A Passing Patch Can Break a Later Task: Revocable Learning from Verified Agent Traces

A software-repair episode can pass repository tests and compilation, train a LoRA child, and reveal its harm only when a different task that passed under the parent fails under the child. Both observations can be correct: the verifier establishes source-issue success, whereas the later regression concerns the policy produced from that success. StatePermit records this cross-task transition through a versioned parent–child lineage. Every eligible verified episode first becomes a redacted, provenance-bound memory record; promotion to model state additionally requires stable training loss and bounded parent-to-child divergence; and fixed, identity-disjoint canaries can restore a passing ancestor and quarantine an implicated trace. Across five matched 300-issue SWE-bench Lite trajectories, verified-trace memory averages 21.4% resolve with 0.9 replay regressions per 100 evaluator identities. Ungated online LoRA reaches 25.4% but produces 18.3 regressions, whereas StatePermit reaches 27.5% with 4.6. Of 1,186 verifier-passed candidates, loss or divergence screening leaves 83 memory-only; monitoring operationally attributes and revokes 43 of 1,000 committed sources. Strong fixed-weight and continual-learning alternatives finish within 0.9 resolve points yet separate sharply in downstream burden. On a controller-hidden 2,000-check evaluator, StatePermit records 44 new failures, compared with 58 for a frozen cross-encoder, 110 for MIR-LoRA, and 134 for Replay LoRA. Qwen2.5-72B and constraint-based SQL comparisons preserve the same qualitative utility–burden pattern. Persistent learning should therefore distinguish evidence that licenses inspectable reuse from evidence that licenses a shared weight change, and evaluate the latter by its future-task consequences rather than source-task success alone.