章节结构（全文标题提取）： 1 Introduction 2 System Model and Contract 3 Activation Protocol 4 Branch Lifecycle and Restoration 5 Evaluation 6 Related Work 7 Conclusion References 2.1 Authority Is Reachability 2.2 Proposals and Typed Transitions 2.3 Threat Model and Conditional Contract 3.1 One activation predicate 3.2 Four stable dispositions 3.3 Receipts state what they prove 3.4 Safety properties under the stated assumptions 3.5 Realization boundary 4.1 Branch creation 4.2 Writer handoff 4.3 Migration and forward restoration 5.1 Formal State-Space Exploration (RQ1–RQ3)
Persistent AI agents accumulate versioned state across long horizons, but storage retention alone does not identify authoritative state. Without an explicit control plane, unmediated updates by models, tools, and background workers risk stale overwrites, un-audited exposures, and self-authorizing privilege escalation. We argue that agent state governance is an infrastructural activation problem, defining continuity as an unbroken, authorized lineage of accepted branch heads. We present the Continuity Kernel (CK), an activation contract that decouples off-commit candidate evaluation from atomic state activation. Untrusted components propose typed changes against an exact predecessor head or typed absence. A short activation transaction revalidates ownership, pre-state authority, freshness, and effect uniqueness, recording one stable disposition (Commit, Reject, Quarantine, or Defer). Only Commit atomically advances the branch head and installs the complete accepted unit (state, authority, lineage, effects, outcome, and receipt). A bounded executable model verifies the protocol across 2,808,230 reachable states and 5,526,474 state-changing transitions with zero invariant violations.