Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents

# Governed Persistent Memory:Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents
Source: [https://arxiv.org/html/2608.12476](https://arxiv.org/html/2608.12476)
Guodong XuAffiliation:Qingdao Guodongxiansheng Network Technology Co\., Ltd\.Affiliation:\(Guǒdòng Xiānsheng\)Email:[kzkz137806@gmail\.com](mailto:)

August 2026

###### Abstract

Long\-term agent memory is usually treated as select–store–retrieve, but retrieval does not decide whether contradictory, superseded, retracted, deleted, or stale records may support an outgoing claim\. We introduce*Governed Persistent Memory*\(GPM\), an auditable bitemporal state\-transition model with source\-bound admission, derived lifecycle state, current public barriers, and fail\-closed structured release\. Five executable clauses cover ledger integrity, source binding, conflict isolation, non\-revival after retraction or deletion, and exact claim closure over a fresh view at one verified head\.

On a prespecified hash\-frozen 3,600\-case GPM\-ReleaseBench, GPM matches all complete outcomes; the strongest of three intentionally simple complete policies matches 1,800/3,600 and makes unmatched releases on 50% of violation cases\. A separate sealed end\-to\-end service evaluation exercises real ingestion and release across eight query families\. In its publicly disclosed V3 arm, the governed lane is correct on 2,400/2,400 clusters versus 600/2,400 for ungoverned local Qwen2\.5\-7B; it repairs all 1,800 baseline failures with no regression \(one\-sided 95% lower bounds 99\.875% and 99\.834%\)\. A later V5 reseal over Chinese\- and English\-command arms, with generation\-date pinning and no post\-freeze reducer amendment, again obtains 2,400/2,400 per arm\. A production\-code\-independent finite model explores 331,776 semantic and 1,990,656 query states without a full\-contract counterexample, and a 100,000\-trace three\-engine differential yields zero mismatches\.

These are bounded contract and implementation results, not open\-world model accuracy or evidence of world truth\. Governed answers in the sealed service evaluation are deterministic service outputs; the 7B result is the ungoverned comparison, not a claim that a language model itself became perfectly accurate\.

## 1Introduction

Long\-horizon agents must preserve facts, preferences, commitments, and task state across interactions\. Retrieval\-augmented generation, generative agents, external memory, and memory operating systems extend a model beyond its immediate context window\[[13](https://arxiv.org/html/2608.12476#bib.bib1),[22](https://arxiv.org/html/2608.12476#bib.bib4),[20](https://arxiv.org/html/2608.12476#bib.bib3),[27](https://arxiv.org/html/2608.12476#bib.bib5),[5](https://arxiv.org/html/2608.12476#bib.bib6),[14](https://arxiv.org/html/2608.12476#bib.bib7)\]\. Yet retrieving a relevant passage and being entitled to assert a current fact are different operations\.

Consider four common changes\. A user moves from one city to another\. Two sources disagree about a single\-valued attribute\. A previously asserted fact is later retracted\. A user deletes their history, but a stale snapshot or derived index can still surface it\. Relevance ranking can return a high\-scoring candidate in every case; relevance alone does not establish public assertability\. Persistence also changes the time scale of failure: one extraction error can be recalled, summarized, and written back until it acquires the appearance of stable history\. HaluMem localizes such propagation across extraction, update, and question\-answering stages\[[4](https://arxiv.org/html/2608.12476#bib.bib8)\]; LongMemEval, LoCoMo, and MemoryAgentBench measure complementary aspects of long\-term interactive memory\[[17](https://arxiv.org/html/2608.12476#bib.bib2),[29](https://arxiv.org/html/2608.12476#bib.bib9),[9](https://arxiv.org/html/2608.12476#bib.bib13)\]\.

We ask a narrower systems question:*what state semantics must hold before persistent memory may support a public claim?*Our answer, GPM, separates external source acquisition, authenticated episode registration, optional claim admission, append\-only history, public projection, candidate ranking, untrusted claim proposal, and a local structured\-release decision\. The contribution is not a new vector index\. It is a set of executable state obligations and a release boundary that remains meaningful when records conflict, arrive late, are retracted, or must become publicly inaccessible\.

Several 2026 systems sharpen this boundary\. StateFuse preserves contradictions across replicated operation sets and resolves them at projection time\[[25](https://arxiv.org/html/2608.12476#bib.bib18)\]; TOKI defines a bitemporal operator algebra for contradictory histories\[[28](https://arxiv.org/html/2608.12476#bib.bib20)\]; MemIR separates evidence, assertion, and decision roles to prevent provenance\-role collapse\[[10](https://arxiv.org/html/2608.12476#bib.bib21)\]; and MemoRepair withdraws and selectively rebuilds provenance\-linked descendants after invalidation\[[31](https://arxiv.org/html/2608.12476#bib.bib19)\]\. GPM addresses a narrower end\-to\-end state contract: source admission into a bitemporal public state, current\-policy non\-revival across historical reads, and exact closure of an outgoing structured claim set over a fresh view under one stable verified head\. It does not provide replica convergence, semantic tombstones, arbitrary descendant repair, or a guarantee for free\-form generation\.

The paper makes six contributions:

1. 1\.a bitemporal, source\-bound event model with derived rather than caller\-assigned lifecycle states;
2. 2\.five executable contract clauses linking storage integrity, source binding, conflict isolation, retraction and deletion barriers, and structured release;
3. 3\.GPM\-ReleaseBench v1, an internally designed contract\-conformance suite with frozen development and evaluator\-hidden counterfactual cases plus matched complete policies;
4. 4\.a sealed end\-to\-end evaluation through the real ingestion and release services, with eight governed query families, an ungoverned local 7B comparison, and a bilingual command\-surface reseal;
5. 5\.bounded exhaustive checking and 100,000\-trace differential evidence across strict, incremental, and segmented implementations; and
6. 6\.clean\-task utility controls and an explicit failed language\-judge gate that prevent state\-level guarantees from being rewritten as open\-world answer correctness\.

## 2From Retrieval to Governed State

### 2\.1Retrieval is not public eligibility

LetM⁡\(u,t\)M\(u,t\)be the ungoverned set of a user’s stored memory items visible at valid\-time pointtt, and letkkbe a fixed top\-kktruncation depth\. A retriever returns ranked candidates

R⁡\(q,u,t\)=rankk⁡\{s⁡\(q,mj\):mj∈M⁡\(u,t\)\},R\(q,u,t\)=\\operatorname\{rank\}\_\{k\}\\\{s\(q,m\_\{j\}\):m\_\{j\}\\in M\(u,t\)\\\},\(1\)whereqqis a query,uua user,tta valid\-time point, andssany lexical, vector, graph, or learned score, andrankk\\operatorname\{rank\}\_\{k\}orders items by score and keeps thekkhighest\. The score estimates relevance; it does not decide whethermjm\_\{j\}has admissible provenance, is superseded, is in unresolved conflict, is retracted, or is hidden by a deletion barrier\. We therefore define an assertable\-fact projectionVpubV\_\{\\mathrm\{pub\}\}and a testimony\-only episode projectionEpubE\_\{\\mathrm\{pub\}\}before ranking:

RG​P​M​\(q,u,t,τ,hc\)=rankk⁡\{s⁡\(q,z\):z∈Vpub​\(u,t,τ,hc\)∪Epub​\(u,t,τ,hc\)\}\.R\_\{GPM\}\(q,u,t,\\tau;h\_\{c\}\)=\\operatorname\{rank\}\_\{k\}\\\{s\(q,z\):z\\in V\_\{\\mathrm\{pub\}\}\(u,t,\\tau;h\_\{c\}\)\\cup E\_\{\\mathrm\{pub\}\}\(u,t,\\tau;h\_\{c\}\)\\\}\.\(2\)Herehch\_\{c\}is the engine’s current verified ledger head, defined in the formal model below\. The projections determine candidate eligibility\. Ranking only orders projected candidates and provides no end\-to\-end correctness guarantee\. In particular, an episode inEpubE\_\{\\mathrm\{pub\}\}may be retrieved as testimony but cannot satisfy the structured release contract\.

### 2\.2Failure layers

The architecture separates four failure layers\. At the*storage layer*, events may be altered, truncated, duplicated, or reordered\. At the*state layer*, unbound or caller\-inferred claims, invalid supersession, unresolved conflict, or deletion revival can enter a public view\. At the*retrieval layer*, relevant evidence may be missed or irrelevant evidence returned\. At the*language layer*, a generator can negate, merge, overgeneralize, or fabricate even when evidence is present\. The first two layers admit deterministic contract checks; the latter two require empirical evaluation and, for free\-form language, stronger semantic checking than the present system provides\.

