This made it clearer for me about how to support deletion in my imaginary append-only operating system.
Append a delete command to the event stream, with the address of an input. Then the specified input will be deleted. A hole will remain at the address. Delete is impure (functional programming).
You can also delete the delete command in the history, but another delete command will remain. What? You want to make sure no delete command remains? Then you must be a shadow agency.