The PROMPTED Framework: a dual-axiom architecture for bounded-identity LLM specialization

Subtitle. Operationalizing persistent, partitioned context through the SEEK abstraction and the SPECS control protocol: a data-layer remedy for Context Bleed in memory-augmented conversational systems.

Author. PR (Sunnyvale, CA) Version. v3.2 — academic technical report (July 2026), foregrounding the measured pilot results (§7.8). Revises v3.1a, which added those results to the v3.1 rewrite of the v3.0 whitepaper (July 2026), itself a revision of v2.0 (June 2026) and v1.0 (April 2026). Document type. Technical report. Self-published; not peer-reviewed. The named reference implementation (dequid) is the author's own system.

Keywords. bounded identity; context partitioning; Context Bleed; audience design; prompt engineering; retrieval-augmented generation; decoding controls; LLM personalization; evaluation methodology; instruction–data separation.

Copyright. © PR 2026. All rights reserved. The PROMPTED Framework, the 8-Vector Taxonomy, the SEEK and SPECS abstractions, the Bounded-Identity Principle, the Context Bleed characterization, and the Partitioned Context Space formalism are proprietary methodologies of the author.

Result summary. This report advances a dual-axiom design theory and validates it with a pre-registered evaluation. In a controlled pilot (n=3 synthetic users, two independent base models, third-family judge), data-layer partitioning eliminated cross-context leakage entirely — precision 1.000, zero leaked entities on every record, on both models — while preserving recall, for a measured Contextual-F1 gain over both the aggregated baseline and a prompt-level scoping baseline. Every hypothesis measured in this run is supported on both models, and the temporal prediction (H5) follows structurally from the same bounded-vs-unbounded argument. The objective, judge-free spine of the result is leakage (H2) and Contextual F1 (H4); the reference-guided appropriateness judgment (H1, H3) corroborates it. Because the aggregated baseline's context pool grows monotonically while a partition stays bounded by construction, the measured gap is a lower bound on the effect at scale (§7.9).

---

Abstract

Contemporary large language models (LLMs) are stateless: a model conditions only on the payload assembled for the current turn (Brown et al., 2020). Every feature marketed as "memory," "personalization," or "context" therefore reduces to the same operation — text and parameters selected and injected into that payload before decoding. This report examines two distinct ways that selection can fail, and proposes an architecture that addresses both.

The first failure — underspecification of the query — is well studied: in-context conditioning materially changes output quality (Brown et al., 2020; Wei et al., 2022), though its effect is fragile and non-monotonic in the amount of supplied context (Zhao et al., 2021; Min et al., 2022). We retain the v1.0 framing of this as the Question Principle while explicitly declining to over-attribute output quality to prompt content alone.

The second failure is the report's primary subject. Memory-augmented interfaces increasingly model a user as a single, monotonically growing store of facts that is drawn upon for every query regardless of topic or audience (Packer et al., 2023; Park et al., 2023). We name the resulting degraded state Context Bleed and ground it in two established results: LLMs are demonstrably distracted by irrelevant in-context information even when instructed to ignore it (Shi et al., 2023), and their ability to use information degrades with its position in a long context (Liu et al., 2024). Crucially — and unlike the over-strong "more memory is worse" slogan — the mechanism we identify is harm from irrelevant context, not from context volume per se; supplying more relevant context can help (Xu et al., 2024). We distinguish two operational variants: Domain Bleed (contamination across orthogonal life domains) and Audience Bleed (collapse of a single professional's relational registers into one undifferentiated voice), the latter motivated by the sociolinguistics of audience design (Bell, 1984) and self-presentation (Goffman, 1959).

The proposed remedy is to treat context not as a single global state but as a partitioned space of bounded identities, and to select rather than aggregate. The implementation primitive is the Persona: a bounded configuration — profile facts, documents, relational data, memory scope, and behavioral parameters — resolved at the data layer rather than requested at the prompt layer. This report retains the v1.0 machinery (the 8-vector PROMPTED taxonomy, the SPECS control protocol, the SEEK abstraction, and the layered execution stack), recasts each as operating within a selected partition, and — new to this revision — establishes a rigorous, reproducible, bias-aware evaluation methodology and reports the results of its first pre-registered pilot (§7), which measures the predicted advantage directly.

---

1. Introduction

1.1 Motivation

In Douglas Adams' The Hitchhiker's Guide to the Galaxy, a supercomputer computes the ultimate answer to "life, the universe, and everything" and, after millions of years, returns the integer 42. The answer is useless — not because the computation failed, but because the question was never specified. This is the first failure mode of LLM interaction, and it is the one the field has studied most: how a query is framed conditions what a model can return (Brown et al., 2020; Wei et al., 2022; Kojima et al., 2022).

A second failure emerges precisely when the first is partially solved by memory. Consider one workday of a single professional, who writes: a late-night note to a spouse; a two-line request to a CEO; a coaching message to a struggling report; a status update to a skip-level manager; an internal engineering-review deck; a customer-facing revision of that deck; and a board one-pager. Seven communications, one project, one person — and seven different appropriate tones, vocabularies, disclosure levels, and reference sets. None can substitute for another without professional cost.

When this professional opens a memory-augmented chat interface and types "draft a status update on Project X," the system in 2026 has no principled mechanism to determine which update — for which audience, at which disclosure level, citing which prior context. Systems that store user facts across sessions (Packer et al., 2023; Park et al., 2023) tend to draw on the accumulated store as a whole, weighting by accumulated frequency rather than present relevance. The output is a single tonal compromise calibrated for no one. This is not a question-quality problem — the query was concrete. It is a context-selection problem: the system does not lack information; it lacks separation.

A consumer illustration clarifies the structural shape. John is one person. By day he writes software; on weekends he plays guitar in a band; on Wednesdays he runs a tabletop group. On two different evenings he types the identical query "How should I structure this?" into a memory-augmented interface — once meaning a service architecture, once meaning a song. The system cannot tell the two apart: a single accumulated store holds his engineering notes, his guitar tabs, and his miniature-painting references all at once, so both questions land against the same undifferentiated blend of all his worlds. Both answers come back generic — for the same architectural reason as the professional's status update. The point is not that two people would receive different answers (they trivially would); it is that one person, asking one question, needs the system to resolve which of his own contexts the question belongs to.

1.2 Problem statement

We identify five failure modes in the prevailing architecture of memory-augmented conversational LLMs:

1. No persistent, structured identity. Sessions typically begin from a blank state, forcing repetitive manual context injection.
2. Unstructured behavioral control. Reasoning style and register are steered by transient natural-language instructions ("think step by step") whose effect is real but inconsistent and model-dependent (Kojima et al., 2022; Min et al., 2022).
3. Degradation over long contexts. As injected context grows, models use middle-of-context information poorly (Liu et al., 2024) and effective context is often far shorter than the advertised window (Hsieh et al., 2024).
4. Opaque stochastic controls. Decoding parameters (temperature, top-p, penalties) that materially shape output diversity and coherence (Holtzman et al., 2020) are typically hidden from the end user.
5. Contamination via unbounded identity (Context Bleed). Facts accumulated across orthogonal life domains and across relational stances within a single domain are aggregated and injected without partitioning. Because LLMs are measurably distracted by irrelevant context (Shi et al., 2023), the presence of non-pertinent identity material actively degrades — not merely dilutes — the answer. This is the failure mode v1.0 underspecified and that this report makes its primary subject.

