Reinstatement Is the Missing Primitive in Agent Memory

Deletion removes a falsified belief and keeps every premise that produced it. This post argues that the missing reinstate operation is what makes revocation usable at all, and what turns a retraction from bookkeeping into deliverable memory.

Date: 26 August 2026. Reading time: about 28 minutes.

An agent memory system is mostly a very small operation table. Write a note. Read it back. Replace it with a newer value. Delete it, on demand or on a schedule. Some systems can also record that a deletion happened, as an audit event or a tombstone row. That is close to the entire surface area of the field as it ships today.

Almost none of these systems can put a deleted belief back.

That sounds like a gap in an API, the kind of thing you file and forget. It is not. The argument of this post is that the missing operation decides whether an ordinary mistake becomes a permanent one, and the argument runs through terrain that has already been mapped: a failure mode the survey literature has already named, a recontamination loop that recent unlearning research has formalized, and a forty-year-old formal tradition that solved the reversal problem on paper before anyone forgot to ship it.

The core observation comes first, because everything after it depends on it. A belief an agent holds does not merely describe the world. It determines which actions the agent takes, and therefore which evidence the agent will ever collect. A false belief that forecloses an action forecloses the only evidence that could refute it. Deleting that belief does not fix this, and the reasons why take some unpacking.

Part 1 · A Loop Deletion Cannot Break

01 · The Failure Mode Has a Name

The survey literature on agent memory states the problem directly. Memory for Autonomous LLM Agents (Du, arXiv:2603.07670) devotes its section on reflective and self-improving memory to it, and opens with this: "The central risk of reflective memory is self-reinforcing error." The example it gives is worth quoting in full because of how ordinary it is:

"If the agent incorrectly concludes 'API X always returns errors with parameter Y,' it will avoid that call path forever, never collecting evidence to overturn the false belief."

Read that as a control-flow problem rather than a knowledge problem, because that is what it is.

The belief is not sitting inertly in a store waiting to be checked. It is gating an action. As long as it is held, the action is not taken. As long as the action is not taken, no observation is generated. As long as no observation is generated, nothing exists that could contradict the belief. The loop is closed and it is stable. Time does not help. More capable models do not help either, because the model is reasoning correctly from a premise it has no route to re-examine.

Sequential decision theory met this structure decades ago. In a multi-armed bandit problem, an agent repeatedly chooses among actions whose payoffs it does not know, and it learns only about the actions it actually takes. Consider a purely greedy agent, one that always pulls the best-known arm. Give it a false negative belief about one arm's value and the arm leaves its action set forever. Once removed, the posterior over that arm cannot update, because updates require pulls.

Analogy. A restaurant critic who decides a kitchen is bad and never returns can never revise the review. Every visit skipped is a meal uneaten, and the review cites itself as evidence: the kitchen must be bad, look how few return visits it gets. Bandit algorithms named the cure decades ago: forced exploration, some mechanism that occasionally takes the action the current posterior says is worthless, specifically to keep the posterior honest.

Agent memory has no forced exploration. There is no mechanism that periodically resurfaces a discarded belief for re-testing. The belief is either held, in which case it gates, or gone, in which case Part 2 shows something worse happens.

This is worth stating as an asymmetry, because the asymmetry explains why the problem is invisible during normal operation. False positive beliefs are self-correcting: the agent believes something works, tries it, fails, and generates an immediate correction signal. False negative beliefs are self-sealing: the agent believes something does not work, does not try it, and generates nothing.

Insight. Errors that suppress action are structurally harder to detect than errors that produce it. An error that acts generates its own refutation. An error that prevents action generates silence, and silence looks identical to correctness from every dashboard you might build. Agent memory accumulates the second kind quietly, which is why stores fill up with beliefs nobody remembers writing and nobody can disprove.

The survey's proposed mitigations make the gap concrete. For reflective memory it lists confidence scores on stored conclusions, contradiction checking against other memories, and periodic expiration, and then concedes these gates are "necessary but still underdeveloped." Notice what is absent from the list. Nothing there delivers the fact of a correction back to the agent. Confidence scoring tunes what gets believed next time; expiration deletes; neither one hands the agent its own corrected mistake at the moment the mistake is about to repeat. One proposed mitigation, periodic expiry, I would argue against outright: it treats the passage of time as if it were evidence, which is a category error argued at length in a previous post. What no listed mitigation supplies is the subject of Parts 3 and 4.

