Transitive Taint Propagation for Shared Agent State: Measured Generalization Across Models and Topologies — An Empirical Companion (v0.3)

The v0.2 companion measured Transitive Taint Propagation (TTP) — a primitive that records, at write time, the provenance dependencies of each write and contains the blast radius of a poisoned write without re-verifying the whole field — on a seeded synthetic oracle, and reported a first real-workload accuracy slice on one workload class and one model. The loudest open objection was generalization: does the result hold beyond a single model and a single agent topology, and is the self-declared ground truth it rests on actually sound? This version answers both with measurements on real instrumented agent traces. (1) Model-agnostic, measured: across three model families — Claude Haiku 4.5, Claude Sonnet 4.5, and gemini-2.5-flash — the causal-derivation premise holds in all three and the read-relevance gate lifts blast-radius precision 80%→100% in the same threshold band for every family. (2) Topology-general, with an honest recall split: across six distinct agent topologies the gate reaches 100% precision in every one, with the recall cost reported per workload and falling exactly where the topology stresses the two published boundaries (cross-session carry; paraphrase floor). (3) Ground-truth integrity, measured per workload: under-declaration is ≈0% in five of six topologies but 50% in one (plan-execute), so it does not universally generalize and must be measured, never assumed. (4) Two instrumentation closures: an observable carry channel recovers a cross-session dependency edge from 33%→100% recall on a no-re-read handoff, and a retrieval-layer (logged-input) ground truth on plan-execute lifts measured precision 46.2%→88.5%. The precision gain generalizes; each of its costs is named and on the page. CC-BY-4.0.