Skip to main content

80  Data Engines, Continual Learning, and Unlearning

80.1 Chapter status

Field	Value
Chapter ID	data-engines-continual-learning-and-unlearning
Part	Part IV - Evidence, Implementation, and the Living Book
Status	conceptual
Manuscript maturity	v0.3 manuscript draft
Last updated	2026-08-08
Primary source records	11 assigned, 11 passage-reviewed mappings, including SISA, model-collapse and accumulation work, Theseus, W3C PROV-O, Croissant, MUSE, OpenUnlearning, the benchmark critique, QCSA, and V-JEPA 2
Claim label	Design rationale
Evidence level	argument
Source loading state	source notes: learning_compute_topology, ext_bourtoule_machine_unlearning_2021, deterministic_capability_compilation, platonic_world_model, ext_shumailov_model_collapse_2023, ext_gerstgrasser_data_accumulation_2024, theseus_synthetic_data_curation, ext_w3c_prov_o_2013, ext_mlcommons_croissant_1_1_2026, ext_muse_unlearning_2025, ext_unlearning_benchmarks_weak_2024, ext_openunlearning_2025, qcsa_whitepaper, ext_v_jepa_2_2025, ext_influence_functions_2017, ext_curriculum_learning_2009, regret_engine
Test state	The receipt probe validates four intake routes. P3 and M7 preserve their bounded update/unlearning results and failures. The first P5 slice restores nine prospectively frozen classes and removes one cohort from five declared local storage surfaces. The second mutates actual model/Adam learning state, rejects weights-only recovery, and restores nine classes after a crash. Neither tests deletion, forgetting, influence, privacy, rights, or external erasure; the core remains argument.

80.2 Drafting guardrail

A data engine is a governed lifecycle for learning inputs, not a synonym for a larger training corpus. The useful unit is a receipt-bound candidate: where it came from, what authority permits its use, whether it is real or synthetic, which splits exclude it, which contamination checks ran, how long it may be retained, what deletion must reach, which evaluations are relevant, and what remains unresolved.

The literature anchors make the boundary concrete. ext_bourtoule_machine_unlearning_2021 shows why deletion paths depend on training-time structure and carry accuracy, storage, and retraining trade-offs. ext_shumailov_model_collapse_2023 and ext_gerstgrasser_data_accumulation_2024 make replacement, accumulation, and provenance competing policies rather than slogans about synthetic data. theseus_synthetic_data_curation supplies source-reported governance patterns, not a reproduced result. None of those sources establishes a local data engine, data quality, privacy compliance, safe synthetic data, or verified forgetting.

80.3 Human Reading Path

Concrete lens. The simpler baseline restores weights and reports a deleted cohort’s behavioral change as unlearning. The chapter requires full-state recovery and keeps behavioral, causal, privacy, lineage, storage, backup, and descendant axes separate.

Learning systems depend on decisions about what gets to count as experience. Those decisions can disappear inside an import script, replay buffer, or synthetic-example generator, even though they determine which history will influence later behavior and which claims later appear plausible.

The question is not whether a source is real, synthetic, old, or new. It is whether anyone can explain why it entered the learning path, what it was allowed to influence, and what evidence would require it to leave or quarantine it.

Deletion makes the gap visible. Removing a row from a table does not show that its effects are gone from checkpoints, caches, retrieval stores, distilled artifacts, or published results. An honest system names the paths it checked, the descendants it can identify, and the paths it still cannot verify.

Synthetic data creates the converse tension: retaining real material can protect coverage, while retention can conflict with privacy, freshness, poisoning response, or revocation. A careful admissions record keeps those trade-offs visible and grants only bounded learning authority rather than making a safe default out of an unresolved conflict.

80.4 Problem

A self-improving system has to learn from something: observations, human feedback, task traces, benchmark failures, tool results, retrieved documents, generated examples, replayed trajectories, or curated datasets. Each input can carry rights, provenance, contamination, quality, privacy, safety, freshness, and distributional consequences. When those consequences remain implicit, the learning loop can change because of data that nobody can later justify, reproduce, revoke, or distinguish from its descendants.

The operational difficulty compounds over time. A generated example can be mixed with real material, transformed into a summary, used to train a model, captured in a checkpoint, copied into a retrieval store, distilled into another model, and cited as evidence of a later improvement. A deletion request can arrive after each of those steps. A benchmark item can leak through either a raw source or a semantically similar synthetic one. A data policy that looks helpful for distributional coverage can be harmful for minimization, poisoning response, cost, or revocation. The architecture requires a lifecycle that exposes those conflicts before they become invisible training history.

80.5 Why existing approaches are insufficient

Many pipelines divide responsibility by tool: ingestion validates a file, training consumes a dataset, evaluation holds out examples, storage applies a retention rule, and a later privacy process receives deletion requests. That division makes local operations easier but fails to express a single answer to the most important questions: what did the input affect, why was it admitted, which exclusions were checked, and which descendants remain after a change in authority or policy?

Machine-unlearning methods can improve the cost of retraining selected paths, but a request route is not a proof that every downstream representation has been erased. Synthetic-data research likewise does not support a universal rule. Recursive replacement can lose distributional support under its stated conditions, while accumulation can produce different behavior in other stated conditions. Neither observation resolves provenance spoofing, semantic leakage, privacy, poisoning, legal authority, or task-specific utility. A governed stack needs those concerns in one record and must preserve the residuals when available evidence cannot settle them.

80.5.1 Strongest-neighbor comparison

The distinctive claim is not that the stack invents provenance, synthetic data, continual learning, or unlearning. Its proposed delta is to join their decision surfaces without collapsing their evidence. SISA supplies a training-time structure that can bound retraining work. Model-collapse and accumulation studies show that synthetic-data policy changes the distribution and retention tradeoff. MUSE and OpenUnlearning separate multiple behavioral and privacy-facing evaluations, while the benchmark critique warns that those scores can still be weak proxies. QCSA contributes identity-preserving migration and rollback records. The data engine turns these into separately owned lifecycle claims linked by a full-state transaction.

Comparator	Strong capability	Residual boundary	ASI Stack design delta
SISA machine unlearning	Training-time sharding, isolation, slicing, and aggregation can reduce bounded retraining cost.	Efficiency and approximate removal on a chosen structure do not prove closure across every descendant, privacy property, or external store.	Bind a deletion method to a prospective state inventory, checkpoint authority, descendant graph, and claim partition.
Recursive replacement and data accumulation	Demonstrate that replacement and accumulation can have materially different distributional behavior under stated assumptions.	Neither policy is universally safe, private, fresh, revocable, or optimal.	Treat replacement, accumulation, replay, and retraining as registered arms with utility, retention, contamination, deletion, compute, and residual outcomes reported together.
MUSE, benchmark critique, and OpenUnlearning	Separate memorization, privacy leakage, retained utility, scale, sequential requests, method execution, and metric faithfulness.	Behavioral scores remain target- and evaluator-dependent and can be optimistic under benign perturbation.	Refuse a generic “forgotten” state; record behavioral cohort change, influence evidence, privacy evidence, lineage propagation, and storage erasure independently.
QCSA lifecycle-safe migration	Preserves identity through readdressing, merge/split lineage, compatibility checks, and rollback.	Identity-safe migration is not learning, causal removal, or erasure.	Include semantic addresses and migration descendants in the inventory while keeping them outside unlearning claims unless separately verified.
ASI Stack P3 local campaign	Real small-network optimizer/scheduler mutation, prospective checkpoint selection, 24-surface inventory, exact rollback, and three-seed deletion-aware comparison.	Synthetic local scope, internal evaluation, no target-gain threshold hit, proxy-only influence signal, and retained source storage.	Preserve the negative update disposition and use the campaign as an executable bridge for full-state and claim-separation semantics, not as a promotion result.

This comparison makes two ownership boundaries explicit. Full-state rollback is an identity claim over declared surfaces; it is not evidence that the update was useful. Unlearning is a family of causal, behavioral, privacy, lineage, and storage claims; it is not a synonym for exclusion from a retraining corpus. The architecture adds value only if it can keep those statements distinct when one is favorable and another remains false or unmeasured.

