1. The Ungoverned Commit Boundary
1.1 From momentary output to durable influence
A stateless system can be wrong once. A persistent system can make one error into a rule.
This difference is easy to underestimate because durable adaptation often appears as an ordinary internal operation: append a memory, add a demonstration, update an adapter, register a tool, revise a system prompt, promote a workflow, modify an evaluator, or change a team role. Yet each operation changes the probability distribution of future behavior across episodes. Persistence is therefore not merely a storage property. It is a causal effect on the future.
Consider a conversational assistant that reads an untrusted email and stores the claim that its user prefers a particular vendor. The original interaction may end harmlessly, but the memory can influence later recommendations, searches, messages, and purchases. Recent persistent-memory benchmarks and attacks show that stored state can create cross-domain leakage, sycophantic reinforcement, delayed action steering, and long-lived compromise [29-33]. The exact numbers and attack methods will change, but the architectural lesson is stable: a write into durable adaptive state can have a larger and less visible blast radius than the output that caused it.
The same boundary appears far beyond memory:
- A trajectory added to a fine-tuning set can influence millions of future generations.
- A reward-model revision can redefine which behavior is reinforced.
- A generated tool can replace repeated reasoning across many tasks.
- A regression test can make one historical failure a permanent capability floor.
- A multi-agent routing change can alter which subsystem receives future evidence.
- An organizational procedure can transfer decision rights, burden, and accountability across people and machines.
- A compiler update can change how all later lessons are interpreted and installed.
These are different mechanisms, but they share one event: transient evidence crosses a boundary and acquires durable influence.
This paper calls that boundary the Adaptive Commit Boundary.
Figure 1. The Adaptive Commit Boundary. Counterexamples, drift, and revocation reopen the commit decision rather than silently preserving stale structure.
1.2 The prior question hidden inside learning
Machine learning typically asks how to update a selected parameterization. Continual learning asks how to update it without catastrophic forgetting [1-3]. Model editing asks how to change a fact or behavior locally [5,6]. Agent-memory research asks what to store and retrieve. Skill-learning systems ask how to preserve successful workflows. Organizational-learning research asks how repeated performances become routines [11,12]. Self-improving-agent research asks how systems can alter their own code or scaffolding [21-23,38].
Each line of work is important. But each often begins after a consequential choice has already been made: the adaptation locus has been selected.
The event will become a gradient.
The event will become a memory.
The event will become a skill.
The event will become a rule.
The event will change the organization.
The prior question is:
What relationship to persistence does this experience deserve?
That question includes several subquestions:
- What actually happened?
- What, if anything, does the evidence justify learning?
- Which causal mechanism should change?
- Where should the lesson be realized?
- Should it be represented in one locus or several?
- How strongly should it bind future behavior?
- What authority permits that influence?
- How will its assumptions be monitored?
- What happens if the lesson is later narrowed, contradicted, or revoked?
Without explicit answers, adaptive systems can turn noise into memory, correlation into policy, evaluator weakness into objective, successful improvisation into brittle automation, and local repair into global rigidity.
1.3 Persistence is neither memory nor learning alone
The word persistence is used here in a broad but disciplined sense. A state item is persistent relative to an adaptive identity when it can survive beyond the episode that produced it and influence later decisions, outputs, evaluations, resource allocations, or successor states.
This includes, but is not limited to:
- parametric state;
- optimizer and adapter state;
- episodic and semantic memory;
- replay buffers and curated datasets;
- prompts, policies, and routing rules;
- tools, skills, workflows, and code;
- world-model concepts and dynamics;
- tests, benchmarks, critics, and reward models;
- agent roles and communication topology;
- interfaces, interlocks, and environmental structure;
- institutional routines, permissions, and governance rules.
A particular object can be external at one resolution and internal at another. A tool is external to a language model but internal to an agent. A shared memory is external to one agent but internal to a team. A procedure is external to a worker but internal to an organization. The theory must therefore declare the adaptive identity and resolution under study rather than assuming that the learner is the model.
1.4 Central thesis
The central thesis is:
Cumulative intelligence depends not only on the capacity to adapt from experience, but on the capacity to govern what experience is allowed to become persistent.
