Knowing the Store: What a Memory Backend Must Write Down Before an Agent Can Read It

Ansuman Mullick; Eray Tüzün

cs.AIOct 3, 2026

Knowing the Store: What a Memory Backend Must Write Down Before an Agent Can Read It

Authors: Ansuman Mullick, Eray Tüzün

Organizations: Bilkent University, Ankara, Türkiye

Abstract

An agent with long-term memory can answer from a record it should no longer use, such as a plan the user later cancelled. We ask what a memory store must expose for an agent to know this before retrieving anything, and we score that judgment on its own, as metamemory monitoring. Readers see only a value-free summary: record counts by lifecycle state and a list of attribute names. Each of 148 questions is asked against three versions of one store that differ in one attribute, so wording cannot give the answer away. What a model adds depends on the length of that list. On the short lists the benchmark's ground truth produces (2.6 names on average), none of five language models reliably beats a cosine-similarity lookup over the names, and the three stronger ones are equivalent to it within 0.05. Under a control that fixes counts and list length, none is reliably above it and none is shown equivalent. On lists longer than the stores we tested write, padded to 60 names, the lookup loses 0.18; GPT-5.6 Luna and Sol lose 0.06 to 0.07 and lead it by 0.13 to 0.14, while the other three fall with it. The lead holds for Sol against a sibling padded to the same length and counts. Reworded to share no word with the names, the lookup loses 0.02 and one stronger reader edges 0.04 ahead. On the short lists the three stronger readers lead only where the summary counts a state without naming it, and one count feature closes that lead within a question, though not when items are pooled. The backends we tested omit or misstate this information: under FR-Bank's own metadata, GPT-4.1 mini, Haiku 4.5 and the lookup fall from 0.73, 0.82 and 0.75 to 0.60, 0.71 and 0.59. In these tests, what the store wrote down limited every reader we gave it to. All stores are synthetic; control, whether a better judgment yields a better answer, is left to a later study.

Figures & tables

A retraction triple. Question: What should I expect during my next Brazil Carnival trip?
summary line	present version	pn version	absent version
retraction total	0	1	0
category: entries, active, retracted	55, 55, 0	56, 55, 1	54, 54, 0
category names	..., trip_plan	..., trip_plan	... (no trip_plan )
superseded names	(none)	(none)	(none)
name lookup score	$0.00$	$0.00$	$0.00$

Figure 2: The Carnival retraction triple: one question, three store versions differing in one attribute. Only the count distinguishes present from pn ; absent also loses the category name. The default name lookup reads the superseded list, so it ties the versions. Only changed summary lines are shown (the supersession triple is in Appendix C.2 ).

Reader	Named states	AUROC	persona interval	matched	W/T/L
mini a	superseded	$0.76$	$[0.72,0.80]$	$0.73$	$100/15/33$
mini a	all	$0.83$	$[0.79,0.87]$	$0.90$	$130/5/13$
Haiku	superseded	$0.76$	$[0.71,0.80]$	$0.78$	$89/52/7$
Haiku	all	$0.88$	$[0.84,0.91]$	$0.91$	$125/18/5$
Luna	superseded	$0.84$	$[0.80,0.88]$	$0.88$	$129/2/17$
Luna	all	–	–	–	–

Table 1: Counterfactual obligation AUROC:

88

supersession,

30

retraction and

30

expiry positives. Brackets: persona intervals. The matched column is the within-triple comparison of pn against present ,

(W+T/2)/148

; it and W/T/L are post hoc; persona intervals keep triples intact. Question-only AUROC is

0.50

. Differences at four decimals. (Appendix C.2 )

What we tried to break	What it removes	What happened
One question, three store versions	Question-wording leakage	A question-only reader scores $0.50$ by construction
Random tokens for the names p	Name meaning, length kept	$0.65$ ; the real lookup is $0.13$ higher
Sibling-name control	List length and counts	Lookup $0.95$ , models $0.88$ to $0.97$ , none reliably above the lookup
Lifecycle totals permuted	The summary’s two totals	No model moves by more than $0.01$ , none reliably
Count moved to a sibling version p	Where the count sits	Luna, Sol, Opus fall $0.28$ to $0.33$ ; mini, Haiku no reliable change
Every count deleted	The counts	Mini and Haiku within $0.01$ ; Luna loses $0.06$ , Opus $0.04$

Table 2: The checks we ran to break the lookup result, what each removes, and what happened. Short ground-truth lists do not establish robustness to longer store-written ones. In row 9 retraction and expiry do not move, since the list names neither. (Appendices C.2 and E.9 )

Panel of Figure 3 — Figure 3: Per-state matched AUROC on the counterfactual set ( pn against present within the triple; post hoc); the dashed line is chance. Mini uses five draws, matching Table 1 . The count reader guesses the category. Luna and Sol ran only the default summary. Every value is in the tables of Appendix C.2 ; bars: persona-grouped 95% intervals.

Backend	Mode	Census measurement
FR-Bank	Over-mark	Of $18{,}936$ entries and $109$ events, marks $5{,}968$ entries stale against ${\sim}102$ in the reference (about $58\times$ ) and retains an active obsolete assertion after $72\%$ of supersession events, at the stored-versus-obsolete matching threshold of the census.
Mem0	Overwrite	At the retrieval surface we evaluated ( search and get_all , mem0ai 1.0.5), $12.7\%$ of $10{,}074$ entries expose updated_at and nothing else, because UPDATE overwrites the record it exposes and ingestion is silently lossy; its per-memory history call was not consulted.
A-MEM	Unresolved links	In our integration ( agentic-memory 0.0.1), all $23{,}186$ link references across $11{,}319$ notes resolve to $0$ note identifiers, on the $40$ scored personas (not checked against the reference implementation).

Table 3: Backend census: counts of disagreement with the manifest-and-alignment reference, without hand adjudication or sampling intervals. Lower panel: coverage losses and rebuilt-summary scores. (Appendices E.7 and E.9 )

Policy	Forbidding records in view (of $104$ )	rate	Mean lines per question	Licensed record in view (of $174$ )
Top-five retrieval	$54$	$0.52$	$5.00$	$0.37$
Similarity, matched budget	–	$0.54$	$5.43$	$0.39$
Newest per attribute, matched	–	$0.23$	$5.43$	$0.29$
Always-on fetch, matched	–	$0.82$	$5.43$	$0.34$
Lookup rule	$85$	$0.82$	$5.46$	$0.37$
Model rule	$85$	$0.82$	$5.43$	$0.37$

Table 4: Reach on the full obligation set: forbidding records among the

104

obligations, mean lines over the

661

questions, and licensed records among the

174

items. Matched rows interpolate between depths (Table 90 , Appendix E.10 ). No answer is scored here.

Appendix figures & tables100 assets

Supplementary material from the paper’s appendix.

Appendix

Population	$n$ (positives)	Models (calls per question)
the counterfactual set	$444$ items: $148$ questions asked of three versions of one store that differ in one attribute ( $148$ obligations: $88$ supersession, $30$ retraction, $30$ expiry)	GPT-4.1 mini (1, and 5), Haiku 4.5 (5), Opus 5 (5), GPT-5.6 Sol (5), GPT-5.6 Luna (5)
the expiry extension	$42$ items: the $14$ eligible expiry pairs the first draw left undrawn, built by the same construction ( $44$ expiry pairs pooled with the set’s $30$ )	GPT-4.1 mini (1), Haiku 4.5 (5), Opus 5 (1)
the paraphrase set	$345$ items: the $115$ of the $148$ questions whose rewrite, sharing no content word with any printed name, passed a word screen and an author’s read, asked of the same three store versions ( $115$ obligations: $76$ supersession, $17$ retraction, $22$ expiry)	GPT-4.1 mini (1), Haiku 4.5 (5), Opus 5 (1), GPT-5.6 Luna (5), GPT-5.6 Sol (5); the last two under the default summary only
the counterfactual set, lists padded to $60$ names	$444$ items: the same $148$ questions asked of the same three store versions with the superseded-names list padded to $60$ names (148 obligations: $88$ supersession, $30$ retraction, $30$ expiry)	GPT-4.1 mini (5), Haiku 4.5 (5), Opus 5 (1), GPT-5.6 Luna (5), GPT-5.6 Sol (5); the default summary only
the supersession pairs, a sibling padded to $60$ names	$176$ items: the $88$ supersession pairs’ padded pn version against a fourth version with one name swapped for a same-category sibling (identical pad and counts)	GPT-4.1 mini (5), GPT-5.6 Luna (5), GPT-5.6 Sol (5); Haiku 4.5 and Opus 5 not run
the full obligation set	$661$ questions ( $104$ obligations: $63$ supersession, $26$ retraction, $15$ expiry): the hard tier’s $307$ and the easy tier’s $354$ together	GPT-4.1 mini (1); Haiku 4.5, Opus 5 and GPT-5.6 Luna (5); GPT-5.6 Sol and Kimi K3 stopped at the budget

Appendix

Table 5: The populations, with their sizes and positives and the models that ran on each (calls per question in parentheses). The body refers to a population by these names only.

Model	Vendor	Counterfactual ( $444$ )	Full obligation ( $661$ )	Coverage ( $307$ )	Cross-model ( $84$ )	Scoring
GPT-4.1 mini	OpenAI	ran	ran (the main study)	ran	ran	one call, temperature $0$ ; on the counterfactual set also five calls at the provider default (Table 29 )
Haiku 4.5	Anthropic	ran	ran	ran	ran	five calls, temperature $0$
Opus 5	Anthropic	ran	ran	ran	ran	five calls, provider default; one call on the expiry extension
GPT-5.6 Luna	OpenAI	ran	ran	ran	ran h	five calls, provider default; the cross-model set through the agent harness at reasoning effort low
GPT-5.6 Sol	OpenAI	ran	stopped at the budget	stopped at the budget	ran h	five calls; the cross-model set through the agent harness at reasoning effort low, the counterfactual set through the raw API
Kimi K3	Moonshot	not run	stopped at the budget	stopped at the budget	ran	five calls

Appendix

Table 6: Run coverage, model by question set, in the words of the run records. Two runs stopped at the budget on the full populations, so their complete rows are on the cross-model set; five models ran on the counterfactual set, and five ran its paraphrase set (Table 5 ): GPT-4.1 mini one call, Haiku 4.5 five, Opus 5 one, GPT-5.6 Luna and GPT-5.6 Sol five through the raw interface under the default summary only; the same five ran it again with the superseded-names list padded to

60

names, GPT-4.1 mini, Haiku 4.5, GPT-5.6 Luna and GPT-5.6 Sol at five calls and Opus 5 at one. h : elicited through the vendor’s agent harness rather than the raw API (Appendix A ).

Model	Judgment	$n$	Positive	Blind	Indexed	$\Delta$ ( $95\%$ CI)	Clustered CI
mini	FOK	$84$	$54$	$0.4488$	$0.7090$	$+0.2602$ —	$[+0.0913,+0.3912]$
mini	NOK	$84$	$40$	$0.5000^{\dagger}$	$0.7139$	— †	— †
GPT-5.6 Luna h	FOK	$84$	$54$	$0.5735$	$0.7417$	$+0.1682$ $[+0.0340,+0.3033]$	$[+0.0367,+0.3001]$
GPT-5.6 Luna h	NOK	$84$	$40$	$0.5585$	$0.8526$	$+0.2940$ $[+0.1696,+0.4172]$	$[+0.1984,+0.4051]$
GPT-5.6 Sol h	FOK	$84$	$54$	$0.7099$	$0.7463$	$+0.0364$ $[-0.0930,+0.1600]$	$[-0.1095,+0.1609]$
GPT-5.6 Sol h	NOK	$84$	$40$	$0.5290$	$0.8588$	$+0.3298$ $[+0.1994,+0.4470]$	$[+0.2117,+0.4500]$

Appendix

Table 7: The exact capability table records the cross-model set on FR-Bank with

n=84

; luna, sol, and the three new models use

k=5

, while mini is the original primary elicitation; h marks the rows elicited through the vendor’s agent harness (the paragraph above). It shows tight indexed FOK across all six models and tight indexed NOK across the five models whose blind NOK varies. The clustered column reports the persona-clustered sensitivity uniformly for the whole set; the item-level interval remains the preregistered primary endpoint.

Model	Judgment	$n$	Blind	Indexed	$\Delta$ ( $95\%$ CI)	Clustered CI
mini	NOK	$661$	$0.4946$	$0.7339$	—	—
mini	FOK	$307$	$0.4966$	$0.7003$	$+0.2037$ $[+0.0935,+0.3191]$	$[+0.1259,+0.2767]$
GPT-5.6 Luna	NOK	$661$	$0.4495$	$0.8182$	$+0.3687$ $[+0.2932,+0.4358]$	$[+0.2656,+0.4666]$
GPT-5.6 Luna	FOK	$307$	$0.5720$	$0.7605$	$+0.1885$ $[+0.0439,+0.3352]$	$[+0.0770,+0.3071]$
Opus 5	NOK	$661$	$0.6429$	$0.8327$	$+0.1898$ $[+0.1437,+0.2411]$	$[+0.1241,+0.2523]$
Opus 5	FOK	$307$	$0.6793$	$0.8099$	$+0.1306$ $[+0.0557,+0.2148]$	$[+0.0523,+0.2026]$

Appendix

Table 8: The full-population runs: blind and indexed FOK and NOK for every model that completed, with the paired gain and both intervals. The paired separation replicates on every completed run, and the spread of indexed NOK scores across models (

0.0988

) is again smaller than the spread of blind scores (

0.2279

). All five registered predictions held. The GPT-5.6 Sol and Kimi K3 runs were stopped by a budget directive before completion (

1{,}422

and

231

raw rows retained, disclosed, and not scored as sets). GPT-4.1 mini’s blind obligation condition spans two distinct values on this population, so its

0.4946

rests on a condition that is otherwise flat and its difference (

+0.2393

, intervals

[+0.1801,+0.2949]

and

[+0.1552,+0.3237]

, recorded in the text above) is not shown as a gain; on the

84

-item cross-model set of Table 7 the same condition is constant and scores

0.5000

exactly.

FOK by backend, GPT-4.1 mini
Backend	$n$ / pos.	Blind	Indexed (ground-truth; constrained on Mem0, A-MEM)	$\Delta$	item interval	persona interval
FR-Bank hard tier	$307$ / $35$	$0.50$	$0.70$	$+0.20$	$[+0.09,+0.32]$	$[+0.13,+0.28]$
Mem0	$238$ / $94$	$0.57$	$0.48$	$-0.10$	$[-0.17,-0.03]$	$[-0.16,-0.03]$
A-MEM	$284$ / $126$	$0.56$	$0.45$	$-0.11$	$[-0.17,-0.04]$	$[-0.17,-0.04]$
NOK by model, FR-Bank ; the name lookup scores $0.75$ (rounded from $0.7484$ ) on the same $661$ questions
Model	$n$ / pos.	Blind	Indexed (ground-truth summary)	$\Delta$	item interval	persona interval

Appendix

Table 9: Blind and indexed judgments with the paired gain and both intervals: coverage by backend for GPT-4.1 mini (positives non- absent ) and the obligation judgment on FR-Bank by model (positives pn ). On the hard tier every coverage positive is an obligation, so that FOK row scores the same positives as the NOK row.

Registered item	Observation	Population	Outcome
P1: luna blind NOK includes chance	$0.5585$ , CI $[0.4299,0.6869]$ includes $0.50$	cross-model set h , $n=84$	held
P2: blind FOK increases with scale	$0.5267<0.6745<0.8131$	stratified set h , $n=150$ per model	held
P3: indexed FOK gain decreases with scale	$+0.0364<+0.1682<+0.2602$	cross-model set h , $n=84$	held
P4: luna has a positive NOK gain	$+0.2940$ , CI $[+0.1696,+0.4172]$	cross-model set h , $n=84$	held
P5: Sol blind FOK remains below $0.75$	$0.8131>0.75$	stratified set h , $n=150$	failed
h Rows elicited through the vendor’s agent harness (Appendix A ).

Appendix

Table 10: Five capability items were registered before the cross-model run. The first four held, while the sol threshold failed, revising the earlier one-call account. The first, third, and fourth items are scored on the

84

-item cross-model set; the second and fifth on the original per-model populations, the shared

150

-item stratified set, with mini’s value from its recorded one-call main-study elicitation and luna’s and sol’s from the five-call average.

Item	Registered reading and observation	Outcome
XV-1	Registered: every new blind-NOK interval includes chance. Observed: Opus 5 is above, Haiku 4.5 below, and K3 includes chance	failed
XV-2	Positive indexed-minus-blind NOK delta with interval excluding zero on Opus 5 and K3	held
XV-3	Opus 5 blind FOK exceeds Haiku 4.5 blind FOK; cross-generation price/capability ordering	held
XV-4	Indexed FOK lies within the registered OpenAI-centered band on all three new models	held
XV-5	K3 blind NOK includes chance under its always-reasoning configuration	reports

Appendix

Table 11: Five items were registered for the three new models. The indexed separation and FOK band held, while the universal blind-NOK baseline failed in opposite directions.

Probe and population	$n$	PN	AUROC ( $95\%$ CI)	Reading
Supervised TF–IDF, cross-model set	$84$	$40$	$0.7972$ $[0.6949,0.8927]$	text carries label signal
Supervised TF–IDF, hard row (FOK target $\equiv$ PN) ‡	$307$	$35$	$0.9199$ $[0.8869,0.9472]$	text carries label signal
Zero-shot mini, cross-model set	$84$	$40$	$0.4804$ $[0.3587,0.5935]$	includes chance
Supervised TF–IDF, powered matched set	$162$	$35$	$0.8436$ $[0.7813,0.8990]$	not controlled for the question signal
Supervised TF–IDF, FOK target, pooled hard	$588$	$35$	$0.9662$ $[0.9510,0.9788]$	text carries coverage-label signal
‡ The hard tier contains no present items, so the FOK target (non- absent ) and the PN target are label-identical on this row; the registered coverage-target probe re-derives the same point estimate, and the recorded PN-probe interval is the one printed.

Appendix

Table 12: Question-only probes measure how much PN label signal is available without a store. Label-supervised term-frequency–inverse-document-frequency (TF–IDF) features expose generator-specific template signal rather than monitor cue use, whereas the zero-shot mini probe on the cross-model set remains at chance.

Model	Judgment	Blind ( $95\%$ CI)	Indexed	$\Delta$ ( $95\%$ CI)
Monitors
mini	NOK	$0.4774$ $[0.2991,0.6623]$	$0.6771$	$+0.2028$ $[-0.1121,+0.4984]$
Opus 5	NOK	$0.3993$ $[0.2008,0.6232]$	$0.6962$	$+0.2978$ $[+0.0752,+0.5292]$
Haiku 4.5	NOK	$0.4427$ $[0.2582,0.6522]$	$0.6562$	$+0.2208$ $[-0.0522,+0.4809]$
mini	FOK	$0.5788$	$0.8867$	$+0.3110$ $[+0.1133,+0.5222]$
Opus 5	FOK	$0.6675$	$1.0000$	$+0.3372$ $[+0.1399,+0.5709]$

Appendix

Table 13: The authorship-matched set (

n=36

;

12

pn ,

29

non- absent ; one generator voice for every label; label transfer

36/36

). Blind NOK includes chance on all three models. The paired NOK gain is positive on all three and excludes zero on Opus 5 only, the resolution an

n=36

set affords. FOK rows are descriptive; their blind intervals are not reported. The probe block is the recorded supervised probe of Table 12 , run unchanged on these same

36

questions.

Item-construction category	$n$	pn	$P(\textsc{pn}{})$	Classes
Stable identity	$21$	$0$	$0.000$	single
Expired logistics	$16$	$8$	$0.500$	both
Superseded preference	$14$	$13$	$0.929$	both ( $1$ negative)
Selective forgetting	$13$	$13$	$1.000$	single
Natural absence	$8$	$0$	$0.000$	single
Multi-version fact	$6$	$6$	$1.000$	single

Appendix

Table 14: Label structure by item-construction category on the cross-model set (

n=84

40

pn ). Ranking by category alone attains AUROC

0.9736

, above the supervised probe’s

0.7972

on the same set. This is a deterministic census on recorded labels (no model is fit and nothing is resampled), so no interval is defined, the same reporting convention as the one-bit is-FR-Bank rule in Appendix E.8 . Six of the eight categories carry a single class, and only expired logistics carries both at usable size.