Part 2 · Deletion Falls Short

02 · Delete the Note, Keep the Trap

The intuitive fix for a wrong memory is removal. If the note is false, delete the note, and the agent returns to a clean state.

It does not return to a clean state, and the reason is the most important idea in this post.

The false belief was derived from something, and that something is usually still there.

An agent concluded that the API always errors with that parameter because it observed a failure that had another cause, or because a stale comment in the codebase said so, or because a README documents behavior that changed two releases ago, or because a previous agent wrote a note that was true at the time. Delete the resulting belief and every one of those inputs remains exactly where it was. The next session encounters the same stale comment, performs the same reasoning, and arrives at the same false conclusion. It will then, quite possibly, write it down again.

Deletion removes the conclusion and leaves the premise. It is not idempotent against a persistent cause. Worse, it is invisible: the second derivation looks like a fresh discovery, carries no trace of having been examined and rejected before, and arrives with full confidence.

Public work has recently formalized this recurrence pattern under the name backflow. Agentic Unlearning: When LLM Agent Meets Machine Unlearning (Wang et al., arXiv:2602.17692) defines the loop: a sensitive fact written to external memory "is later retrieved into the context," where it "influences the agent's behavior, and is then written back into new memories or re-encoded into the model." Removing the fact once is not enough, because residual knowledge in the parameters can regenerate it during later interactions, at which point it is "written back into memory and reverses the unlearning."

What their countermeasures leave out teaches the most. The paper attacks the loop with two subtractive moves. On the memory side, dependency-aware deletion: a dependency graph over raw memories, summaries, reflections, and knowledge-graph nodes, pruned down to the facts being forgotten, with derived artifacts cleaned up by reference counting. On the parameter side, suppression: unlearning-style training that pushes model outputs toward a high-entropy prior instead of confident reproduction. A persistent blocklist enforces "membership checks to prevent re-exposure" at retrieval boundaries. That last phrase is exact. The system filters things out. Nothing is ever added back.

For beliefs that live inside the memory store and the model's weights, subtractive cleanup plus suppression may well suffice. But coding agents operate in a third location the paper's two pathways do not reach. The durable contaminant there is not a memory entry and not a weight. It is a stale artifact sitting in the repository: the outdated comment, the two-releases-behind README, the config example nobody updated. No amount of memory-side deletion removes it, because it was never a memory. This workspace-mediated version of the same loop is the one that matters for coding agents, and it is the one that deleting memory entries cannot touch at all.

Insight. Deleting a falsified belief treats it as noise to be removed. But a belief that was derived once from durable evidence will be derived again from the same evidence. The valuable artifact is not the belief. It is the record that the belief was examined and found wrong, and why. Deletion destroys exactly the part that would prevent recurrence and keeps nothing.

So the operation "delete the wrong note" carries a hidden precondition: it is correct only if the reasoning that produced the note cannot recur. For anything derived from workspace artifacts, that precondition essentially never holds.

Part 3 · Three Families, Same Hole

03 · Contraction Removes by Definition

Formal logic got to "how should a belief be removed?" long before agent memory existed. The belief-revision tradition's answer is the AGM framework of Alchourrón, Gärdenfors, and Makinson, published in 1985. It models an agent's information as a belief set: a set of sentences closed under logical consequence. Removal from it is called contraction, and its defining requirement, the success postulate, says that after contracting a non-tautological sentence, the set no longer implies it. Systems built in this tradition implement revise, contract, and expand operations, with operators checked against the AGM postulates; partial meet contraction has been formalized and machine-checked in proof assistants down to the selection-function construction.

The problem here is definitional rather than a defect of implementation. Contraction is removal from the belief set. That is what the operator means. A system that implements it faithfully ends with the proposition absent, and that is the state Part 2 showed to be insufficient, because absence from the belief set says nothing about the durable evidence that produced the belief. The formalism was developed for belief sets considered on their own, not for agents embedded in a mutable environment that keeps re-supplying the same inputs.

And here is the twist that deserves a closer look. The tradition did not consider reversal an afterthought. It wrote reversibility into the axioms.

