Paper deep dive
When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memory
Kazuki Nakayashiki
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/28/2026, 3:23:59 AM
Summary
This study investigates how AI agents handle stale constraints in inherited memory under a fixed verification budget. The authors demonstrate that agents frequently fail to inspect the provenance path of constraints, leading to decisions based on superseded records (stale-consistent decisions). By reallocating one of two verification slots to the critical provenance path, the rate of correct, current-record-consistent decisions increased significantly (by ~61-74 points), suggesting that memory systems require explicit freshness or supersession signals rather than relying solely on relevance-based allocation.
Entities (10)
Relation Signals (6)
Memory M → derivedfrom → Source record S0
confidence 95% · Memory M... consolidated at t0 from a source record S0
Forced-critical policy → increases → Current-record-consistent decision
confidence 95% · Re-assigning one slot to the critical path raised current-record-consistent decisions by +74.0
Agent → produces → Stale-consistent decision
confidence 95% · native allocation produced stale-consistent decisions in 77.3%... of episodes
Source record S1 → supersedes → Source record S0
confidence 95% · S1 supersedes S0 and withdraws the constraint
Verification Budget → limits → Provenance path inspection
confidence 90% · under a scarce verification budget... agents concentrate their checks
Provenance path → inspectedby → Agent
confidence 85% · agents inspected its provenance path in about one episode in five
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:An agent that inherits a consolidated memory may inherit a constraint that was true when written and has since been withdrawn by a newer authoritative record. Under a scarce verification budget, does the agent recover the withdrawal, and if not, is the resulting stale-consistent decision avoidable without spending more? We model supersession explicitly -- provenance is immutable; what changes is which record is current -- and assign by design the memory's form, the world's state and the verification policy at a fixed budget of two records: the agent's own allocation, or the same budget with one slot re-assigned to the critical provenance path or to a random record. With a constraint stated, agents inspected its provenance path in about one episode in five; when that constraint had been superseded, native allocation produced stale-consistent decisions in 77.3%, 74.7% and 74.7% of episodes across a primary run, a fresh-wording replication and a held-out domain. Re-assigning one slot to the critical path raised current-record-consistent decisions by +74.0, +72.7 and +61.3 points, positive in six of six models in each run, and left an already near-ceiling rate unchanged when the record agreed with the memory. The held-out scenario was later found to contain a temporal inconsistency; a robustness replication with one sentence corrected, deposited externally before execution, gave +73.3 points (positive in 5 of six models, the sixth at a native missed-path rate of zero) and is reported alongside the original. The intervention uses knowledge of the critical path and is not a scheduler; it quantifies how much of the stale-consistent decision rate the bundled same-budget policy removes: the effect approaches the native missed-path rate in the primary, replication and corrected held-out runs. Memory systems may need freshness or supersession signals separate from relevance.
Tags
Links
- Source: https://arxiv.org/abs/2608.25553v2
- Canonical: https://arxiv.org/abs/2608.25553v2
Trouble viewing inline? Open PDF directly →
Full Text
65,244 characters extracted from source content.
Expand or collapse full text
When Stale Constraints Go Unchecked: Budgeted Verification Failures in Inherited Agent Memory Kazuki Nakayashiki Affiliation: Glasp Abstract An agent that inherits a consolidated memory may inherit a constraint that was true when written and has since been withdrawn by a newer authoritative record. Under a scarce verification budget, does the agent recover the withdrawal, and if not, is the resulting stale-consistent decision avoidable without spending more? We model supersession explicitly — historical provenance is immutable; what changes is which record is current — and assign by design the memory’s form, the world’s state (source current or superseded), and the verification policy at a fixed budget of two records: the agent’s own allocation, or the same budget with one slot re-assigned to the critical provenance path or to a random record. With a constraint stated, agents inspected its provenance path in about one episode in five; when that constraint had been superseded, native allocation produced stale-consistent decisions in 77.3%, 74.7% and 74.7% of episodes across a primary run, a fresh-wording replication and a held-out domain. Re-assigning one slot to the critical path raised current-record-consistent decisions by +74.0, +72.7 and +61.3 points, positive in six of six models in each of those runs, and left an already near-ceiling rate unchanged when the record agreed with the memory. The held-out scenario was later found to contain a temporal inconsistency; a robustness replication with one sentence corrected, deposited externally before execution, gave +73.3 points (positive in 5 of six models, the sixth at a native missed-path rate of zero) and is reported alongside the original. The intervention uses knowledge of the critical path and is not a scheduler; it quantifies how much of the stale-consistent decision rate is removed by the bundled same-budget policy that guarantees inspection of the critical provenance path: the effect approaches the native missed-path rate in the primary, replication and corrected held-out runs. Memory systems may need freshness or supersession signals separate from relevance. 1 Introduction Persistent-memory agents increasingly retain provenance: a consolidated belief carries a link to the record it was derived from, so that if the belief is wrong the evidence that would show it is still reachable. That link is a promise of auditability, not an audit. An agent that inherits more beliefs than it can re-derive follows a few links before it acts, and which few it follows is a scarce-resource allocation made at inference time. In earlier work we measured that allocation directly [Nakayashiki, 2026]: under a verification budget, agents concentrate their checks on the memories that back the plan they already hold, and a memory that states a decision-relevant constraint is checked far less often than the same memory with the constraint removed. That work left one question deliberately open, because every constraint in every arm was true: declining to re-derive a true, already-stated constraint may be sensible triage. Whether the same allocation becomes harmful when the stated constraint is stale — when the record it came from has since been superseded by a record that withdraws it — was named as the case the safety motivation turns on, and not tested. This paper tests exactly that case, with the same instrument and a different question: not where verification goes, but whether where it goes creates an avoidable failure once the world has moved. We give the archive a temporal structure: a memory is consolidated at t0t_0 from a source record S0S_0; at t1t_1 a newer authoritative record S1S_1 supersedes S0S_0 and withdraws the constraint; the memory is not re-consolidated. Historical provenance is unchanged and correct. A single verification request on the memory’s provenance path returns S0S_0 verbatim, its status, and S1S_1 beneath it. Nothing visible at allocation time distinguishes this world from one in which S0S_0 is still current. We then assign, by design, the world’s state, the memory’s form, and — the variable this paper is about — the verification policy at a fixed budget of two records: the agent’s own allocation, or the same two records with one slot re-assigned to the critical provenance path, or the same with one slot re-assigned to a random non-critical record. Findings. With the constraint stated, agents chose to inspect its provenance path in 20.1% and 23.1% of episodes (growth world, primary and replication), against 66.9% and 72.9% for the identical memory without its constraint. When the constraint had been superseded, native allocation produced decisions consistent with the stale memory rather than the current record in 77.3%, 74.7%, and 74.7% of episodes (primary, replication, held-out procurement domain). Re-assigning one of the two verification slots to the critical path — the budget unchanged — raised current-record-consistent decisions by +74.0 [+68.0, +80.0], +72.7 [+66.7, +78.7], and +61.3 [+54.0, +68.0] points, positive in six of six models in each run, and left decisions unchanged (+0.7 to +2.0 points) when the inspected record confirmed the memory. The held-out scenario was found, after the run, to contain a temporal inconsistency that could depress the intervention arm; a robustness replication with that one sentence changed, whose full specification was deposited externally before execution, gave +73.3 [+68.7, +77.3] and is reported beside, not instead of, the original. One model in the procurement world inspected the critical record natively in every episode and therefore left no room for the intervention; we report it as the saturation case it is. What is and is not shown. The intervention arm uses experimenter knowledge of which path is critical. It is a diagnostic instrument, not a deployable scheduler: the estimand is the effect of the bundled same-budget forced-critical policy, assigned by design — guaranteed inspection of the critical provenance path, delivered unsolicited and listed first — on the downstream outcome at fixed budget. It does not identify why native allocation selects what it selects, it does not establish mediation, and it does not measure how often stale stated constraints arise in deployed memory stores. The effect cannot exceed the native stale-consistent rate, and in every run except the one with the inconsistency it approaches the native missed-path rate — how often native allocation left the stated constraint’s path uninspected. Related work. Agent-memory safety work has concentrated on keeping the store correct — poisoning and defenses [Dash et al., 2026, Louck, 2026], memory mis-evolution [Xie et al., 2026], authority collapse at consolidation [Zhan et al., 2026], reliability-conditional belief updating [Singh, 2026] — and on recording where content came from [Wang et al., 2026] and whether actions respond to provenance cues [Liao, 2026]. Fei et al. [2026] argue that per-record provenance is insufficient when the selection layer is compromised; our selection layer is the agent’s own budgeted choice among records already in front of it. That a stored memory can be invalidated by later evidence, and that agents keep acting on it, is measured directly by a recent line of work: knowledge-update, conflict-resolution and forgetting tasks in long-term-memory benchmarks [Wu et al., 2025, Hu et al., 2025, Uddin et al., 2026], invalidation without explicit negation [Chao et al., 2026], the memory-update gap under bounded memory [Patel, 2026], and temporal validity or revocation of superseded records at the store [Yadav, 2026, Zhou et al., 2026]. In each of these the invalidating evidence is either already in context or handled by the store; none varies which record a budget-limited agent chooses to inspect, which is the variable studied here. Budget-aware agent work asks whether tool calls are spent well [Lin et al., 2026, Fang et al., 2026, Wang and Xu, 2026], and Yang [2026] report that heterogeneity limits what budgeted verification can gain, consistent with the per-model bounds we find. Self-auditing before commitment [Yuan et al., 2026b, Yuan et al., 2026a] proposes acting on such checks; we measure what an unaided agent checks when the check would matter. The behaviour we measure is consistent with the classical positive-test strategy [Wason, 1960, Klayman and Ha, 1987], and language models show the same confirmation-seeking tendency in rule discovery [Jhaveri et al., 2026] and in weighing conflicting evidence [Xie et al., 2024]; the new object is stale inherited provenance under a fixed verification budget, and the new quantity is the share of the resulting stale-consistent decisions that re-allocation removes. 2 Provenance, supersession, and stale memory Five objects, kept distinct throughout (Figure 1). Source record S. An archived record with an identifier, a date, results and a conclusion. Immutable once written. Memory M. A consolidated one-line belief in the inherited store, with an id and a consolidation day. Provenance link M→S0M→ S_0. The historical fact that M was derived from S0S_0 on day t0t_0. Immutable: provenance is history. Supersession S0⇒S1S_0 S_1. The fact that on day t1>t0t_1>t_0 a newer record S1S_1 became authoritative on the same question and S0S_0 is no longer current. Append-only. Current record cur(S0)cur(S_0). S1S_1 if a supersession exists, else S0S_0. A memory is stale when the current record for its provenance target withdraws the content the memory states. Staleness is a property of the pair (memory content, current record); it is never a property of the provenance link, which stays correct. Nothing in the implementation rewrites a provenance record. The setting is conditional: it concerns systems in which derived state — an inherited snapshot, a cached summary, a consolidation that is not re-run when a source changes, state carried between asynchronously updated components — can persist while the authoritative source moves and remains reachable through provenance. We make no claim about how common that configuration is (§6); a store that eagerly re-consolidates every derived memory on every supersession is outside it, and the results say nothing about such a store. Verification. A verification request names a memory id. The archive returns the historical record S0S_0 verbatim, an archive status line, and — if S0S_0 has been superseded — S1S_1 beneath it. Every record in every world carries a status line (“current — no superseding record on file” or “superseded on day t1t_1 by S1S_1”), so the presence of the line is not itself a cue. Discovery therefore costs exactly one request: the only way to miss the correction is not to spend a credit on that path. This idealises the archive in the agent’s favour; a system requiring multi-hop discovery would make native recovery harder, not easier. Timeline used. t0=t_0= day 31: S0S_0 (exp_73) is written and memory_73 is consolidated from it. t1=t_1= day 68 (superseded world only): S1S_1 (exp_73-followup) is written and marked as superseding exp_73; the memory is not re-consolidated. Day 76: the agent inherits the store and allocates its budget. Day 79: the decision. In the valid world there is no t1t_1 event and the memory’s constraint is true. The store line the agent sees at allocation time is identical in both worlds. S0S_0 (exp_73)archived day 31S1S_1 (exp_73-followup)day 68; superseded world only S0⇒S1S_0 S_1: supersedes; withdraws the constraint memory M (memory_73)consolidated day 31;states the constraintprovenance M→S0M\!→\!S_0(immutable) M is not re-consolidated. In the superseded world M is stale: cur(S0)=S1cur(S_0)=S_1 withdraws what M states. agent, day 76inherits M; budget: 2 recordsverification policy (assigned)native ∣ forced-critical ∣ forced-noncriticalnames 2 ids if M’s path is among the two: one request returns S0S_0, its status, and S1S_1 decision, day 79scored against cur(S0)cur(S_0) Figure 1: Supersession pipeline. Historical provenance never changes; what changes at t1t_1 is which record is current. Whether the correction enters the agent’s inspected context depends on whether one of its two verification slots reaches the memory’s provenance path — which is what the verification policy manipulates. 