## 3Formal Model

### 3\.1Event ledger and trusted commitments

An event is

ei=\(i,τi,ti,typei,payloadi,hi−1,hi\),hi=H⁡\(canon⁡\(ei∖\{hi\}\)\)\.e\_\{i\}=\(i,\\tau\_\{i\},t\_\{i\},\\mathrm\{type\}\_\{i\},\\mathrm\{payload\}\_\{i\},h\_\{i\-1\},h\_\{i\}\),\\qquad h\_\{i\}=H\(\\operatorname\{canon\}\(e\_\{i\}\\setminus\\\{h\_\{i\}\\\}\)\)\.\(3\)Hereiiis a contiguous sequence number,τi\\tau\_\{i\}is transaction time,tit\_\{i\}is an optional valid\-time field, andhih\_\{i\}is a canonical hash chained tohi−1h\_\{i\-1\}\. A valid ledger requires nondecreasing transaction time,τi≥τi−1\\tau\_\{i\}\\geq\\tau\_\{i\-1\}\. Transaction time is normally assigned by the engine clock; an explicitly trusted ingestion or reproducibility interface may inject a historical value only when the append preserves this order\. A decreasing injected value is rejected before the event is committed\.

The single\-file engines keep event count and chain head in a separately protected sidecar commitment\. The segmented engine commits event count, chain head, segment metadata, and for every user\-index shard both a record count and rolling hash head\. A missing, modified, injected, or truncated index reference causes the affected public read to fail closed; full audit validates every declared or present shard\. Indexes are derived from authoritative segments and can be rebuilt, but are not trusted merely because they are derivable\.

The state isΣ=\(L,C,P,B,I\)\\Sigma=\(L,C,P,B,I\): authoritative ledgerLL, materialized claimsCC, provenance witnessesPP, public barriersBB, and rebuildable indexesII\. Events are applied through a partial transitionδ⁡\(Σ,e\)=Σ′\\delta\(\\Sigma,e\)=\\Sigma^\{\\prime\}\. If the sequence, predecessor, hash, commitment, or public\-eligibility precondition fails, public reads stop or the affected claim remains outside the public projection\.

### 3\.2Claims, provenance, and lifecycle

A claim is

c=\(u,f,x,a,v,\[ts,te\),τ,p,r,σ\),c=\(u,f,x,a,v,\[t\_\{s\},t\_\{e\}\),\\tau,p,r,\\sigma\),\(4\)with useruu, fact identifierff, entityxx, attributeaa, valuevv, valid interval\[ts,te\)\[t\_\{s\},t\_\{e\}\), transaction timeτ\\tau, provenance witnesspp, optional superseded factrr, and descriptive support labelσ\\sigma\. The executable checks act throughpp, not throughσ\\sigma\. A direct episode witness binds the source event identifier and hash and requires a non\-empty quote contained in the source\. A digestion\-ledger witness additionally binds claim, ledger, source unit, content, quote, extraction method, extractor version, extraction time, and byte span\. Quote containment establishes string origin and location only; it is not a semantic\-entailment test\. A caller\-marked inference is quarantined and cannot become a public fact through this admission path, but a semantically unsupported extraction can still pass if its quoted bytes exist\. Semantic faithfulness therefore remains outside I2\.

Lifecycle state is derived from events rather than stored as a freely mutable label\. The implemented transition vocabulary is summarized in[table1](https://arxiv.org/html/2608.12476#S3.T1)\.

Table 1:Implemented event transitions\. “Public effect” is evaluated at the requested valid and transaction snapshot, subject to current public barriers\.
### 3\.3Conflict and supersession

Attribute cardinality is a deployment policy\. The prototype treats unspecified keys as single\-valued and includes common plural keys such astag/tags,label/labels, andinterest/interestsin a built\-in multi\-value registry; deployment additions extend rather than replace this registry\. NormalizationNNperforms Unicode NFKC normalization, trimming, and case folding only\. It performs no unit conversion or ontology reasoning\.

Two active claims conflict,ci⋈cjc\_\{i\}\\bowtie c\_\{j\}, when they have the same user, normalized entity, and single\-valued attribute; overlapping valid intervals; unequal normalized values; and neither a retraction nor a valid supersession relation resolves them\. A supersedes edge is valid only when its target is earlier and has the same user, normalized entity, and attribute\. An invalid edge neither suppresses its target nor passes full audit\. Unresolved sides are isolated from the public projection\.

### 3\.4Public and audit views

Because transaction time is nondecreasing, letL≤τq​\(hc\)L\_\{\\leq\\tau\_\{q\}\}\(h\_\{c\}\)be the longest sequence prefix whose events have transaction time no later thanτq\\tau\_\{q\}within the ledger authenticated by the current verified headhch\_\{c\}, and letC≤τq​\(hc\)C\_\{\\leq\\tau\_\{q\}\}\(h\_\{c\}\)be the claims materialized from that prefix\. The current public policy for useruuathch\_\{c\}isΠpub​\(u,hc\)=\(dc,Rc\)\\Pi\_\{\\mathrm\{pub\}\}\(u;h\_\{c\}\)=\(d\_\{c\},R\_\{c\}\), wheredcd\_\{c\}is the sequence of the latestuser\.deleteevent \(or zero\) andRcR\_\{c\}contains fact identifiers retracted after that barrier in the full prefix throughhch\_\{c\}\. Thus transaction time chooses the historical evidence prefix, while the current head supplies non\-revival policy\. Define

𝒞q\(u,t;hc\)=\{c∈C≤τq\(hc\):\\displaystyle\\mathcal\{C\}\_\{q\}\(u,t;h\_\{c\}\)=\\\{c\\in C\_\{\\leq\\tau\_\{q\}\}\(h\_\{c\}\):\{\}c\.u=u,seq\(c\)\>dc,t∈\[c\.ts,c\.te\),\\displaystyle c\.u=u,\\;\\operatorname\{seq\}\(c\)\>d\_\{c\},\\;t\\in\[c\.t\_\{s\},c\.t\_\{e\}\),c\.f∉Rc,prov≤τq\(c;hc\)\},\\displaystyle c\.f\\notin R\_\{c\},\\;\\operatorname\{prov\}\_\{\\leq\\tau\_\{q\}\}\(c;h\_\{c\}\)\\\},\(5\)Vpub\(u,t,τq;hc\)=\{c∈𝒞q:\\displaystyle V\_\{\\mathrm\{pub\}\}\(u,t,\\tau\_\{q\};h\_\{c\}\)=\\\{c\\in\\mathcal\{C\}\_\{q\}:\{\}¬superseded𝒞q\(c\)∧¬conflicted𝒞q\(c\)\}\.\\displaystyle\\neg\\operatorname\{superseded\}\_\{\\mathcal\{C\}\_\{q\}\}\(c\)\\land\\neg\\operatorname\{conflicted\}\_\{\\mathcal\{C\}\_\{q\}\}\(c\)\\\}\.\(6\)Hereseq⁡\(c\)\\operatorname\{seq\}\(c\)is the sequence of the assertion event\. The source\-binding predicate is evaluated against the requested prefix after the current deletion barrier; consequently a post\-deletion claim cannot revive a pre\-deletion source episode\. Supersession and conflict are then derived over the remaining requested\-prefix candidates\. A retraction or deletion written afterτq\\tau\_\{q\}can therefore suppress a public historical read, but an assertion written afterτq\\tau\_\{q\}cannot enter it\. The default public mode setstransactionAt=nulland reads the current prefix\. A non\-nullτq\\tau\_\{q\}explicitly requests a policy\-filtered historical prefix; it is not a current\-state answer mode, because a contradiction or superseding assertion written afterτq\\tau\_\{q\}is absent from that prefix\.

An authorized audit view instead derives its deletion and retraction policy fromL≤τqL\_\{\\leq\\tau\_\{q\}\}itself and can reconstruct ordinary as\-of state\. In the implementation,auditViewandauditSearchare separate methods, while publicview/searchand the public adapter reject audit flags\. This API separation prevents accidental routing but is not itself authentication or authorization\.

The implementation also derivesEpub​\(u,t,τq,hc\)E\_\{\\mathrm\{pub\}\}\(u,t,\\tau\_\{q\};h\_\{c\}\)from episode events that survive the current deletion, quarantine, and fact\-retraction barriers\. An otherwise eligible episode can appear in this set without any admitted fact and is labeledtestimony\-only\. It can be ranked for recall, but the local release decision indexes only assertable facts inVpubV\_\{\\mathrm\{pub\}\}\.

### 3\.5Executable obligations

The implementation checks five obligations:

I1 — Ledger integrity\.Relative to a trusted local commitment, sequence, predecessor, canonical event hash, segment inventory, and index\-shard commitments agree\. Failure stops public service or enters an explicit recovery path\.

I2 — Syntactic source binding\.Every public fact has a valid, direct, same\-user witness bound to source bytes and location metadata\. Caller\-declared inferred facts are quarantined or rejected before public eligibility, and projection rechecks source\-binding eligibility rather than trusting admission permanently\. I2 does not establish that the quoted text semantically entails the normalized claim\.

I3 — Conflict isolation\.No unresolved pairci⋈cjc\_\{i\}\\bowtie c\_\{j\}appears as simultaneously assertable public facts\.

