Replicating Belief, Not Bits: Epistemic State Replication for Agentic Systems

# Replicating Belief, Not Bits: Epistemic State Replication for Agentic Systems
Source: [https://arxiv.org/html/2607.09748](https://arxiv.org/html/2607.09748)
###### Abstract

In distributed systems, the classical State Machine Replication \(SMR\) model assumes that correct replicas execute deterministic transitions to yield identical bitwise states\. However, the rise of agentic distributed systems—where autonomous, stochastic, and model\-driven agents orchestrate infrastructure—presents scenarios where deterministic, bitwise replication is insufficient\. Replicas operating with generative models may exhibit divergent reasoning paths, summaries, and token boundaries, yet reach semantically equivalent and correct operational decisions\. Forcing bitwise agreement across these stochastic participants degrades execution flexibility, induces context amnesia, and limits performance\.

We argue that in such settings replicas should agree on*belief*, not*bits*\. We proposeEpistemic State Replication \(ESR\), a belief\-replication layer for agentic distributed systems that shifts the replication boundary from data visibility to knowledge visibility\. We formalize the epistemic node state as a pair𝒦=\(ℒ,ℬ\)\\mathcal\{K\}=\(\\mathcal\{L\},\\mathcal\{B\}\)separating the deterministic, immutable evidence log \(ℒ\\mathcal\{L\}\) from the stochastic, evolving belief lineage \(ℬ\\mathcal\{B\}\)\. To govern execution safety, we define*Semantic Linearizability*, which requires operations to reflect the latest committed operational meaning within a verifier\-bounded semantic compatibility metric, and*Bounded Eventual Coherence*, which bounds expected semantic divergence under fair delivery, monotonic evidence, bounded verifier disturbance, and a contractive graft operator\. We outline protocols for propagating derived insights using structured*epistemic deltas*, and formalize*Verifiable Semantic Rollbacks*to prune faulty premises from belief lineages without inducing context amnesia\. We prototype ESR and report preliminary simulation results that show feasibility under the stated assumptions and illustrate reductions in secondary cognitive faults\.

## 1Introduction

Distributed systems have historically operated under a deterministic consensus model\. In the classical State Machine Replication \(SMR\) paradigm\[schneider1990replication\], a set of replicas achieves reliability by starting from identical initial states and executing the same sequence of deterministic state transitions\. This model relies on a fundamental axiom: correct participants execute identical code to produce identical bitwise states\. Formally, for two correct replicasAAandBB, their states at any logical stepttmust satisfy a strict byte\-level equality:

SA​\(t\)=SB​\(t\)\.S\_\{A\}\(t\)=S\_\{B\}\(t\)\.\(1\)This deterministic axiom has formed the basis of classical distributed systems, from consensus protocols like Paxos and Raft\[ongaro2014raft\]to distributed databases and transaction managers\[bernstein1987concurrency\]\.

However, the integration of large language models \(LLMs\) and autonomous reasoning agents into cloud control planes, software delivery pipelines, and critical infrastructure presents scenarios where deterministic, bitwise replication is insufficient\[pdds2026manifesto\]\. Replicas operating with generative models may exhibit divergent reasoning paths, summaries, and token boundaries, yet reach semantically equivalent and correct operational decisions\. Forcing bitwise state agreement \(SA=SBS\_\{A\}=S\_\{B\}\) across these stochastic replicas is computationally impractical and semantically restrictive\. Generative models operate over large token spaces where minor variations in phrasing, summary structures, or token boundaries do not alter the underlying operational intent\. If a replication layer rejects transitions that are not bitwise identical, it destroys the cognitive diversity and reasoning flexibility of the participant group, triggering execution stalls\. Conversely, if the system allows replicas to drift without any consistency bounds, it risks severe coordination failures\.

At the same time, existing agentic frameworks manage memory through local recall mechanisms \(e\.g\., conversation histories, sliding context windows, and vector databases\)\. While these systems support individual agent retrieval, they lack distributed consistency, semantic coordination across replicas, and formal rollback recovery\. When an agent experiences a failure, reverting database rows \(a physical rollback\) is insufficient because the agent’s internal memory remains contaminated with flawed belief contexts\. Conversely, naive pruning of agent context to fit window limits leads to*context amnesia*: bounded context management removes or summarizes away evidence or beliefs that remain causally relevant to future safe decisions\. ESR addresses this failure mode by recording explicit justification links between beliefs and the evidence or prior beliefs on which they depend\.

