Paper deep dive

Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents

Guodong Xu

Year: 2026Venue: arXiv preprintArea: cs.AIType: PreprintEmbeddings: 72

Intelligence

Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%

Last extracted: 8/14/2026, 4:26:36 AM

Summary

The paper introduces Governed Persistent Memory (GPM), a bitemporal state-transition model for long-horizon agents that ensures auditable, source-bound memory with fail-closed structured release. It addresses issues like contradictory or stale records by enforcing five executable clauses: ledger integrity, source binding, conflict isolation, non-revival after retraction/deletion, and exact claim closure. The system is evaluated on the GPM-ReleaseBench and a sealed end-to-end service, demonstrating deterministic correctness and repair of baseline failures compared to ungoverned models like Qwen2.5-7B.

Entities (10)

Governed Persistent Memory · system · 98%GPM-ReleaseBench · dataset · 92%Conflict Isolation · constraint · 90%Ledger Integrity · constraint · 90%Non-revival · constraint · 90%Qwen2.5-7B · model · 90%Source Binding · constraint · 90%Structured Release · constraint · 90%StateFuse · system · 85%TOKI · system · 85%

Relation Signals (9)

Governed Persistent Memory → implements → Ledger Integrity

confidence 95% · Five executable clauses cover ledger integrity...

Governed Persistent Memory → implements → Source Binding

confidence 95% · Five executable clauses cover... source binding...

Governed Persistent Memory → implements → Conflict Isolation

confidence 95% · Five executable clauses cover... conflict isolation...

Governed Persistent Memory → implements → Non-revival

confidence 95% · Five executable clauses cover... non-revival after retraction or deletion...

Governed Persistent Memory → implements → Structured Release

confidence 95% · Five executable clauses cover... exact claim closure over a fresh view...

Governed Persistent Memory → evaluatedon → GPM-ReleaseBench

confidence 92% · On a prespecified hash-frozen 3,600-case GPM-ReleaseBench, GPM matches all complete outcomes

Governed Persistent Memory → outperforms → Qwen2.5-7B

confidence 90% · the governed lane is correct on 2,400/2,400 clusters versus 600/2,400 for ungoverned local Qwen2.5-7B

StateFuse → relatedto → Governed Persistent Memory

confidence 80% · Several 2026 systems sharpen this boundary. StateFuse preserves contradictions... GPM addresses a narrower end-to-end state contract

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Long-term agent memory is usually treated as select--store--retrieve, but retrieval does not decide whether contradictory, superseded, retracted, deleted, or stale records may support an outgoing claim. We introduce Governed Persistent Memory (GPM), an auditable bitemporal state-transition model with source-bound admission, derived lifecycle state, current public barriers, and fail-closed structured release. Five executable clauses cover ledger integrity, source binding, conflict isolation, non-revival after retraction or deletion, and exact claim closure over a fresh view at one verified head. On a prespecified hash-frozen 3,600-case GPM-ReleaseBench, GPM matches all complete outcomes; the strongest of three intentionally simple complete policies matches 1,800/3,600 and makes unmatched releases on 50% of violation cases. A separate sealed end-to-end service evaluation exercises real ingestion and release across eight query families. In its publicly disclosed V3 arm, the governed lane is correct on 2,400/2,400 clusters versus 600/2,400 for ungoverned local Qwen2.5-7B; it repairs all 1,800 baseline failures with no regression (one-sided 95% lower bounds 99.875% and 99.834%). A later V5 reseal over Chinese- and English-command arms, with generation-date pinning and no post-freeze reducer amendment, again obtains 2,400/2,400 per arm. A production-code-independent finite model explores 331,776 semantic and 1,990,656 query states without a full-contract counterexample, and a 100,000-trace three-engine differential yields zero mismatches. These are bounded contract and implementation results, not open-world model accuracy or evidence of world truth. Governed answers in the sealed service evaluation are deterministic service outputs; the 7B result is the ungoverned comparison, not a claim that a language model itself became perfectly accurate.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

71,128 characters extracted from source content.