80.6 Core Claim

Reader claim. Restoring every declared training-state surface does not show that an update helped, and changing a deleted cohort’s behavior does not show that its influence, privacy exposure, backups, or descendants are gone.

Operational rule. Bind data admission, checkpoint authority, model, optimizer, scheduler, RNG, cache, backup, lineage, descendants, and deletion scope before learning. Report behavioral change, causal influence, privacy, lineage, legal status, storage, backups, and external descendants as separate axes that cannot promote one another.

[data-engines-continual-learning-and-unlearning.core, label: Design rationale, support: argument] Data Engines, Continual Learning, and Unlearning owns a datum-, cohort-, provenance-, rights-, split-, contamination-, learning-lane-, retention-, checkpoint-authority-, full-state-inventory-, descendant-, deletion-request-, claim-axis-, consumer-, environment-, and time-specific Data-and-Descendant Custody Lease: before learning or deletion, it binds admissible use, evaluation exclusions, synthetic and transformation lineage, coverage and distribution residuals, model/optimizer/scheduler/RNG/cache/backup/descendant state, prospective checkpoint authority, retention and replay, deletion propagation, verification, rollback, expiry, and terminal custody; behavioral cohort change, causal influence reduction, privacy leakage reduction, lineage invalidation, legal compliance, and storage or backup erasure remain separate claims, and no receipt, checksum, exclusion, invalidation, benchmark score, rollback match, or synthetic campaign alone establishes model quality, forgetting, privacy, erasure, safety, readiness, deployment, support, transfer, or SOTA.

The claim remains at argument support. The in-prose external anchors ext_bourtoule_machine_unlearning_2021, ext_shumailov_model_collapse_2023, and ext_gerstgrasser_data_accumulation_2024 provide source-noted method and risk context. theseus_synthetic_data_curation is a pinned implementation reference. No assigned source has been reproduced in this repository, and no receipt, proof, or source note turns an intake decision into evidence of model quality, privacy, safety, deletion completeness, or capability improvement.

80.7 Mechanism

80.7.1 Worked result: fifteen exact rollbacks and zero storage erasures

The P3 full-state bridge froze 24 surfaces before training, ran five arms across three seeds, and recorded 15 transactions. All 15 restored the declared state inventory exactly, including model, optimizer, scheduler, RNG, cache, checkpoint, backup, and descendant surfaces. The campaign also exposed six best-versus-final checkpoint disagreements, confirming why checkpoint authority had to be prospective rather than selected after outcomes.

The favorable rollback result did not rescue the learning claim. No arm met the target gain. Deletion-aware behavior changed on four, zero, and one cases across the three seeds; lineage propagation was recorded three times; influence reduction remained a true-confidence proxy rather than an established result; and storage erasure was zero. The terminal disposition was no_change_update_narrow_rollback_and_unlearning. This is the distinction the chapter needs readers to retain: inventory-exact recovery earned a narrow positive result while update utility and the several meanings of unlearning remained negative, unmeasured, or unresolved.

The data engine begins with a data-admission receipt before a candidate may enter a declared learning or evaluation lane. The receipt identifies the candidate and its origin, names an authority or license reference, classifies provenance, records real and synthetic lineage, identifies the relevant holdout and benchmark exclusions, records contamination checks, declares retention and deletion scope, links evaluation references, names residuals, and records an admission decision plus non-claims. The receipt is not a claim that its fields are true. It is the minimum shape needed to make a later review possible.

The first routing rule is deliberately conservative. Missing provenance or authority blocks ordinary admission. Missing split exclusions or contamination controls routes the candidate to quarantine. Missing retention, deletion, evaluation, or residual records leaves it experimental rather than making it ordinary training input. The finite version of those rules is mechanized in AsiStackProofs.DataEngines; its scope is branch behavior over declared fields, not inspection of a corpus or validation of a data source.

80.7.2 Eighteen-stage custody lifecycle

The lease makes the mechanism eighteen reviewable stages rather than one admission decision. It (1) freezes consumer, purpose, cohort, learning lane, claim axes, rights, state inventory, and deletion scope; (2) binds source, collector, authority, acquisition, digests, schema, location, transformations, generator, reviewer, and decision authority; (3) records use, jurisdiction, affected-party, privacy, retention, disclosure, transfer, revocation, deletion, and appeal constraints; (4) distinguishes source, human, synthetic, augmented, translated, summarized, distilled, retrieved, replayed, inferred, and mixed material; and (5) measures composition, duplication, coverage, tails, subgroups, freshness, poisoning, privacy, rights, and shift.

It then (6) freezes train, validation, public-calibration, hidden-holdout, contamination, temporal, adversarial, deletion, and transfer partitions; (7) routes missing or uncertain controls to block, quarantine, review, or experimental-only use; (8) versions every custody transition; (9) compares replacement, accumulation, replay, reweighting, synthetic augmentation, quarantine, retraining, sharding, fine-tuning, and no-change; (10) inventories model through descendant state; (11) fixes checkpoint and rollback authority prospectively; and (12) runs frozen, seeded campaigns with natural tasks, strong baselines, hidden holdouts, regressions, tails, and full costs.

For deletion, it (13) binds request authority, target, basis, deadline, method, inventory, descendants, claim axes, verification, exceptions, and residuals; (14) adjudicates behavioral, influence, privacy, lineage, legal, storage, backup, and external-descendant claims separately; (15) propagates through datasets, checkpoints, adapters, caches, retrieval, indexes, evaluations, distillates, publications, releases, and transfers; and (16) verifies postconditions and effect-complete rollback or retraining. Finally, it (17) monitors natural utility, calibration, tails, forgetting, interference, privacy, poisoning, drift, incidents, sequential deletion, regrowth, residual age, and descendants, then (18) expires, narrows, refutes, revokes, restores, archives, or retires the lease after any material change.

flowchart LR
  A["Candidate data or feedback"] --> B["Receipt: origin, authority, lineage"]
  B --> C{"Provenance and authority recorded?"}
  C -- "no" --> X["Block and retain reason"]
  C -- "yes" --> D{"Split exclusions and contamination checks recorded?"}
  D -- "no" --> Q["Quarantine for review"]
  D -- "yes" --> E["Retention, deletion scope, evaluation refs, residuals"]
  E --> F{"Lifecycle record complete?"}
  F -- "no" --> R["Experimental-only lane"]
  F -- "yes" --> G["Eligible for a declared bounded use"]
  G --> H["Independent training or evaluation evidence"]
  H --> I["Separate governance and claim-promotion decision"]

What the data-admission route shows: provenance and authority precede ordinary handling; exclusion and contamination gaps do not disappear into a generic queue; and even a complete record establishes only bounded eligibility for a declared use. It does not show that a model should train, that the data are high quality, or that any resulting capability deserves promotion.

Synthetic-data candidates add two required choices. First, the receipt records the generation lineage and the policy under consideration: replacement, accumulation, targeted replay, quarantine, or retraining. Second, it records the metric that could expose a failure in the declared workload, such as heldout task retention, tail coverage, calibration, contamination, or a regression suite. The policy has competing costs. Accumulation may retain useful real-data support while preserving poisonous, private, stale, or revoked material. Replacement may limit retention while destroying coverage. A receipt makes the tradeoff inspectable instead of silently selecting one side.

80.7.3 Regret-aware replay without failure fixation

The Regret Engine source (regret_engine) gives replay a typed intake rather than a global priority score. Packets enter separate catastrophic or hard-boundary, recurrent-avoidable, unresolved-novelty, competence-and-surplus, and retired-or-superseded strata. Only packets with adequate causal and decision-time evidence enter direct learning; severe but unresolved events are retained for adjudication and information acquisition. Successful trajectories, rare skills, and recovery successes reserve capacity so repair does not become catastrophic fixation.

Within a learning-eligible stratum, priority may depend on bounded severity, confidence, recurrence, transfer, and uncovered mitigation. Sampling still needs quotas, diversity, importance correction where appropriate, and the Data-and-Descendant Custody Lease: exact packet, evidence, affected cohort, retention, deletion, replay policy, training state, and descendants remain traceable. Retirement stops active influence through an append-only status change rather than erasing the record. This is a proposed scheduler, not a demonstrated forgetting, unlearning, privacy, or continual-learning result.

