Counterexample: a connector grant is revoked at epoch 8, but an import message created under epoch 7 is delayed. The primary store deletes its copy, then the delayed consumer writes a derived card back into a cache. Every component “worked,” yet the system did not converge on revoked. Revocation needs a protocol, not a broadcast best effort.
The motivating news is OpenAI’s July 23, 2026 Health in ChatGPT announcement. OpenAI says rollout is to eligible logged-in US users age 18+ on web and iOS, with supported medical-record and Apple Health connections; the dashboard can cover labs, medications, activity, sleep, and other health information. OpenAI states connected data and relevant conversations are not used to train foundation models or target ads. These are attributed claims from the primary announcement, not evidence about internal architecture or deletion behavior.
Assumptions and invariant
Assume at-least-once event delivery, independently retrying consumers, temporary partitions, caches, derived views, and no global transaction. Policy defines which objects must be deleted, retained, or detached; the protocol must carry that decision without inventing it.
The central invariant is:
