Memory
An agent that transacts has to remember. A memory nobody can verify is a liability rather than an asset.
Addressed by content
A record's identifier is derived from its own body, and that body folds in where the claim came from. Tampering with a claim, or with its lineage, changes the identifier. You cannot quietly edit history and keep the same name for it.
Two clocks
When something was true in the world is kept separate from when we came to believe it. That separation is what makes a recall "as of" a past date structurally free of hindsight: asking what was known on a date cannot accidentally return something learned afterwards.
Untrusted writes
A deny-first write gate keeps an untrusted source from overwriting sensitive fields. The same posture as the payment side: the default is no, and trust is something a path has, not something a caller asserts.
Forgetting, properly
Memory that only grows is not a design, it is an omission. The governed lifecycle covers decay planning, consolidation that can be verified, and erasure that cascades through what derived from the erased thing, each sealed as a proof through the same trust root the rest of the system uses.
- Decay is planned rather than incidental.
- Consolidation produces a proof, so a summary can be checked against what it summarised.
- Erasure cascades, because deleting a claim and keeping everything derived from it is not deletion.
Reaching it
Remember, recall, assemble, verify and forget are available over the API for the deployments that use them. Assembly is the interesting one: it gathers what is relevant and ranks it, and the result carries what it was built from.