[vhpx]

Persist the meeting document's freeze, installed generation and applied receipt so restarting a channel room cannot serve an older copy during an erase. Add Ed25519 command verification, authenticated callback ingress, generation-aware join/checkpoint tickets, client disposal on generation change and read-only protocol-1 editors after erasure. Current documents remain available during unrelated S-X/history work.

DRAFT / integration HOLD. Grounded in accepted r5.1 SHA-256 5af2611365e00025b0c22843c115f48c440d64ea328f75e79d1a7b7d1f0fa5df; the queue's r5 backup matches 69f8afb3….

Dependencies and review gates:

• V4's read/checkpoint generation RPCs must be available before deployment.
• The V10/V12 owner must implement and qualify meet_document_erase_callback(p_claims): durable nonce consumption/result replay; namespace/topic/meeting/document binding; generation/status reads; hold-epoch apply leases expiring no later than the ticket; recovery bytes only for authenticated admitted recovery. This PR contains the authenticated route and receiver contract, not that database implementation. Missing service support refuses document access. Do not deploy this draft independently.
• Selene: review exact-head protocol/security behavior. Rex: review the empty public verification-key ring in Wrangler and dependency/deploy ordering. No migration or provisioning is included.
• Full bun check:changed --base HEAD is not green: M4 TTR rejected heavy validation for low disk. Initial source-size, formatting, inventory and translation-order findings were fixed and their narrow gates rerun successfully. The broad run was stopped after repeated admission refusals. i9 source extraction stalled and was stopped; no i9 test pass is claimed.

Tests first: the initial DO gate suite was 6 failed / 2 passed, then 13 passed after implementation. Final targeted M4 checks:

• node --import tsx --test apps/meet-realtime/src/channel-room-erase.test.ts: 13 passed.
• node --test apps/meet-realtime/src/channel-room-erase.runtime.test.mjs: 1 passed using real Worker/SQLite; reconstructs the room between requests, tests lease recovery, apply/replay/release, held history/S-X and wiped-storage reapplication.
• Realtime vitest run src/documents/provider.test.ts --maxWorkers=1: 5 passed.
• Meet-core vitest run src/features/call/components/document-panel.test.tsx --maxWorkers=1: 3 passed.
• Web vitest run src/app/api/v1/realtime/documents/erase-state/route.test.ts src/app/api/v1/realtime/documents/checkpoint/route.test.ts --maxWorkers=1: 6 passed.
• Focused protocol TypeScript check, Biome on all 24 changed supported files, source-size, generated route inventory, translation order/parity and diff whitespace checks passed. No whole-app build or browser QA.

Risk paths: document availability when callbacks are missing; hold-lease admission; restore generation/receipt matching; client refresh/remount; checkpoint RPC compatibility. Runtime recovery tests use generated disposable keys. Callback database replay/hold concurrency and complete production restore behavior still need integrated proof. No customer data, real keys, secrets, flags, merge, deployment or publication action was used.

Feature gates remain external and default OFF: meet_transcript_erase, meet_transcript_erase_self and the existing Meet AI kill switch. This PR enables none of them. The checked-in command public-key ring is empty; no signing key is placed in realtime.

Claude Code: independent review requested from Selene.

R1 protocol and rollout corrections

Callbacks use the service User-Agent and fresh callback nonces, keeping the apply
ticket in command_nonce. Recovery uses one admission. Document gates are cached
for 30 seconds, invalidated on commands, and report content-free refusal codes
and counts. Whole erase tombstones all Yjs roots, verifies item GC and refuses
future client updates to extra roots.

MEET_ERASE_DO_PROTOCOL is default-off on web and Worker. Off retains legacy
checkpoint arity and document availability; previously frozen/advanced documents
stay closed. The callback secret is required and distinct from realtime auth,
with environment-controlled key version rotation. Public keys use a secret,
HTTPS is required, workers.dev is disabled, and AI containment vars remain set.

Migration order: V4 → V2 → V10. Deploy order: V4 → callback RPC + web route →
secrets → meet-realtime. Enable only after independent callback acceptance,
with synchronized web/Worker flags and V12 signer readiness. Keep DRAFT and all
integration/security holds pending Selene's exact-head re-check. No deployment or
production writes are part of this PR.

The unit tests use Vitest; the Node SQLite runtime test declares esbuild and
Miniflare in its owning package. Runtime fixtures check headers, unique callback
nonces and one admission per recovery. See the retention runbook for rotation,
telemetry and the integration requirements.

Validation: full bun check:changed on i9 passed all 87 steps (506.0 s), including Node SQLite runtime, 20 protocol unit tests, web route tests and all selected type checks. Cold declaration and out-of-scope advisories remain as reported by the repository gate; root shared configuration remains CI-only. Four new regressions were RED on the original head. Final source bytes were compared to the committed source before publication. CI and independent exact-head acceptance are pending.