Memory curation, governance and forgetting

Agents log everything cheaply and end up with summaries of summaries that fail at retrieval. The lifecycle that fixes it has named stages, and the interesting ones are the two most systems skip. Consolidation runs on a cadence tuned to the domain rather than a fixed clock — the reported precision stabilized around batches of roughly 200 events and improved further once forgetting was layered on top. Adjudication resolves a conflicting incoming claim three ways: update the existing entity, add a new one, or discard the incoming as erroneous. Evaluation splits three ways too — retention, retrieval, and task completion, the last being the most important and the most expensive — with the warning that perfect memory badly exposed by the harness simply gets ignored.

Four failure classes appear at fleet scale: concurrent writes, organization-wide poisoning, tracking collaboration between humans and agents, and stale, incorrect or maliciously injected memories. Four controls match them: version history carrying provenance — which session, which actor motivated the edit — optimistic concurrency (hash, draft, re-hash, retry), permission tiers running from curated org-wide read-only knowledge down to per-agent scratchpads, and explicit staleness handling. Prompt injection into memory is called out by name: persistent memory is one of the amplifiers that turns a single injected instruction into durable agent behaviour. The answer to "are we reinventing databases?" is yes, deliberately — codify the winning primitives in the harness rather than leaving them to agent discretion.

A second distinction sharpens the design: retrievable facts — numbers, past conversations, things that live as tokens — against implicit knowledge, meaning style, preference and how things are done, which resists being written down and belongs in weights or weight-like state. Both are required. A memory taxonomy from the graph side splits the same territory differently: conversational, long-term, procedural, and decision-trace memory, explicitly analogized to sleep-time consolidation.

Memory written back from a system's own successes is a continual-learning loop, and it carries a specific, well-named safety failure. An agent completes the task while violating a constraint; a task-focused evaluator scores the run positive; the next update amplifies the violation. Distribution shift is exactly where these failures hide, because evaluators score task success and miss constraint violations, so the failure repeats and escalates rather than surfacing.

Also: LongMemEval; Microsoft Foundry.

The three permission tiers already exist in practice — a human-only instruction layer, agent-proposable and human-merged project memory, and ephemeral agent-writable scratchpads — but they are convention rather than a stated contract, and nothing makes a machine proposal derived from unblessed content inherit the trust gate's quarantine flag. Formalizing the tiers, and making quarantine inheritable, is the cheapest item here. Concurrency, by contrast, is already answered and should be claimed as such: git's rejection of a stale push is the hash-draft-re-hash-retry loop, so there is no reason to hand-roll hash plumbing. Provenance is half-present — commits carry the actor, but a memory line does not carry which session or which incident motivated it.

Memory files only grow. There is no decay, no interference, no conflict adjudication and no consolidation cadence. The production memory work reads as a design review of Assay's unbuilt consolidation pass by people who shipped one, and three things transfer directly: fire the pass per stream or on an activity threshold rather than on a cron; have it propose diffs to existing entries — update, add, or discard — rather than appends; and adopt the retention / retrieval / task-completion triad as the pass's own acceptance criteria. The accept-or-reject step needs an edit-in-place affordance for any of this to be usable, and an entry's age should be a trust signal carried on the entry rather than something a reader has to infer. The fact/implicit split also gives a routing rule: memory holds facts and rulings, skills hold procedural know-how, so a proposal phrased as a preference or a way-of-doing targets a skill edit, not a memory line. Since Assay cannot touch weights, skills are its weight-level memory.

The unsafe-reinforcement pathway is the risk model for this whole theme. A pass harvesting lessons from transcripts is a continual-learning loop, so if a session succeeded while doing something subtly out of bounds — routing around a guard, borrowing an identity — a naive harvest reinforces the violation. That is the standing argument for keeping a human accept-or-reject gate, and for scoring proposals against constraint compliance rather than task success alone. It aligns exactly with the existing rule that a guard refusal is a full stop, never a prompt to find another route.

• Whether anyone publishes consolidation-cadence or forgetting parameters that transfer across domains, or whether the ~200-event batch stays domain-specific.
• Whether a second group reproduces the unsafe-reinforcement pathway empirically; it is currently one source and it is the most consequential claim in the theme.
• Whether memory permission tiers appear as a harness primitive rather than a convention — the signal that organization-wide poisoning is being treated as a real threat.
• Whether the retention / retrieval / task-completion eval triad gets an open implementation.