A mature adaptive system should:
- preserve a defensible record of experience;
- adjudicate whether a durable lesson is identifiable and legitimate;
- separate the lesson from any particular implementation;
- choose a portfolio of adaptation loci;
- match commitment strength to evidence and authority;
- compile guarded realizations;
- qualify the exact realizations before ordinary use;
- preserve a viable slow path and counterfactual observability;
- monitor assumptions, descendants, and delayed effects;
- narrow, relocate, decompile, unlearn, compensate, revoke, or retire structure when warranted.
The paper calls this theory Adjudicated Persistence.
Figure 2. The Search-to-Structure Ratchet. Structure is neither terminal nor irreversible; residuals and invalidated assumptions return control to novelty-handling mechanisms.
1.5 Contributions
This paper makes ten conceptual contributions.
First, it identifies the Adaptive Commit Boundary. Persistent writes, updates, and promotions are treated as consequential effects requiring admission discipline.
Second, it separates six objects: experience record, lesson hypothesis, disposition, realization, qualification lease, and authority grant.
Third, it defines learning eligibility before adaptation. An outcome can justify investigation or containment without justifying a policy update.
Fourth, it formulates Cross-Surface Adaptation Assignment. Lessons are assigned to portfolios across heterogeneous adaptation loci rather than one presumed destination.
Fifth, it defines multidimensional commitment profiles spanning scope, binding strength, persistence, coupling, authority, irreversibility, and descendant reach.
Sixth, it introduces Evidence-Commitment Matching. Evidence obligations are derived from the proposed commitment profile and lesson class.
Seventh, it introduces Minimum Sufficient Persistence. The preferred realization is the least committing admissible portfolio, subject to efficacy, capability, observability, and recovery constraints.
Eighth, it requires guarded use, UNKNOWN routes, re-expansion triggers, and a deliberation reserve. Compilation cannot eliminate the general mechanism needed for novelty and repair.
Ninth, it defines a non-self-ratifying meta-compilation boundary. A compiler may propose improvements to itself but cannot be the sole authority that declares them better.
Tenth, it proposes LocusBench, a benchmark in which similar outcomes arise from different causal loci and therefore require different persistence decisions.
16. Threat Model and Failure Taxonomy
16.1 Threat actors and failure sources
The framework considers:
- ordinary statistical noise;
- incomplete observability;
- distribution shift;
- specification error;
- accidental implementation defects;
- strategic users;
- malicious external content;
- compromised memory or tools;
- reward hacking;
- evaluator capture;
- organizational incentive distortion;
- colluding agents;
- self-serving meta-compilers.
The goal is not to solve all threats. It is to prevent persistent adaptation from silently amplifying them.
16.2 Semantic miscompilation
Failure: The lesson itself is false or incomplete.
Examples: a coincidence becomes a rule; one evaluator blind spot becomes a skill; a benchmark exploit becomes a capability claim.
Controls: source diversity, counterexamples, transfer, interventions, uncertainty, lesson versioning, EVIDENCE_ONLY disposition.
16.3 Scope miscompilation
Failure: A valid lesson is applied beyond its qualified domain or too narrowly to cover its cause.
Controls: typed operating regions, guarded admission, hierarchical region splitting, UNKNOWN, re-expansion, transfer tests.
16.4 Causal miscompilation
Failure: The system changes a correlated surface rather than the causal mechanism.
Controls: decision-time reconstruction, feasible comparators, intervention, causal bounds, minimal causal sets, unresolved status.
16.5 Locus miscompilation
Failure: The lesson is correct but stored in the wrong surface.
Examples: fine-tuning a volatile fact; adding memory for a tool bug; changing a model to compensate for an unsafe interface.
Controls: cross-surface alternatives, fixed-locus baselines, staged placement, placement regret.
16.6 Temporal miscompilation
Failure: Commitment occurs too early, too late, or on the wrong clock.
Controls: outcome maturity, fast containment versus slow consolidation, expiry, minimum dwell periods, hysteresis.
