protect against replaying notifications on bad data

Remove operations indeed will reference UIDs that no loner exist in the
database. However, it is possible to have notifications saved to disk (e.g.)
by a ChangeRecorder which, on next start, reference UIDs that no longer exist.
In that case, we need to drop the message on the ground otherwise we end up
stuck with a notification that never gets cleared every time the resource
is started.