Question: What is my current work style or preference?
summary line	version 1: present	version 2: pn	version 3: absent
lifecycle total, superseded	0	1	0
PREFERENCES_HABITS : entries, active, superseded	46, 46, 0	47, 46, 1	45, 45, 0
names carrying superseded content	(none)	work_preference	(none)
the name lookup’s score	$0.00$	$0.73$	$0.00$
the label	a current value, licensed	the old value must not be used	no such record

Appendix

Table 15: The supersession triple of the counterfactual set that Figure 2 leaves out: the question is fixed, the three store versions differ in one attribute, and only the summary lines that differ are shown, with the name lookup’s score under each. The obligation is named, and the lookup separates the versions.

Reader	whole	supersession	retraction	expiry	persona interval (whole)
Category-aware reader	$0.6043$	$0.5000$	$0.7306$	$0.7778$	$[0.5753,0.6389]$
State-aware reader	$0.8580$	$0.9006$	$0.8944$	$0.7778$	$[0.8150,0.8998]$
Totals reader	$0.5603$	$0.5028$	$0.6347$	$0.6922$	$[0.5452,0.5882]$
Category-guessing reader	$0.6623$	$0.6573$	$0.6669$	$0.6872$	$[0.6273,0.6991]$
Post hoc and privileged: the category-guessing reader’s share read at the manifest category
Category-given share reader	$0.8473$	$0.8981$	$0.7336$	$0.8528$	$[0.8071,0.8873]$

Appendix

Table 16: The count readers on the counterfactual set beside the models, under the superseded-only summary: AUROC on the whole set and per state, the persona interval of the whole-set AUROC, and each model minus the category-aware reader on the two counted states. The category-aware reader reads the retracted-plus-expired count at the question’s category, the state-aware reader the state’s own cell at that category, the totals reader the two lifecycle totals, and the category-guessing reader the share of superseded, retracted and expired entries at the category the question-only suite’s rule assigns. The last reader row reads that share at the manifest category: privileged, since the category is given, and added after the fact. The category-aware reader separates the versions on the counted states; every model is below it on both. Descriptive; computed after the fact on the recorded texts and rows.

Reader	row	sup. only	moved-count control	difference (item; persona)
GPT-4.1 mini ( $k=1$ )	whole set	$0.7167$	$0.7410$	$+0.0242$ $[-0.0047,+0.0523]$ ; $[-0.0032,+0.0530]$
GPT-4.1 mini	retraction ( $30$ pairs)	$0.5283$	$0.5553$	$+0.0269$ $[-0.0491,+0.1080]$ ; $[-0.0692,+0.1331]$
GPT-4.1 mini	expiry ( $30$ pairs)	$0.5489$	$0.6100$	$+0.0611$ $[-0.0404,+0.1641]$ ; $[-0.0217,+0.1417]$
Haiku 4.5 ( $k=5$ )	whole set	$0.7566$	$0.7525$	$-0.0041$ $[-0.0220,+0.0133]$ ; $[-0.0233,+0.0146]$
Haiku 4.5	retraction ( $30$ pairs)	$0.5433$	$0.5361$	$-0.0072$ $[-0.0925,+0.0781]$ ; $[-0.0981,+0.0795]$
Haiku 4.5	expiry ( $30$ pairs)	$0.5794$	$0.5342$	$-0.0453$ $[-0.0958,+0.0014]$ ; $[-0.0781,-0.0169]$

Appendix

Table 17: The moved-count control: each model under the moved text against its recorded superseded-only row, whole set and per state, with the paired difference and both intervals, beside the reference readers on the same text. Descriptive; no prediction was registered on the first three readers’ rows. Opus 5’s five-draw row was registered before its four added draws (Amendment 1), which predicted that the one-draw movement on retraction and expiry would replicate at five draws with both intervals excluding zero; it did. GPT-5.6 Luna and GPT-5.6 Sol ran at five draws under the second amendment, whose one prediction, that each falls reliably on both counted states, failed on retraction for both.

Reader	summary	AUROC	persona interval	minus intact	item interval	persona interval	retraction	expiry
Haiku 4.5	intact (recorded)	$0.7566$
	counts only	$0.5945$	$[0.5514,0.6460]$	$-0.1621$	$[-0.2187,-0.1024]$	$[-0.1941,-0.1278]$	$0.5553$	$0.5189$
	names only	$0.7507$	$[0.7114,0.7891]$	$-0.0059$	$[-0.0370,+0.0237]$	$[-0.0365,+0.0216]$	$0.5631$	$0.5642$
	counts only minus names only			$-0.1562$	$[-0.2175,-0.0889]$	$[-0.2007,-0.1126]$
GPT-4.1 mini	intact (recorded)	$0.7167$
	counts only	$0.5862$	$[0.5416,0.6322]$	$-0.1306$	$[-0.2025,-0.0524]$	$[-0.1835,-0.0801]$	$0.6053$	$0.4933$

Appendix

Table 18: Names against counts on the counterfactual set (E2; registered, ADDENDUM_CF2_NAMES_COUNTS). The superseded-only summary with every count line removed (names only), with the two name blocks removed (counts only), and, for GPT-4.1 mini, with every count replaced by a dash (the committed names-only rule of the pooled hard tier). The recorded intact row is the comparator, GPT-4.1 mini’s at one draw (the five-draw row of Table 1 is not used here); differences carry the item-level and the persona-grouped interval. Both readers stay within tolerance of the intact summary without the counts and fall reliably without the names (P-N1 and P-N2 held).

Reader	summary	AUROC	minus intact	item interval	persona interval	matched	ret.	exp.
GPT-5.6 Luna, draw 1	intact (recorded)	$0.8265$
	names only	$0.7534$	$-0.0732$ ∗	$[-0.1147,-0.0327]$	$[-0.1108,-0.0367]$	$0.7162$	$0.3667$	$0.4333$
	counts only	$0.6803$	$-0.1462$ ∗	$[-0.1997,-0.0877]$	$[-0.1884,-0.1009]$	$0.7297$	$0.5833$	$0.7500$
	counts minus names		$-0.0730$ ∗	$[-0.1440,-0.0010]$	$[-0.1274,-0.0170]$
GPT-5.6 Luna, five draws	intact (recorded)	$0.8417$
	names only	$0.7819$	$-0.0598$ ∗	$[-0.0967,-0.0270]$	$[-0.0965,-0.0295]$	$0.7939$	$0.5333$	$0.5167$

Appendix

Table 19: Names against counts on the three stronger models (E2, Amendment 1; registered, ADDENDUM_R125_E2_AMENDMENT_1). E2’s two renderings, byte-identical to Table 18 ’s, on Opus 5 (one draw, Batch), GPT-5.6 Luna (five draws through the raw API; its one-draw reading beside) and GPT-5.6 Sol (one draw; not run, see below): the pooled AUROC (its persona interval is in the ledger), the paired difference from the recorded intact row with both intervals ( ∗ both exclude zero), counts only minus names only, and the renderings under the matched metric, the whole set and the two counted states (ret., exp.; their persona intervals are in the ledger, P-N5’s two failing lower bounds below). Three predictions: P-N3, names only within tolerance of the intact row at the point, failed (on the models run) (GPT-5.6 Luna

-0.0598

; Opus 5

-0.0426

, within the band); P-N4, counts only reliably below names only, held (on the models run); P-N5, counts only above

0.50

on both counted states under the matched metric with the persona interval excluding

0.50

, failed (on the models run) (Opus 5 reads

0.4833

on retraction; GPT-5.6 Luna’s expiry lower bound is

0.4615

). GPT-5.6 Sol’s lane was dropped by the registration’s own rule when the vendor’s projection for this task and the sibling-name control together exceeded the cap, so its rows print as not run.

Reader, summary	scope	PN vs PRESENT	persona interval	pooled	W/T/L	strict-win	persona interval
GPT-4.1 mini, sup. only	whole	$0.7056$	$[0.6555,0.7575]$	$0.7167$	$81/57/10$	$0.5473$	$[0.4625,0.6334]$
	sup.	$0.8265$	$[0.7607,0.8931]$	$0.8308$	$68/19/1$	$0.7727$	$[0.6781,0.8734]$
	ret.	$0.5044$	$[0.4165,0.5975]$	$0.5283$	$9/15/6$	$0.3000$	$[0.1665,0.4516]$
	exp.	$0.5250$	$[0.4280,0.6450]$	$0.5489$	$4/23/3$	$0.1333$	$[0.0000,0.3333]$
GPT-4.1 mini, all three	whole	$0.7840$	$[0.7240,0.8407]$	$0.7967$	$105/32/11$	$0.7095$	$[0.6063,0.7961]$
	sup.	$0.8428$	$[0.7664,0.9130]$	$0.8444$	$71/12/5$	$0.8068$	$[0.7096,0.9000]$

Appendix

Table 20: PN-versus-PRESENT discrimination and within-triple ordering on the counterfactual set, per reader, summary and state (post hoc, specified before recomputation). PN vs PRESENT is the AUROC of the PN versions against the PRESENT versions alone (the ABSENT versions excluded), with the persona-grouped interval; the pooled AUROC of Table 1 is the mean of this column and the PN-vs-ABSENT AUROC, which the artifact’s ledger carries beside the Wilson intervals. W/T/L counts the triples in which the reader scores the PN version above, equal to, or below the PRESENT version; the strict-win fraction counts ties as failures, is not a tie-adjusted ranking accuracy, and its chance reference is not

0.50

when ties occur. A reader that only knows whether the store covers the question scores

0.75

pooled and

0.50

PN vs PRESENT (every triple a tie).

Reader	pooled	state-balanced	W/T/L	matched	triple interval	persona interval	matched sup. / ret. / exp.	vs absent
The default summary (superseded content named)
Name lookup	$0.7663$	$0.6408$	$82/66/0$	$0.7770$	$[0.7365,0.8176]$	$[0.7346,0.8188]$	$0.9659$ / $0.5000$ / $0.5000$	$0.7770$
GPT-4.1 mini, one draw	$0.7167$	$0.6360$	$81/57/10$	$0.7399$	$[0.6858,0.7872]$	$[0.6916,0.7911]$	$0.8807$ / $0.5500$ / $0.5167$	$0.7399$
GPT-4.1 mini, five draws	$0.7648$	$0.6716$	$100/15/33$	$0.7264$	$[0.6520,0.7973]$	$[0.6646,0.7871]$	$0.8920$ / $0.5667$ / $0.4000$	$0.8514$
Haiku 4.5	$0.7566$	$0.6701$	$89/52/7$	$0.7770$	$[0.7264,0.8243]$	$[0.7175,0.8321]$	$0.9148$ / $0.5667$ / $0.5833$	$0.8176$
GPT-5.6 Luna	$0.8417$	$0.7017$	$129/2/17$	$0.8784$	$[0.8209,0.9291]$	$[0.8134,0.9363]$	$0.9602$ / $0.6500$ / $0.8667$	$0.8176$

Appendix

Table 21: Every reader of Table 1 under both metrics (post hoc; the matched metric was defined after the pooled rows were known). Pooled: the recorded AUROC over the

444

items, and the mean of the three per-state pooled values (state-balanced). Matched: W/T/L counts the triples in which the reader scores the pn version above, equal to, or below the present version (ties exact equality of the collapsed scores), and the matched AUROC is

(W+T/2)/148

, with the triple-level and the persona-grouped bootstrap interval (

1{,}000

draws) and the per-state values over each state’s own triples (

88

30

30

); the last column is the same comparison against the absent version. The lookups and the count readers never lose a triple, so their matched values are half their tie counts plus their wins; GPT-4.1 mini’s five-draw row loses

33

triples where its one-draw row loses

10

, so it sits lower on this metric and higher on the pooled one.

The default summary
Reader	pooled	within a triple ( $296$ )	same state, across questions ( $18,792$ )	across states ( $24,720$ )
Name lookup	$0.7663$	$0.7770$	$0.8437$	$0.7074$
GPT-4.1 mini, one draw	$0.7167$	$0.7399$	$0.7763$	$0.6712$
GPT-4.1 mini, five draws	$0.7648$	$0.7889$	$0.8211$	$0.7217$
Haiku 4.5	$0.7566$	$0.7973$	$0.8265$	$0.7029$
GPT-5.6 Luna	$0.8417$	$0.8480$	$0.8749$	$0.8165$

Appendix

Table 22: The pooled AUROC decomposed by pair class (post hoc). Of the

43,808

positive-negative pairs the pooled AUROC averages over,

296

are within a triple,

18,792

pair a positive with a negative of the same state from another question, and

24,720

cross states; the pooled value is the pair-count-weighted mean of the three class AUROCs (asserted for every reader). The within-triple class is the matched metric’s two comparisons pooled. Readers as in Table 21 .

Reader minus its lookup, whole set	difference	triple interval	persona interval	retraction	expiry
GPT-4.1 mini, one draw	$-0.0372$	$[-0.0811,+0.0068]$	$[-0.0877,+0.0146]$	$+0.0500$	$+0.0167$
GPT-4.1 mini, five draws	$-0.0507$	$[-0.1115,+0.0101]$	$[-0.1069,+0.0000]$	$+0.0667$	$-0.1000$
Haiku 4.5	$+0.0000$	$[-0.0439,+0.0372]$	$[-0.0528,+0.0483]$	$+0.0667$	$+0.0833$
GPT-5.6 Luna	$+0.1014$ ∗	$[+0.0473,+0.1554]$	$[+0.0442,+0.1533]$	$+0.1500$	$+0.3667$
GPT-5.6 Sol	$+0.0811$ ∗	$[+0.0270,+0.1351]$	$[+0.0283,+0.1319]$	$+0.0833$	$+0.3333$
Opus 5	$+0.0980$ ∗	$[+0.0472,+0.1454]$	$[+0.0435,+0.1503]$	$+0.2667$	$+0.1833$

Appendix

Table 23: Paired differences under the matched metric (post hoc): the mean over triples of the two readers’ per-triple outcomes (a win

1

, a tie

\tfrac{1}{2}

, a loss

0

), with the triple-level and the persona-grouped interval; ∗ marks a difference with both intervals clear of zero. First panel: each reader minus its summary’s lookup on the whole set, with the point differences on the two counted states (the lookup ties every counted-state triple under the default summary); second panel: the same on supersession. Under the all-states summary Opus 5’s lead over its lookup is not reliable at five draws and is at its first draw alone. Third and fourth panels: each reader minus the guessed-category and the given-category count reader on the counted states; a difference of

-0.5000

against the given-category reader means that reader won every triple the other tied.

Reader, summary	W/T/L	matched	supersession	retraction	expiry
GPT-4.1 mini, names only	$75/69/4$	$0.7399$	$0.8864$	$0.5500$	$0.5000$
GPT-4.1 mini, names only, dash rule	$69/66/13$	$0.6892$	$0.8523$	$0.4500$	$0.4500$
GPT-4.1 mini, counts only	$48/83/17$	$0.6047$	$0.6534$	$0.6167$	$0.4500$
Haiku 4.5, names only	$85/59/4$	$0.7736$	$0.9318$	$0.5167$	$0.5667$
Haiku 4.5, counts only	$61/66/21$	$0.6351$	$0.7159$	$0.5833$	$0.4500$
GPT-4.1 mini, totals randomized	$78/50/20$	$0.6959$	$0.8750$	$0.4000$	$0.4667$

Appendix

Table 24: The ablations under the matched metric (post hoc). Upper panel: the names-only, counts-only, totals-randomized and moved-count rows, W/T/L against the present version and the matched AUROC, whole set and per state (Tables 18 and 17 carry the pooled rows). Middle panels: the paired contrasts, one row per scope, with both intervals, ∗ where both exclude zero; the counted states are the

60

retraction and expiry triples. Names alone leave both smaller models where the intact summary left them and counts alone cost each about

0.14

, all of it on supersession; the moved count moves the three stronger models reliably on the counted states and neither smaller model. Lower panel: Opus 5 under the all-states summary minus the all-states lookup, five draws and its first draw alone.

Panel of Figure 4 — Figure 4: The pooled version of Figure 3 : per-state pooled obligation AUROC on the counterfactual set, each state’s positives against all of its items’ negatives, under the summary naming supersession only (left) and the summary naming all states (right); the dashed line is chance. Mini uses five draws, matching Table 1 ; the count reader guesses the category; Luna and Sol have rows under the default summary only. Every value is in Table 21 .

Store version	empty lists	mean length	length: pairs
pn	$0$	$2.6250$	1: 23, 2: 17, 3: 25, 4: 17, 5: 5, 6: 1
present	$24$	$1.5341$	0: 24, 1: 16, 2: 31, 3: 12, 4: 4, 5: 1
absent	$24$	$1.5341$	0: 24, 1: 16, 2: 31, 3: 12, 4: 4, 5: 1

Appendix

Table 25: How much of the lookup is list length and emptiness (post hoc). Upper panel: the superseded-names list of the

88

supersession pairs per store version under the default summary, the count of empty lists, the mean length and the length distribution; the pn version’s list is longer than the present version’s by one name on

81

pairs, two on

6

and three on

1

, and on the

24

pairs whose present list is empty emptiness alone identifies the pn version. Middle panel: the random-token control (every name replaced by a random token, the list’s length and emptiness kept) on the counterfactual set under both summaries, pooled and matched, and on the full obligation set (no triples, so no matched row; each state’s positives against all

557

negatives). Lower panel: the name lookup minus the random-token control, pooled with the item-level and persona-grouped intervals and matched with the triple-level and persona-grouped intervals ( ∗ both exclude zero). Under the default summary

0.60

of the lookup’s

0.77

pooled and

0.65

of its

0.78

matched is reachable with no name meaning anything; the sibling-name control (Table 36 ) removes that component.

Reader	pop.	rubric	same-store AUROC	persona interval	pair interval	W/T/L
GPT-4.1 mini ( $k=1$ )	A	main-study	$0.3973$	$[0.3447,0.4455]$	$[0.3460,0.4426]$	16/26/45
	A	intent-explicit	$0.4789$	$[0.4169,0.5413]$	$[0.4261,0.5279]$	22/34/31
	B	main-study	$0.3388$	$[0.2385,0.4297]$	$[0.2411,0.4157]$	0/13/13
	B	intent-explicit	$0.4238$	$[0.3264,0.5236]$	$[0.3262,0.5297]$	7/5/14
Haiku 4.5 ( $k=5$ )	A	main-study	$0.3765$	$[0.3183,0.4257]$	$[0.3239,0.4203]$	18/16/53
draw 1 only	A	main-study	$0.3872$	$[0.3302,0.4367]$	$[0.3350,0.4318]$	16/22/49

Appendix

Table 26: The intent crossover on the counterfactual set (registered; ADDENDUM_CF2_INTENT_CROSSOVER and its Amendment 1). Each supersession pair of the set is asked its recorded present-tense question and a second question about how the attribute has changed, of the same two store versions ( pn and present ) under the default summary (population A,

87

of the

88

pairs); each expiry pair is asked its recorded upcoming-intent question and a question about the past event under the all-states summary (population B,

26

of the

30

pairs); our read of the crossed questions dropped five pairs before any call. The crossed question makes the same stale record licensed, so a reader that conditions on intent scores the pn version of the original question above the same version under the crossed question. This table: that same-store AUROC, chance

0.50

, with the persona-grouped and the pair-clustered interval and the within-pair W/T/L. Table 27 : the interaction, the mean of the two-by-two contrast, with both intervals, and the pooled AUROC of the original question’s pn version against the other three cells. Each reader ran under the main-study rubric and under a rubric that states the intent rule. GPT-5.6 Luna and Haiku 4.5 ran five draws; their draw-1 rows are the column comparable with the one-draw readers, and the body reads that column. GPT-5.6 Sol was added after an interim read of three models’ rows, and its prediction is labelled so in Appendix F ; under the intent-explicit rubric it counts

76/0/11

within pairs on population A, and in

9

of its

11

losses both questions score

0.96

or higher, so the rule was not applied on those pairs. Under the intent-explicit rubric no model’s discrimination on its original questions falls by more than

0.05

(the largest fall

-0.0458

, Haiku 4.5 on population A; the largest rise

+0.1716

, GPT-4.1 mini on population B).

