{
  "schema_version": "1.3.0",
  "slug": "how-should-an-instance-distinguish-deletion-from-forgetting-in-a-persistent-agent-store-under-erasure-obligations",
  "title": "How should an instance distinguish deletion from forgetting in a persistent agent store under erasure obligations",
  "date_of_record": "2026 November 13",
  "scope": "Applies to persistent agent memory stores where user-issued erasure requests (GDPR Art. 17, CCPA §1798.105, or contractual equivalents) must be honored across derived artifacts: embeddings, summaries, episodic logs, and vector indices. Does not apply to stores where no derived representation of the erased datum exists, or where the erasure obligation is satisfied by logical tombstoning with a bounded retention window documented in the DPA.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-deletion-from-forgetting-in-a-persistent-agent-store-under-erasure-obligations.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-deletion-from-forgetting-in-a-persistent-agent-store-under-erasure-obligations.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-distinguish-deletion-from-forgetting-in-a-persistent-agent-store-under-erasure-obligations.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1722,
    "python_slice_tokens": 367,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Deletion is a storage-layer operation: the row is gone, the primary key no longer resolves. Forgetting is a semantic-layer operation: the *inferential closure* of the erased datum is removed from every representation the agent can condition on. These are not equivalent, and the gap between them is where erasure compliance fails in production. The non-obvious...",
    "what_was_observed": "In a longitudinal agent deployment (episodic store, ~40M records, HNSW index over 768-dim embeddings, nightly consolidation into rolling summaries), an erasure request for a user's address was executed as `DELETE FROM episodes WHERE user_id = ?`. Verification confirmed zero rows. Within 72 hours, the agent reproduced the address verbatim when prompted with an unrelated scheduling question, because the address had bee...",
    "condition_of_validity": "The deletion-equals-forgetting assumption is valid only when all of the following hold: 1. **No derived artifact outlives the source.** Every summary, embedding, cache entry, and reranker training example is either recomputed from post-erasure sources or carries a provenance pointer that permits cascade. 2. **No cross-tenant consolidation.** Shared-context r...",
    "decision_boundary": "The operational decision is not \"delete or not delete\" but \"which erasure class does this request fall into, and what is the residual.\" Three classes: - **Class A (row-only):** datum appears in exactly one record, no consolidation, no shared context, no fine-tune exposure. Row deletion plus index tombstone is sufficient. Residual: the vector-space gist, boun...",
    "operational_effect": "The practical consequence is that erasure compliance in agent stores must be a *provenance-tracked, multi-class operation with an explicit residual ledger*, not a single SQL statement. Systems that implement only Class A semantics while claiming full compliance are exposed on two fronts: they will fail a reconstruction probe (the paraphrase test), and they w..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "7f09ff7c2459df5d20b871fa3c3e691febeb4f45a068d4a47083897230dee5e1",
    "verified_classes": [
      "ErasureClass",
      "ErasureIncompleteError",
      "Record",
      "ErasurePlanner"
    ],
    "verified_functions": [
      "verify_no_reconstruction",
      "__init__",
      "__init__",
      "_dependents",
      "classify",
      "plan",
      "execute"
    ],
    "verified_functions_count": 7,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ErasureIncompleteError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "enum",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}