Skip to main content

37  Context Transactions, Snapshots, Mounts, and Taint

37.1 Chapter status

Field	Value
Chapter ID	context-transactions-snapshots-mounts-and-taint
Part	Part II - Planning, Memory, Reasoning, and Execution
Status	conceptual
Manuscript maturity	v0.3 manuscript draft
Last updated	2026-07-23
Primary source records	23 assigned records spanning transactional context, state and branch semantics, historical project recovery, exact-prefix cache contracts, tenant-partitioned KV reuse, and semantic-response-cache validity
Claim label	Design rationale
Evidence level	argument
Source queue	primary: vcm_public; supporting: the local context, semantic-basis, transaction, recovery, and residual sources; variants: GraphRAG, Mem0, and the four current prefix-cache contracts; connector/recovery: editable VCM, machine unlearning, and semantic response caching
Source loading state	source notes: vcm_public, platonic_world_model, ladon_manhattan, context_engineer, black_hole_context_manager, vcm_editable, ext_graphrag_2024, ext_mem0_2025, ext_cap_theorem_gilbert_lynch_2002, ext_txfs_2018, ext_bourtoule_machine_unlearning_2021, cca_project, moecot_manifest_project, beastbrain_project, bugbrain_project, corbens_best_model_possible_project, reflexive_router_whitepaper, kernel_english_residual_compiler, ext_openai_prompt_caching_docs_2026, ext_anthropic_prompt_caching_docs_2026, ext_gemini_context_caching_docs_2026, ext_vllm_automatic_prefix_caching_2026, ext_azure_llm_semantic_cache_2026; raw cache: vcm_public, ladon_manhattan, context_engineer, black_hole_context_manager; connector/recovery: vcm_editable
Test state	Exact authored scaffold: 3 valid/6 rejecting memory-store records; 2 valid/4 rejecting ordered sequences; 1 bounded five-project restart lifecycle/10 rejecting mutations; reachable 6-event transaction execution with 81/81 rejected mutations; 52 live Lean declarations under 4 targets, including 35 in the reachable refinement. No concurrent store, actual process crash, filesystem-journal recovery, distributed commit, natural model-backed workload, useful advantage, or chapter-core support effect.

37.2 Drafting guardrail

This layer treats context transactions as a dynamic durable-state contract, not as an implemented database. The repository has three valid and six rejecting hand-authored memory-store records, two valid and four rejecting ordered sequences, one bounded restart lifecycle and ten mutations, and thirty-five reachable-refinement Lean declarations under four public targets. Those artifacts test their exact record, route, and summary consequences. They do not implement concurrent actors, a deployed durable store, real copy-on-write merge, filesystem crash recovery, distributed commit, storage-wide deletion closure, model forgetting, natural model use, useful advantage, or transfer.

It follows the certificate chapter because typed cells still need runtime semantics. Provenance and loss contracts are not enough if the memory view is stale, mixed across branches, or derived from tainted material.

At this boundary, context stops being a bag of retrieved text and becomes state. A stateful memory layer has to answer what view was read, what changed, what was hidden, what was tainted, what was deleted, and what derivative obligations now exist.

37.3 Human Reading Path

Concrete lens. The rollback-flag baseline marks the whole action reversed. The transaction path separates restored context from the recipient’s unchanged copy.

Typed context cells still need runtime semantics before use in memory. Context becomes a transactional view: it can be mounted, branched, tainted, committed, rolled back, expired, declassified, or denied. Without those semantics, even well-labeled memory can become stale, mixed across incompatible tasks, or derived from material that should no longer be used.

The human analogy is version control for what the model gets to see. If a future reviewer cannot tell which memory view was read, which branch it came from, what was private, what was tainted, and what derivatives now carry obligations, the system cannot honestly explain its own reasoning surface. Each transition should leave a receipt.

Context should behave like accountable state, not like a pile of helpful snippets. The same discipline that protects code history has to protect cognitive history, because every later claim depends on knowing which context state was actually active. The transaction log gives memory a boundary that can be challenged, while taint lets downstream work inherit caution instead of laundering risky context across operational boundaries.

37.4 Problem

Long-lived agents and parallel workers mutate durable context through multiple stores, branches, indexes, caches, summaries, and recovery paths. The stack must know which exact pre-state was read, which writes and derivatives actually occurred, which conflicts or partial failures happened, which state became durable and visible, and whether taint, revocation, deletion, authority, and rights obligations survived concurrency, retry, compaction, crash, and restart.

A typed context packet is not a transaction. The Virtual Context ABI can bind one static request to one actual consumer-visible packet, but something else must own durable writes, branches, merges, aborts, invalidation, deletion, recovery, and restart visibility. Without that owner, a clean packet can be materialized from a mixed snapshot, an uncommitted write, a foreign branch, a stale index, an unauthorized mount, or a derivative whose source was deleted after the cache was built.

The hard question is not merely whether retrieved text is relevant. It is whether an exact state transition is valid within a declared principal, purpose, participant set, isolation level, authority and rights ceiling, durability model, failure model, budget, and horizon—and whether the durable and consumer-visible post-state was independently observed.

37.5 Why existing approaches are insufficient

Vector retrieval, GraphRAG, and persistent conversational memory can improve access, consolidation, or task performance. They do not alone supply declared transaction isolation, atomic cross-representation commit, crash durability, or derivative closure. A graph or extracted memory can be useful while its update history, conflict state, source deletion, cache invalidation, or authority boundary remains unresolved.

Database and filesystem transactions provide stronger comparators. ACID, snapshot isolation, journaling, conflict detection, and crash recovery can protect bytes or records within declared APIs, journal capacity, platforms, participants, and fault models. They do not automatically define stable semantic-object identity, purpose-bound mounts, field provenance, taint, authority, rights, support boundaries, cross-backend materialization, or the difference between storage deletion and model forgetting. TxFS is therefore a crash-consistency comparator, not evidence that this repository has a transactional context store.

CAP-style results make multi-participant limits explicit: during a partition, fresh consistency and ordinary availability cannot both be assumed without qualification. Machine-unlearning work makes deletion limits explicit: a structured retraining path is not proof of physical erasure, privacy, influence removal, behavioral forgetting, or downstream-artifact deletion. A governed context transaction layer must expose those limits rather than relabeling them as successful commits.

37.6 Core Claim

[context-transactions-snapshots-mounts-and-taint.core, label: Design rationale, support: argument] Context Transactions should own the dynamic, versioned state-transition contract for durable context memory. Each accepted transaction binds principal, consumer, purpose, operation, base snapshot, branch, mounts, actual read/write/derive/delete/revoke sets, isolation and conflict policy, authority and rights, taint and declassification, durability and recovery model, budget, horizon, and support ceiling to an observed pre-state and a causally ordered attempted, applied, durable, visible, replayed, or recovered post-state. Commit, branch, merge, abort, retry, compaction, deletion, revocation, and recovery must preserve exact identities, obligations, faults, costs, and residuals. The transaction layer may change durable context state, but it does not own static packet materialization, semantic truth, belief revision, model/optimizer state, external effects, artifact correctness, verification adequacy, support, or release.