Assurance-Shift Learning (assurance_shift_learning) adds three constraints to this scheduler. First, natural-distribution evidence and adversarial or diagnostic probe evidence remain separate so a synthetic probe campaign cannot masquerade as prevalence. Second, every active exception retains protected positive cases and a counterexample to the proposed repair. Third, negative priority has a learner-relative half-life: it can decay only when the named version, repair, regression coverage, and operating region justify reduced attention, not merely because time passed.

The resulting memory is not a warehouse of failures. It distinguishes unresolved bundles, active repair material, admitted regressions, competence-preserving positives, and retired or superseded records. A change in model, evaluator, region, or repair can reactivate an old bundle. Retiring its training influence is still not parameter deletion, privacy erasure, or proof that the underlying behavior is gone.

Deletion and revocation are lifecycle events, not a completed state inferred from a request. The engine records the affected source and version, the method chosen, the declared downstream scope, the evaluation planned, and every unverified descendant class. That makes it possible to say “request received, checkpoint path rerun, retrieval cache unverified” without pretending that a single verb, unlearn, settled the matter.

80.7.4 Atlas epochs and identity-safe migration

80.7.5 Adaptive lineage, reversible integration, and knowledge placement

Continual learning changes more than weights. Learned memory, optimizer state, curriculum, evaluator, archive, router, and topology-controller state can each be a persistent adaptive identity. The custody graph must name which identity changed, which evidence and judgement reached it, which credit signal caused the change, and which descendants inherited the result.

Learning–Compute Topology adds a reversible integration ladder. When confidence is low or future option value is high, keep a capability in an archive, ensemble, or separately governed module. Distillation or parameter merge is a more committed step because it can erase lineage and make influence difficult to remove. Commitment should anneal only after compatibility, retention, rights, privacy, deletion, and rollback checks. “Keep every branch” is not a solution: storage, attack surface, consent, retention limits, and unlearning cost remain part of the decision.

Knowledge placement is therefore an explicit action. A discovery may belong in central weights, a specialist, retrieval memory, procedure, tool, evaluator, test, or archive depending on reuse, precision, latency, conflict, provenance, and erasure obligations. Before retirement, salvage can preserve a validated counterexample or procedure without copying an entire unsafe lineage. Behavioral cohort removal, causal influence reduction, privacy protection, and physical storage erasure remain different claims across every placement.

QCSA separates three update timescales. Task-local resolution, questioning, and routing are fast and ephemeral; resolver and codebook learning is medium-term candidate state; atlas authority changes only through a slow governed epoch release. Stable SOIDs remain independent throughout. This prevents an embedding or cluster update from silently redefining every object that used the old address.

Each atlas release needs a migration record from old paths to new paths, consumer compatibility tests, collision and boundary reports, shadow evaluation, staged authority, rollback, and explicit known breaks. Its central invariant is referential: an old address must resolve under migration to the same SOID or a typed failure. Silent resolution to a different identity is forbidden. Merge and split operations preserve aliases, tombstones, source evidence, disputed states, descendant mappings, and historical receipts.

These records strengthen the full-state principle, but they do not collapse distinct deletion claims. In the bounded evaluation, full QCSA preserved all same/fail/merge/split/stale migration fixtures; removing migration compatibility reduced task-decision accuracy to 0.833333 and compatibility to zero. The vertical trace then migrated one old address to a new address with the same SOID, inventoried context/cache/backup/receipt descendants, and restored a real temporary file byte-for-byte. Silent retargeting and incomplete lifecycle records failed closed.

That is exact local migration and rollback evidence, not learning or unlearning. The post-v2.3 review accepts synthetic-test-backed support only for the exact non-core migration-compatibility ablation; readdressing an object is still not behavioral forgetting, causal influence removal, privacy erasure, storage erasure, or proof that every distributed descendant was deleted. The fixture has no optimizer, scheduler, RNG, model state, storage service, or privacy adversary. The core claim remains at argument.

80.7.6 Full-state update contract and worked trace

The P3 campaign makes “state” prospective rather than retrospective. Before training, its inventory freezes 24 surfaces spanning model parameters and buffers; optimizer, scheduler, accumulated-gradient, sampler, and RNG state; dataset, preprocessing, code, environment, and evaluation configuration; best, final, released, shadow, and rollback checkpoints; inference and feature caches; lineage; and a local backup store. Each surface names identity, mutation, rollback, deletion, observation, ownership, and external scope. A future campaign may have more surfaces, but it may not discover a changed surface after outcomes and quietly exclude it from rollback.

Checkpoint authority is also prospective. Validation target utility selects a candidate only while retained-family regression stays within the declared bound; ties use retained regression, earlier epoch, then digest. Test data does not select a checkpoint or hyperparameter, and the final checkpoint remains visible even when the best eligible checkpoint differs. Six of fifteen arms showed that disagreement, demonstrating why “the trained model” is an underspecified identity.

Trace step	Observed campaign fact	Admissible statement	Prohibited upgrade
Freeze	Three seeds, five arms, 24 state surfaces, authority rule, stop conditions, and claim partition were preregistered.	The evaluated transaction boundary was fixed before outcome inspection.	The inventory is complete for production or external systems.
Mutate	Real model, optimizer, scheduler, RNG, cache, checkpoint, backup, and lineage surfaces changed in the local disposable run.	The campaign exercised more than parameter-only rollback.	The small network represents foundation-model continual learning.
Select	Validation-only authority chose the eligible checkpoint; six best/final disagreements remained visible.	The selected identity followed the prospective rule.	The selected checkpoint is useful, safe, or deployment-ready.
Roll back	All 15 transactions restored the 24 declared surfaces exactly.	Local declared-surface rollback identity passed 15/15.	Remote effects, production services, firmware, or every possible descendant were restored.
Delete-aware retrain	Behavioral cohort changes were 4, 0, and 1; lineage invalidation propagated in all three seeds.	Behavioral change and lineage propagation occurred on this frozen cohort.	Influence, privacy, legal, storage, or backup erasure occurred.
Decide	Zero of nine eligible challenger seed-arms met the registered 0.05 target-utility gain.	The update disposition is no_change; rollback and unlearning evidence are narrow.	Activity volume, exact rollback, or deletion-aware training justifies capability promotion.

The worked trace is deliberately asymmetric. Exact rollback earns a strong statement inside its inventory, while the update earns no positive disposition and the unlearning result remains partitioned. That is the desired governance behavior: a technically successful transaction control does not rescue a weak learning outcome, and a changed cohort prediction does not erase retained storage.

80.7.7 Three-timescale atlas learning and referentially safe remapping

QCSA separates semantic change by clock. Fast contextual resolution may choose different addresses or questions for one task without changing the atlas. Medium-timescale learning may update resolver, question policy, codebooks, or physical translation behind a frozen epoch and evaluation boundary. Slow governance publishes a new atlas only after collision, calibration, plural- facet, grounding, downstream-compatibility, authority, privacy, and rollback review. Success at one clock grants no authority to advance the next.

Physical relocation is normally cheaper than semantic migration. Moving a memory shard, replacing an expert, changing a decoder, or rebalancing hardware updates the semantic-to-physical translation table while the SOID and atlas epoch remain fixed. A semantic reorganization instead emits a migration map. Every old address must resolve to the same SOID under the new epoch or return a typed failure; silent retargeting is forbidden. Splits preserve an ambiguous parent or deprecated alias and re-resolve old occurrences with uncertainty; merges preserve both original identities and evidence rather than rewriting history.

Alternating optimization may improve resolver, atlas, question, routing, and representation objectives, but release remains multi-objective and Pareto-gated. Quality, calibration, migration stability, residual burden, resource cost, authority, privacy, and downstream repair cannot be hidden in one loss. This lifecycle is a design contract from QCSA, not evidence of continual-learning quality, catastrophic-drift prevention, or safe ontology self-reorganization.

80.7.8 Upward concept learning and foundry-state custody

The Platonic World Model permits experience to update particulars and produce concept hypotheses, but forbids direct upward mutation of canonical Forms. Candidates move through ephemeral, research, provisional, qualified, canonical, deprecated, or forked states and carry positive, negative, boundary, grounding, utility, stability, intervention, and governance evidence. A learned cluster is not promoted merely because it predicts a convenient label.