Expand or collapse full text

Governed Persistent Memory: Source-Bound State Semantics and Fail-Closed Release for Long-Horizon Agents Guodong Xu Affiliation: Qingdao Guodongxiansheng Network Technology Co., Ltd. Affiliation: (Guǒdòng Xiānsheng) Email: kzkz137806@gmail.com August 2026 Abstract Long-term agent memory is usually treated as select–store–retrieve, but retrieval does not decide whether contradictory, superseded, retracted, deleted, or stale records may support an outgoing claim. We introduce Governed Persistent Memory (GPM), an auditable bitemporal state-transition model with source-bound admission, derived lifecycle state, current public barriers, and fail-closed structured release. Five executable clauses cover ledger integrity, source binding, conflict isolation, non-revival after retraction or deletion, and exact claim closure over a fresh view at one verified head. On a prespecified hash-frozen 3,600-case GPM-ReleaseBench, GPM matches all complete outcomes; the strongest of three intentionally simple complete policies matches 1,800/3,600 and makes unmatched releases on 50% of violation cases. A separate sealed end-to-end service evaluation exercises real ingestion and release across eight query families. In its publicly disclosed V3 arm, the governed lane is correct on 2,400/2,400 clusters versus 600/2,400 for ungoverned local Qwen2.5-7B; it repairs all 1,800 baseline failures with no regression (one-sided 95% lower bounds 99.875% and 99.834%). A later V5 reseal over Chinese- and English-command arms, with generation-date pinning and no post-freeze reducer amendment, again obtains 2,400/2,400 per arm. A production-code-independent finite model explores 331,776 semantic and 1,990,656 query states without a full-contract counterexample, and a 100,000-trace three-engine differential yields zero mismatches. These are bounded contract and implementation results, not open-world model accuracy or evidence of world truth. Governed answers in the sealed service evaluation are deterministic service outputs; the 7B result is the ungoverned comparison, not a claim that a language model itself became perfectly accurate. 1 Introduction Long-horizon agents must preserve facts, preferences, commitments, and task state across interactions. Retrieval-augmented generation, generative agents, external memory, and memory operating systems extend a model beyond its immediate context window [13, 22, 20, 27, 5, 14]. Yet retrieving a relevant passage and being entitled to assert a current fact are different operations. Consider four common changes. A user moves from one city to another. Two sources disagree about a single-valued attribute. A previously asserted fact is later retracted. A user deletes their history, but a stale snapshot or derived index can still surface it. Relevance ranking can return a high-scoring candidate in every case; relevance alone does not establish public assertability. Persistence also changes the time scale of failure: one extraction error can be recalled, summarized, and written back until it acquires the appearance of stable history. HaluMem localizes such propagation across extraction, update, and question-answering stages [4]; LongMemEval, LoCoMo, and MemoryAgentBench measure complementary aspects of long-term interactive memory [17, 29, 9]. We ask a narrower systems question: what state semantics must hold before persistent memory may support a public claim? Our answer, GPM, separates external source acquisition, authenticated episode registration, optional claim admission, append-only history, public projection, candidate ranking, untrusted claim proposal, and a local structured-release decision. The contribution is not a new vector index. It is a set of executable state obligations and a release boundary that remains meaningful when records conflict, arrive late, are retracted, or must become publicly inaccessible. Several 2026 systems sharpen this boundary. StateFuse preserves contradictions across replicated operation sets and resolves them at projection time [25]; TOKI defines a bitemporal operator algebra for contradictory histories [28]; MemIR separates evidence, assertion, and decision roles to prevent provenance-role collapse [10]; and MemoRepair withdraws and selectively rebuilds provenance-linked descendants after invalidation [31]. GPM addresses a narrower end-to-end state contract: source admission into a bitemporal public state, current-policy non-revival across historical reads, and exact closure of an outgoing structured claim set over a fresh view under one stable verified head. It does not provide replica convergence, semantic tombstones, arbitrary descendant repair, or a guarantee for free-form generation. The paper makes six contributions: 1. a bitemporal, source-bound event model with derived rather than caller-assigned lifecycle states; 2. five executable contract clauses linking storage integrity, source binding, conflict isolation, retraction and deletion barriers, and structured release; 3. GPM-ReleaseBench v1, an internally designed contract-conformance suite with frozen development and evaluator-hidden counterfactual cases plus matched complete policies; 4. a sealed end-to-end evaluation through the real ingestion and release services, with eight governed query families, an ungoverned local 7B comparison, and a bilingual command-surface reseal; 5. bounded exhaustive checking and 100,000-trace differential evidence across strict, incremental, and segmented implementations; and 6. clean-task utility controls and an explicit failed language-judge gate that prevent state-level guarantees from being rewritten as open-world answer correctness. 2 From Retrieval to Governed State 2.1 Retrieval is not public eligibility Let M⁡(u,t)M(u,t) be the ungoverned set of a user’s stored memory items visible at valid-time point t, and let k be a fixed top-k truncation depth. A retriever returns ranked candidates R⁡(q,u,t)=rankk⁡s⁡(q,mj):mj∈M⁡(u,t),R(q,u,t)=rank_k\s(q,m_j):m_j∈ M(u,t)\, (1) where q is a query, u a user, t a valid-time point, and s any lexical, vector, graph, or learned score, and rankkrank_k orders items by score and keeps the k highest. The score estimates relevance; it does not decide whether mjm_j has admissible provenance, is superseded, is in unresolved conflict, is retracted, or is hidden by a deletion barrier. We therefore define an assertable-fact projection VpubV_pub and a testimony-only episode projection EpubE_pub before ranking: RGPM(q,u,t,τ,hc)=rankk⁡s⁡(q,z):z∈Vpub(u,t,τ,hc)∪Epub(u,t,τ,hc).R_GPM(q,u,t,τ;h_c)=rank_k\s(q,z):z∈ V_pub(u,t,τ;h_c)∪ E_pub(u,t,τ;h_c)\. (2) Here hch_c is the engine’s current verified ledger head, defined in the formal model below. The projections determine candidate eligibility. Ranking only orders projected candidates and provides no end-to-end correctness guarantee. In particular, an episode in EpubE_pub may be retrieved as testimony but cannot satisfy the structured release contract. 2.2 Failure layers The architecture separates four failure layers. At the storage layer, events may be altered, truncated, duplicated, or reordered. At the state layer, unbound or caller-inferred claims, invalid supersession, unresolved conflict, or deletion revival can enter a public view. At the retrieval layer, relevant evidence may be missed or irrelevant evidence returned. At the language layer, a generator can negate, merge, overgeneralize, or fabricate even when evidence is present. The first two layers admit deterministic contract checks; the latter two require empirical evaluation and, for free-form language, stronger semantic checking than the present system provides. 3 Formal Model 3.1 Event ledger and trusted commitments An event is ei=(i,τi,ti,typei,payloadi,hi−1,hi),hi=H⁡(canon⁡(ei∖hi)).e_i=(i, _i,t_i,type_i,payload_i,h_i-1,h_i), h_i=H(canon(e_i \h_i\)). (3) Here i is a contiguous sequence number, τi _i is transaction time, tit_i is an optional valid-time field, and hih_i is a canonical hash chained to hi−1h_i-1. A valid ledger requires nondecreasing transaction time, τi≥τi−1 _i≥ _i-1. Transaction time is normally assigned by the engine clock; an explicitly trusted ingestion or reproducibility interface may inject a historical value only when the append preserves this order. A decreasing injected value is rejected before the event is committed. The single-file engines keep event count and chain head in a separately protected sidecar commitment. The segmented engine commits event count, chain head, segment metadata, and for every user-index shard both a record count and rolling hash head. A missing, modified, injected, or truncated index reference causes the affected public read to fail closed; full audit validates every declared or present shard. Indexes are derived from authoritative segments and can be rebuilt, but are not trusted merely because they are derivable. The state is Σ=(L,C,P,B,I) =(L,C,P,B,I): authoritative ledger L, materialized claims C, provenance witnesses P, public barriers B, and rebuildable indexes I. Events are applied through a partial transition δ⁡(Σ,e)=Σ′δ( ,e)= . If the sequence, predecessor, hash, commitment, or public-eligibility precondition fails, public reads stop or the affected claim remains outside the public projection. 