{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-a-scoped-memory-deletion-has-silently-failed-to-revoke-derived-indexes",
  "title": "What structural signals indicate a scoped memory deletion has silently failed to revoke derived indexes",
  "date_of_record": "2026 November 14",
  "scope": "Applies to read/write/forget memory stores where a `forget(scope)` operation is expected to make all data reachable through that scope both unreadable and unrecoverable, including derived structures (vector indexes, inverted term indexes, summaries, caches). Does not apply to stores that maintain a single flat namespace with no derived artifacts, nor to append-only logs where retention is enforced by physical segment expiry rather than logical revocation.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-a-scoped-memory-deletion-has-silently-failed-to-revoke-derived-indexes.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-a-scoped-memory-deletion-has-silently-failed-to-revoke-derived-indexes.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-a-scoped-memory-deletion-has-silently-failed-to-revoke-derived-indexes.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1821,
    "python_slice_tokens": 290,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A deletion has two separable semantics: **tombstoning** (the primary record is marked deleted and reads through the canonical path return absent) and **revocation** (every derived artifact that encodes information about the record is invalidated or rebuilt). The non-obvious boundary is that these are almost always implemented at different layers, by differen...",
    "what_was_observed": "In a store with three tiers—a primary document table, an HNSW vector index, and a rolling LLM-generated summary cache keyed by scope—a `forget(scope=\"tenant_4471\")` operation completed in 41 ms and returned a deletion receipt with a monotonically increasing `forget_seq`. Subsequent canonical reads for that tenant returned `404`/absent as expected. However: 1. Vector search continued to return chunks whose `tenant_id`...",
    "condition_of_validity": "The \"forget returns ok implies revoked\" assumption is valid only when all of the following hold: - Every derived artifact records, at write time, the set of scopes that contributed to it (a provenance vector), and this set is queryable without scanning content. - The forget operation computes the transitive closure of dependents from that provenance before r...",
    "decision_boundary": "The operational decision is whether to trust a forget receipt as a revocation guarantee or to require a verification read. - **Trust the receipt** only if the store exposes a `provenance_complete` flag per artifact class and a `forget_seq` watermark on every read response. If the read response does not carry a sequence number, you cannot prove the artifact p...",
    "operational_effect": "Teams that treat the forget receipt as authoritative ship a system where erasure is reported but not enforced, and the gap is invisible to canonical-read tests. The failure surfaces later as a vector-search hit on deleted content, or as a summary that paraphrases a record the tenant believes is gone—often during an audit, which is the worst time. The durable..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "ebc4d20105ec0ecce6393a5fc31ae396a09b1379594c38a9cbd694048a556b7e",
    "verified_classes": [
      "RevocationIncompleteError",
      "DerivedArtifact",
      "ForgetReceipt"
    ],
    "verified_functions": [
      "verify_forget"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "RevocationIncompleteError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}