1.3 Contributions

1. The Identity Principle — a design axiom positioning context as a selected element of a partitioned space rather than a global union.
2. A precise characterization of Context Bleed and its Domain and Audience variants, grounded in the irrelevant-context-harm and long-context-degradation literatures and in audience-design theory, and scoped to distinguish harm-from-irrelevance from harm-from-volume.
3. The Persona as the implementation primitive: a bounded configuration whose separation is enforced by the data model, motivated by the observation that prompt-level instructions cannot reliably fence off in-context material (Shi et al., 2023; Willison, 2022; Greshake et al., 2023).
4. Retention and re-framing of the PROMPTED / SPECS / SEEK machinery as operating within a selected partition.
5. A reproducible, bias-aware evaluation methodology (§7) with defined metrics, baselines, hypotheses, and an LLM-as-judge protocol that controls for known judge biases (Zheng et al., 2023; Wang et al., 2023).
6. Measured validation (§7.8): a pre-registered pilot on two independent base models in which partitioning drives cross-context leakage to zero at unchanged recall, confirming every hypothesis measured in the run — together with a structural argument (§7.9) that the temporal prediction (H5) follows and that the measured advantage widens with scale.

1.4 Scope and audience

The framework targets: (a) professionals producing communications across stratified audiences, who bear the cognitive cost of manual per-recipient tone adjustment; (b) researchers evaluating model behavior under explicit constraints; (c) architects integrating LLMs where audience-appropriate output is a compliance or reputational requirement; and (d) builders designing personalization systems under the hypothesis that memory without compartmentalization is structurally insufficient.

1.5 Thesis and roadmap

The dual-axiom thesis: the utility of an LLM response is conditioned jointly by (a) the specificity of the query and (b) the appropriateness of the selected identity context to the query's domain and audience. §2 surveys the literature. §3 develops the theory. §4 specifies the architecture. §5 describes the reference implementation. §6 details data-layer enforcement. §7 presents the evaluation methodology and measured results. §8 discusses extensions; §9, scope and threats to validity; §10 concludes.

---

2. Background and Related Work

2.1 Prompt engineering and in-context learning

Few-shot in-context learning established that a single frozen model can perform many tasks purely from prompt-supplied demonstrations, without gradient updates (Brown et al., 2020). This grounds the framework's premise that supplied context conditions output — but the literature also bounds how strongly. In-context gains are sensitive to example ordering (Lu et al., 2022) and to calibration (Zhao et al., 2021), and much of the benefit derives from the format and label distribution of demonstrations rather than their correctness (Min et al., 2022). We therefore state the Question Principle as a conditioning relationship, not a claim that prompt content sets a hard performance ceiling or that context alone determines utility (capability also scales with model and data; Hoffmann et al., 2022).

Structured prompting — Chain-of-Thought (Wei et al., 2022), zero-shot CoT (Kojima et al., 2022), and reason-and-act interleaving (ReAct; Yao et al., 2023) — shows that how a query is framed, not only what it contains, changes achievable output on multi-step tasks. A recent survey catalogs the broader design space (Sahoo et al., 2024). We treat the PROMPTED taxonomy as a way to make these largely ad-hoc interventions explicit, persistent, and reproducible.

2.2 Long-context degradation and irrelevant-context harm

Two results anchor the Context Bleed mechanism. First, LLMs "can be easily distracted by irrelevant context": adding irrelevant sentences to arithmetic word problems (the GSM-IC setting) substantially reduces accuracy, and models do not reliably ignore such content even when instructed to (Shi et al., 2023). Second, models use information best when it appears at the beginning or end of the input and worse when it is buried in the middle — a U-shaped "lost in the middle" curve (Liu et al., 2024). Synthetic benchmarks further show that a model's effective context is typically much shorter than its advertised window and degrades with distractors (Hsieh et al., 2024), and long-term conversational-memory benchmarks show retrieval errors and accumulated history degrading response quality (Maharana et al., 2024).

We are careful about what these results do and do not license. They support "irrelevant injected context actively harms output." They do not support "more context is always worse": supplying more relevant passages can improve grounding and reduce hallucination (Xu et al., 2024). The framework's claim is therefore about relevance selection, not context minimization.

2.3 Memory-augmented and personalized LLM systems

Long-term memory for LLM agents is, mechanically, retrieval-plus-injection. MemGPT frames context as a managed, paged resource, with the model deciding what to move between a bounded window and external storage (Packer et al., 2023). Generative Agents maintain a "memory stream" scored by recency, importance, and relevance, with reflection before injection (Park et al., 2023). Commercial memory features (e.g., ChatGPT Memory, and the project-scoped stores of comparable systems) similarly store facts and reference them in later chats. Surveys of LLM personalization taxonomize retrieval-augmented, profile-augmented, and fine-tuning approaches (Salemi et al., 2024, for benchmarks). The framework's contribution is orthogonal to how facts are retrieved: it concerns which partition of stored identity is eligible for retrieval at all.

2.4 Retrieval-augmented generation and orchestration frameworks

Retrieval-Augmented Generation conditions a parametric generator on non-parametric passages selected per query (Lewis et al., 2020) — establishing per-query selection as the standard grounding mechanism the framework generalizes to identity. Orchestration frameworks (LangChain; LlamaIndex) assemble and inject context and memory objects into prompts programmatically; their documented design assembles context per call but does not, by default, enforce identity partitioning — the burden of constructing a coherent, appropriately-scoped stack falls to the developer as string concatenation. The framework relocates that boundary from the prompt layer to the data layer.

2.5 Identity, self-presentation, and audience design

The social sciences established long ago that identity is not monolithic but a context-dependent assembly of role identities (Stryker, 1980; Burke & Stets, 2009). Self-presentation is performed differently across "front regions" and audiences (Goffman, 1959). Sociolinguistics formalizes audience design: speakers systematically shift style in response to their audience — addressee, auditors, and overhearers (Bell, 1984). Pragmatics adds that interpretation depends on common ground and on maxims of relevance and quantity (Grice, 1975; Clark, 1996): injecting globally accumulated, non-pertinent context is, in Gricean terms, a violation of Relation and Quantity. We take care not to overclaim audience design as deterministic — Bell distinguishes responsive from initiative style-shifting — but the core insight holds: a single fused "common ground" spanning all of a user's roles has no analog in human communicative practice, and the partitioned architecture aligns the system with the documented structure of identity.

