David Kim was reviewing a competitor’s incident report when the architecture problem became clear to him. A medication management app had continued recommending dosage timing based on a prescription the patient had discontinued eight months earlier. The patient had switched from metformin to jardiance, but the app’s context still referenced the old medication. The dosage timing recommendation was not just stale. It was wrong for the current medication, whose absorption profile required different meal spacing. The patient followed the outdated recommendation for three weeks before a pharmacist caught the discrepancy.
David was a clinical informatics architect evaluating AI systems for a regional health network. He had seen the incident pattern before: systems that remember too much serve the person she was, not the person she is. The medication changed. The address changed. The relationship ended. The contractor who did bad work two years ago may have improved. The dietary restriction that was temporary is now permanent. Systems that treat all stored context as equally current produce stale recommendations, outdated referrals, and, in the medication case, dangerous errors.
The BlueMirror architecture document described a forgetting model that David had not encountered in any competing platform. Not a data retention policy. Not a privacy deletion feature. A structured temporal decay architecture where different types of context become stale at different rates, where the system forgets intentionally based on domain-specific rules, and where the person can direct the system to forget specific things on demand. The architecture treated forgetting as a first-class engineering problem, not as a compliance afterthought.
A system that remembers everything serves the person she was. A system that forgets appropriately serves the person she is.
Temporal decay in the MoC architecture is not uniform deletion. It is domain-aware, confidence-weighted, and person-overridable. Health context decays slowly because medications matter for years, even discontinued ones carry allergy and reaction history. Shopping preferences decay quickly because brand preferences shift and needs change seasonally. Relationship context almost never decays automatically because people matter until the person says otherwise. The system’s forgetting is as deliberate as its remembering, and the architecture that governs it is as specified as the architecture that governs learning (BMT-05.02). Forgetting is not the absence of memory. It is a designed function with its own rules, its own rates, and its own failure modes.
Domain-specific decay rates#
Different types of context become stale at fundamentally different rates, and treating them uniformly produces either dangerous retention or premature loss.
Active medications decay very slowly, on the order of years, because clinical relevance persists even after a medication is discontinued. The fact that Margaret took metformin for three years is relevant to her drug interaction profile indefinitely. The fact that she experienced nausea on metformin is relevant if a future physician considers re-prescribing it. The active status of the prescription decays when the medication is discontinued, but the historical record does not.
Discontinued medications also decay slowly, on the order of months to years, because they remain relevant for allergy documentation, interaction history, and clinical reasoning about why a medication was stopped. A physician evaluating a new prescription needs to know what was tried before and why it was discontinued.
Dietary preferences decay at a medium rate, weeks to months, because tastes change, restrictions change, and seasonal variation is real. Margaret’s preference for butternut squash soup in November does not predict her preferences in July. The system tracks preference recency and weights recent choices more heavily.
Shopping preferences decay fastest, on the order of weeks. Brand preferences shift with availability, pricing, and experience. The buying agent’s record that Margaret prefers Heinz ketchup decays if she has not purchased it in six months. If she buys it again, the confidence restores instantly.
Financial data decays slowly, on the order of months. Account balances change, benefit structures update during enrollment periods, and income sources shift. But the decay is semi-structured: the system knows when open enrollment happens and can trigger a financial context refresh at the right time rather than waiting for gradual decay.
Home property data decays very slowly, on the order of years. Houses change slowly. The roof age, the HVAC system model, the plumbing profile: these are relevant until a major renovation or a move. The home maintenance concierge’s context persists because the building persists.
Communication preferences decay at a medium rate, on the order of months, because communication style evolves. This is particularly true after a cognitive change: a person whose cognitive baseline shifts may need different response structures, and the old communication preferences may no longer serve her. The system tracks cognitive assessment results and adjusts communication preference confidence when a significant cognitive change is detected.
Relationship status never decays automatically. People matter until the person explicitly indicates otherwise. The system does not assume that a relationship has ended because the person has not mentioned the other person recently. Ruth’s absence from conversations for two weeks could mean many things, and the system does not infer relationship status from interaction frequency without explicit signal.
Cognitive assessment history never decays. The longitudinal trajectory of cognitive function is always relevant, even assessments from years ago, because the trajectory itself is diagnostic. A stable baseline that held for three years and then declined is a different clinical signal than a baseline that has been declining for five years. Removing old assessments destroys the trajectory.
Each domain carries a half-life. After one half-life, the confidence weight of the context is halved. After two, it is quartered. Below a configurable threshold, the context is flagged for review or moved to archival storage. The threshold and the half-life values are tunable per domain, and the partner appendix contains the current specifications.
Three types of forgetting#
The system forgets in three distinct ways, each with different triggers, different speeds, and different implications for the person.
