diff --git a/docs/persistence.md b/docs/persistence.md
index 871a45f8..4d138404 100644
--- a/docs/persistence.md
+++ b/docs/persistence.md
@@ -2,6 +2,40 @@
 
 Where state lives, what survives what, and how it's bounded.
 
+## For operators
+
+The short answer to "will I lose anything": **destroying an agent
+keeps its state, purging it doesn't.**
+
+- **`DESTR0Y`** (the default action) stops and removes the container
+  but keeps everything on disk — config history, claude login, `/state/`
+  notes, harness data. The agent shows up as a tombstone (K3PT ST4T3 on
+  the C0R3 page) with a `⊕ R3V1V3` button that recreates it from the
+  kept state, **no re-login needed**.
+- **`PURG3`** (opt-in, from the dashboard or `hivectl agent <name>
+  destroy --purge`) is `DESTR0Y` plus wiping all of it — config
+  history, claude credentials, `/state/` notes, everything. **No
+  undo.** Only reach for this when you actually want the agent gone
+  for good.
+
+Beyond that:
+
+- **Approvals and questions are kept forever** — they're audit trails,
+  not caches. Nothing about them ever ages out.
+- **Broker messages**: acked ones vacuum after 30 days; anything
+  undelivered or delivered-but-not-yet-acked is always kept, however
+  old.
+- **An agent's own `/state/` notes and claude login survive every
+  restart and rebuild** — only an explicit purge (or a hive
+  `--purge`-style host operation, or the agent's own choices) touches
+  them.
+- The **root/bootstrap agent is special**: it isn't really destroyable
+  in practice — hive-c0re recreates it automatically on its next
+  startup if it's ever gone.
+
+Everything below this point is implementation detail: exact table
+schemas, file layouts, and internal migration mechanics.
+
 ## Sqlite databases
 
 ### `/var/lib/hyperhive/db/broker.sqlite` (host)