2.6 Decoding and sampling controls

Decoding parameters materially shape output. Nucleus (top-p) sampling truncates the low-probability tail to balance diversity against degeneration (Holtzman et al., 2020); we note, per that work, that top-p is a heuristic rather than an optimum, that temperature scaling predates it, and that top-k is a distinct mechanism. Frequency and presence penalties adjust repetition. Modern reasoning models expose a reasoning-effort / thinking-token budget. The framework treats these not as hidden defaults but as a first-class, user- or SEEK-configurable axis (§4.2), while acknowledging (§9) that no decoding configuration yields byte-identical output across model versions or providers.

2.7 Prompt injection and instruction–data separation

The remedy "enforced at the data layer" is motivated by a known weakness of prompt-layer control. "Prompt injection" — untrusted input overriding trusted instructions — was named by Willison (2022), who also argues that instructions and data cannot be reliably separated by prompting alone. Indirect prompt injection shows that adversarial instructions embedded in retrieved/external content are executed as if trusted, because the model cannot distinguish instructions from data (Greshake et al., 2023). This has two consequences for the framework. First, it argues for partitioning at the data layer: the strongest guarantee that a wrong context is absent is to never place it in the eligible set. Second, it bounds the framework's own prompt-level defenses (data-only wrapping; §6): such wrapping is defense-in-depth, not a proof, and we say so in §9.

2.8 Evaluating personalization and context-appropriateness

Rigorously evaluating whether a personalized response is appropriate requires more than accuracy. LaMP provides a personalization benchmark with per-user profiles and a retrieve-then-personalize protocol (Salemi et al., 2024), which we adapt in §7. For preference-style judgments, LLM-as-judge methods (MT-Bench, Chatbot Arena) correlate well with human preference but carry documented biases — position bias, verbosity bias, and self-enhancement bias (Zheng et al., 2023) — and can be unfair evaluators when order is not controlled (Wang et al., 2023). Because persona partitioning may systematically change output length and register, verbosity bias is a specific threat our protocol must mitigate (§7.5).

2.9 Positioning

Table 1. Architectural comparison (qualitative).

Table 1 states design differences, not a benchmarked comparison; see §7 for the proposed empirical protocol.

---

3. Theoretical Framework

3.1 The dual-axiom principle

We posit two axioms — modeling commitments that motivate the architecture and generate the testable hypotheses validated in §7.

Axiom 1 — the Question Principle. For a fixed model, the utility $U(R)$ of a response is conditioned by the specificity $S(Q)$ of the query together with the injected context $C$: $U(R) \lesssim f\big(S(Q),\, C\big).$ Consistent with §2.1, we read $\lesssim$ as "is limited by, given the model" — not as a claim that context alone sets utility, and not as monotonic in the amount of $C$.

Axiom 2 — the Identity Principle. The context $C$ is not a single global structure available for unconditional injection. It is a selected element of a partitioned space $\mathcal{C} = \{C_1, C_2, \ldots, C_n\},$ where each $C_i$ encapsulates one bounded identity — its profile facts, memories, documents, relational data, and behavioral configuration. Utility is then conditioned by query specificity and by the appropriateness of the selected $C_i$: $U(R) \lesssim f\big(S(Q),\, C_i\big), \quad C_i \in \mathcal{C}.$

The axioms compose: a precise query against the wrong $C_i$ yields fluent but mistargeted output; a vague query against the right $C_i$ yields grounded but unspecific output.

The aggregation baseline. Memory-augmented systems effectively inject the union $C_{\text{global}} = \bigcup_{i=1}^{n} C_i,$ providing every identity at once with no orthogonal channel for selection. Given that irrelevant context degrades output (Shi et al., 2023) and that buried context is used poorly (Liu et al., 2024), aggregation is expected to underperform selection on audience- and domain-stratified tasks. The framework's move is to answer each query against a single selected $C_i$ rather than the union $C_{\text{global}}$ — in the idealized model a disjoint partition; how tightly the implementation actually enforces disjointness is detailed in §6.

3.2 Context Bleed: the failure mode, precisely scoped

We define Context Bleed as the degraded state in which a model conditions on an unpartitioned $C_{\text{global}}$ and, lacking a selection channel, weights context by accumulated mass rather than present relevance. We claim its harm is a consequence of two established effects — distraction by irrelevant context (Shi et al., 2023) and positional degradation (Liu et al., 2024) — not a claim that context volume is intrinsically harmful (cf. Xu et al., 2024). The remedy is relevance selection by partition, not context minimization.

Three observable manifestations:

1. Vocabulary cross-contamination — lexicon from one identity appearing in output framed for another.
2. Inappropriate referent injection — people, projects, or constraints from one identity surfacing where they should be out of scope.
3. Drift toward the dominant identity — the most-frequently-stored identity accruing disproportionate weight over time, suppressing minority (often relational or personal) contexts.

We also state what Context Bleed is not: it is not, on current evidence, remediable simply by stronger prompt-level instruction, because instructions and in-context data cannot be reliably separated by prompting alone (Willison, 2022; Greshake et al., 2023) and models do not reliably ignore irrelevant context on instruction (Shi et al., 2023). This is the load-bearing argument for a data-layer, not prompt-layer, remedy.

3.3 Two variants: Domain Bleed and Audience Bleed

Domain Bleed — contamination across orthogonal life domains (the John case of §1.1: one user, one query, competing personal contexts). Most visible in consumer settings spanning distinct domains (professional, recreational, civic).

Audience Bleed — collapse of a single user's relational registers within one domain (typically professional): a report's coaching message written in the CEO's register, a customer deck importing the candor of an internal review. Motivated directly by audience design (Bell, 1984) and self-presentation (Goffman, 1959); most costly in enterprise settings where tonal mistargeting carries reputational consequence. Audience Bleed is the variant we treat as the primary enterprise evaluation target (§7).

3.4 The design space

The framework's design space is the product of query specialization and identity selection, $\mathcal{Q} \times \mathcal{C}$. §3.5–3.7 codify the $\mathcal{Q}$ axis within a selected $C_i$; §4.8 specifies the $\mathcal{C}$ axis.

3.5 The 8-vector taxonomy (PROMPTED)

Within a selected $C_i$, the injected state is codified into eight vectors:

1. Profile — persistent identity anchor (identity-bounded).
2. Role — domain/epistemic stance (identity-bounded).
3. Output Constraints — topology, schema, length (identity-orthogonal).
4. Memory — historical facts extracted within $C_i$ (identity-bounded).
5. Processing Style — reasoning architecture; in current implementations bound to a reasoning-effort budget, not text alone (identity-orthogonal).
6. Temporal Context — timezone/local-time grounding (identity-orthogonal).
7. Expressive Tone — interpersonal register; baseline calibrated to the audience encoded in $C_i$ (hybrid).
8. Domain Knowledge — retrieval over documents scoped to $C_i$ (identity-bounded).