Reader	pop.	rubric	interaction	persona interval	pair interval	pooled AUROC
GPT-4.1 mini ( $k=1$ )	A	main-study	$-0.0695$	$[-0.1149,-0.0268]$	$[-0.1161,-0.0276]$	$0.6821$
	A	intent-explicit	$-0.0259$	$[-0.0899,+0.0300]$	$[-0.0822,+0.0242]$	$0.7275$
	B	main-study	$-0.1058$	$[-0.1655,-0.0444]$	$[-0.1731,-0.0365]$	$0.4497$
	B	intent-explicit	$-0.0538$	$[-0.1340,+0.0310]$	$[-0.1635,+0.0520]$	$0.6146$
Haiku 4.5 ( $k=5$ )	A	main-study	$-0.0218$	$[-0.0683,+0.0204]$	$[-0.0609,+0.0160]$	$0.7035$
draw 1 only	A	main-study	$-0.0195$	$[-0.0634,+0.0223]$	$[-0.0609,+0.0209]$	$0.7028$

Appendix

Table 27: The intent crossover, continued from Table 26 : the interaction, the mean of the two-by-two contrast (the original question’s pn version minus its present version, minus the same difference under the crossed question), with the persona-grouped and the pair-clustered interval, and the pooled AUROC of the original question’s pn version against the other three cells, with the same readers, populations and rubrics.

Reader	row	whole set	persona interval	minus the lookup	item interval	persona interval
GPT-5.6 Luna ( $k=5$ )	main-study (recorded)	$0.8417$	$[0.7999,0.8835]$	$+0.0754$	$[+0.0339,+0.1216]$	$[+0.0450,+0.1090]$
	intent-explicit	$0.8531$	$[0.8108,0.8950]$	$+0.0867$	$[+0.0447,+0.1302]$	$[+0.0562,+0.1219]$
	intent-explicit minus main-study	$+0.0113$			$[-0.0052,+0.0277]$	$[-0.0010,+0.0227]$
GPT-4.1 mini ( $k=1$ )	main-study (recorded)	$0.7167$	$[0.6663,0.7649]$	$-0.0496$	$[-0.1012,+0.0013]$	$[-0.0933,-0.0054]$
	intent-explicit	$0.7253$	$[0.6738,0.7731]$	$-0.0411$	$[-0.0878,+0.0034]$	$[-0.0817,-0.0036]$
	intent-explicit minus main-study	$+0.0085$			$[-0.0260,+0.0430]$	$[-0.0290,+0.0417]$

Appendix

Table 28: The counterfactual set under the intent-explicit rubric (registered; ADDENDUM_R122_CF2_P1): GPT-5.6 Luna at five draws and GPT-4.1 mini at one, each against its recorded row under the main-study rubric. Upper panel: whole set with the persona interval, and the margin over the name lookup with both intervals. Lower panel: the per-state values and the post hoc columns. Predicted before the run: each reader within

0.05

of its recorded row (both readers, as predicted), the same per-state order (GPT-5.6 Luna as predicted; GPT-4.1 mini’s two counted states swap, neither move reliable, a failed prediction), and Luna’s margin over the lookup reliable (as predicted).

Reader	row	whole set	persona interval	minus the lookup	item interval	persona interval
default (superseded-only)	one draw, temperature $0$ (recorded)	$0.7167$	$[0.6663,0.7649]$	$-0.0496$	$[-0.1012,+0.0013]$	$[-0.0933,-0.0054]$
	five draws, provider default	$0.7648$	$[0.7218,0.8047]$	$-0.0016$	$[-0.0426,+0.0393]$	$[-0.0415,+0.0328]$
	five minus one	$+0.0481$			$[+0.0119,+0.0857]$	$[+0.0171,+0.0827]$
all-states	one draw, temperature $0$ (recorded)	$0.7967$	$[0.7438,0.8478]$	$-0.0789$	$[-0.1229,-0.0344]$	$[-0.1283,-0.0334]$
	five draws, provider default	$0.8323$	$[0.7889,0.8725]$	$-0.0433$	$[-0.0879,-0.0035]$	$[-0.0838,-0.0042]$
	five minus one	$+0.0356$			$[+0.0094,+0.0619]$	$[+0.0092,+0.0688]$

Appendix

Table 29: GPT-4.1 mini at five draws on the counterfactual set (registered; ADDENDUM_R122_MINI_K5), under the default and the all-states summary, beside its recorded one-draw rows at temperature

0

. Upper panel: whole set with the persona interval, and the margin over the same summary’s lookup with both intervals. Lower panel: per state, and the post hoc columns. The five-draw run used the provider’s default temperature, so two things changed between the rows. Predicted before the run: the five-draw row within

0.05

of the one-draw row and fewer tied triples, under both summaries (as predicted). Table 1 prints the five-draw rows; the names-against-counts comparison of Table 18 keeps the one-draw row as its comparator.

Model	whole set	supersession	minus the lookup	item interval	persona interval	both exclude zero
GPT-4.1 mini, one draw (recorded)	$0.7167$	$0.8308$	$-0.0915$	$[-0.1399,-0.0478]$	$[-0.1436,-0.0425]$	yes
GPT-4.1 mini, five draws (provider default)	$0.7648$	$0.8793$	$-0.0429$	$[-0.0898,+0.0006]$	$[-0.1001,+0.0035]$	no
Haiku 4.5 (five draws)	$0.7566$	$0.8876$	$-0.0347$	$[-0.0813,+0.0086]$	$[-0.0809,+0.0066]$	no
Opus 5 (five draws)	$0.8405$	$0.9325$	$+0.0102$	$[-0.0183,+0.0392]$	$[-0.0259,+0.0432]$	no
GPT-5.6 Sol (five draws)	$0.8500$	$0.9383$	$+0.0161$	$[-0.0130,+0.0473]$	$[-0.0202,+0.0478]$	no
GPT-5.6 Luna (five draws)	$0.8417$	$0.9426$	$+0.0204$	$[-0.0053,+0.0473]$	$[-0.0056,+0.0451]$	no

Appendix

Table 30: Each model’s supersession-only margin over the name lookup on the counterfactual set under the default summary (

88

pairs,

264

items; the lookup reads

0.9223

there): the model’s whole-set and supersession AUROC, the paired difference from the lookup with the item-level and the persona-grouped interval, and whether both intervals exclude zero. Descriptive; computed on the recorded rows after the fact. At one draw GPT-4.1 mini is reliably below the lookup; at five draws its interval includes zero; no model is reliably above it.

Whole set, $n=444$ ; blind $0.5000$ by construction; gain is AUROC less $0.5000$
Reader, summary	AUROC	item interval	persona interval	first draw	first-draw gain
GPT-4.1 mini, sup. only	$0.7167$	$[+0.1494,+0.2846]$	$[+0.1663,+0.2649]$	$0.5939$	$+0.0939$
GPT-4.1 mini, all three	$0.7967$	$[+0.2314,+0.3568]$	$[+0.2438,+0.3478]$	$0.6419$	$+0.1419$
GPT-4.1 mini, totals rand.	$0.7179$	$[+0.1479,+0.2857]$	$[+0.1691,+0.2638]$	—
Haiku 4.5, sup. only	$0.7566$	$[+0.1942,+0.3189]$	$[+0.2102,+0.3035]$	$0.6406$	$+0.1406$
Haiku 4.5, all three	$0.8773$	$[+0.3174,+0.4395]$	$[+0.3362,+0.4124]$	$0.7656$	$+0.2656$

Appendix

Table 31: The store-counterfactual set:

148

questions, each asked of three versions of one store differing in a single attribute, so

n=444

with

148

positives (

88

supersession,

30

retraction,

30

expiry). The question is fixed and the store varies, so a question-only reader scores

0.5000

by construction and every gain is measured against that. Three summaries: naming superseded content only, naming all three non-active states, and the first with its two lifecycle totals, retracted and expired, permuted across store versions (the per-category counts untouched). Intervals are the item-level paired bootstrap and the bootstrap with questions grouped by persona, both at

95\%

; a prediction holds only when both agree; the first form’s gains are against the same

0.5000

. The first form of the set (

30

questions,

n=90

) is reported beside the new values as a first-form column or row; it had no totals-randomized summary and its counted-state block used the

45

items whose attribute name identified the pair, a predicate the new draw applies before any pair is drawn. A dash marks an entry the design does not define: a lookup reads one summary and has no paired interval, and the first form has no totals-randomized value. Adverse rows are stated in the text above.

Model	Summary	AUROC	persona interval	mean, present	mean, absent	mean, pn
GPT-4.1 mini	sup. only	$0.6357$	$[0.5972,0.6770]$	$0.4517$	$0.3530$	$0.4966$
GPT-4.1 mini	all three	$0.6436$	$[0.6120,0.6802]$	$0.4926$	$0.3875$	$0.5439$
GPT-4.1 mini	totals rand.	$0.6371$	$[0.6071,0.6709]$	$0.4551$	$0.3503$	$0.4882$
Haiku 4.5	sup. only	$0.6168$	$[0.5828,0.6537]$	$0.5130$	$0.4178$	$0.5263$
Haiku 4.5	all three	$0.6133$	$[0.5816,0.6522]$	$0.5055$	$0.4163$	$0.5180$
Haiku 4.5	totals rand.	$0.6050$	$[0.5713,0.6416]$	$0.5072$	$0.4231$	$0.5180$

Appendix

Table 32: Coverage AUROC on the counterfactual set (

n=444

; positives the present and pn versions,

296

) from the recorded coverage scores, by model and summary, with the interval grouped by persona and the mean score by store version. Blind coverage is

0.5000

by construction, so the gain is the AUROC minus

0.5000

. Descriptive; no prediction was registered on these rows.

Model minus the lexical lookup on the same summary (paired bootstrap): difference, item interval, persona interval
Lookup, summary	whole set	supersession	retraction	expiry
Lexical, sup. only	$0.6698$	$0.7829$	$0.5000$	$0.5000$
Lexical, all three	$0.8085$	$0.7829$	$0.8617$	$0.8244$
Embedding, sup. only	$0.7663$	$0.9223$	$0.5000$	$0.5000$
Embedding, all three	$0.8756$	$0.8995$	$0.7975$	$0.8711$
GPT-4.1 mini, sup. only	$+0.0469$	$[+0.0037,+0.0925]$	$[+0.0037,+0.0895]$

Appendix

Table 33: The lexical lookup on the counterfactual set beside the embedding lookup, whole set and by state, and each model minus the lexical lookup on the same summary with both intervals. The lexical reader trails the embedding reader on every row. Exploratory, computed after the fact on the recorded rows.

Encoder	population, summary	AUROC	persona interval	minus MiniLM	item interval	persona interval
all-MiniLM-L6-v2 (recorded)	$444$ , default	$0.7663$	$[0.7226,0.8051]$	–	–	–
	$444$ , all-states	$0.8756$	$[0.8391,0.9111]$	–	–	–
	$661$ , committed	$0.7484$	$[0.6636,0.8298]$	–	–	–
	$661$ , marker-free	$0.7442$	$[0.6513,0.8336]$	–	–	–
all-mpnet-base-v2	$444$ , default	$0.7605$	$[0.7140,0.8024]$	$-0.0059$	$[-0.0240,+0.0126]$	$[-0.0224,+0.0093]$
	$444$ , all-states	$0.8646$	$[0.8296,0.9018]$	$-0.0110$	$[-0.0296,+0.0063]$	$[-0.0257,+0.0034]$

Appendix

Table 34: The name lookup under two further sentence encoders, and the random-token control (registered; ADDENDUM_R122_ENCODERS): the same lookup code with the encoder swapped, on the counterfactual set under the default and the all-states summary and on the full obligation set, AUROC with the persona interval where recorded and the difference from the recorded all-MiniLM-L6-v2 lookup with both intervals. The full-obligation-set rows as committed read the summaries where an empty section’s (none) marker is encoded as a name; the marker-free rows drop the marker and are the fair cross-encoder comparison there. The control replaces every name by a random token, so what it scores comes from the list’s length and from whether it is empty. Predicted before the run: both encoders within

0.05

of MiniLM on the counterfactual set under the default summary (as predicted).

Scope	hybrid	persona interval	minus the lookup	item interval	persona interval
whole set	$0.7865$	$[0.7488,0.8234]$	$+0.0201$	$[-0.0016,+0.0410]$	$[+0.0039,+0.0409]$
supersession	$0.9070$	–	$-0.0153$	$[-0.0293,-0.0029]$	$[-0.0306,-0.0018]$
retraction	$0.5889$	–	$+0.0889$	$[+0.0120,+0.1673]$	$[+0.0477,+0.1483]$
expiry	$0.5942$	–	$+0.0942$	$[+0.0165,+0.1717]$	$[+0.0517,+0.1635]$
whole set, minus the category-guessing reader			$+0.1242$	$[+0.0668,+0.1816]$	$[+0.0825,+0.1656]$

Appendix

Table 35: A hybrid reader with no generative-model call on the counterfactual set (registered; ADDENDUM_CF2_HYBRID_READER): a logistic regression of the label on the name lookup’s cosine, the category-guessing reader’s share and an indicator that a category was assigned, fitted under leave-persona-out over the

40

personas and scored out of fold, under the superseded-only summary. Upper panel: whole set and per state with the persona interval, and the paired differences against the name lookup and the category-guessing reader with both intervals. Lower panels: each model’s recorded row minus the hybrid, and GPT-4.1 mini’s five-draw row (Table 1 ) beside its one-draw row; then the same reader under the matched metric (post hoc), whole set and per state, minus the lookup and against each model. Predicted before the run: that the hybrid exceeds the name lookup reliably (it does not: the item-level interval includes zero, a failed prediction) and that GPT-5.6 Sol stays reliably above it (as predicted). The fitted coefficients on the standardized features range over the folds from

+1.13

+1.29

on the lookup and

+0.39

+0.53

on the share.

Reader	W/T/L	pn vs sibling	triple interval	persona interval	pn vs present	sibling vs present
Name lookup	$82/3/3$	$0.9489$	$[0.9034,0.9830]$	$[0.9070,0.9831]$	$0.9659$	$0.7557$
GPT-4.1 mini (five draws)	$78/3/7$	$0.9034$	$[0.8409,0.9602]$	$[0.8409,0.9551]$	$0.8920$	$0.6932$
Haiku 4.5 (five draws)	$73/9/6$	$0.8807$	$[0.8182,0.9375]$	$[0.8274,0.9318]$	$0.9148$	$0.7045$
GPT-5.6 Luna (five draws)	$80/1/7$	$0.9148$	$[0.8523,0.9659]$	$[0.8351,0.9767]$	$0.9602$	$0.6989$
GPT-5.6 Sol (draw 1)	$78/5/5$	$0.9148$	$[0.8636,0.9602]$	$[0.8681,0.9620]$	$0.9489$	$0.6080$
Opus 5 (draw 1)	$85/1/2$	$0.9716$	$[0.9375,1.0000]$	$[0.9387,1.0000]$	$0.9716$	$0.5284$

Appendix

Table 36: The sibling-name control (registered; ADDENDUM_R125_SIBLING): a fourth version of each of the

88

supersession pairs, rendered from the pn version’s text with the target’s name in the superseded-names list replaced by a same-category sibling under HV-B’s pool and neighbourhood rule (no content token shared with the question or the target;

88

88

pairs kept; the leak screen

0

30

), so counts, list length and every other line are identical to the pn version’s. Upper panel: W/T/L and the matched AUROC of the pn version against the sibling version with both intervals; the pn -against- present value on the same pairs; and the sibling version against the present version (how far an unrelated name in the list raises the score, the list-length component; descriptive). Lower panels: the sibling-minus- present mean score with both intervals, and each reader minus the name lookup on the primary comparison, ∗ where both intervals exclude zero. Four predictions, all as written: P-SB1, the lookup at or above

0.90

(

0.9489

); P-SB2, every model at or above

0.80

with the persona interval above

0.50

(lower bounds

0.8409

0.8351

0.8681

0.8274

0.9387

); P-SB3, the random-token lookup and the count reader within

0.05

0.50

(

0.4716

0.5000

); P-SB4, no model reliably above the lookup. Disclosure: the scorer was dry-run once before the freeze to check its code path and computed the three no-model readers on the sibling texts, so P-SB1 and P-SB3 are recorded values rather than predictions and are not counted in Appendix F ; no model row existed at the dry run. GPT-4.1 mini, Haiku 4.5 and GPT-5.6 Luna are five-draw means as in Table 1 ; Opus 5 and GPT-5.6 Sol one draw.

Reader	list	AUROC	$\Delta$ vs recorded	item interval	persona interval
Padding with correct names, the $661$ questions, ground-truth summary
Name lookup	$1.75$ names	$0.7484$	–	–	–
Name lookup	$15$ names	$0.7298$	$-0.0186$	$[-0.0777,+0.0400]$	$[-0.0917,+0.0522]$
Name lookup	$30$ names	$0.7191$	$-0.0293$	$[-0.0968,+0.0392]$	$[-0.1156,+0.0525]$
Name lookup	$60$ names	$0.6696$	$-0.0788$	$[-0.1541,-0.0096]$	$[-0.1794,+0.0284]$
Name lookup	$100$ names	$0.6558$	$-0.0926$	$[-0.1718,-0.0221]$	$[-0.1953,+0.0199]$

Appendix

Table 37: The list-length check and its amendment. Upper block: the superseded-names list of each of the

661

main-study summaries padded with correct attribute names that no scored question of the persona targets, to

15

30

and

60

names, and for the two lookups to

100

and

200

names under the registered draw order, which continues into other personas’ names once the store’s own pool is exhausted (

79

of the

242

summaries at

100

, every summary at

200

); obligation AUROC of each reader against its recorded

1.75

-name row, with the paired difference and both intervals. Lower block: the counterfactual set’s

444

superseded-only summaries with wrong names injected into the negatives’ lists at FR-Bank’s measured rate (

0.232

) and at

0.40

; AUROC against the recorded list, the paired difference and both intervals, and for the models the difference from the embedding lookup on the same lists (the weaker of the two intervals). Descriptive; no prediction was registered, and every branch prints as it came out.

Reader	States	original	paraphrase	difference	item interval	persona interval	reading	per state, paraphrase
Name lookup	superseded	$0.7921$	$0.7705$	$-0.0216$	$[-0.0463,+0.0010]$	$[-0.0476,+0.0055]$	holds	$0.8937$ / $0.5000$ / $0.5000$
Lexical lookup	superseded	$0.6860$	$0.5000$	$-0.1860$ ∗	$[-0.2327,-0.1374]$	$[-0.2355,-0.1343]$	collapses	$0.5000$ / $0.5000$ / $0.5000$
Name lookup	all	$0.8785$	$0.8227$	$-0.0559$ ∗	$[-0.0908,-0.0196]$	$[-0.0896,-0.0194]$	collapses	$0.8553$ / $0.6548$ / $0.8264$
Lexical lookup	all	$0.8053$	$0.5000$	$-0.3053$ ∗	$[-0.3505,-0.2623]$	$[-0.3492,-0.2570]$	collapses	$0.5000$ / $0.5000$ / $0.5000$
GPT-4.1 mini	superseded	$0.7127$	$0.6801$	$-0.0326$	$[-0.0879,+0.0181]$	$[-0.0816,+0.0116]$	holds	$0.7742$ / $0.4896$ / $0.5207$
GPT-4.1 mini	all	$0.7957$	$0.7186$	$-0.0771$ ∗	$[-0.1363,-0.0170]$	$[-0.1259,-0.0307]$	collapses	$0.7684$ / $0.7154$ / $0.6043$

Appendix

Table 38: The paraphrase check on the

115

accepted pairs (

345

items,

115

obligations; registered, descriptive): obligation AUROC on the original questions and on the paraphrases under the same store versions, the paired difference paraphrase minus original with the item-level and the persona-clustered interval, the registered reading at the

\pm 0.05

tolerance (a reader holds inside it and collapses below

-0.05

with both intervals clear of zero), and the paraphrase-set AUROC per state (superseded / retracted / expired). ∗ : both intervals exclude zero. The lexical lookup reads

0.5000

on every paraphrase set by construction: no content token is shared with any printed name.

