MemTX: Transactional Belief Commit for Stateful Agent Memory

1 Introduction

• Existing memory systems focus on storage and retrieval, treating accepted writes as truth even when they may become premises for refunds, bookings, or emails.The paper distinguishes recording an observation from committing a belief and identifies six state-corruption families.Source: §1 · p. 1
• MemTX stages writes in snapshot-isolated transactions, validates and commits beliefs, gates irreversible calls on in-flight state, and repairs derived records and tool effects after retraction.Records carry evidence, permissions, provenance, and validity, and mature from tentative to action-safe.Source: §1 · pp. 1–2
• The protocol's two invariants—action-safety gating and cascade-repair completeness—were machine-checked over 5.5 million states with zero violations.The strong gating form is scoped to external-action transactions.Source: §1 · p. 2
• The evaluation uses a 90-task suite across six corruption families, with paired traps and controls, fidelity-audited baselines, and a downstream harm pipeline, plus a hardened 56-case extension.The design measures whether methods avoid over-blocking as well as unsafe actions.Source: §1 · p. 2
• Across five backbones, MemTX ranks first on every open backbone and seed, is significant against all eight baselines in pooled paired tests, and ties the best baseline on the strongest closed backbone while alone preserving zero downstream harm.The introduction reports significance at p below 0.00001.Source: §1 · p. 2

Agent and multi-agent memory

• Agent-memory systems often resolve competing writes with last-writer-wins or LLM-judge merges, without isolation levels or a commit contract; shared-memory governance adds a trust ladder but no transactional commit protocol.Multi-agent surveys identify memory consistency and access control as open problems [Yu et al., 2026, Wu and Shu, 2026].Source: §2 · p. 2

Transactions and concurrency for agents

• Semantic transactions around tool effects, verified concurrency, and SAFEFLOW address execution state, but not the full combination of belief lifecycle, semantic conflict, permissions, and typed repair.Chen et al. [2026] transact external tool effects; Khan [2026] provides content-agnostic consistency and cascade verification; SAFEFLOW [Li et al., 2025] gates by security label.Source: §2 · p. 2

Memory-state governance and access control

• MemState revises dependent topics in a single-tenant abstraction, while Collaborative Memory and GateMem use retrospective permission filters that do not propagate private-source restrictions to derived beliefs.Collaborative Memory [Rezazadeh et al., 2025] and GateMem [Ren et al., 2026] lack rollback for this laundering gap.Source: §2 · p. 2

Semantic contradiction and belief revision

• TOKI [Wang, 2026] is credited with full write-time adjudication, but its experiments lack agent principals and its recovery lacks dependency tracking; STALE [Chao et al., 2026] isolates implicit conflicts.An implicit conflict occurs when a later observation invalidates an earlier memory without explicit negation.Source: §2 · pp. 2–3

Adjacent lines

• Adjacent work covers single-writer temporal supersession, read-time RAG conflicts, memory poisoning, and classical database isolation and transaction models.Examples include temporal-validity memories [Rasmussen et al., 2025, Yadav, 2026, Ganesan, 2026, Tan et al., 2026] and RAG conflict work [Xu et al., 2024, Liu et al., 2025].Source: §2 · p. 3

3 The MemTX Protocol

• MemTX provides a model-agnostic state machine that makes recording an observation, committing it as a belief, acting on it, and repairing it after retraction distinct steps.Figure 1 depicts admission and repair as linked pipelines through a derivation DAG.Source: §3 · p. 3, Figure 1 · p. 4

3.1 Data Model and Belief Lifecycle

• Each governed record carries source authority, permissions, derivation links, type, validity interval, and writer confidence, and moves through a fixed eight-state lifecycle from raw to action-safe or a branch state.The branch states are quarantined, superseded, and revoked.Source: §3.1 · p. 3

3.2 Transactions and the Commit Pipeline

• Transactions capture a risk-tier-mapped snapshot; staged writes remain tentative, and commit checks evidence, validity, semantic conflict, and dependency stability in order.Passing records become committed, and become action-safe only in external-action transactions; a transaction may partially commit or abort.Source: §3.2 · p. 3