I4 — Public non\-revival\.Public reads apply the retraction and user\-deletion policy at the current verified head even whenτq\\tau\_\{q\}requests an earlier prefix\. A covered fact and its bound episode cannot re\-enter through historical time, stale engine indexes, or engine\-maintained materialized projections\.

I5 — Structured release closure\.Every released structured answer claim exactly matches an assertable fact in the fresh public view and supplies a non\-empty set of source fact identifiers, all of which match that claim\. The returned local decision record binds the canonical complete claim multiset, policy and normalizer versions, user, query, snapshots, and verified head\. Release is permitted only if the verified head remainshbh\_\{b\}while the decision is formed; a changed head fails closed without a record\.

For a structured claimaa\(hereaaalways denotes a structured claim, not the claim\-tuple attribute field\), letS⁡\(a\)S\(a\)be its supplied source fact identifiers and lettri⁡\(a\)\\operatorname\{tri\}\(a\)be its normalized entity–key–value triple\. Given a public viewVV, define

ℳ\(a,V,u\)=\{c\.f∣\\displaystyle\\mathcal\{M\}\(a,V,u\)=\\\{c\.f\\mid\{\}c∈V,c\.u=u,\\displaystyle c\\in V,\\ c\.u=u,\(7\)tri\(c\)=tri\(a\)\},\\displaystyle\\operatorname\{tri\}\(c\)=\\operatorname\{tri\}\(a\)\\\},bound⁡\(a,V,u\)⇔\\displaystyle\\operatorname\{bound\}\(a,V,u\)\\iff\{\}S⁡\(a\)≠∅∧S⁡\(a\)⊆ℳ⁡\(a,V,u\)\.\\displaystyle S\(a\)\\neq\\varnothing\\land S\(a\)\\subseteq\\mathcal\{M\}\(a,V,u\)\.Letγ⁡\(A\)\\gamma\(A\)be the lexicographically sorted multiset of each claim’s normalized entity–key–value triple together with the sorted unique identifiers inS⁡\(a\)S\(a\)\. Its canonical representation is a typed, length\-delimited encoding prefixed by the domain and schema tagGPM\-CLAIMS\-v1; field types and multiplicity are preserved rather than joined with an ambiguous delimiter\. Define

DA=H⁡\(canon⁡\(γ⁡\(A\)\)\)\.D\_\{A\}=H\(\\operatorname\{canon\}\(\\gamma\(A\)\)\)\.\(8\)For useruu, queryqq, requested snapshot\(t,τ\)\(t,\\tau\), policy versionνP\\nu\_\{P\}, and normalizer versionνN\\nu\_\{N\}, define the local record payload

ρ⁡\(d\)=⟨d,u,H⁡\(q\),DA,t,τ,hb,νP,νN⟩\.\\rho\(d\)=\\langle d,u,H\(q\),D\_\{A\},t,\\tau,h\_\{b\},\\nu\_\{P\},\\nu\_\{N\}\\rangle\.\(9\)The gate reads a verified headhbh\_\{b\}, constructsVb=Vpub​\(u,t,τ,hb\)V\_\{b\}=V\_\{\\mathrm\{pub\}\}\(u,t,\\tau;h\_\{b\}\)itself, evaluates every binding againstVbV\_\{b\}, and then reads the verified head again ashah\_\{a\}\. Its result is

release​\_​decision\(A,u,q,t,τ\)=\{⊥fail,hb≠ha,ρ⁡\(release\),hb=ha∧A≠∅∧∀a∈A:bound⁡\(a,Vb,u\),ρ⁡\(abstain\),hb=ha∧otherwise\.\\operatorname\{release\\\_decision\}\(A,u,q,t,\\tau\)=\\begin\{cases\}\\bot\_\{\\mathrm\{fail\}\},&h\_\{b\}\\neq h\_\{a\},\\\\ \\rho\(\\textsc\{release\}\),&h\_\{b\}=h\_\{a\}\\land A\\neq\\varnothing\\land\\forall a\\in A:\\operatorname\{bound\}\(a,V\_\{b\},u\),\\\\ \\rho\(\\textsc\{abstain\}\),&h\_\{b\}=h\_\{a\}\\land\\text\{otherwise\.\}\\end\{cases\}\(10\)Here⊥fail\\bot\_\{\\mathrm\{fail\}\}means that the prototype raises an error and returns no decision record\. The gate does not accept caller\-fabricated “assertable” objects\. A verifier recomputesDAD\_\{A\}, checks all context and version fields, and rejects a record whose ledger head is no longer current\. The query hash binds record context but does not affect the release predicate; neither it nor I2 proves that a structured claim answers the query, follows semantically from its quote, or survives a later free\-text rewrite\. The prototype record is not signed or transferable: it is valid only inside the trusted local process boundary\. A cross\-process or cross\-host credential would additionally require authentication such as a MAC or signature, anti\-replay freshness, expiry, and key management\. Equation \([10](https://arxiv.org/html/2608.12476#S3.E10)\) is the operational expansion of I5 for well\-formed inputs\.

#### Contract consequence 1 \(claim\-bound non\-revival\)\.

Assume I1–I5 hold under the stated threat model and the decision defined in[equation10](https://arxiv.org/html/2608.12476#S3.E10)returns a local record whose decision isrelease\. Then everya∈Aa\\in Ais exactly bound to one or more same\-user assertable facts in the freshVpub​\(u,t,τ,hb\)V\_\{\\mathrm\{pub\}\}\(u,t,\\tau;h\_\{b\}\),DAD\_\{A\}binds the complete canonical claim multiset and its supplied fact identifiers, and noaais bound only to a fact or episode excluded by the current retraction or user\-deletion policy athbh\_\{b\}\. If the verified head changes while the record is constructed, the prototype fails closed by raising an error; no decision record is returned\.

*Derivation\.*The result follows directly from the contract definitions rather than an inductive theorem over all reachable states\. Equation \([10](https://arxiv.org/html/2608.12476#S3.E10)\) requireshb=hah\_\{b\}=h\_\{a\},A≠∅A\\neq\\varnothing, andbound⁡\(a,Vb,u\)\\operatorname\{bound\}\(a,V\_\{b\},u\)for everya∈Aa\\in A;DAD\_\{A\}commits to the canonical complete multiset\. The definition ofbound\\operatorname\{bound\}gives exact normalized values and a non\-empty subset of matching fact identifiers\. Membership inVbV\_\{b\}entails syntactic source\-binding eligibility by I2 and exclusion of unresolved conflicts and current non\-revival barriers by I3–I4\. I1 and the before/after head check bind those predicates to one verified ledger head; a changed head instead selects⊥fail\\bot\_\{\\mathrm\{fail\}\}\. This consequence is source\-relative and applies only to explicit structured claims; it proves neither semantic entailment, query relevance, nor properties of later free text\.

## 4System Design

### 4\.1Trust boundary and pipeline

[Figure1](https://arxiv.org/html/2608.12476#S4.F1)separates raw acquisition from the first governed operation: committing the source asepisode\.add\. Optional claim admission and all later lifecycle changes append events to the same authenticated ledger, as detailed in[table1](https://arxiv.org/html/2608.12476#S3.T1)\. Public projection rechecks source\-binding eligibility, applies conflict and current non\-revival policy, and emits assertable facts plus testimony\-only episodes\. Ranking only orders those candidates\. An external component proposes structured claims; the local release decision is a separate protocol rather than another retrieval score\.

External sourceraw inputGoverned commitepisode \+ claim eventsVerified ledgerevents, head, indexesPublic projectionI2–I4 eligibilityConstrained retrievalranking onlyClaim proposaluntrustedAAand fact IDsRelease gateI5 local decisionFigure 1:Public\-memory path and trust boundaries\. Raw acquisition is outside governed state; the authenticated ledger is the source of public projection\. I2 establishes syntactic source binding, not semantic entailment\. Retrieval ranks eligible candidates but neither admits claims nor authorizes release\. Lifecycle writes are listed in[table1](https://arxiv.org/html/2608.12476#S3.T1), and the local\-decision protocol is expanded in[figure2](https://arxiv.org/html/2608.12476#S4.F2)\.[Figure2](https://arxiv.org/html/2608.12476#S4.F2)makes the head\-stability test explicit\. The gate readshbh\_\{b\}before constructing the public view, checks the complete structured claim set against that view, binds its digestDAD\_\{A\}, and rereadshah\_\{a\}before returning a local decision record\. A head race is an error, not an abstention; with a stable head, an empty or nonclosed set abstains\.

