\section{Failure analysis and limitations}
\label{sec:limitations}

\paragraph{Contextual, not parametric.} Every effect reported here disappears when the message or cache is removed (A0). No receiver
acquired knowledge; frozen models were given better or worse \emph{access} to information. Claims about ``learning'' are out of scope.

\paragraph{Local white-box versus hosted black-box.} Cache experiments require a runtime that exposes attention tensors (MLX here).
Hosted APIs expose a billing abstraction (cached input tokens) whose precision, layout and residency are undisclosed; Track~D therefore
contains text methods only and its cached-token fields are never translated into bytes.

\paragraph{Same checkpoint versus cross-family.} All cache reuse and transfer results concern identical checkpoints and revisions
(Track~B, two-node B1) or a same-family size ladder with a linear mapper (Track~C). Cross-family cache transfer was not executed: the
only published method with code (SwaT) released no checkpoint and no licence, and training a mapper of its size exceeded our budget.
The paper's title names knowledge transfer in general; its \emph{cache}-transfer evidence is same-family only.

\paragraph{Query-aware versus reusable compression.} Attention-based selection is query-dependent; its question-blind variant (generic
window) is a different method with much lower quality (Section~\ref{sec:results}). Reusable (blind) messages and query-specific
(aware) messages are reported in separate panels and should not be ranked against each other.

\paragraph{Translated-cache distribution shift.} The mapper was fitted on native sender caches; chains of mapped caches (feeding a mapped
cache into a further mapping) were not run, so no closure property is claimed.

\paragraph{Budgets are measured but not universal.} Byte counts include manifests and quantization metadata; latencies include
serialization, loading and fresh-query processing; memory peaks are MLX allocator peaks. They are specific to \texttt{mlx-lm}~0.32.2
kernels on one M5~Max and two M3~Ultra machines; a fused eviction kernel or a different attention backend would change the compression
and TTFT components. We compared methods on a common backend; we did not compare against vendor-optimized kernels.

\paragraph{Network and reuse.} The two-node link is a 1~GbE LAN with 1.2~ms RTT; break-even positions scale with bandwidth and with
the receiver's prefill speed, both of which we report so that the analytic curves can be re-drawn. Queue delays were not imposed; the
cluster nodes carried a light concurrent CPU workload from another study.

\paragraph{Contamination and synthetic facts.} The public QA texts may appear in pre-training corpora; the communication-dependence
conclusions rest on the synthetic private-fact family, whose facts are new by construction but whose templates are narrower than real
documents. The generated ledger is not a filing; the executable tasks are small.

\paragraph{Scoring.} All scoring is deterministic (exact/numeric/yes-no/abstention/F1/hidden tests); no language-model judge and no human
annotation were used. The fact-ledger retention metric is string containment of normalized values, which under-counts paraphrased
retention and over-counts accidental matches of short values.

\paragraph{Coverage.} Two 3B model families, three task families, one sender budget (512 tokens) in the core, one selection ratio
(1/4) for the registered comparisons. Audited but unexecuted methods are listed with reasons in Table~\ref{tab:taxonomy} and
Appendix~\ref{app:audit}; their absence is a coverage gap, not evidence about them.

\paragraph{Auditability and security of latent messages.} A cache is not human-readable; our manifests bind it to a checkpoint
revision, tokenizer, chat template, prefix-token hash and document id, and the loader rejects mismatches, which protects against the
wrong-document handle. Structured evidence with spans is auditable but depends on the integrity of the source it points to; retrieved
passages are treated as data, never as instructions, and the public benchmark text never enters the operator's command channel.