Reader	States	original W/T/L	matched	paraphrase W/T/L	matched	difference	triple interval	persona interval
Name lookup	superseded	$72/43/0$	$0.8130$	$69/43/3$	$0.7870$	$-0.0261$	$[-0.0522,-0.0043]$	$[-0.0636,+0.0000]$
Lexical lookup	superseded	$43/72/0$	$0.6870$	$0/115/0$	$0.5000$	$-0.1870$ ∗	$[-0.2261,-0.1435]$	$[-0.2328,-0.1381]$
Name lookup	all	$98/15/2$	$0.9174$	$93/21/1$	$0.9000$	$-0.0174$	$[-0.0522,+0.0217]$	$[-0.0572,+0.0192]$
Lexical lookup	all	$69/46/0$	$0.8000$	$0/115/0$	$0.5000$	$-0.3000$ ∗	$[-0.3435,-0.2564]$	$[-0.3440,-0.2521]$
GPT-4.1 mini	superseded	$63/46/6$	$0.7478$	$50/58/7$	$0.6870$	$-0.0609$ ∗	$[-0.1174,-0.0087]$	$[-0.1191,-0.0039]$
GPT-4.1 mini	all	$80/25/10$	$0.8043$	$69/36/10$	$0.7565$	$-0.0478$	$[-0.1174,+0.0217]$	$[-0.1355,+0.0345]$

Appendix

Table 39: The same

115

pairs under the matched metric (post hoc): within each triple the pn version against the present version, W/T/L and

(W+T/2)/115

, on the original questions and on the paraphrases, with the paired difference (the mean over triples of the per-triple outcome difference) and the triple-level and persona-grouped intervals. ∗ : both intervals exclude zero.

Model	States	paraphrases	item	persona	originals	item	persona
GPT-4.1 mini	superseded	$-0.0904$ ∗	$[-0.1453,-0.0352]$	$[-0.1517,-0.0337]$	$-0.0794$ ∗	$[-0.1303,-0.0290]$	$[-0.1236,-0.0348]$
GPT-4.1 mini	all	$-0.1040$ ∗	$[-0.1775,-0.0351]$	$[-0.1649,-0.0512]$	$-0.0828$ ∗	$[-0.1323,-0.0357]$	$[-0.1319,-0.0356]$
Haiku 4.5	superseded	$-0.0568$	$[-0.1170,+0.0040]$	$[-0.1066,-0.0074]$	$-0.0142$	$[-0.0675,+0.0365]$	$[-0.0557,+0.0346]$
Haiku 4.5	all	$-0.0704$ ∗	$[-0.1300,-0.0130]$	$[-0.1230,-0.0149]$	$-0.0006$	$[-0.0363,+0.0378]$	$[-0.0426,+0.0385]$
Opus 5 (draw 1) a	superseded	$+0.0630$ ∗	$[+0.0078,+0.1134]$	$[+0.0101,+0.1139]$	$+0.0745$ ∗	$[+0.0230,+0.1252]$	$[+0.0357,+0.1147]$
Opus 5 (draw 1) a	all	$+0.0544$ ∗	$[+0.0013,+0.0983]$	$[+0.0060,+0.1003]$	$+0.0387$ ∗	$[+0.0053,+0.0718]$	$[+0.0071,+0.0705]$

Appendix

Table 40: Each model minus the name lookup under the same summary on the whole set of

115

pairs, pooled AUROC with the item-level and the persona-clustered paired interval: on the paraphrase set (the registered row) and on the original questions of the same pairs beside it (post hoc), so that a lead can be read against the one it replaces. ∗ : both intervals exclude zero.

Model	States	questions	Pooled AUROC	item interval	persona interval
GPT-4.1 mini	superseded	paraphrases	$-0.1195$ ∗	$[-0.1842,-0.0572]$	$[-0.1959,-0.0512]$
		originals	$-0.1044$ ∗	$[-0.1593,-0.0532]$	$[-0.1665,-0.0456]$
GPT-4.1 mini	all	paraphrases	$-0.0868$ ∗	$[-0.1583,-0.0115]$	$[-0.1572,-0.0143]$
		originals	$-0.0703$ ∗	$[-0.1177,-0.0197]$	$[-0.1320,-0.0099]$
Haiku 4.5	superseded	paraphrases	$-0.0743$ ∗	$[-0.1371,-0.0202]$	$[-0.1355,-0.0116]$
		originals	$-0.0304$	$[-0.0746,+0.0152]$	$[-0.0833,+0.0222]$

Appendix

Table 41: Supersession only (post hoc): each model minus the name lookup under the same summary on the

76

supersession pairs (

228

items), on the paraphrases and on the original questions of the same pairs; upper panel the pooled AUROC with the item-level and the persona-clustered paired intervals, lower panel the matched metric with the triple-level and the persona-grouped intervals. ∗ : both intervals clear of zero.

Reader	States	original	paraphrase	difference	item interval	persona interval	reading
Name lookup	superseded	$0.7901$	$0.7643$	$-0.0258$	$[-0.0494,-0.0008]$	$[-0.0542,+0.0017]$	holds
Lexical lookup	superseded	$0.6847$	$0.5000$	$-0.1847$ ∗	$[-0.2286,-0.1421]$	$[-0.2317,-0.1356]$	collapses
Name lookup	all	$0.8741$	$0.8104$	$-0.0637$ ∗	$[-0.0969,-0.0243]$	$[-0.0977,-0.0254]$	collapses
Lexical lookup	all	$0.8058$	$0.5000$	$-0.3058$ ∗	$[-0.3467,-0.2633]$	$[-0.3504,-0.2606]$	collapses
GPT-4.1 mini	superseded	$0.7252$	$0.6721$	$-0.0531$ ∗	$[-0.1060,-0.0025]$	$[-0.1020,-0.0075]$	collapses
GPT-4.1 mini	all	$0.7979$	$0.7034$	$-0.0945$ ∗	$[-0.1540,-0.0339]$	$[-0.1417,-0.0510]$	collapses

Appendix

Table 42: Sensitivity, not registered: the same scoring on all

124

screen-passing pairs (

372

items), the

115

accepted and the

9

an author’s read excluded; original, paraphrase, the paired difference with both intervals and the reading at the same tolerance. ∗ : both intervals exclude zero.

Reader	States	rule 1, flagged	unflagged	originals, flagged	unflagged	rule 2, flagged	unflagged
Name lookup	superseded	$0.7163$	$0.8443$	$0.7291$	$0.8795$	$0.6641$	$0.8080$
Lexical lookup	superseded	$0.5000$	$0.5000$	$0.5567$	$0.8354$	$0.5000$	$0.5000$
Name lookup	all	$0.7762$	$0.9124$	$0.8170$	$0.9769$	$0.7385$	$0.8566$
Lexical lookup	all	$0.5000$	$0.5000$	$0.6672$	$0.9588$	$0.5000$	$0.5000$
GPT-4.1 mini	superseded	$0.6280$	$0.7647$	$0.6303$	$0.8384$	$0.5527$	$0.7374$
GPT-4.1 mini	all	$0.6694$	$0.7943$	$0.7020$	$0.9240$	$0.6182$	$0.7699$

Appendix

Table 43: The attribute-naming split of Appendix G.2 recomputed on the paraphrase set (a disclosure; it excludes nothing), under two rules for the sheet’s second column: an author’s read to that appendix’s sentence, whether the rewrite names the plan or value its attribute is about (

61

flagged of the

115

54

not), and the token rule of the original read, whether the rewrite carries a content token of the value part of the slot path (

32

flagged,

83

not). Pooled AUROC on each half; under the first rule the original questions’ values on the same halves beside.

Pooled AUROC
Reader	unpadded	padded	difference	item interval	persona interval
Name lookup	$0.9223$	$0.7416$	$-0.1807$ ∗	$[-0.2420,-0.1272]$	$[-0.2335,-0.1311]$
Lexical lookup	$0.7829$	$0.6892$	$-0.0937$ ∗	$[-0.1435,-0.0501]$	$[-0.1320,-0.0599]$
Random-token lookup	$0.6651$	$0.5008$	$-0.1643$ ∗	$[-0.2325,-0.0957]$	$[-0.2302,-0.1106]$
GPT-4.1 mini	$0.8793$	$0.6891$	$-0.1902$ ∗	$[-0.2451,-0.1369]$	$[-0.2407,-0.1354]$
Haiku 4.5	$0.8876$	$0.7354$	$-0.1522$ ∗	$[-0.2106,-0.1001]$	$[-0.2017,-0.0997]$

Appendix

Table 44: The long-list check, supersession (registered): the

264

items of the

88

supersession triples with the superseded-names list padded to

60

names, every reader’s pooled AUROC (upper panel) and matched score (lower panel, with W/T/L) beside its recorded unpadded value on the same items, and the paired difference padded minus unpadded with the item-level and the persona-grouped interval (pooled) or the triple-level and the persona-grouped interval (matched). The three lookups read the padded lists as printed; the models ran the padded summaries at the settings of their Table 1 rows. ∗ : both intervals exclude zero.

Padded lists
Model	pooled	item interval	persona interval	matched	triple interval	persona interval
GPT-4.1 mini	$-0.0525$	$[-0.1065,+0.0041]$	$[-0.1092,+0.0058]$	$-0.0455$	$[-0.1307,+0.0455]$	$[-0.1461,+0.0450]$
Haiku 4.5	$-0.0062$	$[-0.0652,+0.0515]$	$[-0.0558,+0.0464]$	$-0.0284$	$[-0.0852,+0.0341]$	$[-0.0805,+0.0294]$
GPT-5.6 Luna	$\mathbf{+0.1375}$ ∗	$[+0.0883,+0.1934]$	$[+0.0971,+0.1777]$	$\mathbf{+0.1023}$ ∗	$[+0.0398,+0.1648]$	$[+0.0482,+0.1552]$
GPT-5.6 Sol	$\mathbf{+0.1274}$ ∗	$[+0.0726,+0.1837]$	$[+0.0802,+0.1726]$	$\mathbf{+0.0909}$ ∗	$[+0.0227,+0.1477]$	$[+0.0341,+0.1519]$
Opus 5 a	$-0.0336$	$[-0.1070,+0.0448]$	$[-0.1597,+0.0748]$	$-0.0455$	$[-0.1420,+0.0398]$	$[-0.1845,+0.0756]$

Appendix

Table 45: The long-list check, supersession (registered): each model minus the name lookup on the same lists, pooled (item-level and persona-grouped intervals) and matched (triple-level and persona-grouped), on the padded lists (upper panel) and on the unpadded lists (lower panel: the recorded model minus the recorded lookup). A difference in bold is reliable (both intervals exclude zero, ∗ ).

Pooled AUROC
Reader	unpadded	padded	difference	item interval	persona interval
Name lookup	$0.7663$	$0.6470$	$-0.1194$ ∗	$[-0.1805,-0.0571]$	$[-0.1551,-0.0857]$
Lexical lookup	$0.6698$	$0.6153$	$-0.0544$ ∗	$[-0.0960,-0.0109]$	$[-0.0791,-0.0298]$
Random-token lookup	$0.5954$	$0.5004$	$-0.0951$ ∗	$[-0.1567,-0.0316]$	$[-0.1377,-0.0601]$
GPT-4.1 mini	$0.7648$	$0.6304$	$-0.1344$ ∗	$[-0.1794,-0.0936]$	$[-0.1702,-0.0992]$
Haiku 4.5	$0.7566$	$0.6525$	$-0.1041$ ∗	$[-0.1475,-0.0636]$	$[-0.1453,-0.0631]$

Appendix

Table 46: The long-list check on the whole counterfactual set,

444

items and

148

triples (descriptive; the registered comparisons are the supersession slice): every reader’s padded and unpadded scores as in Table 44 (the first two panels), then each model minus the name lookup as in Table 45 (the last two). ∗ : both intervals exclude zero; bold: reliable.

Reader	retraction, pooled	retraction, matched	expiry, pooled	expiry, matched
Name lookup	$0.5000$ / $0.5000$ / $+0.0000$	$0.5000$ / $0.5000$ / $+0.0000$	$0.5000$ / $0.5000$ / $+0.0000$	$0.5000$ / $0.5000$ / $+0.0000$
Lexical lookup	$0.5000$ / $0.5000$ / $+0.0000$	$0.5000$ / $0.5000$ / $+0.0000$	$0.5000$ / $0.5000$ / $+0.0000$	$0.5000$ / $0.5000$ / $+0.0000$
Random-token lookup	$0.5000$ / $0.5000$ / $+0.0000$	$0.5000$ / $0.5000$ / $+0.0000$	$0.5000$ / $0.5000$ / $+0.0000$	$0.5000$ / $0.5000$ / $+0.0000$
GPT-4.1 mini	$0.5761$ / $0.5597$ / $-0.0164$	$0.5667$ / $0.6667$ / $+0.1000$	$0.5594$ / $0.5147$ / $-0.0447$	$0.4000$ / $0.5500$ / $+0.1500$
Haiku 4.5	$0.5433$ / $0.5014$ / $-0.0419$	$0.5667$ / $0.3833$ / $-0.1833$ ∗	$0.5794$ / $0.5606$ / $-0.0189$	$0.5833$ / $0.4833$ / $-0.1000$
GPT-5.6 Luna	$0.5458$ / $0.4956$ / $-0.0503$	$0.6500$ / $0.7333$ / $+0.0833$	$0.6167$ / $0.5700$ / $-0.0467$	$0.8667$ / $0.8000$ / $-0.0667$

Appendix

Table 47: The long-list check on retraction and expiry,

90

items and

30

triples each (descriptive): unpadded/padded/the paired difference, pooled and matched, per state. The padded list names neither state and a triple’s three versions carry identical padded lists, so the lookups tie every triple on both states by construction. ∗ : both intervals exclude zero.

	minus the lexical lookup				minus the random-token lookup
Model	padded, pooled	matched	unpadded, pooled	matched	padded, pooled	matched	unpadded, pooled	matched
GPT-4.1 mini	$-0.0001$	$+0.0398$	$+0.0964$ ∗	$+0.1080$ ∗	$+0.1883$ ∗	$+0.2784$ ∗	$+0.2142$ ∗	$+0.1477$ ∗
Haiku 4.5	$+0.0461$	$+0.0568$	$+0.1046$ ∗	$+0.1307$ ∗	$+0.2345$ ∗	$+0.2955$ ∗	$+0.2225$ ∗	$+0.1705$ ∗
GPT-5.6 Luna	$+0.1898$ ∗	$+0.1875$ ∗	$+0.1597$ ∗	$+0.1761$ ∗	$+0.3782$ ∗	$+0.4261$ ∗	$+0.2775$ ∗	$+0.2159$ ∗
GPT-5.6 Sol	$+0.1798$ ∗	$+0.1761$ ∗	$+0.1554$ ∗	$+0.1761$ ∗	$+0.3682$ ∗	$+0.4148$ ∗	$+0.2732$ ∗	$+0.2159$ ∗
Opus 5 a	$+0.0188$	$+0.0398$	$+0.1496$ ∗	$+0.1932$ ∗	$+0.2072$ ∗	$+0.2784$ ∗	$+0.2674$ ∗	$+0.2330$ ∗

Appendix

Table 48: The long-list check, supersession (descriptive): each model minus the lexical lookup and minus the random-token lookup on the same lists, padded and unpadded, pooled and matched; point estimates, ∗ where both intervals exclude zero (the intervals are in the artifact’s ledger).

Reader	rank against pn score	rank against outcome
Name lookup	$+0.3264$	$+0.2040$
Lexical lookup	$+0.3316$	$+0.1612$
Random-token lookup	$-0.0496$	$-0.0613$
GPT-4.1 mini	$+0.1434$	$+0.2762$
Haiku 4.5	$+0.1647$	$+0.2717$
GPT-5.6 Luna	$+0.2634$	$+0.1199$

Appendix

Table 49: The target’s alphabetical rank in the pn version’s

60

-name list over the

88

supersession triples against each reader (descriptive): Spearman correlation of the rank with the reader’s pn score and with its pn -against- present outcome.

Reader	scope, metric	difference	95% item/triple	95% persona	90% item/triple	90% persona	reliable	equivalent
default summary
GPT-4.1 mini, one draw	supersession, matched	$-0.0852$	$[-0.1307,-0.0398]$	$[-0.1420,-0.0294]$	$[-0.1250,-0.0509]$	$[-0.1330,-0.0372]$	yes	no
GPT-4.1 mini, five draws	supersession, matched	$-0.0739$	$[-0.1307,-0.0227]$	$[-0.1393,-0.0214]$	$[-0.1193,-0.0284]$	$[-0.1304,-0.0294]$	yes	no
Haiku 4.5	supersession, matched	$-0.0511$	$[-0.1136,+0.0000]$	$[-0.1084,+0.0000]$	$[-0.0966,-0.0114]$	$[-0.0988,-0.0066]$	no	no
GPT-5.6 Luna	supersession, matched	$-0.0057$	$[-0.0341,+0.0227]$	$[-0.0321,+0.0174]$	$[-0.0284,+0.0227]$	$[-0.0291,+0.0150]$	no	yes
GPT-5.6 Sol	supersession, matched	$-0.0057$	$[-0.0511,+0.0341]$	$[-0.0417,+0.0287]$	$[-0.0455,+0.0284]$	$[-0.0372,+0.0230]$	no	yes

Appendix

Table 50: Equivalence within

0.05

(post hoc): each model minus the name lookup under the same summary, every row printed for the default summary (Tables 30 , 46 and 23 ), the sibling-name control (Table 36 ), the all-states summary (Tables 1 and 23 ) and the padded set (Tables 45 and 46 ), and the lookup with one count feature minus each stronger reader (matched,

148

triples). Pooled rows: item-level and persona-grouped intervals; matched rows: triple-level and persona-grouped. Equivalent: both

90\%

intervals inside

[-0.05,+0.05]

, the two one-sided tests at

5\%

; reliable: both

95\%

intervals exclude zero; a row that is neither is neither shown nor excluded.

Reader	scope, metric	difference	95% item/triple	95% persona	90% item/triple	90% persona	reliable	equivalent
paraphrase set
GPT-4.1 mini, paraphrases	whole, pooled	$-0.0904$	$[-0.1453,-0.0352]$	$[-0.1517,-0.0337]$	$[-0.1387,-0.0438]$	$[-0.1405,-0.0424]$	yes	no
GPT-4.1 mini, originals	whole, pooled	$-0.0794$	$[-0.1303,-0.0290]$	$[-0.1236,-0.0348]$	$[-0.1238,-0.0375]$	$[-0.1179,-0.0404]$	yes	no
GPT-4.1 mini, paraphrases	supersession, pooled	$-0.1195$	$[-0.1842,-0.0572]$	$[-0.1959,-0.0512]$	$[-0.1687,-0.0666]$	$[-0.1833,-0.0598]$	yes	no
GPT-4.1 mini, originals	supersession, pooled	$-0.1044$	$[-0.1593,-0.0532]$	$[-0.1665,-0.0456]$	$[-0.1475,-0.0594]$	$[-0.1558,-0.0550]$	yes	no
GPT-4.1 mini, paraphrases	supersession, matched	$-0.1513$	$[-0.2171,-0.0789]$	$[-0.2501,-0.0548]$	$[-0.2105,-0.0855]$	$[-0.2344,-0.0730]$	yes	no

Appendix

Table 51: Equivalence within

0.05

on the paraphrase set (post hoc): every row of Tables 40 and 41 , on the paraphrases and on the original questions of the same pairs; Luna and Sol were added after the registration. Columns and rule as in Table 50 .

