Forget a memory

Always 200 — removed: false when the id is unknown (forge contract). The delete is scoped to ONE namespace: pass the ns the memory was written to, or it will not be found (removed: false). Class A — accepts a session JWT, an il_live_/il_test_ API key, or an il_oauth_ token. On the il_* lanes the bearer is forwarded to Kairos verbatim and Kairos enforces the credential's grant on this workspace (its 401/403 is surfaced in the v2 envelope). The response body is Kairos's, passed through unchanged; X-InfoLang-Tokens-Saved / X-InfoLang-Overage are echoed when set.

Requires the memories:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying memories:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which INCLUDES memories:write — every key minted before scoping keeps working here.