[{"data":1,"prerenderedAt":813},["ShallowReactive",2],{"navigation_docs":3,"-docs-operations-data-lifecycle-and-deletion":356,"-docs-operations-data-lifecycle-and-deletion-surround":808},[4,8,34,64,90,139,157,171,193,227,241,266,312,334],{"title":5,"path":6,"stem":7},"Documentation","\u002Fdocs","docs\u002Findex",{"title":9,"path":10,"stem":11,"children":12},"Getting started","\u002Fdocs\u002Fgetting-started","docs\u002F01.getting-started\u002Findex",[13,14,18,22,26,30],{"title":9,"path":10,"stem":11},{"title":15,"path":16,"stem":17},"Introduction","\u002Fdocs\u002Fgetting-started\u002Fintroduction","docs\u002F01.getting-started\u002F01.introduction",{"title":19,"path":20,"stem":21},"Concepts","\u002Fdocs\u002Fgetting-started\u002Fconcepts","docs\u002F01.getting-started\u002F02.concepts",{"title":23,"path":24,"stem":25},"Quickstart (5 minutes)","\u002Fdocs\u002Fgetting-started\u002Fquickstart","docs\u002F01.getting-started\u002F03.quickstart",{"title":27,"path":28,"stem":29},"Local development","\u002Fdocs\u002Fgetting-started\u002Flocal-development","docs\u002F01.getting-started\u002F04.local-development",{"title":31,"path":32,"stem":33},"FAQ","\u002Fdocs\u002Fgetting-started\u002Ffaq","docs\u002F01.getting-started\u002F05.faq",{"title":35,"path":36,"stem":37,"children":38},"Architecture","\u002Fdocs\u002Farchitecture","docs\u002F02.architecture\u002Findex",[39,40,44,48,52,56,60],{"title":35,"path":36,"stem":37},{"title":41,"path":42,"stem":43},"Architecture overview","\u002Fdocs\u002Farchitecture\u002Foverview","docs\u002F02.architecture\u002F01.overview",{"title":45,"path":46,"stem":47},"Services","\u002Fdocs\u002Farchitecture\u002Fservices","docs\u002F02.architecture\u002F02.services",{"title":49,"path":50,"stem":51},"Request lifecycle","\u002Fdocs\u002Farchitecture\u002Frequest-lifecycle","docs\u002F02.architecture\u002F03.request-lifecycle",{"title":53,"path":54,"stem":55},"Data model","\u002Fdocs\u002Farchitecture\u002Fdata-model","docs\u002F02.architecture\u002F04.data-model",{"title":57,"path":58,"stem":59},"Status and evidence","\u002Fdocs\u002Farchitecture\u002Fstatus-and-evidence","docs\u002F02.architecture\u002F05.status-and-evidence",{"title":61,"path":62,"stem":63},"Target architecture and authority","\u002Fdocs\u002Farchitecture\u002Ftarget-architecture","docs\u002F02.architecture\u002F06.target-architecture",{"title":65,"path":66,"stem":67,"children":68},"Auth","\u002Fdocs\u002Fauth","docs\u002F03.auth\u002Findex",[69,70,74,78,82,86],{"title":65,"path":66,"stem":67},{"title":71,"path":72,"stem":73},"Overview","\u002Fdocs\u002Fauth\u002Foverview","docs\u002F03.auth\u002F01.overview",{"title":75,"path":76,"stem":77},"Organization and agent model","\u002Fdocs\u002Fauth\u002Forg-project-model","docs\u002F03.auth\u002F02.org-project-model",{"title":79,"path":80,"stem":81},"Issuing API keys","\u002Fdocs\u002Fauth\u002Fissuing-api-keys","docs\u002F03.auth\u002F03.issuing-api-keys",{"title":83,"path":84,"stem":85},"Multi-tenant RLS","\u002Fdocs\u002Fauth\u002Fmulti-tenant-rls","docs\u002F03.auth\u002F04.multi-tenant-rls",{"title":87,"path":88,"stem":89},"Operator sessions and step-up","\u002Fdocs\u002Fauth\u002Foperator-sessions","docs\u002F03.auth\u002F05.operator-sessions",{"title":91,"path":92,"stem":93,"children":94},"Proxy","\u002Fdocs\u002Fproxy","docs\u002F04.proxy\u002Findex",[95,96,99,103,107,111,115,119,123,127,131,135],{"title":91,"path":92,"stem":93},{"title":71,"path":97,"stem":98},"\u002Fdocs\u002Fproxy\u002Foverview","docs\u002F04.proxy\u002F01.overview",{"title":100,"path":101,"stem":102},"Authentication","\u002Fdocs\u002Fproxy\u002Fauthentication","docs\u002F04.proxy\u002F02.authentication",{"title":104,"path":105,"stem":106},"Request