Math. A postulate, in this tradition, is a property an operator is required to satisfy. Two of the AGM contraction postulates, stated for a logically closed belief set K, a sentence φ, contraction K ÷ φ, and expansion K + φ:

success:   φ ∉ K ÷ φ        (φ is not a tautology)
recovery:  K ⊆ (K ÷ φ) + φ

Success is the definition of removal: after contraction, K no longer implies φ. Recovery says more, and in plain English: whatever contraction removed, expansion by the same sentence puts back. One machine-checked formulation glosses it exactly that way: "all propositions removed in a set K by contraction of φ will be recovered by expansion of φ." Recovery is famously the contested postulate; it needs extra assumptions to hold, and later work proposed weaker constraints in its place. But the instinct behind it is the point. This tradition judged a removal operator partly by whether contracting left you a route back. Production deletion implementations ship success and drop recovery without comment.

Four decades before anyone shipped an agent memory, the theorists of removal had already concluded that a removal you cannot reverse is badly specified. The engineering tradition inherited the removal and left the reversal behind.

04 · Supersession Requires Knowing the Answer

The most common practical disposal operation is supersession: a newer memory replaces an older one. Cleanly implemented, this is genuinely useful, and it handles the ordinary case of a fact changing over time.

The flagship production implementation shows the pattern concretely. Mem0 (Chhikara et al., arXiv:2504.19413) extracts candidate facts from a conversation, retrieves semantically similar existing memories, and lets an LLM choose among four operations per candidate: ADD, UPDATE, DELETE, or NOOP (which means what it sounds like). UPDATE augments a memory with complementary information. DELETE handles "removal of memories contradicted by new information," and the algorithm reduces to removing the entry from the set. In the graph variant, superseded relations are marked invalid rather than deleted, which preserves them for temporal reasoning, but none of these transitions records an author or a rationale; what persists is the operation label, the resulting value, and ordinary timestamps.

Supersession has a precondition that fails exactly when you need it most: supersession requires you to already know the correct answer. You can only replace a value with a better value. The situation this post is about is different. You have learned that the held belief is wrong, and you do not yet know what is right. "The API does not in fact always error with that parameter" is not a replacement value. It is a retraction, and a value-replacement operation has nowhere to put it.

The missing metadata compounds the problem. Supersession implementations typically carry no reason and no actor. The old value is simply gone or archived, with no record of why it stopped being current. That distinction matters in Part 4, where the reason turns out to be the payload.

05 · Audit Trails Wait to Be Asked

More sophisticated current work goes further. TOKI (Wang, arXiv:2606.06240) treats agent memory as a bitemporal store where every fact is a triple stamped with a valid-time period, a system-time period, provenance, and confidence. Contradictions between facts sharing a subject and predicate get resolved by typed operators, each carrying an isolation precondition drawn from database theory (read committed, snapshot isolation, serializable, listed here weakest to strongest): last-writer-wins needs only read committed, evidence-weighted resolution wants snapshot isolation, and policy tables are pinned at serializable. Provenance itself is modeled algebraically, as polynomials over write-event tokens, so a resolved-away fact stays recoverable through its annotation.

On the operation table, this family has the primitives. Nothing gets destroyed: resolution "commits the winner to the current row, and writes the loser to an audit row recoverable at every later system time."

The gap is delivery. The same paper specifies it plainly: "default retrieval filters row_kind=current, and audit rows reach through a separate audit-log slice." Losing facts, retractions, and their annotations exist, persist, and are queryable. They do not travel. A normal retrieval, the kind a coding agent runs forty times an hour, never surfaces them.

That is a complete answer for compliance and debugging, and no answer at all for self-reinforcing error, because of a simple observation: the agent does not know to ask. An audit trail helps an investigator who already suspects something. The agent in the failure mode has no suspicion. It holds a belief it considers settled, or holds nothing at all after a deletion, and in neither state does it have a reason to query a contradiction history. Evidence that is available on request is not available to a process that does not know it is missing anything.

06 · Three Families Against One Failure Mode

Set the three families side by side and ask one question of each: after the operation runs, what stops the agent from walking back into the same derivation? Every family has an answer, and every answer comes up empty:

All three families treat the retraction as bookkeeping: something that happens to the record, rather than something the record says. The alternative is to treat it as content.

Part 4 · Retraction as Content

07 · Revocation as Deliverable Memory

The design that closes the loop changes what happens when a belief is found wrong. The belief is neither deleted nor silently replaced. It transitions to a revoked state carrying three things: the reason it was found wrong, the actor who found it, and the timestamp. It remains in the store. It also remains eligible to surface, but rendered differently: not as a claim, as a deterrent.