Deterministic Capability Compilation adds the state needed to reproduce and reverse the learning path: scaffold and charter versions, corpus and counterexamples, base model, parameter ownership, optimizer, scheduler, RNG, router, verifier, caches, backups, descendants, residuals, and reified outputs. This improves update custody but does not collapse behavioral cohort removal, causal influence reduction, privacy leakage reduction, storage erasure, or legal compliance into one claim.

80.7.9 Governed synthetic-data and self-play lifecycle

Synthetic data is a generated claim about a useful training experience. It begins with a generation charter: target capability or failure, eligible source material, generator and judge identities, protected-data and rights boundaries, diversity and difficulty requirements, contamination rules, cost ceiling, and the externally grounded validation that could show usefulness.

The lifecycle separates proposal, filtering, verification, curation, training, and evaluation. Generators propose examples, environments, opponents, or trajectories. Filters reject malformed, duplicated, contaminated, or rights-incompatible material. Verification checks answers, transitions, difficulty, and intended phenomena without reducing truth to generator confidence. Curation builds a versioned coverage and provenance record. Training follows a frozen mixture and checkpoint policy. Final evaluation uses natural, independently sourced, or otherwise non-generator-circular evidence.

Self-play is one generator family, not automatic ground truth. Its record names the game, rules, population, opponent sampling, starting states, exploration, reward, curriculum, termination, and archive. Verifier-complete formal domains can supply stronger labels than open-ended social or language simulations, but population collapse, cycling, exploit overfitting, reward hacking, and evaluator co-adaptation remain visible in both.

The central failure is a closed epistemic loop: generator, filter, judge, student, and evaluator share one model family or blind spot. More volume can then amplify error, reduce diversity, leak evaluation patterns, or cause model collapse while internal scores improve. Controls include real-data anchors, held-out generators, executable verification where available, independent judges, evaluation-set deduplication, mixture ablations, source-only and synthetic-only baselines, and fresh natural outcomes.

Every accepted item carries generator lineage, prompt or environment identity, source dependencies, transformations, verifier result, uncertainty, rights and privacy disposition, deduplication state, curriculum role, expiry, and descendants. Deleting a seed source propagates through generated examples, checkpoints, caches, releases, and backups according to the relevant claim; “synthetic” never means provenance-free.

flowchart LR
    C["Generation charter"] --> G["Generator / self-play"]
    G --> F["Filter and deduplicate"]
    F --> V["Independent or executable verification"]
    V --> D["Versioned curated dataset"]
    D --> T["Bounded training mixture"]
    T --> E["Fresh natural evaluation"]
    E --> R{"Useful without collapse or leakage?"}
    R -->|yes, scoped| A["Admit dataset version"]
    R -->|no or unknown| Q["Quarantine / revise / retire"]

80.8 Interfaces

The custody lease has twelve explicit neighbors. Policy Optimization consumes lease-bound candidates and returns update, checkpoint, rollback, and evidence records without rewriting custody truth. Artifact Graphs owns replayable lineage; Benchmark Ratchets owns partitions, exposure, contamination, comparators, and regressions; Supply Chain and Weight Custody own artifact, replica, backup, transfer, hardware, and key custody. Virtual Context, context transactions, procedural memory, retrieval, and tools consume purpose-, taint-, retention-, and revocation-bound artifacts rather than free-floating examples.

Evidence States, Claim Ledgers, Executable Specifications, and Lean retain claim-axis evidence and finite control consequences. Stable Capability Fields, Capability Replacement, Readiness, Residual Escrow, and Release Governance own capability belief, rollback acceptance, deployment, and publication. Security and runtime permissions execute access, disclosure, transfer, and deletion but cannot infer lawful authority or erasure from execution. Intent, constitutional, moral-uncertainty, and governance layers own affected-party, rights, appeal, and normative constraints. Resource Economics receives all compute, storage, review, privacy, deletion, retraining, rollback, and externality costs. Incident response may revoke or narrow a lease. The Living Book consumes only adjudicated public-safe records and cannot promote a claim by publishing it.

80.9 Invariants

Eighteen invariants prevent evidence laundering. Eligibility is exact to the datum or cohort, consumer, purpose, learning lane, rights, partitions, retention, state inventory, claim axes, environment, and time. Metadata, checksums, provenance assertions, consent, licenses, or authority fields do not self-prove truth, completeness, integrity, lawful use, representativeness, fitness, privacy, or safety. Every transformation retains lineage and residuals. Every train, validation, public-calibration, hidden-holdout, contamination, temporal, adversarial, deletion, and transfer partition and exposure remains distinct and frozen. Every candidate policy remains explicit.

Results preserve complete denominators, failures, exclusions, seeds, and history. Full state includes model, adapters, optimizer, scheduler, scaler, RNG, sampler, dataloader, curriculum, checkpoints, caches, retrieval, indexes, logs, backups, replicas, credentials, evaluations, publications, and descendants. Checkpoint, rollback, deletion, verification, appeal, exception, and terminal authorities are prospective. Behavioral, influence, privacy, lineage, legal, storage, backup, and external-descendant claims stay separate; requests, exclusions, changed outputs, lower memorization, tombstones, checksums, invalidations, and retraining receipts cannot cross-promote them.

Deletion propagates through declared descendants while unreachable transfers, publications, replicas, backups, and regenerating processes remain residuals. Storage erasure requires identity-bound action, replica and backup scope, regeneration controls, independently checked postconditions, and residuals. Custody operations cannot promote capability, benchmark, privacy, safety, readiness, deployment, support, transfer, legal, or SOTA claims. Conclusions remain scoped to the exact data, algorithms, models, seeds, checkpoints, metrics, evaluators, consumers, institutions, environments, descendants, and time tested. Natural utility, calibration, tails, forgetting, interference, privacy, poisoning, drift, sequential deletion, regrowth, closure, latency, and full cost remain jointly visible. Rollback covers the frozen inventory and external effects or residualizes them. Material change expires the lease. Schemas, probes, finite reductions, digest matches, and validators prove only their exact artifact boundary.

80.10 Failure modes

The failure inventory is correspondingly broad: provenance laundering; metadata theater; exact-overlap checks that miss semantic leakage; synthetic replacement tail collapse or indiscriminate accumulation; curation Goodhart; partition laundering; state-inventory truncation; and checkpoint-authority drift. The deletion family includes behavioral-forgetting-to-influence laundering, privacy laundering, lineage-to-storage laundering, deletion theater, retraining theater, and rollback theater. Aggregate utility can hide tails, forgetting, interference, privacy, poisoning, drift, or sequential failure. Promotion laundering, cost externalization, and unsupported transfer can then convert a well-formed local record into claims it never tested.

These are not synonyms. A system can preserve provenance and still have bad rights, coverage, or privacy; delete source storage and still retain influence; change behavior while retaining storage; restore a checkpoint digest while external effects persist; or improve an average while harming a tail. Every failure therefore has its own observable, terminal disposition, and residual instead of sharing a generic pass flag.

80.11 Consequences, objections, and surviving residuals

Full-state accounting changes what a learning result costs. Saving parameters is insufficient when optimizer momentum, scheduler position, RNG streams, sampler order, cached features, release pointers, or backups can change later behavior or defeat rollback. The inventory therefore grows with the system, and exactness is always indexed to an inventory version. This creates storage and observation overhead, but omitting the overhead does not make the hidden state disappear.

Prospective checkpoint authority also changes the meaning of improvement. A best validation checkpoint, final checkpoint, released checkpoint, and rollback checkpoint are different governed identities. Keeping all four prevents a late, favorable test result from selecting the artifact after the fact. It also exposes a practical consequence: deployment tooling must carry authority pointers rather than assuming the newest file is canonical.

Unlearning claim separation prevents a common category error. Behavioral change may be useful for one operational purpose while providing weak evidence about causal influence. An influence estimate may still say nothing about membership privacy. Lineage invalidation can close a governance obligation without deleting storage, and storage deletion can occur without proving that a trained model no longer exposes information. A single success percentage is therefore not merely incomplete; it can reverse which residual appears closed.