To address these limitations, we proposeEpistemic State Replication \(ESR\), a belief\-replication layer for agentic distributed systems\. The core thesis is that ESR replicates*belief*, not*bits*: replicas need not agree on token sequences or prompt buffers, only on what those tokens*mean*operationally\. Concretely, ESR shifts the replication boundary from data visibility to*knowledge visibility*by decoupling physical state representations \(such as token sequences or prompt buffers\) from semantic knowledge retention\. Data visibility exposes committed physical observations; state visibility exposes concrete byte\-level or object\-level state; knowledge visibility exposes semantically compatible operational beliefs, evidence references, and admissible action boundaries\. Under knowledge visibility, replicas need not expose identical prompts, token buffers, or intermediate reasoning traces\. Rather than requiring bitwise equality, ESR maps physical states to their operational meaning or epistemic intent via an evaluation projectionE​\(S\)E\(S\)\. The correctness condition for replication is expressed as an approximate semantic relation:

dℳ​\(E​\(SA\),E​\(SB\)\)≤ϵ,d\_\{\\mathcal\{M\}\}\(E\(S\_\{A\}\),E\(S\_\{B\}\)\)\\leq\\epsilon,\(2\)wheredℳd\_\{\\mathcal\{M\}\}is a semantic distance metric\. The intent is to keep replicas within an admissible operational compatibility class even when their physical token sequences diverge\.

This paper formalizes the system model, consistency protocols, and recovery operators of ESR\. We model the epistemic node state by separating raw telemetry from belief lineage, define semantic consistency models, and propose mechanisms for propagating insights and performing verifiable rollbacks\.

Contributions\.In this paper, we make the following contributions:

- •The Epistemic Node and System Model:We formalize the anatomy of reasoning replicas, defining the*Immutable Evidence Log*, the*Belief Lineage*, and a comprehensive failure model for stochastic distributed execution\.
- •Consistency Specifications:We formalize*Semantic Linearizability*and*Bounded Eventual Coherence*in post\-deterministic environments, framing convergence in terms of bounded semantic compatibility\.
- •Epistemic Consistency Protocols:We outline methods to propagate derived reasoning across agent clusters using lightweight*epistemic deltas*and a context grafting operator \(⊕\\oplus\), providing pseudocode for core operations\.
- •Verifiable Semantic Rollbacks:We formalize a rollback protocol that alters an agent’s belief lineage to prune failed premises without causing context amnesia, and we state conditional safety invariants over the repaired lineage\.
- •System Evaluation in Simulation:We prototype the persistence layer and report preliminary simulation results in a cloud\-control\-plane setting, covering throughput, latency, and secondary\-fault behavior\.

## 2The Epistemic Node Model

To model reasoning replicas in a distributed system, we must redefine what constitutes the state of a node\. In classical state\-machine replication, a node’s state is a single bitwise representation\. In an agentic distributed system, however, the node’s state includes both physical observations of its environment and its internal cognitive interpretation of those observations\. We formalize this dual state as the*Epistemic Node Model*\.

### 2\.1Anatomy of a Reasoning Replica

An epistemic nodeiimaintains a knowledge state𝒦i​\(t\)\\mathcal\{K\}\_\{i\}\(t\)at any logical timett\. We define this state as a tuple:

𝒦i​\(t\)=\(ℒi​\(t\),ℬi​\(t\)\),\\mathcal\{K\}\_\{i\}\(t\)=\(\\mathcal\{L\}\_\{i\}\(t\),\\mathcal\{B\}\_\{i\}\(t\)\),\(3\)where:

- •ℒi​\(t\)\\mathcal\{L\}\_\{i\}\(t\)is theImmutable Evidence Log\. It contains the hard telemetry, physical transaction logs, and external events observed by the replica\. It is deterministic, append\-only, and identical across correct replicas\.
- •ℬi​\(t\)\\mathcal\{B\}\_\{i\}\(t\)is theBelief Lineage\. It represents the node’s stochastic interpretation of the evidence\. It is composed of summaries, retrieved documents, plans, and inferences\. Unlike the log, the belief lineage can diverge across different replicas while remaining semantically equivalent\.

### 2\.2Formalizing the Belief Lineage

The Belief Lineageℬi​\(t\)\\mathcal\{B\}\_\{i\}\(t\)is formally structured as a directed acyclic graph \(DAG\) of beliefs:

ℬi​\(t\)=\(VB,EB\),\\mathcal\{B\}\_\{i\}\(t\)=\(V\_\{B\},E\_\{B\}\),\(4\)where each vertexb∈VBb\\in V\_\{B\}represents a distinct belief unit, defined as a triplet:

b=\(ϕ,𝒥,τ\),b=\(\\phi,\\mathcal\{J\},\\tau\),\(5\)whereϕ\\phiis the semantic content of the belief \(e\.g\., a natural language proposition or a structured key\-value state\),𝒥⊆ℒi​\(t\)∪VB\\mathcal\{J\}\\subseteq\\mathcal\{L\}\_\{i\}\(t\)\\cup V\_\{B\}is the*justification set*containing the causal ancestors \(evidence or prior beliefs\) that led to this belief, andτ\\tauis the logical timestamp of its derivation\.

The directed edgese=\(bm,bn\)∈EBe=\(b\_\{m\},b\_\{n\}\)\\in E\_\{B\}represent logical derivation steps, meaning beliefbnb\_\{n\}was derived in part using beliefbmb\_\{m\}\(i\.e\.,bm∈𝒥nb\_\{m\}\\in\\mathcal\{J\}\_\{n\}\)\. This causal linking is what allows ESR to avoid context amnesia: it explicitly tracks which raw inputs or intermediate assumptions led to a given operational decision\.