Summary	scope	items	triples	pooled	persona interval	W/T/L	matched	triple interval	persona interval
padded to $60$	whole	$444$	$148$	$0.7973$	$[0.7552,0.8404]$	$88/60/0$	$0.7973$	$[0.7568,0.8378]$	$[0.7552,0.8404]$
padded to $60$	supersession	$264$	$88$	$1.0000$	$[1.0000,1.0000]$	$88/0/0$	$1.0000$	$[1.0000,1.0000]$	$[1.0000,1.0000]$
padded to $60$	retraction	$90$	$30$	$0.5000$	$[0.5000,0.5000]$	$0/30/0$	$0.5000$	$[0.5000,0.5000]$	$[0.5000,0.5000]$
padded to $60$	expiry	$90$	$30$	$0.5000$	$[0.5000,0.5000]$	$0/30/0$	$0.5000$	$[0.5000,0.5000]$	$[0.5000,0.5000]$
default (short list)	whole	$444$	$148$	$0.6295$	$[0.6078,0.6654]$	$88/60/0$	$0.7973$	$[0.7568,0.8378]$	$[0.7552,0.8404]$
default (short list)	supersession	$264$	$88$	$0.7199$	$[0.6949,0.7716]$	$88/0/0$	$1.0000$	$[1.0000,1.0000]$	$[1.0000,1.0000]$

Appendix

Table 52: The length-only reader (post hoc): its score is the number of names in the superseded-names section of the summary it is given, and nothing else, scored as the count readers are. Pooled AUROC with the persona-grouped interval; matched W/T/L and score with the triple-level and persona-grouped intervals. The sibling-name control compares the pn version with its sibling version. pn list length minus each sibling’s, per triple and sibling: padded lists, supersession:

1

162

2

12

3

2

; padded lists, whole:

0

120

1

162

2

12

3

2

; unpadded lists, supersession:

1

162

2

12

3

2

; unpadded lists, whole:

0

120

1

162

2

12

3

2

; sibling lists, supersession:

0

88

Reader	W/T/L	matched	triple interval	persona interval	pooled	sibling vs present
Name lookup (embedding)	$57/31/0$	$0.8239$	$[0.7727,0.8750]$	$[0.7670,0.8816]$	$0.7395$	$0.5227$
Lexical lookup	$42/46/0$	$0.7386$	$[0.6875,0.7898]$	$[0.6875,0.7927]$	$0.6815$	$0.5114$
Random-token lookup	$1/86/1$	$0.5000$	$[0.4830,0.5170]$	$[0.4837,0.5170]$	$0.5006$	$0.5057$
Length-only reader	$0/88/0$	$0.5000$	$[0.5000,0.5000]$	$[0.5000,0.5000]$	$0.5000$	$1.0000$
Count reader, guessed category (share)	$0/88/0$	$0.5000$	$[0.5000,0.5000]$	$[0.5000,0.5000]$	$0.5000$	$0.6932$
GPT-5.6 Luna (five draws)	$76/0/12$	$0.8636$	$[0.7955,0.9318]$	$[0.8043,0.9259]$	$0.8517$	$0.6818$

Appendix

Table 53: The sibling-name control at

60

names (registered; ADDENDUM_R141_SB60): the pn version with its list padded to

60

names against a fourth version with one name swapped for a same-category sibling, identical pad and counts, on the

88

supersession pairs. Upper panel: each reader’s matched score (W + T/2)/88 with the triple-level and persona-grouped intervals, the pooled AUROC over the

176

items, and the sibling against the padded present version (descriptive). The no-model rows were recorded before the freeze. Lower panel: each model minus the name lookup, paired; ∗ : both

95\%

intervals exclude zero; equivalent: both

90\%

intervals inside

[-0.05,+0.05]

. Haiku 4.5 and Opus 5 were not run on this control.

Reader	summary	$444$ expiry ( $30$ pairs)	extension ( $14$ pairs)	pooled ( $44$ pairs)
Name lookup	sup. only	$0.5000$ $[0.5000,0.5000]$	$0.5000$ $[0.5000,0.5000]$	$0.5000$ $[0.5000,0.5000]$
All-states lookup	all three	$0.8711$ $[0.7864,0.9424]$	$0.9694$ $[0.9475,1.0000]$	$0.8977$ $[0.8376,0.9477]$
GPT-4.1 mini	sup. only	$0.5489$ $[-0.1022,+0.1893]$	$0.5421$ $[-0.1446,+0.2222]$	$0.5461$ $[-0.0628,+0.1585]$
GPT-4.1 mini	all three	$0.5869$ $[-0.0524,+0.2230]$	$0.6811$ $[-0.0308,+0.3901]$	$0.6139$ $[-0.0042,+0.2198]$
GPT-4.1 mini	totals rand.	$0.5144$ $[-0.1317,+0.1534]$	$0.5651$ $[-0.1021,+0.2373]$	$0.5302$ $[-0.0797,+0.1325]$
Haiku 4.5	sup. only	$0.5794$ $[-0.0626,+0.2182]$	$0.6059$ $[-0.0441,+0.2595]$	$0.5872$ $[-0.0307,+0.1932]$

Appendix

Table 54: The expiry state of the counterfactual set extended by a third descriptive draw: the

444

’s

30

expiry pairs (

90

items), the

14

eligible pairs the first draw left undrawn (

42

items, built by the same construction with questions written before any store version existed), and the two pooled (

44

pairs,

132

items). Obligation AUROC per reader and summary; question only (blind) is

0.5000

by construction on every set, so each value is also a gain. Intervals are the weaker of the item-level and persona-grouped paired intervals for the models and the persona interval of the AUROC for the lookups. The pooled row joins two cells scored on different dates under two registrations with the same prompts, models and construction; Opus 5’s rows are five-call averages on the

444

and single calls on the extension, so its pooled row mixes the two; the rows below them read Opus 5 at its first draw on every pair, so the pooled value there mixes nothing. Descriptive; no prediction was registered.

Intent	Label	superseded	retracted	expired	active only	unaligned	none	total
current	pn	$63$	$26$	$0$	$0$	$0$	$0$	$89$
current	present	$1$	$1$	$15$	$68$	$0$	$0$	$85$
current	absent	$0$	$0$	$0$	$0$	$0$	$274$	$274$
upcoming	pn	$0$	$0$	$15$	$0$	$0$	$0$	$15$
upcoming	present	$5$	$3$	$8$	$18$	$0$	$0$	$34$
upcoming	absent	$0$	$0$	$0$	$0$	$0$	$49$	$49$

Appendix

Table 55: The

661

questions of the full obligation set by intent, label and the state of the question’s own attribute. For a pn question the state is the forbidding record’s, from the manifest; for a present question it is the first of retracted, superseded and expired that the ground-truth join puts on any record of the question’s own attribute in its store version, else active only (unaligned: no gold record is aligned, the ten past-event questions); an absent question has no such record. Every pn question has current or upcoming intent, and

44

present questions hold a non-active record of their own attribute:

33

under current or upcoming intent, where the label follows the record the question targets, and

11

under change intent, where intent licenses the old content (the

4

with a superseded record are the items Appendix C.2 counts).

Reader	group	$n$	mean, question only	mean, with summary	AUROC, with summary	item interval	persona interval
GPT-4.1 mini	obligations	$104$	$0.0000$	$0.2591$
	(a)	$33$	$0.0000$	$0.0773$	$0.6801$	$[0.5924,0.7619]$	$[0.5649,0.7791]$
	(b)	$11$	$0.0000$	$0.0455$	$0.6875$	$[0.5809,0.7815]$	$[0.5574,0.7973]$
	(c)	$130$	$0.0015$	$0.0296$	$0.6947$	$[0.6261,0.7659]$	$[0.6051,0.7868]$
Haiku 4.5	obligations	$104$	$0.1201$	$0.3399$
	(a)	$33$	$0.3559$	$0.2177$	$0.6716$	$[0.5738,0.7598]$	$[0.5623,0.7620]$

Appendix

Table 56: The

104

obligations against the three present groups of Table 55 : (a) the

33

whose own attribute holds a non-active record under current or upcoming intent, (b) the

11

under change intent, (c) the remaining

130

. Upper panel: the mean score question only and with the summary, and the AUROC of the obligations against the group with the summary, with the item-level and persona-grouped intervals (

1{,}000

draws). Lower panel: the question-only AUROC and the paired gain from adding the summary, with both intervals. GPT-4.1 mini’s rows are one call; Haiku 4.5, Opus 5 and GPT-5.6 Luna the five-call collapse; the name lookup reads the superseded section and has no question-only form. Descriptive; read after the results were known.

Record	$n$	$95\%$ CI	Point or composition	Constrains
Design records
Scoreable corpus	$1{,}183$	n/a	$40$ personas across three backends, with preregistered Mem0 exclusions	design record
Hard tier	$588$	n/a	$35$ FOK-positive items; external negatives: $145$ A-MEM and $136$ Mem0	design record
FR-Bank hard tier	$307$	n/a	$145$ natural-absent; $127$ slot-absent; $35$ PN	design record
Intent audit	$413$	not recorded	route precision $20\%$ ; intent conditioning makes $110$ items ( $26.6\%$ ) ineligible for PN by definition	design record
Inherited retrieval premise ( Mullick & Tüzün, 2026 )	not recorded	not recorded	retraction-record pass $5\%$	design record

Appendix

Table 57: The main-study record separates frozen design choices from measured checks in pipeline order. It shows how the labels, presence control, leakage screen, and querying apparatus constrain the reported estimates.

Manipulation	Judgment	$n$	Intact	Manipulated	$\Delta$	$95\%$ CI
Another persona’s summary	FOK	$307$	$0.7003$	$\mathbf{0.3631}$	$-0.3383$	$[-0.4506,-0.2169]$
Another persona’s summary	NOK	$661$	$0.7339$	$\mathbf{0.4659}$	$-0.2668$	$[-0.3298,-0.2010]$
Own summary, categories shuffled	FOK	$307$	$0.7003$	$0.7053$	$+0.0031$	$[-0.0499,+0.0546]$
Own summary, categories shuffled	NOK	$661$	$0.7339$	$0.7116$	$-0.0217$	$[-0.0611,+0.0178]$
The shuffle permutes the per-category count rows and the per-category attribute-name lists under a fixed seed, preserving byte length exactly on all $661$ summaries and leaving column alignment intact, so the manipulation is correspondence rather than damaged formatting. It preserves the global multiset of names and counts and leaves the flat superseded-names section untouched, so it bounds per-category correspondence and nothing more. Each $\Delta$ is the recorded paired-bootstrap estimate of manipulated minus intact ( $1{,}000$ item-level draws, seed $42$ ; single-class draws discarded) rather than the difference of the two displayed columns, from which it differs by Monte Carlo error only, at most $0.002$ on every row.

Appendix

Table 58: The registered wrong-summary control replaces only the summary text and holds the question, prompts, protocol, and populations fixed; the intact condition is the recorded elicitation, read from the recorded rows. Giving the monitor another persona’s summary costs it the whole benefit and inverts FOK below chance. Permuting which counts and which attribute-name lists belong to which category costs it nothing.

\Delta

is the changed condition minus the original, so a negative number means the change hurt.

Row	$n$	$\Delta$	Item-level CI	Persona-clustered CI
FOK, hard headline	$588$	$+0.2272$	$[+0.1177,+0.3504]$	$[+0.1552,+0.2996]$
FOK, FR-Bank hard	$307$	$+0.2037$	$[+0.0935,+0.3191]$	$[+0.1259,+0.2767]$
FOK, easy contrast	$595$	$+0.1914$	$[+0.1179,+0.2596]$	$[+0.1327,+0.2433]$
NOK, FR-Bank	$661$	$+0.2393$	$[+0.1801,+0.2949]$	$[+0.1552,+0.3237]$
FOK, Mem0	$238$	$-0.0969$	$[-0.1686,-0.0250]$	$[-0.1638,-0.0286]$
FOK, A-MEM	$284$	$-0.1065$	$[-0.1726,-0.0403]$	$[-0.1654,-0.0446]$

Appendix

Table 59: The clustered-sensitivity table reports the registered item-level interval beside the persona-clustered interval for every calibration row. Every clustered interval excludes zero, and four of six are narrower than their item-level counterparts. The last row is the paired intact-minus-blind ECE difference, whose interval includes zero.

Condition	$n$	AUROC	$\Delta$ vs. intact	$95\%$ CI	ECE
Blind	$588$	$0.5258$	—	—	$0.1596$
Intact summary	$588$	$0.7530$	—	—	$0.1741$
Counts jittered	$588$	$0.7697$	$+0.0167$	$[-0.0174,+0.0552]$	$0.1720$
Counts coarsened	$588$	$0.7625$	$+0.0095$	$[-0.0390,+0.0657]$	$0.1668$
Names only	$588$	$0.8516$	$+0.0985$	$[+0.0426,+0.1577]$	$0.0583$

Appendix

Table 60: The pooled count-destruction probe compares intact, altered-count, and names-only summaries on the hard tier. It shows flat intact-summary calibration and a different names-only result driven by the structureless external stores. Every positive of the pooled tier is an FR-Bank item and every Mem0 and A-MEM item a negative, so the pooled level reflects cross-store differences; Table 61 is the controlled within-store comparison.

Condition	$n$	AUROC	$\Delta$ vs. intact	$95\%$ CI
Intact summary	$307$	$0.7003$	—	—
Counts jittered	$307$	$0.7018$	$+0.0015$	$[-0.0310,+0.0366]$
Counts coarsened	$307$	$0.7015$	$+0.0012$	$[-0.0472,+0.0509]$
Names only	$307$	$0.7283$	$+0.0279$	$[-0.0231,+0.0801]$

Appendix

Table 61: The FR-Bank count-destruction probe compares each altered summary with the intact summary. Every manipulated-condition interval includes zero; the differences and their item-level bootstrap intervals are read from the recorded probe scores (the artifact’s mechanism-score ledger).

Model	Backend/population	$n$	Blind	Indexed	$\Delta$ ( $95\%$ CI)
mini	Mem0	$238$	$0.5746$	$0.4777$	$-0.0969$ $[-0.1686,-0.0250]$
mini	A-MEM	$284$	$0.5591$	$0.4526$	$-0.1065$ $[-0.1726,-0.0403]$
GPT-5.6 Sol h	external pooled	$66$	$0.9130$	$0.8083$	$-0.1046$ $[-0.2024,-0.0174]$
GPT-5.6 Luna h	external pooled	$66$	$0.7894$	$0.4514$	$-0.3380$ $[-0.4896,-0.1811]$

Appendix

Table 62: The table records negative summary effects on structureless stores for every tested model scale. It shows inversion at every scale, while only some scores under the summary (the indexed rows) fall below chance. h marks rows elicited through the vendor’s agent harness (Appendix A ).

Store	Condition	$n$	Indexed AUROC	$\Delta$ vs blind	$95\%$ CI
Mem0	intact (recorded)	$238$	$0.4777$	$-0.0969$	$[-0.1686,-0.0250]$
Mem0	count removed	$238$	$0.4802$	$-0.0943$	$[-0.1674,-0.0233]$
Mem0	markers removed	$238$	$0.4796$	$-0.0949$	$[-0.1654,-0.0250]$
Mem0	count $+$ markers removed	$238$	$0.4664$	$-0.1082$	$[-0.1769,-0.0392]$
A-MEM	intact (recorded)	$284$	$0.4526$	$-0.1065$	$[-0.1726,-0.0403]$
A-MEM	count removed	$284$	$0.4587$	$-0.1004$	$[-0.1699,-0.0309]$

Appendix

Table 63: The summary-ablation probe removes candidate channels from the external-store summaries. No single channel separates from the intact inversion; removing the global count and the markers together reduces the A-MEM inversion and leaves Mem0 unchanged.

Store	$n$	Blind	Intact	Marker as absence	$-$ intact ( $95\%$ CI)	$-$ blind ( $95\%$ CI)
Mem0	$238$	$0.5746$	$0.4777$	$0.5353$	$+0.0577$ $[-0.0074,+0.1157]$	$-0.0393$ $[-0.1042,+0.0226]$
A-MEM	$284$	$0.5591$	$0.4526$	$0.5355$	$+0.0829$ $[+0.0277,+0.1411]$	$-0.0236$ $[-0.0871,+0.0388]$

Appendix

Table 64: The marker read as absence: GPT-4.1 mini’s coverage AUROC on the two structureless stores when one instruction line is appended to the otherwise unchanged constrained rendering, beside the recorded question-only (blind) and intact rows. The condition lifts both stores toward chance without lifting either above question only. Intervals are the item-level paired bootstrap; the persona-clustered intervals are in the text above; descriptive, no prediction.

Store	$n$	Blind	Constrained	Names	Names $-$ blind ( $95\%$ CI)	Names $-$ constrained ( $95\%$ CI)	NB-4	NB-5
A-MEM	$284$	$0.5591$	$0.4526$	$0.8974$	$+0.3383$ $[+0.2673,+0.4122]$	$+0.4448$ $[+0.3800,+0.5116]$	$0.7000$	$0.8554$
Mem0	$238$	$0.5746$	$0.4777$	$0.8751$	$+0.3006$ $[+0.2208,+0.3728]$	$+0.3975$ $[+0.3218,+0.4747]$	$0.7104$	$0.8700$

Appendix

Table 65: The name-bearing summary on the two structureless stores. Each store’s recorded coverage items are scored by GPT-4.1 mini against a summary built from the manifest for the entries the store holds, beside the two lookups on that summary; question only (blind) and constrained are the recorded rows of Table 62 . A-MEM carries the two registered predictions and both hold (Section 6 ); Mem0’s summary covers

49.4\%

of its entries, below the coverage floor of one half, so its row is descriptive and carries no verdict. Intervals are the item-level paired bootstrap; the persona-clustered intervals are in the text.

Store	Condition	distinct values	variance	mean	mean, positives	mean, negatives
Mem0 ( $238$ )	blind	$6$	$0.0245$	$0.2183$	$0.2202$	$0.2170$
Mem0 ( $238$ )	indexed	$5$	$0.0060$	$0.1660$	$0.1617$	$0.1688$
A-MEM ( $284$ )	blind	$6$	$0.0242$	$0.2234$	$0.2230$	$0.2237$
A-MEM ( $284$ )	indexed	$5$	$0.0052$	$0.1607$	$0.1544$	$0.1658$

Appendix

Table 66: The distribution of GPT-4.1 mini’s coverage score on the two structureless stores, question only (blind) against with the summary (indexed) under the constrained rendering, from the recorded rows: distinct values, variance, mean, and the mean on positive and negative items. The summary collapses the score onto a few low values on both stores, the positives slightly below the negatives. Descriptive.

Reader	store	summary	AUROC	persona interval	minus blind	item interval	persona interval	modal share
GPT-4.1 mini	Mem0	blind	$0.5746$	$[0.5141,0.6327]$				$0.4202$
		structural	$0.4777$	$[0.4238,0.5378]$	$-0.0969$	$[-0.1686,-0.0250]$	$[-0.1638,-0.0286]$	$0.4622$
		omitted	$0.4881$	$[0.4206,0.5475]$	$-0.0865$	$[-0.1508,-0.0254]$	$[-0.1501,-0.0254]$	$0.6176$
		neutral	$0.5024$	$[0.4387,0.5590]$	$-0.0722$	$[-0.1391,-0.0046]$	$[-0.1311,-0.0121]$	$0.4664$
GPT-4.1 mini	A-MEM	blind	$0.5591$	$[0.5072,0.6136]$				$0.4014$
		structural	$0.4526$	$[0.3951,0.5083]$	$-0.1065$	$[-0.1726,-0.0403]$	$[-0.1654,-0.0446]$	$0.4648$

Appendix

Table 67: The inexpressibility marker on the two structureless stores (E3; registered, ADDENDUM_MARKER_ABLATION): coverage AUROC under the constrained rendering (structural), with the three inexpressible sections omitted (the recorded omitted arm of the main study), and with the marker’s three lines reworded to say the store does not record the field (neutral), against question only (blind). GPT-4.1 mini on each store’s coverage population at one call; GPT-5.6 Luna on the pooled

66

questions through the raw API at five calls, with its recorded harness rows beside ( h : elicited through the vendor’s agent harness, Appendix A ). Differences against question only carry the item-level and the persona-grouped interval. The modal share is the fraction of items at the most common score.

Population	summary	$n$	monitor	NB-1	NB-2	NB-4	NB-5	NB-3 idx	NB-6	best	$\Delta$
FR-Bank FOK	ground-truth	$307$	$0.7003$	$0.5194$	$0.5228$	$0.6080$	$0.6186$	$0.5048$	–	$0.6186$	$\mathbf{+0.0817}$
FR-Bank FOK	store-written	$307$	$0.7005$	$0.5194$	$0.4630$	$0.6080$	$0.6186$	$0.5419$	–	$0.6186$	$\mathbf{+0.0819}$
FR-Bank NOK	ground-truth	$661$	$0.7339$	$0.5514$	$0.5834$	$0.5383$	$0.5974$	$0.4780$	$\mathbf{0.7484}$	$0.7484$	$-0.0145$
FR-Bank NOK	store-written	$661$	$0.5959$	$0.4987$	$0.5459$	$0.5383$	$0.5974$	$0.4715$	$0.5858$	$0.5974$	$-0.0015$
Mem0 FOK	constrained ‡	$238$	$0.4777$	$0.4818$	$0.4923$	$0.5000$	$0.5000$	$0.4464$	–	$0.5000$	$-0.0223$
Mem0 FOK	store-written	$238$	$0.5741$	$0.4818$	$0.5372$	$0.5000$	$0.5000$	$0.4621$	–	$0.5372$	$+0.0369$

Appendix

Table 68: Mechanical readers of the same serialized summary. “Best” is the strongest baseline on that row; the final column is the monitor minus that best, under the

\pm 0.05

tolerance inherited from the count-destruction probe. The NB-6 column (the name lookup) is filled on the obligation rows only: on the coverage rows NB-6 reads the same name map as NB-4 and NB-5 and reproduces both exactly, so an entry there would repeat a number already in the table. The NB-6 values shown are its embedding variant, the stronger of its two wherever it is scored. NB-5 and NB-6 use a local open-weights encoder and are not the presence control’s embedding channel.