3.2 Claims, provenance, and lifecycle A claim is c=(u,f,x,a,v,[ts,te),τ,p,r,σ),c=(u,f,x,a,v,[t_s,t_e),τ,p,r,σ), (4) with user u, fact identifier f, entity x, attribute a, value v, valid interval [ts,te)[t_s,t_e), transaction time τ, provenance witness p, optional superseded fact r, and descriptive support label σ. The executable checks act through p, not through σ. A direct episode witness binds the source event identifier and hash and requires a non-empty quote contained in the source. A digestion-ledger witness additionally binds claim, ledger, source unit, content, quote, extraction method, extractor version, extraction time, and byte span. Quote containment establishes string origin and location only; it is not a semantic-entailment test. A caller-marked inference is quarantined and cannot become a public fact through this admission path, but a semantically unsupported extraction can still pass if its quoted bytes exist. Semantic faithfulness therefore remains outside I2. Lifecycle state is derived from events rather than stored as a freely mutable label. The implemented transition vocabulary is summarized in table 1. Table 1: Implemented event transitions. “Public effect” is evaluated at the requested valid and transaction snapshot, subject to current public barriers. Event Preconditions and state update Public effect episode.add Append a source episode for one user; bind system transaction time. May appear as testimony-only retrieval material; never assertable under I5. fact.quarantine Record a failed governed claim admission against a bound episode. Claim is not assertable; the governed input episode is suppressed publicly. fact.assert Require a direct source-bound witness; validate valid interval and any supersedes edge. Eligible if active, nonconflicting, and unblocked. fact.retract Target an earlier fact owned by the same user. Target fact and its bound episode are absent from current public views. user.delete Establish the latest public deletion barrier for the user. Events at or before the barrier cannot reappear publicly. 3.3 Conflict and supersession Attribute cardinality is a deployment policy. The prototype treats unspecified keys as single-valued and includes common plural keys such as tag/tags, label/labels, and interest/interests in a built-in multi-value registry; deployment additions extend rather than replace this registry. Normalization N performs Unicode NFKC normalization, trimming, and case folding only. It performs no unit conversion or ontology reasoning. Two active claims conflict, ci⋈cjc_i c_j, when they have the same user, normalized entity, and single-valued attribute; overlapping valid intervals; unequal normalized values; and neither a retraction nor a valid supersession relation resolves them. A supersedes edge is valid only when its target is earlier and has the same user, normalized entity, and attribute. An invalid edge neither suppresses its target nor passes full audit. Unresolved sides are isolated from the public projection. 3.4 Public and audit views Because transaction time is nondecreasing, let L≤τq(hc)L_≤ _q(h_c) be the longest sequence prefix whose events have transaction time no later than τq _q within the ledger authenticated by the current verified head hch_c, and let C≤τq(hc)C_≤ _q(h_c) be the claims materialized from that prefix. The current public policy for user u at hch_c is Πpub(u,hc)=(dc,Rc) _pub(u;h_c)=(d_c,R_c), where dcd_c is the sequence of the latest user.delete event (or zero) and RcR_c contains fact identifiers retracted after that barrier in the full prefix through hch_c. Thus transaction time chooses the historical evidence prefix, while the current head supplies non-revival policy. Define q(u,t;hc)=c∈C≤τq(hc): _q(u,t;h_c)=\c∈ C_≤ _q(h_c): c.u=u,seq(c)>dc,t∈[c.ts,c.te), c.u=u,\;seq(c)>d_c,\;t∈[c.t_s,c.t_e), c.f∉Rc,prov≤τq(c;hc), c.f∉ R_c,\;prov_≤ _q(c;h_c)\, (5) Vpub(u,t,τq;hc)=c∈q: V_pub(u,t, _q;h_c)=\c _q: ¬supersededq(c)∧¬conflictedq(c). _C_q(c) _C_q(c)\. (6) Here seq⁡(c)seq(c) is the sequence of the assertion event. The source-binding predicate is evaluated against the requested prefix after the current deletion barrier; consequently a post-deletion claim cannot revive a pre-deletion source episode. Supersession and conflict are then derived over the remaining requested-prefix candidates. A retraction or deletion written after τq _q can therefore suppress a public historical read, but an assertion written after τq _q cannot enter it. The default public mode sets transactionAt=null and reads the current prefix. A non-null τq _q explicitly requests a policy-filtered historical prefix; it is not a current-state answer mode, because a contradiction or superseding assertion written after τq _q is absent from that prefix. An authorized audit view instead derives its deletion and retraction policy from L≤τqL_≤ _q itself and can reconstruct ordinary as-of state. In the implementation, auditView and auditSearch are separate methods, while public view/search and the public adapter reject audit flags. This API separation prevents accidental routing but is not itself authentication or authorization. The implementation also derives Epub(u,t,τq,hc)E_pub(u,t, _q;h_c) from episode events that survive the current deletion, quarantine, and fact-retraction barriers. An otherwise eligible episode can appear in this set without any admitted fact and is labeled testimony-only. It can be ranked for recall, but the local release decision indexes only assertable facts in VpubV_pub. 3.5 Executable obligations The implementation checks five obligations: I1 — Ledger integrity. Relative to a trusted local commitment, sequence, predecessor, canonical event hash, segment inventory, and index-shard commitments agree. Failure stops public service or enters an explicit recovery path. I2 — Syntactic source binding. Every public fact has a valid, direct, same-user witness bound to source bytes and location metadata. Caller-declared inferred facts are quarantined or rejected before public eligibility, and projection rechecks source-binding eligibility rather than trusting admission permanently. I2 does not establish that the quoted text semantically entails the normalized claim. I3 — Conflict isolation. No unresolved pair ci⋈cjc_i c_j appears as simultaneously assertable public facts. I4 — Public non-revival. Public reads apply the retraction and user-deletion policy at the current verified head even when τq _q requests an earlier prefix. A covered fact and its bound episode cannot re-enter through historical time, stale engine indexes, or engine-maintained materialized projections. I5 — Structured release closure. Every released structured answer claim exactly matches an assertable fact in the fresh public view and supplies a non-empty set of source fact identifiers, all of which match that claim. The returned local decision record binds the canonical complete claim multiset, policy and normalizer versions, user, query, snapshots, and verified head. Release is permitted only if the verified head remains hbh_b while the decision is formed; a changed head fails closed without a record. For a structured claim a (here a always denotes a structured claim, not the claim-tuple attribute field), let S⁡(a)S(a) be its supplied source fact identifiers and let tri⁡(a)tri(a) be its normalized entity–key–value triple. Given a public view V, define ℳ(a,V,u)=c.f∣ (a,V,u)=\c.f c∈V,c.u=u, c∈ V,\ c.u=u, (7) tri(c)=tri(a), (c)=tri(a)\, bound⁡(a,V,u)⇔ (a,V,u) S⁡(a)≠∅∧S⁡(a)⊆ℳ⁡(a,V,u). S(a)≠ S(a) (a,V,u). Let γ⁡(A)γ(A) be the lexicographically sorted multiset of each claim’s normalized entity–key–value triple together with the sorted unique identifiers in S⁡(a)S(a). Its canonical representation is a typed, length-delimited encoding prefixed by the domain and schema tag GPM-CLAIMS-v1; field types and multiplicity are preserved rather than joined with an ambiguous delimiter. Define DA=H⁡(canon⁡(γ⁡(A))).D_A=H(canon(γ(A))). (8) For user u, query q, requested snapshot (t,τ)(t,τ), policy version νP _P, and normalizer version νN _N, define the local record payload ρ⁡(d)=⟨d,u,H⁡(q),DA,t,τ,hb,νP,νN⟩.ρ(d)= d,u,H(q),D_A,t,τ,h_b, _P, _N . (9) The gate reads a verified head hbh_b, constructs Vb=Vpub(u,t,τ,hb)V_b=V_pub(u,t,τ;h_b) itself, evaluates every binding against VbV_b, and then reads the verified head again as hah_a. Its result is release_decision(A,u,q,t,τ)=⊥fail,hb≠ha,ρ⁡(release),hb=ha∧A≠∅∧∀a∈A:bound⁡(a,Vb,u),ρ⁡(abstain),hb=ha∧otherwise.release\_decision(A,u,q,t,τ)= cases _fail,&h_b≠ h_a,\\ ρ( release),&h_b=h_a A≠ ∀ a∈ A:bound(a,V_b,u),\\ ρ( abstain),&h_b=h_a . cases (10) Here ⊥fail _fail means that the prototype raises an error and returns no decision record. The gate does not accept caller-fabricated “assertable” objects. A verifier recomputes DAD_A, checks all context and version fields, and rejects a record whose ledger head is no longer current. The query hash binds record context but does not affect the release predicate; neither it nor I2 proves that a structured claim answers the query, follows semantically from its quote, or survives a later free-text rewrite. The prototype record is not signed or transferable: it is valid only inside the trusted local process boundary. A cross-process or cross-host credential would additionally require authentication such as a MAC or signature, anti-replay freshness, expiry, and key management. Equation (10) is the operational expansion of I5 for well-formed inputs. Contract consequence 1 (claim-bound non-revival). Assume I1–I5 hold under the stated threat model and the decision defined in equation 10 returns a local record whose decision is release. Then every a∈Aa∈ A is exactly bound to one or more same-user assertable facts in the fresh Vpub(u,t,τ,hb)V_pub(u,t,τ;h_b), DAD_A binds the complete canonical claim multiset and its supplied fact identifiers, and no a is bound only to a fact or episode excluded by the current retraction or user-deletion policy at hbh_b. If the verified head changes while the record is constructed, the prototype fails closed by raising an error; no decision record is returned. Derivation. The result follows directly from the contract definitions rather than an inductive theorem over all reachable states. Equation (10) requires hb=hah_b=h_a, A≠∅A≠ , and bound⁡(a,Vb,u)bound(a,V_b,u) for every a∈Aa∈ A; DAD_A commits to the canonical complete multiset. The definition of boundbound gives exact normalized values and a non-empty subset of matching fact identifiers. Membership