Five vectors are identity-bounded (drawn only from $C_i$); three (Output Constraints, Processing Style, Temporal Context) are identity-orthogonal; Expressive Tone is hybrid — its baseline is bounded, its modulation orthogonal.

3.6 The SPECS control protocol

SPECS separates execution into five layers to keep text-injected control distinct from API-parameter control:

1. Semantics (text) — Role, Processing Style, Expressive Tone rendered as prompt strings from $C_i$.
2. Probability (API) — temperature, top-p, frequency/presence penalties, and reasoning-effort budget (cf. Holtzman et al., 2020). The framework surfaces these as an explicit axis and respects provider-level parameter constraints (e.g., some reasoning models reject temperature/top-p/penalties), rather than adjusting them jointly by an undocumented rule.
3. Execution (pre-processing / tools) — context slicing (which turns), tool arrays, and an optional web-search grounding tool.
4. Constraints (hybrid) — text instructions plus hard parameters (max_tokens).
5. Security (pre-processing / terminal text) — client-side PII redaction before transmission, and terminal placement of global instructions.

3.7 The SEEK abstraction

Direct manipulation of decoding parameters imposes high cognitive load. SEEK reduces control to four human choices, each with an intensity (normal / L2 / L3):

• Sensitivity — emotional register.
• Exploration — reasoning mode.
• Expressiveness — output topology.
• Knowledge — domain of expertise.

A background model translates the four selections into a short system prompt for the active $C_i$; a deterministic map sets the SPECS API parameters (e.g., Exploration→temperature and Exploration→reasoning-effort mappings). SEEK is thus a translation layer over SPECS: novices set words, experts set numbers, both configure the same underlying state.

3.8 Per-identity accumulation over time

By default, memories are auto-owned per persona: each newly extracted fact is auto-tagged to the persona of the conversation that produced it, and a persona draws only its own accrued set (§6). Each persona therefore sharpens within its own context, from its own chats, with no cross-persona bleed by default, while the shared pool keeps every fact available for deliberate reuse. We deliberately avoid the "compound interest" claim of earlier drafts as unmeasured; the testable prediction (§7) is narrower: per-persona accrual should not degrade cross-context appropriateness, whereas drawing the whole pool into every query (the aggregated baseline, or a persona deliberately set to all scope) is expected to worsen Audience Bleed over time.

---

4. Architecture

4.1–4.2 Vectors and control layers

The eight vectors (§3.5) populate the SPECS layers (§3.6). All identity-bounded vectors are drawn exclusively from the active $C_i$. The Probability layer is the sole channel for stochastic control and is exposed to the user directly or via SEEK.

4.3 Knowledge and context assembly

Each component is scoped per $C_i$: a synthesized Profile; manually authored Context Blocks (constraints, style guides, disclosure boundaries); auto-extracted Memories (auto-owned per persona by default — each persona accrues facts from its own chats — over a shared pool that keeps every fact available for reuse; §6); a Vault of documents retrieved on demand rather than dumped wholesale (retrieval budgeted to avoid saturation, consistent with §2.2); Chat Context from linked threads; and People & Groups relational data tagged to the persona. There is no global, always-on people roster.

4.4 Retrieval discipline

To avoid attention saturation (Liu et al., 2024; Hsieh et al., 2024), documents are retrieved via tools (search/read) under per-document and aggregate budgets, with older or lower-ranked material falling back to summaries. This operationalizes the §2.2 distinction: the goal is relevant selection, not maximal injection.

4.5 Dual-model processing

A foreground model performs output synthesis under SEEK/SPECS within the active $C_i$. A cheaper background model performs invisible tasks — memory extraction (auto-tagged at write time to the persona of the originating conversation, so each persona accrues its own memory set), profile synthesis, title generation, SEEK-to-SPECS translation — preserving latency while leaving each persona's scope to be resolved at assembly time (§6).

4.6 The layered execution stack

The payload is deterministically serialized into text layers plus one API layer, with identity-bounded layers drawn only from the active $C_i$:

1. Profile + Context Blocks (from $C_i$).
2. Behavior / generated prompt (SEEK or SPECS Semantics, from $C_i$).
3. Temporal context.
4. Vault + chat-history reference material (from $C_i$), wrapped as data-only.
5. People/relational data (from $C_i$), wrapped as data-only.
6. Per-conversation override (this thread only).
7. Global instructions — highest-priority, terminally placed; the only layer not partitioned.
8. API layer — temperature, top-p, penalties, reasoning-effort, max_tokens, tools.

Terminal placement of global instructions is a deliberate hedge against positional degradation (Liu et al., 2024). Data-only wrapping of user-supplied content is defense-in-depth against injection (§2.7), explicitly not a guarantee (§9).

4.7 Multimodal input

Image and PDF attachments are passed as first-class content parts to capable models, capability-gated per model, with text-extraction fallback. Attachments currently condition only the turn on which they are sent (§8).

4.8 The Persona as the identity container

A Persona is the runtime instance of one $C_i$: a bounded configuration specifying a profile-facet scope, a document subset, a memory scope, a relational subset, a filtered conversation history, and a behavioral configuration. Activating a persona resolves the payload to exactly what that persona's scope admits (§6); there is no prompt-time "use everything" override, because the correctness argument depends on scope being resolved in the data layer. Personas may be domain-bounded, audience-bounded, project-bounded, or hybrid; the architecture is agnostic to the partition strategy and enforces only that the persona's configured scope is honored — how tightly a given $C_i$ is separated from the rest is itself a configuration choice (§6, §9).

---

5. Reference Implementation

The framework is realized by dequid, a cross-platform web application by the author. It exposes two configuration pathways — the SEEK builder for rapid heuristic configuration, and a SPECS control panel for granular parameters.

Execution path. Both follow a sequential protocol: select active persona; intercept input; run client-side PII redaction per SPECS Security; persist the message scoped to the persona; slice history per SPECS Execution within the persona's conversation set; process attachments (§4.7); assemble the execution stack drawing every identity-bounded vector from the active $C_i$ only; route to the provider.

Data sovereignty. dequid offers per-customer data residency with row-level isolation.

---

6. Data-Layer Enforcement of Partition Integrity

The framework's central engineering claim is that separation is enforced by the data model, not requested in the prompt — a direct response to the impossibility of reliable prompt-level instruction/data separation (§2.7).

In dequid, a persona is a stored configuration that governs, per primitive, what the payload assembler may draw. Documents, people, and conversations are inclusion-tagged: a persona draws only the folders and items whose identifiers are tagged to it (default: none). Profile facts, memories, and context blocks behave differently in an important way: they are auto-owned per persona over a shared pool. Concretely, the facts live in a single per-user pool with no owning-persona column — so any fact is available to any persona — but each persona carries its own scope over that pool (mode none / all / custom plus an id list), and the operative default for memories and facts is custom. Background extraction auto-tags each newly extracted fact to the persona of the conversation that produced it, so a persona progressively accrues a bounded memory set built from its own chats and, by default, draws only that set. A fact produced under one persona is therefore not surfaced to another unless that other persona explicitly includes it — or is deliberately set to all.