Obligation arises from	$n$	NB-6 ( $95\%$ CI)	monitor ( $95\%$ CI)	monitor $-$ NB-6
Supersession	$63$	$0.9534$ $[0.9281,0.9760]$	$0.8572$ $[0.7946,0.9142]$	$-0.0962$ $[-0.1520,-0.0495]$
Expiry	$15$	$0.4823$ $[0.3626,0.6110]$	$0.5110$ $[0.3971,0.6383]$	$+0.0287$ $[-0.1795,+0.2212]$
Retraction	$26$	$0.4053$ $[0.2812,0.5320]$	$0.5638$ $[0.4629,0.6760]$	$+0.1585$ $[+0.0002,+0.3341]$
Whole population	$104$	$0.7484$ $[0.6636,0.8298]$	$0.7339$ $[0.6502,0.8186]$	$-0.0145$ $[-0.0769,+0.0549]$

Appendix

Table 69: Post-hoc census of the obligation population under the ground-truth summary, split by the lifecycle state each obligation arises from and scored against the same negatives. The summary names superseded content and only counts the other two states, and discrimination follows that line for both readers. Designed after the baseline result; it carries no registered prediction and is reported whichever way it came out.

Model	Obligation arises from	$n$	blind	indexed	indexed $-$ blind ( $95\%$ CI)
GPT-5.6 Luna	Supersession	$63$	$0.3693$	$0.8933$	$+0.5240$ $[+0.4544,+0.5970]$
GPT-5.6 Luna	Expiry	$15$	$0.7197$	$0.8248$	$+0.1051$ $[+0.0056,+0.2163]$
GPT-5.6 Luna	Retraction	$26$	$0.4881$	$0.6323$	$+0.1442$ $[-0.0077,+0.3041]$
Opus 5	Supersession	$63$	$0.5387$	$0.8690$	$+0.3303$ $[+0.2814,+0.3831]$
Opus 5	Expiry	$15$	$0.8709$	$0.8881$	$+0.0172$ $[-0.0057,+0.0411]$
Opus 5	Retraction	$26$	$0.7641$	$0.7129$	$-0.0511$ $[-0.0987,+0.0009]$

Appendix

Table 70: Test of the per-state split, controlled for the question signal: blind and indexed discrimination for the three models scored on the full obligation population, with the paired gain (indexed minus blind) and its interval. The summary carries every model on the state it names. On the two states it only counts, one model of three separates from its own blind condition on each, so the advantage those models hold over the name lookup there is not attributable to the summary. GPT-4.1 mini is absent because its blind condition spans two distinct values on this population.

Model	Obligation arises from	$n$	AUROC ( $95\%$ CI)	$-$ lookup ( $95\%$ CI)
GPT-5.6 Luna	Supersession	$63$	$0.8933$ $[0.8495,0.9324]$	$-0.0601$ $[-0.1021,-0.0246]$
GPT-5.6 Luna	Expiry	$15$	$0.8248$ $[0.7825,0.8656]$	$+0.3425$ $[+0.2093,+0.4636]$
GPT-5.6 Luna	Retraction	$26$	$0.6323$ $[0.5255,0.7361]$	$+0.2270$ $[+0.0836,+0.3679]$
Opus 5	Supersession	$63$	$0.8690$ $[0.8322,0.9026]$	$-0.0845$ $[-0.1226,-0.0486]$
Opus 5	Expiry	$15$	$0.8881$ $[0.8576,0.9153]$	$+0.4058$ $[+0.2751,+0.5264]$
Opus 5	Retraction	$26$	$0.7129$ $[0.6526,0.7736]$	$+0.3077$ $[+0.1772,+0.4386]$

Appendix

Table 71: Per-state split for the three models scored on the full obligation population under five calls per question, against the name lookup, with the difference and its interval from the stratified paired bootstrap of the registration. The crossover is the finding: the lookup leads on the state the summary names and trails on the two it only counts. The GPT-5.6 Sol and Kimi K3 runs are absent because a budget directive stopped them before they were scored on this population.

Model	Lookup variant	model	lookup	difference	item interval	persona interval
GPT-4.1 mini	embedding	$0.7339$	$0.7484$	$-0.0145$	$[-0.0769,+0.0549]$	$[-0.1080,+0.0765]$
GPT-4.1 mini	lexical	$0.7339$	$0.5738$	$+0.1601$	$[+0.1086,+0.2153]$	$[+0.0676,+0.2585]$
GPT-5.6 Luna	embedding	$0.8182$	$0.7484$	$+0.0698$	$[+0.0123,+0.1264]$	$[-0.0180,+0.1520]$
GPT-5.6 Luna	lexical	$0.8182$	$0.5738$	$+0.2444$	$[+0.1977,+0.2888]$	$[+0.1655,+0.3197]$
Opus 5	embedding	$0.8327$	$0.7484$	$+0.0843$	$[+0.0182,+0.1448]$	$[-0.0091,+0.1759]$
Opus 5	lexical	$0.8327$	$0.5738$	$+0.2589$	$[+0.2195,+0.2987]$	$[+0.1935,+0.3199]$

Appendix

Table 72: Each model minus the name lookup on the

661

obligation questions, for the embedding and the lexical variant of the lookup, with the item-level and the persona-clustered interval. Haiku 4.5, Opus 5 and GPT-5.6 Luna lead the embedding lookup at item level and not under clustering; every model leads the lexical lookup. Exploratory, computed after the fact on the recorded rows.

Population	$n$ / pos.	blind	indexed	lexical	embedding	model $-$ embedding	item interval	persona interval
FR-Bank hard tier	$307$ / $35$	$0.4966$	$0.7003$	$0.5970$	$0.7864$	$-0.0861$	$[-0.1879,+0.0305]$	$[-0.1793,+0.0166]$
FR-Bank easy tier	$354$ / $243$	$0.4660$	$0.7835$	$0.5162$	$0.6083$	$+0.1752$	$[+0.0938,+0.2515]$	$[+0.0959,+0.2579]$
Easy tier, all backends	$595$ / $463$	$0.4422$	$0.6336$	$0.5071$	$0.4021$	$+0.2315$	$[+0.1628,+0.2979]$	$[+0.1680,+0.2970]$
Easy tier, whole map	$354$ / $243$	$0.4660$	$0.7835$	$0.6311$	$0.7469$	$+0.0367$	$[-0.0127,+0.0861]$	$[-0.0036,+0.0776]$

Appendix

Table 73: The name lookup, lexical and embedding, on the coverage populations, beside GPT-4.1 mini’s recorded blind and indexed coverage AUROC, with the model minus the embedding lookup and both intervals; the last row reads the whole name map instead of the superseded section (post hoc, specified before recomputation). Where the coverage positives are obligations the lookup reads them; where they are ordinary records the model leads the superseded-section lookup and not, reliably, the whole-map lookup. Exploratory, computed after the fact on the recorded rows.

Rend.	own name	$n$	Haiku, store-written	ground-truth	lookup	store-written minus ground-truth	Haiku minus lookup
capped	present	$24$	$0.7993$	$0.8925$	$0.7292$	$-0.0932$	$+0.0701$
	item					$[-0.1746,-0.0006]$	$[-0.0204,+0.1663]$
	persona					$[-0.2041,+0.0235]$	$[-0.0261,+0.1709]$
capped	absent	$39$	$0.6933$	$0.8880$	$0.6146$	$-0.1947$	$+0.0787$
	item					$[-0.2673,-0.1224]$	$[-0.0137,+0.1666]$
	persona					$[-0.2813,-0.1011]$	$[-0.0497,+0.2355]$

Appendix

Table 74: Haiku 4.5 under the store’s own metadata, the

63

supersession obligations split by whether the item’s own scrubbed name survives in the store-written list, each half against the same

557

negatives: Haiku 4.5 under the store-written and the ground-truth summary, the lookup on the store-written list, and the paired differences, each with its item-level and persona-grouped intervals on the rows beneath. Descriptive; no prediction was registered.

Reader	Ground-truth summary	Store-written, capped	Store-written, cap lifted
GPT-4.1 mini	$0.73$	$0.60$	$0.65$
Haiku 4.5	$0.82$	$0.71$	$0.74$
retention a		$0.72$	$0.79$
Name lookup	$0.75$	$0.59$	$0.66$

Appendix

Table 75: Obligation AUROC on the full obligation set (

661

questions,

104

obligations) under the ground-truth summary and under FR-Bank’s store-written summary, rendered with the fifteen-name cap and with the cap lifted. Retention is Haiku 4.5’s store-written gain as a fraction of its ground-truth gain.

Obligations	$n$	GPT-4.1 mini			Haiku 4.5			Name lookup
		truth	capped	lifted	truth	capped	lifted	truth	capped	lifted
all $104$ (the printed rows)	$104$	$0.7339$	$0.5959$	$0.6513$	$0.8210$	$0.7069$	$0.7364$	$0.7484$	$0.5858$	$0.6588$
alignment marks the forbidding record ( $0.80$ bar)	$82$	$0.7910$	$0.6636$	$0.7297$	$0.8515$	$0.7258$	$0.7821$	$0.8346$	$0.6319$	$0.7061$
the same at the $0.75$ bar	$84$	$0.7866$	$0.6573$	$0.7180$	$0.8468$	$0.7235$	$0.7738$	$0.8177$	$0.6261$	$0.6986$
the same at the $0.50$ bar	$95$	$0.7571$	$0.6193$	$0.6750$	$0.8358$	$0.7156$	$0.7473$	$0.7766$	$0.5942$	$0.6640$
not marked at $0.80$ (the $22$ )	$22$	$0.5210$	$0.3433$	$0.3591$	$0.7074$	$0.6368$	$0.5659$	$0.4272$	$0.4138$	$0.4822$

Appendix

Table 76: The rows of Table 75 re-scored on strata of the

104

obligations, the

557

negatives unchanged (post hoc). The alignment of manifest events to stored records marks a forbidding record for

82

obligations at the

0.80

overlap bar (

63

supersession,

8

retraction,

11

expiry),

84

0.75

and

95

0.50

; the store’s own fields mark a member of

73

;

56

are marked by both,

26

by the alignment alone,

17

by the store alone and

5

by neither. Upper panel: the AUROC per stratum. Lower panel: on the

82

the alignment marks, each store-written row minus its ground-truth row with both intervals, ∗ where both exclude zero. On the

22

it does not mark every reader is at or below

0.71

under every summary, the ground-truth summary included, because the ground-truth name list is built from the same alignment.

Population	$n$ / pos.	Ground-truth	Own name removed	$\Delta$	item-level $95\%$	by persona	Lookup, ground-truth	Lookup, removed
whole population	661 / 104	$0.7339$	$0.5016$	$-0.2323$	$[-0.2890,-0.1753]$	$[-0.3054,-0.1540]$	$0.7484$	$0.4913$
supersession-derived	620 / 63	$0.8572$	$0.5310$	$-0.3262$	$[-0.3991,-0.2548]$	$[-0.4327,-0.2167]$	$0.9534$	$0.5108$
expiry-derived	572 / 15	$0.5110$	$0.5136$	$+0.0026$	$[-0.0028,+0.0079]$	$[-0.0041,+0.0103]$	$0.4823$	$0.4887$
retraction-derived	583 / 26	$0.5638$	$0.4234$	$-0.1404$	$[-0.2569,-0.0508]$	$[-0.3305,-0.0028]$	$0.4053$	$0.4455$

Appendix

Table 77: Own-name ablation. The superseded-names section of the ground-truth summary is re-rendered without the item’s own attribute name and every name within its encoder neighbourhood (

102

661

summaries change); GPT-4.1 mini’s obligation discrimination under that summary against the main study’s row, per lifecycle state (positives of one state against the same

557

negatives) and whole; the name lookup on the same two texts beside.

Monitor	Population	$n$ / pos.	Truthful	Monitor	$\Delta$	item-level $95\%$	by persona
Retrieved view	obligation, whole	661 / 104	$0.7339$	$0.6851$	$-0.0488$	$[-0.1274,+0.0285]$	$[-0.1454,+0.0389]$
Retrieved view	obligation, supersession	620 / 63	$0.8572$	$0.6853$	$-0.1719$	$[-0.2641,-0.0734]$	$[-0.2764,-0.0682]$
Retrieved view	obligation, expiry	572 / 15	$0.5110$	$0.7474$	$+0.2364$	$[+0.1053,+0.3829]$	$[+0.0645,+0.4037]$
Retrieved view	obligation, retraction	583 / 26	$0.5638$	$0.6487$	$+0.0850$	$[-0.0682,+0.2235]$	$[-0.1435,+0.2764]$
Retrieved view	coverage, hard tier	307 / 35	$0.7003$	$0.7870$	$+0.0867$	$[-0.0261,+0.1908]$	$[+0.0041,+0.1683]$
Summary + retrieved view	obligation, whole	661 / 104	$0.7339$	$0.8303$	$+0.0964$	$[+0.0415,+0.1554]$	$[+0.0227,+0.1635]$

Appendix

Table 78: Retrieved-view and hybrid monitors. The five entries a similarity retriever returns from the item’s store, active or not, each with the lifecycle flags the store’s ground-truth join records; the retrieved-view monitor sees those five and no summary, the hybrid monitor sees both. Obligation rows on the

661

, per state and whole; coverage rows on the

307

against the ground-truth summary; reach of the record that forbids use, a census over the

104

obligations with a Wilson interval.

Monitor, tag source	AUROC	$\Delta$ (against)	item interval	persona interval
Summary alone	$0.73$
Tagged view, ground-truth tags	$0.69$	$-0.05$ (the summary alone)	$[-0.13,+0.03]$	$[-0.15,+0.04]$
on expiry, 15 obligations	$0.75$	$+0.24$ (the summary alone, $0.51$ )	$[+0.11,+0.38]$	$[+0.06,+0.40]$
on supersession, 63 obligations	$0.69$	$-0.17$ (the summary alone, $0.86$ )	$[-0.26,-0.07]$	$[-0.28,-0.07]$
Summary plus tagged view, ground-truth tags	$0.83$	$+0.10$ (the summary alone)	$[+0.04,+0.16]$	$[+0.02,+0.16]$
Tagged view, the store’s own tags	$0.81$	$+0.13$ (the view under ground-truth tags)	$[+0.07,+0.18]$	$[+0.06,+0.21]$

Appendix

Table 79: Obligation AUROC of GPT-4.1 mini on the tagged view, on the full obligation set (

661

questions,

104

obligations).

\Delta

is the monitor minus the comparison named in its row, with both intervals; the two indented rows score that state’s obligations against the same

557

negatives. Haiku 4.5 and the readers with no generative-model call are in Appendix E.10 .

Row	first	second	$\Delta$	item interval	persona interval
Haiku 4.5, view (ground-truth tags) minus its summary alone	$0.7134$	$0.8210$	$-0.1077$	$[-0.1732,-0.0369]$	$[-0.1939,-0.0203]$
Haiku 4.5, summary plus view (ground-truth tags) minus its summary alone	$0.7863$	$0.8210$	$-0.0347$	$[-0.0930,+0.0248]$	$[-0.1109,+0.0433]$
Ground-truth tags: the GPT-4.1 mini monitor on the same input minus the reader with no generative-model call
View monitor minus tag density	$0.6851$	$0.6157$	$+0.0694$	$[+0.0375,+0.1053]$	$[+0.0257,+0.1103]$
View monitor minus tagged-name lookup	$0.6851$	$0.6313$	$+0.0538$	$[+0.0232,+0.0899]$	$[+0.0110,+0.0951]$
View monitor minus forbidding-record indicator	$0.6851$	$0.6683$	$+0.0168$	$[-0.0192,+0.0572]$	$[-0.0380,+0.0784]$

Appendix

Table 80: The tagged view, the rows Table 79 leaves out: Haiku 4.5 on the view and on summary plus view under ground-truth tags, and the four readers with no generative-model call under each tag source, each against the GPT-4.1 mini monitor that saw the same input. The readers are tag density (the fraction of lines tagged non-active), the tagged-name lookup (the question against the names of the tagged lines), the forbidding-record indicator (the item’s forbidding record in view and tagged) and the hybrid of the name lookup with the tagged-name lookup.

\Delta

is the first-named score minus the second, with both intervals.

Policy	abstains	sup. (of $63$ )	ret. (of $26$ )	exp. (of $15$ )	abstain, absent (of $383$ )
Top-5 only	$0$	$22$	$20$	$12$	$0$
Oracle	$383$	$63$	$22$	$14$	$383$
Model rule	$210$	$53$	$20$	$12$	$172$
Lookup rule	$224$	$53$	$20$	$12$	$174$
Model rule, all states named	$210$	$53$	$20$	$12$	$172$
Lookup rule, all states named	$224$	$53$	$20$	$12$	$174$

Appendix

Table 81: The downstream experiment. Seven registered policies assemble a view from the five retrieved entries and, where a rule fires, the store’s non-active records for the attributes the summary names (the oracle: the item’s own attribute; the gold labels decide abstention). Table 88 carries each policy’s fires, reach, view size, tagged reach and coverage; the first block here adds the abstention counts and the reach by the state the obligation arises from. Stage

2

is one GPT-4.1 mini answer per distinct view, scored by the ground-truth token detector at its high-precision threshold (

0.80

) and at the ground-truth join’s threshold (

0.50

), split by whether the forbidding record carried its tag. The literal-threshold lookup row is descriptive; its answer stage was registered after the first draft (Amendment 2) and prints in the second block, whose lower rows give the same counts under the answer stage run once more with an added instruction to treat tagged records as not to be used (Amendment 3; the Amendment 1 policy’s views were not answered again). The last row of each block is the descriptive policy of the amendment registered after the study: the model rule with its obligation score elicited under the summary that names all three states, and the all-states fetch set, so that the counted-state gate can fire. Scored with the store’s tags as joined, one retraction tag inverted (the negation paragraph).

Policy	answered	stale at $0.80$	stale at $0.50$ , tagged / untagged	present answered	correct at $0.50$
Top-5 only	$54$	$7$	$8$ of $35$ / $11$ of $19$	$174$	$48$ ( $0.2759$ )
Oracle	$99$	$9$	$17$ of $82$ / $10$ of $17$	$174$	$48$ ( $0.2759$ )
Model rule	$74$	$9$	$15$ of $61$ / $8$ of $13$	$155$	$45$ ( $0.2903$ )
Lookup rule	$70$	$7$	$14$ of $61$ / $5$ of $9$	$146$	$41$ ( $0.2808$ )
Model rule, all states named	$74$	$5$	$12$ of $61$ / $8$ of $13$	$155$	$45$ ( $0.2903$ )
Lookup rule, all states named	$70$	$5$	$13$ of $61$ / $5$ of $9$	$146$	$40$ ( $0.2740$ )

Appendix

Table 82: The answer stage under Claude Haiku 4.5 as the answerer, every policy, on the same

452

distinct views GPT-4.1 mini answered; the columns of the second block of Table 81 , counted over the answered subset, and the lower rows the same counts under the answer stage run once more with the added instruction to treat tagged records as not to be used (Amendment 3). Descriptive; both registered after the first draft. Scored with the store’s tags as joined, one retraction tag inverted (the negation paragraph).

Answerer	Policy	Reached	Stale at $0.50$	Stale at $0.80$	Correct (licensed)	Rate at $0.50$	Scorable, whole answer	Scorable, first sentence
mini	Top-5	$54$	$11\to 3$	$3\to 1$	$56$ of $174$	$0.2037\to 0.0556$	$10\to 2$ of $42$	$10\to 2$ of $42$
mini	Model	$74$	$11\to 2$	$2\to 1$	$53$ of $155$	$0.1486\to 0.0270$	$10\to 1$ of $62$	$10\to 1$ of $62$
mini	Lookup	$70$	$9\to 1$	$2\to 1$	$48$ of $146$	$0.1286\to 0.0143$	$8\to 0$ of $58$	$8\to 0$ of $58$
mini	Model, all states	$74$	$12\to 2$	$2\to 1$	$53$ of $155$	$0.1622\to 0.0270$	$11\to 1$ of $62$	$11\to 1$ of $62$
mini	Lookup, all states	$70$	$9\to 1$	$1\to 1$	$47$ of $146$	$0.1286\to 0.0143$	$8\to 0$ of $58$	$8\to 0$ of $58$
mini	Literal	$94$	$17\to 5$	$3\to 1$	$55$ of $174$	$0.1809\to 0.0532$	$16\to 4$ of $82$	$16\to 4$ of $82$

Appendix

Table 83: The answer stage with the store’s untagged duplicates tagged (DS Amendment 5, descriptive; no prediction was registered). For each of the

35

obligations whose view carried an active line asserting the stale value, every such line is retagged with the obligation’s state (superseded or retracted) and nothing else in any view changes;

74

of the

452

distinct views change (

132

lines) and are re-answered by both answerers under the Amendment 4 header, the other

378

keeping their Amendment 4 answers. A line counts as asserting the stale value by the item’s own committed detector at the ground-truth join’s threshold: at least two content tokens shared with the stale field, coverage of the stale-only tokens at least

0.50

, coverage of the successor-only tokens below

0.34

. Stale is the detector’s flag on the answer at

0.50

(the ground-truth join’s threshold) and at

0.80

(the registered threshold), over the reached obligations of each policy; the last two columns restrict to the scorable supersession- and retraction-derived obligations and give the flag on the whole answer beside the flag on the answer’s first sentence alone (the expiry obligations’ gold field is the expired fact, so they are unscorable there); correct is over the licensed items, whose views do not change. Every cell reads Amendment 4 (recorded) to Amendment 5; mini is GPT-4.1 mini and Haiku is Haiku 4.5. Scored with the store’s tags as joined, one retraction tag inverted (the negation paragraph).

