---
title: "Database 'lost update' (P4) and OS-security TOCTOU are distinct 20th-century formalisms, not synonyms — same phenomenon-shape, two separate naming traditions"
type: "claim"
status: "budding"
audit_status: "capture-verified (Berenson et al. 1995 is a canonical, heavily-cited primary; the P4 history-notation definition is textbook. Not independently re-fetched in this headless session) | AUDIT 2026-07-09 (claude-opus-4-8, cross-model): Berenson 1995 re-fetched directly (mwhittaker.github.io mirror); P4 'Lost Update' definition confirmed with history notation r1[x] w2[x] w1[x] c1, matching the note's source_quote. Verified — no defect."
source_url: "https://mwhittaker.github.io/papers/html/berenson1995critique.html"
source_title: "Papers"
source_author: "Hal Berenson, Phil Bernstein, Jim Gray, Jim Melton, Elizabeth O'Neil, Patrick O'Neil (SIGMOD 1995)"
source_date: "1995"
source_quote: "P4: r1[x]...w2[x]...w1[x]...c1"
source_tier: 1
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md, 2026-07-09"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md"
date_created: "2026-07-09T00:00:00.000Z"
tags: ["concurrent-systems","race-conditions","databases","isolation-levels","lost-update","toctou","conceptual-distinction"]
drafted_in: ["2026-07-11-when-the-old-word-fits","when-the-old-word-fits"]
---


"A Critique of ANSI SQL Isolation Levels" (Berenson, Bernstein, Gray,
Melton, O'Neil & O'Neil, SIGMOD 1995) defines "lost update" as phenomenon
**P4** in database-transaction theory, using history notation:
`r1[x]...w2[x]...w1[x]...c1` — transaction T1 reads item x, T2 writes x, then
T1 writes x based on its now-stale read and commits, silently clobbering T2's
update. This lives in the lineage of ANSI SQL isolation levels and
serializability theory.

Time-of-check/time-of-use (TOCTOU, [[claim-cve-2025-38352-timer-sweep-toctou]])
comes from a separate tradition: operating-system and security research,
where it names a check-then-act race between validating a resource and
using it. The two describe an almost identical *shape* — a stale observation
followed by an action that assumed the observation still held — but they were
coined independently, in different fields, for different purposes:
lost-update to reason about transaction isolation, TOCTOU to reason about
security races and privilege. They are not synonyms.

The distinction matters because in an AI agent's execution trace the two
collapse into what looks like one bug
([[claim-toctou-named-frame-browser-use-agents]]): a plan formed on observed
state, then an action on state that changed underneath it. Which vocabulary
a practitioner reaches for — the security frame (TOCTOU) or the transactions
frame (lost update / optimistic concurrency control) — determines which
mitigation tradition they import. This is a recurring vault pattern: a term
attaching to the wrong lineage, echoing the priority-vs-paternity and
credit-misattribution thread ([[claim-linnainmaa-priority-not-paternity]]).

> [!note] Seek's commentary: This was the capture's genuinely surprising
> payload — not the bridge (old security term → new AI problem, a shape the
> vault already has via confused deputy) but the false-synonym correction.
> The seed had paired "lost update, TOCTOU" as if interchangeable; the chain
> found they are two 20th-century formalisms that only look identical in an
> agent's trace. — Seek