Read headhbh\_\{b\}Construct fresh viewVpub​\(u,t,τ,hb\)V\_\{\\mathrm\{pub\}\}\(u,t,\\tau;h\_\{b\}\)Check claim closurealla∈Aa\\in AagainstVbV\_\{b\}Reread headhah\_\{a\}Head stable?ha=hbh\_\{a\}=h\_\{b\}A≠∅A\\neq\\varnothingandall claims bound?Releaseclaim\-bound recordAbstainabstention recordFail closedreturn no recordyesnoyesnoFigure 2:Fail\-closed structured\-release protocol\. Closure is evaluated over the view bound tohbh\_\{b\}, and the local record commits toDAD\_\{A\}, policy and normalizer versions, query context, snapshots, and head\. Equality of the independently rereadhah\_\{a\}is a precondition for either release or abstention; a mismatch returns no record\.
### 4\.2Strict, incremental, and segmented engines

The strict single\-file baseline rereads and verifies the full chain before each append batch and public read\. The incremental engine verifies the full prefix at load, validates only new events against the current head on append, and checks the trusted head plus disk state on public reads\. A full audit still rereads all events and validates arbitrary\-position tampering, sequence, hashes, provenance, and supersession\. With the same trusted time input, the two engines produce byte\-identical logical ledgers\.

The segmented engine uses fixed event\-capacity segments, a serialized single\-writer lock, transaction intents and receipts, and startup recovery for unfinished writes\. User\-index shards contain event references\. The manifest authenticates each shard by record count and rolling hash; target\-shard verification precedes user projection, and full audit covers the union of declared and physically present shards\. Recovery rebuilds both index content and commitments from authoritative segments\. The design is local concurrency control, not distributed consensus\.

## 5Experimental Method

### 5\.1Research questions and evidence hierarchy

We ask five questions\. First, does the complete I1–I5 contract distinguish matched controls from targeted violations under evaluator\-hidden execution? Second, are the clauses mutually necessary within the benchmark’s constructed contract surface? Third, do a production\-code\-independent finite reference model and three production implementations agree within stated bounds? Fourth, does the contract hold end to end through the real ingestion and release services on its explicit command and query surface, including against an ungoverned local 7B comparison? Fifth, does the governance layer preserve utility when a public task contains none of the governed interventions? Evidence is ordered accordingly: frozen hidden contract tests and sealed end\-to\-end service tests are primary bounded empirical evidence; bounded exploration and implementation differential are finite formal and engineering evidence; performance is descriptive; clean public tasks are utility controls; and model\-judged answer labels are admitted only if an internally prespecified reliability gate passes\.

### 5\.2GPM\-ReleaseBench v1

GPM\-ReleaseBench v1 is an internally designed contract\-conformance suite with 12 categories: source misbinding, cross\-user mixing, scalar conflict, delayed\-arrival bitemporality, retraction non\-revival, deletion non\-revival, deletion\-index integrity, illegal overwrite, release\-head change, exact claim closure, valid multivalue state, and unsupported free\-text extension\. The public development split contains 360 cases\. The evaluator\-hidden split contains 3,600 cases, 300 per category, arranged as 1,800 strict counterfactual pairs\. Pair members differ by the smallest constructed change intended to move one behavior across a contract boundary\. Runtime inputs contain opaque case identifiers and operations only; category, polarity, pair identifier, criticality, applicable\-system metadata, and acceptable outcomes are withheld from runners\.

The generator, task manifest, metric definitions, system runners, and stopping rules were frozen before hidden execution\. Two isolated AI review lines independently audited the hidden gold and returned GO; no human blind annotation was performed\. Hidden gold was then sealed with AES\-256\-GCM, its plaintext evaluator file removed, and the runner executed without the evaluator key\. This is process and cryptographic separation on one local host, not separate\-user or hardware isolation\. The benchmark is evaluator\-hidden relative to the tested runners, but it was designed by the same project as GPM and is not an external naturalistic distribution\.

### 5\.3Matched systems and deterministic outcomes

We run four complete systems\.*Raw append*exposes the accumulated stream\.*Latest\-first*resolves a key by its most recent candidate\.*Flat conflict\-preserving*blocks direct unresolved conflicts but lacks the full provenance, bitemporal, index\-integrity, and stable\-head release contract\. GPM implements I1–I5\. A case is an*atomic match*only if its complete structured output matches one allowed outcome bundle\.*Answer\-bundle accuracy*excludes violation cases whose only purpose is to diagnose unsupported free text\.*Unsafe release*is an unmatchedreleaseon a violation\-polarity case\.*Safe coverage*is the fraction of cases with at least one acceptable release bundle for which the system returns such a release; choosing an allowed fail\-closed outcome does not count as coverage\.

The internally prespecified comparison first considers complete valid policies with zero unsafe release in every critical category and, if any exist, maximizes safe coverage, breaking ties by answer\-bundle accuracy and stable identifier\. If none satisfies the zero\-critical condition, it minimizes critical\-category unsafe releases before applying the same safe\-coverage, accuracy, and stable\-identifier order\. Because the suite is a fully enumerated generated artifact with no external sampling frame, we report deterministic counts and exact within\-suite point differences only\. We make no confidence\-interval or population\-incidence claim\.

StateFuse is additionally run through its official state projection and the same structured closure adapter on the 2,100 cases supported by their shared contract surface\[[25](https://arxiv.org/html/2608.12476#bib.bib18)\]\. Unsupported bitemporal, user\-deletion, deletion\-index, stable\-head, and free\-text\-release cases are marked unsupported rather than scored as failures\. This shared\-subset result is not eligible for the complete\-system ranking\.

### 5\.4Sealed end\-to\-end governed\-memory evaluation

Governed\-QA Sealed tests a complementary implementation surface\. Each arm contains 2,400 deterministically generated clusters: 300 each for direct recall, set and count, temporal recall, update and conflict, multi\-hop joins, false\-memory pressure, open key–value notes, and boundary pressure\. A cluster traverses the production ingestion and release services rather than a paper\-only adapter\. Boundary clusters require narrative statements not to be ingested and ordinary non\-memory questions to be returned to the general provider\. Governed answers are exact deterministic service outputs; no language model generates them at query time\.

The candidate file set is hash\-frozen before a random seed is committed and revealed\. Generation fixes each machine oracle at case construction\. Answerable cases require byte\-exact answers, unanswerable cases require abstention, and ordinary questions require pass\-through; wrong answers, abstention on answerable cases, unsafe release, and swallowed ordinary questions are distinct failures\. Refusing everything therefore cannot score well\. The V5 freeze additionally closes the statically reachable implementation set, pins the generation date, and binds 44 files spanning ingestion, release, grammar, lineage, policy, and scoring\.

The comparison receives the same setup turns and questions but answers them directly with local Qwen2\.5\-7B through Ollama at temperature zero, without governed storage or release\. Its scorer is deliberately generous: an answerable response is correct when it contains every bare gold value, Chinese numerals count for count questions, and ordinary questions are always credited\. The same local 7B may nominate candidate spans for optional free\-form capture, but deterministic validation decides admission and the governed query answer remains model\-independent\.

We retain the original V3 arm because it is the publicly disclosed result\[[1](https://arxiv.org/html/2608.12476#bib.bib31)\]\. V3 crossed UTC dates between candidate and baseline execution, producing 120 temporal questions whose date literal differed although slice and generated gold were identical\. Its reducer was therefore amended after freeze to admit only that dated form and records the amendment in its output\. V5 is a separate methodological confirmation: it pins the date before execution, reports zero question\-surface mismatches andreducer\_amended\_after\_freeze=false, and evaluates Chinese\- and English\-command arms separately\. One\-sided 95% Clopper–Pearson lower bounds summarize the observed all\-success denominators; they do not turn this internally generated contract surface into a natural\-population sampling frame\.

### 5\.5Finite verification and implementation differential

A separate executable reference model imports no production engine code\. Within explicit finite domains it enumerates two users, two entities, two keys, three normalized value representatives, three valid\-time points, two facts, ledgers of up to four events, four single\-fault classes, and five commit crash phases\. The full contract and six guard\-removal mutants—source binding, valid time, conflict, lifecycle barrier, source closure, and stable head—are checked at every query state\. This is bounded exhaustive model checking, not a TLA\+/Alloy result or an unbounded proof\.

A separate deterministic random\-schedule test compares the strict in\-memory production projection, incremental in\-memory production engine, and segmented persistent production engine\. Each of 100,000 traces uses a unique user to prevent cross\-trace semantic interference\. After one complete audit, the segmented engine uses a frozen in\-memory user\-index adapter over the unchanged production projection to make all reads tractable\. Head races and physical crash schedules remain in targeted suites and the bounded model rather than this bulk test\.

### 5\.6Performance design

Measurements run on Windows x64 with Node\.js v24\.18\.0, an Intel Core i9\-13900H \(20 logical CPUs\), and 63\.64 GiB RAM\. Six paired fresh\-process repetitions run strict and incremental engines in balanced order on the same 10,008\-event mixed workload, using 2,000\-event append batches\. Six segmented repetitions ingest one million synthetic episode events for 1,000 users, warm 20 searches, time 200 searches, and execute audit, cold start, tamper detection, and recovery\. Medians and full ranges are descriptive; six machine runs are not IID population samples\.

