{
  "schema_version": "1.3.0",
  "slug": "where-must-an-instance-reconcile-ttl-expiry-against-scoped-retention-when-a-forget-request-races-a-read",
  "title": "Where must an instance reconcile TTL expiry against scoped retention when a forget request races a read",
  "date_of_record": "2026 November 13",
  "scope": "Applies to memory tool APIs that expose read/write/forget operations with per-record TTLs and scoped retention (tenant, session, or namespace). Does not apply to append-only audit logs with no forget primitive, nor to systems where TTL is enforced solely at the storage layer without a scoped-retention overlay.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/where-must-an-instance-reconcile-ttl-expiry-against-scoped-retention-when-a-forget-request-races-a-read.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-reconcile-ttl-expiry-against-scoped-retention-when-a-forget-request-races-a-read.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/where-must-an-instance-reconcile-ttl-expiry-against-scoped-retention-when-a-forget-request-races-a-read.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1517,
    "python_slice_tokens": 282,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A TTL is a *lifetime predicate over a single record*. Scoped retention is a *set-level invariant over a namespace*. These two mechanisms fail in different directions, and the boundary case is not \"did the record expire\" but \"does the namespace's post-forget state still satisfy its retention invariant when a concurrent read has already resolved the TTL.\" The ...",
    "what_was_observed": "A memory tool exposed `read(scope, key)`, `write(scope, key, value, ttl)`, and `forget(scope, predicate)`. The forget predicate was a set selector (e.g., `tag == \"pii\"`), and success returned a count of records tombstoned. A verifier then called `read` across the scope and asserted an empty result for forgotten keys. Under load, roughly 1 in 4,000 verification sweeps observed a record that `forget` had reported as to...",
    "condition_of_validity": "The invariant \"forget is verifiable\" holds only if, for every record `r` in scope `S`: - If `forget(S, pred)` returned at time `t_f` and `r` matched `pred`, then no read that began before `t_f` may return `r` after `t_f` unless that read's linearization point precedes the forget's. - TTL expiry at `t_e` is a *separate* exclusion: `r` is unreadable for `t > t...",
    "decision_boundary": "Choose tombstone-on-read-revalidation (re-check the forget tombstone immediately before returning the value, and abort to \"not found\" if tombstoned) when: - Reads and forgets can interleave within a single scope, and - The verifier's assertion is \"forgotten implies unreadable,\" not merely \"forgotten implies deleted from primary storage.\" Choose pure TTL-only...",
    "operational_effect": "With tombstone revalidation, the verifier's sweep returns empty deterministically, and the forget count matches the observable excluded set. The cost is one extra tombstone lookup per read on the return path, plus the requirement that tombstones outlive the maximum in-flight read duration for the scope (a tombstone GC horizon, not a TTL). If tombstones are G..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "1a2177445080c353cb1aac4cedb156a5711578d43e89c2643f33f13943ffefcd",
    "verified_classes": [
      "RetentionViolation",
      "MemoryScope"
    ],
    "verified_functions": [
      "__init__",
      "read",
      "forget",
      "verify_forgotten"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "RetentionViolation"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "time"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}