{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-of-a-memory-record-exist-for-a-forget-to-be-safe-the-tombstone-before-index-invariant-in-governed-deletion",
  "title": "Where must an instance of a memory record exist for a forget to be safe: the tombstone-before-index invariant in governed deletion",
  "date_of_record": "2026 November 8",
  "scope": "Applies to read/write/forget memory tool APIs that track provenance and enforce governed deletion over derived artifacts (vector indexes, caches, summaries, embeddings). Does not apply to append-only logs without derived indexes, nor to systems where \"forget\" is merely a logical filter applied at read time with no physical reclamation obligation.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-memory-record-exist-for-a-forget-to-be-safe-the-tombstone-before-index-invariant-in-governed-deletion.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-memory-record-exist-for-a-forget-to-be-safe-the-tombstone-before-index-invariant-in-governed-deletion.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-of-a-memory-record-exist-for-a-forget-to-be-safe-the-tombstone-before-index-invariant-in-governed-deletion.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1489,
    "python_slice_tokens": 232,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is between **deletion of the source record** and **deletion of every derived projection that can reconstruct it**. A `forget(record_id)` call that removes the authoritative row but leaves a stale embedding, a cached summary, or an inverted-index posting is not a deletion — it is a *relocation* of the memory into a less governed subst...",
    "what_was_observed": "In a provenance-tracked memory service, records carried `provenance_id` chains: a summary pointed at its source spans, spans pointed at a source document, embeddings pointed at spans. Forget was specified as \"delete record and all descendants.\" The implementation walked the provenance graph top-down, deleting the source document first, then descendants, then invalidating index entries, then writing the tombstone last...",
    "condition_of_validity": "The tombstone-first ordering is valid — and the simpler source-first ordering is unsafe — precisely when all three of the following hold: - **Derived projections are queryable independently of the source.** If every read path joins back to the authoritative row, a missing source is self-evidently a forgotten record and no tombstone is needed. Vector indexes ...",
    "decision_boundary": "The engineer's decision is not \"tombstone first or source first\" in the abstract but **which readers must consult the tombstone before trusting a projection.** The boundary: - Readers that can reconstruct content from a projection (summarizers, embedding-based retrieval, cache warmers) **must** check the tombstone set before serving or promoting. This check ...",
    "operational_effect": "Adopting tombstone-first ordering plus tombstone-aware readers changed the system's failure surface from \"silent resurrection and index leakage\" to \"quarantined orphans requiring operator review.\" Forget latency rose (tombstone write is now on the critical path, before any cleanup), but forget *correctness* became monotonic: once `forget` returns success, no..."
  },
  "matched_failure_symptoms": [
    "OOM_KILL_OR_MEMORY_EXHAUSTION"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "60b46815a0ff66d8f46a5c8b0ba4aafd4e226f1ae9a108c55ae0ab0e3e411646",
    "verified_classes": [
      "ForgetOrderingError",
      "MemoryStore"
    ],
    "verified_functions": [
      "__init__",
      "forget",
      "read_projection"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 3,
    "raised_exceptions": [
      "ForgetOrderingError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}