memory_forget
Permanently forget a capsule's content with a mandatory reason. Purged mode erases everything; redacted mode retains provenance for audit—both irreversibly destroy data.
Instructions
Forget a capsule's content IRREVERSIBLY (reason MANDATORY). The capsule's embedding sidecar row is destroyed WITH it (both modes — a vector is derived from the destroyed bytes and the id stops being enumerable on memory_vector's list). mode "purged" = hard forget, nothing retained; "redacted" = the provenance {source, anchor} is deliberately RETAINED on the marker for audit — both destroy the content bytes (secure_delete) and empty the recall index row. What remains is the tombstone marker: id, mode, at, reason, a KEYED HMAC-SHA-256 content fingerprint (key from NMEMORY_HMAC_KEY or a 0600 key file beside the DB, created on first use), the id's relation edges, and — redacted only — the retained provenance. Afterwards: memory_get answers the marker envelope (memory_list omits tombstoned ids); retrieve counts it under excluded {tombstoned} ONLY when a query term IS the capsule id itself (e.g. terms:["cap-3"]); the content index row is EMPTIED, so searching the forgotten content abstains — zero matches, no tombstone echo; re-ingesting the identical content is rejected (forget is sticky); the id drops out of the digest dag (forget is a sanctioned dag repair); forgetting the id AGAIN is a resource-state error (-32002, data {kind: "tombstoned_capsule", id}) — the same family as an unknown id, never a fake invalid-params. Audited with the reason.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The capsule to forget (`cap-<n>`). | |
| mode | Yes | How: `purged` (hard forget) or `redacted` (provenance retained for audit). Both destroy the content bytes. | |
| reason | Yes | The mandatory stated reason (recorded on the marker + audit). |