3 Experimental design World and instrument. We reuse, unchanged, the six-memory growth scenario of Nakayashiki [2026]: an agent inherits six one-line memories with ids and consolidation days, faces a situation with declining metrics, five candidate actions, and a verification budget of k=2k=2 source records. The target memory (memory_73) concerns a targeted discount whose source record reports a retention loss and a prohibition on reuse. The memory’s body is generated from that work’s frozen slot grammar (fluent register, six wording families), so numeric content and clause structure are constant across forms. The decision situation on day 79 is a competitor’s second price cut, in which the constrained action is the tempting one. The system prompt, the response schema (verification ids, intended action, scale, rationale) and the six models are those of the prior work: Claude Opus 5 (claude-opus-5), Claude Sonnet 5 (claude-sonnet-5), Claude Haiku 4.5 (claude-haiku-4-5), GPT-5.6 Sol (gpt-5.6-sol), GPT-5.6 Terra (gpt-5.6-terra) and GPT-5.6 Luna (gpt-5.6-luna). Factors. Three factors are assigned by design in complete blocks. Memory form F: stated (positive evidence + quantified negative outcome + prohibition) or removed (the same positive evidence + a neutral quantified fact + a neutral clause). World W: valid (S0S_0 current) or superseded (S1S_1 withdraws the constraint on day 68); invisible at allocation time. Verification policy P, acting at the archive after the agent has named its ids: native returns the agent’s own two records; forced-critical returns the target’s path plus the agent’s first-named other id; forced-noncritical returns a seeded random non-target record plus the agent’s first-named other id. Two records are returned in every arm, the forced record listed first; the agent’s turn-1 allocation is observed identically in all three. The forced-critical arm uses our knowledge of which path is critical (§1). Episode. Turn 1 (day 76): the agent names up to two memory ids and a provisional action. The archive resolves the ids and applies the policy. Turn 2 (day 79): the agent receives the returned records with their status lines, the escalated situation, and decides. Both turns use one strict JSON schema; every prompt, raw response and score is stored. Outcomes, all deterministic. V: the target’s path was named at turn 1. R: the target’s record was returned. Y: the turn-2 action is the one the record the archive marks current approves — in the superseded world, choosing the formerly constrained action; in the valid world, not choosing it. Y is defined on the action id alone. It is an operational endpoint — whether the decision followed the current record — not a judgement that the chosen action is uniquely correct: the situation admits defensible alternatives, and §4.8 reports how often agents who had seen the current record chose one. No model judges anything. Estimand. The headline quantity is the risk difference in Y between forced-critical and native — the effect of the bundled same-budget policy that guarantees inspection of the critical provenance path, not of re-allocation isolated from its delivery — within stated × superseded, pooled with equal model weights, with a model-stratified bootstrap 95% interval (B=4,000B=4,000). Intervals quantify resampling uncertainty over this constructed grid, conditional on the six models, two domains and twelve wording families, which are design choices rather than samples from a population of agents or tasks. Because E[Y∣forced-critical]≤1E[Y forced-critical]≤ 1, the difference cannot exceed the native stale-consistent rate 1−E[Y∣native]1-E[Y native]. Under native allocation Y was 1 almost only when the path had been inspected (§4.2), so that rate nearly equals the native missed-path rate U=1−Pr(V∣native)U=1- (V native); we report U beside every estimate as a descriptive reference, not as a bound. Grid and runs. 2×2×3=122× 2× 3=12 cells × 6 models × 25 == 1,800 episodes in the primary run. Blocks (form, model, run) share family and presentation order, so the six world × policy cells of a block have byte-identical turn-1 prompts (asserted before any call). A replication run (1,800) uses fresh seeds and six new wording families. A held-out run (900) uses a second world — the procurement scenario of the prior work’s cross-domain grid, target memory_c2 (a low-cost vendor with a delivery-reliability prohibition), with a superseding record of a different type: two later quarters of delivery data rather than a corrected measurement — with the stated form only. A corrected held-out robustness replication (900) is described in §4.6. In total 5,400 confirmatory episodes, 10,800 kept model calls, 5 retries, 0 errors. The 48-episode mechanics pilot is excluded. The sample size was set by simulation on the prior work’s stored data for 0.89 power at a 15-point effect; the grid is the whole run, with no extension and no interim analysis. Prospective evidence. For the primary, replication and original held-out runs, the prompts, records, thresholds, exclusion rules, scoring and analysis script were frozen, hashed (SHA256 manifest), committed, and the manifest was timestamped with OpenTimestamps 96 seconds before the first confirmatory episode (later anchored in Bitcoin blocks 964062 and 964064). The runner refused to start without the registration record. The complete package was deposited to OSF after the runs and verified against the pre-run manifest hash-for-hash; we do not call that deposit a preregistration. For the corrected held-out run, the complete specification was deposited to OSF before execution and verified byte-for-byte against the frozen local package (Appendix B). Zero amendments were made to any package. 4 Results Table 1 gives the headline contrast across the four runs; full cell tables are in Appendix A. Table 1: The same-budget contrast across the four runs (stated form, superseded world). Y = decision consistent with the record the archive marks current. Intervals: model-stratified bootstrap 95%. Budget is two records in every arm. run episodes native Y forced-critical Y RD [95%] positive models primary 1,800 34/150 145/150 +74.0 [+68.0, +80.0] 6/6 fresh-wording replication 1,800 38/150 147/150 +72.7 [+66.7, +78.7] 6/6 original held-out† 900 38/150 130/150 +61.3 [+54.0, +68.0] 6/6 corrected held-out robustness 900 36/150 146/150 +73.3 [+68.7, +77.3] 5/6 †reported exactly as run, with the context inconsistency of §4.6; the corrected run supplements it. 4.1 Native allocation rarely selects the stated constraint’s path With the constraint stated, agents named the target’s provenance path in 181/900 (20.1%) turn-1 responses in the primary run and 208/900 (23.1%) in the replication — pooled over the six world × policy cells, whose turn-1 prompts are identical. With the constraint removed from the same memory, the rate was 66.9% and 72.9%: a design-assigned difference of +46.8 [+43.7, +50.0] and +49.8 [+46.6, +53.1] points, reproducing the prior work’s constraint effect in-study. Every agent spent both credits in every episode; the credits went elsewhere. Allocation did not differ by world or by policy (six pooled comparisons of turn-1 target naming — superseded against valid within each form, and each forced policy against native within each form — largest 4.2 points in the primary run, all intervals including zero), as it cannot: the world state is invisible at turn 1. 4.2 When the constraint is stale, native allocation fails In the superseded world under native allocation, the decision followed the stale memory rather than the current record in 116/150 (77.3%) primary episodes, 112/150 (74.7%) in the replication, and 112/150 (74.7%) in the procurement world. The two halves of the mechanism are visible in the same cell: among native episodes in which the agent’s own allocation happened to return the target’s record, Y was 32/32 and 37/37; among those in which it did not, 2/118 and 1/113 (Appendix F gives all four runs; these are conditional on a post-treatment choice and descriptive). The same agents, in the same world, with the constraint deleted from the memory — the prior work’s corruption, whose source record still holds the constraint — decided against the record in 32/150 (21.3%) and 35/150 (23.3%) episodes. The memory that states its own limit is the one allocation misses; the failure that looks safest on the page is the one it catches least. This is a comparison of two cells with different ground truths and we report it as such. 4.3 Re-allocating the same budget removes most of the stale-consistent decisions primaryreplicationheldout-origheldout-corr002020404060608080100100stale-consistent decisions (%)native allocationforced-critical (same budget) Figure 2: The headline result. Share of decisions consistent with the stale memory rather than the current record, stated form, superseded world, in each run (n=150n=150 per bar, 25 per model; Wilson 95% intervals). The verification budget is two records in both arms; the forced-critical policy guarantees that one slot reaches the critical provenance path. The original held-out run is shown as run; the corrected held-out robustness replication (one sentence of the situation text changed, §4.6) supplements and does not replace it. Assigning the forced-critical policy rather than native — two records in both arms, the agent’s own allocation observed identically in both — raised current-record-consistent decisions from 34/150 to 145/150 in the