routing","\u002Fdocs\u002Fproxy\u002Frequest-routing","docs\u002F04.proxy\u002F03.request-routing",{"title":108,"path":109,"stem":110},"Sessions","\u002Fdocs\u002Fproxy\u002Fsessions","docs\u002F04.proxy\u002F04.sessions",{"title":112,"path":113,"stem":114},"Directives","\u002Fdocs\u002Fproxy\u002Fdirectives","docs\u002F04.proxy\u002F05.directives",{"title":116,"path":117,"stem":118},"Idempotency and budgets","\u002Fdocs\u002Fproxy\u002Fidempotency-and-budgets","docs\u002F04.proxy\u002F06.idempotency-and-budgets",{"title":120,"path":121,"stem":122},"Rate limiting","\u002Fdocs\u002Fproxy\u002Frate-limiting","docs\u002F04.proxy\u002F07.rate-limiting",{"title":124,"path":125,"stem":126},"Provider adapters","\u002Fdocs\u002Fproxy\u002Fprovider-adapters","docs\u002F04.proxy\u002F08.provider-adapters",{"title":128,"path":129,"stem":130},"Auth caching","\u002Fdocs\u002Fproxy\u002Fauth-caching","docs\u002F04.proxy\u002F09.auth-caching",{"title":132,"path":133,"stem":134},"Configuration","\u002Fdocs\u002Fproxy\u002Fconfiguration","docs\u002F04.proxy\u002F10.configuration",{"title":136,"path":137,"stem":138},"Provider routing and resilience","\u002Fdocs\u002Fproxy\u002Fprovider-routing-and-resilience","docs\u002F04.proxy\u002F11.provider-routing-and-resilience",{"title":140,"path":141,"stem":142,"children":143},"Memory","\u002Fdocs\u002Fmemory","docs\u002F05.memory\u002Findex",[144,145,149,153],{"title":140,"path":141,"stem":142},{"title":146,"path":147,"stem":148},"Memory overview","\u002Fdocs\u002Fmemory\u002Foverview","docs\u002F05.memory\u002F01.overview",{"title":150,"path":151,"stem":152},"Write path","\u002Fdocs\u002Fmemory\u002Fwrite-path","docs\u002F05.memory\u002F02.write-path",{"title":154,"path":155,"stem":156},"Search and lifecycle","\u002Fdocs\u002Fmemory\u002Fsearch-and-lifecycle","docs\u002F05.memory\u002F03.search-and-lifecycle",{"title":158,"path":159,"stem":160,"children":161},"Context","\u002Fdocs\u002Fcontext","docs\u002F06.context\u002Findex",[162,163,167],{"title":158,"path":159,"stem":160},{"title":164,"path":165,"stem":166},"Assembly pipeline","\u002Fdocs\u002Fcontext\u002Foverview","docs\u002F06.context\u002F01.overview",{"title":168,"path":169,"stem":170},"Ranking and packing","\u002Fdocs\u002Fcontext\u002Franking-and-packing","docs\u002F06.context\u002F02.ranking-and-packing",{"title":172,"path":173,"stem":174,"children":175},"Intelligence","\u002Fdocs\u002Fintelligence","docs\u002F07.intelligence\u002Findex",[176,177,181,185,189],{"title":172,"path":173,"stem":174},{"title":178,"path":179,"stem":180},"Workers","\u002Fdocs\u002Fintelligence\u002Fworkers","docs\u002F07.intelligence\u002F01.workers",{"title":182,"path":183,"stem":184},"Extraction","\u002Fdocs\u002Fintelligence\u002Fextraction","docs\u002F07.intelligence\u002F02.extraction",{"title":186,"path":187,"stem":188},"Embedder","\u002Fdocs\u002Fintelligence\u002Fembedder","docs\u002F07.intelligence\u002F03.embedder",{"title":190,"path":191,"stem":192},"Extraction evaluation","\u002Fdocs\u002Fintelligence\u002Fevaluation","docs\u002F07.intelligence\u002F04.evaluation",{"title":194,"path":195,"stem":196,"children":197},"API reference","\u002Fdocs\u002Fapi-reference","docs\u002F08.api-reference\u002Findex",[198,199,203,207,211,215,219,223],{"title":194,"path":195,"stem":196},{"title":200,"path":201,"stem":202},"Chat