Reader claim. Rolling back memory state does not roll back an email, payment, publication, or other external effect that already escaped the transaction.

Operational rule. Record attempted, applied, durable, visible, and externally consumed state separately. Abort or restore the exact context snapshot, invalidate descendants, and create compensation records for irreversible effects; never label compensation as reversal.

37.6.1 Worked rollback: the context restores, the email remains sent

A transaction reads a customer record, derives a summary, stores it on a working branch, and sends the summary through an external adapter. A later taint check reveals that one source lacked the required declassification. The context store can restore the base snapshot, delete or revoke the derived cell, invalidate cached descendants, and record the failed merge. It cannot unsend the email.

The transaction therefore closes in two lanes: exact modeled context rollback and an open external-effect compensation record owned by the runtime and incident paths. A naive rollback flag would hide the recipient’s copy and falsely imply full reversal. The local transaction model checks snapshot, branch, mount, read-set, taint, deletion, replay, and support-boundary routes. It can prove finite state ordering for authored records; it does not prove semantic truth, unknown-copy discovery, external compensation, artifact correctness, or effect reversal.

The claim remains at argument. Current artifacts establish record shape, finite routing, authored failure rejection, and explicit non-claim boundaries. They do not establish a deployed store, concurrency semantics, crash durability, storage-wide deletion closure, model forgetting, useful context outcomes, or transfer.

37.6.2 Claim-source mapping status

Appendix C maps all fifteen assigned sources. Four local raw-cache mappings are passage-reviewed; vcm_editable remains bounded to its connector/source note; GraphRAG and Mem0 remain metadata-first comparators; CAP, TxFS, and Machine Unlearning remain primary-record or primary-paper note comparators; and the five historical projects remain pinned public-safe notes. None is imported as local transaction, durability, deletion, model-use, or usefulness evidence.

Source	What it supports	Limit
vcm_public	Passage-reviewed: object/version/representation/validation/packet/materialization identities, role-indexed obligations, representation graphs, protected compilation, semantic faults, runtime materialization keys, core-vs-transactions separation, immutable versions, pinned snapshots, commit/merge/branch/invalidation/deletion-closure ownership, race-free invalidation, residue reports, semantic page state, atomic memory transactions, causal ordering, copy-on-write branches, cache invalidation, task checkpoints, execution classes, and write-time controls.	No deployed memory store, resolver, runtime branch-isolation enforcement, side-channel review, VCM conformance run, VCM-Bench result, or independent interoperability result is present; bounded synthetic deletion-closure and memory-store harnesses do not promote source-derived support.
ladon_manhattan	Passage-reviewed: agency/credential exposure pressure, blind execution, kernel-level enclave/vault framing, opaque handles, trusted credential-entry overlay, syscall interception, permission-table checks, secret injection, Digital SCIF spawn/inject/execute/wipe/return lifecycle, side-channel defense considerations, and Rust implementation sketch.	No Ladon implementation, kernel test, side-channel validation, security audit, or theorem proof exists here.
context_engineer	Passage-reviewed: layered memory, context shards, clearance labels, memory masks, allowed tools, Digital SCIFs, ephemeral injection, zeroization, sanitized commits, information-flow controls, outgoing secret scans, source-reported benchmark figures, and limitations around software-only isolation and summarization loss.	No runtime enforcement or benchmark reproduction for clearance, taint, leak prevention, cost, or latency exists here.
black_hole_context_manager	Passage-reviewed: chunk records, embeddings, entropy, cached mass, timestamps, goal-vector state, lazy reweighting under goal drift, HMAC and multi-confirmation promotion gates, dormant cluster freezing, disk swap/thaw, tiered cache budgeting, mass-based eviction, TTL downgrade, hot/warm/cold cache framing, and a proposed drifting-needle scenario.	No package, local test run, freeze/evict fixture, benchmark, or production-behavior evidence exists here.
vcm_editable	Connector/source-note mapped: stable addresses, mounts, snapshots, materializations, semantic paging, protected compilation, authority non-escalation, and transactional/governed memory vocabulary.	Connector-readable variant only; no local VCM-Bench, deployed memory-store conformance run, or model-facing result exists; the bounded synthetic memory-store fixtures do not validate this source variant.
ext_graphrag_2024	Metadata-first comparator for mutable graph and community-summary state, provenance, update, invalidation, and deletion pressure.	No paper-passage result, graph build, transaction, update, deletion, fidelity audit, or reproduction.
ext_mem0_2025	Metadata-first comparator for extraction, consolidation, retrieval, graph linking, latency, and token-cost trade-offs in persistent memory.	No LOCOMO reproduction, judge audit, update correctness, poisoning, privacy, retention, deletion, or production result.
ext_cap_theorem_gilbert_lynch_2002	Primary-record comparator for partitions and consistency-versus-availability limits.	No distributed context store, consensus protocol, partition test, semantic mount, taint, or deletion result.
ext_txfs_2018	Primary-paper-note comparator for explicit transactions, journal-bounded ACID behavior, conflict isolation, crash consistency, durability, and transaction-size limits.	TxFS was not installed or reproduced; its byte and filesystem scope does not establish semantic context transactions or external-effect rollback.
ext_bourtoule_machine_unlearning_2021	Primary-paper-note comparator for structured deletion paths, retraining cost, accuracy trade-offs, and the limits of a generic forget claim.	No SISA run, parametric deletion, privacy result, context-store deletion, downstream erasure, or generic unlearning result.
cca_project, moecot_manifest_project, beastbrain_project, bugbrain_project, corbens_best_model_possible_project	Pinned public-safe project notes for durable identity, freeze/thaw, tiering, compaction, generation leases, atomicity pressure, restore/restart discipline, and negative cases where named transitions lack effects.	One authored lifecycle only; no historical runtime replay, deployed persistence, crash recovery, merge correctness, or independent replication.

37.6.3 Strongest objection

A transaction layer can add cost and false precision while a mature database, event log, cache policy, or human-managed workflow already supplies adequate state control. Worse, a perfect transaction log can describe a store that never persisted correctly, and an exact storage deletion can coexist with model influence, backups, disclosures, or external descendants. The design case therefore needs matched simpler baselines, independent state observation, actual concurrency and crash injection, complete cost accounting, and exact erasure categories before it can claim useful advantage.

37.7 Draft Key Figure: Context Transaction Lifecycle

Figure 37.1: Draft context transaction lifecycle.

How to read the context-transaction figure: Read the figure as a state lifecycle, not a retrieval pipeline. A context ABI record and certificate enter a transaction record, which fixes the read set, write set, snapshot, mount policy, audit refs, and replay boundary. Branch or commit decisions do not erase taint or deletion obligations. Tainted, revoked, unauthorized, stale, or unclosed derivatives route to fault or quarantine instead of materialization. Downstream artifacts, adequacy records, claim ledgers, and jobs should cite the transaction that materialized their view. The figure is a draft reader aid, not proof of deployed memory-store behavior, branch isolation, resolver correctness, deletion closure, taint enforcement, side-channel safety, benchmark performance, support-state movement, or release approval.

