Philosophically, I think I would disagree.

In this case, the pointer contains information to help the traversal and essentially becomes an extension of the index. As such, it is handed off to the index, and it is appropriate that the index be entrusted with destroying it.

Alternatively (if you want to adhere to the assertion), then the index could let me (the model) know that it (the index) is being destroyed, and the model can then do what it needs to clean up anything it has given to the index before said index is destroyed. That would preserve the notion that anything given to the index belongs to the model.

I don't think that breaks any design paradigms, and is consistent with the idea of the index.

my 2c
rickb