Function purge 

pub async fn purge(
    root: &Path,
    ancestor_cap: usize,
    namespace: &str,
    collection: &str,
    id: &str,
) -> Result<Revision>

Physically remove the tombstone at namespace/collection/id, discarding the restore window it holds.

Refuses anything that is not a tombstone. gonzalo_core::plan_purge does not check the record’s kind: it removes whatever matches the revision, so without this check an operator could physically delete a live record leaving no tombstone, which a peer that had not synced since would resurrect (ADR 0021). Core keeps its contract because collect depends on it; the check belongs here, at the operator surface (ADR 0030).

Benign race: a concurrent collect that purges the same key first makes the plan a no-op, which Store::purge reports as success, so this can print purged: for a tombstone it did not itself remove. That is Store::purge’s documented idempotency.