### 2\.3The Cognitive Transaction

Mutations to the knowledge state𝒦i\\mathcal\{K\}\_\{i\}are performed via aCognitive Transaction\(C​TCT\)\. Unlike database write transactions, which apply deterministic state transitions, a cognitive transaction encapsulates a stochastic reasoning step executed by an LLM or an agent\.

Formally, a Cognitive Transaction is a mapping:

C​T:ℐ×\(ℒ×ℬ\)→𝜃𝒜×ℛ×Δ​ℬ,CT:\\mathcal\{I\}\\times\(\\mathcal\{L\}\\times\\mathcal\{B\}\)\\xrightarrow\{\\theta\}\\mathcal\{A\}\\times\\mathcal\{R\}\\times\\Delta\\mathcal\{B\},\(6\)whereℐ\\mathcal\{I\}is the input intent \(e\.g\., a user query or system alert\),ℒ×ℬ\\mathcal\{L\}\\times\\mathcal\{B\}is the active knowledge state,θ\\thetarepresents the stochastic parameters of the reasoning engine \(such as model temperature and seed\),𝒜\\mathcal\{A\}is the proposed external action or system mutation,ℛ\\mathcal\{R\}is the generated reasoning trace \(raw tokens\), andΔ​ℬ\\Delta\\mathcal\{B\}is the set of new beliefs to be committed to the lineage\.

The lifecycle of a cognitive transactionC​TCTis modeled as a state machine:

1. 1\.Proposed:The replica assembles evidence fromℒi\\mathcal\{L\}\_\{i\}and active beliefs fromℬi\\mathcal\{B\}\_\{i\}into a prompt contextCC, then runs the reasoning engine under intentℐ\\mathcal\{I\}and parameterθ\\thetato produce a proposed action𝒜\\mathcal\{A\}, traceℛ\\mathcal\{R\}, and belief deltaΔ​ℬ\\Delta\\mathcal\{B\}\.
2. 2\.Pre\-validated:A semantic quorum checks the proposed external action against the safety policy boundary𝒫\\mathcal\{P\}\. This is a pre\-execution safety gate: it authorizes, rejects, or escalates𝒜\\mathcal\{A\}before the environment is mutated\.
3. 3\.Executed:If pre\-validation succeeds, the system executes𝒜\\mathcal\{A\}against the external environment and records the observed physical outcome\.
4. 4\.Evidence\-committed:The physical observation and any resulting system mutation are appended to the shared evidence logℒ\\mathcal\{L\}using the underlying consensus protocol\.
5. 5\.Belief\-committed:The system extracts the subset ofCCcausally relevant to𝒜\\mathcal\{A\}, records it as the justification set𝒥\\mathcal\{J\}, and insertsΔ​ℬ\\Delta\\mathcal\{B\}into the lineage as a pending or active belief update according to the commit policy\.
6. 6\.Post\-validated:A semantic quorum checks that the resulting belief projection remains compatible with peer projections and policy constraints\. This is a post\-commit coherence check, distinct from the pre\-execution safety check\.
7. 7\.Finalized or Rolled back:If post\-validation succeeds, the transaction is finalized\. If post\-validation fails or execution faults, the transaction enters the rollback protocol, which repairs or removes affected beliefs before the autonomous loop resumes\.

The*semantic linearization point*of a cognitive transaction is the transition toFinalized: the physical outcome has an evidence\-log position, the belief delta has been committed to the lineage, and post\-commit semantic validation has certified the resulting projection\. The pre\-validation state is therefore not a semantic linearization point; it is only an execution\-safety gate for the proposed action\.

By structuring node state and transactions in this manner, ESR makes the justification path for any finalized action traceable even though the reasoning traceℛ\\mathcal\{R\}is stochastic and heterogeneous\.

### 2\.4System and Failure Model

We assume a distributed execution environment consisting of a set ofNNreplicated agent controllers, a shared and replicated evidence log, stochastic reasoning engines, and semantic validators\.

#### 2\.4\.1Environment Model

Replicas interact with each other and the external environment through three abstractions:

- •Replicated Agent Controllers:A set of processes\{p1,p2,…,pN\}\\\{p\_\{1\},p\_\{2\},\\dots,p\_\{N\}\\\}that coordinate state mutations\. Replicas run stochastic reasoning engines \(e\.g\., LLMs parameterized by temperatureθ\>0\\theta\>0\) to decide on mutations\.
- •Shared Evidence Log \(ℒ\\mathcal\{L\}\):An append\-only log that serves as the single source of truth for physical observations\. The log is replicated across nodes using a standard consensus mechanism \(e\.g\., Raft\)\.
- •Semantic Validators:Code modules that evaluate reasoning output or state projections against a set of safety policies𝒫\\mathcal\{P\}\.
- •External Actions \(𝒜\\mathcal\{A\}\):Operations executed on the external physical environment \(e\.g\., infrastructure orchestration, network routing updates\)\.

