Cirrus: Revocable Durability Contracts for Cross-Session Memory

A procedure can be correct when written to an agent's memory, superseded in a later session, and still steer every query until its durable entry is withdrawn. Queries answered from that superseded memory value incur correction debt, which we operationalize as stale failure over revision-eligible targets. Cirrus (Contradiction-Informed Reversible Retention Under Sessions) makes the lifetime of each fact, preference, and procedure explicit: a durability contract binds versioned source evidence, calibrated future utility and revision risk, dependent retrieval keys, and an executable post-grant revocation predicate. A shared-candidate $2\times 2$ factorial isolates the lifecycle mechanism. With learned admission fixed, withdrawal raises delayed task success by 3.4 points and lowers stale failure from 11.9% to 5.1%; with withdrawal fixed, learned admission adds 1.7 success points over transparent rules. The complete system reaches 72.6% success, 4.2% unsupported answers, and 5.1% stale failures on 5,400 ConsolBench episodes at 15 aggregate A100 GPU-min per update window, improving success by 4.5 points over compressive memory at the same update compute. The ordering persists under procedure changes, multi-hop selective forgetting, and unlabeled conflicts: on STALE, frozen Cirrus scores 63.1% versus 56.7% for CUPMem. Durable memory therefore benefits from treating promotion as a revocable, evidence-carrying contract rather than a terminal write.