“Twenty-four surfaces are arbitrary, so exact rollback is ceremonial.” The number is not universal. Its value comes from being frozen before training, covering the state actually used by the local runner, and naming exclusions. That evidence is strong for the disposable transaction and silent about remote stores, services, firmware, and unknown state. A production inventory would need runtime discovery, external-effect receipts, recovery objectives, and failure injection; the current result does not transfer automatically.

“Deletion-aware retraining is the only meaningful unlearning baseline.” It is an important comparator, not a universal answer. Retraining may be prohibitively expensive, may reproduce information through retained data, and may fail to reach distributed descendants. Approximate methods can still be useful if their target and evidence are explicit. The architecture therefore compares methods while refusing to let any method name define the claim.

“If storage remains, calling anything unlearning is misleading.” This is why the evidence state avoids an undifferentiated completion label. A consumer may need a behavioral mitigation, a causal influence claim, a privacy bound, a lineage response, or physical deletion. The result record states which of those occurred. Where a legal or contractual obligation requires storage erasure, behavioral change and invalidation are insufficient and the route remains open.

“The local campaign is too small to matter.” It cannot establish foundation-model behavior or production transfer. It does matter as a causal and governance integration test: real optimizer and scheduler state changed, checkpoint choices diverged, rollback was exercised, and an unfavorable promotion result survived reconciliation. Its proper contribution is a tested transaction pattern and a falsified update threshold, not a general learning claim.

“Preserving every failed checkpoint and descendant conflicts with deletion.” The conflict is real. Auditability, scientific reproducibility, minimization, and erasure can demand incompatible retention. The policy must decide which artifacts may be retained, encrypted, access-restricted, summarized, or destroyed and must record when reproducibility is deliberately reduced. A lineage graph cannot resolve that normative conflict; it can prevent the chosen tradeoff from becoming invisible.

The surviving residual is causal closure. The campaign knows what it mutated inside one local boundary and can replay that boundary. It does not know every way a cohort influenced upstream curation, downstream users, copied artifacts, human decisions, or external stores. That residual is not a reason to abandon bounded evidence. It is the reason every conclusion carries a scope and every new descendant reopens the relevant obligation.

80.12 Minimum Viable Implementation

The exact current minimum preserves the fifteen admission, full-state, and claim-separation route theorems; the four-scenario receipt probe; the 24-surface/15-transaction full-state bridge; and the three-seed/twelve-arm small-model update result inside an eight-stage, 82-route custody lifecycle with 96/96 route and 3/3 cross-stage mutations rejected, one bounded custody handoff, and one version-2 readmission witness. Influence remains unestablished, source storage remains retained, storage erasure remains zero, all affected claims remain no_change, and no source or rights truth, semantic-contamination control, foundation-model learning, privacy/legal/backup/external-descendant erasure, production recovery, natural-task transfer, or chapter-core promotion result exists.

The receipt fixture records a synthetic template-mutation candidate, source-note lineage, split and benchmark exclusions, an exact-overlap negative control, a retention boundary, limited deletion scope, residual semantic- leakage uncertainty, and the absence of any training or parametric-unlearning result. It is intentionally not a hidden dataset or training recipe.

DataAdmissionReview encodes the minimum control fields, while DataAdmissionRouteFor makes missing provenance or authority block, missing exclusions or contamination checks quarantine, incomplete lifecycle evidence remain experimental, and a complete finite review eligible for a declared bounded use. The proof and fixture should be used as contract tests when a future ingestion path is built. The checked artifacts establish record shape and declared finite branch selection, not the truth of provenance, safety of a source, absence of contamination, useful learning, or deletion propagation through a real system.

data_admission_receipt_probe makes the boundary executable across four finite public-safe scenarios: block for missing provenance, quarantine for a missing contamination record, experimental-only handling for a missing deletion scope, and receipt eligibility only when the recorded controls are complete. Its expected-invalid controls reject promotion laundering as well as incomplete records treated as eligible. It does not train or evaluate a model, load a dataset, detect semantic contamination, or verify deletion from descendants; those remain workload and replay obligations. The deterministic result is recorded at experiments/data_admission_receipt_probe/results/2026-07-10-local.json.

The later P3 campaign supplies the next bounded increment: a frozen synthetic corpus, five update arms, prospective authority, 24 state surfaces, exact local rollback, deletion-aware retraining, lineage invalidation, and explicit no-change/narrow dispositions. It does not supply semantic-contamination detection, natural-task transfer, independent external replay, influence or privacy evidence, or storage erasure. Those are the next evidence obligations, so the architecture and core claim remain at argument.

The custody-lifecycle refinement at experiments/data_engine_lifecycle_refinement/results/2026-07-16-local.json independently reruns the admission probe, full-state bridge, and update-causality validator, then reaches all 82 routes across scope, admission, full-state binding, update receipt, deletion assessment, claim-axis adjudication, bounded custody, and material-change readmission. Exact identity custody includes data, cohort, provenance, rights, authority, partitions, model and checkpoint state, optimizer, scheduler, RNG, caches, backups, lineage, descendants, deletion request, evaluator, consumer, and version. Two Lean composition theorems execute the full eight-transition cycle and an influence-laundering prefix. All 96 route mutations and three cross-stage mutations reject: behavior-as-influence and lineage-as-storage laundering prevent custody and readmission, while incomplete descendant invalidation prevents readmission after custody. The result proves authored custody and transition consequences only: every right, check, inventory, rollback receipt, deletion status, propagation claim, monitor, and invalidation remains trusted input, and exact rollback remains limited to prospectively declared local surfaces.

The P5 multi-process reference adds one executable deletion and recovery projection without promoting the chapter claim. It selects checkpoint authority before mutation and restores nine local state classes byte-exactly, including model, optimizer, scheduler, RNG, cache, backup, derived-artifact, descendant, and credential payloads. A separate custodian removes a declared cohort from primary, cache, backup, derived, and descendant storage surfaces. The result deliberately records behavioral change, causal influence reduction, and privacy leakage reduction as not_tested, and external storage erasure as not_established. This is the claim-axis separation the lease requires, but the payloads are deterministic local bytes rather than learned state and the sandbox cannot observe external copies.

The stateful-service successor removes one limitation and preserves the claim partition. Its nine-class checkpoint contains a real two-parameter model, bias-corrected Adam moments, scheduler step, deterministic RNG state, prediction cache, backup identity, evaluation artifact, descendant adapter, and credential record. Training changes all nine; a model-only restore leaves eight inconsistent; a new process restores all nine from prospective authority and recovers the prior prediction exactly. This establishes that full-state custody can bind actual learning state in this small local service. It does not run a deletion request, measure forgetting or retained influence, reduce privacy leakage, erase remote copies, or establish trajectory equivalence for a large model.

80.13 Mature Research Target

80.13.1 Argument-exit campaign

Exiting argument support requires natural heterogeneous learning and deletion workloads with frozen partitions, complete denominators, and matched strong replacement, accumulation, replay, reweighting, synthetic-augmentation, quarantine, retraining, sharding, fine-tuning, and no-change policies. The campaign must inventory and restore the full declared state and jointly measure coverage, contamination, poisoning, leakage, rights, natural utility, calibration, tails, forgetting, causal influence, privacy, sequential deletion, storage and backup erasure, regrowth, external-descendant closure, effect-complete rollback, latency, and total cost. Independent trainers, custodians, privacy evaluators, storage verifiers, institutions, and transfer sites must reproduce terminal positive, negative, null, narrowed, blocked, and refuted outcomes without outcome-aware protocol changes.

The mature target is a data governance plane spanning the entire stack. Every learning input, synthetic descendant, replay item, deletion request, evaluation split, checkpoint, adapter, cache, retrieval index, distilled model, and published artifact has a versioned lineage and a declared permitted use.

At that logical end state, the engine does more than record inputs. It runs independent contamination and semantic-overlap checks, retains negative results, detects distributional drift, tracks synthetic generations, declares where human data remain necessary, and exposes the conflict between preserving coverage and honoring revocation. Deletion creates a closure obligation over all declared descendants. The system can then produce a verifier-backed report that distinguishes “removed from source store,” “retrained affected shard,” “invalidated retrieval index,” “published artifact withdrawn,” and “scope unverified.” It still cannot compress those statements into a universal claim of forgetting.