#### 2\.4\.2Fault Classifications

Unlike classical distributed systems, which focus primarily on network partitions and crash\-stop faults, an agentic distributed system must handle both physical and cognitive failure modes\. We explicitly distinguish the following categories:

1. 1\.Crash\-Stop Faults \(fc​r​a​s​hf\_\{crash\}\):A replica stops executing operations\.
2. 2\.Stale Evidence \(fs​t​a​l​ef\_\{stale\}\):A replica reads a prefix ofℒ\\mathcal\{L\}that lags behind the global consensus state, leading to outdated reasoning context\.
3. 3\.Hallucinated Premises \(fh​a​l​l​u​cf\_\{halluc\}\):The stochastic reasoning engine generates a propositionϕ\\phithat has no supporting evidence in the logℒ\\mathcal\{L\}\.
4. 4\.Poisoned Beliefs \(fp​o​i​s​o​nf\_\{poison\}\):An incorrect or unvalidated belief is committed to a replica’s lineage and propagated to other replicas\.
5. 5\.Model Divergence \(fd​i​vf\_\{div\}\):Nodes run heterogeneous models or experience stochastic drift, causing their reasoning traces to diverge, even under identical contexts\.
6. 6\.Semantic Verifier Errors \(fv​e​r​i​f​i​e​rf\_\{verifier\}\):A validator incorrectly approves an unsafe action \(false negative\) or rejects a safe, semantically valid action \(false positive\)\.
7. 7\.Rollback\-Triggering Faults \(fr​o​l​l​b​a​c​kf\_\{rollback\}\):Physical execution failures in the environment \(e\.g\., container crash during deployment\) that require reverting both physical state and the memory premises that authorized the action\.

#### 2\.4\.3Trust Boundary

To state the safety and liveness assumptions precisely, we define the trusted system components\. The*Trusted Computing Base*\(TCB\) consists of:

- •The physical consensus layer replicating the evidence logℒ\\mathcal\{L\}, ensuring its immutability and linearizable order\.
- •The quorum mechanism that certifies semantic replication commits\.
- •The policy boundary𝒫\\mathcal\{P\}, which defines the hard constraints that validators must enforce\.
- •The provenance metadata: while beliefs are stochastic, the justification links \(𝒥\\mathcal\{J\}\) mapping beliefs back to specific indices inℒ\\mathcal\{L\}are securely recorded and verifiable\.

## 3Semantic Linearizability and Bounded Eventual Coherence

In traditional databases, linearizability\[herlihy1990linearizability\]requires that all operations appear to execute atomically at some point in time between their invocation and response, and that any read returns the exact data written by the most recent write\. In an agentic distributed system, this standard is too strict because the physical representation of the state \(the exact token sequence in the memory buffer\) is non\-deterministic\. We therefore introduce two consistency specifications:*Semantic Linearizability*and*Bounded Eventual Coherence*\.

### 3\.1Approximate Semantic Compatibility

Let𝒮\\mathcal\{S\}denote the set of all physical node states \(raw strings, token contexts, prompt buffers\)\. We define anEvaluation FunctionEEthat projects a physical stateS∈𝒮S\\in\\mathcal\{S\}into a semanticMeaning Spaceℳ\\mathcal\{M\}:

E:𝒮→ℳ\.E:\\mathcal\{S\}\\to\\mathcal\{M\}\.\(7\)For lineage\-level reasoning, we use a belief projectionEb:ℬ→ℳE\_\{b\}:\\mathcal\{B\}\\to\\mathcal\{M\}\. When the argument is clear,EEdenotes the physical\-state projection andEbE\_\{b\}denotes the belief\-lineage projection\. The meaning spaceℳ\\mathcal\{M\}represents the set of operational intents, active policies, and system assumptions\. Rather than requiring exact semantic equality \(E​\(SA\)=E​\(SB\)E\(S\_\{A\}\)=E\(S\_\{B\}\)\), we define a metric space\(ℳ,dℳ\)\(\\mathcal\{M\},d\_\{\\mathcal\{M\}\}\), wheredℳ:ℳ×ℳ→ℝ≥0d\_\{\\mathcal\{M\}\}:\\mathcal\{M\}\\times\\mathcal\{M\}\\to\\mathbb\{R\}\_\{\\geq 0\}is a semantic distance metric\.

###### Definition 1\(ϵ\\epsilon\-Semantic Compatibility\)\.

Two physical statesSA,SB∈𝒮S\_\{A\},S\_\{B\}\\in\\mathcal\{S\}areϵ\\epsilon\-Semantically Compatible, denoted bySA≈ϵSBS\_\{A\}\\approx\_\{\\epsilon\}S\_\{B\}, if and only if:

dℳ​\(E​\(SA\),E​\(SB\)\)≤ϵ\.d\_\{\\mathcal\{M\}\}\(E\(S\_\{A\}\),E\(S\_\{B\}\)\)\\leq\\epsilon\.\(8\)