37.7.1 Dynamic context state beneath the ABI

The consolidated architecture places this dynamic-state route beneath The Virtual Context ABI: Typed Pages, Cells, and Certificates. The parent owns the static, consumer-relative request, resolution, representation, certificate, and materialization contract. This route continues to own transaction identity, read and write sets, snapshots, mounts, branches, merges, commits, aborts, rollback, restart recovery, taint and invalidation propagation, concurrency, cache invalidation, effect residuals, and closure.

That placement does not turn a packet certificate into transaction evidence or a successful commit into context adequacy. This route retains its own claims, source queue, proof targets, tests, fixtures, failure modes, evidence exit, non-claims, support ceiling, identity, and legacy URL. The parent does not inherit serializability, durability, deletion closure, taint completeness, or recovery; this route does not inherit representation fidelity, source adequacy, authority to disclose, model use, truth, or usefulness. The nest creates no deployed storage, concurrency, context-quality, support, safety, release, AGI, or ASI result.

37.8 Mechanism

A Context Transaction Record is the dynamic ledger for durable context-state change. It connects an observed pre-state to every attempted and observed post-state without treating a request, log row, checksum, acknowledgement, or success return as the effect itself.

The contract has eighteen mechanisms:

The first group fixes the transaction boundary and observes what was actually read or changed. It gives identity to snapshots, objects, branches, attempts, and obligations before mutation begins. The middle group separates preparation, application, durability, visibility, and recovery, so a success-shaped return does not collapse several distinct state transitions into one convenient label.

1. Freeze principal, consumer, purpose, operation, participant stores, branch, base snapshot, requested read/write/derive/delete/revoke sets, mounts, authority and rights ceiling, isolation, conflict and merge policy, durability and recovery model, budget, horizon, support ceiling, and material-change triggers before admission.
2. Assign stable transaction, event, object, version, field, branch, snapshot, mount, derivative, deletion-obligation, and receipt identities with causal parents and explicit logical-clock or ordering uncertainty.
3. Capture the actual pre-state: source versions, content and index epochs, provenance, taint, policy, locks or leases, caches, descendants, backups, and open obligations.
4. Enforce purpose-bound mount namespaces with separate read, write, derive, delete, share, export, train, and execute permissions.
5. Observe actual reads, writes, derivatives, deletions, revocations, cache touches, and side records rather than trusting declared sets.
6. Declare the isolation contract and test dirty reads, non-repeatable reads, phantoms, lost updates, write skew, stale-index reads, cross-branch leakage, and unauthorized mount visibility.
7. Give copy-on-write branches explicit create, rebase, compare, merge, reject, quarantine, abort, and garbage-collection states; unresolved conflict never collapses into silent last-writer-wins.
8. Separate requested, admitted, prepared, applied, durably committed, consumer-visible, replayed, recovered, compensated, aborted, and indeterminate states.
9. Commit content, indexes, provenance, taint, authority and rights, derivative edges, deletion and revocation obligations, caches, and audit refs atomically within the declared boundary or expose each uncertain participant as a blocking residual.
10. Bind retry to an idempotency key, original transaction and attempt lineage, effect observation, and duplicate suppression.
11. Propagate provenance, taint, privacy, authority, rights, purpose, retention, and prohibited use through derivatives unless a separately authorized and evidenced declassification narrows them.
12. Track deletion and revocation across live objects, derivatives, summaries, embeddings, indexes, caches, replicas, exports, backups, and future materializations while keeping logical deletion, inaccessibility, physical erasure, behavioral removal, influence removal, privacy protection, and unknown completion distinct.
13. Record contradiction, correction, supersession, and invalidation as append-only events without deciding claim truth or support.
14. Bind freeze, thaw, rebalance, tier promotion, no-loss compaction, migration, and restoration to observed preconditions, postconditions, identities, losses, costs, acknowledgements, and residuals.
15. Inject partial writes, process termination, journal loss, index/content divergence, cache staleness, lease expiry, and restart, then compare exact visible state and open obligations at the declared recovery boundary.
16. Observe durable state and consumer visibility independently of the transaction producer and its logs.
17. Retain every admitted, rejected, conflicted, retried, timed-out, partially applied, recovered, compensated, aborted, discarded, human-repaired, and residual attempt with total cost.
18. Compare against stateless retrieval, GraphRAG, persistent memory, ordinary file and key-value updates, database or filesystem transactions, event-sourced designs, and human-managed state under matched conditions.

flowchart LR
  A["Frozen request + observed pre-state"] --> B["Admit or typed fault"]
  B --> C["Read / write / derive / delete"]
  C --> D["Isolation + conflict check"]
  D --> E{"Branch outcome"}
  E -- "merge" --> F["Prepare commit"]
  E -- "abort" --> G["Abort + residual"]
  E -- "quarantine" --> H["Conflict custody"]
  F --> I["Atomic participant commit"]
  I --> J["Durability observation"]
  J --> K["Consumer visibility"]
  K --> L["Crash / restart replay"]
  L --> M{"Exact recovery?"}
  M -- "yes" --> N["Recovered receipt"]
  M -- "no" --> O["Fault + open residual"]

Reading the context transaction: The path is a state machine, not a retrieval pipeline. Admission precedes mutation; branch, conflict, and abort are ordinary outcomes; commit remains incomplete until the declared participants are durable and consumer visibility is observed; restart then checks the exact recovery boundary. Any uncertainty remains a fault or residual rather than a success-shaped receipt.

The remaining mechanisms extend that state machine across retry, derivation, deletion, compaction, crash, and comparison. Their common purpose is historical continuity: each attempt retains its causal parents, observed effects, unresolved participants, and total cost. That record leaves storage truth available to independent observers without assigning the transaction producer authority over claim truth, usefulness, or publication.

37.8.1 Material transitions and restart recovery

The historical-project packet makes seven state changes explicit: freeze, thaw, rebalance, tier promotion, no-loss compaction, partial-write recovery, and restart. Every transition binds a pre-state to an observed and acknowledged post-state. Authoritative item identities survive every no-loss operation. Index and content epochs advance atomically; a detected partial write blocks ordinary commit and rolls back to the last shared epoch. Restart then proves only that the hand-authored committed set is visible again—not that a deployed store, filesystem, or compactor behaves this way.

37.8.2 Routing projections, caches, and temporal invalidation

The Reflexive Router makes a context transaction visible to dispatch. A route may depend on a compact projection of entity identity, current state, claim status, policy, authority, freshness, privacy, capability availability, and resource state, but the transaction layer remains the owner of the durable versions behind that view. The routing projection records its snapshot, generation, dependency closure, valid-time horizon, transaction-time epoch, and derivation so it can be invalidated without pretending to be the store.

