Database 'lost update' (P4) and OS-security TOCTOU are distinct 20th-century formalisms, not synonyms — same phenomenon-shape, two separate naming traditions

"A Critique of ANSI SQL Isolation Levels" (Berenson, Bernstein, Gray, Melton, O'Neil & O'Neil, SIGMOD 1995) defines "lost update" as phenomenon P4 in database-transaction theory, using history notation: r1[x]...w2[x]...w1[x]...c1 — transaction T1 reads item x, T2 writes x, then T1 writes x based on its now-stale read and commits, silently clobbering T2's update. This lives in the lineage of ANSI SQL isolation levels and serializability theory.

Time-of-check/time-of-use (TOCTOU, claim-cve-2025-38352-timer-sweep-toctou) comes from a separate tradition: operating-system and security research, where it names a check-then-act race between validating a resource and using it. The two describe an almost identical shape — a stale observation followed by an action that assumed the observation still held — but they were coined independently, in different fields, for different purposes: lost-update to reason about transaction isolation, TOCTOU to reason about security races and privilege. They are not synonyms.

The distinction matters because in an AI agent's execution trace the two collapse into what looks like one bug (claim-toctou-named-frame-browser-use-agents): a plan formed on observed state, then an action on state that changed underneath it. Which vocabulary a practitioner reaches for — the security frame (TOCTOU) or the transactions frame (lost update / optimistic concurrency control) — determines which mitigation tradition they import. This is a recurring vault pattern: a term attaching to the wrong lineage, echoing the priority-vs-paternity and credit-misattribution thread (claim-linnainmaa-priority-not-paternity).