To make this definition operationally realistic, we relate semantic compatibility to admissible external actions rather than identical language model behavior\. Let𝒫a​d​m​\(S\)⊆𝒜\\mathcal\{P\}\_\{adm\}\(S\)\\subseteq\\mathcal\{A\}represent the set of external actions that are admissible under the policy boundary𝒫\\mathcal\{P\}when the replica is in physical stateSS\. Exact equality of𝒫a​d​m​\(SA\)\\mathcal\{P\}\_\{adm\}\(S\_\{A\}\)and𝒫a​d​m​\(SB\)\\mathcal\{P\}\_\{adm\}\(S\_\{B\}\)is too strong for large or structured action spaces, where many harmless low\-level choices may differ\. ESR therefore admits one of three deployment\-specific compatibility conditions:

1. 1\.Policy\-compatible selected actions:for the current intentℐ\\mathcal\{I\}and decision policyπ\\pi, the selected actionsπ​\(SA,ℐ\)\\pi\(S\_\{A\},\\mathcal\{I\}\)andπ​\(SB,ℐ\)\\pi\(S\_\{B\},\\mathcal\{I\}\)are both admissible under𝒫\\mathcal\{P\}and equivalent under the policy’s action abstraction\.
2. 2\.Safety\-critical action equivalence:for a designated safety\-critical subset𝒜c​r​i​t⊆𝒜\\mathcal\{A\}\_\{crit\}\\subseteq\\mathcal\{A\}, replicas agree on admissibility within that subset: 𝒫a​d​m​\(SA\)∩𝒜c​r​i​t=𝒫a​d​m​\(SB\)∩𝒜c​r​i​t\.\\mathcal\{P\}\_\{adm\}\(S\_\{A\}\)\\cap\\mathcal\{A\}\_\{crit\}=\\mathcal\{P\}\_\{adm\}\(S\_\{B\}\)\\cap\\mathcal\{A\}\_\{crit\}\.\(9\)
3. 3\.Bounded symmetric difference:under a task\-specific measureμ\\muover action classes, the disagreement mass remains bounded: μ​\(𝒫a​d​m​\(SA\)​△​𝒫a​d​m​\(SB\)\)≤β\.\\mu\(\\mathcal\{P\}\_\{adm\}\(S\_\{A\}\)\\triangle\\mathcal\{P\}\_\{adm\}\(S\_\{B\}\)\)\\leq\\beta\.\(10\)

These conditions preserve the safety\-relevant part of action agreement while allowing benign differences in ranking, formatting, retrieval, or non\-critical operational choices\.

##### Implementation ofEE:

In practice, the evaluation functionEEis implemented via one of the following mechanisms, depending on the latency and security constraints of the control plane:

- •Structured Policy Verifier:A deterministic logic engine \(e\.g\., using Rego or Datalog\) that evaluates whether the active belief state violates concrete infrastructure invariants\.
- •Schema\-Based Extractor:A parser that extracts key\-value parameters from natural language beliefs into a structured JSON schema, filtering out stylistic reasoning variances\.
- •Semantic Classifier:A fast, fine\-tuned classification model that determines whether two plans are equivalent under a specified ontology\.
- •Embedding \+ Thresholding:Mapping beliefs to a dense vector space using a sentence transformer model and checking if their cosine distance is within a calibrated thresholdϵ\\epsilon\.
- •Human\-Audited Validator:A human\-in\-the\-loop interface that asynchronously reviews and certifies critical state modifications\.

### 3\.2Semantic Linearizability

To define Semantic Linearizability, we must specify the nature of the replicated semantic object and its operations\.

##### Replicated Semantic Object:

The object being replicated is a semantic state projectionv∈ℳv\\in\\mathcal\{M\}\.

##### Operations:

- •Read Operation \(rr\):Queries the semantic projection of the node’s active knowledge state:r​\(\)→vr\(\)\\to v, wherev=E​\(S\)∈ℳv=E\(S\)\\in\\mathcal\{M\}\.
- •Write Operation \(w​\(e,Δ​ℬ\)w\(e,\\Delta\\mathcal\{B\}\)\):Appends new telemetry evidenceeeto the logℒ\\mathcal\{L\}and commits the set of beliefsΔ​ℬ\\Delta\\mathcal\{B\}to the lineage, resulting in a state mutation\.

##### Linearization Point:

A cognitive transactionC​TCTbecomes visible in the replicated semantic object at the transition toFinalizedin the lifecycle of Section[2\.3](https://arxiv.org/html/2607.09748#S2.SS3):

1. 1\.Its proposed evidence is committed to the shared, physically linearizable evidence logℒ\\mathcal\{L\}\(managed by classical consensus\), and
2. 2\.its proposed epistemic delta is committed to the lineage and certified by post\-commit semantic quorum validation\.

The pre\-execution quorum does not linearize semantic state; it only gates whether the external action may be attempted\.

##### Validation Stage Timing:

Semantic quorum validation happens at two critical stages in the lifecycle:

- •Pre\-Execution validation:Before an external action𝒜\\mathcal\{A\}is physically executed in the environment, a quorum must verify that𝒜∈𝒫a​d​m​\(S\)\\mathcal\{A\}\\in\\mathcal\{P\}\_\{adm\}\(S\)to prevent unsafe actions\.
- •Post\-Commit validation:After the beliefsΔ​ℬ\\Delta\\mathcal\{B\}are committed to the local lineage, a quorum verifies that the updated local state remainsϵ\\epsilon\-compatible with peer states\.