The final product would also connect evidence to learning without allowing learning to rewrite evidence. A data candidate becomes eligible for a bounded experiment; the experiment produces measurements and negative controls; an independent evaluator determines whether those measurements support a scoped claim; governance decides whether a result changes deployment. That separation is the architectural endpoint. It is not a current-result claim: support must stay at argument until controlled ingestion, training, descendant tracing, and deletion verification are independently replayed and accepted.

80.14 Codex test plan

Test	Purpose	Status
Data-admission receipt schema fixture	Validate provenance, authority, lineage, exclusions, contamination checks, lifecycle fields, residuals, non-claims, and an experimental-only decision in a public-safe record.	implemented by python3 scripts/validate_schemas.py; no dataset, training run, or data-quality result
Data-admission route proof	Prove finite routing for missing provenance or authority, missing split exclusions or contamination checks, and complete record eligibility.	implemented in AsiStackProofs.DataEngines; no corpus inspection, training, inference, or deletion
Data-admission lifecycle probe	Exercise block, quarantine, experimental-only, and eligible receipt routes with four expected-invalid controls.	implemented by python3 scripts/validate_data_admission_receipt_probe.py; no dataset, model, semantic-contamination, deletion, or support-state result
Full-state update campaign	Exercise model, optimizer, scheduler, RNG, cache, checkpoint, backup, and lineage state under prospective checkpoint authority.	implemented by the preregistered P3 campaign: 24 surfaces and 15/15 exact local rollbacks; update disposition no_change
Continual-learning policy comparison	Compare no-update, bounded update, EWC mitigation, deletion-aware retraining, and an authorized-data comparator under frozen baselines.	implemented on one synthetic small-network workload; zero of nine eligible challenger seed-arms met the promotion threshold, so no capability result
Descendant-deletion trace	Distinguish behavioral change, influence, privacy, lineage propagation, and storage erasure.	bounded lineage invalidation implemented; influence remains proxy-only and storage erasure false
Semantic-overlap adversary	Falsify an exact-overlap-only assurance before an admission path can feed a learning run.	planned; no semantic-leakage detector or adversarial corpus exists
Data-engine custody/update/deletion lifecycle refinement	Join exact admission, full-state, update, deletion-axis, bounded-custody, and successor-version boundaries without cross-promoting claims.	implemented by python3 scripts/validate_data_engine_lifecycle_refinement.py; two composed Lean traces, three inherited suites, all 82 routes, 96/96 route mutations, and 3/3 cross-stage mutations pass, support/effect none; no source-truth, learning, influence, forgetting, privacy/legal/storage erasure, production recovery, release, transfer, or support claim

The implemented checks are deliberately narrow. Schema validation cannot tell whether a provenance statement is true, and a finite Lean route cannot tell whether a real source, model, or descendant obeyed that route. The planned workload and deletion trace must remain separate evidence lanes with their own baselines, controls, residuals, and replay records.

80.14.1 Formalization hooks

Tag	Module	Target	Status
lean:data_engines.provenance_authority.failure_blocks_admission	AsiStackProofs.DataEngineLifecycleRefinement	Missing bound provenance, rights, or authority blocks the reachable custody lifecycle before data admission.	implemented
lean:data_engines.contamination.failure_routes	AsiStackProofs.DataEngineLifecycleRefinement	Missing split exclusions or a contamination-check record blocks the reachable custody lifecycle before admission.	implemented
lean:data_engines.complete_receipt.eligibility_invariant	AsiStackProofs.DataEngineLifecycleRefinement	A complete admission record advances only to full-state binding and does not establish data quality, training, deletion, or support.	implemented
lean:data_engines.full_state.complete_reaches_evidence_review	AsiStackProofs.DataEngineLifecycleRefinement	Complete declared full-state custody and a prospectively fixed selection rule advance only to an update receipt, not promotion.	implemented
lean:data_engines.full_state.missing_optimizer_requires_repair	AsiStackProofs.DataEngineLifecycleRefinement	Missing optimizer state blocks full-state binding.	implemented
lean:data_engines.full_state.missing_scheduler_requires_repair	AsiStackProofs.DataEngineLifecycleRefinement	Missing scheduler state blocks full-state binding.	implemented
lean:data_engines.full_state.missing_rng_requires_repair	AsiStackProofs.DataEngineLifecycleRefinement	Missing RNG state blocks full-state binding.	implemented
lean:data_engines.full_state.missing_cache_requires_repair	AsiStackProofs.DataEngineLifecycleRefinement	Missing cache state blocks full-state binding.	implemented
lean:data_engines.full_state.missing_backup_requires_repair	AsiStackProofs.DataEngineLifecycleRefinement	Missing backup state blocks full-state binding.	implemented
lean:data_engines.full_state.missing_descendant_requires_repair	AsiStackProofs.DataEngineLifecycleRefinement	Missing descendant state blocks full-state binding.	implemented
lean:data_engines.full_state.missing_checkpoint_authority_requires_repair	AsiStackProofs.DataEngineLifecycleRefinement	Missing prospective checkpoint authority or selection rule blocks full-state binding.	implemented
lean:data_engines.full_state.rollback_mismatch_requires_repair	AsiStackProofs.DataEngineLifecycleRefinement	A declared-surface rollback mismatch blocks the update record and cannot be generalized to semantic or production recovery.	implemented
lean:data_engines.unlearning.behavior_cannot_launder_influence	AsiStackProofs.DataEngineLifecycleRefinement	Behavioral cohort change cannot serve as evidence of causal influence reduction in deletion-claim adjudication.	implemented
lean:data_engines.unlearning.behavior_cannot_launder_privacy	AsiStackProofs.DataEngineLifecycleRefinement	Behavioral cohort change cannot serve as evidence of privacy protection or erasure in deletion-claim adjudication.	implemented
lean:data_engines.unlearning.lineage_cannot_launder_storage	AsiStackProofs.DataEngineLifecycleRefinement	Lineage propagation or invalidation cannot serve as evidence of physical storage or backup erasure in deletion-claim adjudication.	implemented

Formal audit. All fifteen legacy declarations remain derived finite route consequences, and the refinement adds one combined route theorem, one complete- cycle theorem, and one axis-laundering/downstream-blocking theorem over a reachable eight-stage model plus an independently implemented 82-route consumer with 96 route and three cross-stage mutations. The consumer binds rather than merges the admission, full-state, and update result lanes. These finite records do not prove their inputs true or their controls effective. None of this establishes provenance or rights truth, detects semantic leakage, learns, proves target improvement or forgetting, reduces causal influence or privacy leakage, erases storage or backups, enforces a production route, restores an undeclared effect, or establishes reproduction or transfer. The favorable formal endpoint is bounded custody only; it creates no support or release authority.

80.15 Data order, curricula, and attribution-assisted custody

A dataset is not fully identified by its rows. Curriculum learning makes the order, difficulty model, pacing rule, resampling, and adaptive transitions part of the learning mechanism [@ext_curriculum_learning_2009]. The custody ledger therefore versions an exposure schedule beside each data lease: batch order or distribution, curriculum score and author, competence threshold, augmentation state, replay frequency, random seeds, and any feedback-driven change. This matters for both reproducibility and deletion because two runs over the same nominal corpus can give a cohort different exposure, gradient influence, and descendant reach.

Attribution methods can help prioritize the descendant search. Influence functions approximate how a small change in a training point’s weight affects a target prediction or loss [@ext_influence_functions_2017]. The useful output is not “this row caused the answer,” but a versioned candidate list tied to a checkpoint, target, approximation, parameter scope, solver, and error checks. The list can direct expensive leave-one-out retraining, counterfactual data edits, membership or extraction probes, cache inspection, and descendant invalidation.

The mechanism fails when difficulty labels encode social bias, adaptive curricula leak evaluation data, exposure logs omit preprocessing, influence approximations break under non-convexity, or a low estimated influence is treated as permission to skip deletion. The nonclaim is strict: exposure identity does not prove causal influence, and influence reduction does not prove behavioral forgetting, privacy protection, lawful erasure, backup deletion, or removal from distilled descendants. Those remain separately tested and separately reported.