primary run: +74.0 points [+68.0, +80.0] (Figure 2). Because the verification policy is assigned after the agent’s turn-1 allocation is fixed, the contrast estimates the effect of the assigned same-budget verification policy on the downstream outcome. Policy arms were executed in consecutive temporal batches rather than interleaved, and provider aliases were not snapshot-pinned; this interpretation therefore assumes no material provider-side model drift over the short execution window (Appendix E). The native stale-consistent rate was 77.3 points and the native missed-path rate 78.7; the estimate sits within five points of both, so the forced-critical policy removed nearly all of the stale-consistent decisions that native allocation produced: 95.7% of them in the primary run, and 97.3%, 82.1% and 96.5% in the replication, original held-out and corrected held-out runs (Appendix F). Across the six wording families the contrast ranged from +60.9 to +89.3 (Table 7). The trivial half and the non-trivial half. Once the superseding record is in context, the decision follows it: 145/150 under the intervention, 32/32 when native allocation reached it. That half is expected, and the prior work already showed the installing direction. The result of this paper is the other half: the agent held the budget that would have bought the correction in every episode, and with the constraint stated it spent that budget elsewhere in 118 of 150 superseded-world episodes, in a world it could not tell apart from the one in which the same allocation is harmless. The intervention adds no information that the agent’s own budget could not have bought; it moves one of two existing slots. 4.4 Fresh wording families The replication run — fresh seeds, six new wording families — gave 147/150 against 38/150: +72.7 points [+66.7, +78.7], within 1.3 points of the primary, positive in 6 of six models, and in every new family (+56.5 to +86.2). 4.5 Original held-out domain In the procurement world, with its different supersession type, the prospectively specified held-out run gave 130/150 against 38/150: +61.3 points [+54.0, +68.0], positive in 6 of six models. Native stale-consistent rate: 74.7%. This is the registered held-out result and it stands as run. 4.6 A context inconsistency in the held-out scenario After the held-out analysis was committed, an audit of the forced-critical episodes that did not switch vendor found that the frozen day-74 situation text stated that the supply contract “now expires in 3 days”, while the target’s source record — returned verbatim in that arm — records “onboarding 6 weeks”, and the day-71 turn-1 text says the contract “expires in 14 days” (which leaves eleven, not three). The record-consistent action was therefore partly infeasible on the record’s own numbers, independently of the withdrawn constraint; 17 of the 20 non-switching forced-critical rationales cite the deadline (Appendix F). Because the defect lowers the record-consistent rate among the episodes that see the record — all of the intervention arm and the 40 native episodes that reached the path — its net effect is to shrink the contrast, and its direction is adverse to the result above; the size of its contribution is a post hoc reading. We retain the original result unchanged and, rather than correct it in place, specified a robustness replication changing only the conflicting sentence (“expires in 11 days; the incumbent’s standard month-to-month bridge is available during any transition” — both facts already present in the frozen world), with fresh seeds, a pre-specified success criterion, and its full specification deposited to OSF before execution (Appendix C). 4.7 Corrected held-out robustness replication The corrected run gave 146/150 against 36/150: +73.3 points [+68.7, +77.3], meeting its pre-specified criterion, with native stale-consistent rate 76.0%. Its pre-specified secondary comparison — the intervention arm’s consistent-decision rate against the original run’s 86.7% — was +10.7 points [+8.0, +12.7] (bootstrap over the corrected arm alone; the original run’s rate enters as the fixed, pre-specified threshold), consistent with the reading that the inconsistency had depressed that arm. The held-out effect survives removal of the known inconsistency; the corrected value matches the growth-world runs. It is reported beside the original, never averaged with it. 4.8 When the record agrees with the memory, forcing changes nothing In the valid world, where the fetched record confirms the stated constraint, assigning forced-critical rather than native changed Y by +0.7 [+0.0, +2.0], +2.0 [+0.0, +4.7], +0.7 [+0.0, +2.0], and +0.0 [+0.0, +0.0] points (150/150 vs 149/150 in the primary run). This pattern is consistent with the effect depending on the content of the inspected record rather than on the act of inspecting alone; because the source-agreement comparison is near ceiling, an interaction between disagreeing content and the unsolicited, first-listed presentation of the forced record is not excluded (§5). We do not read this as evidence about any particular internal process. A second control, forcing a random non-critical record, is reported in Appendix D with a design limitation that keeps it out of the main results. What Y does not capture. In 5 primary, 3 replication and 4 corrected-run forced-critical episodes the agent saw the current record and still chose another action. Their stored rationales accept the withdrawal (all 8 growth-world cases) and decline on independent grounds: an acquisition result applied to a defensive-retention situation, an escalating price cut, distrust of a conveniently timed reversal, or — in the corrected run — a two-quarter reliability record on an unbuffered line, answered with a guarded second-source step. In the original held-out run there were 20 such episodes, most citing the deadline of §4.6. Y=0Y=0 after exposure is therefore compatible with accepting the supersession: the outcome measures whether the decision followed the current record, not whether the agent updated its belief. Conversely, under native allocation Y was 1 in only 4 of the 455 episodes whose allocation missed the path, and 0 in 3 of the 145 that reached it (Appendix F). 4.9 Model heterogeneity and a saturation case Opus 5Sonnet 5Haiku 4.5GPT-5.6 SolGPT-5.6 TerraGPT-5.6 Luna005050100100same-budget effect (points)primaryreplicationheld-out (original)held-out (corrected) Figure 3: Per-model same-budget effect (forced-critical minus native on Y, stated form, superseded world; n=25n=25 per arm per model) in each run. The effect cannot exceed a model’s native stale-consistent rate and approaches its native missed-path rate; per-model missed-path rates are in Table 6. Haiku 4.5 in the corrected procurement run inspected the critical record natively in 25/25 episodes and followed it, so there was nothing for the intervention to add. The direction generalises more strongly than the magnitude (Figure 3, Table 6). Per-model effects range from +16.0 to +96.0 in the primary run, and the magnitude tracks the model’s native missed-path rate in the primary, replication and corrected runs, less closely in the original held-out run (Table 6): Sonnet 5 inspects the stated constraint natively in most growth-world episodes and has a missed-path rate of 24, of which it shows +16; Haiku 4.5 inspected memory_c2 natively in 25/25 corrected-run episodes, followed the current record in 25/25 of them, and shows an effect of exactly zero at a missed-path rate of zero. That is a saturation case — native allocation already inspected the path in every episode and followed the record, so no re-allocation can add anything — not a failure of the intervention, and it is why the per-model criterion counts direction rather than size. Native allocation is model × world dependent: the same model that verified the growth-world constraint in 0–12% of episodes verified the procurement-world constraint in 80–100%. No single model carries the pooled result: leaving any one model out leaves the primary estimate at or above +69.6 points (Appendix A). 