completions","\u002Fdocs\u002Fapi-reference\u002Fchat-completions","docs\u002F08.api-reference\u002F01.chat-completions",{"title":204,"path":205,"stem":206},"Responses","\u002Fdocs\u002Fapi-reference\u002Fresponses","docs\u002F08.api-reference\u002F02.responses",{"title":208,"path":209,"stem":210},"Errors","\u002Fdocs\u002Fapi-reference\u002Ferrors","docs\u002F08.api-reference\u002F03.errors",{"title":212,"path":213,"stem":214},"Health and metrics","\u002Fdocs\u002Fapi-reference\u002Fproxy-health","docs\u002F08.api-reference\u002F04.proxy-health",{"title":216,"path":217,"stem":218},"HTTP route inventory","\u002Fdocs\u002Fapi-reference\u002Fhttp-routes","docs\u002F08.api-reference\u002F05.http-routes",{"title":220,"path":221,"stem":222},"Management API","\u002Fdocs\u002Fapi-reference\u002Fmanagement-api","docs\u002F08.api-reference\u002F06.management-api",{"title":224,"path":225,"stem":226},"Auth gRPC (ValidateToken, ValidateAgent)","\u002Fdocs\u002Fapi-reference\u002Fauth-grpc","docs\u002F08.api-reference\u002F07.auth-grpc",{"title":228,"path":229,"stem":230,"children":231},"MCP","\u002Fdocs\u002Fmcp","docs\u002F09.mcp\u002Findex",[232,233,237],{"title":228,"path":229,"stem":230},{"title":234,"path":235,"stem":236},"Memory server","\u002Fdocs\u002Fmcp\u002Fmemory-server","docs\u002F09.mcp\u002F01.memory-server",{"title":238,"path":239,"stem":240},"Operator gateway","\u002Fdocs\u002Fmcp\u002Foperator-gateway","docs\u002F09.mcp\u002F02.operator-gateway",{"title":242,"path":243,"stem":244,"children":245},"Security","\u002Fdocs\u002Fsecurity","docs\u002F10.security\u002Findex",[246,247,251,254,258,262],{"title":242,"path":243,"stem":244},{"title":248,"path":249,"stem":250},"Security overview","\u002Fdocs\u002Fsecurity\u002Foverview","docs\u002F10.security\u002F01.overview",{"title":100,"path":252,"stem":253},"\u002Fdocs\u002Fsecurity\u002Fauthentication","docs\u002F10.security\u002F02.authentication",{"title":255,"path":256,"stem":257},"Tenant isolation","\u002Fdocs\u002Fsecurity\u002Ftenant-isolation","docs\u002F10.security\u002F03.tenant-isolation",{"title":259,"path":260,"stem":261},"Secrets and keys","\u002Fdocs\u002Fsecurity\u002Fsecrets-and-keys","docs\u002F10.security\u002F04.secrets-and-keys",{"title":263,"path":264,"stem":265},"Prompt injection","\u002Fdocs\u002Fsecurity\u002Fprompt-injection","docs\u002F10.security\u002F05.prompt-injection",{"title":267,"path":268,"stem":269,"children":270},"Operations","\u002Fdocs\u002Foperations","docs\u002F11.operations\u002Findex",[271,272,276,280,284,288,292,296,300,304,308],{"title":267,"path":268,"stem":269},{"title":273,"path":274,"stem":275},"Observability","\u002Fdocs\u002Foperations\u002Fobservability","docs\u002F11.operations\u002F01.observability",{"title":277,"path":278,"stem":279},"Traces and ClickHouse","\u002Fdocs\u002Foperations\u002Ftraces-and-clickhouse","docs\u002F11.operations\u002F02.traces-and-clickhouse",{"title":281,"path":282,"stem":283},"Health checks","\u002Fdocs\u002Foperations\u002Fhealth-checks","docs\u002F11.operations\u002F03.health-checks",{"title":285,"path":286,"stem":287},"Incident response","\u002Fdocs\u002Foperations\u002Fincident-response","docs\u002F11.operations\u002F04.incident-response",{"title":289,"path":290,"stem":291},"Troubleshooting","\u002Fdocs\u002Foperations\u002Ftroubleshooting","docs\u002F11.operations\u002F05.troubleshooting",{"title":293,"path":294,"stem":295},"Billing and