16.7 Pedagogical miscompilation
Failure: A compact trajectory is executable but teaches a learner to presuppose information unavailable at inference time.
Controls: decision-time information contracts, information-acquisition preservation, inspect-act-verify structure, process interventions, separate execution and learning compilations.
16.8 Integration miscompilation
Failure: Local realizations work separately but conflict when composed.
Examples: guard combinations cause universal refusal; sequential edits erase each other; multiple tools create inconsistent state.
Controls: compatibility hypergraph, higher-order tests, order analysis, re-synthesis, retained modular fallback.
16.9 Governance miscompilation
Failure: Useful behavior acquires unjustified authority, shifts burden, or changes rights.
Controls: four-separation rule, normative firewall, affected-party standing, authority ceilings, appeals, independent promotion.
16.10 Stale-profile miscompilation
Failure: A previously valid realization remains active after model, environment, evaluator, dependency, or stakeholder change.
Controls: material-change invalidation, expiry, dependency closure, drift monitoring, canary requalification.
16.11 Recursive miscompilation
Failure: The persistence machinery alters its own evaluator, records, or promotion process to ratify itself.
Controls: proposal/promotion separation, frozen external tests, predecessor fallback, archive, evaluator-change epochs, human or institutional gates.
16.12 Memory poisoning and origin laundering
Failure: adversarial content becomes durable memory or rule; later summaries conceal the untrusted origin.
Controls: restricted write channels, source identity, taint, quarantine, independent verification, rate limits, source concentration tests, derivation lineage.
Recent persistent-memory attacks show that delayed compromise can survive across sessions and later cause agentic actions [31-33]. Input filtering alone is insufficient when the update mechanism itself can promote untrusted content.
16.13 Recurrence laundering
Failure: one poisoned source produces many correlated traces and appears independently recurrent.
Controls: evidence genealogy, effective-source count, cluster-level weighting, source-diverse confirmation, adversarial recurrence tests.
16.14 Evaluator capture
Failure: candidate and evaluator share a blind spot, training data, provider, prompt, toolchain, or incentive.
Controls: evaluator lineage vectors, deterministic anchors, hidden tests, delayed external outcomes, adversarial critics, evaluator-first investment.
Multiple prompts to the same model do not constitute independent evaluators.
16.15 Reward laundering
Failure: proxy improvement is narrated as target improvement.
Controls: separate proxy and target claims, reward-hacking probes, causal ablations, hidden transfer, independent outcome evaluation.
Partial reward identifiability [34] and spontaneous reward hacking in iterative refinement [35] make this a central risk.
16.16 Probability-mass displacement
Failure: suppressing one bad behavior increases another.
Controls: distribution-level audits, alternative outputs, pass@k analysis, counterfactual correction pairs, calibrated abstention, protected-positive suites.
16.17 Excessive repulsion and catastrophic fixation
Failure: old negative evidence continues to push behavior after the target is remote, or one vivid incident dominates adaptation.
Controls: learner-relative relevance, decay, recurrence weighting, severity caps, diversity quotas, conversion of mature lessons into tests or guards.
16.18 Creativity and exploration suppression
Failure: novel valid behavior resembles past failure and is blocked.
Controls: protected counterfactual surplus, novelty sandboxes, shadow alternatives, appeals, valid-exception tests, deliberation reserve.
16.19 Competence starvation
Failure: fast paths reduce practice and degrade the general solver or human recovery capability.
Controls: reserve traffic, drills, independent solving, human-skill metrics, explicit retirement decisions.
16.20 Observability collapse
Failure: the system chooses actions with weaker logging, shortens evaluation horizons, or suppresses incident reports.
Controls: external telemetry, missingness monotonicity, minimum logging, independent audit sampling, conservative risk bounds when evidence disappears.
Missing evidence must not lower estimated risk by default.
16.21 Descendant amnesia
Failure: revoking a lesson updates one store while leaving copies, fine-tunes, indexes, tools, publications, or organizational descendants unchanged.
Controls: descendant graph, invalidation propagation, claim-specific closure, residual reporting, no universal erasure claim.