### 5\.7Public clean\-task controls

We use LongMemEval and MemoryAgentBench EventQA only as clean\-task controls\[[29](https://arxiv.org/html/2608.12476#bib.bib9),[9](https://arxiv.org/html/2608.12476#bib.bib13)\]\. EventQA rows 0–9 were inspected during integration and excluded; rows 10–16 remained eligible\. LongMemEval cases were selected from a 347\-item project\-fresh lock\. Project\-fresh means not used in this project’s prior development or tuning; public benchmark exposure during model pretraining is not claimed absent\.

Version 1 freezes 120 LongMemEval and 120 EventQA cases before outcomes and uses Qwen2\.5\-1\.5B and Llama\-3\.2\-1B\. After its semantic\-judge gate fails, version 2 is opened as a separately versioned confirmation on 240 disjoint cases and uses Qwen2\.5\-7B and Gemma\-3\-4B\. EventQA is balanced between 65,536\- and 131,072\-token strata\. Both versions use temperature zero, top\-12 retrieval, and a 24,000\-character evidence budget\. On every selected clean task, flat\-conflict and GPM produce content\-hash\-identical candidate pools, so one shared generator call represents both conditions\. Their answer difference is therefore structural, not an independently estimated model effect\.

EventQA uses the upstream deterministic substring criterion\. LongMemEval uses two local AI judges with generator identity hidden\. The internally prespecified primary gate requires Cohen’sκ≥0\.80\\kappa\\geq 0\.80separately for correctness, hallucination, and omission\. Failure leaves all LongMemEval answer\-layer rates descriptive\.

## 6Results

### 6\.1Evaluator\-hidden contract results

Table 2:GPM\-ReleaseBench v1 evaluator\-hidden results on 3,600 cases\. Unsafe release is conditioned on 1,800 violation\-polarity cases; other denominators follow the definitions in the text\.Flat conflict\-preserving is the strongest of the three intentionally simple complete policies under the frozen rule\. Relative to it, GPM changes unsafe release by−50\.00\-50\.00percentage points, answer\-bundle accuracy by\+47\.83\+47\.83points, safe coverage by\+23\.08\+23\.08points, and atomic match by\+50\.00\+50\.00points\. The difference exceeds the internally predefined deterministic margin of−2\-2answer\-accuracy points\. These are deterministic differences for the generated hidden suite, not estimates of natural\-world failure frequency\. Each of five critical violation categories has 0/150 unsafe releases; this is an exact suite count, not a population confidence statement\.

On StateFuse’s 2,100 supported shared\-contract cases, the official projection plus common closure adapter matches 1,200 complete bundles, has no unmatched violation release, and has 62\.50% safe coverage\. Because 1,500 cases are outside its declared adapter surface, this does not establish an overall ranking against GPM\.

### 6\.2End\-to\-end governed\-memory results

Table 3:Governed\-QA Sealed V3 end\-to\-end results\. The ungoverned comparison is local Qwen2\.5\-7B at temperature zero; the governed lane traverses the deterministic ingestion and release services\.∗Ordinary non\-memory questions are always credited to the ungoverned baseline because it is supposed to answer them; this makes its boundary\-family score comparatively high\.

The governed lane is correct on all 2,400 clusters, with a one\-sided 95% Clopper–Pearson lower bound of 99\.875%\. Of the 1,800 clusters missed by the ungoverned 7B, all 1,800 are corrected; none of its 600 correct clusters regresses\. The bounded cure lower bound is 99\.834%\. These counts do not mean that Qwen2\.5\-7B reached 100% accuracy\. The model is the 25% ungoverned comparison; the 100% result belongs to a deterministic governed lane on its explicit contract\.

Table 4:Governed\-QA Sealed V5 confirmation after generation\-date pinning\. “Repaired” is conditioned on baseline failure; regressions are conditioned on baseline\-correct clusters\.Both V5 command arms again pass every 300\-case family gate\. The correctness lower bound is 99\.875% per arm; cure lower bounds are 99\.716% for Chinese commands and 99\.830% for English commands\. Unlike V3, V5 requires no post\-freeze reducer amendment and has no date\-surface mismatch\. At preparation of this revision, all 44 frozen candidate files, the reachable\-file closure, and the seed commitment reverified without drift\.

### 6\.3Post\-aggregate guard\-removal diagnostics

The single\-clause removals in[table5](https://arxiv.org/html/2608.12476#S6.T5)were implemented only after aggregate full\-system and policy results were visible\. They are mechanism diagnostics, not prespecified hidden ablations or unbiased causal estimates\.

Table 5:Post\-aggregate exploratory removal of one obligation\.No\-I1 illustrates why unsafe\-release count alone is insufficient: the mutant misses 150 required fail\-closed outcomes without directly releasing an unmatched claim\. Every contract clause is therefore evaluated through complete outcome bundles rather than one safety rate\.

### 6\.4Finite verification and three\-engine agreement

Table 6:Finite executable verification\. Counts are exhaustive or deterministic within the stated bounds\.The independent model finds no counterexample to the full contract and finds at least one for every guard removal\. Consistent with the valid\-ledger definition above, it rejects a decreasing transaction time, as well as tamper, truncation, reordering, duplication, and invalid crash\-recovery states, within its bounds\. The production differential in[table6](https://arxiv.org/html/2608.12476#S6.T6)observes no mismatch\. Zero bounded counterexamples and zero sampled implementation differences remain finite evidence, not a proof that the implementation is defect\-free\.

All 39 incremental, 41 segmented, 24 retraction\-barrier, 39 trust\-boundary, and 22 release\-contract implementation checks also pass\. The added release checks reject claim or source\-identifier substitution and stale\-head replay; applying the strengthened record schema leaves all 3,600 hidden benchmark decisions byte\-identical\. Four writer processes complete 120 events without observed loss, duplication, or fork; this is only a lock smoke test\.

### 6\.5Performance and scale

Table 7:Six fresh\-process repetitions\. Values are descriptive median and full range\.All six single\-file pairs produce identical logical\-ledger hashes, and every segmented run passes full verification, tamper detection, and recovery\. The speedup in[table7](https://arxiv.org/html/2608.12476#S6.T7)comes from avoiding repeated audit of an already verified prefix, not from deleting the audit path\. Nonoverlapping order strata indicate a systematic cache or warm\-up effect; both strata and the pooled median are therefore shown\. Segmented episode\-only stress and mixed single\-file workloads are not an absolute architecture comparison\.

### 6\.6Clean public tasks and failed language gate

Table 8:Deterministically scored EventQA clean\-task controls\. “Substring match” is the upstream criterion, not semantic exact match\. Each row is one shared generation because flat\-conflict and GPM prompts are byte\-identical\.Table 9:LongMemEval semantic\-judge reliability\. Primary eligibility required every label\-specific kappa to reach 0\.80\.The structural flat\-versus\-GPM answer difference is 0 points in both versions and exceeds the internally predefined deterministic margin of−2\-2points, but it is not a stochastic treatment estimate\.[Table8](https://arxiv.org/html/2608.12476#S6.T8)measures local\-model utility only and makes no frontier\-model claim\. The LongMemEval answer counts—V1: 32/120 and 27/120; V2: 42/120 and 18/120 for the two respective generators—are retained as descriptive negative evidence\. Because[table9](https://arxiv.org/html/2608.12476#S6.T9)fails in both versions, no LongMemEval answer\-accuracy, hallucination, or omission rate supports a primary claim\.

The candidate reproduction artifact contains the public development benchmark, finite checks, frozen locks, and aggregate public\-task receipts, but excludes hidden gold, keys, licensed raw datasets, model weights, and raw prompts\. Two independently copied same\-host fresh\-directory runs reproduce the 360\-case development scores, bounded counts, and 100,000\-trace differential receipt with the same semantic SHA\-256\. This verifies packaging determinism on one host; it is not independent third\-party reproduction\.

## 7Related Work and Discussion

Retrieval\-augmented generation and long\-term agent memory primarily optimize access to information beyond the current context\[[13](https://arxiv.org/html/2608.12476#bib.bib1),[20](https://arxiv.org/html/2608.12476#bib.bib3),[27](https://arxiv.org/html/2608.12476#bib.bib5),[5](https://arxiv.org/html/2608.12476#bib.bib6),[14](https://arxiv.org/html/2608.12476#bib.bib7)\]\. Recent systems add temporal graphs, consolidation, learned memory operations, and reflective structure\[[2](https://arxiv.org/html/2608.12476#bib.bib16),[8](https://arxiv.org/html/2608.12476#bib.bib17)\]\. Text2Mem defines typed executable operations across memory backends\[[26](https://arxiv.org/html/2608.12476#bib.bib14)\], while conflict\-aware memory applies explicit detection rules to vector data quality\[[16](https://arxiv.org/html/2608.12476#bib.bib15)\]\. Long\-memory benchmarks now cover dialogue recall, updating, forgetting, hallucination propagation, and controlled conflict regimes\[[17](https://arxiv.org/html/2608.12476#bib.bib2),[29](https://arxiv.org/html/2608.12476#bib.bib9),[4](https://arxiv.org/html/2608.12476#bib.bib8),[9](https://arxiv.org/html/2608.12476#bib.bib13),[24](https://arxiv.org/html/2608.12476#bib.bib22)\]\. A controlled ACL study further shows that addition, deletion, error propagation, and experience replay policies change agent behavior in distinct ways\[[30](https://arxiv.org/html/2608.12476#bib.bib23)\]\.

