glyph,
>> 2. Do I notify you if Joe disappears on my side?
>>
> Yes.
That's the recipient announcing deletion, not the sender.
On the sender's side, the object can't disappear unless the recipient sends the deletion. The recipient is holding a reference to it. This is by design - the sender can synthesize a restricted capability which has no use except for mediating the recipient's access to a particular resource (in fact, this is practically the only recommended way to use PB) and the reference to that object is held only by the server.
And anyway, my questions is how _should_ this work, not how does it work right now.
It works this way now, and that part of the design is basically correct, I think, unless you're asking about some other aspect of it that I don't get ;).