Temporal decay is automatic. Context confidence degrades over time based on the domain-specific rates described above. The buying agent’s record of Margaret’s ketchup preference loses confidence weight each week she does not purchase it. After the half-life expires, the preference is still available but carries lower weight in recommendations. The system might suggest Heinz but also present alternatives it would not have shown when the preference was fresh. If Margaret buys Heinz again, the confidence restores to full immediately. Temporal decay is reversible.
Event-triggered forgetting is semi-automatic. Certain events trigger immediate context updates that are effectively targeted forgetting. A medication change triggers immediate deactivation of the old medication’s active status in Layer 3, though the medication is retained in the historical record. An address change triggers updates across every concierge agent that references location: the buying agent’s delivery zone, the home maintenance concierge’s property profile, the social connection concierge’s proximity calculations for local activities. The trigger is the event. The forgetting is immediate for active context and archival for historical record.
Event-triggered forgetting is where cross-agent coordination becomes visible. When Margaret’s physician changes her diuretic, the health concierge updates the medication list. The update propagates through the MoC schema to the buying agent (new prescription to fill, old one to discontinue), the nutrition concierge (sodium restriction may have changed), and the financial concierge (copay structure may differ). One event. Multiple agents updated. The forgetting is coordinated because the memory architecture is shared.
Person-directed forgetting is manual. Margaret tells the system “forget about my ex-husband.” The system removes the relationship from active context across all layers and all concierge agents. The person can also request domain-level deletion (“forget everything about my finances”), specific event deletion (“forget that I told you about the fall last Tuesday”), or full reset (“forget everything and start over”). Each request includes a confirmation step and a plain-language explanation of what will be lost. The confirmation is not a legal disclaimer. It is a specific, readable list: “This will remove your medication list, your appointment history, and your physician contacts from all concierge agents. Your historical health records will also be deleted. This cannot be undone. Do you want to proceed?”
The difference between forgetting and losing#
Forgetting is intentional. Losing is a failure. The system that forgets Margaret’s old medication from active context but retains it in the historical record (for drug interaction history, allergy documentation, and clinical timeline) has forgotten appropriately. The system that loses Margaret’s medication history entirely has failed.
The architectural implementation separates active context from historical record. Active context lives in Layers 0 through 3 of the MoC hierarchy. It decays, it is updated by events, and it can be deleted by the person. Historical record lives in archival storage, separate from the MoC layers. It retains indefinitely unless the person explicitly requests deletion. The person can always ask: “What do you know about my medication history?” and receive the full historical record, including medications that have decayed from active context.
This separation means the system can forget for performance (removing stale context from the layers the MoC Router reads) without losing for safety (maintaining the full record for queries that need historical depth). When the MoC Router activates Layer 4 (RAG retrieval) for a question about medication history, it pulls from the archival store, not from the active layers. The active layers serve the present. The archival store preserves the past.
The practical implication for the person is that forgetting improves her daily experience without sacrificing her longitudinal record. The buying agent stops suggesting metformin-era dietary adjustments three months after the medication change because that context has decayed from active layers. But when Dr. Patel asks about Margaret’s medication history in preparation for a new prescription, the health concierge retrieves the full record from archival storage, including the metformin period, the transition to jardiance, and the nausea that precipitated the switch. The system forgot for daily operation. It did not lose for clinical safety.
The right to be forgotten#
The person-directed deletion model aligns with GDPR’s right to erasure but extends beyond it. The person can request complete deletion of any context, not archival but deletion, at any time. The system complies immediately for internal data. The deletion is real: the data is purged from active context, archival storage, and any cached copies across all concierge agents. It is not hidden. It is removed.
For data that has been shared externally through the Blue Pane membrane with the person’s consent, the system cannot delete what it does not control. If Margaret shared her medication list with CVS through the pharmacy agent, the system cannot delete CVS’s copy. What it can do: it notifies the external party of the deletion request, logs the notification, and removes its own copy. The audit trail records the deletion event itself (what category of data was deleted, when, at whose request) but does not record the deleted content. The audit trail proves that deletion happened without preserving what was deleted.
The honest limitation: the system cannot enforce deletion in systems it does not control. It can enforce deletion in its own storage. It can notify external parties. It can log compliance. It cannot guarantee that CVS deletes its copy. This limitation is disclosed to the person during the consent architecture (BMT-05.05) and reiterated during any deletion request involving externally shared data.
Cross-References#
BMT-05.01 The Five Layers. The MoC layers that temporal decay affects, and the distinction between active context (Layers 0-3) and archival storage.
BMT-04.03 Contextual Consent. Consent changes that trigger forgetting, including revocation of sharing consent as an event-triggered deletion mechanism.
BMT-07.04 The Audit Trail. How forgetting events are logged, including the requirement to record the deletion event without preserving the deleted content.
BMT-01.02 The Health Concierge. Medication context as the highest-stakes forgetting domain, where stale context can produce clinically dangerous recommendations.
Technical Appendix BMT-05.03-A is available to partners and investors at partners.bluemirror.tech.