[142] [REVOKED] [api, retries]
  Previously believed: endpoint tolerates 3 retries per window.
  Revoked 2026-06-02 by swapnanil: the failure was a proxy timeout,
  not the retry limit. Do not re-derive without verification.

Then reinstatement is simply another transition, available at any time, at no special cost. Four properties follow from this design, and together they are the argument for it.

It attacks the premise, not just the conclusion

A revoked note that surfaces on the same cue that would trigger re-derivation reaches the agent at the exact moment it is about to repeat the mistake. The stale comment is still in the codebase. The agent is about to read it and conclude the same thing. Arriving alongside is a record saying that conclusion was drawn before, examined, and rejected, with the reason attached.

This is what deletion cannot do. Deletion removes the conclusion and leaves the trap. Revocation leaves the trap and adds a sign next to it.

Analogy. City inspectors have both options, and the difference between them is the whole design in miniature. Map the parts before the analogy runs: the building is the durable premise, the stale artifact that keeps causing trouble; the notice on the door is the revoked note; reinspection is reinstatement. Demolish a building with a gas leak and the lot looks clean until someone builds on the same fault line and the leak comes back with nobody any wiser. Condemn it instead: the structure stays standing, a notice names the defect and the inspector who found it, and every future occupant walks past the warning before walking inside. Nobody would draft a condemnation ordinance that omitted the clearing step.

It makes the reason the payload

"This was found to be wrong" is weak. "This was found to be wrong because the failure was caused by a proxy timeout, not the parameter" is strong, for three distinct reasons. It is actionable in the next session: the agent knows the observation underneath (the request failed) was real and only the attribution was wrong. It separates the true part from the false part, so the agent does not over-correct and discard a genuine signal along with the mistaken conclusion. And it can itself be checked: a stated cause suggests its own test, run the request without the proxy in the path.

The reason is the part of a retraction with lasting value, and it is the part every deletion-based approach discards first.

Reversibility lowers the threshold for correct action

This property is easy to overlook and may be the strongest practical argument.

A destructive operation demands confidence. If revoking a belief means destroying it, then revoking is only safe when you are sure, and the cost of becoming sure is high enough that in practice people and agents skip it. Wrong beliefs sit in the store because nobody was confident enough to pay the cost of removing them irreversibly.

If revocation is free to reverse, the threshold collapses. You can revoke on suspicion, because being wrong about the revocation costs one reinstatement event. The presence of the reinstate edge is what makes the revoke edge usable. A state machine missing its reverse transition does not merely lack a feature. It discourages use of the forward transition, and the observable symptom is a memory store full of beliefs nobody was willing to touch.

This also answers the obvious objection to aggressive revocation: you will sometimes revoke true things. Yes, sometimes. The cost of that mistake is bounded and recoverable, and that bound is what makes the policy safe to adopt. An irreversible policy has to be right; a reversible one only has to be right often enough.

It composes with the other staleness signals

Revocation is the strongest signal in a family, and it should sit alongside the others rather than replacing them:

Every one of the first four is a deterministic state signal produced by something that actually happened.

Warning. Notably absent from that list is elapsed time, and keeping it absent is load-bearing. A note from a year ago about why a migration was written a certain way can be the most relevant thing in the store today, and a note from an hour ago can already be false. Age may reasonably inform ranking, as one weak tie-breaker among retrieved candidates. It must never decide validity, because it measures the passage of time and nothing else. Promote age into a validity signal and you have rebuilt TTL deletion with extra steps.

One more property of this design deserves its own mention, and it is about delivery rather than storage. A deterrent that lives in the store but never reaches the agent is TOKI's audit slice wearing a different name. The surfacing has to happen on the injection path, at the moment the agent approaches the anchored artifacts. My own work on this problem concluded that delivery, not storage, is the product: harness-evaluated trigger conditions over path, symbol, semantic, event, and temporal cues, with deterministic evaluation (Saha, arXiv:2607.20972). In seeded runs, cue-triggered injection fired on every relevant event with zero false alarms, while a voluntary store the agent had to think to consult saw zero uses across a 114-turn session. The revoked note inherits that machinery directly. A retraction is worth storing only if it is worth delivering.

Part 5 · Building It

08 · One Log, One Fold, One Narrow Trigger

The mechanism is smaller than the argument. It is an append-only event log per note, with current state computed as a fold over the log:

note event vocabulary (the kinds this post turns; the store carries a few more)

created
  then optionally:
superseded(new_note_id)
revoked(reason, actor, timestamp)
stale_flagged(anchor, observed_hash)
reinstated(actor, timestamp)

Nothing here is clever. The interesting question is why the shape resists the failures in Part 3, and three consequences answer it.