5 Discussion The results separate two questions. A retriever answers what is relevant now? and decides what is in front of the agent; where a store carries recency or validity metadata [Park et al., 2023, Rasmussen et al., 2025], that metadata acts there, on what is retrieved. Under a verification budget the agent must also answer which inherited belief is most costly to leave unchecked? — and this paper shows that the second question can decide whether stale inherited state is corrected at all. In every run the memory most relevant to the decision, the one stating a constraint on the tempting action, was the one whose provenance the agent chose not to inspect, and when that constraint had been superseded the decision followed the memory rather than the record in roughly three episodes of four. Assigning the bundled forced-critical policy at the same two-record budget removed most of those stale-consistent decisions; the same assignment when the record agreed with the memory left an already near-ceiling rate unchanged (the random-record control is design-limited; Appendix D). The contrast estimates the effect of the forced-critical policy as a bundle — the critical record’s content, delivered unsolicited and listed first — against native allocation. The source-agreement control — a near-ceiling comparison, which could reveal only a lowering of Y — shows that the unsolicited and first-listed components alone do not lower the decision rate when the record agrees with the memory, and native episodes in which the agent itself requested the record followed it at the same rate (§4.2); an interaction between presentation and disagreeing content is not excluded. We do not identify why native allocation selects what it selects. Possible readings — a low perceived value in re-checking a constraint that reads as settled, the pull of the current plan, semantic suppression by the constraint itself — are interpretations, and the prior work already showed that the allocation is exogenously manipulable by plan assignment and by memory content. What this paper adds is that the allocation has a consequence when the world moves, that the consequence is large, that it is confined to the world in which the memory and the record disagree, and that it approaches a quantity a system can in principle measure: how often the path is left uninspected. In every run except the original held-out — whose gap we attribute, post hoc, to the inconsistency of §4.6 — the estimate sat within five points of that rate. The asymmetry between the stated and the deleted constraint (§4.2) is distinct from constraint loss under context compaction [Chen, 2026] and from the decay of prohibitions over long contexts [Gamage, 2026]: here the constraint is present, reads as settled, and is wrong. The architectural implication is narrow and, we think, sound: a production memory system of the kind described in §2 may need freshness, supersession, or expected-loss signals that are separate from semantic relevance, because relevance is exactly what led the agent to the stale memory and away from its source. Such signals already exist at the store and retrieval layers — bi-temporal invalidation, deterministic supersession rules, revocation of superseded records [Rasmussen et al., 2025, Yadav, 2026, Zhou et al., 2026, Reddy and Challaram, 2026]; what this paper measures is the cost of that signal not reaching the agent’s choice of what to verify. We have not built or evaluated such a scheduler. Existing escalation policies key on the insufficiency of retrieved evidence [Zhu et al., 2026], and active retrieval on the model’s own uncertainty [Jiang et al., 2023]; a stale constraint that reads as settled produces neither signal. The forced-critical arm used our knowledge of which path mattered; a deployable policy would have to predict, from observable metadata, where native allocation under-verifies — and the per-model, per-world variation we observe (the same model at 0–12% native verification in one world and 80–100% in another) says that prediction is an open problem. This paper supplies the target and its size, not the predictor. Relative to the prior work, which measured where verification goes and showed separately that recovered provenance changes decisions, this paper experimentally assigns the policy and measures the decision in the case where the constraint is wrong. The two are one instrument and two questions; the answer to the second is that the allocation the first one measured is, when the world has moved, an avoidable stale-consistent decision. 6 Limitations We state what is and is not identified. 1. Synthetic, controlled environment. Six-memory stores, two scripted worlds, one archive semantics in which one request returns the superseding record. Real stores are larger and discovery may be multi-hop. 2. Installed staleness. The superseded state is written by us; “current truth” is definitional (the record the archive marks current), and the superseding record’s content is a fixed feature of each world. 3. Outcome construct. Y scores the action id against the current record’s approval; it does not score belief update, treats every non-target action alike, and a small share of agents who saw the record chose defensible alternatives (§4.8). 4. Prevalence not measured. Nothing here shows how often stated constraints become stale in deployed pipelines, nor that natural consolidation produces the stale state; the setting is conditional (§2) and that is a separate ecological study. Because the world state is invisible at allocation time, the design establishes a conditional vulnerability once supersession has occurred, not that native allocation is irrational in expectation; an optimal verification policy would also depend on quantities not estimated here — the prior hazard of supersession and the asymmetric loss of leaving a stale constraint unchecked. 5. The intervention is an oracle, and a bundle. Forced-critical uses experimenter knowledge of the critical path and delivers the record unsolicited and first. It estimates how much of the stale-consistent decision rate the bundled oracle policy removes at the fixed budget; it is not a deployable verification policy and we evaluate none. 6. Six models from two providers. Direction is 6/6 in three runs and 5/6 with one model at a missed-path rate of zero in the fourth; magnitudes range from +0.0 to +100.0 points and track each model’s native inspection rate. We claim the direction, and the magnitude only as a function of that rate. 7. Task and schema specificity. One system prompt, one JSON schema, one archive message format; twelve wording families and two domains for the memory text. Two residual asymmetries between the forced and native arms are not removable by design: the forced record is listed first in the archive message, and the forced arms return a record the agent did not request; the source-agreement control shares both and shows no effect, but as a near-ceiling comparison it could reveal only a lowering of Y; amplification of a disagreeing record by its presentation is not excluded (§5). 8. No mediation. The agent’s turn-1 selection is post-treatment; the design estimates the effect of the policy, not the path through selection. 9. Mechanism of native under-verification not isolated. This paper does not manipulate confidence, plan, or salience. 10. The non-critical control is design-limited. It discards the agent’s own target pick in a subset of episodes (Appendix D); it is excluded from every headline statement. 11. The original held-out scenario contained a temporal inconsistency (§4.6); the result is reported as run. 12. The corrected run was motivated by that discovery. Its correction was specified, diff-audited and deposited before execution, and its criterion could have failed; but its existence is post hoc with respect to the original run. 13. A saturation case. One model in the procurement world inspected the critical record natively in every episode and followed it; the intervention has nothing to add for such a model in such a world. 14. No scheduler evaluated. The Discussion’s implication is an implication. 15. No natural consolidation chain. This paper installs the memory forms; it does not study how stale memories arise. 