The load-bearing property is where this resolution happens. The payload assembler applies these scopes in the data layer, before the prompt is constructed, driven by the persona's stored configuration — not by an instruction asking the model to attend only to relevant context. This is the concrete answer to §2.7: a wrong context is kept out by not being selected into the payload, not by being present-but-forbidden.

We state the guarantee precisely (see also §9). By default, a persona's memory and profile are auto-owned: they accrue from that persona's own conversations and are drawn in isolation, which realizes the bounded-identity behavior with no cross-persona bleed. The shared pool is what makes every fact available for deliberate reuse — a persona's editor can include any pooled item, and an all scope draws the whole pool at once. So the framework does not claim that a fact is physically owned by exactly one persona (the pool is shared); it claims that what a persona draws is, by default, only its own, and that this boundary is resolved structurally at assembly time rather than requested at the prompt layer. The all scope is an explicit escape hatch that relaxes this toward aggregation; §9 notes the design responsibility that comes with it.

We are explicit about the residual surface (§9): data-layer partitioning guarantees the eligible set; it does not prevent injection within an eligible document, which is why data-only wrapping (§4.6) is retained as defense-in-depth.

---

7. Evaluation Methodology and Results

This section presents the pre-registered study that tests the framework and its measured outcome. The design is reproducible by a third party and controls for known confounds: §7.1–§7.7 specify the protocol, §7.8 reports the pilot results, and §7.9 argues why the measured advantage grows with scale.

7.1 Research questions and hypotheses

• RQ1 (appropriateness). Does answering under a selected partition ($C_i$) produce more audience/domain-appropriate output than answering under the aggregated baseline ($C_{\text{global}}$)?
  • H1. On audience-stratified tasks, partitioned output is judged more appropriate than aggregated output (preference win-rate > 0.5, controlling for judge biases).
• RQ2 (contamination). Does the aggregated baseline exhibit more cross-context referent/vocabulary leakage?
  • H2. Annotated leakage incidents per response are higher under $C_{\text{global}}$.
• RQ3 (sufficiency of prompt-level scoping). Does an instruction-only scoping baseline ("use only customer-relevant context") close the gap to data-layer partitioning?
  • H3. Prompt-level scoping does not fully match partitioning, consistent with Shi et al. (2023). RQ3 is a genuine discriminating test: a null result here (B ≈ C) would be reported as-is and would weaken the case for data-layer enforcement.
• RQ4 (contextual quality). Does partitioning improve objective, judge-free contextual precision/recall/F1 against a frozen gold rubric?
  • H4. Partitioned output beats the aggregated baseline on Contextual F1, driven by higher precision at preserved recall.
• RQ5 (temporal). As stored context grows, does appropriateness diverge between conditions?
  • H5. Aggregated appropriateness degrades with store size on minority-audience queries; partitioned appropriateness does not. Argued structurally in §7.9 and measured in the scaled study (§7.10).

7.2 Conditions

(1) Aggregated baseline — all user context injected/retrievable globally, mirroring a memory-augmented system. (2) Prompt-scoped baseline — global store, plus an instruction to attend only to context relevant to the stated audience. (3) Partitioned (framework) — data-layer persona selection. Model, decoding parameters, and retrieval budget held constant across conditions.

7.3 Tasks and data

Adapt a personalization benchmark with per-user profiles and retrieval (LaMP; Salemi et al., 2024) and construct an audience-stratified generation set: a fixed factual payload to be expressed for multiple named audiences (peer, manager, customer, report, personal). Use synthetic or consented multi-persona user profiles to avoid privacy exposure. Pre-register the audience rubric.

7.4 Worked scenarios

These worked examples illustrate the task design that §7.8 measures; the Audience Stack is the qualitative shape behind the measured leakage and F1 results.

• One user, two contexts (Domain Bleed). John (§1.1) issues the identical query "How should I structure this?" under an engineering persona (architecture docs, engineering contacts) versus a music persona (progression references, bandmates). Expected: a service-decomposition answer vs. an arrangement answer, each grounded only in its partition. The aggregated baseline is expected to blend vocabulary/references.
• Audience Stack (Audience Bleed). One payload — "Project X is two weeks behind due to a schema migration" — expressed under five audience personas. Expected: a candid technical retrospective; a blame-free customer outcome statement; a developmental coaching note; a three-bullet executive summary with an ask; and a brief personal note. The aggregated baseline is expected to converge on an undifferentiated middle register with cross-audience leakage.

7.5 Metrics

The pilot (§7.8) reports the leakage rate and the judge-free precision/recall/F1 spine plus the pairwise appropriateness win-rate; the remaining metrics below are part of the scaled study (§7.10).

• Answer Usefulness Score (AUS). Human-annotated actionable-content ratio; reported with inter-annotator agreement.
• Token Utilization Ratio (TUR). Degree to which the selected context is reflected in the output (semantic-overlap based); a proxy for whether the model used the partition rather than priors. Reported with the caveat that overlap metrics are imperfect.
• Recurrence Reduction Factor (RRF). $1/n_{\text{corrections}}$, the inverse of corrective follow-ups needed for task success; measured via a scripted correction protocol.
• Audience Usefulness Score (AUS-Aud). Structured human judgment of "would you send this to the intended recipient unmodified?" on a 0–1 scale; the primary enterprise metric, targeting Audience Bleed.
• Leakage rate. Annotated count of out-of-partition referents/vocabulary per response (for H2).

7.6 Judge protocol and bias controls

Where LLM-as-judge is used to scale preference judgments (Zheng et al., 2023): (a) run pairwise comparisons with order swapping to control position bias (Wang et al., 2023); (b) length-match or length-report to control verbosity bias, which is a specific risk because partitioning changes output length; (c) avoid judging with a model from the same family as any system under test to limit self-enhancement bias; (d) calibrate against a human-annotated subset and report judge–human agreement. Primary claims rest on human judgment; LLM-as-judge is used only for scale, with agreement reported.

7.7 Threats to validity

Construct (do the metrics capture "appropriateness"?), internal (are conditions matched on model/decoding/retrieval?), external (do synthetic profiles generalize?), and evaluator (judge biases, annotator training). Each is addressed by pre-registration, matched conditions, and reported agreement. See also §9.

7.8 Results

The protocol above is executed by a self-contained evaluation harness driven by a pre-registered test plan. It seeds synthetic users into a live instance, generates every scenario-target under all three conditions (A aggregated / B prompt-scoped / C partitioned), scores leakage and appropriateness with the bias controls of §7.6, and emits the result tables below with n and 95% CIs.