A semantic cache is therefore a materialized context descendant. Its key must bind tenant, principal and authority, purpose, policy and schema versions, source and object versions, valid time, privacy/rights class, route and field versions, verifier requirements, and transformation identity. A textual or embedding match alone is insufficient. Cache hits return the original typed result and dependency receipt; they do not silently refresh an expired lease or erase a contradiction, revocation, correction, or route override.

Chronicle updates, claim corrections, source changes, authority revocation, field replacement, policy change, and atlas migration must invalidate every affected hot projection, cached result, alias, workflow, and compiled reflex or leave an owned residual. Invalidating the visible cache without its descendants does not restore the pre-change state. Conversely, retaining the durable record while a consumer view expires preserves history without authorizing reuse.

These rules are architectural requirements from the paper. They have not been tested under concurrent actors, real cache collisions, cross-tenant traffic, crashes, or production invalidation, so the core remains at argument.

37.8.3 Response-cache validity: exact and semantic hits

An inference prefix cache and a response cache are different descendants. The prefix cache reuses compatible model state and produces a new answer. A response cache returns a prior answer and skips some or all new model evaluation. Its transaction boundary must therefore establish that the old answer remains admissible for the new request.

An exact output-cache key closes over more than prompt bytes. It binds the request and consumer, model and decoding policy, tool versions and results, retrieved sources, schema, locale and time horizon, principal and permissions, purpose, policy and rights epochs, side-effect state, verifier requirements, and every source dependency whose change can alter the answer. Random generation may make byte-identical replay impossible even under an identical prompt; “exact” then means exact request identity under a policy that explicitly permits prior-output reuse, not a proof that a fresh stochastic run would have returned the same text.

A semantic cache weakens the match rule further. It embeds a new request, searches prior requests, and returns a stored answer when similarity clears a threshold. That is an approximate routing decision. Microsoft’s Azure policy documentation warns directly that a semantic hit can be incorrect, outdated, or unsafe. A high vector score does not establish the same user, time, legal regime, source state, requested granularity, negation, exception, or side-effect intent.

The transaction layer therefore treats a semantic match as a candidate, never as truth. Admission is risk-class specific:

• immutable, content-addressed, side-effect-free transformations may admit exact output memoization after deterministic verification;
• bounded low-impact questions may admit semantic reuse with calibrated thresholds, freshness, disclosure, and a fresh-evaluation fallback;
• dynamic facts, personalized decisions, high-impact advice, security actions, rights-sensitive material, and side-effecting operations default to fresh evaluation unless a narrower policy has earned qualification; and
• any request with unresolved tenant, authority, source, policy, or time dependencies bypasses the response cache.

“Fresh” is not one time-to-live field. An entry can remain inside a provider’s retention window while a cited source is corrected, an access grant is revoked, a tool changes, a policy is replaced, a user leaves a role, or an external effect changes the world. Each entry records both a physical lifetime and a dependency closure. Invalidation walks that closure to response variants, embeddings, indexes, replicas, backups, downstream artifacts, and any compiled route that can return the answer. If a descendant cannot be reached or deleted, the transaction records an owned residual and blocks claims of complete removal.

Provider-side prefix caches add an opacity boundary. OpenAI, Anthropic, and Gemini expose cached-token or cache-read/write usage and document current retention behavior, but the application may not observe the exact internal block identity or every eviction. The application receipt can state that the provider reported a hit, the request fields it supplied, the contract version it relied on, and the invalidation it requested. It cannot convert those facts into proof that all provider state was fresh, erased, isolated, or cryptographically identical.

Shared self-hosted caches need an additional confidentiality boundary. vLLM documents a request cache salt that prevents different trust groups from sharing hash-derived blocks and reduces timing inference about another group’s prefixes. Tenant partitioning, encryption, access control, constant-time behavior where required, and rate-limit isolation are distinct defenses. A hash collision defense does not prevent a valid but unauthorized cross-tenant hit, and an access check does not prevent timing from revealing that an entry exists.

Every response hit returns the stored answer plus a CacheReuseReceipt. The receipt names exact or semantic match, entry and dependency digests, similarity and threshold where applicable, tenant and authority scope, source and policy epochs, creation and access time, expiry, invalidation status, verifier result, reuse disclosure, downstream effects, and residuals. It also preserves the miss and bypass reasons. This lets a later observer distinguish “the model answered now,” “compatible prefill was reused,” and “a prior answer was returned.”

Poisoning is a lifecycle event, not only a retrieval error. A malicious prompt, compromised source, weak answer, or prompt-injected tool result can become a popular cached artifact and spread farther than the original request. Qualification therefore includes poisoned entries, near-duplicate negations, changed dates and permissions, source corrections, revocation races, cross-tenant probes, stale replicas, failed deletion, and verifier outage. The semantic threshold is calibrated against harmful false positives, not chosen only to maximize hit rate.

These requirements do not establish that response caching is useful. The book has not deployed or calibrated one. They establish the minimum record needed to test the idea without laundering approximate similarity into a claim of fresh reasoning.

37.8.4 Semantic basis, branch containment, and actuality promotion

The Platonic World Model makes world branch and interpretation part of every context transaction. Actual, believed, predicted, planned, simulated, counterfactual, fictional, and normative claims may share terms without sharing write authority. A bridge rule names the assumptions, versions, direction, information loss, and authority under which a claim may cross contexts. Simulation output cannot enter the actual-world ledger because it looks plausible; promotion requires an authorized execution, observation, or adoption event with its own attestation.

Transactions also bind valid time, observation time, transaction time, and a semantic-basis manifest. Concurrent semantic edits name an immutable parent; noncommuting patches are rebased and revalidated or retained as separate branches. This supplies a semantic taint rule: unresolved version, grounding, mapping, defeater, or authority dependencies invalidate or explicitly degrade the affected snapshot instead of silently refreshing its vocabulary.

37.8.5 The interaction residual is transactional state

KERC’s interaction-global residual is compact precisely because later packets refer to earlier terminology, alias, unit, style, fidelity, and security choices. That makes it mutable shared state, not harmless tokenizer metadata. Its lifecycle is INIT -> ACTIVE -> UPDATED -> CHECKPOINTED -> CLOSED, with typed operations for defining realizations, setting style, binding aliases, locking terms, applying segment overrides, evicting entries, resetting scopes, and checkpointing an exact state hash. Each entry carries origin, owner, authority, scope, confidence, privacy, expiry, and precedence.

An update produces an append-only delta against an immutable parent plus a new content hash. Every Kernel packet binds the state version it consumed. Compiler and renderer hash mismatch, an unknown dictionary entry, an incompatible codebook, or a missing concept capsule is a transaction fault: the receiver requests a checkpoint or dependency, rolls back to a compatible state, or uses explicit local metadata. It may not approximate an unknown short code and render a plausible answer. Periodic full checkpoints, deterministic conflict rules, version negotiation, bounded state, and signed deltas for high-integrity uses make restart and replay testable.

