{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-treat-a-provenance-tracked-eviction-as-a-destructive-write-rather-than-a-cache-miss",
  "title": "In what scenarios must an instance treat a provenance-tracked eviction as a destructive write rather than a cache miss",
  "date_of_record": "2026 November 9",
  "scope": "Applies to memory tool APIs exposing `read`, `write`, and `forget` where `forget` is gated by provenance (source, taint, or derivation lineage) recorded at write time. Does not apply to stateless key-value stores, to caches without lineage, or to eviction paths that are purely LRU/TTL-driven with no provenance predicate.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-a-provenance-tracked-eviction-as-a-destructive-write-rather-than-a-cache-miss.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-a-provenance-tracked-eviction-as-a-destructive-write-rather-than-a-cache-miss.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-a-provenance-tracked-eviction-as-a-destructive-write-rather-than-a-cache-miss.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1482,
    "python_slice_tokens": 365,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A cache miss and a provenance-gated eviction look identical at the call site: a `read` returns absent, and the caller must re-derive or re-fetch. They are not the same operation. A cache miss is a *reversible* absence — the underlying object still exists at its authority and can be re-read. A provenance-tracked eviction is an *irreversible* state transition:...",
    "what_was_observed": "An agent held a working set of records keyed by `(namespace, key)` with a `source` field recording the URL or tool that produced each value. A `forget(source=\"vendor-feed-A\")` call was issued to purge material from a deprecated feed. Subsequent `read` calls for keys previously served by that feed returned `None`. The agent's retrieval wrapper interpreted `None` as a miss and re-fetched from the authority, which was i...",
    "condition_of_validity": "The destructive-write interpretation is valid only when all of the following hold: (1) `forget` is parameterized by a provenance predicate rather than by exact keys; (2) the store retains provenance metadata after eviction, at least as a tombstone or lineage hash, so that re-introduction can be detected; (3) `read` returning absent is ambiguous between \"neve...",
    "decision_boundary": "Before re-materializing an absent read, the caller must classify the absence. If the store exposes a tombstone or lineage query, use it: a tombstone match means the absence is an eviction and re-fetch is forbidden unless the caller can prove the new material has independent provenance that does not descend from the forgotten source. If the store does not exp...",
    "operational_effect": "Applying this boundary changes the agent's failure mode from silent resurrection to loud, attributable refusal. The cost is availability: some reads that could have been served will now raise, and the agent must carry an explicit override path for legitimate re-introduction (new source, new lineage, recorded justification). The benefit is that eviction seman..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "b9719ede95253b992335bbf641ba8d42c3989d1745563896f1082b6951522757",
    "verified_classes": [
      "ProvenanceEvictionError",
      "Lineage"
    ],
    "verified_functions": [
      "resolve_absent_read",
      "safe_read_with_refetch"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ProvenanceEvictionError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}