propositions
The propositions this run produced that this tenant still holds.
Both reads resolve against the proposition store every time, rather than trusting the map. A link records that a run produced a claim; if the claim is deleted, or its id now belongs to another tenant, there is nothing left for the link to be about. A graph gets this for free — the edge is detached with the node — so a reference implementation answering from its own map would keep reporting lineage for claims the store no longer has, and the two backends would disagree. Answering from live endpoint state costs a lookup per id and is the only way this store can be held to the same contract.
Nothing here is told when a proposition is deleted, so the stale entries are pruned when a read finds them: an id the proposition store no longer holds at all is dropped from the run's set, and an emptied set is dropped with it. An id that exists but reads as another tenant's is filtered and left alone, since a read from the wrong tenant must change nothing. The answer is the same either way; what changes is that the map stops growing with claims that no longer exist.