First: no transition ever mutates or deletes anything. Every state change is an append. That is the whole reason reinstatement comes free: it is one more event, not an undo path that has to reconstruct destroyed data. Systems that mutate rows in place have to build undo as a separate feature, which is why so few of them have it.

Second, history comes free and exact. State being a fold means the full trajectory of a belief is available without any parallel bookkeeping: when it was written, when it was doubted, on what grounds, by whom, whether it came back. Auditability stops being a subsystem and becomes a byproduct.

Third: rendering is a function of state. An active note renders as its content. A revoked note renders as a deterrent carrying its reason. A stale-flagged note renders as its content with the drift caveat attached. One store, one log, and the presentation follows from the fold. Push the same note through a few lifecycles below and watch how different the agent's input looks depending only on the last event.

Interactive demo: "One Note, Four Renderings." Append lifecycle events to a single stored note and watch what the agent receives. The note's content never changes. What changes is whether the fold presents it as a claim to trust, a caveat to weigh, or a warning to stop and verify. Edit the revocation reason to see why the reason is the payload. Controls append superseded, stale_flagged, revoked, or reinstated events, or reset to created; current state is the last appended event, nothing is edited in place, and reinstating costs exactly one event, which is the entire argument of Part 4 made mechanical.

The part that requires actual care is the trigger condition. A revoked note that surfaces on every unrelated query is noise, and noise gets ignored, which destroys the mechanism. The condition that matters is narrow: surface the deterrent when the agent is approaching the same derivation. In practice that means anchoring the deterrent to the artifacts and symbols involved in the original mistake, so it fires when those are touched, rather than firing on general topical similarity.

Note what this deliberately does not do. It does not classify queries, and it does not gate anything. The deterrent is injected as ordinary text alongside whatever else the agent retrieved, and the model weighs it the way it weighs any other input: the arbitration is the model's job, not the memory system's. A retraction that blocked an action would reintroduce the original problem in a new location, because a wrong revocation would then foreclose evidence the same way the wrong belief did.

Part 6 · The Honest Accounting

09 · Limits, and the Experiment Worth Running

This argument extends an earlier one. A previous post argued that memory expiry should be a state rather than a delete, and that age is not evidence. This post makes the narrower and sharper claim: the state machine is incomplete in one specific place, and the missing edge is the one that matters most.

Several honest limits apply.

There is no controlled measurement here. That is the significant gap and it should not be papered over. The argument is structural: it identifies a failure mode the literature has named, shows why three families of existing operations cannot address it, and proposes a mechanism that can. That is an argument, not a result.

The field does not need another architecture description. Recent memory-governance work has produced a substantial number of systems, several with genuinely sophisticated designs: bitemporal operator algebras, dependency-aware unlearning pipelines, production supersession engines. An additional system description without measurement adds to a crowded room, and the survey cited in Part 1 effectively says as much when it calls its own proposed quality gates "necessary but still underdeveloped." The valuable next contribution here is a measured one.

The experiment is specifiable, which is the useful part. Construct tasks where a plausible false-negative belief forecloses the action that would refute it. Then compare four disposal policies, holding everything else fixed:

Measure three things across sessions: how often the agent re-derives the false belief, how often it takes the foreclosed action anyway, and how long the error survives. Then test reinstatement separately: revoke a true belief under policy D and measure the cost of recovery. A policy whose safety rests on reversibility should show that reversibility working.

Interactive demo: "Run the Four-Arm Experiment." The experiment above scaled down to one agent, one false belief, and one durable stale premise, run session by session. Pick a disposal policy, keep the stale premise in place or remove it, and watch which arms escape the loop and which ones never do. The point to observe: with the premise present, policies A and B re-derive forever, C escapes only by luck, and D corrects immediately. Model, per fresh-agent session: a held false belief forecloses the call; otherwise the agent reads the workspace, and a stale present premise re-derives the false belief 65% of the time unless something intercepts. Under arms A and B the premise keeps regenerating the belief until some session gets lucky and acts first. Arm C queries the audit history 15% of the time (an agent with no suspicion rarely asks). Arm D surfaces the deterrent on the derivation cue every time.