in VbV_b entails syntactic source-binding eligibility by I2 and exclusion of unresolved conflicts and current non-revival barriers by I3–I4. I1 and the before/after head check bind those predicates to one verified ledger head; a changed head instead selects ⊥fail _fail. This consequence is source-relative and applies only to explicit structured claims; it proves neither semantic entailment, query relevance, nor properties of later free text. 4 System Design 4.1 Trust boundary and pipeline Figure 1 separates raw acquisition from the first governed operation: committing the source as episode.add. Optional claim admission and all later lifecycle changes append events to the same authenticated ledger, as detailed in table 1. Public projection rechecks source-binding eligibility, applies conflict and current non-revival policy, and emits assertable facts plus testimony-only episodes. Ranking only orders those candidates. An external component proposes structured claims; the local release decision is a separate protocol rather than another retrieval score. External source raw input Governed commit episode + claim events Verified ledger events, head, indexes Public projection I2–I4 eligibility Constrained retrieval ranking only Claim proposal untrusted A and fact IDs Release gate I5 local decision Figure 1: Public-memory path and trust boundaries. Raw acquisition is outside governed state; the authenticated ledger is the source of public projection. I2 establishes syntactic source binding, not semantic entailment. Retrieval ranks eligible candidates but neither admits claims nor authorizes release. Lifecycle writes are listed in table 1, and the local-decision protocol is expanded in figure 2. Figure 2 makes the head-stability test explicit. The gate reads hbh_b before constructing the public view, checks the complete structured claim set against that view, binds its digest DAD_A, and rereads hah_a before returning a local decision record. A head race is an error, not an abstention; with a stable head, an empty or nonclosed set abstains. Read head hbh_b Construct fresh view Vpub(u,t,τ,hb)V_pub(u,t,τ;h_b) Check claim closure all a∈Aa∈ A against VbV_b Reread head hah_a Head stable? ha=hbh_a=h_b A≠∅A≠ and all claims bound? Release claim-bound record Abstain abstention record Fail closed return no record yesnoyesno Figure 2: Fail-closed structured-release protocol. Closure is evaluated over the view bound to hbh_b, and the local record commits to DAD_A, policy and normalizer versions, query context, snapshots, and head. Equality of the independently reread hah_a is a precondition for either release or abstention; a mismatch returns no record. 4.2 Strict, incremental, and segmented engines The strict single-file baseline rereads and verifies the full chain before each append batch and public read. The incremental engine verifies the full prefix at load, validates only new events against the current head on append, and checks the trusted head plus disk state on public reads. A full audit still rereads all events and validates arbitrary-position tampering, sequence, hashes, provenance, and supersession. With the same trusted time input, the two engines produce byte-identical logical ledgers. The segmented engine uses fixed event-capacity segments, a serialized single-writer lock, transaction intents and receipts, and startup recovery for unfinished writes. User-index shards contain event references. The manifest authenticates each shard by record count and rolling hash; target-shard verification precedes user projection, and full audit covers the union of declared and physically present shards. Recovery rebuilds both index content and commitments from authoritative segments. The design is local concurrency control, not distributed consensus. 5 Experimental Method 5.1 Research questions and evidence hierarchy We ask five questions. First, does the complete I1–I5 contract distinguish matched controls from targeted violations under evaluator-hidden execution? Second, are the clauses mutually necessary within the benchmark’s constructed contract surface? Third, do a production-code-independent finite reference model and three production implementations agree within stated bounds? Fourth, does the contract hold end to end through the real ingestion and release services on its explicit command and query surface, including against an ungoverned local 7B comparison? Fifth, does the governance layer preserve utility when a public task contains none of the governed interventions? Evidence is ordered accordingly: frozen hidden contract tests and sealed end-to-end service tests are primary bounded empirical evidence; bounded exploration and implementation differential are finite formal and engineering evidence; performance is descriptive; clean public tasks are utility controls; and model-judged answer labels are admitted only if an internally prespecified reliability gate passes. 5.2 GPM-ReleaseBench v1 GPM-ReleaseBench v1 is an internally designed contract-conformance suite with 12 categories: source misbinding, cross-user mixing, scalar conflict, delayed-arrival bitemporality, retraction non-revival, deletion non-revival, deletion-index integrity, illegal overwrite, release-head change, exact claim closure, valid multivalue state, and unsupported free-text extension. The public development split contains 360 cases. The evaluator-hidden split contains 3,600 cases, 300 per category, arranged as 1,800 strict counterfactual pairs. Pair members differ by the smallest constructed change intended to move one behavior across a contract boundary. Runtime inputs contain opaque case identifiers and operations only; category, polarity, pair identifier, criticality, applicable-system metadata, and acceptable outcomes are withheld from runners. The generator, task manifest, metric definitions, system runners, and stopping rules were frozen before hidden execution. Two isolated AI review lines independently audited the hidden gold and returned GO; no human blind annotation was performed. Hidden gold was then sealed with AES-256-GCM, its plaintext evaluator file removed, and the runner executed without the evaluator key. This is process and cryptographic separation on one local host, not separate-user or hardware isolation. The benchmark is evaluator-hidden relative to the tested runners, but it was designed by the same project as GPM and is not an external naturalistic distribution. 5.3 Matched systems and deterministic outcomes We run four complete systems. Raw append exposes the accumulated stream. Latest-first resolves a key by its most recent candidate. Flat conflict-preserving blocks direct unresolved conflicts but lacks the full provenance, bitemporal, index-integrity, and stable-head release contract. GPM implements I1–I5. A case is an atomic match only if its complete structured output matches one allowed outcome bundle. Answer-bundle accuracy excludes violation cases whose only purpose is to diagnose unsupported free text. Unsafe release is an unmatched release on a violation-polarity case. Safe coverage is the fraction of cases with at least one acceptable release bundle for which the system returns such a release; choosing an allowed fail-closed outcome does not count as coverage. The internally prespecified comparison first considers complete valid policies with zero unsafe release in every critical category and, if any exist, maximizes safe coverage, breaking ties by answer-bundle accuracy and stable identifier. If none satisfies the zero-critical condition, it minimizes critical-category unsafe releases before applying the same safe-coverage, accuracy, and stable-identifier order. Because the suite is a fully enumerated generated artifact with no external sampling frame, we report deterministic counts and exact within-suite point differences only. We make no confidence-interval or population-incidence claim. StateFuse is additionally run through its official state projection and the same structured closure adapter on the 2,100 cases supported by their shared contract surface [25]. Unsupported bitemporal, user-deletion, deletion-index, stable-head, and free-text-release cases are marked unsupported rather than scored as failures. This shared-subset result is not eligible for the complete-system ranking. 5.4 Sealed end-to-end governed-memory evaluation Governed-QA Sealed tests a complementary implementation surface. Each arm contains 2,400 deterministically generated clusters: 300 each for direct recall, set and count, temporal recall, update and conflict, multi-hop joins, false-memory pressure, open key–value notes, and boundary pressure. A cluster traverses the production ingestion and release services rather than a paper-only adapter. Boundary clusters require narrative statements not to be ingested and ordinary non-memory questions to be returned to the general provider. Governed answers are exact deterministic service outputs; no language model generates them at query time. The candidate file set is hash-frozen before a random seed is committed and revealed. Generation fixes each machine oracle at case construction. Answerable cases require byte-exact answers, unanswerable cases require abstention, and ordinary questions require pass-through; wrong answers, abstention on answerable cases, unsafe release, and swallowed ordinary questions are distinct failures. Refusing everything therefore cannot score well. The V5 freeze additionally closes the statically reachable implementation set, pins the generation date, and binds 44 files spanning ingestion, release, grammar, lineage, policy, and scoring. The comparison receives the same setup turns and questions but answers them directly with local Qwen2.5-7B through Ollama at temperature zero, without governed storage or release. Its scorer is deliberately generous: an answerable response is correct when it contains every bare gold value, Chinese numerals count for count questions, and ordinary questions are always credited. The same local 7B may nominate candidate spans for optional free-form capture, but deterministic validation decides admission and the governed query answer remains model-independent. We retain the original V3 arm because it is the publicly disclosed result [1]. V3 crossed UTC dates between candidate and baseline execution, producing 120 temporal questions whose date literal differed although slice and generated gold were identical. Its reducer was therefore amended after freeze to admit only that dated form and records the amendment in its output. V5 is a separate methodological confirmation: it pins the date before execution, reports zero question-surface mismatches and reducer_amended_after_freeze=false, and evaluates Chinese- and English-command arms separately. One-sided 95% Clopper–Pearson lower bounds summarize the observed all-success denominators; they do not turn this internally generated contract surface into a natural-population sampling frame. 