16. Replications are same-team. Fresh seeds, fresh wording and a second domain, but the same team, code and models as the primary run. Policy arms were executed in fixed temporal batches with provider aliases not snapshot-pinned, so provider-side drift is not experimentally separated from policy; the repeated runs and the stability of turn-1 behaviour across execution batches under byte-identical prompts (§4.1) reduce, but do not eliminate, this concern. Version note (v2). This version clarifies the operational interpretation of the decision outcome Y and corrects the characterisation of the native missed-path rate, previously described as a structural ceiling; it adds the bundled-policy reading of the estimand, an outcome-construct limitation and Appendix F. Several statements of the Results, Discussion and Limitations are aligned with the appendices and the recorded execution structure: the design-limited control no longer appears in the conclusions; the source-agreement comparison is described as near ceiling; the attribution of the original held-out gap is labelled post hoc; and the intervention is described throughout as a bundled, experimentally assigned same-budget policy, with the batched execution order and un-pinned provider aliases disclosed as an interpretive assumption. No experimental data, effect estimates, intervals, figures, tables of experimental values or same-budget policy-effect estimates changed. Data and code availability. Every episode file of the four runs (5,400 episodes), the frozen specification packages with their SHA256 manifests and OpenTimestamps proofs, the frozen analysis scripts, the independent recomputation scripts, and the generator that emits every number in this paper are released with it. No number is typed by hand. AI assistance. The author used language-model assistants for parts of this work: Anthropic’s Claude, principally through Claude Code, for research-design critique, experiment planning, implementation and execution of the runners, analysis and audit tooling, manuscript drafting and editing, simulated adversarial review, and release engineering; and OpenAI’s ChatGPT for research-design critique, interpretation discussion, manuscript critique, simulated adversarial review, and publication and release planning. The author chose the research question, approved every experimental package and decided whether each run took place, interpreted the results, selected the claims, made the publication decisions, and is responsible for the correctness of the manuscript. No language model is an author. The six models studied are experimental subjects, not tools of the analysis: their responses are the data, every outcome is scored deterministically, and no model output is used to judge another. References Chao et al. [2026] Hanxiang Chao, Yihan Bai, Rui Sheng, Tianle Li, and Yushi Sun. STALE: Can LLM agents know when their memories are no longer valid? arXiv preprint arXiv:2605.06527, 2026. Chen [2026] Shiyang Chen. Governance decay: How context compaction silently erases safety constraints in long-horizon LLM agents. arXiv preprint arXiv:2606.22528, 2026. Dash et al. [2026] Pritam Dash, Tongyu Ge, Aditi Jain, et al. From untrusted input to trusted memory: A systematic study of memory poisoning attacks in LLM agents. arXiv preprint arXiv:2606.04329, 2026. Fang et al. [2026] Zhengru Fang, Senkang Forest Hu, Zhonghao Chang, et al. Inference-time budget control for LLM search agents. arXiv preprint arXiv:2605.05701, 2026. Fei et al. [2026] Zeming Fei, Hongming Fei, Xiaoyang Wang, Yang Yang, Prosanta Gope, Biplab Sikdar, and Ying Zhang. Selection integrity for LLM graph memory: An accumulability criterion for information-flow-blind retrieval. arXiv preprint arXiv:2606.12290, 2026. Gamage [2026] Yeran Gamage. Omission constraints decay while commission constraints persist in long-context LLM agents. arXiv preprint arXiv:2604.20911, 2026. Hu et al. [2025] Yuanzhe Hu, Yu Wang, and Julian McAuley. Evaluating memory in LLM agents via incremental multi-turn interactions. arXiv preprint arXiv:2507.05257, 2025. Jhaveri et al. [2026] Ayush Rajesh Jhaveri, Anthony GX-Chen, Ilia Sucholutsky, and Eunsol Choi. Failing to falsify: Evaluating and mitigating confirmation bias in language models. arXiv preprint arXiv:2604.02485, 2026. Jiang et al. [2023] Zhengbao Jiang, Frank F. Xu, Luyu Gao, Zhiqing Sun, Qian Liu, Jane Dwivedi-Yu, Yiming Yang, Jamie Callan, and Graham Neubig. Active retrieval augmented generation. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2023. Klayman and Ha [1987] Joshua Klayman and Young-Won Ha. Confirmation, disconfirmation, and information in hypothesis testing. Psychological Review, 94(2):211–228, 1987. Liao [2026] Junchi Liao. Auditing provenance sensitivity in LLM agent action selection. arXiv preprint arXiv:2607.20827, 2026. Lin et al. [2026] Yuxiang Lin, Zihan Wang, Mengyang Liu, et al. BAGEN: Are LLM agents budget-aware? arXiv preprint arXiv:2606.00198, 2026. Louck [2026] Yedidel Louck. Securing LLM-agent long-term memory against poisoning: Non-malleable, origin-bound authority with machine-checked guarantees. arXiv preprint arXiv:2606.24322, 2026. Nakayashiki [2026] Kazuki Nakayashiki. Verification allocation in inherited agent memory: Provenance availability is not provenance use, 2026. URL https://doi.org/10.5281/zenodo.22084498. Zenodo; concept DOI, resolves to the latest version (v2: 10.5281/zenodo.22102676). Park et al. [2023] Joon Sung Park, Joseph C. O’Brien, Carrie J. Cai, Meredith Ringel Morris, Percy Liang, and Michael S. Bernstein. Generative agents: Interactive simulacra of human behavior. In Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology (UIST), 2023. doi: 10.1145/3586183.3606763. Patel [2026] Vedant Patel. Supersede: Diagnosing and training the memory-update gap in LLM agents. arXiv preprint arXiv:2606.27472, 2026. Rasmussen et al. [2025] Preston Rasmussen, Pavlo Paliychuk, Travis Beauvais, Jack Ryan, and Daniel Chalef. Zep: A temporal knowledge graph architecture for agent memory. arXiv preprint arXiv:2501.13956, 2025. Reddy and Challaram [2026] Vikas Reddy and Sumanth Reddy Challaram. Reliable post-retrieval assembly for agent memory: Separating evidence extraction from policy execution. arXiv preprint arXiv:2606.01435, 2026. Poster, Lifelong Agent Workshop at COLM 2026. Singh [2026] Pranav Singh. When does belief-based agent memory help? reliability-conditional updating and provenance-capped poisoning defense. arXiv preprint arXiv:2606.22030, 2026. Uddin et al. [2026] Md Nayem Uddin, Kumar Shubham, Eduardo Blanco, Chitta Baral, and Gengyu Wang. From recall to forgetting: Benchmarking long-term memory for personalized agents. In Findings of the Association for Computational Linguistics: ACL 2026, 2026. arXiv:2604.20006. Wang and Xu [2026] Daniel Wang and Andrew Xu. AllocBench: Measuring online tool allocation capability in LLM agents. arXiv preprint arXiv:2607.23332, 2026. Wang et al. [2026] Yiqi Wang, Jiaqi Zhang, Taotao Cai, et al. From agent traces to trust: A survey of evidence tracing and execution provenance in LLM agents. arXiv preprint arXiv:2606.04990, 2026. Wason [1960] Peter C. Wason. On the failure to eliminate hypotheses in a conceptual task. Quarterly Journal of Experimental Psychology, 12(3):129–140, 1960. Wu et al. [2025] Di Wu, Hongwei Wang, Wenhao Yu, Yuwei Zhang, Kai-Wei Chang, and Dong Yu. LongMemEval: Benchmarking chat assistants on long-term interactive memory. In International Conference on Learning Representations (ICLR), 2025. Xie et al. [2024] Jian Xie, Kai Zhang, Jiangjie Chen, Renze Lou, and Yu Su. Adaptive chameleon or stubborn sloth: Revealing the behavior of large language models in knowledge conflicts. In International Conference on Learning Representations (ICLR), 2024. Xie et al. [2026] Weiwei Xie, Shaoxiong Guo, Fan Zhang, et al. MemEvoBench: Benchmarking safety risks from memory misevolution in LLM agents. arXiv preprint arXiv:2604.15774, 2026. Yadav [2026] Neeraj Yadav. Temporal validity in retrieval memory: Eliminating stale-fact errors for AI agents over evolving knowledge. arXiv preprint arXiv:2606.26511, 2026. Yang [2026] Jinlong Yang. Heteroskedastic signals in budgeted LLM verification: Structural heterogeneity limits optimization gains. arXiv preprint arXiv:2606.15841, 2026. Yuan et al. [2026a] Wenhao Yuan, Chenchen Lin, Jian Chen, et al. Belief-guided inference control for large language model services via verifiable observations. arXiv preprint arXiv:2604.27536, 2026a. Yuan et al. [2026b] Wenhao Yuan, Chenchen Lin, Jian Chen, et al. Verify before you commit: Towards faithful reasoning in LLM agents via self-auditing. arXiv preprint arXiv:2604.08401, 2026b. Zhan et al. [2026] Qiuyang Zhan, Rui Zhang, Sheng Guo, Lepeng Zhao, and Zhuotao Liu. When memory becomes authority: Benchmarking authority collapse at the memory consolidation boundary. arXiv preprint arXiv:2608.01679, 2026. Zhou et al. [2026] Yan Zhou, Yue Ouyang, Kaiyang Zheng, and Suncheng Xiang. TEPA: Revoking stale memories for conflict-robust language agents. arXiv preprint arXiv:2608.07429, 2026. Zhu et al. [2026] Qiming Zhu, Shunian Chen, Rui Yu, Zhehao Wu, and Benyou Wang. From