfterCollection,
+                    ConflictDetails.Encode(
+                        "This was deleted elsewhere while this machine had unsaved changes to it, long enough ago "
+                        + "that the server no longer remembered the deletion. The changes were kept and the item "
+                        + "was put back."),
+                    cancellationToken).ConfigureAwait(false);
+
+                report.Recreated++;
+            }
+
             return true;
         }
 

src/DodoSSH.Client.Sync/SyncReport.cs

@@ -84,6 +84,17 @@ public sealed record SyncOptions
 /// changed anything, which is otherwise the sort of thing that looks like a fault.
 /// </para>
 /// </param>
+/// <param name="PushedLogEntries">How many of <paramref name="Pushed"/> were log entries.</param>
+/// <param name="PulledLogEntries">How many of <paramref name="Pulled"/> were log entries.</param>
+/// <param name="Recreated">
+/// Items this machine had edited that somebody else had deleted so long ago the server no longer
+/// remembered it. The edit was kept and the item sent again under its own name — and the user is told,
+/// because the deletion was somebody's decision.
+/// </param>
+/// <param name="Pruned">
+/// Items removed from this machine because a read from the beginning found the server no longer has them:
+/// deleted elsewhere while this machine was away for longer than the server keeps deletions.
+/// </param>
 public sealed record SyncReport(
     Guid VaultId,
     int Pulled,
@@ -99,11 +110,13 @@ public sealed record SyncReport(
     bool RoundsExhausted,
     bool ResyncedFromStart,
     int PushedLogEntries = 0,
-    int PulledLogEntries = 0)
+    int PulledLogEntries = 0,
+    int Recreated = 0,
+    int Pruned = 0)
 {
     /// <summary>Whether anything happened that a user should be told about.</summary>
     public bool NeedsAttention =>
-        Resurrected > 0 || DeletesAbandoned > 0 || Parked > 0 || Unreadable > 0 || RekeyRequired;
+        Resurrected > 0 || Recreated > 0 || DeletesAbandoned > 0 || Parked > 0 || Unreadable > 0 || RekeyRequired;
 
     /// <summary>
     /// Operations the server accepted that were somebody's own work rather than a log entry.
@@ -160,6 +173,10 @@ internal sealed class SyncReportBuilder(Guid vaultId)
 
     internal bool ResyncedFromStart { get; set; }
 
+    internal int Recreated { get; set; }
+
+    internal int Pruned { get; set; }
+
     internal SyncReport Build() =>
         new(
             vaultId,
@@ -176,7 +193,9 @@ internal sealed class SyncReportBuilder(Guid vaultId)
             RoundsExhausted,
             ResyncedFromStart,
             PushedLogEntries,
-            PulledLogEntries);
+            PulledLogEntries,
+            Recreated,
+            Pruned);
 }
 
 /// <summary>The record written to the conflict log when a merge had to override something.</summary>