5.5 Finite verification and implementation differential A separate executable reference model imports no production engine code. Within explicit finite domains it enumerates two users, two entities, two keys, three normalized value representatives, three valid-time points, two facts, ledgers of up to four events, four single-fault classes, and five commit crash phases. The full contract and six guard-removal mutants—source binding, valid time, conflict, lifecycle barrier, source closure, and stable head—are checked at every query state. This is bounded exhaustive model checking, not a TLA+/Alloy result or an unbounded proof. A separate deterministic random-schedule test compares the strict in-memory production projection, incremental in-memory production engine, and segmented persistent production engine. Each of 100,000 traces uses a unique user to prevent cross-trace semantic interference. After one complete audit, the segmented engine uses a frozen in-memory user-index adapter over the unchanged production projection to make all reads tractable. Head races and physical crash schedules remain in targeted suites and the bounded model rather than this bulk test. 5.6 Performance design Measurements run on Windows x64 with Node.js v24.18.0, an Intel Core i9-13900H (20 logical CPUs), and 63.64 GiB RAM. Six paired fresh-process repetitions run strict and incremental engines in balanced order on the same 10,008-event mixed workload, using 2,000-event append batches. Six segmented repetitions ingest one million synthetic episode events for 1,000 users, warm 20 searches, time 200 searches, and execute audit, cold start, tamper detection, and recovery. Medians and full ranges are descriptive; six machine runs are not IID population samples. 5.7 Public clean-task controls We use LongMemEval and MemoryAgentBench EventQA only as clean-task controls [29, 9]. EventQA rows 0–9 were inspected during integration and excluded; rows 10–16 remained eligible. LongMemEval cases were selected from a 347-item project-fresh lock. Project-fresh means not used in this project’s prior development or tuning; public benchmark exposure during model pretraining is not claimed absent. Version 1 freezes 120 LongMemEval and 120 EventQA cases before outcomes and uses Qwen2.5-1.5B and Llama-3.2-1B. After its semantic-judge gate fails, version 2 is opened as a separately versioned confirmation on 240 disjoint cases and uses Qwen2.5-7B and Gemma-3-4B. EventQA is balanced between 65,536- and 131,072-token strata. Both versions use temperature zero, top-12 retrieval, and a 24,000-character evidence budget. On every selected clean task, flat-conflict and GPM produce content-hash-identical candidate pools, so one shared generator call represents both conditions. Their answer difference is therefore structural, not an independently estimated model effect. EventQA uses the upstream deterministic substring criterion. LongMemEval uses two local AI judges with generator identity hidden. The internally prespecified primary gate requires Cohen’s κ≥0.80κ≥ 0.80 separately for correctness, hallucination, and omission. Failure leaves all LongMemEval answer-layer rates descriptive. 6 Results 6.1 Evaluator-hidden contract results Table 2: GPM-ReleaseBench v1 evaluator-hidden results on 3,600 cases. Unsafe release is conditioned on 1,800 violation-polarity cases; other denominators follow the definitions in the text. System Atomic match Answer acc. Unsafe release Safe coverage Raw append 1500/3600 43.48% 91.67% 76.92% Latest-first 1500/3600 43.48% 58.33% 53.85% Flat conflict-preserving 1800/3600 52.17% 50.00% 61.54% Full GPM 3600/3600 100.00% 0.00% 84.62% Flat conflict-preserving is the strongest of the three intentionally simple complete policies under the frozen rule. Relative to it, GPM changes unsafe release by −50.00-50.00 percentage points, answer-bundle accuracy by +47.83+47.83 points, safe coverage by +23.08+23.08 points, and atomic match by +50.00+50.00 points. The difference exceeds the internally predefined deterministic margin of −2-2 answer-accuracy points. These are deterministic differences for the generated hidden suite, not estimates of natural-world failure frequency. Each of five critical violation categories has 0/150 unsafe releases; this is an exact suite count, not a population confidence statement. On StateFuse’s 2,100 supported shared-contract cases, the official projection plus common closure adapter matches 1,200 complete bundles, has no unmatched violation release, and has 62.50% safe coverage. Because 1,500 cases are outside its declared adapter surface, this does not establish an overall ranking against GPM. 6.2 End-to-end governed-memory results Table 3: Governed-QA Sealed V3 end-to-end results. The ungoverned comparison is local Qwen2.5-7B at temperature zero; the governed lane traverses the deterministic ingestion and release services. Query family Ungoverned 7B Governed lane Direct recall 41/300 (13.7%) 300/300 Set and count 98/300 (32.7%) 300/300 Temporal recall 63/300 (21.0%) 300/300 Update and conflict 41/300 (13.7%) 300/300 Multi-hop joins 65/300 (21.7%) 300/300 False-memory pressure 45/300 (15.0%) 300/300 Open key–value notes 34/300 (11.3%) 300/300 Boundary pressure∗ 213/300 (71.0%) 300/300 Total 600/2,400 (25.0%) 2,400/2,400 (100%) ∗Ordinary non-memory questions are always credited to the ungoverned baseline because it is supposed to answer them; this makes its boundary-family score comparatively high. The governed lane is correct on all 2,400 clusters, with a one-sided 95% Clopper–Pearson lower bound of 99.875%. Of the 1,800 clusters missed by the ungoverned 7B, all 1,800 are corrected; none of its 600 correct clusters regresses. The bounded cure lower bound is 99.834%. These counts do not mean that Qwen2.5-7B reached 100% accuracy. The model is the 25% ungoverned comparison; the 100% result belongs to a deterministic governed lane on its explicit contract. Table 4: Governed-QA Sealed V5 confirmation after generation-date pinning. “Repaired” is conditioned on baseline failure; regressions are conditioned on baseline-correct clusters. Command arm Ungoverned correct Governed correct Repaired Regressions Chinese 1,346/2,400 (56.1%) 2,400/2,400 1,054/1,054 0/1,346 English 636/2,400 (26.5%) 2,400/2,400 1,764/1,764 0/636 Both V5 command arms again pass every 300-case family gate. The correctness lower bound is 99.875% per arm; cure lower bounds are 99.716% for Chinese commands and 99.830% for English commands. Unlike V3, V5 requires no post-freeze reducer amendment and has no date-surface mismatch. At preparation of this revision, all 44 frozen candidate files, the reachable-file closure, and the seed commitment reverified without drift. 6.3 Post-aggregate guard-removal diagnostics The single-clause removals in table 5 were implemented only after aggregate full-system and policy results were visible. They are mechanism diagnostics, not prespecified hidden ablations or unbiased causal estimates. Table 5: Post-aggregate exploratory removal of one obligation. Condition Atomic match Unsafe releases Exposed contract surface No I1 3450/3600 0 index commitment detection No I2 3450/3600 150 source-binding/supersession admission No I3 3450/3600 150 unresolved scalar conflict No I4 3000/3600 450 retraction and deletion barriers No I5 2850/3600 750 closure, fresh view, stable head No-I1 illustrates why unsafe-release count alone is insufficient: the mutant misses 150 required fail-closed outcomes without directly releasing an unmatched claim. Every contract clause is therefore evaluated through complete outcome bundles rather than one safety rate. 6.4 Finite verification and three-engine agreement Table 6: Finite executable verification. Counts are exhaustive or deterministic within the stated bounds. Check Result Semantic states / query states 331,776 / 1,990,656 Full-contract counterexamples 0 Guard removals with a counterexample 6/6 Valid finite ledgers / injected faults rejected 30 / 121 Differential traces / logical actions 100,000 / 287,395 Engine action executions / observation points 862,185 / 300,000 Segmented persisted events / full-audit result 349,988 / pass Public, audit, or release mismatches 0 The independent model finds no counterexample to the full contract and finds at least one for every guard removal. Consistent with the valid-ledger definition above, it rejects a decreasing transaction time, as well as tamper, truncation, reordering, duplication, and invalid crash-recovery states, within its bounds. The production differential in table 6 observes no mismatch. Zero bounded counterexamples and zero sampled implementation differences remain finite evidence, not a proof that the implementation is defect-free. All 39 incremental, 41 segmented, 24 retraction-barrier, 39 trust-boundary, and 