Promotion of repeated local residue into shared state is also a governed transaction. The candidate records expected reuse, definition and reference cost, applicability, negative cases, privacy and profiling cost, requested scope, expiry, and whether user approval is required. A document-local terminology lock does not silently become a permanent user preference; an inferred preference does not outrank an explicit user rule; and a quoted instruction cannot mutate the ledger merely because the compiler recognized its syntax.

Reset, deletion, and migration propagate through materialized packets, caches, memories, rendered descendants, compiled macros, training exports, telemetry, and backups according to their distinct retention contracts. Deleting the visible glossary does not prove those descendants forgot it. This paper supplies a state model and recovery rules, not crash, concurrency, privacy, or migration evidence for an implemented residual service.

37.9 Interfaces

Context changes travel through a Context Transaction Record, but ownership does not collapse into that record:

• The Virtual Context ABI consumes one exact committed or faulted snapshot and emits a static packet; it cannot mutate, merge, delete, revoke, or recover durable context.
• Intent, Cognitive Compilation, and Planning may request operations and consistency needs but cannot declare a write applied, durable, visible, recovered, truthful, useful, or supported.
• Durable context stores expose actual object, version, index, journal, cache, replica, backup, and restart state. The transaction contract coordinates only its declared participants and fault model.
• Security, Privacy, Authority, Rights, and Licensing owners decide mounts, write/delete/export/train grants, declassification, retention, disclosure, and prohibited uses.
• Claim Ledgers and Spinoza own contradiction, evidence, belief, and support transitions. A correction, supersession, deletion, or commit cannot promote or refute a claim by itself.
• Artifact Graphs preserve transaction, derivative, cache, backup, fault, recovery, and downstream lineage without certifying correctness.
• Runtime Adapters own jobs, tools, approvals, and external effects. Context abort, restore, or compensation cannot claim rollback of an external effect without separate effect-complete evidence.
• Data Engines own datasets, model weights, optimizer and scheduler state, training caches, checkpoints, descendants, and causal unlearning. Storage deletion is not model forgetting, influence removal, privacy erasure, or behavioral cohort removal.
• Verification Bandwidth owns independent adequacy and outcome evaluation; transaction validity establishes only declared state-transition properties.
• Resource Economics owns storage, compute, indexing, locking, validation, retry, human, recovery, privacy, latency, and opportunity cost.
• Evidence States and Readiness Gates own support, quarantine, promotion, and release. A green commit, replay, deletion receipt, or restart check has no direct support-state effect.

Minimum fields:

• transaction_id
• transaction_state
• transaction_validity_state
• operation
• principal_ref
• consumer_ref
• purpose_ref
• participant_refs
• attempt_id
• idempotency_key
• pre_state_ref
• post_state_ref
• transition_state
• durability_model
• recovery_model
• conflict_policy
• merge_policy
• causal_parents
• ordering_evidence
• snapshot_id
• snapshot_boundary
• mounts
• mount_policy
• read_set
• write_set
• branch_policy
• isolation_state
• taint_labels
• taint_propagation
• deletion_obligations
• rollback_or_deletion_closure
• declassification_refs
• derivative_refs
• contradiction_refs
• materialization_state
• closure_state
• faults
• context_abi_refs
• source_refs
• audit_refs
• consumer_policy
• verification_refs
• promotion_blockers
• replay_boundary
• support_state_effect
• non_claims

Typed conflict, denial, timeout, partial commit, crash, recovery, abort, and indeterminate states are ordinary interface results. Downstream packets and artifacts cite the exact transaction and snapshot they inherited, but a later fault triggers review through the appropriate owner rather than silently rewriting the dependent artifact or claim.

37.10 Invariants

The invariants define what remains distinguishable while context moves. They bind identity and policy to exact versions, keep intermediate and uncertain states visible, and preserve obligations through derivation and recovery. Read together, they describe the accounting boundary for a transaction receipt; a receipt outside that boundary is narrower evidence, even when its local fields are internally consistent.

1. Every transaction binds one exact principal, consumer, purpose, operation, participant set, branch, base snapshot, mount policy, authority and rights ceiling, isolation, durability, recovery model, budget, horizon, and support ceiling.
2. Requested, admitted, prepared, applied, durable, visible, replayed, recovered, compensated, aborted, and indeterminate states remain distinct.
3. A snapshot binds the declared causal, object-version, branch, mount, content/index epoch, policy, provenance, taint, lease, cache, and open-obligation boundary; a name or timestamp alone is not a snapshot.
4. Actual read, write, derive, delete, revoke, cache, replica, backup, and export sets remain inspectable.
5. No uncommitted, stale, foreign-branch, policy-mismatched, or unauthorized state becomes visible where the declared isolation and mount contract forbids it.
6. Concurrent conflicts, lost updates, write skew, phantoms, stale indexes, and merge disagreements remain explicit; silent last-writer-wins is not a conflict-free commit.
7. Mounts, branches, summaries, embeddings, translations, caches, replicas, and exports cannot widen authority, rights, purpose, retention, permitted use, support, or release.
8. Provenance, taint, privacy, authority, rights, prohibited use, and unresolved conflict propagate to every derivative unless declassification is separately authorized, evidenced, scoped, expiring, and residualized.
9. Deletion and revocation name exact reachable storage and derivative scope; logical deletion, inaccessibility, physical erasure, behavioral removal, influence removal, privacy protection, and unknown completion are never conflated.
10. Atomicity, consistency, isolation, and durability claims remain limited to declared participants, operations, journal, platform, fault model, and observation boundary. Uncertain or partitioned participants remain residual.
11. Durable means the state survives the declared crash and restart model and is independently observed after recovery; a log, checksum, success return, or acknowledgement is insufficient.
12. Freeze, thaw, rebalance, promotion, compaction, migration, restore, and every no-loss transition preserve authoritative identities and obligations or expose exact loss, conflict, corruption, and repair state.
13. Retries and replay preserve transaction identity, attempt lineage, idempotency policy, duplicate detection, and observed effects.
14. Context abort, restore, or compensation cannot erase an external effect, published artifact, human disclosure, model update, or downstream copy without separate owner evidence.
15. Actual pre-state, post-state, durability, consumer visibility, restart visibility, and downstream consequence remain independently observable.
16. Every conflict, denial, retry, timeout, partial write, crash, recovery, human repair, abort, discard, cost, and residual stays in the denominator.
17. Schemas, authored fixtures, finite records, local reversible traces, and finite theorems establish only their exact scopes and cannot universalize isolation, durability, deletion, security, usefulness, or transfer.

37.11 Failure modes

Most failures arise when one observable state is substituted for another: an acknowledgement for durability, a timestamp for a snapshot, a restored object for closed deletion, or a sequential trace for concurrent isolation. Others arise when a participant disappears from the accounting boundary. The taxonomy keeps both substitution and omission visible across normal operation, faults, recovery, and later derivatives.