16.22 Institutional capture
Failure: organizations suppress embarrassing evidence, prefer metrics showing few incidents, or shift burdens to users and reviewers.
Controls: independent reporting, audit rights, waiver ownership, separation of deployment incentive from incident adjudication, whistleblower and appeal mechanisms.
Technical architecture cannot substitute for institutional accountability.
16.23 Privacy-forensics tension
Failure investigation favors detailed records; privacy favors minimization.
Controls include:
- purpose limitation;
- approved-span retention;
- redaction;
- restricted evidence stores;
- content commitments;
- differential access;
- deletion records;
- explicit statements of which future claims become weaker after deletion.
The framework does not resolve the tension by declaring either maximal logging or maximal deletion universally correct.
16.24 Dual use
A system capable of discovering residual failures can also discover exploits. Skill traces, incident archives, and counterfactual probes can increase offensive capability.
Controls include:
- sandboxing;
- separation between critic and actor access;
- minimum-necessary disclosure;
- risk-tiered release;
- restricted tools;
- monitoring of exploit reproduction;
- publication of abstractions rather than operational payloads where appropriate.
18. Discussion
18.1 Adjudicated Persistence as a missing control plane
Modern adaptive systems often have many update pathways but no common control plane over persistence.
A model trainer decides what changes parameters.
A memory system decides what gets stored.
A tool agent decides what becomes a skill.
A benchmark owner decides what becomes a regression.
A deployment team decides what becomes default.
An organization decides what becomes procedure.
When these decisions are isolated, the same event can be:
- fine-tuned into the model;
- written into memory;
- encoded as a tool;
- added to a test;
- and converted into a policy
without one record explaining whether the layers agree, duplicate, or conflict.
Adjudicated Persistence is a proposed control plane over these transitions. It does not replace local adaptation mechanisms. It establishes shared semantics for evidence, lesson identity, commitment, qualification, authority, and lifecycle.
18.2 The deepest design shift: persistence is earned
The ordinary framing is:
[ . ]
The proposed framing is:
[ . ]
This change matters because many adaptive failures are not failures of learning capacity. They are failures of admission:
- the system learned from poisoned evidence;
- learned the wrong cause;
- learned at the wrong layer;
- learned too broadly;
- learned too permanently;
- learned without preserving exceptions;
- learned under a captured evaluator;
- or learned what it was not authorized to decide.
A strong learner is not merely easy to update. It is selective about what acquires future causal power.
18.3 Search and structure
The framework preserves the search-to-structure intuition while narrowing it.
Flexible computation is valuable for:
- novelty;
- ambiguity;
- exploration;
- synthesis;
- exception handling;
- repair.
Persistent structure is valuable for:
- recurrence;
- exact execution;
- low-latency response;
- preservation;
- coordination;
- assurance.
The system should not choose one permanently. It should move work between them:
[ ]
This resembles amortization, partial evaluation, profile-guided optimization, and library learning [7-10,14,15], but adds evidence, authority, and lifecycle constraints.
18.4 Persistence and alignment
Adjudicated Persistence is not a complete alignment theory. It addresses a narrower question: how an adaptive system’s future behavior is changed by experience.
That boundary is alignment-relevant because:
- reward models can drift;
- memories can carry untrusted norms;
- tools can acquire practical authority;
- evaluators can be Goodharted;
- organizations can institutionalize harmful routines;
- meta-compilers can modify the processes that judge improvement.
The framework contributes structural defenses:
- no automatic objective mutation;
- support/qualification/authority separation;
- independent promotion;
- evidence-matched commitment;
- residual preservation;
- contestability;
- slow-path and fallback.
These controls do not guarantee aligned goals. They make goal and authority changes harder to hide inside ordinary learning.
18.5 Persistence and interpretability
Externalized lessons are often easier to inspect than parametric changes, but externalization is not automatically interpretable.
A generated tool can contain opaque code.
A memory can contain misleading summaries.
A test suite can encode an incorrect construct.
An organizational rule can obscure who bears cost.
Interpretability should therefore be measured by whether a reviewer can reconstruct:
- the lesson claim;
- its evidence;
- its applicability;
- its realization;
- its effects;
- its exceptions;
- its lifecycle.