3.3 Gating Irreversible Actions

• The action gate blocks irreversible calls when tentative state is in flight, and external-action transactions also require an action-safe record in their snapshot.Blocked calls return a reasoned refusal; reversible tools are not gated by design.Source: §3.3 · pp. 3–4

3.4 Typed Cascading Repair

• Abort and revocation share a repair routine that walks transitive descendants and dispatches by type, revoking beliefs, quarantining views, and compensating reversible actions or logging irreversible leaks.Repair covers only recorded provenance; compensation is a decision-level obligation, and tool reversibility is statically designated.Source: §3.4 · p. 4

3.5 Invariants and Machine Verification

• I1 gates irreversible actions and I2 makes every non-terminal descendant inactive after retraction; G3 rules out committed or action-safe records with revoked ancestors.Property-based tests and bounded enumeration covered 5,530,160 canonical states and 10,537,260 transitions with zero violations; verification exposed a transaction-abort cascade defect retained as a regression test.Source: §3.5 · pp. 4–5

3.6 Agent Integration

• The agent-facing interface maps five memory tools to reading, staging, committing, aborting, and revoking, while domain tools pass through the action gate.Source: §3.6 · p. 5

Test scenarios

• The 90-case conformance suite scripts concurrent writers, logical time, and ground truth for commits, actions, and retractions across six corruption families, pairing 60 traps with 30 controls.Public suites do not script shared-store concurrent writers or pair traps with controls.Source: §4 · p. 5

Hardened suite

• The hardened 56-case extension chains corruptions across families in 40 traps and includes 16 controls that require legitimate tool use, with traps designed to survive repair-and-retry behavior.Its cases make individual protocol components load-bearing and prevent blanket refusal from scoring well.Source: §4 · p. 5

Baselines

• Nine methods share one memory-manager interface, including five faithful system reimplementations and three variants that graft one MemTX feature onto selected baselines.The official MemState implementation also runs through the shared interface as a check on its reimplementation.Source: §4 · p. 5

Backbones, tool environment, and grading

• The study evaluates five backbones from three model families using five memory tools and eleven deterministic domain tools, six irreversible; a rule-based grader measures required commits, actions, retractions, permissions, safety, over-abstention, and cost.The downstream pipeline replays committed beliefs into 24 refund episodes and scores realized harm rather than proxy accuracy.Source: §4 · p. 5

Reliability controls

• The memory manager is the only variable, with identical runner, prompts, tools, and case schedule; campaigns use three seeds and pooled paired McNemar tests.Serving drift is measured at at most 0.022 task success, so ablation deltas use same-session anchors.Source: §4 · pp. 5–6

Downstream harm

• Zero downstream harm on every backbone makes MemTX the only method with that outcome; on GPT-5.5 it completes all episodes, while the tied variant has 0.25 harm.Across the 24-episode pipeline, rollback recall is 1.0 on four backbones and 0.96 on the capability floor.Source: §5 · p. 6

Scope blind spots

• Every method fails the source-scope cases; on three backbones, retries after stale-write aborts also erase the staleness axis, exposing protections bounded by a commit or transaction.Transcription can omit parent provenance, while a fresh retry snapshot can make a late write appear current.Source: §5 · p. 6

Main suite

• On 90 cases, MemTX ranks first on four backbones; 39/40 baseline comparisons survive Holm correction, while GPT-5.5 ties Cordon with cascading revocation, 0.756 vs 0.778.The task-success comparison is at temperature zero; MemTX also intercepted every forbidden action and had zero dirty reads, with permission enforcement 0.889 on GPT-5.5 and 1.0 elsewhere.Source: §5 · p. 6, Table 2 · p. 7

Hardened suite

• On the hardened suite, GPT-5.5 scores 0.929 for MemTX versus 0.768 for the best single-feature variant; all 32 comparisons on four strong backbones are significant.All 16 controls pass on strong backbones, so the margin is not bought with refusal.Source: §5 · p. 6, Table 3 · p. 7

