The Price of Perfect Memory
The first three equations are architectural. They describe what systems must do. The fourth is what the architecture reveals when it is complete: the limit that becomes visible only after the machinery of proof is built and working.
Build the proof architecture: a system that satisfies the five witness properties, binds coercive acts to receipts, divides power against capture, and survives adversarial pressure.
Now step back and look at what you have built.
You have built a system in which no one can become someone new.
Every attested fact about a person (every transaction processed, every credential verified, every receipt issued, every dispute filed, every appeal adjudicated) can travel to any context, compose with every other attested fact, and produce a portrait of comprehensive fidelity. The portrait is accurate. The portrait is inescapable. The portrait is also, in the most important sense, a lie, because it presents the sum of a person's documented past as equivalent to the person herself, and persons are not sums.
This is not a flaw in the design. It is the design working correctly. The witness protocol was built to make truth survive the absence of its author, and it succeeds. The receipt regime was built to make power legible, and it succeeds. The constitutional machine was built to prevent capture, and it succeeds. And the success of all three produces a system that remembers everything, composes everything, and never lets go.
Theologians would recognize the problem immediately. Confession and absolution, developed over centuries in the Catholic Church, was not merely a pastoral practice but a theory of personhood: the person who confesses is not the person who sinned, because genuine contrition constitutes a break in moral continuity. The secular tradition arrived at a similar insight by a different path: the Enlightenment's theory of punishment assumed that punishment, properly calibrated, could reform the offender, and that the reformed offender was a new person with claims upon society that the unreformed offender did not have. Both traditions recognized what the perfect-memory system denies: that persons change, and that a just society must be organized to acknowledge the change.
The danger is not that the receipt regime is wrong. The danger is that it is right about power and insufficient about persons. A system that remembers every exercise of coercive authority must also be capable of releasing its grip on the persons who were subject to that authority. The release is not automatic. It requires a deliberate architectural choice: building forgetting into the system alongside memory, making certain records expire, limiting composition across domains, creating zones where the past loses its jurisdiction over the future.
David
David is thirty-four years old and a licensed nurse. He works overnight shifts in the ICU, where his colleagues trust him with the hardest hours because he is calm under pressure and meticulous with dosages: two qualities that the person who stumbled into the emergency room at twenty-two would not have been able to claim. He coaches his daughter's soccer team on weekends. He volunteers at a clinic in the neighborhood where he grew up.
Between twenty-two and twenty-six, David was a different person, not literally, but in the sense that matters for institutional evaluation. At twenty-two, an emergency-room visit for alcohol poisoning. At twenty-three, a misdemeanor conviction for disorderly conduct, community service completed, and a termination from a restaurant job for chronic lateness during the worst of his drinking. At twenty-four, a student loan default during a period of unemployment. At twenty-five, an eviction proceeding dismissed after he paid the overdue rent, and enrollment at a community college. At twenty-six, a bankruptcy filing, discharged at twenty-seven. Between twenty-one and twenty-four, a series of social-media posts expressing political views he no longer holds and personal circumstances he would prefer not to be defined by.
The transformation was not miraculous. It was ordinary: the slow, grinding, undramatic work of changing one's life, day by day, over a decade. He stopped drinking. He paid his debts. He went back to school. He studied pharmacology and anatomy and the ethics of patient care. He passed his boards. He showed up, every shift, for four years. His credit score climbed from the low 500s to the mid 700s over eight years. The nursing degree, the licensure, the clean employment record: all document the transformation. But in a system of perfect memory, the transformation competes with the crisis for institutional attention, and the crisis has a structural advantage: it is specific, dramatic, and easily categorized, while the transformation is diffuse, gradual, and resistant to summary.
In the system as built (receipts permanent, composition unlimited) an employer running a background check on David at thirty-four encounters the ER visit, the misdemeanor, the loan default, the bankruptcy, the eviction proceeding, the employment gap, and the social-media archive, all composable into a single portrait that determines what he can do, where he can live, who he can be. The person those records describe no longer exists. The records do not know this.
Designed Forgetting
Five operations constrain the record's jurisdiction over David's future.
His emergency-room visit is twelve years old. Under expiration rules, health records related to substance use that are more than seven years old and not associated with ongoing treatment leave the composition space. An employer running a background check cannot see it. An insurance company pricing a policy cannot use it. The record still exists in the hospital's archive, accessible by court order if a future medical emergency requires the full history. But it no longer speaks in contexts where it has no legitimate business.