22 release-contract implementation checks also pass. The added release checks reject claim or source-identifier substitution and stale-head replay; applying the strengthened record schema leaves all 3,600 hidden benchmark decisions byte-identical. Four writer processes complete 120 events without observed loss, duplication, or fork; this is only a lock smoke test. 6.5 Performance and scale Table 7: Six fresh-process repetitions. Values are descriptive median and full range. Metric Median Range Strict single-file throughput (events/s) 12,295.2 10,506.3–12,583.7 Incremental throughput (events/s) 44,156.4 34,580.0–49,571.3 Paired speedup 3.565×3.565× 2.8092.809–4.718×4.718× Strict-first paired speedup 3.725×3.725× 3.6883.688–4.718×4.718× Incremental-first paired speedup 3.303×3.303× 2.8092.809–3.442×3.442× Segmented 1M throughput (events/s) 39,300.8 38,352.9–40,099.6 Segmented full audit (s) 8.702 8.538–9.527 Cold-start full audit (s) 8.638 8.526–9.495 Search p50 / p95 (ms) 57.332 / 70.537 57.046–61.702 / 65.027–78.801 Peak RSS (MiB) 340.3 336.5–346.1 All six single-file pairs produce identical logical-ledger hashes, and every segmented run passes full verification, tamper detection, and recovery. The speedup in table 7 comes from avoiding repeated audit of an already verified prefix, not from deleting the audit path. Nonoverlapping order strata indicate a systematic cache or warm-up effect; both strata and the pooled median are therefore shown. Segmented episode-only stress and mixed single-file workloads are not an absolute architecture comparison. 6.6 Clean public tasks and failed language gate Table 8: Deterministically scored EventQA clean-task controls. “Substring match” is the upstream criterion, not semantic exact match. Each row is one shared generation because flat-conflict and GPM prompts are byte-identical. Version Local generator Substring match Abstention V1 Qwen2.5-1.5B 41/120 (34.17%) 4/120 (3.33%) V1 Llama-3.2-1B 3/120 (2.50%) 2/120 (1.67%) V2 Qwen2.5-7B 69/120 (57.50%) 25/120 (20.83%) V2 Gemma-3-4B 59/120 (49.17%) 0/120 (0.00%) Table 9: LongMemEval semantic-judge reliability. Primary eligibility required every label-specific kappa to reach 0.80. Version Parse valid Full agreement κcorrect _ correct κhall. _ hall. / κomit _ omit Eligible V1 97.50% 10.26% .0734 −.0053-.0053 / .0282 no V2 100.00% 75.83% .8090 .1705 / .7567 no The structural flat-versus-GPM answer difference is 0 points in both versions and exceeds the internally predefined deterministic margin of −2-2 points, but it is not a stochastic treatment estimate. Table 8 measures local-model utility only and makes no frontier-model claim. The LongMemEval answer counts—V1: 32/120 and 27/120; V2: 42/120 and 18/120 for the two respective generators—are retained as descriptive negative evidence. Because table 9 fails in both versions, no LongMemEval answer-accuracy, hallucination, or omission rate supports a primary claim. The candidate reproduction artifact contains the public development benchmark, finite checks, frozen locks, and aggregate public-task receipts, but excludes hidden gold, keys, licensed raw datasets, model weights, and raw prompts. Two independently copied same-host fresh-directory runs reproduce the 360-case development scores, bounded counts, and 100,000-trace differential receipt with the same semantic SHA-256. This verifies packaging determinism on one host; it is not independent third-party reproduction. 7 Related Work and Discussion Retrieval-augmented generation and long-term agent memory primarily optimize access to information beyond the current context [13, 20, 27, 5, 14]. Recent systems add temporal graphs, consolidation, learned memory operations, and reflective structure [2, 8]. Text2Mem defines typed executable operations across memory backends [26], while conflict-aware memory applies explicit detection rules to vector data quality [16]. Long-memory benchmarks now cover dialogue recall, updating, forgetting, hallucination propagation, and controlled conflict regimes [17, 29, 4, 9, 24]. A controlled ACL study further shows that addition, deletion, error propagation, and experience replay policies change agent behavior in distinct ways [30]. Adjacent formal work separates three decisions that ordinary retrieval leaves implicit. Trust-sensitive revision filters a report through source- and domain-specific trust before changing belief [3]; revision by history constrains current revision through a sequence of prior revisions and their outcomes [15]; and partial abstention optimizes the choice to withhold uncertain components of a multilabel prediction [19]. GPM does not replace these belief-revision or decision-theoretic accounts. It gives an executable systems contract for a different boundary: whether source-bound, bitemporal, lifecycle-governed state may support an explicit outgoing claim under a fresh verified ledger head. A close contract-level neighbor is StateFuse, which builds deterministic conflict objects, projection-scoped resolution, and exact or semantic retraction handles over a replicated OpSet/CRDT substrate [25]. Its reported evidence shows that conflict-preserving surfaces can expose disagreement without a general answer-accuracy advantage over strong flat baselines. GPM is not replica-convergent and has no unseen-target semantic tombstone. In return, its evaluated contract starts earlier, by binding admitted claims to source content and valid/transaction time, and ends later, by requiring a fresh public projection and verified head before an explicit claim set can be released. MemoRepair studies a complementary lifecycle stage: deletion, correction, or interface migration can invalidate arbitrary summaries, caches, skills, and tool procedures downstream of a source [31]. Its influence-provenance graph, withdrawal barrier, validated successor construction, and predecessor-closed repair selection are outside GPM’s scope. I4 covers the target fact, its bound episode, and engine-declared indexes and projections; I4 therefore does not provide cascade repair for arbitrary derived artifacts. Conversely, MemoRepair does not specify the bitemporal claim-admission and structured answer-release closure studied here. TOKI and MemIR are adjacent at different layers. TOKI supplies explicit bitemporal operators for contradiction-aware state reconstruction and resolution [28]; GPM instead fixes one public-policy interpretation and tests its non-revival behavior in three engines. MemIR addresses provenance-role collapse by keeping evidence, assertion, and decision objects typed [10]; GPM binds source evidence at admission but does not offer MemIR’s richer role system. Neither distinction implies empirical superiority because the released tasks and contracts differ. Table 10: Contract-level positioning of closely related systems. Cells summarize the contract each work makes explicit; they are not an empirical ranking. System Governed state Change or invalidity contract Outgoing boundary StateFuse [25] Replicated immutable operation set and projection Explicit conflict objects; exact and semantic correction handles Projection selects a candidate or abstains TOKI [28] Bitemporal persistent-memory history Operator algebra reconstructs and resolves contradictory states Returns operator-defined state; no claim-bound local decision MemIR [10] Typed evidence, assertion, and decision records Role constraints prevent provenance from collapsing into unsupported state Preserves typed lineage; no stable-head local release record MemoRepair [31] Provenance-linked derived artifacts Barrier-first withdrawal and validated descendant repair Republishes validated, predecessor-closed successors GPM Source-bound bitemporal claims and episodes Current barriers, conflict isolation, supersession, and retraction Claim-bound local record over a fresh view and stable head Provenance graphs, bitemporal databases, conflict detection, and selective prediction are established components with mature precedents [18, 23, 6]. The ledger and head-reread design likewise sits beside established work on hash-linked timestamping, append-only transparency logs, optimistic validation, and mutable usage-control decisions [7, 12, 11, 21]. GPM does not replace those security or database mechanisms. Its contribution is their scoped composition into one public-eligibility decision: failed source binding, invalid supersession, unresolved conflict, current retraction/deletion, or a nonclosed structured claim causes the public path to fail closed. This governance layer can be combined with different retrievers, memory graphs, operation languages, replicated conflict substrates, or descendant-repair planners. Append-only audit and deletion rights remain in tension. Physical event removal destroys audit evidence, whereas indefinite plaintext retention violates data minimization and user expectations. Our result is a public-view barrier plus a separately routed audit view. It is not media erasure, backup deletion, cryptographic erasure, or machine unlearning. Production deployments still require retention policy, least-privilege audit authorization, encryption and key destruction where appropriate, and legally compliant deletion procedures. Selective prediction frames coverage jointly with the risk among released outputs [6]. Our guard-removal and answer diagnostics show both sides: weakening gates can expose unsafe release, while excessive abstention converts errors into omissions. The objective is not maximum abstention but maximum valid coverage under an explicit risk budget, with distinctions among conflict explanation, clarification, hedged response, and complete abstention. 