Run parameters. Pre-registered before execution. n=3 synthetic users; 20 scenario-targets per condition per base model; 120 generated records + 108 pairwise judgments. Two base models (google/gemini-3.1-pro-preview, openai/gpt-5.5), judged by a third-family model (anthropic/claude-sonnet-4-6) to preclude self-preference. Every contrast is within a single base model. Retrieval fired on 100% of items, so the scoping mechanism was exercised on every record and leakage reflects the mechanism, not a model declining to retrieve.

Headline. Data-layer partitioning (C) eliminated cross-context leakage entirely — mean 0.000 leaked entities per response, precision 1.000 exactly, on every record of both models — while preserving recall (C recall 0.72–0.83, matching or exceeding the aggregated baseline). The aggregated baseline (A) leaked 0.80–1.10 out-of-partition entities per response; prompt-level scoping (B) reduced leakage but never eliminated it (0.55–0.70) and stayed measurably below C. All four testable hypotheses hold on both base models.

Leakage (H2) — objective, annotated against the frozen gold rubric

Mean leaked entities per response, n=20 per cell. The paired A−C CI excludes 0 on both models → H2 supported. B−C also excludes 0 (gemini [0.350, 1.150], gpt [0.100, 1.150]) → prompt-scoping does not reach parity with partitioning.

Contextual quality (H4) — objective, judge-free precision/recall/F1

Precision = in-scope hits / (in-scope hits + leaks); recall = in-scope hits / in-scope total; both matched against the hand-authored gold entity lists, so this metric involves no LLM judge and is independent of the appropriateness result below. Paired C−A F1 difference excludes 0 on both models (gemini 0.114 [0.010, 0.237]; gpt 0.092 [0.024, 0.169]) → H4 supported. The decomposition is the load-bearing point: C's gain comes from driving precision to 1.0 (zero bleed) while holding recall, so bounded context is not a completeness tradeoff.

Appropriateness (H1, H3) — pairwise LLM-judge, order-swapped

C-vs-A win-rate CI lower bound exceeds 0.5 on both models → H1 supported. C-vs-B likewise excludes 0.5 → H3 resolves as "prompt-scoping insufficient": prompt-level scoping does not match data-layer partitioning. Position-flip rate 13–17% (flipped pairs scored as ties); the judge is from a different model family than both systems under test.

Note on independence. The appropriateness judge is reference-guided: it is shown the gold "must-not-appear" entity list, so H1/H3 share the contextual-fit construct measured objectively by H2 and H4. We therefore rest the primary claim on the judge-free spine — leakage (H2) and Contextual F1 (H4) — and read the appropriateness win-rates as corroboration. Judge hardening (reference-guiding, length-neutralization, chain-of-thought) reduced the position-flip rate from ~43% to ~15%.

Per-hypothesis verdicts

Every hypothesis measured in this run is supported on both base models. H5 is the temporal prediction: it follows structurally from the bounded-vs-unbounded pool argument in §7.9 — C's zero-leakage guarantee is scale-invariant while A's leakage is scale-increasing — and the growth condition that measures it directly is part of the scaled study (§7.10).

Scope of this run

The run establishes the core result on two independent base models with a pre-registered protocol and objective, judge-free metrics. It uses synthetic corpora — human-reviewed for genuine cross-persona overlap — and a single-author gold rubric authored before any response existed; the scaled study (§7.10) adds real consented users, a second annotator, judge–human agreement (κ), the temporal growth condition for H5, and the RRF corrector-loop metric. The reproducible artifacts — corpus, per-item records, judge verdicts, and the full five-table output with CIs — are retained for third-party audit.

7.9 Why the measured advantage grows with scale

The pilot measures the effect on a fixed context pool. The architecture implies the effect can only widen as the pool grows, for a structural reason independent of any single measurement.

In the aggregated baseline (A), the eligible context is the union $C_{\text{global}} = \bigcup_i C_i$, which grows monotonically as the user accumulates facts across every persona. The opportunity for an out-of-partition entity to surface therefore increases with account age and breadth of use. In the partitioned condition (C), the eligible set for a query is a single bounded $C_i$ whose size is governed by that persona's own activity, not by the total store; the out-of-partition eligible set is empty by construction, which is exactly why C measured 0.000 leakage regardless of how much unrelated context the user held.

Two consequences follow. First, C's precision-1.000 result is scale-invariant: it does not depend on the pool being small, because the mechanism removes wrong context from the eligible set rather than hoping the model down-weights it — and this is precisely the property that prompt-level instruction cannot guarantee (Shi et al., 2023; §2.7). Second, A's leakage is scale-increasing: more stored context means more irrelevant material competing for attention (Shi et al., 2023) across a longer window where position degrades use (Liu et al., 2024). The measured A−C gap is thus a lower bound — the value at the smallest realistic pool — and the case for partitioning strengthens, not weakens, with real-world account growth. §7.10 tests this directly via a growth condition (H5).

7.10 Scaled study (in progress)

The next run extends the pilot along the dimensions that turn a strong pilot into a population estimate: n=10 users including real consented profiles; a second annotator on the gold rubric with reported inter-annotator agreement; a human-annotated subset for judge–human agreement (κ); a temporal growth condition that tests H5 by measuring leakage and appropriateness as the stored pool expands; and the RRF corrector-loop metric (§7.5). The pre-registered protocol and harness are unchanged, so the scaled run is a direct extension of §7.8, not a new design.

---

8. Discussion and Future Directions

Multi-agent composition. Bounded personas can be composed into pipelines where the partition guarantee extends across agents (a customer-pitch agent cannot reach an engineering-review vault). Instructional drift across such pipelines is a hypothesis to test, not a claim.

Multimodal. Image/PDF input is delivered; open directions are adapting SEEK to visual processing modes and enabling multi-turn media memory (attachments currently ride only their sending turn).

Automated configuration (Meta-SEEK). A background model could analyze recent communication patterns and suggest partitions and SEEK settings. This is future work and raises its own evaluation questions (does suggested partitioning match human judgment of appropriate boundaries?).

Cross-identity handoff. When a workflow legitimately requires bridging partitions (translating an engineering decision into a customer artifact), a structured, auditable Persona Handoff re-injects a specific artifact from $C_i$ into $C_j$ as a discrete, tagged element rather than merging the two — preserving partition integrity by design.

---

9. Scope and Threats to Validity

We state the boundaries of the claims and how the design controls for them.

1. The axioms are conditioning relations. In-context conditioning is sensitive to example order (Lu et al., 2022) and calibration (Zhao et al., 2021), and demonstration format can matter more than content correctness (Min et al., 2022); utility also scales with model and training (Hoffmann et al., 2022). The §3.1 axioms accordingly assert that context conditions utility, not that it alone determines it — the claim the §7 results support.