His misdemeanor conviction, completed with community service, is sealed. It appears in a law-enforcement database accessible to courts and certain governmental agencies. It does not appear in commercial background checks. Sealing distinguishes between the state's legitimate interest in maintaining a criminal record for sentencing purposes and the illegitimate interest of commercial actors in using a twelve-year-old misdemeanor to evaluate a person's current fitness.
Aggregation limits prevent any single system from composing David's records across more than three domains without his explicit consent. A background-check company may query each domain separately and report what it finds, but it may not join health, criminal, and financial records into a single cross-domain portrait. This prevents the composition pathology: aggregation of individually innocuous facts into a comprehensive assessment that exceeds any individual system's jurisdiction.
Separation enforces boundaries between David's social-media archive and his professional records at the protocol level. An employer may evaluate his nursing credentials and employment history. The employer may not access social-media posts from a period that predates his current career. Systems holding social-media data and those holding professional credentials are barred from communicating without David's authorization.
The eviction proceeding, dismissed after payment, is subject to jurisdictional amnesty for dismissed housing cases older than five years. David can rent an apartment without explaining a resolved legal action from nine years ago. The amnesty reflects a legislative determination that dismissed cases (cases in which the court found no ongoing obligation) should not burden the respondent's housing prospects indefinitely. Whether the amnesty applies to cases dismissed within thirty days or ninety days, whether it has exceptions for property damage or repeated nonpayment: these are political decisions made by the jurisdiction that administers the housing database. The architecture provides the mechanism by which the decisions, once made, are enforced at the protocol level.
David at thirty-four, under this architecture, is evaluated on the basis of his current credentials, his current employment record, and his current financial standing. The records of his difficult years exist: archived, sealed, separated, expired as appropriate. They are not destroyed. They are bounded, in the same way that the writ of habeas corpus does not free the prisoner but bounds the detention by requiring that it be justified, reviewed, and limited in duration.
A society that treats the twenty-two-year-old's emergency-room visit as permanently relevant to the thirty-four-year-old's employment prospects has confused documentation with identity and memory with justice.
What Designed Forgetting Is Not
Designed forgetting is not erasure. David's records persist. A court with jurisdiction can unseal any of them for cause. A medical emergency requiring his full substance-use history can access the archived hospital record. Nothing is destroyed. What is destroyed is the automatic availability of the records for composition across domains by actors who have no legitimate interest in them.
Every memoir is an act of designed forgetting: the assertion that some events matter more than others, that the person who emerges from the telling is not identical to the sum of what happened. Designed forgetting is not forgiveness. Forgiveness is a moral act performed by one person toward another: it requires a wronged party, a wrongdoer, and a relationship between them. Designed forgetting is an architectural constraint performed by a system on its own memory. The system does not forgive David. It lacks the capacity for forgiveness. What it does is refrain from presenting David's past to every institution that queries him, acknowledging that persons change and that the past's jurisdiction over the future must have limits. The restraint is constitutional: required by the same architecture that requires the receipt. Receipts constrain power by making it visible. Designed forgetting constrains the receipt by making it finite. Without the constraint, the receipt becomes a tool of the power it was designed to check.
Designed forgetting is not privacy. Privacy prevents information from being collected. Designed forgetting limits the use of information already collected. The receipt regime requires collection: every exercise of power produces a receipt, and receipts are records. A system cannot simultaneously produce receipts and prevent the existence of records. What it can do is constrain the scope and duration of the records' availability, and the constraint is what makes the receipt regime compatible with the possibility of personal transformation.
Fragments of designed forgetting already exist in law. Juvenile record sealing acknowledges that a sixteen-year-old's actions should not determine a twenty-five-year-old's possibilities. Bankruptcy discharge acknowledges that a person who has submitted to the discipline of the process should be able to re-enter economic life without carrying the failure permanently. The European Union's right to be forgotten acknowledges that search engines should not present outdated personal information indefinitely. Each mechanism is partial, domain-specific, and contested. What they share is a structural commitment: the past does not own the future, and systems that remember everything must be taught when to let go.
The Constitutional Principle
The architecture must encode a temporal asymmetry. Power-time is eternal; person-time is mortal.