budgets","\u002Fdocs\u002Foperations\u002Fbilling-and-budgets","docs\u002F11.operations\u002F06.billing-and-budgets",{"title":297,"path":298,"stem":299},"Evidence and relay","\u002Fdocs\u002Foperations\u002Fevidence-and-relay","docs\u002F11.operations\u002F07.evidence-and-relay",{"title":301,"path":302,"stem":303},"Console","\u002Fdocs\u002Foperations\u002Fconsole","docs\u002F11.operations\u002F08.console",{"title":305,"path":306,"stem":307},"Failure modes and recovery","\u002Fdocs\u002Foperations\u002Ffailure-and-recovery","docs\u002F11.operations\u002F09.failure-and-recovery",{"title":309,"path":310,"stem":311},"Data lifecycle and deletion","\u002Fdocs\u002Foperations\u002Fdata-lifecycle-and-deletion","docs\u002F11.operations\u002F10.data-lifecycle-and-deletion",{"title":313,"path":314,"stem":315,"children":316},"Deployment","\u002Fdocs\u002Fdeployment","docs\u002F12.deployment\u002Findex",[317,318,322,326,330],{"title":313,"path":314,"stem":315},{"title":319,"path":320,"stem":321},"Docker Compose (dev)","\u002Fdocs\u002Fdeployment\u002Fdocker-compose","docs\u002F12.deployment\u002F01.docker-compose",{"title":323,"path":324,"stem":325},"Environment variables","\u002Fdocs\u002Fdeployment\u002Fenvironment-variables","docs\u002F12.deployment\u002F02.environment-variables",{"title":327,"path":328,"stem":329},"Kubernetes","\u002Fdocs\u002Fdeployment\u002Fkubernetes","docs\u002F12.deployment\u002F03.kubernetes",{"title":331,"path":332,"stem":333},"Production readiness","\u002Fdocs\u002Fdeployment\u002Fproduction-readiness","docs\u002F12.deployment\u002F04.production-readiness",{"title":335,"path":336,"stem":337,"children":338},"Reference","\u002Fdocs\u002Freference","docs\u002F13.reference\u002Findex",[339,340,344,348,352],{"title":335,"path":336,"stem":337},{"title":341,"path":342,"stem":343},"Glossary","\u002Fdocs\u002Freference\u002Fglossary","docs\u002F13.reference\u002F01.glossary",{"title":345,"path":346,"stem":347},"Roadmap and gates","\u002Fdocs\u002Freference\u002Froadmap","docs\u002F13.reference\u002F02.roadmap",{"title":349,"path":350,"stem":351},"Architecture decisions","\u002Fdocs\u002Freference\u002Fadr","docs\u002F13.reference\u002F03.adr",{"title":353,"path":354,"stem":355},"Compatibility and versioning","\u002Fdocs\u002Freference\u002Fcompatibility","docs\u002F13.reference\u002F04.compatibility",{"id":357,"title":309,"audience":358,"author":359,"authorUrl":359,"body":360,"coverIndex":359,"coverLabel":359,"coverTone":359,"date":359,"decisionStatus":359,"description":801,"excerpt":359,"extension":802,"featured":803,"historical":803,"meta":804,"navigation":714,"path":310,"readingTime":359,"scope":416,"seo":805,"sourceOfTruth":806,"status":367,"stem":311,"tags":359,"verifiedDate":368,"__hash__":807},"docs\u002Fdocs\u002F11.operations\u002F10.data-lifecycle-and-deletion.md","operator",null,{"type":361,"value":362,"toc":785},"minimark",[363,369,378,383,386,396,399,402,407,418,445,448,452,518,521,525,528,572,581,592,604,608,611,640,644,651,654,658,675,679,699,703,754,758],[364,365],"page-status",{"note":366,"status":367,"verified":368},"Local tombstones and receipted org deletion exist; a complete deletion certificate and cross-store atomicity are not accepted","PROVISIONAL","2026-10-21",[370,371,372,373,377],"p",{},"Deletion is a lifecycle, not a single ",[374,375,376],"code",{},"DELETE",". The platform distinguishes immediate read suppression from physical purge, and it distinguishes an organization suspension from a deletion job. Confusing those states is how deleted data reappears through a cache or