1\section{Failure analysis and limitations}2\label{sec:limitations}34\paragraph{Contextual, not parametric.} Every effect reported here disappears when the message or cache is removed (A0). No receiver5acquired knowledge; frozen models were given better or worse \emph{access} to information. Claims about ``learning'' are out of scope.67\paragraph{Local white-box versus hosted black-box.} Cache experiments require a runtime that exposes attention tensors (MLX here).8Hosted APIs expose a billing abstraction (cached input tokens) whose precision, layout and residency are undisclosed; Track~D therefore9contains text methods only and its cached-token fields are never translated into bytes.1011\paragraph{Same checkpoint versus cross-family.} All cache reuse and transfer results concern identical checkpoints and revisions12(Track~B, two-node B1) or a same-family size ladder with a linear mapper (Track~C). Cross-family cache transfer was not executed: the13only published method with code (SwaT) released no checkpoint and no licence, and training a mapper of its size exceeded our budget.14The paper's title names knowledge transfer in general; its \emph{cache}-transfer evidence is same-family only.1516\paragraph{Query-aware versus reusable compression.} Attention-based selection is query-dependent; its question-blind variant (generic17window) is a different method with much lower quality (Section~\ref{sec:results}). Reusable (blind) messages and query-specific18(aware) messages are reported in separate panels and should not be ranked against each other.1920\paragraph{Translated-cache distribution shift.} The mapper was fitted on native sender caches; chains of mapped caches (feeding a mapped21cache into a further mapping) were not run, so no closure property is claimed.2223\paragraph{Budgets are measured but not universal.} Byte counts include manifests and quantization metadata; latencies include24serialization, loading and fresh-query processing; memory peaks are MLX allocator peaks. They are specific to \texttt{mlx-lm}~0.32.225kernels on one M5~Max and two M3~Ultra machines; a fused eviction kernel or a different attention backend would change the compression26and TTFT components. We compared methods on a common backend; we did not compare against vendor-optimized kernels.2728\paragraph{Network and reuse.} The two-node link is a 1~GbE LAN with 1.2~ms RTT; break-even positions scale with bandwidth and with29the receiver's prefill speed, both of which we report so that the analytic curves can be re-drawn. Queue delays were not imposed; the30cluster nodes carried a light concurrent CPU workload from another study.3132\paragraph{Contamination and synthetic facts.} The public QA texts may appear in pre-training corpora; the communication-dependence33conclusions rest on the synthetic private-fact family, whose facts are new by construction but whose templates are narrower than real34documents. The generated ledger is not a filing; the executable tasks are small.3536\paragraph{Scoring.} All scoring is deterministic (exact/numeric/yes-no/abstention/F1/hidden tests); no language-model judge and no human37annotation were used. The fact-ledger retention metric is string containment of normalized values, which under-counts paraphrased38retention and over-counts accidental matches of short values.3940\paragraph{Coverage.} Two 3B model families, three task families, one sender budget (512 tokens) in the core, one selection ratio41(1/4) for the registered comparisons. Audited but unexecuted methods are listed with reasons in Table~\ref{tab:taxonomy} and42Appendix~\ref{app:audit}; their absence is a coverage gap, not evidence about them.4344\paragraph{Auditability and security of latent messages.} A cache is not human-readable; our manifests bind it to a checkpoint45revision, tokenizer, chat template, prefix-token hash and document id, and the loader rejects mismatches, which protects against the46wrong-document handle. Structured evidence with spans is auditable but depends on the integrity of the source it points to; retrieved47passages are treated as data, never as instructions, and the public benchmark text never enters the operator's command channel.48