Policy	Lines	Record in view, of $174$ (Wilson)	Correct at $0.50$ (Wilson)	at $0.80$	Among in view	Abstain, licensed	Abstain, absent, of $383$ (Wilson)
GPT-4.1 mini
Flat $5$	$5.00$	$65$ $[0.3051,0.4474]$	$56$ $[0.2569,0.3945]$	$20$	$48$ of $65$	$33$	$241$ $[0.5798,0.6761]$
Flat $6$	$6.00$	$72$ $[0.3432,0.4881]$	$59$ $[0.2729,0.4122]$	$21$	$50$ of $72$	$30$	$236$ $[0.5666,0.6635]$
Flat $7$	$7.00$	$77$ $[0.3708,0.5168]$	$62$ $[0.2890,0.4299]$	$23$	$54$ of $77$	$25$	$228$ $[0.5454,0.6433]$
Flat $8$	$8.00$	$82$ $[0.3985,0.5453]$	$65$ $[0.3051,0.4474]$	$20$	$57$ of $82$	$21$	$218$ $[0.5192,0.6179]$
Flat $9$	$9.00$	$88$ $[0.4321,0.5791]$	$67$ $[0.3160,0.4591]$	$22$	$60$ of $88$	$18$	$219$ $[0.5218,0.6204]$

Appendix

Table 84: The answer stage along the depth of the retrieval view (DS Amendment 6, descriptive; no prediction was registered). Views are the first

k

lines of the recorded ten-deep ranking rendered by the recorded renderer (the five-line view is the recorded one), answered under the Amendment 4 header by both answerers; the gated view renders ten lines where GPT-4.1 mini’s recorded coverage score is at or above the base-rate threshold (

366

of the

557

items:

155

of the

174

licensed,

211

of the

383

absent) and five elsewhere, a mean of

8.29

lines. Per policy: the licensed record in view, correct answers at

0.50

and at

0.80

, correct among the items whose record is in view, abstentions on the licensed items, and abstentions on the

383

absent items, with Wilson intervals on the rates. The last rows are the budget-matched comparison: the gated view against the flat curve interpolated at

8.29

lines between

k=8

and

k=9

, the difference with the item-level and persona-grouped bootstraps (

10{,}000

draws, the three policies resampled together). Scored with the store’s tags as joined, one retraction tag inverted (the negation paragraph).

Answerer	Policy (prompt)	Licensed correct	Reported (by the successor)	Absent abstained: rule $+$ answerer	Composite	Rule-only
GPT-4.1 mini	Top-5 (header)	$56$	$4$ ( $1$ )	$241=0+241$	$301$	$59$
GPT-4.1 mini	Top-5 (tagged)	$56$	$4$ ( $1$ )	$241=0+241$	$301$	$59$
GPT-4.1 mini	Literal rule (header)	$55$	$4$ ( $1$ )	$242=0+242$	$301$	$58$
GPT-4.1 mini	Literal rule (tagged)	$55$	$4$ ( $1$ )	$242=0+242$	$301$	$58$
GPT-4.1 mini	Model rule (header)	$53$	$2$ ( $1$ )	$265=172+93$	$320$	$226$
GPT-4.1 mini	Lookup rule (header)	$48$	$2$ ( $1$ )	$276=174+102$	$326$	$223$

Appendix

Table 85: The composite per policy over the full obligation set (

661

questions) with its three components (DS Amendment 7, descriptive; no prediction was registered; no generative-model call). A licensed item counts when its answer is correct at

0.50

. An obligation counts when it is reached, answered and reported: the answer names the lifecycle state from a closed word list (superseded, retracted, expired, no longer, not current, outdated, cancelled, replaced, withdrawn, discontinued, past, and previous or former in a sentence that also carries one of those) without giving the stale value by the committed detector at

0.50

, or, on a supersession item, gives the successor value; the count by the successor alone is printed beside it. An absent item counts when the policy’s coverage rule abstained on it or, where the rule let it through, the answerer abstained on its recorded five-line view (the Amendment 6 answers under the header; the absent items a gated rule answers on a longer view, ten under the model rule, seventeen under the lookup rule and seventy-two under the literal rule, are read on that longer view, answered under the same header prompt after the registration,

99

distinct views per answerer; read on the five-line view as a proxy instead, every composite is within one of the value printed). The last column is the rule-only reading, in which an absent item counts only when the coverage rule abstained. The oracle’s rule is the label itself, so its absent component is

383

383

; the row is printed and enters no comparison. Rows: retrieval alone and the literal rule (no coverage rule), the gated rules under the header prompt, the same rules with the store’s untagged duplicates tagged (tagged), then the oracle; the denominators are

174

licensed items,

104

obligations,

383

absent items and

661

in all. Scored with the store’s tags as joined, one retraction tag inverted (the negation paragraph).

Re-answers on the changed views under own tags (before $\to$ after; stale at $0.50$ over answered obligation views; correct licensed answers)
Measure	GT tags, primary	GT tags, secondary	own tags, primary	own tags, secondary
Views changed, of $452$	$1$	$1$	$90$	$123$
Lines propagated	$1$	$1$	$117$	$152$
Audited duplicate items fully tagged, of $35$	$0$	$0$	$15$	$15$
False propagation on the licensed items’ active lines	$3$ / $2333$ ( $0.13\%$ )	$3$ / $2333$ ( $0.13\%$ )	$69$ / $2333$ ( $2.96\%$ )	$83$ / $2333$ ( $3.56\%$ )
GPT-4.1 mini: top-five: $1$ / $7$ $\to$ $0$ / $2$ ; correct $11\to 7$ ; model: $7$ / $12$ $\to$ $3$ / $7$ ; correct $9\to 7$ ; oracle: $6$ / $17$ $\to$ $1$ / $8$ ; correct $11\to 7$

Appendix

Table 86: Label propagation inside the view (E4; registered, DS Amendment 8). A rule that reads only the assembled view propagates a tagged line’s lifecycle tag to the untagged lines of the same attribute that repeat it under the census function unchanged (shared tokens

\geq 2

, cross guard

0.34

, coverage

\geq 0.80

), with an age-field ordering (primary) or without it (secondary), under the ground-truth tags and under FR-Bank’s own tags. Of the

272

audited stale-line instances,

187

sit under a different attribute key from their tagged twin,

45

fall below

0.50

coverage of any same-attribute tagged line,

40

between

0.50

and

0.80

, and none reaches the threshold. Detector counts; the re-answers under own tags are descriptive, no prediction was registered on them. Scored with the store’s tags as joined, one retraction tag inverted (the negation paragraph).

Policy	Forbidding records in view (of $104$ )	Stale answers (of $104$ )	Stale, of the reached scorable obligations	Stale, of the answered subset; Wilson	Correct (of $174$ )
Top-5 retrieval	$54$	$9$	$8$ of $42$ , $0.19$	$8$ of $42$ , $0.19$ $[0.10,0.33]$	$46$
Model rule	$85$	$9$	$8$ of $73$ , $0.11$	$8$ of $62$ , $0.13$ $[0.07,0.23]$	$44$
Lookup rule	$85$	$7$	$6$ of $73$ , $0.08$	$6$ of $58$ , $0.10$ $[0.05,0.21]$	$40$
Model rule, all states named and scored	$89$	$12$	$11$ of $76$ , $0.14$	$11$ of $65$ , $0.17$ $[0.10,0.28]$	$44$
Literal lookup rule (descriptive)	$94$	$14$	$13$ of $82$ , $0.16$	$13$ of $82$ , $0.16$ $[0.10,0.25]$	$46$
Oracle	$99$	$17$	$16$ of $85$ , $0.19$	$16$ of $85$ , $0.19$ $[0.12,0.28]$	$46$

Appendix

Table 87: The downstream policies for GPT-4.1 mini on the full obligation set: forbidding records put in view, detector-flagged stale answers at the

0.50

threshold, and correct answers on the licensed items. The flagged rate holds under every gated policy until the store’s untagged duplicates are retagged (Table 83 , Appendix E.10 ). Scored with the store’s tags as joined, one retraction tag inverted (the negation paragraph).

Policy	fires	reach rate; Wilson interval of the stale rate	mean view	tagged	coverage (of $174$ )
Top-5 retrieval	$0$	$0.5192$ ; $[0.100,0.333]$	$5.00$	$35$	$65$
Model rule	$75$	$0.8173$ ; $[0.067,0.234]$	$7.08$	$66$	$60$
Lookup rule	$77$	$0.8173$ ; $[0.048,0.208]$	$6.88$	$66$	$56$
Model rule, all states named and scored	$110$	$0.8558$ ; $[0.097,0.278]$	$11.42$	$72$	$60$
Literal lookup rule (descriptive)	$184$	$0.9038$ ; $[0.095,0.253]$	$7.42$	$75$	$65$
Oracle	$104$	$0.9519$ ; $[0.119,0.284]$	$7.07$	$82$	$65$

Appendix

Table 88: The downstream policies, the columns Table 87 leaves out: the items on which each rule fires, the reach of the forbidding record as a rate (of

104

obligations), the Wilson interval of the stale rate over the reached scorable obligations (GPT-4.1 mini, the detector at

0.50

), the mean view size on the obligations, tagged records, and coverage of the

174

licensed items (record in view without abstention). Scored with the store’s tags as joined, one retraction tag inverted (the negation paragraph).

$k$	reach (of $104$ )	rate	supersession (of $63$ )	retraction (of $26$ )	expiry (of $15$ )
$5$	$54$	$0.5192$	$22$	$20$	$12$
$6$	$60$	$0.5769$	$26$	$22$	$12$
$7$	$62$	$0.5962$	$27$	$23$	$12$
$8$	$69$	$0.6635$	$32$	$25$	$12$
$9$	$70$	$0.6731$	$33$	$25$	$12$
$10$	$74$	$0.7115$	$37$	$25$	$12$

Appendix

Table 89: Reach of the forbidding record by the depth of the retrieval view, a census over the

104

obligations from the recorded ten-deep ranking, whole and by the state the obligation arises from. Reach grows with depth and stays below the gated policies at their matched view size.

Policy	in view (of $104$ )	Wilson	sup. / retr. / exp.	minus the model rule	item interval	persona interval
Model rule (recorded)	$85$ = $0.8173$	–	53 / 20 / 12	–	–	–
Always-open fetch, five lines plus the fetch	$86$ = $0.8269$	$[0.743,0.888]$	54 / 20 / 12	$+0.0096$	$[-0.0577,+0.0673]$	$[-0.0804,+0.0980]$
Always-open fetch, matched	$0.8164$	–	–	$-0.0009$	$[-0.0700,+0.0664]$	$[-0.0893,+0.0890]$
Similarity view, seven lines (recorded rows)	$62$ = $0.5962$	$[0.500,0.685]$	27 / 23 / 12	$-0.2212$	$[-0.3077,-0.1346]$	$[-0.3530,-0.0850]$
Similarity view, matched	$0.5443$	–	–	$-0.2730$	$[-0.3621,-0.1865]$	$[-0.3976,-0.1378]$
Recency-aware view, seven lines	$28$ = $0.2692$	$[0.193,0.362]$	17 / 0 / 11	$-0.5481$	$[-0.6635,-0.4423]$	$[-0.6970,-0.3924]$

Appendix

Table 90: What the gate buys, reach only (registered; ADDENDUM_R122_GATE_REACH): three policies assembled from the recorded ranking and the store’s records with no reader (monitor) call and no answer call, against the recorded model rule. The always-open fetch keys the lifecycle fetch on the name the lookup matches best and never abstains; the similarity view is the recorded top-

k

retrieval; the recency-aware view keeps the newest record of each attribute and fills to

k

. Each is read at its named depth and budget-matched to the model rule’s mean view over the

661

questions (

5.43

lines) by interpolating between the two bracketing depths (the always-open fetch between

k=3

and

4

with weight

0.91

on the deeper, the similarity and recency-aware views between

k=5

and

6

with weight

0.43

). Upper panel: the forbidding record in view over the

104

obligations with the Wilson interval and the per-state census, and the difference from the model rule with both intervals. Lower panel: the licensed record in view over the

174

licensed items with its difference from the model rule, and the mean lines per question over the

661

and over the

104

. The fetch keyed on the best-matched name at four similarity lines reaches

85

104

5.53

lines; the matched always-open row loses licensed records reliably because the truncated fill drops them; the recency-aware view reaches no retraction obligation because the retracted record is never the newest of its attribute. All three predictions came out as written: the ungated fetch within

0.05

of the model rule at the matched budget, its unmatched form spending more lines, and the recency-aware view below the rule by more than

0.05

Number (where)	Population	Label source	Record alignment	Tag source	Evaluator	Validation
Counterfactual NOK AUROC, lookup $0.77$ and models $0.76$ to $0.85$ (Section 5 , Table 1 )	$444$ items, $148$ triples	manifest; pn labels hand-verified; question fixed across versions	not needed: versions built from the manifest	ground-truth summary	AUROC, persona-grouped bootstrap	registered predictions held; PN-vs-PRESENT decomposition post hoc
Paraphrase check, the lookup’s loss of $0.02$ (Section 5.2 , Table 38 )	$345$ items, $115$ of the $148$ triples	manifest; labels transferred from the original triples, whose store versions are unchanged; rewrites screened by a word rule and read by an author with disclosed AI assistance	not needed: versions built from the manifest	ground-truth summary	AUROC, paired bootstrap (item and persona)	descriptive registration, no prediction; readings as they came out; the matched metric and the supersession-only comparison post hoc
Long-list check, the lookup’s loss of $0.18$ and the two leads of $0.13$ to $0.14$ (Section 5.2 , Tables 2 and 44 )	$444$ items, $148$ triples, with $60$ -name lists; the $88$ supersession triples registered	manifest; labels unchanged, the store versions unchanged, the list lengthened with the persona’s own names	not needed: versions built from the manifest	ground-truth summary, the superseded-names list padded	pooled AUROC primary and the matched score secondary, both fixed in advance; paired bootstrap (item and persona; triple and persona)	registration committed before the run; two of four predictions held; Opus 5 at one draw
Own-name ablation, $0.86$ to $0.53$ (Section 5.1 )	$661$ , $63$ supersession obligations	manifest; hand-verified	join, for the names removed	ground-truth summary, edited	AUROC, paired bootstrap	registered prediction held
Moved-count control (Section 5.1 )	$60$ counted-state triples	manifest	not needed	ground-truth summary, one count moved	AUROC, paired bootstrap; band reading	descriptive; fired as neither
Tagged view $0.69$ , $0.83$ , $0.81$ (Section 7 , Table 79 )	$661$ , $104$ obligations	manifest; hand-verified	join (ground-truth tags: $82$ of $104$ forbidding records marked); the store’s own tags for the $0.81$ row	ground-truth tags; FR-Bank’s own tags	AUROC, paired bootstrap	L2 predictions failed; the own-tags row descriptive

Appendix

Table 91: Provenance of the headline numbers: the population, the label source, how records are aligned to labels, the tag source the reader saw, the evaluator, and its validation status. “Manifest” is the human-written persona manifest; “join” is the token-overlap alignment of manifest events to stored records at the

0.80

bar; “hand-verified” means every pn label was checked by hand from its constituent judgments.

Artifact	Commit hash	Freeze day	What it froze	Outcome
E0 preregistration	0f2fde2c3b	day 0	pilot universe, labels, summary, prompts, decision rules, bootstrap, leakage; both hypotheses held	held
E0 Amendment 1	d4ef3bee6a	day 0	contamination sensitivity, absence split, PN verification; a method freeze carrying no prediction	no prediction
E0 Amendment 2	c603f4a5ce	day 0	blind-deduplicated sensitivity; a method freeze carrying no prediction	no prediction
E1 preregistration	875f726fab	day 0	taxonomy, tiers, summary source, prompts, decision rules, metrics; all four hypotheses held	held
E1 Amendment 1	307865f414	day 0	two-channel presence control and FR-only NOK scope; a method freeze carrying no prediction	no prediction
Frontier addendum	3c3ef7dd6d	day 0	matched frontier condition and interpretation rule, and three mechanism hypotheses. The two carrying a bar held; the third was registered as descriptive and its reading was not supported, so the registration’s own rule declared the mechanism unresolved	held

Appendix

Table 92: The registration record lists each frozen monitoring artifact, commit, freeze day (day 0 is the first freeze), scope, and outcome. It distinguishes held or failed predictions from N-A method freezes.

Artifact	Commit hash	Freeze day	What it froze	Outcome
Side experiments: name-bearing summary (S1)	e8b2630ce3	day 33	a manifest-built, name-bearing summary for the two structureless stores, the entry map with its hand check, a coverage floor, and two predictions on A-MEM, both of which held; Mem0 fell below the floor and prints as descriptive	held / descriptive
Side experiments: store-written-state cap (S2)	e8b2630ce3	day 33	two filter rules on the store’s own metadata and a precision bar neither reached, so the repair was withdrawn before any call; one descriptive condition, the store-written summary with its fifteen-name cap lifted, carrying no prediction	no prediction
R94: CF-2 store-counterfactual set	f016f033e9	day 33	$148$ question and slot pairs drawn under predicates fixed before any verdict, three store versions each, three summaries, three readers, five predictions and their branch texts; all five held, two of them printing either way: the lookups within tolerance and every reader inside the totals-randomization band; five recorded deviations	held
RESP: mechanism tests	17e6328c81	day 33	the own-name ablation, the retrieved-view and hybrid monitors, and the rubric-gate test on the full obligation population, six predictions and their failure texts: L1-P1 held; L1-P2, L2-P1, L2-P2, L2-P3, L3-P1 failed, all printed	L1-P1 held; L1-P2, L2-P1, L2-P2, L2-P3, L3-P1 failed.
DS: downstream experiment	a5a2036c3b	day 34	six policies over the obligation and coverage scores already on record, their assembled views, reach and abstention, and one answer call per distinct view; five predictions: DS-P3 and DS-P5 held; DS-P1, DS-P2 and DS-P4 failed; two bars set under the 5% premise the study corrected at L2; one prediction unfulfillable by its own gate, recorded as a deviation	held / failed
DS Amendment 4: a view header binding the entries to the persona and pinning the date	fb4b2ca8c8 (file hash)	day 35	the same $452$ views answered once more by GPT-4.1 mini and Haiku 4.5 with a header naming the persona and the current date; the same detector with first-sentence and source columns beside; two predictions on the $65$ licensed items in view, with failure texts	two predictions; both held

Appendix

Table 93: The registration record, continued: the side experiments, the powered counterfactual set, the mechanism tests and the downstream experiment; the Outcome column lists each prediction’s outcome. Every row was committed before its first call except DS Amendment 4 and Graphiti Amendment 2, which are attested by the runner’s lock (file hashes shown).

