private management routes to redact stored record bodies without touching logical identity: DELETE /repos/{did} excludes, untracks, and erases every body a repo owns (heads, history, the compatibility archive, buffered resync commits), and DELETE /repos/{did}/records/{collection}/{rkey} scopes the same to one record with a head/history/all target. redaction replaces bodies with their raw CID bytes and writes permanent markers so a replayed version of the same record+CID stays suppressed even after an intervening version or history compaction. both routes are idempotent, chunk their rewrites in bounded key-ordered batches, and are rejected in ephemeral and links-only modes. issue: hydrant-0gg