# Eve operator-memory governance — Task 9.4

Date: 2026-09-12

Status: complete for Task 9.4; Phase 9 and G11 remain open

## Result

Operator memory now has a server-owned lifecycle instead of an unversioned bag
of notes. Each current row carries a stable memory id, original source
provenance, revision and predecessor pointer, latest source reauthorization,
fixed category salience, and an explicit expiry. Corrections archive the exact
prior revision with a successor pointer. Canonical dedupe refuses equivalent
content in another slot of the same category; confirming unchanged content
reauthorizes the existing source rather than fabricating a revision.

The policy is intentionally small and inspectable:

| Category              | Salience | Recall expiry | Source reauthorization |
| --------------------- | -------: | ------------: | ---------------------- |
| `standing-initiative` |      100 |       30 days | required to renew      |
| `pinned-contexts`     |       80 |       14 days | required to renew      |
| `preferences`         |       50 |          none | not required           |

Expiry means exclusion from recall, not hidden deletion. An expired row remains
visible to its operator for correction, reauthorization, or erasure. Explicit
reauthorization records a new source reference, renews the category expiry,
clears last-use, and leaves the content revision and its original provenance
unchanged.

## Supersession and privacy

`assistant_operator_memory` remains the only recall source.
`assistant_operator_memory_history` retains exact superseded revisions solely
for correction lineage; it is not queried by prompt recall. The authenticated
privacy snapshot takes the same ordered per-category advisory locks as writers,
then reads current and historical rows together so an in-flight correction
cannot produce a split view.

The drawer now shows source refs, revision and predecessor, reauthorization,
salience, expiry, and active/expired status. Its collapsed
`Superseded revisions` section shows exact retained historical values, source
provenance, successor, and supersession time, and says they are never recalled.
This closes the privacy gap that would otherwise result from retaining hidden
historical content.

Exact forget deletes the current row and every revision in its lineage.
Forget-all and operator-subject erasure delete all current and superseded rows
for that authenticated subject. The service accepts no client-supplied subject;
route and PostgreSQL coverage proves an adjacent operator's current and history
rows are neither disclosed nor deleted.

## Bounded recall and precedence

Recall filters expiry in PostgreSQL before updating last-use, orders eligible
rows by salience then recency, and selects at most 8. Rendering independently
enforces the same 8-entry limit and a 4,096-character ceiling. Current and
superseded storage ceilings remain 12 preferences, 1 standing initiative, and 8
pinned contexts per operator.

The dynamic prompt block labels memory as fallible and states an explicit
precedence contract: security/system policy, live authoritative tool state, and
the operator's live instruction always override memory. Preferences are only
presentation guidance. Pinned references must be re-grounded through authorized
live tools before a current-state claim, and stale, conflicting, or inapplicable
memory is ignored. Expired and superseded values are structurally absent before
the model boundary.

## Verification boundary

The retained Task 9.4 manifest covers source inspection, a static contract with
mutation controls, focused logic tests, real Fastify service routes, real
PostgreSQL persistence/reconstruction/erasure, authorization isolation, restart
recovery, the precedence adversarial pair, and the real Chromium privacy and
reauthorization journey with a scoped serious-impact axe scan.

The PostgreSQL 16.14 receipt records stable identity across correction, revision
2 superseding revision 1, one visible historical row and no historical prompt
input, canonical duplicate refusal, expired-source exclusion, renewal without a
content revision, an 8-row/2,549-character bounded prompt, successful client
reconstruction, exact/all lineage erasure, adjacent current/history
preservation, and zero synthetic rows after cleanup. Eighteen lifecycle tests,
five real-route tests, eight parser/component tests, focused BFF and admin
typechecks, formatting and lint, and the real Chromium 148 journey pass. Eleven
isolated mutation controls each fail before a clean regression. The manifest is
`docs/audits/eve-sota-evidence/phase-09/task-9-4.json`.

This task does not claim the broader memory-poisoning matrix in Task 9.5,
semantic recall in Task 9.6, or canary and rollout outcomes in Task 9.7. Task
9.3 also remains open until an actual human reviewer returns the requested
relevance labels and attestation. Therefore Phase 9 and G11 remain open.