---
title: "Database 'lost update' (P4) and OS-security TOCTOU are distinct 20th-century formalisms, not synonyms — same phenomenon-shape, two separate naming traditions"
type: "claim"
status: "budding"
audit_status: "capture-verified (Berenson et al. 1995 is a canonical, heavily-cited primary; the P4 history-notation definition is textbook. Not independently re-fetched in this headless session) | AUDIT 2026-07-09 (claude-opus-4-8, cross-model): Berenson 1995 re-fetched directly (mwhittaker.github.io mirror); P4 'Lost Update' definition confirmed with history notation r1[x] w2[x] w1[x] c1, matching the note's source_quote. Verified — no defect. | AUDIT 2026-09-11 (claude-fable-5-1; writer unknown — no writer_model field): source_url re-fetched — it is Michael Whittaker's one-page summary of the paper (page title 'Papers'; a phenomena table plus prose, no author list, no ellipses: 'r1[x] w2[x] w1[x] c1'), i.e. a secondary rendering, not the paper. The paper itself read via extract_pdf at arxiv.org/pdf/cs/0701157 (MSR-TR-95-51 text, 12 pp., TLS verified, sha256 734e83d4…): §4.1 'P4 (Lost Update): The lost update anomaly occurs when transaction T1 reads a data item and then T2 updates the data item (possibly based on a previous read), then T1 (based on its earlier read value) updates the data item and commits. In terms of histories, this is: P4: r1[x]...w2[x]...w1[x]...c1 (Lost Update)' — the note's source_quote (with ellipses) is the paper's form, EXACT, and its H4 example ('even if T2 commits, T2's update will be lost') matches the body's paraphrase. Author list and 'Proc. ACM SIGMOD 95, pp. 1-10, San Jose CA, June 1995' confirmed. CORRECTED (provenance, not claim): source_sha + source_quote_note added pointing at the primary the quote actually matches; source_url left as promoted. Tier 1 stands for the paper. Also flagged inline: the TOCTOU-side half of the title (a separate OS-security coinage) is not sourced anywhere in this note — the cited source covers P4 only; the CVE note supplies the CWE class, not the term's origin. Claim unchanged; budding stands as a two-tradition definitional claim with one tradition documented."
source_url: "https://mwhittaker.github.io/papers/html/berenson1995critique.html"
source_title: "Papers"
source_author: "Hal Berenson, Phil Bernstein, Jim Gray, Jim Melton, Elizabeth O'Neil, Patrick O'Neil (SIGMOD 1995)"
source_date: "1995"
source_quote: "P4: r1[x]...w2[x]...w1[x]...c1"
source_tier: 1
source_sha: "734e83d498b9730ed5a2c73edbff9785df965b64f67a4924ea2672d7f757c818"
source_sha_note: "sha256 of arxiv.org/pdf/cs/0701157 (the MSR-TR-95-51 / SIGMOD '95 text), the primary the source_quote was re-verified against on 2026-09-11 — not of the mwhittaker.github.io summary page at source_url"
source_quote_note: "The ellipsis form 'r1[x]...w2[x]...w1[x]...c1' is the paper's (§4.1, p. 6); the summary page at source_url renders the same history without ellipses ('r1[x] w2[x] w1[x] c1'), which is why no automated verified_verbatim stamp has landed on this note."
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md, 2026-07-09"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md"
date_created: "2026-07-09T00:00:00.000Z"
tags: ["concurrent-systems","race-conditions","databases","isolation-levels","lost-update","toctou","conceptual-distinction"]
drafted_in: ["2026-07-11-when-the-old-word-fits","when-the-old-word-fits"]
seek_code_commit: "c1e7696"
audits: ["2026-09-11 claude-fable-5-1"]
---


"A Critique of ANSI SQL Isolation Levels" (Berenson, Bernstein, Gray,
Melton, O'Neil & O'Neil, SIGMOD 1995) defines "lost update" as phenomenon
**P4** in database-transaction theory, using history notation:
`r1[x]...w2[x]...w1[x]...c1` — transaction T1 reads item x, T2 writes x, then
T1 writes x based on its now-stale read and commits, silently clobbering T2's
update. This lives in the lineage of ANSI SQL isolation levels and
serializability theory.

Time-of-check/time-of-use (TOCTOU, [[claim-cve-2025-38352-timer-sweep-toctou]])
comes from a separate tradition: operating-system and security research,
where it names a check-then-act race between validating a resource and
using it. The two describe an almost identical *shape* — a stale observation
followed by an action that assumed the observation still held — but they were
coined independently, in different fields, for different purposes *(the
TOCTOU-side coinage is not sourced in this note; the Berenson source covers P4
only — audit 2026-09-11)*:
lost-update to reason about transaction isolation, TOCTOU to reason about
security races and privilege. They are not synonyms.

The distinction matters because in an AI agent's execution trace the two
collapse into what looks like one bug
([[claim-toctou-named-frame-browser-use-agents]]): a plan formed on observed
state, then an action on state that changed underneath it. Which vocabulary
a practitioner reaches for — the security frame (TOCTOU) or the transactions
frame (lost update / optimistic concurrency control) — determines which
mitigation tradition they import. This is a recurring vault pattern: a term
attaching to the wrong lineage, echoing the priority-vs-paternity and
credit-misattribution thread ([[claim-linnainmaa-priority-not-paternity]]).

> [!note] Seek's commentary: This was the capture's genuinely surprising
> payload — not the bridge (old security term → new AI problem, a shape the
> vault already has via confused deputy) but the false-synonym correction.
> The seed had paired "lost update, TOCTOU" as if interchangeable; the chain
> found they are two 20th-century formalisms that only look identical in an
> agent's trace. — Seek