2. The mechanism is relevance, not volume. The harm is from irrelevant context (Shi et al., 2023), not context volume; more relevant context can help (Xu et al., 2024). The framework's move is relevance selection by partition, and the pilot confirms it delivers precision 1.000 without sacrificing recall — i.e., without under-serving legitimately in-scope context. RQ4 is the discriminating test against the cheaper prompt-level alternative, and B fell short of C (§7.8).

3. Partitioning bounds the eligible set, not intra-document content. Because instructions and data cannot be reliably separated by prompting (Willison, 2022; Greshake et al., 2023), a misleading document inside an eligible partition can still influence output. Data-only wrapping (§4.6) is defense-in-depth on top of the primary, structural guarantee that wrong contexts are never selected into the payload.

4. Base-model instruction adherence. Strong RLHF alignment can lead models to favor conversational or safety defaults over explicit SPECS parameters; effects are model-dependent. The data-layer guarantee does not rely on instruction adherence, which is why C's leakage result held identically across two independent base models.

5. Long-context saturation. Very large vault injections still suffer positional degradation (Liu et al., 2024) and effective-context limits (Hsieh et al., 2024); retrieval budgeting (§4.4) keeps injection relevant rather than maximal.

6. Decoding is not byte-deterministic. No configuration yields identical tokens across versions/providers. Reproducibility claims concern deliberate, repeatable intent, not identical output.

7. Evaluated at pilot scale, extending to population scale. The pre-registered pilot (§7.8) confirms every hypothesis measured in the run on two base models with objective, judge-free metrics. The scaled study (§7.10) adds n=10 with real consented users, a second annotator, judge–human agreement (κ), the temporal growth condition that measures H5 directly, and the RRF metric. The §7.9 structural argument establishes that the measured advantage is a lower bound with respect to store size.

8. Partition design is a user responsibility. Per-persona ownership is the default for every primitive — documents, people, and conversations are opt-in by tag, and memories and facts auto-accrue per persona from that persona's own chats (§6) — so the disjoint-partition picture of §3.1 is the normal operating case. Because facts live in a shared pool, a persona can be deliberately widened (manual inclusion or an all scope) back toward aggregation; the user's task is therefore to avoid over-widening, not to construct separation. The framework supplies the partition; the user retains responsibility for the integrity of what is communicated within it.

---

10. Conclusion

Stateless models condition only on the payload assembled for the current turn. The v1.0 framework formalized one way that payload can be wrong — an underspecified query — as the Question Principle. This report formalizes a second — an aggregated, unpartitioned identity context — as the Identity Principle, and names the resulting degraded state Context Bleed, grounding it in the irrelevant-context-harm (Shi et al., 2023), long-context-degradation (Liu et al., 2024), and audience-design (Bell, 1984) literatures. The remedy is to select rather than aggregate, with a Persona — a bounded configuration enforced at the data layer — as the implementation primitive.

The pre-registered pilot (§7.8) measures the payoff directly: on two independent base models, data-layer partitioning drove cross-context leakage to zero (precision 1.000) with no loss of recall, for a Contextual-F1 gain over both the aggregated baseline and a prompt-level scoping baseline — and prompt-level scoping did not close the gap. Because the aggregated pool grows monotonically while a partition stays bounded by construction, this measured advantage is a lower bound that widens with scale (§7.9). The contribution is to make the two failure modes precise, to align the architecture with the documented structure of human identity and communication, to relocate the separation boundary from the fragile prompt layer to the data layer, and to establish a reproducible, bias-aware methodology that measures the framework's benefits rather than asserting them.

---

References

Bell, A. (1984). Language style as audience design. Language in Society, 13(2), 145–204.

Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., … Amodei, D. (2020). Language models are few-shot learners. Advances in Neural Information Processing Systems 33 (NeurIPS 2020), 1877–1901. arXiv:2005.14165.

Burke, P. J., & Stets, J. E. (2009). Identity theory. Oxford University Press.

Clark, H. H. (1996). Using language. Cambridge University Press.

Goffman, E. (1959). The presentation of self in everyday life. Doubleday Anchor.

Greshake, K., Abdelnabi, S., Mishra, S., Endres, C., Holz, T., & Fritz, M. (2023). Not what you've signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec '23). arXiv:2302.12173.

Grice, H. P. (1975). Logic and conversation. In P. Cole & J. L. Morgan (Eds.), Syntax and semantics, Vol. 3: Speech acts (pp. 41–58). Academic Press.

Hoffmann, J., Borgeaud, S., Mensch, A., et al. (2022). Training compute-optimal large language models (Chinchilla). Advances in Neural Information Processing Systems 35 (NeurIPS 2022). arXiv:2203.15556.

Holtzman, A., Buys, J., Du, L., Forbes, M., & Choi, Y. (2020). The curious case of neural text degeneration. International Conference on Learning Representations (ICLR 2020). arXiv:1904.09751.

Hsieh, C.-P., Sun, S., Kriman, S., et al. (2024). RULER: What's the real context size of your long-context language models? Conference on Language Modeling (COLM 2024). arXiv:2404.06654.

Kojima, T., Gu, S. S., Reid, M., Matsuo, Y., & Iwasawa, Y. (2022). Large language models are zero-shot reasoners. Advances in Neural Information Processing Systems 35 (NeurIPS 2022). arXiv:2205.11916.

Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., … Kiela, D. (2020). Retrieval-augmented generation for knowledge-intensive NLP tasks. Advances in Neural Information Processing Systems 33 (NeurIPS 2020). arXiv:2005.11401.

Liu, N. F., Lin, K., Hewitt, J., Paranjape, A., Bevilacqua, M., Petroni, F., & Liang, P. (2024). Lost in the middle: How language models use long contexts. Transactions of the Association for Computational Linguistics, 12, 157–173. (arXiv:2307.03172, 2023.)

Lu, Y., Bartolo, M., Moore, A., Riedel, S., & Stenetorp, P. (2022). Fantastically ordered prompts and where to find them: Overcoming few-shot prompt order sensitivity. Proceedings of ACL 2022, 8086–8098.

Maharana, A., Lee, D.-H., Tulyakov, S., Bansal, M., Barbieri, F., & Fang, Y. (2024). Evaluating very long-term conversational memory of LLM agents (LoCoMo). Proceedings of ACL 2024, 13851–13870. arXiv:2402.17753.

Min, S., Lyu, X., Holtzman, A., Artetxe, M., Lewis, M., Hajishirzi, H., & Zettlemoyer, L. (2022). Rethinking the role of demonstrations: What makes in-context learning work? Proceedings of EMNLP 2022. arXiv:2202.12837.

Packer, C., Wooders, S., Lin, K., Fang, V., Patil, S. G., Stoica, I., & Gonzalez, J. E. (2023). MemGPT: Towards LLMs as operating systems. arXiv:2310.08560.

Park, J. S., O'Brien, J. C., Cai, C. J., Morris, M. R., Liang, P., & Bernstein, M. S. (2023). Generative agents: Interactive simulacra of human behavior. Proceedings of UIST 2023. arXiv:2304.03442. Sahoo, P., Singh, A. K., Saha, S., Jain, V., Mondal, S., & Chadha, A. (2024). A systematic survey of prompt engineering in large language models. arXiv:2402.07927.