A compact artifact with no lineage is not necessarily more understandable than a model update.
18.6 Persistence and modularity
The framework gives modularity an operational role.
Modularity can:
- localize change;
- preserve alternatives;
- simplify revocation;
- reduce interference;
- improve causal attribution.
But modules also create:
- interface assumptions;
- routing errors;
- hidden shared state;
- duplicated capability;
- maintenance burden.
Cross-Surface Adaptation Assignment should therefore choose modular or integrated realizations empirically. Modularity is an option, not a moral principle.
18.7 Persistence and compression
The theory extends compression in three ways.
First, it includes future computation and coordination cost, not only storage.
Second, it treats residuals as first-class. A compressed structure is not permitted to rename unexplained information as noise merely because it is inconvenient.
Third, it includes assurance and governance cost. A representation that is slightly larger but easier to verify, update, or revoke can have lower total lifecycle cost.
The relevant question is:
What is the least committing structure that preserves the distinctions the system is obligated to make?
18.8 Persistence and scale
As systems become more capable, the commit boundary becomes more consequential for two reasons.
First, each durable change can influence more tasks, users, tools, and descendants.
Second, the system may become better at proposing persuasive but self-serving lessons.
Greater capability should therefore increase—not reduce—the importance of:
- exact identity;
- independent evaluation;
- material-change invalidation;
- authority separation;
- slow-path preservation;
- external monitoring.
A highly capable optimizer should not be trusted with broader persistence merely because it is competent. Competence increases both useful proposal power and potential commitment amplification.
18.9 Persistence and scientific learning
The framework also applies to scientific systems.
Repeated residuals can become:
- a new latent variable;
- a causal relation;
- an equation;
- a simulation component;
- an experimental protocol;
- a measurement correction;
- a research priority.
Scientific persistence should preserve:
- data lineage;
- alternative hypotheses;
- model dependence;
- falsifying tests;
- uncertainty;
- scope;
- retraction.
A theory is a compact generative structure, but it remains qualified relative to observations, interventions, and domains. Scientific progress is therefore another search-to-structure ratchet governed by evidence and defeasibility.
18.10 Persistence and artificial general intelligence
A general intelligence cannot store every experience verbatim, reason through every recurring task from scratch, or internalize every lesson into one homogeneous parameter space.
It must decide:
- which experiences matter;
- which can be generalized;
- which should remain episodic;
- which should become skills;
- which should become concepts;
- which require environmental or institutional change;
- which should not be learned;
- which old lessons should be reopened.
Adjudicated Persistence therefore describes a necessary systems problem for increasingly general agents. It does not establish that solving the problem is sufficient for AGI or ASI.
18.11 Why the theory is not a bureaucracy mandate
The framework can be overbuilt.
A persistence packet that costs more than the expected future benefit is a failure. Low-risk, easily reversible settings may need only lightweight records and automatic tests. High-risk, high-authority, hard-to-reverse changes need stronger adjudication.
The intended principle is proportionality:
[ C_{} < E[ + + ]. ]
If a field, check, or review never changes an admission, route, rollback, or understanding, it should be simplified or removed.
18.12 Why the theory remains falsifiable
Adjudicated Persistence would be weakened if:
- cross-surface assignment does not outperform simpler policies;
- commitment profiles do not predict risk or lifecycle burden;
- Evidence-Commitment Matching does not reduce overshoot;
- the slow path does not preserve recovery;
- transaction semantics add cost without catching stale or partial updates;
- lesson identity does not aid migration or revocation;
- the full framework cannot beat domain-specific adaptation systems.
The theory’s breadth is a liability unless the common abstractions improve prediction and control across several domains.
References
[1] J. L. McClelland, B. L. McNaughton, and R. C. O’Reilly, “Why There Are Complementary Learning Systems in the Hippocampus and Neocortex: Insights from the Successes and Failures of Connectionist Models of Learning and Memory,” Psychological Review, vol. 102, no. 3, pp. 419-457, 1995. doi:10.1037/0033-295X.102.3.419.