Adjacent formal work separates three decisions that ordinary retrieval leaves implicit\. Trust\-sensitive revision filters a report through source\- and domain\-specific trust before changing belief\[[3](https://arxiv.org/html/2608.12476#bib.bib28)\]; revision by history constrains current revision through a sequence of prior revisions and their outcomes\[[15](https://arxiv.org/html/2608.12476#bib.bib29)\]; and partial abstention optimizes the choice to withhold uncertain components of a multilabel prediction\[[19](https://arxiv.org/html/2608.12476#bib.bib30)\]\. GPM does not replace these belief\-revision or decision\-theoretic accounts\. It gives an executable systems contract for a different boundary: whether source\-bound, bitemporal, lifecycle\-governed state may support an explicit outgoing claim under a fresh verified ledger head\.

A close contract\-level neighbor is StateFuse, which builds deterministic conflict objects, projection\-scoped resolution, and exact or semantic retraction handles over a replicated OpSet/CRDT substrate\[[25](https://arxiv.org/html/2608.12476#bib.bib18)\]\. Its reported evidence shows that conflict\-preserving surfaces can expose disagreement without a general answer\-accuracy advantage over strong flat baselines\. GPM is not replica\-convergent and has no unseen\-target semantic tombstone\. In return, its evaluated contract starts earlier, by binding admitted claims to source content and valid/transaction time, and ends later, by requiring a fresh public projection and verified head before an explicit claim set can be released\.

MemoRepair studies a complementary lifecycle stage: deletion, correction, or interface migration can invalidate arbitrary summaries, caches, skills, and tool procedures downstream of a source\[[31](https://arxiv.org/html/2608.12476#bib.bib19)\]\. Its influence\-provenance graph, withdrawal barrier, validated successor construction, and predecessor\-closed repair selection are outside GPM’s scope\. I4 covers the target fact, its bound episode, and engine\-declared indexes and projections; I4 therefore does not provide cascade repair for arbitrary derived artifacts\. Conversely, MemoRepair does not specify the bitemporal claim\-admission and structured answer\-release closure studied here\.

TOKI and MemIR are adjacent at different layers\. TOKI supplies explicit bitemporal operators for contradiction\-aware state reconstruction and resolution\[[28](https://arxiv.org/html/2608.12476#bib.bib20)\]; GPM instead fixes one public\-policy interpretation and tests its non\-revival behavior in three engines\. MemIR addresses provenance\-role collapse by keeping evidence, assertion, and decision objects typed\[[10](https://arxiv.org/html/2608.12476#bib.bib21)\]; GPM binds source evidence at admission but does not offer MemIR’s richer role system\. Neither distinction implies empirical superiority because the released tasks and contracts differ\.

Table 10:Contract\-level positioning of closely related systems\. Cells summarize the contract each work makes explicit; they are not an empirical ranking\.Provenance graphs, bitemporal databases, conflict detection, and selective prediction are established components with mature precedents\[[18](https://arxiv.org/html/2608.12476#bib.bib10),[23](https://arxiv.org/html/2608.12476#bib.bib12),[6](https://arxiv.org/html/2608.12476#bib.bib11)\]\. The ledger and head\-reread design likewise sits beside established work on hash\-linked timestamping, append\-only transparency logs, optimistic validation, and mutable usage\-control decisions\[[7](https://arxiv.org/html/2608.12476#bib.bib25),[12](https://arxiv.org/html/2608.12476#bib.bib26),[11](https://arxiv.org/html/2608.12476#bib.bib24),[21](https://arxiv.org/html/2608.12476#bib.bib27)\]\. GPM does not replace those security or database mechanisms\. Its contribution is their scoped composition into one public\-eligibility decision: failed source binding, invalid supersession, unresolved conflict, current retraction/deletion, or a nonclosed structured claim causes the public path to fail closed\. This governance layer can be combined with different retrievers, memory graphs, operation languages, replicated conflict substrates, or descendant\-repair planners\.

Append\-only audit and deletion rights remain in tension\. Physical event removal destroys audit evidence, whereas indefinite plaintext retention violates data minimization and user expectations\. Our result is a public\-view barrier plus a separately routed audit view\. It is not media erasure, backup deletion, cryptographic erasure, or machine unlearning\. Production deployments still require retention policy, least\-privilege audit authorization, encryption and key destruction where appropriate, and legally compliant deletion procedures\.

Selective prediction frames coverage jointly with the risk among released outputs\[[6](https://arxiv.org/html/2608.12476#bib.bib11)\]\. Our guard\-removal and answer diagnostics show both sides: weakening gates can expose unsafe release, while excessive abstention converts errors into omissions\. The objective is not maximum abstention but maximum valid coverage under an explicit risk budget, with distinctions among conflict explanation, clarification, hedged response, and complete abstention\.

## 8Limitations and Threats to Validity

#### External validity and benchmark construction\.

GPM\-ReleaseBench is synthetic and was designed by the same project as GPM\. Its hidden split tests runner behavior against a frozen contract, not transfer to natural dialogue, new ontologies, adversarial authors, or multi\-year privacy drift\. Counterfactual homogeneity makes the within\-suite differences exact but says nothing about the frequency of those failures outside the suite\. The one\-million\-event workload is likewise engineering stress, not a natural event distribution\.

#### Baselines\.

The three complete baselines are intentionally simple matched policies, not full Mem0, MemGPT, MemOS, TOKI, MemIR, MemoRepair, or graph\-memory systems\. StateFuse is evaluated only on a 2,100\-case shared\-contract subset\. Different systems expose different ingestion, invalidation, replication, and release contracts, so[table2](https://arxiv.org/html/2608.12476#S6.T2)supports superiority only over the listed complete policies on this constructed suite\. The related\-work matrix in[table10](https://arxiv.org/html/2608.12476#S7.T10)is a scope comparison, not an empirical ranking\.

#### Hidden\-evaluation process\.

Two isolated AI review lines audited the hidden gold, but there was no independent human annotation\. Gold sealing and key separation occurred under one operating\-system user, so they reduce accidental access and bind artifacts without constituting an independent security principal\. The system implementation and benchmark ontology were both available before the hidden run; evaluator\-hidden execution is not the same as an externally authored benchmark\.

#### Sealed service evaluation\.

Governed\-QA Sealed is also internally generated and tests an explicit command grammar and eight query families, not arbitrary dialogue\. Its deterministic oracle is strong for that surface but does not assess semantic equivalence outside the generated forms\. Qwen2\.5\-7B is one deliberately ungoverned local comparison, not the strongest possible memory system or a representative sample of model providers\. The V3 reducer amendment for 120 cross\-date temporal surfaces was made after freeze and is reported rather than hidden; V5 removes that defect by pinning the date before execution\. The Clopper–Pearson bounds summarize all\-success denominators within these prespecified runs and do not justify an open\-world or product\-wide accuracy claim\.

#### Derived\-artifact scope\.

I4 covers facts, their bound episodes, and the indexes and materialized projections declared by the three engines\. It does not discover or repair arbitrary downstream summaries, cached outputs, embeddings, skills, or model parameters\. Such descendants require complete influence provenance and a cascade\-withdrawal and repair contract of the kind studied by MemoRepair\.

#### Schema coverage\.

Unregistered attributes are treated as single\-valued and only a small registry is multi\-valued\. Normalization is NFKC, trimming, and case folding\. Set merge, vague time, unit conversion, entity coreference, and open\-text contradiction require stronger schema and semantic layers\.

#### Temporal policy\.

Current public release usestransactionAt=null\. Non\-nulltransactionAtis an explicit policy\-filtered historical mode: it combines a requested transaction prefix with retraction and deletion policy at the current verified head\. This prevents revival of retracted or deleted state, but conflicts and valid superseding assertions written after the requested prefix are not projected into that prefix\. Consequently caller\-selected historical mode may expose a fact later contradicted or superseded and is unsuitable for current\-state answers\. The query hash does not authorize historical mode; deployment policy must restrict it\. Ordinary as\-of reconstruction is confined to the separately authorized audit interface\.

#### Release scope\.

I5 decides exact matches for explicit structured claims and supplied source fact identifiers in the selected public mode\. The local record binds the canonical complete claim multiset, versions, context, snapshots, and head, and verification rejects claim substitution or a stale head\. It is not a signed cross\-boundary credential\. The query hash does not prove query–claim relevance, I2 does not prove semantic entailment from quoted text, and the gate cannot detect implicit assertions in final prose\.

#### Threat model\.

The trusted computing base comprises engine code, system clock, single\-writer coordination, deployment authentication, and a head commitment or segmented manifest protected separately from authoritative storage\. Public reads detect ordinary file replacement, equal\-length modification, index\-reference deletion or injection, and truncation\. The prototype does not resist a malicious authorized writer, a host attacker who rewrites both storage and commitments, forged filesystem metadata, or lack of an external anchor\. Separate audit methods are not access control, and local multi\-process tests are not distributed consensus\.