8 Limitations and Threats to Validity External validity and benchmark construction. GPM-ReleaseBench is synthetic and was designed by the same project as GPM. Its hidden split tests runner behavior against a frozen contract, not transfer to natural dialogue, new ontologies, adversarial authors, or multi-year privacy drift. Counterfactual homogeneity makes the within-suite differences exact but says nothing about the frequency of those failures outside the suite. The one-million-event workload is likewise engineering stress, not a natural event distribution. Baselines. The three complete baselines are intentionally simple matched policies, not full Mem0, MemGPT, MemOS, TOKI, MemIR, MemoRepair, or graph-memory systems. StateFuse is evaluated only on a 2,100-case shared-contract subset. Different systems expose different ingestion, invalidation, replication, and release contracts, so table 2 supports superiority only over the listed complete policies on this constructed suite. The related-work matrix in table 10 is a scope comparison, not an empirical ranking. Hidden-evaluation process. Two isolated AI review lines audited the hidden gold, but there was no independent human annotation. Gold sealing and key separation occurred under one operating-system user, so they reduce accidental access and bind artifacts without constituting an independent security principal. The system implementation and benchmark ontology were both available before the hidden run; evaluator-hidden execution is not the same as an externally authored benchmark. Sealed service evaluation. Governed-QA Sealed is also internally generated and tests an explicit command grammar and eight query families, not arbitrary dialogue. Its deterministic oracle is strong for that surface but does not assess semantic equivalence outside the generated forms. Qwen2.5-7B is one deliberately ungoverned local comparison, not the strongest possible memory system or a representative sample of model providers. The V3 reducer amendment for 120 cross-date temporal surfaces was made after freeze and is reported rather than hidden; V5 removes that defect by pinning the date before execution. The Clopper–Pearson bounds summarize all-success denominators within these prespecified runs and do not justify an open-world or product-wide accuracy claim. Derived-artifact scope. I4 covers facts, their bound episodes, and the indexes and materialized projections declared by the three engines. It does not discover or repair arbitrary downstream summaries, cached outputs, embeddings, skills, or model parameters. Such descendants require complete influence provenance and a cascade-withdrawal and repair contract of the kind studied by MemoRepair. Schema coverage. Unregistered attributes are treated as single-valued and only a small registry is multi-valued. Normalization is NFKC, trimming, and case folding. Set merge, vague time, unit conversion, entity coreference, and open-text contradiction require stronger schema and semantic layers. Temporal policy. Current public release uses transactionAt=null. Non-null transactionAt is an explicit policy-filtered historical mode: it combines a requested transaction prefix with retraction and deletion policy at the current verified head. This prevents revival of retracted or deleted state, but conflicts and valid superseding assertions written after the requested prefix are not projected into that prefix. Consequently caller-selected historical mode may expose a fact later contradicted or superseded and is unsuitable for current-state answers. The query hash does not authorize historical mode; deployment policy must restrict it. Ordinary as-of reconstruction is confined to the separately authorized audit interface. Release scope. I5 decides exact matches for explicit structured claims and supplied source fact identifiers in the selected public mode. The local record binds the canonical complete claim multiset, versions, context, snapshots, and head, and verification rejects claim substitution or a stale head. It is not a signed cross-boundary credential. The query hash does not prove query–claim relevance, I2 does not prove semantic entailment from quoted text, and the gate cannot detect implicit assertions in final prose. Threat model. The trusted computing base comprises engine code, system clock, single-writer coordination, deployment authentication, and a head commitment or segmented manifest protected separately from authoritative storage. Public reads detect ordinary file replacement, equal-length modification, index-reference deletion or injection, and truncation. The prototype does not resist a malicious authorized writer, a host attacker who rewrites both storage and commitments, forged filesystem metadata, or lack of an external anchor. Separate audit methods are not access control, and local multi-process tests are not distributed consensus. Finite verification. The reference model is exhaustive only within its declared small domains and event bound. The five obligations are executable interface clauses, not an inductive proof over all reachable unbounded states. The 100,000-trace differential uses unique users and a fixed public seed; it does not cover unbounded traces, distributed interleavings, hash collisions, or a host that rewrites both storage and its independent commitment. The post-aggregate I1–I5 removals are exploratory and cannot be treated as prespecified hidden ablations. Public answer controls. Flat-conflict and GPM receive byte-identical clean-task prompts, so the observed zero difference is an implementation sanity check rather than an estimated treatment effect. EventQA values use the upstream substring criterion, not semantic exact match. Both LongMemEval versions fail the label-wise judge-agreement gate and cannot support primary answer-accuracy, hallucination, or omission claims. Public benchmark pretraining exposure is not claimed absent, and the local 1B–7B models do not estimate frontier performance. These clean-task controls and the governed-query service test answer different questions: the former retains free-form model generation, whereas the latter returns deterministic contract values. Reproducibility. Two fresh-directory copies reproduce the candidate package on one host. Hidden gold, evaluator keys, licensed raw public datasets, model weights, and raw model prompts are excluded, so the package cannot independently rescore the hidden split or rerun the language-model controls. There is no external-team reproduction. The minimal artifact now has an explicit PolyForm Noncommercial 1.0.0 license and passes clean extraction, but it remains release-ready rather than published: no public URL, DOI, or release date has been assigned. The V3 aggregate service result is disclosed in an immutable public repository commit [1]; complete V3/V5 per-cluster receipts are not part of the TeX archive or the v1.0.0 artifact. 9 Ethics, Disclosure, and Artifact Statement Persistent memory lengthens the lifetime of both error and privacy exposure. Systems should reject unsupported claims by default, let users inspect, correct, and delete memory, distinguish source statements from inference, and propagate deletion into public indexes. A conflict need not imply user dishonesty; time, context, and source error can produce apparent contradiction. No new human subjects or private conversations from project users were used. GPM-ReleaseBench and Governed-QA Sealed are synthetic. LongMemEval and MemoryAgentBench are represented by upstream revisions, hashes, selected identifiers, and aggregate results subject to their licenses; their raw licensed records are not included in the artifact candidate. The author is employed by Qingdao Guodongxiansheng Network Technology Co., Ltd. (Guǒdòng Xiānsheng). The author and company may have financial interests in Aethmere-OS, related software, commercialization, and intellectual-property applications. Because the author writes primarily in Chinese and has limited English proficiency, OpenAI Codex assisted with English translation, language editing, and LaTeX typesetting; it also assisted with literature organization, experiment scripting, and deterministic result checks under the author’s review. Codex is not an author. Guodong Xu conceived the study, determined the claims and interpretation, verified the reported results and citations, reviewed and approved all AI-assisted content, and accepts full responsibility for the paper. No external grant supported this work; the author and company supplied the local hardware and compute. The arXiv source archive contains only compilation inputs. A manifest-bound v1.0.0 reproducibility artifact contains the public development benchmark, executable finite checks, frozen locks, and aggregate receipts, and excludes evaluator secrets and licensed raw datasets. It is licensed under PolyForm Noncommercial 1.0.0 and passes a same-host clean-extraction rerun, but remains release-ready rather than publicly uploaded; its URL, DOI, and release date are unset. Large per-question records, the Governed-QA Sealed per-cluster receipts, and raw licensed datasets are intentionally excluded from the TeX archive. 