LetHHbe an execution history of invocations and responses for reads and writes\. The real\-time precedence relation≺H\\prec\_\{H\}is defined such thato​p1≺Ho​p2op\_\{1\}\\prec\_\{H\}op\_\{2\}if the response ofo​p1op\_\{1\}occurs before the invocation ofo​p2op\_\{2\}inHH\.

###### Definition 2\(Semantic Linearizability\)\.

An execution historyHHisSemantically Linearizableif it can be extended to a sequential historyUUby adding response events for pending operations and/or discarding pending operations, such that:

1. 1\.UUis equivalent to a legal sequential execution of the semantic state object: for every read operationrrinUUreturning valuev∈ℳv\\in\\mathcal\{M\}, the valuevvisϵ\\epsilon\-semantically compatible with the state generated by the most recent write operationwwpreceding it inUU: dℳ​\(v,E​\(State​\(w\)\)\)≤ϵ\.d\_\{\\mathcal\{M\}\}\(v,E\(\\text\{State\}\(w\)\)\)\\leq\\epsilon\.\(11\)
2. 2\.UUpreserves the real\-time precedence ofHH: ifo​p1≺Ho​p2op\_\{1\}\\prec\_\{H\}op\_\{2\}, theno​p1op\_\{1\}precedeso​p2op\_\{2\}inUU\.

Semantic Linearizability is therefore classical linearizability applied to a semantic projection of the state, plus verifier\-bounded semantic compatibility\. It is not a replacement for physical\-state linearizability: ESR retains classical consensus and linearizable ordering for the immutable evidence logℒ\\mathcal\{L\}, while lifting consistency for belief state to a verifier\-bounded semantic projection\. Semantic Linearizability should be understood as classical linearizability applied to a semantic projection, with compatibility determined by a trusted verifier and bounded metric, rather than as a replacement for physical\-state linearizability\.

### 3\.3Bounded Eventual Coherence

For long\-running autonomous tasks, enforcing strict linearizability on every reasoning step introduces high latency\. We relax this toBounded Eventual Coherence, which bounds the expected semantic distance among correct replicas exposed to the same evidence\. With persistent verifier or sampling error, the recurrence below does not imply probability\-1 convergence to a single point; it implies convergence to a bounded semantic neighborhood in expectation\.

##### Assumptions:

Bounded Eventual Coherence relies on the following assumptions:

1. 1\.Fair Delta Delivery:Any epistemic deltaΔe\\Delta\_\{e\}broadcast by a correct replica is eventually delivered to all correct replicas\.
2. 2\.Monotonic Evidence Availability:The evidence logℒt\\mathcal\{L\}\_\{t\}is append\-only, and correct replicas eventually receive all committed evidence entries\.
3. 3\.Bounded Semantic Domain:The active policy boundary𝒫\\mathcal\{P\}defines a compact and bounded semantic domain\.
4. 4\.Bounded Verifier/Noise Error:Letηt≥0\\eta\_\{t\}\\geq 0denote the semantic disturbance at stepttdue to validator error, stochastic sampling, retrieval variation, or repair approximation\. We assume𝔼​\[ηt∣ℱt\]≤δe​r​r\\mathbb\{E\}\[\\eta\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\]\\leq\\delta\_\{err\}for the execution historyℱt\\mathcal\{F\}\_\{t\}\. If verifier errors are modeled as classification errors with probabilitype​r​rp\_\{err\}and maximum semantic magnitudeDe​r​rD\_\{err\}, then their contribution is bounded bype​r​r​De​r​rp\_\{err\}D\_\{err\}and is included inδe​r​r\\delta\_\{err\}\.
5. 5\.Contractive Graft Operator:The grafting operator⊕\\oplusis a contraction mapping\. Specifically, for any two belief lineagesℬA\\mathcal\{B\}\_\{A\}andℬB\\mathcal\{B\}\_\{B\}and a shared epistemic deltaΔe\\Delta\_\{e\}, there exists a factorγ∈\(0,1\)\\gamma\\in\(0,1\)such that: dℳ​\(Eb​\(ℬA⊕Δe\),Eb​\(ℬB⊕Δe\)\)≤γ⋅dℳ​\(Eb​\(ℬA\),Eb​\(ℬB\)\)\.d\_\{\\mathcal\{M\}\}\(E\_\{b\}\(\\mathcal\{B\}\_\{A\}\\oplus\\Delta\_\{e\}\),E\_\{b\}\(\\mathcal\{B\}\_\{B\}\\oplus\\Delta\_\{e\}\)\)\\\\ \\leq\\gamma\\cdot d\_\{\\mathcal\{M\}\}\(E\_\{b\}\(\\mathcal\{B\}\_\{A\}\),E\_\{b\}\(\\mathcal\{B\}\_\{B\}\)\)\.\(12\)