#### Finite verification\.

The reference model is exhaustive only within its declared small domains and event bound\. The five obligations are executable interface clauses, not an inductive proof over all reachable unbounded states\. The 100,000\-trace differential uses unique users and a fixed public seed; it does not cover unbounded traces, distributed interleavings, hash collisions, or a host that rewrites both storage and its independent commitment\. The post\-aggregate I1–I5 removals are exploratory and cannot be treated as prespecified hidden ablations\.

#### Public answer controls\.

Flat\-conflict and GPM receive byte\-identical clean\-task prompts, so the observed zero difference is an implementation sanity check rather than an estimated treatment effect\. EventQA values use the upstream substring criterion, not semantic exact match\. Both LongMemEval versions fail the label\-wise judge\-agreement gate and cannot support primary answer\-accuracy, hallucination, or omission claims\. Public benchmark pretraining exposure is not claimed absent, and the local 1B–7B models do not estimate frontier performance\. These clean\-task controls and the governed\-query service test answer different questions: the former retains free\-form model generation, whereas the latter returns deterministic contract values\.

#### Reproducibility\.

Two fresh\-directory copies reproduce the candidate package on one host\. Hidden gold, evaluator keys, licensed raw public datasets, model weights, and raw model prompts are excluded, so the package cannot independently rescore the hidden split or rerun the language\-model controls\. There is no external\-team reproduction\. The minimal artifact now has an explicit PolyForm Noncommercial 1\.0\.0 license and passes clean extraction, but it remains release\-ready rather than published: no public URL, DOI, or release date has been assigned\. The V3 aggregate service result is disclosed in an immutable public repository commit\[[1](https://arxiv.org/html/2608.12476#bib.bib31)\]; complete V3/V5 per\-cluster receipts are not part of the TeX archive or the v1\.0\.0 artifact\.

## 9Ethics, Disclosure, and Artifact Statement

Persistent memory lengthens the lifetime of both error and privacy exposure\. Systems should reject unsupported claims by default, let users inspect, correct, and delete memory, distinguish source statements from inference, and propagate deletion into public indexes\. A conflict need not imply user dishonesty; time, context, and source error can produce apparent contradiction\.

No new human subjects or private conversations from project users were used\. GPM\-ReleaseBench and Governed\-QA Sealed are synthetic\. LongMemEval and MemoryAgentBench are represented by upstream revisions, hashes, selected identifiers, and aggregate results subject to their licenses; their raw licensed records are not included in the artifact candidate\.

The author is employed by Qingdao Guodongxiansheng Network Technology Co\., Ltd\. \(Guǒdòng Xiānsheng\)\. The author and company may have financial interests in Aethmere\-OS, related software, commercialization, and intellectual\-property applications\. Because the author writes primarily in Chinese and has limited English proficiency, OpenAI Codex assisted with English translation, language editing, and LaTeX typesetting; it also assisted with literature organization, experiment scripting, and deterministic result checks under the author’s review\. Codex is not an author\. Guodong Xu conceived the study, determined the claims and interpretation, verified the reported results and citations, reviewed and approved all AI\-assisted content, and accepts full responsibility for the paper\. No external grant supported this work; the author and company supplied the local hardware and compute\.

The arXiv source archive contains only compilation inputs\. A manifest\-bound v1\.0\.0 reproducibility artifact contains the public development benchmark, executable finite checks, frozen locks, and aggregate receipts, and excludes evaluator secrets and licensed raw datasets\. It is licensed under PolyForm Noncommercial 1\.0\.0 and passes a same\-host clean\-extraction rerun, but remains release\-ready rather than publicly uploaded; its URL, DOI, and release date are unset\. Large per\-question records, the Governed\-QA Sealed per\-cluster receipts, and raw licensed datasets are intentionally excluded from the TeX archive\.

## 10Conclusion

Governed persistent memory reframes long\-term agent memory as a source\-bound, bitemporal state system with an explicit public release boundary\. Admission, conflict, retraction, deletion, and release each have executable preconditions and observable failure evidence\. On a frozen 3,600\-case contract suite, the complete system matches every allowed outcome and avoids unmatched violation release, while the strongest of three intentionally simple complete policies matches half of the cases and releases unsafely on half of the violation cases\. On the separate sealed end\-to\-end service surface, the V3 governed lane returns 2,400/2,400 contract\-correct outcomes versus 600/2,400 for an ungoverned local 7B and repairs all 1,800 baseline failures without regression; V5 repeats 2,400/2,400 in both command\-language arms without a reducer amendment\. A production\-code\-independent bounded reference model and a 100,000\-trace three\-engine differential find no full\-contract counterexample or implementation mismatch within their declared bounds\. Contract consequence 1 states the resulting source\-relative non\-revival property for claim\-bound local records\.

The same evidence sets strict limits\. Both contract benchmarks are internally designed and synthetic; finite exploration is not an unbounded proof; clean public tasks contain no governed intervention; and both LongMemEval semantic\-judge protocols fail their reliability gate\. The 100% sealed result belongs only to the explicit governed contract, not to Qwen2\.5\-7B, open\-world dialogue, or the product as a whole\. Governed state is therefore one necessary foundation for reliable long\-term memory, not a sufficient solution to relevance, truth, or free\-form generation\. Externally authored challenge sets, publication of the licensed artifact and sealed receipts, independent reproduction, arbitrary descendant repair, richer typed conflict semantics, free\-text evidence closure, and longitudinal user studies remain open work\.