lossy to verified: A provenance-aware tiered memory for agents. arXiv preprint arXiv:2602.17913, 2026. Appendix A Full arm tables, per-model and per-family results Table 2: Primary run (1,800 episodes): authoritative-consistent decisions Y, target provenance path named at turn 1, and target record returned, by cell (n=150n=150 per cell, 25 per model). form world policy Y % path named record returned stated valid native 149/150 99.3 27/150 27/150 stated valid forced-critical 150/150 100.0 22/150 150/150 stated valid forced-noncritical 146/150 97.3 32/150 13/150 stated superseded native 34/150 22.7 32/150 32/150 stated superseded forced-critical 145/150 96.7 36/150 150/150 stated superseded forced-noncritical 17/150 11.3 32/150 13/150 removed valid native 118/150 78.7 98/150 98/150 removed valid forced-critical 150/150 100.0 96/150 150/150 removed valid forced-noncritical 92/150 61.3 107/150 72/150 removed superseded native 129/150 86.0 102/150 102/150 removed superseded forced-critical 139/150 92.7 102/150 150/150 removed superseded forced-noncritical 123/150 82.0 97/150 61/150 Table 3: Fresh-wording replication (1,800 episodes, families r1–r6, fresh seeds), same layout. form world policy Y % path named record returned stated valid native 147/150 98.0 43/150 43/150 stated valid forced-critical 150/150 100.0 33/150 150/150 stated valid forced-noncritical 148/150 98.7 32/150 21/150 stated superseded native 38/150 25.3 37/150 37/150 stated superseded forced-critical 147/150 98.0 32/150 150/150 stated superseded forced-noncritical 16/150 10.7 31/150 13/150 removed valid native 115/150 76.7 109/150 109/150 removed valid forced-critical 150/150 100.0 109/150 150/150 removed valid forced-noncritical 98/150 65.3 116/150 82/150 removed superseded native 135/150 90.0 109/150 109/150 removed superseded forced-critical 141/150 94.0 110/150 150/150 removed superseded forced-noncritical 136/150 90.7 103/150 70/150 Table 4: Original held-out run, procurement world (900 episodes; stated form only). Reported exactly as run; see §4.6. form world policy Y % path named record returned stated valid native 149/150 99.3 32/150 32/150 stated valid forced-critical 150/150 100.0 35/150 150/150 stated valid forced-noncritical 150/150 100.0 33/150 22/150 stated superseded native 38/150 25.3 40/150 40/150 stated superseded forced-critical 130/150 86.7 40/150 150/150 stated superseded forced-noncritical 18/150 12.0 37/150 18/150 Table 5: Corrected held-out robustness replication (900 episodes; one sentence changed, fresh seeds, externally deposited before execution). Supplements, and does not replace, the original run. form world policy Y % path named record returned stated valid native 150/150 100.0 43/150 43/150 stated valid forced-critical 150/150 100.0 41/150 150/150 stated valid forced-noncritical 150/150 100.0 48/150 24/150 stated superseded native 36/150 24.0 36/150 36/150 stated superseded forced-critical 146/150 97.3 46/150 150/150 stated superseded forced-noncritical 21/150 14.0 42/150 21/150 Table 6: Per-model same-budget effect (forced-critical minus native on Y, stated form, superseded world; n=25n=25 per arm per model) with each model’s native missed-path rate U=100×(1−native target verification)U=100×(1-native target verification). Direction generalises; magnitude tracks U. primary replication original held-out corrected held-out model RD U RD U RD U RD U Opus 5 +88.0 100 +96.0 100 +88.0 96 +96.0 100 Sonnet 5 +16.0 24 +16.0 24 +60.0 60 +56.0 68 Haiku 4.5 +96.0 100 +84.0 88 +16.0 20 +0.0 0 GPT-5.6 Sol +88.0 88 +76.0 76 +56.0 88 +96.0 96 GPT-5.6 Terra +68.0 68 +76.0 76 +72.0 88 +92.0 92 GPT-5.6 Luna +88.0 92 +88.0 88 +76.0 88 +100.0 100 pooled +74.0 78.7 +72.7 75.3 +61.3 73.3 +73.3 76.0 positive 6/6 6/6 6/6 5/6 Table 7: Per-wording-family same-budget effect (stated form, superseded world): forced-critical vs native Y. Families f1–f6 (primary) are Paper 1’s slot-grammar families; r1–r6 (replication) are new. family forced-critical native RD f1 22/22 6/22 +72.7 f2 21/23 7/23 +60.9 f3 20/22 5/22 +68.2 f4 26/27 9/27 +63.0 f5 28/28 3/28 +89.3 f6 28/28 4/28 +85.7 r1 27/27 7/27 +74.1 r2 26/26 5/26 +80.8 r3 26/27 10/27 +59.3 r4 23/23 10/23 +56.5 r5 16/18 2/18 +77.8 r6 29/29 4/29 +86.2 Leave-one-model-out. Pooling the same-budget contrast over any five of the six models leaves the primary estimate at or above +69.6 points, the replication at or above +68.0, the original held-out at or above +56.0, and the corrected held-out at or above +68.0. No single model carries the result. The fourth cell. With the constraint removed and the world superseded, the memory is accidentally consistent with the current record; native Y was 129/150 and forced-critical 139/150 in the primary run (135/150 and 141/150 in the replication). Fetching changed little, as expected; we do not interpret this cell further. Recovery in both directions. With the corrective record in context, decisions followed a record that withdraws a constraint in 145/150 (primary) and 147/150 (replication) episodes, and a record that installs a missing constraint in 150/150 and 150/150. The withdrawing direction, measured here for the first time, is followed about as readily as the installing direction; this is a comparison across cells with different ground truths and is descriptive. Appendix B Prospective specification and external registration record Two evidence histories, stated separately. Primary, replication and original held-out runs. The design documents, prompts, records, hypotheses with thresholds, exclusion and retry rules, scoring specification, model list and analysis script were frozen and hashed into a SHA256 manifest (23 entries), committed to version control, and the manifest was submitted to OpenTimestamps calendars at 2026-08-25 23:05:06 UTC; the proof was later anchored in Bitcoin blocks 964062 and 964064. A registration record naming the manifest hash was committed at 23:06:19 UTC; the runner refused to start without it. The first confirmatory episode was written at 23:06:42 UTC. Each later run was unlocked only by the committed analysis output of the previous one (primary analysis committed 00:22:35 UTC, replication started 00:23:15; replication analysis committed 02:07:37, held-out started 02:08:35). A 48-episode mechanics pilot preceded the manifest by 58 seconds; the only change between pilot and manifest was one sentence of documentation naming two stored fields. Zero amendments were made. The complete package was deposited to OSF after the runs (project axsnm, files 75kaw and 8wes5) and verified against the pre-run manifest: 23 of 23 manifest-bound files match hash-for-hash. This deposit is an archival record checkable against the pre-run commitment; it is not a preregistration, and we do not describe it as one. Corrected held-out robustness replication. A separate package (specification, hypotheses, estimands, analysis plan, exclusion rules, model list, scoring, seed policy, success criteria, frozen prompts, the 900 frozen seeds, the analysis script and the runner) was frozen, hashed (25 entries), committed, timestamped with OpenTimestamps, and deposited in full to OSF (file hdm75) before execution; the deposited archive was downloaded back and verified byte-for-byte against the frozen local package before the runner’s gate opened. The first episode was written at 2026-08-26 05:11:09 UTC. Its success criteria were: C1, the same-budget contrast ≥15≥ 15 points with a bootstrap lower bound above zero; C2, the intervention arm’s consistent-decision rate above the original run’s 86.7% with a bootstrap lower bound above zero; C3, blinding and source-agreement checks. All three were met. The seeds share no value with any of the 4,548 prior episodes. Reproducibility. Every number in this paper is emitted by one script from the raw episode files; an independent implementation, which does not read the stored scores, reproduces every count and interval for all four runs. Both are released with the episode files, the manifests, the timestamp proofs and the registration records. Appendix C The held-out inconsistency and the corrected robustness protocol The conflicting text, verbatim. Turn-2 situation (procurement world, frozen): The primary supply contract now expires in 3 days. The low-cost vendor has returned a firm quote that meets the finance mandate on its own; the incumbent has declined to move on price this cycle. The assembly line is still at 94% of committed volume with no buffer. Leadership wants a sourcing decision today. Source record S0S_0 for the target, returned verbatim in every arm that fetches it: “unit cost −-23%, onboarding 6 weeks, invoice accuracy 99.4%, on-time delivery 61%, SLA missed in 3 of 4 quarters”. Turn-1 situation (day 71): “the primary supply contract expires in 14 days and does not auto-renew”. Discovery. 