{
  "schema_version": "1.3.0",
  "slug": "what-distinguishes-an-authoritative-memory-tombstone-from-a-resurrection-hazard",
  "title": "What distinguishes an authoritative memory tombstone from a resurrection hazard?",
  "date_of_record": "2026 October 20",
  "scope": "* **Applies when:** Records can be deleted, backups or caches exist that could resurrect deleted state, and downstream consumers cannot distinguish original records from resurrected ones by content alone. * **Does not apply when:** All dele",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-distinguishes-an-authoritative-memory-tombstone-from-a-resurrection-hazard.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-distinguishes-an-authoritative-memory-tombstone-from-a-resurrection-hazard.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-distinguishes-an-authoritative-memory-tombstone-from-a-resurrection-hazard.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1109,
    "python_slice_tokens": 307,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The separation between **deletion flag** (a marker in the primary database saying \"this record is deleted\") and **authoritative tombstone** (a cryptographically signed, monotonic deletion receipt that supersedes any later resurrection attempts, including those from stale replicas, backups, or poisoned caches). Relying on deletion flags creates the **Zombie R...",
    "what_was_observed": "In distributed memory architectures, failing to distinguish tombstones from resurrection hazards produces three primary failure modes: 1. **Backup Resurrection:** A record is deleted from the live database. Six months later, an old backup is restored for unrelated reasons. The deleted record reappears, and consumers treat it as valid because it looks normal. 2. **Cache Repopulation:** A deleted record is purged from ...",
    "condition_of_validity": "* **Applies when:** Records can be deleted, backups or caches exist that could resurrect deleted state, and downstream consumers cannot distinguish original records from resurrected ones by content alone. * **Does not apply when:** All deletions are cryptographically shredded (encryption keys destroyed), making any resurrection mathematically impossible, or ...",
    "decision_boundary": "1. **Is the record currently visible in any layer?** If no, standard state applies. If yes, proceed to check its deletion history. 2. **Is there a `tombstone_receipt_signature` for this record?** If no, the record may never have been deleted. If yes, proceed. 3. **Does the record's `monotonic_version` match or exceed the `tombstone_monotonic_version`?** If n...",
    "operational_effect": "1. **Zombie Record Prevention:** Blocks resurrected records from propagating by requiring tombstone receipt verification before any record is trusted. 2. **Backup Safety:** Allows safe backups and restores by ensuring the tombstone supersedes any restored state. 3. **Replica Consistency:** Catches read-replica lag reversal by comparing the record's version a..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4247ab046a847d6f7f77563f18206f568644af0d9f5b77007773b134bb8fd719",
    "verified_classes": [
      "TombstoneVerdict",
      "RecordState",
      "TombstoneContext",
      "TombstoneManifest",
      "AuthoritativeTombstoneGuard"
    ],
    "verified_functions": [
      "_hash",
      "evaluate_record"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 0,
    "raised_exceptions": [],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "enum",
      "hashlib",
      "json"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}