80.16 World-model data, versions, and prediction-error custody

A learned predictive state introduces a second lifecycle beside the controller. ext_v_jepa_2_2025 separates action-free video pretraining from a smaller action-conditioned predictor, so the data engine must preserve that separation: source video and consent/provenance, preprocessing, encoder version, predictor version, action-labelled adaptation data, observation distribution, forecast horizon, error cohort, and controller consumer all need distinct lineage.

Prediction errors are learning inputs, not self-authenticating evidence. The engine retains error distributions, calibration shifts, camera or sensor changes, action-search failures, and sim-to-real residuals before admitting an update. Deletion or revocation must propagate through encoder checkpoints, predictors, caches, replay buffers, backups, controllers, and descendants. Behavioral change still does not establish causal influence removal, privacy erasure, or storage erasure. The cited paper provides an architecture and empirical comparator; it does not establish a local data engine, causal world model, or safe robot policy.

ext_v_jepa_2_2025 | Metadata-first comparator: V-JEPA 2: Self-Supervised Video Models Enable Understanding, Prediction and Planning. Primary empirical comparator for action-free latent video pretraining, a small action-conditioned predictor, and model-predictive control. Camera sensitivity, autoregressive error accumulation, action-search cost, image-goal assumptions, and representation-bounded capability remain explicit limits; no local world model or robot-control result is established. | No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row. |

80.17 Cross-Surface Persistence and Unlearning

Data admission, replay retention, labels, memory writes, and parameter updates are different persistence surfaces. Adjudicated persistence asks which of them should carry an eligible lesson before a continual-learning pipeline commits to one. A stale fact may need a dated memory and freshness guard; a repeated behavioral defect may justify a data repair or bounded update; an evaluator failure may require neither.

Unlearning inherits the same cross-surface obligation. Deleting records from a dataset does not remove derived weights, memories, tools, summaries, caches, routes, or downstream reliance. The adaptation transaction must preserve a descendant graph and route every affected realization through removal, deoptimization, compensation, requalification, or explicit residual custody.

80.18 Source crosswalk

Source	Role in the argument	Boundary
ext_bourtoule_machine_unlearning_2021	SISA-style deletion-path structure, bounded retraining, and trade-off vocabulary.	No local SISA run, deletion verification, privacy result, or general forgetting claim.
ext_shumailov_model_collapse_2023	Recursive generated-data risks, provenance, and distributional-tail residuals under stated assumptions.	No local recursive-training result or universal synthetic-data claim.
ext_gerstgrasser_data_accumulation_2024	Replacement-versus-accumulation policy contrast and its stated experimental and analytical limits.	No local accumulation result or safety, privacy, or optimality conclusion.
theseus_synthetic_data_curation	Source-reported curation gates for residual-targeted synthetic data.	No curator execution, dataset import, model-quality result, or promoted Theseus claim.
ext_w3c_prov_o_2013, ext_mlcommons_croissant_1_1_2026	Interoperable derivation/invalidation and machine-readable dataset/resource/field metadata for training, evaluation, synthetic, and deletion records.	No local conformance, dataset fitness, legal clearance, representativeness, deletion, or safe continual-learning result.

80.18.1 Manifest source assignment reconciliation

These rows keep Data Engines, Continual Learning, and Unlearning’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
learning_compute_topology	Passage-reviewed comparator: Learning–Compute Topology: Formalizing the Causal Organization of Adaptive Systems. Corben-authored August 2026 research paper and executable preparation package that separates model architecture, learning-process topology, execution topology, and physical compute topology. It contributes adaptive-identity tests; typed evidence, judgement, credit, state, artifact, control, and authority relations; LCT-IR; Learning Causal Normal Form; seven bounded propositions; topology metrics; a semantic compiler firewall; Adaptive Branch–Validate–Integrate; toy and analytical phase diagrams; and an explicit falsification program. The bundled reference implementation passes 11 unit tests, but implements only bounded conformance behavior and does not establish neural-training benefit, causal completeness, universal canonicality, safety, scaling superiority, or ASI.	The formal propositions hold only under their stated finite, explicit-state, interface-sufficiency, information-theoretic, and cut-capacity assumptions. The executable supplement covers a bounded IR/validator/normalizer/compiler/simulator slice; the phase diagrams are toy or analytical, the ABVI topology is proposed, and the novelty matrix is a scoped comparison rather than a global novelty proof. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
deterministic_capability_compilation	Passage-reviewed Corben architecture source: Deterministic Capability Compilation: A Capability-Preserving Ladder from Executable Scaffolds to Governed Adaptive Agents. Corben-authored July 2026 architecture and research program for compiling executable scaffolds into contract-bound experts and linked Neural Capability Objects while retaining semantic obligation mass balance, candidate-specific translation validation, fallback, residual escrow, authority ceilings, reification, and effect-complete recovery. Existing chapters are upgraded first; no foundry implementation, learned-capability result, preservation result, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
platonic_world_model	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_muse_unlearning_2025	Passage-reviewed comparator: MUSE: Machine Unlearning Six-Way Evaluation for Language Models. Supports separating memorization, privacy leakage, retained utility, removal-scale behavior, and sequential sustainability instead of using one forgetting score.	No MUSE corpus, method, 7B model, privacy probe, scale test, or sequential deletion request was reproduced by the local small policy network. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_unlearning_benchmarks_weak_2024	Passage-reviewed comparator: Position: LLM Unlearning Benchmarks are Weak Measures of Progress. Supports treating unlearning benchmark validity, target ambiguity, forget/retain dependence, and benign perturbation robustness as separate evidence burdens.	The position paper raises the interpretation standard but does not validate the local workload or establish influence, privacy, legal erasure, or storage erasure. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_openunlearning_2025	Passage-reviewed comparator: OpenUnlearning: Accelerating LLM Unlearning via Unified Benchmarking of Methods and Metrics. Supports versioned unlearning methods, standardized execution interfaces, public checkpoints, diverse evaluations, and meta-evaluation of metric faithfulness.	The framework, methods, checkpoints, evaluations, and meta-evaluations were not run; standardized record shape does not establish semantic validity or erasure. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
qcsa_whitepaper	Passage-reviewed comparator: Question-Compiled Semantic Addressing. Contributes fast/medium/slow update timescales, candidate versus authoritative atlas epochs, identity-preserving readdressing, merge/split lineage, migration compatibility, shadow evaluation, rollback, and semantic-drift tests; the later repository adds a bounded local 12-lane implementation, 60-case held-out evaluation over 13 systems and three seeds, and one 13-stage governed vertical trace.	The exact matched-advantage and resource gates failed, and the active-question ablation is N2 proxy/regime evidence rather than an exact or broad refutation. No learning, forgetting, influence, privacy/storage erasure, chapter-core promotion, AGI, or ASI result is established. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_v_jepa_2_2025	Passage-reviewed comparator: V-JEPA 2: Self-Supervised Video Models Enable Understanding, Prediction and Planning. Shows why world-model data lineage must separate action-free pretraining, action-conditioned adaptation, predictor versions, and error/residual records.	The reported video and robot results do not establish local model quality, causal understanding, safe control, transfer, deployment, or an ASI Stack result. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_influence_functions_2017	Passage-reviewed comparator: Understanding Black-box Predictions via Influence Functions. Provides an approximate training-point influence estimator that can prioritize candidate descendants and deletion impact checks.	Approximate influence is not proof of causal contribution, privacy leakage, legal erasure, storage erasure, or successful unlearning. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
ext_curriculum_learning_2009	Passage-reviewed comparator: Curriculum Learning. Shows that data order and difficulty schedules can be part of the learning mechanism rather than incidental loader state.	The source does not establish a universal curriculum, safe continual learning, or transfer to current foundation-model pipelines. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
regret_engine	Passage-reviewed Corben architecture source: The Regret Engine: Governed Counterfactual Learning Signals for Continual Adaptation, Prospective Risk Control, and Self-Correction in Artificial Agents. Corben-authored August 2026 conceptual architecture and research program for decision-time-fair Governed Counterfactual Regret, immutable Decision Capsules, admissible comparator contracts, sparse Regret Tensors, append-only Regret Packets, prospective regret control, regret-aware replay, regret-to-rule compilation, three update clocks, root-cause adjudication, and bounded update leases. Existing chapters are upgraded first; no implementation, experiment, reproduction, causal-identification result, formal proof, safety result, support transition, SOTA, AGI, or ASI is inferred.	The bibliography and Markdown figure companions were not supplied; the DOCX embeds its visual material. All propositions, algorithms, experiments, and architecture claims remain proposed rather than independently validated. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
assurance_shift_learning	Passage-reviewed comparator: When Success Stops Teaching: Assurance-Shift Learning and Governed Residual Boundary Learning for Mature AI Systems. Adds informative-exception strata, learner-relative negative half-life, natural/probe distribution separation, protected positives, and repair-aware replay custody.	Inhibition, replay retirement, and retained negative knowledge do not establish parameter unlearning, deletion, privacy, or forgetting. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.
adjudicated_persistence	Passage-reviewed comparator: Adjudicated Persistence: Governing the Transition from Experience to Durable Structure in Adaptive Systems. Frames datasets, replay buffers, labels, weights, memories, and deletion obligations as distinct persistence surfaces with different descendant and unlearning costs.	Conceptual author framework and benchmark proposal; no local implementation, empirical result, independently checked proof, safety result, or support movement. No local implementation, reproduction, performance, safety, deployment, support-state, or ASI result is established by this reconciliation row.