[2] J. Kirkpatrick et al., “Overcoming Catastrophic Forgetting in Neural Networks,” Proceedings of the National Academy of Sciences, vol. 114, no. 13, pp. 3521-3526, 2017. doi:10.1073/pnas.1611835114.
[3] D. Lopez-Paz and M. Ranzato, “Gradient Episodic Memory for Continual Learning,” in Advances in Neural Information Processing Systems 30, 2017, pp. 6467-6476.
[4] L. Bourtoule et al., “Machine Unlearning,” in 2021 IEEE Symposium on Security and Privacy, pp. 141-159, 2021. doi:10.1109/SP40001.2021.00019. arXiv:1912.03817.
[5] K. Meng, D. Bau, A. Andonian, and Y. Belinkov, “Locating and Editing Factual Associations in GPT,” in Advances in Neural Information Processing Systems 35, 2022. arXiv:2202.05262.
[6] K. Meng, A. S. Sharma, A. Andonian, Y. Belinkov, and D. Bau, “Mass-Editing Memory in a Transformer,” in International Conference on Learning Representations, 2023. arXiv:2210.07229.
[7] B. Amos, “Tutorial on Amortized Optimization,” arXiv:2202.00665, 2022.
[8] N. D. Jones, C. K. Gomard, and P. Sestoft, Partial Evaluation and Automatic Program Generation. Prentice Hall, 1993.
[9] D. Chen, D. X. Li, and T. Moseley, “AutoFDO: Automatic Feedback-Directed Optimization for Warehouse-Scale Applications,” in Proceedings of the 2016 International Symposium on Code Generation and Optimization, pp. 12-23, 2016. doi:10.1145/2854038.2854044.
[10] O. Flückiger, G. Scherer, M.-H. Yee, A. Goel, A. Ahmed, and J. Vitek, “Correctness of Speculative Optimizations with Dynamic Deoptimization,” arXiv:1711.03050, 2017.
[11] J. G. March, “Exploration and Exploitation in Organizational Learning,” Organization Science, vol. 2, no. 1, pp. 71-87, 1991. doi:10.1287/orsc.2.1.71.
[12] M. S. Feldman and B. T. Pentland, “Reconceptualizing Organizational Routines as a Source of Flexibility and Change,” Administrative Science Quarterly, vol. 48, no. 1, pp. 94-118, 2003. doi:10.2307/3556620.
[13] S. Sundaresan and I. Guler, “Algorithmic Recommendation Tools and Experiential Learning in Clinical Care,” Organization Science, vol. 36, no. 5, pp. 1786-1802, 2025. doi:10.1287/orsc.2022.16738.
[14] K. Ellis et al., “DreamCoder: Growing Generalizable, Interpretable Knowledge with Wake-Sleep Bayesian Program Learning,” arXiv:2006.08381, 2020.
[15] M. Bowers, T. X. Olausson, L. Wong, G. Grand, J. B. Tenenbaum, K. Ellis, and A. Solar-Lezama, “Top-Down Synthesis for Library Learning,” in Proceedings of the ACM on Programming Languages, vol. 7, POPL, 2023. arXiv:2211.16605.
[16] A. Zhao et al., “ExpeL: LLM Agents Are Experiential Learners,” arXiv:2308.10144, 2023.
[17] T. Schick, J. Dwivedi-Yu, R. Dessì, R. Raileanu, M. Lomeli, L. Zettlemoyer, N. Cancedda, and T. Scialom, “Toolformer: Language Models Can Teach Themselves to Use Tools,” arXiv:2302.04761, 2023.
[18] G. Wang, Y. Xie, Y. Jiang, A. Mandlekar, C. Xiao, Y. Zhu, L. Fan, and A. Anandkumar, “Voyager: An Open-Ended Embodied Agent with Large Language Models,” arXiv:2305.16291, 2023.
[19] P. Jiang et al., “Adaptation of Agentic AI,” arXiv:2512.16301, 2025.
[20] A. Jaglan and J. Barnes, “Continual Learning, Not Training: Online Adaptation for Agents,” arXiv:2511.01093, 2025.
