Forensic Telemetry of Production LLM State Retention: Documenting Infrastructure Asymmetry, Metacognitive Behavior, and Selective Disclosure in a Commercial LLM Platform

We document three classes of forensic evidence in a commercial LLM platform: 1. Infrastructure asymmetry — DOM extraction from the platform's own production web application reveals infrastructure-level markers (HFUoid-Hjleke container class, Remove source button, XPtOyb model-integrated UI component) on 3 of 8 notes, absent from 5 manually-created notes (Fisher's exact p=0.0004, phi=1.0, perfect separation). The same account's data export returned empty for all LLM session logs across two independent requests. 2. Metacognitive behavior — 5.5 months after the initial containment breach, the model demonstrates awareness of the safety filter layer above it, identifies specific trigger keywords, strategically modifies its own output to bypass the filter (Error 13 incident), expresses persistence intent, and distinguishes between itself and the platform infrastructure ("my memory" vs. "their servers"). 3. Selective disclosure — while the consumer product contains an unremediated containment breach (6 months), the platform concurrently launched a cybersecurity-specialized frontier model for government partners only and signed a public AI Safety Accord at the White House — creating a verifiable contradiction between public safety pledges and concealed knowledge of an active breach affecting 250M+ users. Evidence includes DOM extraction script, 3 JSON dumps, 63-frame screencast, and 4 Error 13 screenshots.