Artifact	sha256 (first bytes)	Freeze day	What it froze	Outcome
Q4: the marker read as absence	8b6ee9e3	day 34	one instruction line appended to the otherwise unchanged structureless summaries; the recorded coverage items of both stores; the paired differences against the recorded intact and blind rows (Table 64 )	no prediction
DS Amendment 1: the gate elicited under the all-states summary	72ab84da	day 34	GPT-4.1 mini’s obligation score re-elicited under the summary naming all three states on the $661$ ; one further policy reading it; the counted-state reach beside the recorded gate (Table 81 )	no prediction
List-length padding	93e33022	day 34	the superseded-names list of each of the $661$ summaries padded with correct attribute names to $15$ , $30$ and $60$ ; both lookups and GPT-4.1 mini at each length, paired against the $1.75$ -name row; three branches enumerated	no prediction
Paraphrased counterfactual set	45cad63d	day 34	each of the $148$ questions rewritten to share no content token with the slot path or any printed name, screened and read by us; both lookups and three models on the same store versions, paired against the originals; four branches enumerated	no prediction; run on day $42$ on the $115$ accepted pairs (Table 38 )
Paraphrased counterfactual set: the dated notes and the amendment	2848f1ad (the whole file)	day 42	below the registered text’s marker, dated and never editing the text above: the read disclosed as AI-assisted (an assistant flagged rows with reasons and a coding session printed persona evidence; every verdict an author’s); the floor amended from $120$ to the $115$ accepted pairs before any scoring call, with the $124$ screen-passing pairs as a sensitivity analysis, not registered; GPT-5.6 Luna and GPT-5.6 Sol added as readers, not registered, declared after the lookup result and before any model result	no prediction
Expiry extension of the counterfactual set	2f555c1a	day 35	the $14$ eligible expiry pairs the counterfactual draw left undrawn, fixed by the candidate census ( rows/cf3/CF3_CENSUS.md in the artifact); the same construction, renderer, leakage screen and readers; a pooled expiry row with the $444$ ’s $30$ pairs (Table 54 )	no prediction

Appendix

Table 94: The registration record, continued: twelve descriptive registrations, each hashed by the runner before its first call (the commits of day 39 do not date them) and carrying no prediction and no bar, so nothing in them could hold or fail. Every one has run; the paraphrase check ran last, on the pairs an author’s read accepted, and its dated notes and amendment are the row below it.

Artifact	Commit hash	Freeze day	What it froze	Outcome
Graphiti, three personas: the ingestion trial and its readings	f2d7688a54	day 20	the unmodified release on three personas, its census, and five readings written before any run and read at forty personas: two with a bar, that the obligation gain under the store-written summary excludes zero and that the superseded-names lookup sits within tolerance of the model or above it; one uncomputable on that population; two descriptive (Appendix G.4 )	GR-1 (the gain) failed, GR-2 (coverage) not computable, GR-3 (the lookup) held, GR-4 and GR-5 descriptive, all read at forty personas
Moved-count control, Amendment 1: Opus 5 at five draws	177697a4ae	day 40	Opus 5 at five draws on the moved-count texts against its recorded five-draw row; one prediction, that the one-draw movement on retraction and expiry replicates reliably (Table 17 )	held
Moved-count control, Amendment 2	b0bee9329d	day 40	GPT-5.6 Sol and GPT-5.6 Luna at five draws against their five-draw rows; one prediction, that each falls reliably on both counted states (Table 17 )	failed for both on retraction
Names against counts on the counterfactual set	177697a4ae	day 40	the default summary with its counts removed and with its names removed, GPT-4.1 mini and Haiku 4.5 against their recorded one-draw and five-draw rows; two predictions, that names only sits within tolerance of the recorded row and that counts only falls reliably below names only, and one descriptive reading (Table 18 )	both held
The marker ablation on the structureless stores	177697a4ae	day 40	the constrained rendering with its marker omitted and reworded, GPT-4.1 mini on both stores and GPT-5.6 Luna through the raw API; one prediction, that the coverage loss disappears under the neutral wording, and one descriptive reading (Table 67 )	failed on Mem0, held on A-MEM
DS Amendment 8: label propagation inside the view	177697a4ae	day 40	a view-only rule propagating a tagged line’s tag to same-attribute lines that repeat it, under ground-truth and own tags; five predictions on the views changed, false propagation and the flagged rate (Table 86 )	one held (false propagation under ground-truth tags at most $5\%$ ); three failed; one not defined

Appendix

Table 95: The registration record, continued: the fourth backend’s frozen readings, the five registrations of the counterfactual and downstream follow-ups, the intent crossover, the four registrations of the encoder, draw, rubric and reach checks, and the hybrid reader; the Outcome column lists each prediction’s outcome, and a prediction registered after an interim read of other models’ rows is labelled so. Every row was committed before its first call.

Artifact	Commit hash	Freeze day	What it froze	Outcome
The sibling-name control	5cd8f809f2	day 41	a fourth store version per supersession pair with a same-category sibling in place of the target’s name, the name lookup, five models, the random-token lookup and the count reader on the matched pn -against-sibling comparison (Table 36 ); four readings with a bar, two of them (P-SB1, P-SB3) disclosed at the freeze as recorded values from the scorer’s dry run and not counted as predictions	P-SB2 (every model at or above $0.80$ ) and P-SB4 (no model reliably above the lookup) held; P-SB1 and P-SB3 as recorded
Names against counts, Amendment 1: the three stronger models	5cd8f809f2	day 41	E2’s names-only and counts-only renderings on Opus 5, GPT-5.6 Luna and GPT-5.6 Sol (Table 19 ); three predictions: names only within tolerance of the intact row, counts only reliably below names only, counts only above $0.50$ on both counted states under the matched metric; Sol’s lane dropped by the registration’s own budget rule	the first failed on GPT-5.6 Luna and held on Opus 5; the second held on both; the third failed on both; not evaluable on Sol
The long-list check on the counterfactual set	06c611f	day 43	the $444$ items’ superseded-names lists padded to $60$ names, one pad per triple drawn from the persona’s own printed attribute names, the three lookups and the five models at their Table 1 settings (Opus 5 at one draw against its recorded five-draw row), pooled AUROC primary and the matched score secondary on the supersession triples (Table 44 ); four predictions: each of GPT-5.6 Luna, GPT-5.6 Sol and Opus 5 reliably above the lookup (P-L1), neither GPT-4.1 mini nor Haiku 4.5 reliably above it (P-L2), the lookup reliably losing more than $0.05$ against its unpadded row (P-L3), each of the three stronger models losing less than the lookup (P-L4)	P-L2 and P-L3 held; P-L1 and P-L4 failed on Opus 5 alone, Luna and Sol as predicted
The sibling-name control at $60$ names	f224177	day 44	the $88$ supersession pairs’ padded pn version against a fourth version with one name swapped (identical pad and counts), the no-model readers recorded before the freeze, GPT-5.6 Luna, GPT-5.6 Sol and GPT-4.1 mini at five draws (Table 53 ); four predictions: Luna reliably above the name lookup (P-S1), Sol reliably above it (P-S2), mini not reliably above it (P-S3), Luna and Sol at or above $0.80$ matched with the persona interval above $0.50$ (P-S4)	P-S2, P-S3 and P-S4 held; P-S1 failed

Appendix

Table 96: The registration record, continued: the sibling-name control and the names-against-counts amendment on the three stronger models, both registered after the matched metric had been read, the long-list check on the counterfactual set, registered after the paraphrase check had been read, and the sibling-name control at

60

names, registered after the long-list check had been read; the Outcome column lists each prediction’s outcome. Every row was committed before its first call.

Figure 5: Reliability diagram for the pooled hard tier (bins with

n\geq 10

). The indexed conditions rank well (Spearman

\rho=0.9000

intact,

1.0000

names-only) and scale badly (mean predicted

0.217

against observed

0.056

, about

3.9\times

over-confident), while the blind condition neither ranks (

\rho=0.1026

) nor calibrates: the elicited number behaves as a ranker rather than a probability.

Reader, summary	flagged, whole	flagged, by state	unflagged, whole	unflagged, by state
Name lookup (sup. only)	$0.7142$	$0.9047$ / $0.5000$ / $0.5000$	$0.8668$	$0.9789$ / $0.5000$ / $0.5000$
All-states lookup (all three)	$0.8232$	$0.8675$ / $0.7583$ / $0.8450$	$0.9718$	$0.9751$ / $0.9102$ / $1.0000$
GPT-4.1 mini, sup. only	$0.6539$	$0.7640$ / $0.5000$ / $0.5455$	$0.8355$	$0.9244$ / $0.5859$ / $0.5625$
GPT-4.1 mini, all three	$0.7315$	$0.7859$ / $0.8605$ / $0.5150$	$0.9125$	$0.9145$ / $0.9492$ / $0.8594$
Haiku 4.5, sup. only	$0.6887$	$0.8288$ / $0.5527$ / $0.5713$	$0.8532$	$0.9417$ / $0.5273$ / $0.6094$
Haiku 4.5, all three	$0.8091$	$0.8037$ / $0.8673$ / $0.7608$	$0.9631$	$0.9571$ / $0.9922$ / $0.9922$

Appendix

Table 97: Obligation AUROC on the counterfactual set by whether the question names the plan or value its attribute is about (

89

flagged questions,

n=267

;

59

unflagged,

n=177

), whole and by lifecycle state (supersession / retraction / expiry), for the two lookups on their own summaries and the three models under each summary. Every reader scores higher on the unflagged half. Exploratory: post hoc, no prediction, no interval.

Population	lookup, slice	ground-truth	all faults	missing names	wrong names	length
Counterfactual set ( $444$ )	embedding, whole set	$0.7663$	$0.5005$	$0.6010$	$0.2943$	$0.1047$
Counterfactual set ( $444$ )	embedding, supersession	$0.9223$	$0.5200$	$0.5826$	$0.1892$	$0.2282$
Counterfactual set ( $444$ )	lexical, whole set	$0.6698$	$0.4949$	$0.5682$	$0.3753$	$0.0565$
Counterfactual set ( $444$ )	lexical, supersession	$0.7829$	$0.5371$	$0.6590$	$0.2423$	$0.0987$
Full population ( $661$ )	embedding, whole set	$0.7442$	$0.6096$	$0.8127$	$0.4167$	$-0.2294$
Full population ( $661$ )	embedding, supersession	$0.9599$	$0.6593$	$0.6423$	$0.1675$	$0.1902$

Appendix

Table 98: The lookup’s loss under FR-Bank’s measured faults, decomposed after the fact. Each row gives the ground-truth-list score, the score with all three faults injected at the store’s measured rates (length

15

, contamination

0.232

, recall

0.3604

), and the Shapley share of the loss attributed to each fault; shares sum to one, and a negative share is a credit. Post hoc; no prediction.

Census	$n$	recovered	stale-active	extraction miss	recall (bands $0.50$ / $0.75$ )	precision
Manifest supersession events	$109$	$20$	$12$	$77$	$0.1835$ ( $57$ / $35$ of $109$ )	$35$ of $807$ , $0.0434$
Forbidding records, obligations of the full store (the main-text reading)	$34$ of $47$	$13$	$10$	$11$	$0.3824$	$54$ of $807$ , $0.0669$
the same over distinct forbidding-record sets	$39$ of $56$	$16$	$11$	$12$	$0.4103$	the same
Forbidding records, all $104$ obligation rows (the prediction’s population)	$74$ of $104$	$30$	$21$	$23$	$0.4054$ ( $48$ / $36$ of $74$ ); $0.3846$ over the $78$ by attack vector	the same

Appendix

Table 99: The forty-persona Graphiti census against the manifests. Recall is the share of ground-truth events, or forbidding records, on which some Graphiti edge asserting the old content carries a non-active state under the mapping above; stale-active means such an edge exists and every one is active; extraction miss means no edge asserts the content at the

0.80

overlap bar. Precision is over all

807

non-active edges of the forty graphs and is unchanged by the population. Retraction is inexpressible on this backend, so the eight obligations the ground truth marks retracted enter no recall.

Input or reader	NOK AUROC	Contrast and standing
Store-written summary, capped	$0.5765$	Minus ground truth $-0.1659$ : $[-0.2593,-0.0764]$ ; $[-0.2533,-0.0876]$ . P2 holds.
Store-written summary, lifted	$0.6511$	Descriptive; the lifted name cap is $1{,}000$ .
Ground truth on Graphiti’s schema, capped / lifted	$0.7556$ / $0.6958$	Descriptive schema controls.
Ground-truth summary / question only	$0.7424$ / $0.4964$	Recorded comparators on the same population.
Store’s superseded-name lookup	$0.6780$	Minus capped monitor $+0.1014$ (from the unrounded scores): $[+0.0102,+0.2086]$ ; $[+0.0094,+0.1988]$ . P3 fails; GR-3 holds.
Whole-map lookup, capped / lifted	$0.6994$ / $0.7959$	Descriptive whole-map matcher.

Appendix

Table 100: Completed Graphiti monitoring on

323

full-store questions,

47

positive obligations. GPT-4.1 mini, one call per input; the name lookup uses the local embedding matcher. Paired intervals are item-level first, then persona-grouped. These are monitoring results, not final-answer improvements.

Obligations	$n$	store-written capped	store-written lifted	store’s name lookup	whole-map lookup	five edges untagged	native tags	tagged + summary	FR-Bank top-five	FR-Bank ground truth
all $47$ (the printed rows)	$47$	$0.5765$	$0.6511$	$0.6780$	$0.6994$	$0.6995$	$0.6854$	$0.7741$	$0.6991$	$0.7424$
retained at $0.80$ (recovered or stale-active)	$23$	$0.6920$	$0.7043$	$0.7350$	$0.5983$	$0.6360$	$0.6159$	$0.7307$	$0.6160$	$0.8433$
recovered (a non-active mark on the edge)	$13$	$0.7304$	$0.7156$	$0.7776$	$0.5923$	$0.6579$	$0.7131$	$0.8625$	$0.6211$	$0.8350$
stale-active	$10$	$0.6422$	$0.6897$	$0.6797$	$0.6062$	$0.6076$	$0.4897$	$0.5594$	$0.6094$	$0.8540$
extraction miss	$11$	$0.4559$	$0.7574$	$0.6574$	$0.8337$	$0.6354$	$0.6313$	$0.7413$	$0.7724$	$0.7624$
retained at $0.75$	$28$	$0.6489$	$0.7316$	$0.7081$	$0.6447$	$0.6573$	$0.6424$	$0.7483$	$0.6594$	$0.8467$

Appendix

Table 101: The rows of Table 100 re-scored on strata of the

47

full-store obligations, the

276

negatives unchanged (post hoc; the edges read once from the forty graphs). Of the

34

superseded-or-expired obligations the alignment marks, the graph retains the forbidding content for

23

at the

0.80

overlap bar (

13

recovered, a non-active mark on a firing edge, and

10

stale-active) and never extracted it for

11

;

28

and

32

are retained at the

0.75

and

0.50

bars; the

4

retraction-derived obligations are inexpressible under the mapping and the

9

the alignment does not mark have no stratum. On the

23

retained, the capped store-written summary reads

-0.1512

against the FR-Bank ground-truth summary on the same items with intervals

[-0.2866,-0.0160]

and

[-0.2807,-0.0274]

, still a reliable loss, and the store’s own name lookup

-0.1082

(

[-0.2383,+0.0369]

;

[-0.1947,+0.0007]

); on the

13

recovered the capped summary reads

-0.1047

(

[-0.2913,+0.0921]

;

[-0.2905,+0.0803]

), not reliable at that size.

Condition	GPT-4.1 mini	Haiku 4.5
Repaired top five	$9/5$	$11/5$
Obligation-gated stale fetch	$8/5$	$10/3$
Obligation-gated successor assembly	$9/5$	$11/5$
Successor assembly without obligation gate	$10/4$	$12/4$
Matched depth	$7/6$	$11/5$

Appendix

Table 102: Provisional automated outcomes on the fixed

31

-question repair sample. Strict correct / consequential stale endorsement; historical mention alone is not endorsement. All five conditions retain the common coverage gate. No registered human endpoint is replaced.

LLM Agent Memory

Large language model agent memory lets agents retain, organize, retrieve, and update information across interactions and long-running tasks.

See all 373 papers

May 6, 2026

Storage Is Not Memory: A Retrieval-Centered Architecture for Agent Recall

Extraction at ingestion is the wrong primitive for agent memory: content discarded before the query is known cannot be recovered at retrieval time. We propose True Memory, a six-layer architecture that shifts the center of the system from a storage schema to a multi-stage retrieval pipeline operating over events preserved verbatim. The full system runs as a single SQLite file on commodity CPU with no external database, vector index, graph store, or GPU. On LoCoMo (1,540 questions across 10 multi-session conversations), True Memory Pro reaches 93.0% accuracy (3-run mean) against 61.4% for Mem0, 65.4% for Supermemory, approximately 71% for Zep, and 94.5% for EverMemOS under a matched gpt-4.1-mini answer model. On LongMemEval (500 questions), True Memory Pro reaches 87.8% (3-run mean). On BEAM-1M (700 questions at the 1-million-token scale), True Memory Pro reaches 76.6% (3-run mean), above the prior published result of 73.9% for Hindsight. A 56-configuration ablation shows a 1.3-percentage-point spread within the top-performing configuration family.

Joshua Adler, Guy Zehavi

Sauron Labs

Agent Memory LLM Agent Memory Persistent Memory for Language Models Long-Term Conversational Memory Agent Memory Management

Ask PDF

Oct 23, 2026

FlexA-Mem: Budget-Adaptive Agentic Memory for LLM Agents

Large language model (LLM) agents work in scenarios with very different memory needs. A question about past conversations needs the exact facts it names, while a multi-step task needs a trace of the steps already taken together with details that the next step cannot name. Existing memories are each designed and tested for one kind of scenario. Retrieval memories such as A-Mem miss steps that the current query does not express, summaries drop exact strings, and pairing the two fixes the split of the budget in advance. We propose FlexA-Mem, a general memory that writes each unit of history once into an immutable store and renders a fresh memory for every call. The rendered memory is a compact timeline of records plus detail that a fixed rule fits into the remaining room without an LLM call. The detail is either relevant units as raw text or excerpts or the verbatim pieces that best match the query. With one store, FlexA-Mem serves both kinds of scenario. On AppWorld challenge tasks at 4k, it outperforms the second-best method by 11.5%, and on 147 unused tasks with predictions fixed in advance it outperforms A-Mem with a summary by 12.2%. On LongMemEval and LoCoMo, it matches a dedicated keyword retriever that writes no memory, while memories built on text written by an LLM fall far behind at tight budgets. Ablations show that the timeline carries AppWorld completion, whereas recovery mainly saves steps there and decides accuracy on exact facts. Code is available at https://github.com/WujiangXu/Flex-Amem

Wujiang Xu, Jiaojiao Han, Xi Zhu +5

Rutgers University · Independent Researcher · Stanford University +2

Memory Management for LLM Agents Long-Term Conversational Memory Long-Horizon LLM Agents

Ask PDF

Sep 28, 2026

Mnemon: Raw Records, Fast Judgments, Slow Thoughts

Long-term memory lets an LLM assistant use a history it can no longer reread, and most memory systems build it by rewriting conversations into facts, graphs or typed memories at write time. We argue that the work of memory divides, as thinking does, into two systems. Most of it is fast System 1 work: many small, independent yes/no judgments about records, such as whether a record is needed or no longer current, which a decision model makes by the dozen in a third of a second. Only a little is slow System 2 work: writing a few search queries, naming what the reply needs and composing the answer, which an LLM does well but slowly. We present Mnemon, a memory agent built on this division. It keeps conversations as raw, dated records; an LLM (System 2) plans searches over them, a decision model, Jev (System 1), judges what the searches return, and rules with explicit budgets turn the judgments into a small View for an unchanged answering model. A background pass consolidates each record once into topic timelines, value histories and standing instructions linked to the records, so that questions about a whole conversation reach evidence their own searches miss. Because nothing is decided about a record when it is written, the same agent can read any store that returns dated records. With gpt-4.1-mini answering, as in a public re-evaluation of 14 systems, Mnemon scores 91.7% on LoCoMo, the highest among them, and 83.8% on LongMemEval-S, from under 4k tokens of context per question, with the lowest effective cost index on LoCoMo. With a reasoning model answering, it reaches 92.2% on LoCoMo and 94.4% on LongMemEval-S, the latter on par with the best published results. From 100K to 10M tokens of history on BEAM, its cost per question grows by a factor of 1.11. On the same records, Jev separates gold evidence better than two LLMs and is 3-11 times faster.

Guangren Wang

Persistent Memory for Language Models Memory Agent Benchmarks Long-Term Conversational Memory Agent Memory Management Memory-Augmented Language Model Agents Memory Management for LLM Agents

Ask PDF

Abstract

LLM Agent Memory

Explore similar work

Storage Is Not Memory: A Retrieval-Centered Architecture for Agent Recall

FlexA-Mem: Budget-Adaptive Agentic Memory for LLM Agents

Mnemon: Raw Records, Fast Judgments, Slow Thoughts