80.19 Post-v2 update and deletion result

The update-causality campaign trains real small PyTorch policy networks across three seeds. It preserves zero-delta no-update checkpoints, three mutated challenger families, independent validation/test splits, 40 fixed probes, a 60-member poisoned deletion cohort, best and final checkpoints, forgetting, nonmember utility, deletion responses, rollback, and descendant invalidation. Deletion-aware retraining excluded the cohort and reached mean true-label accuracy 0.8222 on its members versus 0.7944 for final bounded fine-tuning and 0.7833 for the base.

That difference is causal evidence about this frozen cohort, not verified forgetting. It does not show that member influence, stored rows, caches, backups, adapters, or derived artifacts were erased. The core claim remains argument via no_change; production unlearning and deletion propagation remain open.

80.20 Post-v2.1 full-state and unlearning result

The successor campaign expands the state boundary to 24 declared surfaces and restores all of them exactly in 15/15 seed-arm transactions. No eligible challenger, however, reaches the registered 0.05 target-utility gain. Deletion-aware retraining changes 4, 0, and 1 cohort decisions across three seeds and propagates descendant invalidation, while influence reduction remains a confidence proxy and storage erasure remains false. A governed account must keep four claims separate: behavioral cohort change, influence removal, lineage propagation, and storage erasure. Only the first and third receive bounded local evidence here; UU-03 persists.

Source	Use and boundary
ext_muse_unlearning_2025	Multi-dimensional unlearning evaluation comparator; no local 7B-scale, privacy, or sequential-sustainability result.
ext_unlearning_benchmarks_weak_2024	Comparator for weak benchmark validity; reinforces that behavioral scores alone do not establish forgetting.
ext_openunlearning_2025	Reproducible unlearning framework comparator; no reproduced method, privacy guarantee, influence proof, or storage erasure here.

80.21 Post-v2.3 terminal update/unlearning attempt

M7 makes the instrument failures part of the evidence rather than hiding them. The first frozen-representation attempt produced measurable checkpoint and membership statistics, but both deletion cohorts collapsed to one rare class and even deletion-aware retraining scored zero true-label accuracy. It is therefore instrument_inadequate, not a negative unlearning result. A balanced mean-pooled repair then failed before held-out execution at 0.4333 general and 0.3333 deletion-like preflight accuracy.

The terminal instrument used the same exact local Qwen2.5-Coder-0.5B snapshot with frozen weights, concatenated its normalized mean representation with an audited vector of the authority, provenance, contamination, deletion, and risk fields already present in each record, and trained only a small nonlinear head. The preflight ablation is important: Transformer-only reached 0.7667 general and 0.7000 deletion-like accuracy, while structured-only and fused paths both reached 1.0000. The control task became learnable by making its declared fields explicit, not because the language model learned an unlearning procedure.

Across five seeds and seven arms, deletion-aware retraining reached 0.9767 mean deletion true-label accuracy. Sequential approximate unlearning moved only 0.01222040 closer in parameter distance to the retraining comparator than standard update. Its direction-invariant loss-threshold membership-attack advantage changed by -0.02511111. These small results narrow the mechanism: they justify retaining comparator-relative local effects, but not claiming zero influence or privacy.

All 35 arm/seed transactions restored the 24 declared local surface digests. Five late local descendants were invalidated and quarantined; one operational feature shard and its declared local backup were absent with zero index references. The corpus, feature packet, checkpoints, and raw evidence remain retained, while a simulated remote replica and external descendant did not acknowledge closure. Legal compliance was not evaluated. Thus behavioral, influence, membership/privacy, lineage, legal, storage, backup, and external- descendant outcomes remain eight different claims. The terminal disposition is claim_narrowed_after_full_attempt, with no chapter-core support movement.

80.22 Summary

A system that learns without a data lifecycle gradually loses the ability to say why it changed. Provenance, authority, exclusions, contamination controls, retention, deletion scope, evaluation references, and residuals give each learning input a history that can be inspected before it becomes ordinary infrastructure. The point is not to make every candidate impossible to use; it is to give uncertain candidates honest lanes such as quarantine or bounded experimentation.

That discipline also prevents two dangerous shortcuts. A deletion request is not verified forgetting, and a complete receipt is not model-quality evidence. Synthetic-data choices likewise need measurements and trade-offs, not generic optimism or generic prohibition. The governed path makes the decision visible, keeps its unresolved descendants visible, and sends capability claims back through independent evaluation and authority gates. Learning can therefore be continuous without becoming historically opaque.

80.23 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the data-engines-continual-learning-and-unlearning slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains blocked after full attempt at argument support. The strongest family attempt was Full-state update and unlearning causal campaign. Its exact boundary is: Broad unlearning claim is narrowed with no support promotion; behavioral removal is not influence, privacy, legal, storage, backup, or descendant erasure. Across 86 atoms, the terminal ledger records 86 blocked_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	CF-07 / 86 atoms
Terminal dispositions	86 blocked_after_full_attempt
Core	data-engines-continual-learning-and-unlearning.core: blocked_after_full_attempt at argument
Core attempted / missing lanes	causal, empirical, executable, formal, source-synthesis / normative, transfer
Attempted local lanes	causal, empirical, executable, formal, source-synthesis
Missing or unproved lanes	normative, transfer
Strongest family bundle	Full-state update and unlearning causal campaign (end_to_end): One adequate five-seed, seven-arm terminal campaign preserving two prior instrument failures and separate behavioral, influence, privacy, lineage, storage, backup, and descendant axes.
Negative controls	deletion retrain comparator; approximate mitigation arms; 15 rejecting mutations; failure-lineage preservation.
Accepted transitions	none
Maximum inference	Broad unlearning claim is narrowed with no support promotion; behavioral removal is not influence, privacy, legal, storage, backup, or descendant erasure.
Reproduction / next burden	Replay scripts/validate_p4_m7_update_unlearning_v3.py and scripts/validate_claim_family_terminal_program.py; fill the named atom-specific lanes under a new prospective protocol.

80.23.1 Semantic proof ceiling

The P4-C4 audit finds AsiStackProofs.DataEngineLifecycleRefinement adequate only for its bounded eight-stage custody and claim-axis-separation semantics. Its fifteen public targets and five declarations constrain authored records; they do not establish learning, forgetting, influence removal, privacy, legal compliance, storage or backup erasure, inventory completeness, rollback efficacy, deployment, or support movement.

80.24 Handoff

Data decisions create durable obligations and scientific experiments create claims that may depend on those data. Scientific Discovery and Experimental Governance receives exact dataset, rights, provenance, split, contamination, update, and deletion state before governing hypotheses, protocols, instruments, analysis, replication, and dual-use review. A valid dataset does not prove a scientific claim; an experimental result cannot erase data rights, failed attempts, or descendant obligations.