Clarify offline verifiability and disclosure dimensions, especially for payload deletion

[Jenziner]

Part of: recordweb/rwc#1
Related: #1, #2

Problem

RWP Ch. 13 ("Payload Deletion") specifies that when a payload is
deleted, the DID, metadata, version graph structure, and payload hashes
are retained, while the payload content itself is irrevocably removed.
This is designed to satisfy GDPR/DSG erasure rights while preserving
provable existence of the Record (RWC section 11.1).

What is not currently specified is how this affects a verifier that
encounters such a Record offline, i.e. without contacting the
originating system in real time:

• Can a verifier distinguish "payload was deleted under a documented
  legal basis" from "payload is temporarily unavailable" or "system is
  unreachable" purely from what it can resolve offline?
• Is the deletion event itself (documented as a finalized Record event,
  per Ch. 13) required to be co-locatable/retrievable together with the
  original Record's metadata, or can it be resolved separately with a
  time lag?
• Does answering "was this Record ever complete/valid" require an
  online round-trip to the namespace's resolver, or can it be answered
  purely from locally cached DID documents and hashes?

Reference model

Suzuki & Abe (2026) characterize each verification function along
three dimensions: placement (where a function is executed),
timing (when, relative to the transaction), and disclosure
(how much is revealed, to whom). They use this to explain why some
credential ecosystems support offline verification and others do not,
and what privacy trade-offs each choice implies.

Why this matters for RecordWeb specifically

RecordWeb's use cases explicitly include legal disputes years after the
fact (RWC section 10.1, "three years later, in a legal dispute...") and
parliamentary oversight (RWC section 10.4), both scenarios where a
verifier may not have real-time access to the original system, and
where payload deletion may have occurred in the meantime. The current
spec does not state what a verifier can conclusively determine in this
situation without an online query.

Proposed direction (open for discussion)

Add a subsection to Ch. 13 (or a new subsection in the proposed
verifier-requirements chapter from #1) that specifies, per
the placement/timing/disclosure dimensions:

1. What MUST be resolvable offline (e.g. deletion event metadata
   co-located with the DID document) versus what MAY require an online
   resolver query.
2. What a verifier is entitled to conclude from an offline-resolvable
   deletion event alone (e.g. "Record existed and was validly deleted
   under legal basis X on date Y") versus what it cannot conclude
   without additional online confirmation.
3. Whether Case Merkle roots (Ch. 8.4/RWC section 3.4/10.4) remain
   independently verifiable offline even after linked Records have had
   payloads deleted.

Reference

Suzuki, S. & Abe, R. (2026). A Verifier-Centric Conceptual Model for
Digital Credential Ecosystems. Preprint. https://arxiv.org/abs/2607.10747