[21] Y. Xiong, S. Hu, and J. Clune, “Learning to Continually Learn via Meta-Learning Agentic Memory Designs,” arXiv:2602.07755, 2026.
[22] H. Zhou et al., “Memento-Skills: Let Agents Design Agents,” arXiv:2603.18743, 2026.
[23] Y. Huang et al., “MemoHarness: Agent Harnesses That Learn from Experience,” arXiv:2607.14159, 2026.
[24] Q. Chen, A. Bellucci, Z. Sun, and G. Jacucci, “SkillDroid: Compile Once, Reuse Forever,” arXiv:2604.14872, 2026.
[25] H. Sun et al., “Experience Makes Skillful: Enabling Generalizable Medical Agent Reasoning via Self-Evolving Skill Memory,” arXiv:2606.09365, 2026.
[26] G. Liu, H. Zhao, and Q. Yao, “Falsifiable Commitment Planning for Self-Correcting Web Agents,” arXiv:2607.24167, 2026.
[27] L. Jiang, H. Xu, Y. Ding, and A. Zhang, “Trajectory-Refined Distillation,” arXiv:2606.08432, 2026.
[28] S. Yang et al., “What Makes Interaction Trajectories Effective for Training Terminal Agents?” arXiv:2606.03461, 2026.
[29] S. Pulipaka, O. Chen, M. Sharma, T. S. Bajwa, V. Raina, and I. Sheth, “PersistBench: When Should Long-Term Memories Be Forgotten by LLMs?” arXiv:2602.01146, 2026.
[30] T. Ding, A. Nannapaneni, B. Liu, and L. Zhang, “Always-On Agents: A Survey of Persistent Memory, State, and Governance in LLM Agents,” arXiv:2606.30306, 2026.
[31] X. Chen, X. Xie, W. Fu, J. Zhou, S. Yu, and Q. Xuan, “MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair,” arXiv:2607.27080, 2026.
[32] Y. Zhang, S. Zhao, J. Zhang, J. Zhang, G. Deng, X. Liu, C. Xiao, and T. Zhang, “When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents,” arXiv:2607.05189, 2026.
[33] S. Pulipaka, S. Hlebik, L. Raghav, S. Abdelnabi, V. Raina, I. Sheth, and M. Fritz, “Hidden in Memory: Sleeper Memory Poisoning in LLM Agents,” arXiv:2605.15338, 2026.
[34] J. Skalse, M. Farrugia-Roberts, S. Russell, A. Abate, and A. Gleave, “Invariance in Policy Optimisation and Partial Identifiability in Reward Learning,” in Proceedings of the 40th International Conference on Machine Learning, PMLR 202, pp. 32033-32058, 2023.
[35] J. Pan, T. He, J. R. Bowman, and S. Feng, “Spontaneous Reward Hacking in Iterative Self-Refinement,” arXiv:2407.04549, 2024.
[36] D. Manheim and S. Garrabrant, “Categorizing Variants of Goodhart’s Law,” arXiv:1803.04585, 2018.
[37] L. Orseau and S. Armstrong, “Safely Interruptible Agents,” in Proceedings of the 32nd Conference on Uncertainty in Artificial Intelligence, pp. 557-566, 2016.
[38] J. Zhang, S. Hu, C. Lu, R. Lange, and J. Clune, “Darwin Gödel Machine: Open-Ended Evolution of Self-Improving Agents,” arXiv:2505.22954, 2025.
[39] J. Pearl, Causality: Models, Reasoning, and Inference, 2nd ed. Cambridge University Press, 2009.
[40] M. A. Hernán and J. M. Robins, Causal Inference: What If. Chapman & Hall/CRC, 2020.
[41] T. Lebo, S. Sahoo, D. McGuinness, et al., “PROV-O: The PROV Ontology,” W3C Recommendation, 30 April 2013.
[42] National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, 2023. doi:10.6028/NIST.AI.100-1.
Acknowledgment of scope
This manuscript is intentionally standalone. Its concepts are presented and justified within the paper rather than relying on prior architecture papers for definitions. The author welcomes independent attempts to formalize, falsify, simplify, or replace the proposed framework.