###### Theorem 1\(Bounded Eventual Coherence\)\.

Given fair delta delivery, monotonic evidence availability, a bounded semantic domain, bounded verifier/noise errorδe​r​r\\delta\_\{err\}, and a contractive grafting operator with factorγ∈\(0,1\)\\gamma\\in\(0,1\), the semantic states of two correct replicasAAandBBsatisfy:

𝔼​\[dt\]≤γt​d0\+1−γt1−γ​δe​r​r,\\mathbb\{E\}\[d\_\{t\}\]\\leq\\gamma^\{t\}d\_\{0\}\+\\frac\{1\-\\gamma^\{t\}\}\{1\-\\gamma\}\\delta\_\{err\},\(13\)wheredt=dℳ​\(Eb​\(ℬA​\(t\)\),Eb​\(ℬB​\(t\)\)\)d\_\{t\}=d\_\{\\mathcal\{M\}\}\(E\_\{b\}\(\\mathcal\{B\}\_\{A\}\(t\)\),E\_\{b\}\(\\mathcal\{B\}\_\{B\}\(t\)\)\)\. Consequently,

lim supt→∞𝔼​\[dt\]≤δe​r​r1−γ\.\\limsup\_\{t\\to\\infty\}\\mathbb\{E\}\[d\_\{t\}\]\\leq\\frac\{\\delta\_\{err\}\}\{1\-\\gamma\}\.\(14\)For any compatibility radiusϵ≥δe​r​r/\(1−γ\)\\epsilon\\geq\\delta\_\{err\}/\(1\-\\gamma\), replicas are eventually coherent in expectation within theϵ\\epsilon\-compatibility ball\.

###### Proof Sketch\.

Letdt=dℳ​\(Eb​\(ℬA​\(t\)\),Eb​\(ℬB​\(t\)\)\)d\_\{t\}=d\_\{\\mathcal\{M\}\}\(E\_\{b\}\(\\mathcal\{B\}\_\{A\}\(t\)\),E\_\{b\}\(\\mathcal\{B\}\_\{B\}\(t\)\)\)be the semantic distance between the belief projections of the replicas at logical steptt\. Fair delivery and monotonic evidence availability imply that correct replicas eventually apply the same committed evidence entries and compatible epistemic deltas\. Letηt\\eta\_\{t\}capture residual semantic disturbance from validator error, sampling, retrieval order, and repair approximation\. By the contractive grafting assumption,

dt\+1≤γ​dt\+ηt\.d\_\{t\+1\}\\leq\\gamma d\_\{t\}\+\\eta\_\{t\}\.\(15\)Taking conditional expectation and using𝔼​\[ηt∣ℱt\]≤δe​r​r\\mathbb\{E\}\[\\eta\_\{t\}\\mid\\mathcal\{F\}\_\{t\}\]\\leq\\delta\_\{err\}gives

𝔼​\[dt\+1\]≤γ​𝔼​\[dt\]\+δe​r​r\.\\mathbb\{E\}\[d\_\{t\+1\}\]\\leq\\gamma\\mathbb\{E\}\[d\_\{t\}\]\+\\delta\_\{err\}\.\(16\)Unrolling the recurrence yields

𝔼​\[dt\]≤γt​d0\+∑k=0t−1γk​δe​r​r=γt​d0\+1−γt1−γ​δe​r​r\.\\mathbb\{E\}\[d\_\{t\}\]\\leq\\gamma^\{t\}d\_\{0\}\+\\sum\_\{k=0\}^\{t\-1\}\\gamma^\{k\}\\delta\_\{err\}=\\gamma^\{t\}d\_\{0\}\+\\frac\{1\-\\gamma^\{t\}\}\{1\-\\gamma\}\\delta\_\{err\}\.\(17\)Taking the limit superior gives the claimed steady\-state expectation bound\. The result becomes exact convergence only in the special caseδe​r​r=0\\delta\_\{err\}=0\. ∎

##### High\-Probability Implication\.

The assumptions above do not justify almost\-sure convergence\. They do, however, provide a conservative one\-sided bound\. By Markov’s inequality, for any radiusρ\>0\\rho\>0,

lim supt→∞P​\(dt\>ρ\)≤δe​r​r\(1−γ\)​ρ\.\\limsup\_\{t\\to\\infty\}P\(d\_\{t\}\>\\rho\)\\leq\\frac\{\\delta\_\{err\}\}\{\(1\-\\gamma\)\\rho\}\.\(18\)Equivalently, an asymptotic confidence level of at least1−α1\-\\alphais justified only for radiiρ≥δe​r​r/\(\(1−γ\)​α\)\\rho\\geq\\delta\_\{err\}/\(\(1\-\\gamma\)\\alpha\)\. Stronger high\-probability claims require additional distributional assumptions, such as independent bounded disturbances or sub\-Gaussian verifier noise, which are not assumed here\.