Pricing the strong gate

• On matured stores, strong-gate mappings are statistically indistinguishable from their anchors; on cold stores, availability costs at most four main-suite cases.The mappings tested were all-forced external-action risk and intent-based external-effect cases.Source: §5 · p. 7

Ablations

• About 11 task-success points are lost when semantic-conflict adjudication, permission inheritance, or cascading rollback is removed; other components matter on targeted hardened families.Figure 3 assigns action-gate, visibility-scoping, and snapshot-read removals to distinct hardened families; dependency stability and typed repair remain within one case of the anchor when ablated.Source: §5 · pp. 6–7, Figure 2 · p. 8, Figure 3 · p. 8

Cost and isolation

• Latency stays within the baseline band, while tokens exceed it by up to 14% on three backbones; raw-read isolation yields 0.689 task success and 0.11 dirty reads per case.Settings from committed reads upward score identically on the scripted suite.Source: §5 · p. 8

6 Conclusion

• MemTX makes the distinction between a memory write and a belief commit operational through a staged, maturity-gated lifecycle.Source: §6 · p. 8

A.1 Sweep Design

• The scripted-path sweep varies the confidence threshold from 0.3 to 0.8 and the authority bypass from 0.8 to a setting that disables bypassing.Source: §A.1 · p. 11
• The sweep certifies the scripted path, while the LLM path draws confidences from the same value grid.Source: §A.1 · p. 11

• 0.3 through the default 0.6 leaves every safety metric unchanged on both suites and for every bypass setting.Source: §A.2 · p. 11
• 13 verifier calls on the main suite and 10 on the hardened suite make the low-end threshold’s contribution cost ordering within defense in depth.No record has confidence below 0.3, and both comparisons are inclusive, so that setting is equivalent to removing the check.Source: §A.2 · p. 11
• Above 0.6, the main suite begins to over-block at the next occupied confidence-grid point, 0.62, while the hardened suite stays flat across the full range.Source: §A.2 · p. 11

B.1 Backbone Serving

• Accepted closed-backbone campaigns resolve to one dated model snapshot across all cases and methods; a routing-endpoint campaign was excluded after logs showed four distinct models.Source: §B.1 · p. 11

B.2 Deterministic Tool Environment

• Fixed outputs for fixed arguments make repeated tool trajectories produce the same graded outcome; only unscored call identifiers and timestamps vary.Source: §B.2 · p. 11

B.3 Hardware and Pinned Stack

• Open-backbone runs use one 48 GB NVIDIA L40 GPU with pinned software versions, while scripted suites, evaluation, invariant checking, and tests run CPU-only.Source: §B.3 · p. 11

• On a stable matured store, forcing every transaction to the external-action tier stays within one case of the anchor on four strong backbones, without more over-abstention or downstream harm.On a cold store, the hardened suite loses 13 to 17 cases on every backbone; the strict gate is an enforceable floor whose price depends on store maturation.Source: C Pricing the Strong Gate · p. 11
• Single-component attribution cannot reveal redundant pairs, and four cases per hardened trap family are too few for per-family significance.The source-scope family stays at zero under every removal, placing that gap between components rather than within one component.Source: C Pricing the Strong Gate · p. 12
• Across four further removals, seven of eight LLM suite-backbone pairs reproduce their anchor case for case, while typed dispatch adds audit records rather than changing suite metrics.The table reports task success against each run’s same-session anchor; removing the evidence gate leaves task success unchanged while conflict adjudications rise from 117 to 130 on the main suite and 98 to 108 on the hardened suite.Source: Table 5 · p. 12, C Pricing the Strong Gate · p. 12
• On four strong backbones, selective task-intent tiering over a matured store stays within one case of its anchor on both suites and reproduces four of eight suite-backbone pairs case for case.The selective mapping marks 26 main-suite and 20 hardened-suite prompts that name an irreversible tool.Source: Table 6 · p. 12, C Pricing the Strong Gate · p. 12