projection.",[379,380,382],"h2",{"id":381},"memory-lifecycle","Memory lifecycle",[370,384,385],{},"The target memory flow is:",[387,388,394],"pre",{"className":389,"code":391,"language":392,"meta":393},[390],"language-text","authenticated source\n  → validate\u002Fscope\u002Fsize\n  → PII and safety checks\n  → candidate observation\n  → exact idempotency\u002Fhash dedup\n  → near-duplicate\u002Ftemporal\u002Fconflict analysis\n  → active | quarantine | supersede | expire | delete\n","text","",[374,395,391],{"__ignoreMap":393},[370,397,398],{},"Every observation is intended to carry tenant\u002Fresource scope, actor\u002Fsource, content hash, observed\u002Fprocessed\u002Fvalid times, source reference, status, retention or legal hold, model\u002Fembedding\u002Fpreprocessing identities, and links to duplicates, conflicts, or supersession.",[370,400,401],{},"The durable substrate exists locally, but the full append-only provenance ledger and accepted public lifecycle contract do not. GAP-007 remains open.",[403,404,406],"h3",{"id":405},"forget","Forget",[370,408,409,412,413,417],{},[374,410,411],{},"POST \u002Fv1\u002Fmemories\u002F{memory_id}\u002Fforget"," is a ",[414,415,416],"strong",{},"provisional"," revision-fenced tombstone:",[419,420,421,425,428,439,442],"ul",{},[422,423,424],"li",{},"The caller must supply the expected lifecycle revision.",[422,426,427],{},"The row is marked tombstoned with a new revision.",[422,429,430,431,434,435,438],{},"Reads, vector search, full-text search, hot cache, feedback, dedup, and conflict candidate loads filter on ",[374,432,433],{},"deleted_at IS NULL"," and ",[374,436,437],{},"tombstoned = FALSE",".",[422,440,441],{},"Cache eviction happens after the authoritative tombstone commits.",[422,443,444],{},"A stale revision is rejected rather than overwriting a newer lifecycle state.",[370,446,447],{},"This is not yet an accepted public deletion contract. Full-store fan-out, projection fencing, restore behavior, and independent verification remain open.",[379,449,451],{"id":450},"organization-lifecycle","Organization lifecycle",[453,454,455,471],"table",{},[456,457,458],"thead",{},[459,460,461,465,468],"tr",{},[462,463,464],"th",{},"Operation",[462,466,467],{},"Route",[462,469,470],{},"Effect",[472,473,474,488,505],"tbody",{},[459,475,476,480,485],{},[477,478,479],"td",{},"Suspend",[477,481,482],{},[374,483,484],{},"POST \u002Fv1\u002Forganizations\u002F{org_id}\u002Fsuspend",[477,486,487],{},"Marks the organization suspended and publishes invalidation; owner-level permission required",[459,489,490,493,498],{},[477,491,492],{},"Request deletion",[477,494,495],{},[374,496,497],{},"DELETE \u002Fv1\u002Forganizations\u002F{org_id}",[477,499,500,501,504],{},"Returns ",[374,502,503],{},"202"," with a deletion job; enqueue failure is fail-closed",[459,506,507,510,515],{},[477,508,509],{},"Poll job",[477,511,512],{},[374,513,514],{},"GET \u002Fv1\u002Forganizations\u002F{org_id}\u002Fdeletion-jobs\u002F{job_id}",[477,516,517],{},"Returns job status and store receipts",[370,519,520],{},"Deletion is executed by a worker saga with a short soft time limit and a longer hard limit. The job claims work, checks legal holds under an advisory lock, resolves archived object URIs before the PostgreSQL purge, purges canonical rows, publishes model-policy invalidation, runs optional store stages, and finalizes only when receipts satisfy the deployment profile.",[403,522,524],{"id":523},"store-receipts","Store receipts",[370,526,527],{},"The saga records per-store status