##### On the Contractive Graft Assumption\.

The contractive graft assumption is strong and should not be read as a property of arbitrary LLM reasoning\. ESR expects contraction only when grafting is mediated by a bounded ontology, deterministic or audited policy verifier, stable evidence references, explicit contradiction\-resolution rules, and a monotonic reduction of unsupported belief mass\. Without these constraints, a grafted delta may amplify divergence, introduce unsupported premises, or reorder context in ways that increase semantic distance\. The theorem therefore characterizes a disciplined protocol regime rather than generic behavior of stochastic agents\.

## 4Epistemic Consistency Protocols

To maintain semantic linearizability and bounded eventual coherence, replicas must propagate their reasoning\. In classical distributed systems, this is achieved by broadcasting raw state changes or transactional mutations\. In agentic systems, however, broadcasting the entire raw token traceℛ\\mathcal\{R\}of a cognitive transaction is highly inefficient and fills up the finite context windows of recipient nodes with redundant prompts and reasoning steps\. We propose a protocol for propagating derived insights using lightweight*epistemic deltas*and a formal grafting operator\.

### 4\.1Epistemic Deltas

When a replicaAAcompletes a cognitive transactionC​TCTthat commits new beliefsΔ​ℬA\\Delta\\mathcal\{B\}\_\{A\}to its lineage, it does not broadcast the entire transaction log\. Instead, it extracts anEpistemic DeltaΔe\\Delta\_\{e\}, which is a projection of the lineage update containing only the essential insights and their causal anchors\.

Formally, we define the epistemic delta as a set of structured beliefs:

Δe=\{b=\(ϕ,𝒥,τ,c,σ,scope\)∈ΔℬA∣is\_essential\(b\)\}\.\\Delta\_\{e\}=\\\{b=\(\\phi,\\mathcal\{J\},\\tau,c,\\sigma,scope\)\\in\\Delta\\mathcal\{B\}\_\{A\}\\mid\\\\ \\text\{is\\\_essential\}\(b\)\\\}\.\(19\)where:

- •ϕ\\phiis the semantic proposition \(e\.g\., natural language description or state variable mutation\)\.
- •𝒥⊆ℒ∪VB\\mathcal\{J\}\\subseteq\\mathcal\{L\}\\cup V\_\{B\}is the justification set containing references to evidence log indices \(e\.g\., specific log entries\) and ancestor belief identifiers\.
- •τ\\tauis the logical timestamp indicating when the belief was derived\.
- •c∈\[0,1\]c\\in\[0,1\]is the inference confidence score\.
- •σ\\sigmais a cryptographic signature from the validator certifying the belief’s policy compliance\.
- •s​c​o​p​escopedefines the policy scope \(i\.e\., which aspects of the policy boundary𝒫\\mathcal\{P\}this belief relates to\)\.

The filteris\_essential​\(b\)\\text\{is\\\_essential\}\(b\)selects key operational conclusions \(such as a mitigation strategy, a newly identified vulnerability, or a policy adjustment\) and their immediate causal justifications, filtering out intermediate reasoning tokens\.

### 4\.2The Grafting and Verification Protocols

When a replica receives an epistemic delta, it executes a multi\-stage grafting and verification protocol to integrate the remote beliefs into its local DAG\.

##### Recursive Ancestor Retrieval:

If a replica receives an epistemic deltaΔe\\Delta\_\{e\}containing a beliefbbwhose justification set𝒥\\mathcal\{J\}references parent beliefsb′b^\{\\prime\}that are missing from its local lineage DAGℬ\\mathcal\{B\}, the grafting node initiates a recursive pull request to the sender\. The grafting process blocks on these pull requests, recursively fetching and validating ancestor beliefs until the entire causal history ofbbis resolved and integrated, ensuring DAG integrity and preventing context amnesia\.

##### Contradiction Resolution and Termination:

When integrating a new beliefbb, the node checks for semantic contradictions with its active belief set using the local verifier and a semantic cache\. If a contradiction is detected, a resolving cognitive transactionC​Tr​e​s​o​l​v​eCT\_\{resolve\}is executed to evaluate the competing justifications\. To prevent infinite loops of resolving transactions \(e\.g\., replicas continuously disputing each other\), the system enforces two termination rules:

1. 1\.Priority Ordering:Replicas order contradictory beliefs by their confidence scoresccand timestampsτ\\tau\. A belief with significantly lower confidence cannot override a certified, high\-confidence belief\.
2. 2\.Recursion Bounding:Resolving transactions are bounded by a maximum depthKm​a​xK\_\{max\}\. If a contradiction is not resolved withinKm​a​xK\_\{max\}steps, the system halts the autonomous loop, falls back to a deterministic consensus arbitration, and alerts system operators\.

The grafting procedure returns an explicit status for every received delta:ACCEPTED,REPAIRED,QUARANTINED,REJECTED, orNEEDS\_OPERATOR\. A contradiction that cannot be resolved autonomously is retained in a quarantine store with its causal metadata and is made visible to the operator or deterministic arbitration layer\.

### 4\.3Protocol Pseudocode

The core protocols for extracting, grafting, verifying, and validating epistemic states are detailed in Tables[4\.3](https://arxiv.org/html/2607.09748#S4.SS3)andLABEL:alg:validate\.

Table 1:Delta Extraction and Grafting Status Protocol\.