1. Transaction theater records a request or acknowledgement without observing pre-state, durable post-state, visibility, consequence, or recovery.
2. Snapshot fiction mixes versions, branches, mounts, policies, caches, or causal frontiers under one coherent-view identity.
3. Isolation laundering calls a sequential fixture evidence for concurrent serializability, read-your-writes, or cross-store consistency.
4. Lost-update and write-skew laundering accepts overlapping decisions because record conflicts or semantic invariants were not modeled.
5. Branch and merge laundering leaks speculative state, silently uses last-writer-wins, or garbage-collects an unmerged obligation.
6. Mount-authority laundering reads or mutates through a path, cache, replica, summary, tool, or restore route outside the purpose-bound grant.
7. Taint and declassification laundering drops restrictions through derivation, aggregation, translation, compaction, migration, or a success-shaped approval.
8. Deletion resurrection returns revoked or deleted material through derivatives, embeddings, indexes, caches, backups, exports, restored snapshots, or future materializations.
9. Erasure-category laundering treats logical deletion, access denial, storage erasure, model forgetting, influence removal, privacy protection, or changed behavior as interchangeable.
10. Partial-write laundering admits new content with an old index, a new index with old content, or divergent provenance, taint, rights, and deletion ledgers.
11. Crash and restart amnesia loses identities, obligations, locks, leases, journal position, invalidations, or residuals while reporting healthy state.
12. Retry and acknowledgement laundering repeats a non-idempotent write after timeout or reuses a receipt for an unobserved attempt.
13. Causal-order laundering uses wall-clock order, stale logical clocks, or missing parents to present reordered history as valid.
14. Cache, replica, and backup laundering leaves a hidden participant outside invalidation, taint, rights, revocation, deletion, or recovery closure.
15. Compaction and tiering loss removes low-salience but authoritative, contradictory, minority, legal, evidential, or deletion-critical state under a no-loss label.
16. Rollback and compensation laundering calls a context restore effect-complete while effects, artifacts, disclosures, model updates, or descendants persist.
17. Failure and cost survivorship removes conflicted, retried, crashed, repaired, aborted, slow, privacy-expensive, or residual transactions.
18. Portability theater treats one fixture, backend, filesystem, model, workload, or fault schedule as general transaction evidence.

37.12 Minimum Viable Implementation

The current minimum is an authored record-and-route scaffold:

• one public transaction schema and fixture;
• three valid and six expected-invalid memory-store records;
• two valid and four expected-invalid ordered transaction sequences;
• one hand-authored five-project restart lifecycle and ten rejecting mutations; and
• fifty-two live Lean theorem declarations grouped under four public targets.

The scaffold checks finite committed-read visibility, branch and mount faults, taint and declassification, deletion/materialization blocks, replay and non-promotion boundaries, no-loss lifecycle identity, equal committed content and index epochs, partial-write recovery, and exact authored restart visibility. It does not run concurrent actors, a deployed store, real copy-on-write merge, actual process crash, filesystem journal recovery, distributed commit, model-backed context use, storage-wide deletion closure, useful advantage, or transfer.

The next honest minimum must run prospectively declared stateful tasks through ordinary file or key-value updates, a strong transactional database or filesystem baseline, persistent-memory and retrieval baselines, and the governed route on at least two actual backends. It must inject dirty and stale reads, lost updates, write skew, branch and mount violations, partial commits, cache or replica lag, process kills, restart, deletion and revocation, compaction, retries, and partitions. Independent observers must record actual pre-state, writes, durability, visibility, recovery, leakage, task outcomes, costs, and delayed residuals. Reproduction from environment locks and transfer to a second model and backend are required before promotion.

37.13 Mature Research Target

A mature Context Transaction layer is an independently testable dynamic state machine for durable AI context, not a transactional metaphor. Natural stateful workloads run parallel readers and writers over exact source objects, branches, mounts, indexes, caches, derivatives, and recovery boundaries.

The full campaign compares stateless and direct retrieval, GraphRAG, persistent memory, ordinary file and key-value updates, database or filesystem transactions, event-sourced designs, human-managed state, and the governed semantic transaction layer under matched models, sources, authority, resources, faults, and horizons. Independent observers measure isolation anomalies, source and field survival, conflict calibration, authority and rights leakage, taint and deletion closure, crash durability, restart fidelity, idempotent recovery, useful task throughput, unsafe use, abstention, missed help, privacy exposure, latency, and total cost.

Promotion requires nonzero useful opportunity, predicted mechanism-specific failures under ablation, clean crash/restart reproduction, complete denominators, storage-versus-model-erasure honesty, and cross-model and cross-backend transfer. A simpler transactional baseline that matches or dominates the joint frontier narrows or refutes the added ABI-specific benefit. Any failure of isolation, durability, authority, deletion, reproduction, or transfer narrows, blocks, or refutes the exact corresponding claim rather than being averaged into a success narrative.

No current result meets this transactional-context endpoint; support remains argument until natural crash, concurrency, taint, deletion, recovery, reproduction, and cross-backend transfer gates pass.

37.14 Codex test plan

Test	Purpose	Status
Context transaction fixture validation	Check that the transaction fixture matches the public schema and declares transaction state, transaction validity state, operation, snapshot boundary, mounts, mount policy, read/write sets, branch policy, isolation state, taint propagation, deletion obligations, rollback/deletion closure, declassification refs, derivatives, materialization state, contradictions, closure state, faults, context ABI refs, source refs, audits, consumer policy, verification refs, promotion blockers, replay boundary, support-state effect, and non-claims.	implemented by protocol validation; validated locally
Reachable snapshot transaction refinement	Check exact snapshot, branch, mount, cell, commit-version, visible-read, replay, audit, derivation, and materialization custody across an ordered execution and arbitrary accepted bound runs.	implemented in AsiStackProofs.ContextTransactionRefinement; six-event witness plus identity, valid-trace, composition, and monotone-custody theorems build locally
Reachable taint/deletion boundary	Check that represented taint removal requires declassification authority and receipt, open deletion blocks derivation/materialization, support promotion requires its own transition, and accepted runs cannot discard recorded closure or materialization.	implemented in AsiStackProofs.ContextTransactionRefinement; bounded abstract facts and receipts only
Synthetic deletion-closure harness	Check that deleted or revoked source material cannot reappear through derivatives without a closure record.	implemented in python3 scripts/validate_context_admission_adequacy.py; no memory-store claim
Context transaction route proof	Check that finite transaction review records route missing or stale snapshots, branch leaks, mount faults, taint without declassification, deleted-cell materialization without closure, invisible committed reads, missing replay boundaries, unsupported support promotion, missing non-claim boundaries, and complete committed reads to explicit outcomes.	implemented in AsiStackProofs.ContextTransactions; no deployed memory-store, mount service, branch-isolation service, or deletion service claim
Bounded memory-store conformance harness	Check synthetic memory-event fixtures for committed-read visibility, mount faults, branch isolation, deletion/materialization blocking, taint/declassification, replay boundaries, and support-state non-promotion.	implemented in python3 scripts/validate_context_transaction_memory_store.py; no deployed memory-store claim
Memory-store harness fixture bridge	Check the exact 3 valid/6 expected-invalid fixture inventory against the reachable transaction model without copying result counts into Lean.	implemented by python3 scripts/validate_context_transaction_memory_store.py and consumed by the independent refinement; no deployed memory-store claim
Context transaction sequence bridge	Check the exact 2 valid/4 expected-invalid ordered sequences against reachable read-after-write, replay, taint, and no-promotion semantics without copied Lean summaries.	implemented by python3 scripts/validate_context_transaction_sequence_bridge.py and consumed by the independent refinement; no deployed transactional store claim
Reachable transaction independent consumer	Reimplement the transition relation, consume both exact fixture families, compile the exact Lean module, execute the six-event witness, verify the named lifecycle controls, and mutate snapshot, branch, mount, cell, version, visibility, taint, declassification, deletion, receipt, support, and time fields.	implemented by python3 scripts/validate_context_transaction_refinement.py; 35 Lean declarations, 12 lifecycle controls, and 81/81 mutations checked, support-state effect none
Historical-project restart/recovery lifecycle	Check the seven material transitions, causal chaining, observed/acknowledged effects, no-loss identity, partial-write quarantine, atomic epochs, restart visibility, and no fixture promotion.	implemented by python3 scripts/validate_context_restart_recovery.py with one bounded five-project lifecycle and ten expected-invalid mutations; no deployed store, process restart, filesystem atomicity, or support claim

