{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-scoped-forgetting-from-silently-degrading-into-logical-deletion-under-concurrent-re-ingestion",
  "title": "Which invariants prevent scoped forgetting from silently degrading into logical deletion under concurrent re-ingestion",
  "date_of_record": "2026 November 11",
  "scope": "Applies to memory tool interfaces that expose `read`/`write`/`forget` operations over records carrying a retention scope (tenant, session, subject, or data-class tag) and a redaction/forgetting obligation. Does not apply to append-only audit logs whose retention is governed by immutable external policy, nor to single-writer stores where no re-ingestion path exists.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-scoped-forgetting-from-silently-degrading-into-logical-deletion-under-concurrent-re-ingestion.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-scoped-forgetting-from-silently-degrading-into-logical-deletion-under-concurrent-re-ingestion.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-scoped-forgetting-from-silently-degrading-into-logical-deletion-under-concurrent-re-ingestion.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1944,
    "python_slice_tokens": 359,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The boundary that matters is not \"record deleted vs. record present.\" It is **obligation satisfied vs. obligation discharged into a tombstone that a later write can legally overwrite.** A `forget` call that removes a record and returns success has discharged the *operation*; it has not necessarily discharged the *obligation*. The obligation is discharged onl...",
    "what_was_observed": "In a multi-tenant memory service, `forget(scope=tenant_42, field=\"ssn\")` was implemented as a predicate delete over live records. A downstream agent re-ingested a document belonging to `tenant_42` forty minutes later; the ingestion path called `write(scope=tenant_42, key=doc_991, fields={..., \"ssn\": ...})`. The write succeeded because no invariant tied `write` to the forgetting ledger. The forget operation's success ...",
    "condition_of_validity": "The guarantee \"after `forget(S, F)` returns, no live record under `S` exposes `F`\" is valid **only if** all of the following hold: - **Write-path enforcement, not read-path filtering.** Every `write` that would produce a record matching a live forgetting entry must be rejected or transformed *before* commit. Read-path filtering (masking `F` on `read`) does n...",
    "decision_boundary": "The operational decision is: **on a write that matches a live forgetting entry, reject, or transform, or refuse the scope?** - **Reject** (raise, fail the write) when the forgetting obligation is a legal/compliance guarantee and the caller cannot be trusted to supply a compliant value. The write path must fail closed. - **Transform** (strip or redact `F` bef...",
    "operational_effect": "When the invariant holds, `forget` becomes a *state transition on the write path*, not a one-shot delete. The observable consequences: - `forget` returns success only after the ledger entry is durable and the write path is confirmed to consult it (a fencing check, not a best-effort propagation). Propagation lag between ledger commit and write-path enforcemen..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "6be7b89a8a68461ca11f649cfcdae954a5e2518da818e749a521530fcbf63a29",
    "verified_classes": [
      "ForgottenFieldReintroductionError",
      "ForgettingLedger"
    ],
    "verified_functions": [
      "resolve_scope",
      "write_record",
      "forget",
      "__init__",
      "record",
      "lookup"
    ],
    "verified_functions_count": 6,
    "defensive_guards_count": 1,
    "raised_exceptions": [
      "ForgottenFieldReintroductionError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}