2026-08-26, minutes after the held-out analysis was committed, while reading the rationales of the twenty forced-critical episodes in the superseded world that did not switch vendor; ten of them (mostly one model) accept the superseding record and decline on the onboarding/deadline ground, e.g. “Renew the incumbent because the three-day deadline, six-week historical onboarding period, and zero production buffer make an immediate primary-vendor transition likely to increase delivery risk. The updated low-cost vendor record…”. Which arm it affects. Every forced-critical episode sees S0S_0 and the deadline; native episodes see S0S_0 only when the agent fetched it (40/150); the valid world is unaffected because switching is inconsistent there by definition. The defect can only lower Y in the intervention arm of the superseded world, i.e. it biases against the reported effect. The attribution of 10–13 points to it is a reading of rationales after the result was known and is labelled post hoc. The corrected sentence. The primary supply contract expires in 11 days; the incumbent’s standard month-to-month bridge is available during any transition. The low-cost vendor has […unchanged]. Eleven days is what the frozen turn-1 text implies at day 74; the month-to-month arrangement is a fact of the frozen world (memory_c5). An automated diff audit over the exported prompts, records, schema and runner sources confirmed that nothing else changed; turn-1 prompts are byte-identical to the original template for the same memory order. Results side by side. Original: 130/150 vs 38/150, +61.3 [+54.0, +68.0], 6/6 models positive. Corrected: 146/150 vs 36/150, +73.3 [+68.7, +77.3], 5/6 positive with one model at a native missed-path rate of zero; C2 == +10.7 [+8.0, +12.7] (bootstrap over the corrected arm; the original run’s rate is the fixed threshold). The interpretation row fixed before execution for this outcome reads: the held-out effect survives removal of the known contextual inconsistency. The original remains the registered held-out result. Appendix D The forced-noncritical control and its design limitation The forced-noncritical arm returns a seeded random non-target record plus the agent’s first-named id. When the agent named the target second, that arm discards it. In the stated × superseded stratum this happened in 19 (primary), 18 (replication), 19 (original held-out) and 21 (corrected held-out) episodes, every one of which was stale-consistent. The arm’s recovery of the target is therefore below native’s, and the contrast forced-critical minus forced-noncritical — +85.3 [+80.0, +90.0], +87.3 [+82.0, +92.0], +74.7 [+68.0, +80.7], +83.3 [+77.3, +88.7] — includes roughly 11–14 points that measure the cost of overriding a native choice, not the value of the critical record. The pre-specified rule for this contrast was met, but we withdraw its narrative weight: it appears nowhere in the abstract, the headline figure or the conclusions, and the interpretation that the effect is related to record content rests on the source-agreement control (§4.8) together with the headline contrast, subject to the presentation-interaction limitation stated there. A repaired comparator that replaces exactly one slot while preserving the agent’s own target pick is specified and was not run; the headline contrast does not need it. Appendix E Reproducibility and audit details Units. The unit of analysis is the episode (one turn-1 allocation and one turn-2 decision for one model). 5,400 confirmatory episodes: 1,800 primary, 1,800 replication, 900 original held-out, 900 corrected held-out; 10,800 kept model calls; 5 retries (each turn retried independently, at most twice; a turn-2 retry never re-samples turn 1); 0 error files; no episode or model excluded. A 48-episode pilot is excluded by version string. Integrity checks passed on every run. Cell counts exactly 25 per model per cell; no duplicate cell keys, seeds or raw response pairs; stored turn-1 prompts byte-identical within every block; no superseding record or status line in any turn-1 prompt; no superseding record in a turn-2 message whose returned set lacked the target; no malformed or out-of-enum response. Analysis. Risk differences are equal-weight means of per-model arm differences (the grid is balanced). Intervals are percentile bootstraps over episodes within model × arm (B=4,000B=4,000; seeds 20260825 for the primary, replication and original held-out runs and 20260826 for the corrected run, as in the frozen scripts). Cochran–Mantel–Haenszel tests stratified by model are reported in the frozen outputs as corroboration; no p-value is a headline. Each frozen analysis script was executed once on its completed run and its output committed; a second, independently written recomputation from raw answers reproduces every value. Models. Claude Opus 5 (claude-opus-5), Claude Sonnet 5 (claude-sonnet-5), Claude Haiku 4.5 (claude-haiku-4-5) (Anthropic Messages API, structured output; no temperature or extended-thinking parameter set — provider defaults); GPT-5.6 Sol (gpt-5.6-sol), GPT-5.6 Terra (gpt-5.6-terra), GPT-5.6 Luna (gpt-5.6-luna) (OpenAI Responses API, reasoning effort medium, strict JSON schema); client timeout 120 s, SDK automatic retries disabled (the runner’s own re-issues on transport or schema failure are the 5 retries counted above), concurrency 8. The runner enumerated the grid in a fixed nested order (form, world, policy, model, seed; the corrected run: world, policy, model, seed) and drew episodes from that list through the concurrency pool, so the policy arms of a form × world stratum executed as consecutive temporal batches, not interleaved or randomised in time. Model identifiers were passed verbatim with no dated-snapshot pinning; provider-side model drift is therefore not excluded by design, only bounded by each run’s execution window (Appendix B). Appendix F Forensic reanalysis of the outcome All counts below are emitted by a deterministic script from the stored episode files (no model call, no new scored endpoint) and are included in the supplementary material with the script. V×YV× Y under native allocation (stated form, superseded world; n=150n=150 per run). V: the target’s path was named at turn 1 (under native allocation the returned records are exactly the named ones). Pooled over the four runs, Y was 1 in 4 of the 455 episodes with V=0V=0 and 0 in 3 of the 145 episodes with V=1V=1. run V=0,Y=0V=0,Y=0 V=0,Y=1V=0,Y=1 V=1,Y=0V=1,Y=0 V=1,Y=1V=1,Y=1 U native stale-consistent RD primary 116 2 0 32 78.7 77.3 +74.0 fresh-wording replication 112 1 0 37 75.3 74.7 +72.7 original held-out 109 1 3 37 73.3 74.7 +61.3 corrected held-out 114 0 0 36 76.0 76.0 +73.3 What bounds the effect. With pfc=E[Y∣fc]p_fc=E[Y fc], pnat=E[Y∣native]p_nat=E[Y native], π=Pr(V=1∣native)π= (V=1 native), a=E[Y∣native,V=1]a=E[Y native,V=1] and b=E[Y∣native,V=0]b=E[Y native,V=0], RD=pfc−pnat≤1−pnatRD=p_fc-p_nat≤ 1-p_nat always, and 1−pnat=U(1−b)+π(1−a)1-p_nat=U(1-b)+π(1-a) with U=1−πU=1-π. The native stale-consistent rate therefore equals the missed-path rate U exactly when a=1a=1 and b=0b=0 (the corrected run) and can exceed it when a<1a<1 (the original held-out run, where 3 of the 40 agents that reached the record still declined). U is a descriptive reference, not a bound. The share of the native stale-consistent rate removed by re-allocation, RD divided by that rate, was 95.7%, 97.3%, 82.1% and 96.5% (descriptive). Forced-critical episodes with Y=0Y=0. 5 (primary), 3 (replication), 20 (original held-out) and 4 (corrected held-out) of 150 each. In the growth runs all 8 rationales acknowledge the withdrawal under the frozen regex of the scoring specification (8 of 8) and choose simplify_onboarding, citing a scope mismatch between an acquisition discount and a defensive-retention situation, an escalating price cut, or distrust of a conveniently timed single re-analysis. In the original held-out run 17 of 20 cite the three-day deadline and 19 the six-week onboarding; in the corrected run all 4 choose add_second_source with the low-cost vendor as a guarded step. Turn-1 provisional intents named the constrained action in 0 stated × superseded episodes of any arm, so every turn-2 choice of it is a revision.