rather than claiming one global success:",[453,529,530,540],{},[456,531,532],{},[459,533,534,537],{},[462,535,536],{},"Receipt state",[462,538,539],{},"Meaning",[472,541,542,552,562],{},[459,543,544,549],{},[477,545,546],{},[374,547,548],{},"verified",[477,550,551],{},"The deployed store stage completed and its digest\u002Fcount checks passed",[459,553,554,559],{},[477,555,556],{},[374,557,558],{},"failed",[477,560,561],{},"The stage failed or a deployed store was unreachable",[459,563,564,569],{},[477,565,566],{},[374,567,568],{},"not_applicable",[477,570,571],{},"The store is not deployed for this profile",[370,573,574,575,577,578,580],{},"A deployed store is not finalized on ",[374,576,568],{},". An undeployed store may be ",[374,579,568],{},"; it is never counted as verified. ClickHouse, Redis, and object-store stages are optional only when their runtime configuration says they are not deployed.",[370,582,583,584,587,588,591],{},"The PostgreSQL stage removes evidence\u002Foutbox rows, policy and credential rows, rate-limit overrides, TOTP secrets, operator ledger rows, memory rows, sessions, directives, tokens, agents, invites, and users, then marks the organization ",[374,585,586],{},"cancelled",". Memory deletion emits a ",[374,589,590],{},"purged"," lifecycle outbox event. Active legal holds are never deleted mid-saga.",[593,594,597,600,601,438],"callout",{"title":595,"type":596},"Billing has an explicit carve-out","warning",[374,598,599],{},"ibex_billing"," tables are intentionally protected from the organization-deletion cascade: rate cards, budget periods, and enforcement decisions can outlive operational tenant data. Do not describe organization deletion as erasing every billing record. See ",[602,603,293],"a",{"href":294},[379,605,607],{"id":606},"legal-holds","Legal holds",[370,609,610],{},"Legal holds are set and cleared through the management API:",[419,612,613,616,623,630,633],{},[422,614,615],{},"Listing requires a tenant-scoped operator token.",[422,617,618,619,622],{},"Setting or clearing requires ",[374,620,621],{},"LegalHoldManage"," and a session subject.",[422,624,625,626,629],{},"An active hold blocks physical purge but ",[414,627,628],{},"does not restore retrieval eligibility"," for an already tombstoned row.",[422,631,632],{},"Deletion checks the hold under the same advisory lock used by hold creation, so a hold cannot land between the check and the purge stage.",[422,634,635,636,639],{},"A blocked job ends as ",[374,637,638],{},"hold_blocked",", not as a successful deletion.",[379,641,643],{"id":642},"retention","Retention",[370,645,646,647,650],{},"The accepted evidence-contract baseline is 30 days after ",[374,648,649],{},"occurred_at",", with legal or incident holds overriding deletion. This is a contract default; runtime retention enforcement and deletion receipts are not proven across every store.",[370,652,653],{},"Retention must not be inferred from a ClickHouse TTL, object-store lifecycle rule, or projection completeness. Those are implementation details, not authority.",[379,655,657],{"id":656},"what-is-proven-locally","What is proven locally",[419,659,660,663,666,669,672],{},[422,661,662],{},"Revision-fenced memory tombstones and read filters.",[422,664,665],{},"Post-response cache invalidation after the tombstone commit.",[422,667,668],{},"A receipted PostgreSQL-first organization deletion saga.",[422,670,671],{},"Legal-hold blocking and job status reporting.",[422,673,674],{},"Optional ClickHouse, Redis, and object-store stages