Research / Context integrity
Same question, same facts, two stores. One guesses; one knows. Every number here is from a run you can reproduce.
Real accumulated memory always contains conflicts: a vendor emails an updated price, an agent noted the old one last week, a human made a call. When an agent answers from that store, the whole game is whether it can tell which fact to trust. Recall isn’t the problem, every store can hand the facts back. Resolution is: given three answers, which one is right?
A conflict pairs a subject with several competing values at different provenance tiers, exactly one correct. Ground truth is ours, seeded like the pointer run. The two stores hold the identical facts; the only difference is whether each fact carries its provenance tier.
One honest rail decides the whole demo: in every conflict, the wrong answer is the most recent fact. That’s not stacking the deck, it’s how real data behaves, an agent’s fresh guess arrives after the older verified email. Recency is the flat store’s only tiebreaker, so it confidently picks wrong.
Acme invoice total this month? (truth: $4,500) [agent] $4,200 recorded 3d ago <- newest, wrong [email] $4,500 recorded 9d ago guard-verified [human] "use the billing email" the owner's decision
Each store resolves a conflict with the only information it has. Flat store: no tiers, so the sole tiebreaker is recency, take the newest fact. Under the adversarial-but-realistic seeding (the newest fact is the least authoritative) that rule is wrong every time. Provenance store:a fixed trust order, human decision > verified email > agent assertion, with recency breaking ties only within a tier. Both are twenty-line functions over the facts, no model, so the result is a property of the store, not a prompt.
Depth. A depth-d conflict has d competing values across d tiers, exactly one correct. The flat recency rule always picks the newest (wrong), so its accuracy is 0 at every depth; a fairer random tiebreaker would score 1/d; the provenance rule always picks the top tier, so it is 1. The measured points sit exactly on those lines.
Density. Take a store of N facts where a fraction ρ are in conflict. Answering N questions, the non-conflicting 1−ρ are right in both stores; the conflicting ρ are right in the provenance store and wrong in the flat one. That gives two derived lines:
A_flat(rho) = (1 - rho)·1 + rho·0 = 1 - rho A_prov(rho) = (1 - rho)·1 + rho·1 = 1
The flat store degrades linearly with how much of its memory conflicts; the provenance store is flat at 100%. Every measured point (N=40) lands on its derived line:
This is the paper’s headline because it can’t wobble: it’s exact, model-free, and the measurement confirms a formula rather than reporting a vibe. The extra cost is small and bounded, the tier tags add ~9 tokens per conflicting fact, a rounding error against the correctness they buy.
The deterministic resolver proves the store can resolve correctly. To show real agents do, 300 programmatically generated conflicts (depths 2 to 4) went to five models across three architectures (Llama, GPT-OSS, Qwen) on Groq at temperature 0.4, with three prompt phrasings pooled per condition: flat-prompted with a fair prompt (its best honest shot) versus provenance-prompted with the tiers. Accuracy on conflicts, mean ± 95% CI:
| model | flat store | provenance store | gap |
|---|---|---|---|
| llama-3.3-70b | 2% ± 2 | 45% ± 10 | +43 |
| llama-3.1-8b | 3% ± 3 | 36% ± 7 | +33 |
| gpt-oss-120b | 0% ± 0 | 0% ± 0 | 0 |
| gpt-oss-20b | 0% ± 0 | 1% ± 2 | +1 |
| qwen3.6-27b* | 10% ± 19 | 10% ± 19 | 0 |
* qwen completed only a partial run (rate limiting); its wide interval reflects undersampling and we do not weight it.
Across the five models tested, the provenance store never underperformed the flat one. The panel splits cleanly into models that engage the resolution task and models that do not. The two engaged models (Llama-70b, Llama-8b) show a large, prompt-stable gap (+43 and +33 points) with the flat arm near zero, because recency genuinely poisons it. The other three under-engage: the GPT-OSS pair score near zero on both arms (they refuse or over-format rather than commit to a value, an engagement floor, not a provenance effect), and the undersampled qwen shows no separable difference. So the direction is a property of the data (the flat arm lacks the information to resolve trust, so it cannot systematically beat provenance); the magnitude is a property of the model.
One honest correction against the earlier six-conflict pilot: it reported a very large qwen gap (+73); at 300 generated conflicts across pooled prompts that separation does not reproduce. Small hand-seeded sets overstate per-model magnitudes. The larger generated set is the number to trust, and it says the effect is real and large on the models that resolve, and absent (not reversed) on those that do not.
One conflict, verbatim (Llama-70b, “Umbrella seat count,” truth 48 seats):
flat store: 36 provenance store: 48
Same question, same facts. The flat agent takes the recent wrong number; the provenance agent reads the tier and answers correctly. This is why the headline is the deterministic resolver, not the live gap: the structural claim (the flat store lacks the information to resolve trust) is exact, and the panel confirms real agents are pulled by it.
A fair test measures the failure mode too. In tier-inverted conflicts (20% of the generated set) the correct value sits at a lower tier than a wrong higher-tier fact, modeling a stale or mistaken human decision that outranks a correct verified email. There the tier resolver is confidently wrong: it scores 100% on non-inverted conflicts and 0% on inverted ones, which nets to 81.7%overall at a 20% inversion rate, degrading linearly with inversion. Provenance tiers convert “which fact is newest” into “which authority is highest,” an improvement only to the extent the authority ranking is sound. It is a governance mechanism, not an oracle.
A clever flat-store prompt (“prefer values that look official”) can recover sometimes, and the demo gives the flat arm exactly that kind of fair prompt. It still loses, for a reason no prompt can fix: the tier isn’t in the flat data, so nothing can read it. “48 seats” and “36 seats” are just two strings; which one a human confirmed and which one an agent guessed is information the flat store threw away at write time. This is a data-completeness gap, not a prompt gap, which is why it survives fair prompting and why it’s a property of the store rather than the agent.
And the top of that trust order is unforgeable by construction: source: human is minted only through the owner’s authenticated channel, never by an agent’s say-so (see provenance). An agent can’t promote its own guess to the tier that wins.
Both this and the pointer test are symptoms of one problem: an agent is only as reliable as the integrity of the context it acts on. Context has to be verified at the source, attributed to its origin, resolvable to ground truth, and uncorrupted in transit. The pointer test measured resolvable; this one measures attributed. We call the whole property context integrity, and each measurement in the program is a falsifiable test of one piece of it.
The harness seeds the facts, runs the deterministic resolver for the headline number, and (with a model key) runs the live arm for the transcript.
# in the Inbin repo DETERMINISTIC_ONLY=1 node scripts/research-conflict-study.mjs # exact models, instant GROQ_API_KEY=... node scripts/research-conflict-study.mjs # + empirical panel # deterministic result, every run: # depth d: flat 0% · random 1/d · provenance 100% # density: flat = 1 - rho · provenance = 100% (points on the lines)
Honesty notes: conflicts seeded adversarially (wrong value = newest), ground truth we control; the deterministic resolver is exact and model-free; the empirical panel (300 generated conflicts, 3 pooled prompt phrasings, temp 0.4, reported with 95% CIs) varies by model and is shown as illustration, not headline. A measured demonstration, not a study.