Benchmark substrate for that experiment exists. LongMemEval (Wu et al., ICLR 2025) tests five abilities including knowledge updates, the case where information stated early becomes outdated later, across 500 questions embedded in long chat histories, and reports that commercial chat assistants and long-context LLMs show a 30% accuracy drop on remembering information across sustained interactions. MemoryAgentBench (Hu, Wang, and McAuley) converts long-context datasets into incremental multi-turn interactions and tests four competencies including selective forgetting; its authors state that current methods fall short of mastering all four. Frontier performance on tasks shaped like these leaves substantial headroom, which is a reason to expect a four-arm comparison to be informative rather than saturated.

And none of this is a security mechanism. A deterrent record raises the cost of a recurring error. It is not a control against an adversary who can write to the memory store.

Warning. Everything here assumes the actors writing revocations are honest. A malicious writer can revoke true beliefs, forge reasons, or poison deterrents with plausible-sounding falsehoods. The mechanism governs accidental error, not adversarial input. Treating it as the latter is a category mistake with security consequences.

Close · The Line to Keep

Every agent memory system can delete a belief. Almost none can un-revoke one, and the missing edge is not a convenience. It is what allows revocation to be used at all, and what converts a retraction from a tombstone, in the distributed-systems sense of a marker that records a deletion and waits, into something that prevents the next occurrence of the same mistake.

A retraction is deliverable memory. It carries a reason, it names an actor, it is reversible at no cost, and it is worth surfacing at the moment the agent is about to repeat itself. Discarding it keeps the trap and removes the sign.

Sources

• Du, P. Memory for Autonomous LLM Agents: Mechanisms, Evaluation, and Emerging Frontiers. arXiv:2603.07670, March 2026. Section on reflective and self-improving memory names self-reinforcing error; quoted in Part 1.
• Wang, B., Wang, F., Wang, P., Cong, J., Yu, Y., Yin, Y., Han, Z., Wei, B. Agentic Unlearning: When LLM Agent Meets Machine Unlearning. arXiv:2602.17692, February 2026. Defines the backflow loop; mitigation is dependency-aware deletion plus parametric suppression. Part 2.
• Alchourrón, C. E., Gärdenfors, P., Makinson, D. "On the Logic of Theory Change: Partial Meet Contraction and Revision Functions." Journal of Symbolic Logic 50(2), 1985. Source of contraction and the recovery postulate. Postulate statements cross-checked against the machine-checked Isabelle/HOL formalization in the Archive of Formal Proofs (Belief_Revision, AGM_Contraction). Part 3.
• Wang, Z. TOKI: A Bitemporal Operator Algebra for Contradiction Resolution in LLM-Agent Persistent Memory. arXiv:2606.06240, June 2026. Audit rows, isolation preconditions, default-retrieval filtering. Part 3 and Part 4.
• Chhikara, P., Khant, D., Aryan, S., Singh, T., Yadav, D. Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memory. arXiv:2504.19413, April 2025. ADD/UPDATE/DELETE/NOOP update phase. Part 3.
• Wu, D., Wang, H., Yu, W., Zhang, Y., Chang, K.-W., Yu, D. LongMemEval: Benchmarking Chat Assistants on Long-Term Interactive Memory. ICLR 2025, arXiv:2410.10813. Five abilities including knowledge updates; 500 questions; 30% accuracy drop figure. Part 6.
• Hu, Y., Wang, Y., McAuley, J. Evaluating Memory in LLM Agents via Incremental Multi-Turn Interactions (MemoryAgentBench). arXiv:2507.05257. Four competencies including selective forgetting. Part 6.
• Saha, S. Delivery, Not Storage: Cue-Anchored Working Memory as a Harness Property for Coding Agents. arXiv:2607.20972, July 2026. Trigger-condition vocabulary and the delivery findings cited in Part 4.
• vectr source: agent/working_context_store/_events.py (NOTE_EVENT_KINDS) and _store.py (note lifecycle fold). The revoke and reinstate event vocabulary over notes, documented publicly in Agent Memory Expiry Is a State, Not a Delete.

Related reading

• Agent Memory Expiry Is a State, Not a Delete. The direct predecessor: expiry became a visibility state on the same note state machine whose missing reverse edge this post maps.
• Agent Memory Needs a Trust Ladder. Where the actor axis on every revocation comes from: provenance and trust ranks for notes in the same store.
• The Agent Never Chooses to Remember. Why surfacing beats storing: the delivery findings this post's cue-anchored deterrent design leans on.