Delete a conversation thread

Forget ONE conversation thread: its agent checkpoint, its answer records and its thread indexes.

A later message on the same address starts a memory the deleted turns never touched. A LINKED person’s aggregated bridge:@person:{id} thread is forgotten across every route index it spans.

Forgetting is ABSOLUTE: a valid id on its own route always succeeds, even when nothing is stored. An aged-out thread whose answer records already expired under the retention TTL, or one never seen, answers removed=0 and never a 404 — and its checkpoint is deleted regardless, because that memory defaults to keep-forever and is otherwise left behind once the records lapse. A route-keyed id MUST carry the route’s bridge:{route_name}: prefix; an id belonging to another route is a loud 400, the sole guard stopping a delete on one route from wiping another route’s memory. A person bridge:@person:{id} thread whose person is unknown, or whose route_name is not one of the person’s routes, is a loud 404. A turn IN FLIGHT on the thread (an accepted intake still holding a live lease) is a 409: its completion re-writes checkpoint state and re-stamps the indexes behind the delete, half-forgetting the memory — retry once it drains. The guard is re-checked under the FIFO, so a turn admitted while the lock is being taken is refused before any teardown, never left to re-create memory behind the delete. A route_name that is not a valid slug, or a blank thread_id, is a 400.

Caller authority is the door’s grantable write action — the SAME write grant that creates a route deletes routes and forgets threads — never a per-thread owner check.

The teardown runs in an order an interruption cannot strand: the checkpoint FIRST — its memory is reachable only through the indexes once this call returns, so it must go while the indexes still name the thread to bring a re-run back — then the records and the indexes together, the index being the durable marker of an owed reclamation and torn down LAST. Idempotent under re-run, so a partial completion is FINISHED by a retry.

The whole teardown runs under the thread’s per-thread FIFO (the lock an operator send and an in-flight turn take), so an operator send already in flight on the thread within this worker drains BEFORE the delete rather than half-behind it; a full queue is the loud, retriable 503 that FIFO raises before anything is torn down. As a live-caller sync door the acquisition is bounded by sync_door_wait_seconds: a wait past it — behind a turn possibly HITL-paused on another worker — is the loud, retriable 503 ThreadBusyError rather than a block past the proxy timeout.

Returns {"removed", "route_name", "thread_id", "states_erased"}, where removed counts the answer records this call deleted (0 when a prior run already cleared them, when their rows had expired under the retention TTL, or when the id was never stored) and states_erased counts the thread-subject declared-state records forgotten across the routes the thread spans (0 when the states feature is off or the thread held no declared state).

A send still going out on the thread when this call runs is forgotten when it ends, not by this call: for at most one settle deadline its sending row, in no thread index, still holds the participant’s address, and removed does not count it.