The derived-state problem in AI memory.

Memory in an AI application is rarely one record. A message is extracted into a fact, the fact is summarized into a profile, the summary is embedded, retrieval results are cached, and an agent writes a plan that another agent consumes. Each step is reasonable on its own. Together they produce derived state spread across several stores with no shared notion of where it came from.

Retrieval-augmented systems make this more pronounced: every retrieved chunk can become part of a new artifact. When the original source is corrected or removed, nothing in the typical stack connects that event to the copies — so they keep being retrieved.^[15][13]

Database research distinguishes why-provenance (which inputs justify an output) from where-provenance (where a value was copied from). Provenance semirings generalize both by annotating results with polynomials over their inputs. W3C PROV standardizes entities, activities, and agents for interchange, and OpenLineage applies similar ideas to data pipelines.

These models were built for queries and batch jobs with well-defined operators. AI pipelines add operators — extraction, summarization, generation — whose dependence on their inputs is real but not exact.^[1][2][3][4]

Truth-maintenance systems record why a belief is held — its justifications — so that when a premise is retracted, every belief that depended on it can be withdrawn or re-derived. Assumption-based variants track which sets of assumptions support each belief.

An AI memory with lineage is a practical descendant of this idea: artifacts are beliefs, edges are justifications, and invalidation is retraction. The difference is scale, heterogeneous storage, and justifications produced by models rather than rules.^[5][6]

Machine unlearning asks how to remove the influence of specific training data from a model without retraining from scratch, often by structuring training so affected parts can be recomputed.

Lineleaf works at a different layer. It does not change model weights. It addresses the external memory around a model — stores, caches, summaries, and agent state — where a deleted source can persist even when no training is involved.^[7][8]

Relational databases solve a narrow version of this with foreign keys and ON DELETE CASCADE: when a parent row goes, dependent rows go with it. Erasure obligations such as GDPR Article 17 make the broader version a product requirement for many teams.

AI memory breaks the assumptions cascades rely on. Dependencies cross stores, are created by model calls rather than schemas, and include artifacts that should be rebuilt rather than deleted.^[9]

Agent architectures increasingly separate working context from long-term memory that is written, summarized, and reflected upon over time. Reflection and summarization steps are exactly where one observation turns into many durable artifacts.

Multi-agent setups add another hop: one agent’s output becomes another agent’s input, and stale context can propagate while both are running.^[14][13]

Attribution methods estimate which parts of a context a generation actually relied on — through ablation, surrogate models, or influence estimates. They are the closest thing to automatic why-provenance for model outputs.

They are also probabilistic. Lineleaf can record attribution scores as edge metadata, but treats them as evidence for planning rather than proof, and keeps explicitly declared parents as the default.^[16][17]

A summary made from three sources is not invalid when one of them changes; it is partially stale. Deleting it loses good information. Rebuilding it from the remaining valid parents is usually right — and is what incremental view maintenance and build systems do for their own derived artifacts.

The hard part is knowing when a rebuild is possible, and making sure the rebuilt artifact provably no longer depends on the removed parent.^[10][11]

Each store has its own deletion semantics. Some delete immediately; log-structured engines write tombstones and reclaim space later; caches expire; some hosted APIs offer no confirmation at all. An invalidation plan has to coordinate all of them and report honestly when it cannot be sure.

Poisoning makes this a security concern as well as a privacy one: a single injected document can steer retrieval-augmented answers until every derived copy is found.^[12][18]