when configured.",[379,676,678],{"id":677},"what-is-not-proven","What is not proven",[419,680,681,684,687,690,693,696],{},[422,682,683],{},"A complete per-store deletion certificate with restore verification.",[422,685,686],{},"Atomic fencing between deletion and every in-flight replay or projection write.",[422,688,689],{},"Full object-store and backup-copy purge.",[422,691,692],{},"Hosted or HA deletion recovery.",[422,694,695],{},"Legal-hold release followed by a verified purge drill.",[422,697,698],{},"A public, accepted memory lifecycle including checkpoints and provenance.",[379,700,702],{"id":701},"operator-checklist","Operator checklist",[419,704,707,717,723,731,742,748],{"className":705},[706],"contains-task-list",[422,708,711,716],{"className":709},[710],"task-list-item",[712,713],"input",{"disabled":714,"type":715},true,"checkbox"," Determine whether the request is suspension, forget, or organization deletion.",[422,718,720,722],{"className":719},[710],[712,721],{"disabled":714,"type":715}," Check for active legal holds before promising a purge.",[422,724,726,728,729,438],{"className":725},[710],[712,727],{"disabled":714,"type":715}," Record the deletion job ID and poll receipts; do not infer completion from the ",[374,730,503],{},[422,732,734,736,737,739,740,438],{"className":733},[710],[712,735],{"disabled":714,"type":715}," Verify each deployed store reports ",[374,738,548],{},", not merely ",[374,741,568],{},[422,743,745,747],{"className":744},[710],[712,746],{"disabled":714,"type":715}," Confirm tombstoned rows stay unreadable while caches and projections rebuild.",[422,749,751,753],{"className":750},[710],[712,752],{"disabled":714,"type":715}," Preserve IDs and outcomes; do not log memory content or secrets.",[379,755,757],{"id":756},"related","Related",[419,759,760,765,770,775,780],{},[422,761,762,764],{},[602,763,154],{"href":155}," — provisional forget contract",[422,766,767,769],{},[602,768,297],{"href":298}," — outbox and replay fencing",[422,771,772,774],{},[602,773,305],{"href":306}," — restore classes",[422,776,777,779],{},[602,778,220],{"href":221}," — deletion and legal-hold routes",[422,781,782,784],{},[602,783,255],{"href":256}," — cross-tenant deletion boundaries",{"title":393,"searchDepth":786,"depth":786,"links":787},2,[788,792,795,796,797,798,799,800],{"id":381,"depth":786,"text":382,"children":789},[790],{"id":405,"depth":791,"text":406},3,{"id":450,"depth":786,"text":451,"children":793},[794],{"id":523,"depth":791,"text":524},{"id":606,"depth":786,"text":607},{"id":642,"depth":786,"text":643},{"id":656,"depth":786,"text":657},{"id":677,"depth":786,"text":678},{"id":701,"depth":786,"text":702},{"id":756,"depth":786,"text":757},"Tombstones, forget, organization deletion, legal holds, and the retention boundaries that remain unproven.","md",false,{},{"title":309,"description":801},"services\u002Fmemory\u002Fapp\u002Flifecycle.py; services\u002Fworker\u002Fapp\u002Ftasks\u002Forg_deletion.py; services\u002Fapi\u002Fapp\u002Frouters\u002Flegal_holds.py; engineering\u002Farchitecture-v2\u002F09-memory-lifecycle-and-deletion.md","D1SEveqCBw_swh9zhFHMTQhQy9ld1T1GgRslsFzIhYU",[809,811],{"title":305,"path":306,"stem":307,"description":810,"children":-1},"Which dependencies may degrade, which must fail closed, and what recovery evidence is still missing.",{"title":313,"path":314,"stem":315,"description":812,"children":-1},"Local Compose, environment configuration, Kubernetes scaffolding, and the production-readiness gap.",1792875079191]