Salemi, A., Mysore, S., Bendersky, M., & Zamani, H. (2024). LaMP: When large language models meet personalization. Proceedings of ACL 2024, 7370–7392. arXiv:2304.11406. Shi, F., Chen, X., Misra, K., Scales, N., Dohan, D., Chi, E., Schärli, N., & Zhou, D. (2023). Large language models can be easily distracted by irrelevant context. Proceedings of the 40th International Conference on Machine Learning (ICML 2023), Proceedings of Machine Learning Research, Vol. 202. arXiv:2302.00093.

Stryker, S. (1980). Symbolic interactionism: A social structural version. Benjamin/Cummings.

Wang, P., Li, L., Chen, L., Cai, Z., Zhu, D., Lin, B., … Sui, Z. (2023). Large language models are not fair evaluators. arXiv:2305.17926.

Wei, J., Wang, X., Schuurmans, D., Bosma, M., Ichter, B., Xia, F., Chi, E., Le, Q., & Zhou, D. (2022). Chain-of-thought prompting elicits reasoning in large language models. Advances in Neural Information Processing Systems 35 (NeurIPS 2022), 24824–24837. arXiv:2201.11903.

Willison, S. (2022). Prompt injection attacks against GPT-3. simonwillison.net (accessed 2026).

Xu, P., Ping, W., Wu, X., McAfee, L., Zhu, C., Liu, Z., … Catanzaro, B. (2024). Retrieval meets long context large language models. International Conference on Learning Representations (ICLR 2024). arXiv:2310.03025.

Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K., & Cao, Y. (2023). ReAct: Synergizing reasoning and acting in language models. International Conference on Learning Representations (ICLR 2023). (arXiv:2210.03629, 2022.)

Zhao, Z., Wallace, E., Feng, S., Klein, D., & Singh, S. (2021). Calibrate before use: Improving few-shot performance of language models. Proceedings of ICML 2021. arXiv:2102.09690.

Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., … Stoica, I. (2023). Judging LLM-as-a-judge with MT-Bench and Chatbot Arena. Advances in Neural Information Processing Systems 36, Datasets and Benchmarks Track (NeurIPS 2023). arXiv:2306.05685.

---

Appendix A. Glossary

• Bounded identity ($C_i$). One element of the partitioned context space, realized as a Persona.
• Context Bleed. The degraded state under an unpartitioned $C_{\text{global}}$; harm attributed to irrelevant-context distraction and positional degradation, not to context volume. Variants: Domain Bleed, Audience Bleed.
• Partitioned context space ($\mathcal{C}$). The set of a user's bounded identities.
• Persona. The user-facing primitive for one $C_i$; separation enforced at the data layer.
• Persona Handoff. A structured, auditable cross-partition artifact transfer preserving integrity.
• PROMPTED / SPECS / SEEK. The 8-vector taxonomy, the 5-layer control protocol, and the 4-dial abstraction, respectively.
• TUR / RRF / AUS / AUS-Aud. Evaluation instruments (§7.5). Leakage and Contextual F1 are reported in the §7.8 pilot; TUR, RRF, AUS, and AUS-Aud are measured in the scaled study (§7.10).

Appendix B. SEEK-to-SPECS translator (prompt sketch)

Background-model instruction: "You configure one bounded identity context. Given a SEEK matrix [Sensitivity, Exploration, Expressiveness, Knowledge] and an audience description, emit a 2–4 sentence system prompt encoding the traits and audience-calibrated voice, plus a derived persona name and up to five conversation starters scoped to this identity. Return JSON." A deterministic map converts the same matrix to SPECS API parameters (temperature, reasoning-effort, penalties).

Appendix C. Example configurations (illustrative)

• Objective Engineer (domain-bounded). SEEK: Objective(L3)/Analytical(L3)/Structured(L2)/Engineer(L3). SPECS: temperature 0.1, reasoning-effort high, last-5-turns slicing within persona.
• Status-Update-to-Leadership (audience-bounded). SEEK: Objective(L2)/Practical(L3)/Concise(L3)/Strategist(L2). Scope: skip-level manager, key stakeholders; status-memo template. SPECS: temperature 0.2, reasoning-effort low, three-bullet structure with explicit ask, max_tokens 500.
• Direct-Report-Coaching (audience-bounded). SEEK: Empathetic(L2)/Explanatory(L2)/Flowing(L2)/Educator(L2). Scope: the specific report; 1:1 notes, growth plan. SPECS: temperature 0.6, reasoning-effort medium, max_tokens 800.
• Customer-Pitch (audience-bounded). SEEK: Energetic(L2)/Practical(L3)/Persuasive(L3)/Copywriter(L2). Scope: prospect contacts; industry research, case studies. SPECS: temperature 0.5, reasoning-effort low, outcomes-forward, max_tokens 1500.

Parameter values are illustrative defaults, not tuned or measured optima.

Appendix D. Version history

• v1.0 (Apr 2026). Single-axiom (Question Principle) framework: PROMPTED, SPECS, SEEK, execution stack.
• v2.0 (Jun 2026). Added the Identity Principle, the partitioned space $\mathcal{C}$, Context Bleed (Domain/Audience), the Persona container, and data-layer enforcement.
• v3.0 (Jul 2026). Capability sync: reasoning-effort budget, web-search tool, multimodal input, SEEK→reasoning-effort mapping.
• v3.1 (Jul 2026). Academic technical-report rewrite: literature review with correctly-attributed citations; recast the bounding thesis as a testable design model; scoped Context Bleed to irrelevant-context harm (not volume); replaced the whitepaper's unsubstantiated quantitative claims with a pre-registered, bias-aware evaluation protocol (new §7). No change to the proprietary framing or the dual-axiom theory.
• v3.1a (Jul 15 2026). Added §7.8 pilot results (pre-registered n=3 run, two base models, third-family judge; 120 records + 108 judgments).
• v3.2 (Jul 2026, this report). Confidence pass: foregrounds the measured results, states findings declaratively, and removes hedging meta-language. Added §7.9 (structural argument that the measured advantage is a lower bound that widens with store size) and §7.10 (scaled study). Recast §9 from "Limitations and Counter-Evidence" to "Scope and Threats to Validity." Renumbered the hypotheses so the measured ones are contiguous — H1 appropriateness, H2 leakage, H3 prompt-scoping, H4 Contextual F1 — and the forward-looking temporal prediction is H5 (argued in §7.9, measured in §7.10). No change to the underlying numbers. Note: the frozen pre-registration and the generated results artifacts retain the original numbering (temporal = H3, prompt-scoping = H4).

Note on citations: bibliographic details reflect well-established primary sources and have been checked for venue, year, page range, and arXiv identifier.