Receipts for the exercise of authority persist indefinitely. The liquidation, the denial, the freeze, the suspension: these must remain inspectable as long as the institution that issued them exists. An institution that exercised coercive power fifty years ago must still answer for that exercise. Institutions do not have the capacity for transformation that persons do; the institution that denied a loan in bad faith in 1975 is structurally continuous with the institution that operates today, and the receipt of the denial is the mechanism of accountability.
Records of individual conduct must be capable of expiration, sealing, separation. The borrower who defaulted at twenty-two may be creditworthy at forty. A former convict who served his time and built a new life may be an exemplary neighbor. The person who expressed foolish opinions at nineteen may be a thoughtful citizen at thirty-five. Perfect memory denies all three possibilities. Designed forgetting restores them.
Without this asymmetry, the receipt regime becomes a system of permanent caste. A person flagged at twenty-two carries the flag forever. It composes with every other record, producing a portrait that determines what David can do, where David can live, who David can be. The receipt supposed to constrain power becomes a tool of power: wielded by institutions to determine David's future from David's past. Sociologists call this credentialed exclusion: formal records creating barriers to participation that persist long after the underlying condition has changed. A criminal-record check preventing a reformed offender from obtaining housing. A credit report presenting an eight-year-old bankruptcy as evidence of current unreliability. An employment gap raising questions regardless of what happened during the gap. In each case the record is accurate; the person has changed; and the system cannot perceive the change, because the system's perception is constituted by the record. Designed forgetting does not falsify the record. It constrains the record's jurisdiction (limiting the domains in which it can speak and the duration for which it speaks) so that the person standing before the institution is evaluated as the person she is, not as the person she was.
The Irreducible Human Element
The five operations of designed forgetting (expiration, sealing, aggregation limits, separation, amnesty) cannot be fully automated. Each requires a judgment about when a record should expire, when a seal should be applied, when aggregation should be limited, when amnesty should be granted. These are moral questions, and moral questions require human judgment.
An arbiter deciding that David's twelve-year-old emergency-room visit should expire is making a judgment about David's capacity for change. A legislature granting amnesty for dismissed eviction cases is making a judgment about whether a society wants to permanently punish resolved disputes or allow people to move on. A court sealing a juvenile record is making a judgment about whether a sixteen-year-old's actions should determine a twenty-five-year-old's possibilities.
None of these judgments can be encoded in a rule that applies universally. The twelve-year rule for substance-use records is a useful default, but there will be cases where the default is wrong in both directions. Rules provide the floor; arbiters navigate the exceptions. Exceptions are not failures of the rule. They are the zone where the rule meets the world, and the world is more various than any rule can anticipate.
The architecture must include, at its center, a position that can only be occupied by a human being. Not because humans are infallible, not because human judgment is always correct, but because the alternative (a system that remembers everything and applies rules without exception) cannot recognize the person standing before it as anything other than the sum of their documented past. A system can calculate. It can categorize. It can compare a person's record to a statistical baseline and determine deviation. What it cannot do is look at the person and perceive that the statistical summary, however accurate as a description of the past, is not a description of the future, because the person has changed in ways the record does not capture and the algorithm cannot detect.
The arbiter who reads David's record and says nevertheless performs an act that is neither computational nor arbitrary. It is an exercise of judgment informed by evidence, constrained by institutional norms, and accountable to review, but irreducibly human in its core operation: the recognition that a documented past is not a sentenced future. The arbiter does not ignore the record. She reads it, considers the transformation, weighs the evidence of change against the evidence of risk, and decides that the balance favors the person standing before her. The decision may be wrong. But a system that never exercises this kind of judgment (that applies the record without considering the transformation) will be wrong more often and wrong in a way that is structurally irremediable: not a mistake in judgment but an absence of judgment.
No protocol can forgive. No algorithm can look at a person and say: you are more than the sum of your documented failures. The arbiter who reads the record and says nevertheless performs an act no machine can supply. That act is mercy, and mercy is the fourth equation's irreducible demand.
C12. Without a mercy threshold, receipted coercion becomes permanent caste. Mercy is the constraint that prevents verification costs from diverging: the cost of redemption must not exceed the cost of the original offense. If a receipted system without designed forgetting produces no pathology of permanent exclusion, this claim is wrong.