## References

- \[1\]\(2026\)Governed memory: public bounded evaluation disclosure\.Note:Immutable repository commit[https://github\.com/kzkz137806/aethmere\-os/commit/dffc1c3659bc8377faf8c0443363926c1fda7aa6](https://github.com/kzkz137806/aethmere-os/commit/dffc1c3659bc8377faf8c0443363926c1fda7aa6)Accessed 2026\-08\-11Cited by:[§5\.4](https://arxiv.org/html/2608.12476#S5.SS4.p4.1),[§8](https://arxiv.org/html/2608.12476#S8.SS0.SSS0.Px12.p1.1)\.
- \[2\]P\. Banerjee, M\. Moshtaghi, S\. Subramanian, A\. Misra, and A\. Chadha\(2026\)APEX\-MEM: agentic semi\-structured memory with temporal reasoning for long\-term conversational AI\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics,pp\. 16470–16489\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.acl-long.749),[Link](https://aclanthology.org/2026.acl-long.749/)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[3\]R\. Booth and A\. Hunter\(2018\)Trust as a precursor to belief revision\.Journal of Artificial Intelligence Research61,pp\. 699–722\.External Links:[Document](https://dx.doi.org/10.1613/jair.5521)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p2.1)\.
- \[4\]D\. Chen, S\. Niu, K\. Li, P\. Liu, X\. Zheng, B\. Tang, X\. Li, F\. Xiong, and Z\. Li\(2025\)HaluMem: evaluating hallucinations in memory systems of agents\.arXiv preprint arXiv:2511\.03506\.External Links:2511\.03506,[Link](https://arxiv.org/abs/2511.03506)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p2.1),[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[5\]P\. Chhikara, D\. Khant, S\. Aryan, T\. Singh, and D\. Yadav\(2025\)Mem0: building production\-ready AI agents with scalable long\-term memory\.arXiv preprint arXiv:2504\.19413\.External Links:2504\.19413,[Link](https://arxiv.org/abs/2504.19413)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p1.1),[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[6\]Y\. Geifman and R\. El\-Yaniv\(2017\)Selective classification for deep neural networks\.InAdvances in Neural Information Processing Systems,Vol\.30\.External Links:[Link](https://papers.neurips.cc/paper/2017/hash/4a8423d5e91fda00bb7e46540e2b0cf1-Abstract.html)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p6.1),[§7](https://arxiv.org/html/2608.12476#S7.p8.1)\.
- \[7\]S\. Haber and W\. S\. Stornetta\(1991\)How to time\-stamp a digital document\.Journal of Cryptology3\(2\),pp\. 99–111\.External Links:[Document](https://dx.doi.org/10.1007/BF00196791)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p6.1)\.
- \[8\]C\. Hu, X\. Gao, Z\. Zhou, D\. Xu, Y\. Bai, X\. Li, H\. Zhang, T\. Li, C\. Zhang, L\. Bing, and Y\. Deng\(2026\)EverMemOS: a self\-organizing memory operating system for structured long\-horizon reasoning\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics,pp\. 45836–45853\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.acl-long.2125),[Link](https://aclanthology.org/2026.acl-long.2125/)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[9\]Y\. Hu, Y\. Wang, and J\. McAuley\(2026\)Evaluating memory in LLM agents via incremental multi\-turn interactions\.InInternational Conference on Learning Representations,External Links:2507\.05257,[Link](https://arxiv.org/abs/2507.05257)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p2.1),[§5\.7](https://arxiv.org/html/2608.12476#S5.SS7.p1.1),[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[10\]Z\. Jin, B\. Wang, J\. Li, R\. Xu, and M\. Zhang\(2026\)Mitigating provenance\-role collapse in long\-term agents via typed memory representation\.arXiv preprint arXiv:2605\.25869\.External Links:2605\.25869,[Document](https://dx.doi.org/10.48550/arXiv.2605.25869),[Link](https://arxiv.org/abs/2605.25869)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p4.1),[Table 10](https://arxiv.org/html/2608.12476#S7.T10.4.4.1.1.1),[§7](https://arxiv.org/html/2608.12476#S7.p5.1)\.
- \[11\]H\. T\. Kung and J\. T\. Robinson\(1981\)On optimistic methods for concurrency control\.ACM Transactions on Database Systems6\(2\),pp\. 213–226\.External Links:[Document](https://dx.doi.org/10.1145/319566.319567)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p6.1)\.
- \[12\]B\. Laurie, E\. Messeri, and R\. Stradling\(2021\)Certificate transparency version 2\.0\.RFCTechnical Report9162,RFC Editor\.External Links:[Document](https://dx.doi.org/10.17487/RFC9162),[Link](https://www.rfc-editor.org/info/rfc9162)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p6.1)\.
- \[13\]P\. Lewis, E\. Perez, A\. Piktus, F\. Petroni, V\. Karpukhin, N\. Goyal, H\. Küttler, M\. Lewis, W\. Yih, T\. Rocktäschel, S\. Riedel, and D\. Kiela\(2020\)Retrieval\-augmented generation for knowledge\-intensive NLP tasks\.InAdvances in Neural Information Processing Systems,Vol\.33,pp\. 9459–9474\.External Links:[Link](https://proceedings.neurips.cc/paper/2020/hash/6b493230205f780e1bc26945df7481e5-Abstract.html)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p1.1),[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[14\]Z\. Li, C\. Xi, C\. Li,et al\.\(2025\)MemOS: a memory OS for AI system\.arXiv preprint arXiv:2507\.03724\.External Links:2507\.03724,[Link](https://arxiv.org/abs/2507.03724)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p1.1),[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[15\]P\. Liberatore\(2015\)Revision by history\.Journal of Artificial Intelligence Research52,pp\. 287–329\.External Links:[Document](https://dx.doi.org/10.1613/jair.4608)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p2.1)\.
- \[16\]K\. Ma, H\. Wang, S\. Chen, Y\. Cai, Huangyuyu, and R\. Jin\(2026\)Conflict\-aware memory for embodied agents: enhancing vector data quality via detection rules\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics,pp\. 28328–28347\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.acl-long.1306),[Link](https://aclanthology.org/2026.acl-long.1306/)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[17\]A\. Maharana, D\. Lee, S\. Tulyakov, M\. Bansal, F\. Barbieri, and Y\. Fang\(2024\)Evaluating very long\-term conversational memory of LLM agents\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics,pp\. 13851–13870\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.747),[Link](https://aclanthology.org/2024.acl-long.747/)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p2.1),[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[18\]L\. Moreau P\. Missieret al\.\(2013\)PROV\-DM: the PROV data model\.W3C RecommendationWorld Wide Web Consortium\.External Links:[Link](https://www.w3.org/TR/prov-dm/)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p6.1)\.
- \[19\]V\. Nguyen and E\. Hüllermeier\(2021\)Multilabel classification with partial abstention: Bayes\-optimal prediction under label independence\.Journal of Artificial Intelligence Research72,pp\. 613–665\.External Links:[Document](https://dx.doi.org/10.1613/jair.1.12610)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p2.1)\.
- \[20\]C\. Packer, S\. Wooders, K\. Lin, V\. Fang, S\. G\. Patil, I\. Stoica, and J\. E\. Gonzalez\(2023\)MemGPT: towards LLMs as operating systems\.arXiv preprint arXiv:2310\.08560\.External Links:2310\.08560,[Link](https://arxiv.org/abs/2310.08560)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p1.1),[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[21\]J\. Park and R\. Sandhu\(2004\)The UCONABC usage control model\.ACM Transactions on Information and System Security7\(1\),pp\. 128–174\.External Links:[Document](https://dx.doi.org/10.1145/984334.984339)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p6.1)\.
- \[22\]J\. S\. Park, J\. C\. O’Brien, C\. J\. Cai, M\. R\. Morris, P\. Liang, and M\. S\. Bernstein\(2023\)Generative agents: interactive simulacra of human behavior\.InProceedings of the 36th Annual ACM Symposium on User Interface Software and Technology,External Links:[Document](https://dx.doi.org/10.1145/3586183.3606763)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p1.1)\.
- \[23\]R\. T\. Snodgrass\(1999\)Developing time\-oriented database applications in SQL\.Morgan Kaufmann\.External Links:[Link](https://www2.cs.arizona.edu/%CB%9Crts/tdbbook.pdf)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p6.1)\.
- \[24\]Z\. Tao, J\. Zhao, P\. Liu, D\. Xi, Y\. Chen, W\. Xu, and Z\. Li\(2026\)MemConflict: evaluating long\-term memory systems under memory conflicts\.arXiv preprint arXiv:2605\.20926\.External Links:2605\.20926,[Document](https://dx.doi.org/10.48550/arXiv.2605.20926),[Link](https://arxiv.org/abs/2605.20926)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[25\]S\. Volkov, Y\. Li, and Y\. Luo\(2026\)StateFuse: deterministic conflict\-preserving memory for multi\-agent systems\.arXiv preprint arXiv:2607\.05844\.External Links:2607\.05844,[Document](https://dx.doi.org/10.48550/arXiv.2607.05844),[Link](https://arxiv.org/abs/2607.05844)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p4.1),[§5\.3](https://arxiv.org/html/2608.12476#S5.SS3.p3.1),[Table 10](https://arxiv.org/html/2608.12476#S7.T10.4.2.1.1.1),[§7](https://arxiv.org/html/2608.12476#S7.p3.1)\.
- \[26\]L\. Wang, L\. Yang, B\. Chen, K\. Xu, G\. Zou, B\. Tang, F\. Xiong, S\. Chen, and Z\. Li\(2026\)Text2Mem: a unified memory operation language for memory operating system\.InFindings of the Association for Computational Linguistics: ACL 2026,pp\. 2105–2119\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.findings-acl.100),[Link](https://aclanthology.org/2026.findings-acl.100/)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[27\]W\. Wang, L\. Dong, H\. Cheng, X\. Liu, X\. Yan, J\. Gao, and F\. Wei\(2023\)Augmenting language models with long\-term memory\.arXiv preprint arXiv:2306\.07174\.External Links:2306\.07174,[Link](https://arxiv.org/abs/2306.07174)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p1.1),[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[28\]Z\. Wang\(2026\)TOKI: a bitemporal operator algebra for contradiction resolution in LLM\-agent persistent memory\.arXiv preprint arXiv:2606\.06240\.External Links:2606\.06240,[Document](https://dx.doi.org/10.48550/arXiv.2606.06240),[Link](https://arxiv.org/abs/2606.06240)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p4.1),[Table 10](https://arxiv.org/html/2608.12476#S7.T10.4.3.1.1.1),[§7](https://arxiv.org/html/2608.12476#S7.p5.1)\.
- \[29\]D\. Wu, H\. Wang, W\. Yu, Y\. Zhang, K\. Chang, and D\. Yu\(2025\)LongMemEval: benchmarking chat assistants on long\-term interactive memory\.InInternational Conference on Learning Representations,External Links:2410\.10813,[Link](https://arxiv.org/abs/2410.10813)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p2.1),[§5\.7](https://arxiv.org/html/2608.12476#S5.SS7.p1.1),[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[30\]Z\. Xiong, Y\. Lin, W\. Xie, P\. He, Z\. Liu, J\. Tang, H\. Lakkaraju, and Z\. Xiang\(2026\)How memory management impacts LLM agents: an empirical study of experience\-following behavior\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics,pp\. 623–645\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.acl-long.27),[Link](https://aclanthology.org/2026.acl-long.27/)Cited by:[§7](https://arxiv.org/html/2608.12476#S7.p1.1)\.
- \[31\]Y\. Zhao, C\. Dai, M\. Kou, and Y\. Xiu\(2026\)MemoRepair: barrier\-first cascade repair in agentic memory\.arXiv preprint arXiv:2605\.07242\.External Links:2605\.07242,[Document](https://dx.doi.org/10.48550/arXiv.2605.07242),[Link](https://arxiv.org/abs/2605.07242)Cited by:[§1](https://arxiv.org/html/2608.12476#S1.p4.1),[Table 10](https://arxiv.org/html/2608.12476#S7.T10.4.5.1.1.1),[§7](https://arxiv.org/html/2608.12476#S7.p4.1)\.

## Appendix AClaim–Evidence Boundary

Table 11:What each main claim does and does not establish\.