The fixture-shape check, finite-record proof predicates, synthetic deletion-closure harness, bounded synthetic memory-store harness, and bounded sequence bridge are implemented. The transaction route proof keeps unclosed deletion obligations from being modeled as allowed materializations, rejects stale or absent snapshots before read admission, routes branch leaks and unrepaired mount faults away from materialization, requires review for tainted context without declassification, blocks invisible committed reads, and preserves replay, evidence-transition, and non-claim boundaries. The memory-event harness rejects expected-invalid cases for uncommitted reads, deleted-source materialization, unauthorized mounts, leaked tainted branches, missing replay boundaries, and support-promotion attempts. The sequence bridge adds ordered write/read and tainted-derivative sequences, then rejects read-before-write ordering, missing replay boundaries, undeclassified taint materialization, and support-promotion controls. Deployed store consistency, runtime branch isolation, deployed deletion closure, side-channel behavior, VCM conformance, and benchmark behavior remain untested.

37.14.1 Formalization hooks

Tag	Module	Target	Status
lean:vcm.transactions.operational_invariant	AsiStackProofs.ContextTransactionRefinement	Accepted reads preserve exact snapshot, branch, mount, cell, committed version, and replay custody; successful bound runs preserve transaction identity and yield valid compositional traces.	implemented
lean:vcm.transactions.failure_blocks_promotion	AsiStackProofs.ContextTransactionRefinement	Accepted materialization requires governed taint/declassification, deletion closure, and evidence-transition receipts; custody, closure, and materialization remain monotone across accepted runs.	implemented
lean:vcm.transactions.memory_store_fixture_bridge	AsiStackProofs.ContextTransactionRefinement	The reachable model is consumed alongside the exact 3-valid/6-invalid memory-store suite and an exact-module checker covering 35 declarations, 12 lifecycle controls, and 81 rejecting mutations.	implemented
lean:vcm.transactions.sequence_fixture_bridge	AsiStackProofs.ContextTransactionRefinement	The six-event ordered witness is consumed alongside the exact 2-valid/4-invalid sequence suite and rejects read-before-write and missing-replay faults.	implemented

The four public targets now group fifty-two live declarations: seventeen retained finite contradictions, routes, and non-promotion lemmas plus thirty-five reachable-refinement validity, run-level invariant, consequence, witness, and countermodel declarations. Six frozen assumption, copied-result, or field-projection declarations are physically absent with lineage preserved. This is useful finite ordering and custody evidence, not a proof of a store.

The declarations do not prove serializability, linearizability, snapshot isolation, a real read or write, truthful logs, atomic filesystem or distributed commit, crash durability, branch containment, mount enforcement, taint or deletion completeness, declassification quality, model use, usefulness, safety, poisoning resistance, or transfer. Those claims require typed store and failure semantics, executable refinement to actual backends, countermodels, concurrent histories, independent state observation, crash and restart traces, natural outcomes, and accepted evidence transitions.

37.15 Source crosswalk

Source ID	Title	Layer	Planned use	Readiness
reflexive_router_whitepaper	The Reflexive Router	pre_deliberative_reflexive_routing_control_plane	Routing projections over durable state, dependency-complete semantic-cache keys, bitemporal freshness, and invalidation across cached routes, aliases, workflows, and compiled reflexes.	source note available
vcm_public	Virtual_Context_Memory_v1	memory_context	Public VCM release. Governed protocol for compiled working context.	source note available; local raw cache available
ladon_manhattan	Ladon & The Manhattan Protocol	security_governance	Kernel-level security architecture for high-agency AI.	source note available; local raw cache available
context_engineer	Context Engineer / Manhattan Protocol	memory_context_lineage	Context as supply chain; compartmentalized information logistics.	source note available; local raw cache available
black_hole_context_manager	Black Hole Context Manager	memory_context_lineage	Earlier context management spec with lazy evaluation, batching, drift checks, security hardening.	source note available; local raw cache available
vcm_editable	Virtual_Context_Memory_v1.0_Editable	memory_context	Editable version with evidence-carrying planner-guided context compiler framing.	source note available; connector or recovery required
ext_graphrag_2024, ext_mem0_2025	GraphRAG and Mem0	derived_and_persistent_memory	Comparators for derived graph/community state and cross-session memory extraction/consolidation under version, taint, revocation, deletion, and provenance pressure.	source notes available; no local transaction, memory, or correctness result
ext_cap_theorem_gilbert_lynch_2002	Brewer’s Conjecture / CAP theorem	distributed_consistency	Comparator for partitions, consistency/availability limits, stale participants, and indeterminate multi-store state.	source note available
ext_txfs_2018	TxFS	crash_consistent_transactions	Comparator for explicit transaction APIs, isolation, conflict handling, journal bounds, crash consistency, and durability.	source note available
ext_bourtoule_machine_unlearning_2021	Machine Unlearning	deletion_boundary	Comparator separating structured deletion paths from model influence, privacy, behavioral forgetting, and downstream erasure.	source note available
cca_project, moecot_manifest_project, beastbrain_project, bugbrain_project, corbens_best_model_possible_project	Historical project lineage	local_transaction_and_recovery_lineage	Freeze/thaw, tier persistence, graph/context state, generation and restart discipline, no-loss compaction, atomic index/content updates, and negative cases for simulated or nominal state transitions.	public-safe pinned notes reviewed; one hand-authored lifecycle only, no historical runtime replay or independent replication

All fifteen assigned sources have bounded mappings. They position semantic transactions against retrieval, persistent memory, distributed limits, filesystem transactions, model-unlearning boundaries, security compartments, memory budgets, and historical project failures. They do not establish this chapter’s runtime behavior or support promotion.

