Trailryx answers with a completeness proof when it can, and says partial with the reason named when it cannot. And its store is built to erase one person on request without breaking the trail; the shipped node does not expose that yet.
Where this sits today, stated rather than implied. Trailryx reads the shared agent-event bus and seals it. It still takes plain OTLP as well, from a collector or straight over the wire, so it stays useful to somebody who has traces and no TAIPANBOX.
A question lands on one of the five dimensions the index can prove, and the matching records are a contiguous range: that contiguity is the mechanism, not a picture of it. The second question is about something nothing sorts by, so the rows are still right and the answer says so.
SQL is a facade in the tree and not yet a port in the shipped node: today you read the records through read. What every answer carries, either way, is how much of it is actually proved, because an answer of unknown completeness must not read like a proved one.
Trailryx separates the two planes so neither has to give way.
The plane the proofs are built on holds identifiers, enums, hashes, numbers and timestamps, and nothing else. Any prose lives in the encrypted payload under the subject's own key.
Forgetting drops the key. The record keeps its hash, size, class and key id, so what it committed to is still checkable and the chain around it is untouched.
A durability sweep reporting zero violations proves nothing on its own: a check that cannot fail reports zero forever. So the same harness is run against a disk that lies about its writes, and it is required to fail.
As recorded, undated, in the repository's VALIDATION.md: 400,000 seeds, roughly 800 million shard ticks, about 12 million crashes injected. Zero durability violations.
The same harness, the honest-disk assumption removed (as recorded, undated, in VALIDATION.md): 17,869 of 20,000 seeds fail, each naming its own seed and digest. That is what makes the zero above worth reading.
trailryx-verify incident-4471.trxevid
zero third-party dependencies, because an auditor reads it rather than trusting it
CostCrew writes twenty-three event types about money and about its own analysts. This plane seals the two about money with everything else and refuses the other twenty-one by name, because they record a practice rather than an agent's run.