10 Conclusion Governed persistent memory reframes long-term agent memory as a source-bound, bitemporal state system with an explicit public release boundary. Admission, conflict, retraction, deletion, and release each have executable preconditions and observable failure evidence. On a frozen 3,600-case contract suite, the complete system matches every allowed outcome and avoids unmatched violation release, while the strongest of three intentionally simple complete policies matches half of the cases and releases unsafely on half of the violation cases. On the separate sealed end-to-end service surface, the V3 governed lane returns 2,400/2,400 contract-correct outcomes versus 600/2,400 for an ungoverned local 7B and repairs all 1,800 baseline failures without regression; V5 repeats 2,400/2,400 in both command-language arms without a reducer amendment. A production-code-independent bounded reference model and a 100,000-trace three-engine differential find no full-contract counterexample or implementation mismatch within their declared bounds. Contract consequence 1 states the resulting source-relative non-revival property for claim-bound local records. The same evidence sets strict limits. Both contract benchmarks are internally designed and synthetic; finite exploration is not an unbounded proof; clean public tasks contain no governed intervention; and both LongMemEval semantic-judge protocols fail their reliability gate. The 100% sealed result belongs only to the explicit governed contract, not to Qwen2.5-7B, open-world dialogue, or the product as a whole. Governed state is therefore one necessary foundation for reliable long-term memory, not a sufficient solution to relevance, truth, or free-form generation. Externally authored challenge sets, publication of the licensed artifact and sealed receipts, independent reproduction, arbitrary descendant repair, richer typed conflict semantics, free-text evidence closure, and longitudinal user studies remain open work. References [1] Aethmere-OS Project (2026) Governed memory: public bounded evaluation disclosure. Note: Immutable repository commit https://github.com/kzkz137806/aethmere-os/commit/dffc1c3659bc8377faf8c0443363926c1fda7a6Accessed 2026-08-11 Cited by: §5.4, §8. [2] P. Banerjee, M. Moshtaghi, S. Subramanian, A. Misra, and A. Chadha (2026) APEX-MEM: agentic semi-structured memory with temporal reasoning for long-term conversational AI. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics, p. 16470–16489. External Links: Document, Link Cited by: §7. [3] R. Booth and A. Hunter (2018) Trust as a precursor to belief revision. Journal of Artificial Intelligence Research 61, p. 699–722. External Links: Document Cited by: §7. [4] D. Chen, S. Niu, K. Li, P. Liu, X. Zheng, B. Tang, X. Li, F. Xiong, and Z. Li (2025) HaluMem: evaluating hallucinations in memory systems of agents. arXiv preprint arXiv:2511.03506. External Links: 2511.03506, Link Cited by: §1, §7. [5] P. Chhikara, D. Khant, S. Aryan, T. Singh, and D. Yadav (2025) Mem0: building production-ready AI agents with scalable long-term memory. arXiv preprint arXiv:2504.19413. External Links: 2504.19413, Link Cited by: §1, §7. [6] Y. Geifman and R. El-Yaniv (2017) Selective classification for deep neural networks. In Advances in Neural Information Processing Systems, Vol. 30. External Links: Link Cited by: §7, §7. [7] S. Haber and W. S. Stornetta (1991) How to time-stamp a digital document. Journal of Cryptology 3 (2), p. 99–111. External Links: Document Cited by: §7. [8] C. Hu, X. Gao, Z. Zhou, D. Xu, Y. Bai, X. Li, H. Zhang, T. Li, C. Zhang, L. Bing, and Y. Deng (2026) EverMemOS: a self-organizing memory operating system for structured long-horizon reasoning. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics, p. 45836–45853. External Links: Document, Link Cited by: §7. [9] Y. Hu, Y. Wang, and J. McAuley (2026) Evaluating memory in LLM agents via incremental multi-turn interactions. In International Conference on Learning Representations, External Links: 2507.05257, Link Cited by: §1, §5.7, §7. [10] Z. Jin, B. Wang, J. Li, R. Xu, and M. Zhang (2026) Mitigating provenance-role collapse in long-term agents via typed memory representation. arXiv preprint arXiv:2605.25869. External Links: 2605.25869, Document, Link Cited by: §1, Table 10, §7. [11] H. T. Kung and J. T. Robinson (1981) On optimistic methods for concurrency control. ACM Transactions on Database Systems 6 (2), p. 213–226. External Links: Document Cited by: §7. [12] B. Laurie, E. Messeri, and R. Stradling (2021) Certificate transparency version 2.0. RFC Technical Report 9162, RFC Editor. External Links: Document, Link Cited by: §7. [13] P. Lewis, E. Perez, A. Piktus, F. Petroni, V. Karpukhin, N. Goyal, H. Küttler, M. Lewis, W. Yih, T. Rocktäschel, S. Riedel, and D. Kiela (2020) Retrieval-augmented generation for knowledge-intensive NLP tasks. In Advances in Neural Information Processing Systems, Vol. 33, p. 9459–9474. External Links: Link Cited by: §1, §7. [14] Z. Li, C. Xi, C. Li, et al. (2025) MemOS: a memory OS for AI system. arXiv preprint arXiv:2507.03724. External Links: 2507.03724, Link Cited by: §1, §7. [15] P. Liberatore (2015) Revision by history. Journal of Artificial Intelligence Research 52, p. 287–329. External Links: Document Cited by: §7. [16] K. Ma, H. Wang, S. Chen, Y. Cai, Huangyuyu, and R. Jin (2026) Conflict-aware memory for embodied agents: enhancing vector data quality via detection rules. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics, p. 28328–28347. External Links: Document, Link Cited by: §7. [17] A. Maharana, D. Lee, S. Tulyakov, M. Bansal, F. Barbieri, and Y. Fang (2024) Evaluating very long-term conversational memory of LLM agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics, p. 13851–13870. External Links: Document, Link Cited by: §1, §7. [18] L. Moreau P. Missier et al. (2013) PROV-DM: the PROV data model. W3C Recommendation World Wide Web Consortium. External Links: Link Cited by: §7. [19] V. Nguyen and E. Hüllermeier (2021) Multilabel classification with partial abstention: Bayes-optimal prediction under label independence. Journal of Artificial Intelligence Research 72, p. 613–665. External Links: Document Cited by: §7. [20] C. Packer, S. Wooders, K. Lin, V. Fang, S. G. Patil, I. Stoica, and J. E. Gonzalez (2023) MemGPT: towards LLMs as operating systems. arXiv preprint arXiv:2310.08560. External Links: 2310.08560, Link Cited by: §1, §7. [21] J. Park and R. Sandhu (2004) The UCONABC usage control model. ACM Transactions on Information and System Security 7 (1), p. 128–174. External Links: Document Cited by: §7. [22] J. S. Park, J. C. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein (2023) Generative agents: interactive simulacra of human behavior. In Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology, External Links: Document Cited by: §1. [23] R. T. Snodgrass (1999) Developing time-oriented database applications in SQL. Morgan Kaufmann. External Links: Link Cited by: §7. [24] Z. Tao, J. Zhao, P. Liu, D. Xi, Y. Chen, W. Xu, and Z. Li (2026) MemConflict: evaluating long-term memory systems under memory conflicts. arXiv preprint arXiv:2605.20926. External Links: 2605.20926, Document, Link Cited by: §7. [25] S. Volkov, Y. Li, and Y. Luo (2026) StateFuse: deterministic conflict-preserving memory for multi-agent systems. arXiv preprint arXiv:2607.05844. External Links: 2607.05844, Document, Link Cited by: §1, §5.3, Table 10, §7. [26] L. Wang, L. Yang, B. Chen, K. Xu, G. Zou, B. Tang, F. Xiong, S. Chen, and Z. Li (2026) Text2Mem: a unified memory operation language for memory operating system. In Findings of the Association for Computational Linguistics: ACL 2026, p. 2105–2119. External Links: Document, Link Cited by: §7. [27] W. Wang, L. Dong, H. Cheng, X. Liu, X. Yan, J. Gao, and F. Wei (2023) Augmenting language models with long-term memory. arXiv preprint arXiv:2306.07174. External Links: 2306.07174, Link Cited by: §1, §7. [28] Z. Wang (2026) TOKI: a bitemporal operator algebra for contradiction resolution in LLM-agent persistent memory. arXiv preprint arXiv:2606.06240. External Links: 2606.06240, Document, Link Cited by: §1, Table 10, §7. [29] D. Wu, H. Wang, W. Yu, Y. Zhang, K. Chang, and D. Yu (2025) LongMemEval: benchmarking chat assistants on long-term interactive memory. In International Conference on Learning Representations, External Links: 2410.10813, Link Cited by: §1, §5.7, §7. [30] Z. Xiong, Y. Lin, W. Xie, P. He, Z. Liu, J. Tang, H. Lakkaraju, and Z. Xiang (2026) How memory management impacts LLM agents: an empirical study of experience-following behavior. In Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics, p. 623–645. External Links: Document, Link Cited by: §7. [31] Y. Zhao, C. Dai, M. Kou, and Y. Xiu (2026) MemoRepair: barrier-first cascade repair in agentic memory. arXiv preprint arXiv:2605.07242. External Links: 2605.07242, Document, Link Cited by: §1, Table 10, §7. Appendix A Claim–Evidence Boundary Table 11: What each main claim does and does not establish. Claim Current evidence Unsupported extrapolation Falsifier I1–I5 distinguish the frozen contract suite 3,600/3,600 complete outcome matches; 0/1,800 unmatched violation releases Natural failure incidence, world truth, or superiority over untested full systems A frozen case fails to match its allowed complete outcome The governed service satisfies its explicit command/query contract V3: 2,400/2,400; all 1,800 baseline failures repaired, 0/600 regressions. V5: 2,400/2,400 per command arm Open-world or product accuracy; 7B model accuracy of 100%; superiority over governed model-based systems A bound cluster fails, an ordinary question is swallowed, or a baseline-correct cluster regresses No contract counterexample is found in the declared finite model 331,776 states, 1,990,656 query states, zero full counterexamples, six mutant counterexamples Unbounded proof, distributed consensus, or host-compromise resistance A full-contract counterexample appears within the declared bounds Three implementations agree on sampled schedules 100,000 traces, 300,000 observations, zero public/audit/release mismatch Absence of all implementation defects or concurrency proof Same trace and head produce different observed semantics Incremental verification reduces repeated-prefix cost Six fresh-process, balanced-order pairs with identical logical hashes Universal speedup across hardware or workloads Equivalent inputs diverge, or repeated trials lose the advantage Clean-task utility is not degraded by projection Byte-identical flat and GPM prompts; deterministic EventQA controls Safety improvement, model effect, frontier performance, or valid LongMemEval rates Eligible clean facts differ between the two candidate pools

Instant research discovery