habitatprivacy · right to erasure
Did the erased record actually leave the state?
A record has already entered a long-lived system’s consolidated state — an agent’s learned memory, a summarized profile — and must come out: a right-to-erasure demand, a poisoned batch, a data clawback. The owed claim: prove it left the state, not just the row store.
Value Given a declared removal set, the receipt proves the certified state is as-if the removed records never existed, on the identity register, byte-for-byte.
Boundary at a window where the magnitude arm is hollow, it does NOT measure the magnitude of what was removed; publish the identity-register claim only.
the pain
Deleting the row is easy and beside the point — the value lives in the consolidated state. Removing one record from that is the machine-unlearning problem, and its documented status is stronger than merely “open”: the EDPS states unlearning “alone cannot fully guarantee the right to be forgotten”; certified removal offers only approximate (ε,δ) bounds; and an ICML 2024 result shows the verification is fragile — a dishonest provider can pass every current check while retaining the information. A bound is precisely a place for residual influence to hide.
the exhibit — recompute it yourself
corpus: trace-commons/agent-traces (Hugging Face, CC-BY, 2026-06) · 28 donated coding-agent session traces · three states, one substrate: WITH = 11,761 events, the 7,499 declared records mixed in · ERASED = WITH minus the declared set, the erasure performed by the verifier itself · NEVER = the 4,262 eligible events that never held the set · protected geometry: n_tool_use, the count of tool_use blocks, constant on the eligible pool. Register: detection — byte-decidable. Erased equals never-enrolled to the byte, and one record left behind is caught. No floor, no null and no ranking is needed to see it.
Full removal, decidable: erased and never-had-it either collide to the byte or they do not — not “close,” not a bound. The erasure is performed by the verifier, on the bytes, not taken on faith.
That magnitude is set by the ridge, not measured. See the sweep →
The record set genuinely conditioned the state — ~9×10⁷× past the declared floor — so the erasure was non-hollow. And it is forge-armed: leaving even one of the 7,499 records behind lands on a different digest (~2×10⁶× past the floor) and is refused.
A noise floor, not a materiality threshold. Below 1e‑06 a digest difference is floating‑point, not movement. It answers whether anything happened, never whether it matters — and nothing published here has come near it.
recompute fingerprint — ERASED and NEVER, the digit the kit’s verify step reproduces byte-for-byte on any engine that follows the kit’s published canonicalization · sha256 =
67a6f95ee308a2884f73e071ed72bfb0326ba1b7d6da08a147e6ef10394009aa
kit fingerprint · sha256 =
dac39d3392d88cbaa760cdffb53525a640d8aa73014b8e7a1376afab379e6e80
The verifier recomputes all
three states — WITH, ERASED, NEVER — plus the negative controls (tampered artifact,
one-record-leftover forge), in a clean environment (numpy only).
Why this is decidable at all: the state is an exact, canonical function of its record set, so “erased” and “never had it” either collide exactly or they do not. The decidability is the substrate’s, not a tolerance’s.
what this does not prove
The receipt proves a substrate-level take-out: a record that conditioned the accumulated geometry was removed, and the post-erasure geometry is byte-identical to the never-had geometry — decidable, where the field’s best is an (ε,δ) bound. It does not reach other substrates — weights, retrieval indexes, caches, backups. Crucially, it requires the record to live on a recomputable substrate in the first place: you cannot erase-with-proof from someone else’s opaque memory — the buyer adopts the substrate to get the receipt. It is a snapshot (“out of this certified state”), not “never again.” A human reads the receipt; a data-protection authority resolves what it means.
verify this receipt in your browser
This case's receipt records its verdict and both digests above, and carries its own SHA-256. Recompute it here (WebCrypto, in your tab, nothing sent) and it matches; alter one character of a copy and it fails. It is the smallest version of the whole move: recompute, don't trust. The geometry digest itself you can recompute in this tab, on the method page, or on your bench from the kit.
published fingerprint ·
or download this receipt and check it on your bench:
receipt-takeout-agent-trace.json.
shasum -a 256 prints the same number. Every receipt is on
the ledger.
request the kit
The take-out receipt kit — artifact, manifest, verify.py. A person sends it: the kit and its
verification steps arrive by reply, usually within a business day.