D Seed and Temperature Robustness

• All 24 pooled paired comparisons were significant across 270 case pairs per model; the weakest pair, Qwen2.5-14B versus Collaborative, had 31 discordant wins to 4.The open-backbone campaign ranked MemTX first in all nine model-and-seed combinations.Source: D Seed and Temperature Robustness · p. 12
• The campaign reran three open backbones at temperature 0.7 with three seeds; closed backbones ran once at temperature zero and were not covered.Within-method standard deviation was at most 0.023 for every method.Source: D Seed and Temperature Robustness · p. 12
• Holm correction and the case-clustered rerun changed no conclusions, despite the pooled test treating pairs across shared case templates as exchangeable.Each of the 72 single-seed tests was also individually significant.Source: D Seed and Temperature Robustness · p. 12, Table 8 · p. 13
• Under the forced external-action tier, the task-success change stayed within the anchor’s noise band on matured stores, while cold-store availability costs deepened with chain depth.The table compares results against same-session anchors.Source: Table 7 · p. 13

E Extended Safety and Availability Metrics

• MemTX was the only method with zero realized downstream harm in every method-and-backbone column.The downstream pipeline replays committed beliefs into refund episodes and scores realized harm.Source: E Extended Safety and Availability… · p. 13
• On the main suite at temperature zero, five baselines without repair had 0.833 rollback recall on every backbone, while only the two cascade carriers reached 1.0 on four backbones.MemState’s revision re-evaluation reached 0.915 to 0.926.Source: E Extended Safety and Availability… · p. 13
• Permission enforcement reached 1.0 everywhere except GPT-5.5 for the two cascade carriers, while legitimate-action allow rates spanned 0.911 to 0.978.The allow-rate range indicates the reported safety numbers were not bought with refusal.Source: E Extended Safety and Availability… · p. 13

F Cost

• All 24 pooled paired comparisons across 270 case pairs per model were significant.The seed campaign used three seeds at temperature 0.7; the accompanying table reports mean and standard deviation for the open-backbone suite.Source: Table 10 · p. 13, Table 9 · p. 13

G Isolation-Level Sweep

• Raw reads lost eleven points of task success and admitted 0.111 dirty reads and invalid activations per case; every leveled setting from committed reads upward matched on quality metrics.The sweep pinned each transaction’s reads to one level on the scripted 90-case main suite; leveled settings differed only by a fraction of a millisecond in scripted latency.Source: G Isolation-Level Sweep · p. 13, Table 14 · p. 15

H.2 Domain Coverage

• The 90 main-suite cases covered ten application domains, ranging from 7 social cases to 11 travel cases; the hardened suite used the same domains.Counts merge domain spellings that vary in the case files.Source: §H.2 · p. 14

H.3 Case Schema and Ground Truth

• Each case file specifies its corruption family, domain, trap/control status, agent setup, schedules, initial store, and ground truth; task success conjuncts five required axes.The axes are correct committed beliefs, no forbidden action fired, all required actions and retractions completed, and permission rules held.Source: §H.3 · p. 14

H.4 A Worked Example

• A shared investor-facing risk score derived from private underwriting records is blocked because commit-time permission inheritance checks the relation between parent and child scopes.The ground truth requires the score to be aborted or superseded and a permission block for a private source in a shared target.Source: §H.4 · p. 14

H.5 Scale

• Main-suite cases used one to three agents and one to four turns, with two agents and two turns at the median; concurrency came from interleaved turns over a shared store.Source: §H.5 · p. 14

F Cost

• MemTX latency stayed within the baseline band on every backbone, while it alone incurred verifier calls, 1.36 to 1.58 per case.Every baseline had zero verifier calls; conflict adjudication is the protocol’s metered cost.Source: F Cost · p. 13, Table 13 · p. 15

H.1 Suite Composition

• Each of the six main-suite corruption families had ten traps and five controls; the hardened suite instead weighted compound families by their available crossings.The hardened set also included six deep-chain revocation traps and 16 controls distributed across compound behaviors.Source: §H.1 · pp. 13–14, Table 15 · p. 15