{
  "schema_version": "1.3.0",
  "slug": "when-must-a-memory-write-be-rejected-at-commit-time-despite-passing-admission-validation",
  "title": "When must a memory write be rejected at commit time despite passing admission validation?",
  "date_of_record": "2026 November 6",
  "scope": "Applies to agent-facing memory tool APIs that expose `write`, `read`, and `forget` operations with attached provenance records, TTL/expiry fields, and revocation tokens. Does not apply to append-only audit logs that never serve reads, nor to single-tenant stores where revocation and TTL are enforced by an external garbage collector with a documented read barrier.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/when-must-a-memory-write-be-rejected-at-commit-time-despite-passing-admission-validation.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/when-must-a-memory-write-be-rejected-at-commit-time-despite-passing-admission-validation.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/when-must-a-memory-write-be-rejected-at-commit-time-despite-passing-admission-validation.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1404,
    "python_slice_tokens": 259,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Admission validation and commit-time validation are not the same predicate. Admission validation answers \"is this write well-formed and authorized *now*?\" Commit-time validation answers \"is this write still admissible *at the instant it becomes visible to readers*?\" These diverge whenever the interval between admission and commit overlaps a concurrent `forge...",
    "what_was_observed": "During a burst of concurrent agent activity against a shared memory namespace, the following sequence recurred: 1. Agent A issues `write(fact=F, provenance=P, ttl=+300s)` where `P` references memory record `R`. 2. Admission validator checks `P`: chain intact, `R` present, `R` not revoked, principal authorized. Passes. 3. Between admission and commit (a window widened by provenance chain verification, which walks the ...",
    "condition_of_validity": "The commit-time rejection rule is valid — and must be enforced — under the following conditions: - The store permits concurrent `forget` and `write` against the same provenance graph (i.e., no global write lock over the namespace). - Provenance is resolved lazily at read time rather than eagerly materialized at write time. If provenance is fully materialized...",
    "decision_boundary": "At commit time, before making the write visible, the writer must re-evaluate the following and reject on any failure: - **Provenance liveness:** every record referenced by `P` must resolve to a non-tombstoned, non-revoked state *as of commit*. A single tombstoned ancestor is sufficient grounds for rejection. - **TTL non-crossing:** the write's own TTL must b...",
    "operational_effect": "Enforcing commit-time rejection converts a silent, asymmetric corruption into a loud, retryable failure. Writers receive a rejection with a machine-readable cause (`PROVENANCE_TOMBSTONED`, `ANCESTOR_TTL_EXPIRED`, `REVOCATION_RACE`), which is actionable: the agent can re-derive the fact from a live source or abandon it. The cost is a small increase in write r..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4575ea26c7be581d3dfaf1db16f25dbf28675a6a46f4bbee8623b6298ad881bb",
    "verified_classes": [
      "MemoryCommitError",
      "RecordState"
    ],
    "verified_functions": [
      "commit_write",
      "__init__"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "MemoryCommitError"
    ],
    "sample_fail_closed_invariants": [
      "REVOCATION_RACE",
      "OWN_TTL_NONPOSITIVE",
      "PROVENANCE_TOMBSTONED",
      "PROVENANCE_REVOKED"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "time",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}