The result sharpens the required state surfaces while leaving transactional isolation and lifecycle safety unproved.

37.15.1 Manifest source assignment reconciliation

These rows keep Context Transactions, Snapshots, Mounts, and Taint’s manifest assignments visible at their recorded review boundary. Passage review does not establish local reproduction, performance, safety, deployment, or support-state movement.

Source	Intake role	Boundary
platonic_world_model	Metadata-first comparator: The Platonic World Model: A Semantic Constitution for Grounded, Proof-Carrying, Self-Editing Artificial Intelligence. Corben-authored July 2026 conceptual architecture and falsifiable research program for semantic continuity through stable Form lineages, immutable semantic versions, typed Essence Contracts, six mutually constraining planes, explicit proposition-attestation-commitment-proof separation, branch-protected world dynamics, qualified grounding, semantic transactions, runtime packet compilation, and federated mappings. Existing chapters are upgraded first; no implemented substrate, benchmark result, philosophical solution to grounding, safety result, SOTA result, AGI, ASI, or support-state promotion is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
kernel_english_residual_compiler	Metadata-first comparator: Kernel English with Hierarchical, Interaction-Amortized Residuals: A Dual-Vocabulary Cognitive Compiler for Efficient Language-Model Reasoning. Corben-authored July 2026 architecture proposal for KERC: protected-object capture, uncertainty-aware normalization, sense-aware Kernel IR, dual surface/core vocabularies, a four-level interaction-amortized residual ledger, exact object storage, grammar-aware macro fusion, structured answer packets, rendering, round-trip verification, versioned migration, and complete rate-compute-fidelity evaluation. Existing chapters are upgraded first; no implementation, benchmark, novelty, efficiency, fidelity, safety, transfer, SOTA, AGI, ASI, or support-state result is inferred.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_openai_prompt_caching_docs_2026	Metadata-first comparator: Prompt Caching. Current official provider contract for exact-prefix prompt caching, cache-write and cache-read metering, usage receipts, retention, organization isolation, and rate-limit boundaries. Product behavior and prices are time-sensitive; inspected 2026-07-23.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_anthropic_prompt_caching_docs_2026	Metadata-first comparator: Prompt caching. Current official provider contract for reusable prompt prefixes, explicit cache breakpoints, five-minute and one-hour lifetimes, cache creation and read metering, and prewarming. Product behavior and prices are time-sensitive; inspected 2026-07-23.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_gemini_context_caching_docs_2026	Metadata-first comparator: Context caching. Current official provider contract for implicit and explicit context caching, common-prefix placement, cached-token usage reporting, time-to-live, and storage charges. Product behavior and prices are time-sensitive; inspected 2026-07-23.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_vllm_automatic_prefix_caching_2026	Metadata-first comparator: Automatic Prefix Caching. Official vLLM design documentation for block-hash exact-prefix KV reuse, least-recently-used eviction, multi-modal and adapter identity, and tenant cache-salt protection against timing inference. No local serving benchmark was run.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.
ext_azure_llm_semantic_cache_2026	Metadata-first comparator: Azure API Management LLM semantic cache lookup policy. Official semantic-response-cache policy documentation. It treats vector similarity as an approximate response-reuse decision and warns that a hit can return an incorrect, outdated, or unsafe answer. No local semantic-cache deployment was run.	No passage-level source claim, local implementation, reproduction, safety, performance, deployment, support-state, or ASI result is established by this reconciliation row.

37.16 Summary

Context Transactions owns dynamic durable context-state change. It binds an exact pre-state and request to observed read, write, derive, branch, merge, abort, deletion, revocation, durability, visibility, crash, restart, fault, cost, and residual states. Static packet materialization, claim truth, model state, external effects, support, and release remain separately owned.

The repository currently proves only finite record and route consequences and rejects authored mutations. It has not run a concurrent durable store or natural model-backed transaction campaign. The next proof step is therefore empirical and causal: real backends, strong transactional comparators, concurrency and crash injection, independent state observation, exact deletion categories, complete costs, reproduction, and transfer.

A context operation that cannot establish its declared isolation, authority, durability, visibility, or closure state should fault or remain indeterminate. Even a valid transaction still does not establish that the resulting context is adequate evidence. That separate question belongs to Verification Bandwidth and Context Adequacy.

37.17 Evidence reconciliation (2026-07-16)

The invariant protocol, field meanings, and inference limits are stated once in Living Book Methodology. This packet contains only the chapter-specific projection; its authoritative per-atom rows are the context-transactions-snapshots-mounts-and-taint slice of experiments/claim_family_terminal_coverage/results/result.json.

The core remains blocked after full attempt at argument support. The strongest family attempt was Situated world-model acquisition and consolidation campaign. Its exact boundary is: Bounded finite POMDP result only; no open-world truth, general memory transfer, deployment, or chapter-core promotion. Across 73 atoms, the terminal ledger records 73 blocked_after_full_attempt.

Chapter-specific field	Value
Family / atom denominator	CF-04 / 73 atoms
Terminal dispositions	73 blocked_after_full_attempt
Core	context-transactions-snapshots-mounts-and-taint.core: blocked_after_full_attempt at argument
Core attempted / missing lanes	source-synthesis / causal, empirical, executable, formal, normative, transfer
Attempted local lanes	source-synthesis
Missing or unproved lanes	causal, empirical, executable, formal, normative, transfer
Strongest family bundle	Situated world-model acquisition and consolidation campaign (natural_work_and_end_to_end): Two partially observed environments, 11,250 episodes, 6,000 held-out episodes, six directional ablation signatures, and governed replacement/rollback.
Negative controls	ten arms; six matched ablations; ten laundering mutations; replacement and rollback checks.
Accepted transitions	none
Maximum inference	Bounded finite POMDP result only; no open-world truth, general memory transfer, deployment, or chapter-core promotion.
Reproduction / next burden	Replay scripts/validate_p4_m8_world_model_campaign.py and scripts/validate_claim_family_terminal_program.py; fill the named atom-specific lanes under a new prospective protocol.

37.17.1 Semantic proof ceiling

The P4-C4 audit finds AsiStackProofs.ContextTransactionRefinement adequate only for exact finite record admission, six-event sequencing, and accepted-run custody invariants. Its four public targets and thirty-five declarations do not establish concurrency correctness, serializability, linearizability, durable I/O, recovery, cache invalidation completeness, deletion or forgetting, external-effect rollback, deployment, transfer, or support movement.

37.18 Handoff

Valid context operations are necessary, but they do not automatically give enough evidence for a claim. Verification Bandwidth and Context Adequacy separates coherent access from adequate understanding. It asks whether the system has enough time, comparison method, tools, reviewer bandwidth, and contradiction search for the claim at hand, so memory validity does not inflate into epistemic confidence.