Agent Memory

Agent memory is the long-term, cross-session store an agent uses to preserve facts, preferences, traces, and state between interactions. It is structurally distinct from the KV cache (which is per-context, short-term, attention-internal) and from the prompt window (which is per-request).

2026-09-19: agent state is bloated at three layers at once, and three unrelated groups attacked all three in a fortnight

State the pattern, because it crossed the threshold today. Everything on this page so far treats agent memory as a retrieval problem: what to store, how to index it, how to read it back. Three results in fourteen days reframe it as a footprint problem, and they do it at three different layers of the stack with no shared authors and no cross-citation:

• The prompt. SKILL.state (09-19) replaces the append-only transcript with a mutable state object, so the model sees the skill spec, the latest observation, and a structured state it updates explicitly. Cumulative tokens down 16x at 100 turns, prompt footprint constant rather than growing.
• The loop. SoL-Pi (09-18) halved token traffic in a recursive auto-research harness, and the digest that day made the compounding point: halving traffic does not only save money, it doubles how many self-improvement iterations fit in the same budget.
• The host. AgentZip (09-19) compresses sibling agent sandboxes against their shared template and against each other, during the window when the agent is blocked waiting on an LLM response. Sandbox-owned memory falls up to 8.7x, against 2.1x for stock Linux, and restore prefetching holds the resulting slowdown to 1.40x instead of 3.1x.

The unifying claim, which none of the three states: an agent's "memory" is mostly a record of how it got here, and almost none of that is load-bearing for what it does next. Append-only history, a repeated base image, and an unpruned research loop are three encodings of the same redundancy. The fix in all three cases is to separate state from history and pay only for state.

This composes with the parallelism argument rather than competing with it. Elo-per-token (09-15), which converts within-task quality at each token budget into a cross-task Elo and locates the budget where a marginal token stops beating an independent sample, showed that re-slicing a fixed 100M-token budget into parallel sessions at that cap buys +264 Elo over one long session. That argues for width. AgentZip prices the thing width costs, and finds nearly nine tenths of it is redundant. Width is both better on quality per token and cheaper on infrastructure than a naive accounting suggests.

The open question this creates. SKILL.state reports tokens; it does not report task success at matched budget. Constant-size prompts should cost accuracy on problems that genuinely need full history, and the number that matters is the saving at equal success rate, not the saving. Until someone reports it, the 16x is an upper bound on a trade whose price is unmeasured.

2026-09-04: the store-and-retrieve architecture is now under attack from three sides, and the gap none of them touches got promoted to a safety problem

The pattern crossed this wiki's three-paper threshold today, so state it. Three results in three days all move work out of the read path and into a representation the model consumes directly, rather than improving retrieval itself:

• EM²Mem (09-02) binds heterogeneous evidence to event anchors at construction time. 63.66% fewer inference tokens, 4.67x lower latency, plus accuracy gains.
• LatentPress (09-04) writes history into continuous soft tokens a frozen decoder reads through its input-embedding interface, no text reconstruction at inference: 0.504 at 7.70x compression against 0.490 uncompressed, and against 0.184 for text summaries.
• LatentStream (09-04) refuses to hold streaming video history as external visual context and internalizes it into a fixed-length latent memory instead, naming the shift store-and-retrieve → retrieve-and-internalize.

The shared claim is precise and it is not the one the papers advertise: retrieval's real cost is not the search, it is that what you retrieve arrives in a format the model has to re-parse. Write-time anchoring, latent soft tokens and progressive internalization are three different rejections of a human-facing intermediate representation on the grounds that the consumer is a model. Two of them landed the same day in different modalities without citing each other.

LatentStream's fixed-length read is the property this page should adopt as a design requirement. Every retrieval-augmented memory system here budgets the store and leaves the read unbudgeted: retrieve five fragments, grow the context by five fragments. A fixed-length internalized memory converts a variable, query-dependent context cost into a constant, which is the difference between a system you can capacity-plan and one whose cost depends on what the user asked.

And now the part that should reorder this page's priorities. All three improve packaging. None of them moves the retrieval gate, and today a paper made that gate a safety problem. InMind (07-29) established the implicit-association blind spot: retrieval only surfaces a fact when the fact resembles the query, so a stored tree-nut allergy never fires on a macaron request, and six vector, graph and agentic systems reached at most 14.4% on indirect queries against 84.0% when the memory was simply placed in context. PACE (09-04) (arxiv 2609.03293) builds an evaluation whose entire difficulty is that gap: persona-grounded requests paired with egocentric knowledge-base facts, where the disqualifying fact must be retrieved and does not resemble the request, so the assistant complies with something that is wrong for this specific user. It adds a refusal type neither policy classifiers nor capability limits cover, conflict-based refusal, grounded in the requester's circumstances rather than in the request.

Two independent papers five weeks apart converging on "similarity retrieval structurally cannot support personalized assistance," and the second attaches consequences. The right reading for this page is that the roughly 70-point indirect-association headroom is the load-bearing failure, not a benchmark artifact, and packaging improvements have now been measured three times without touching it.

PaceMaker is the first mechanism here aimed at the gate rather than around it, and its three agents are three distinct rejections of similarity: query reformulation rewrites toward the fact's vocabulary, multi-hop graph traversal abandons similarity for structure and follows relations to a fact sharing none of the query's words, and conflict-aware filtering scores candidates on decisiveness rather than relevance. That third one is what every system on this page lacks: they all rank by relevance and none ranks by whether the retrieved item would change the answer. The unpriced problem is that PaceMaker must run on every request, since you cannot know in advance which requests hide a conflict, and a multi-agent retrieval pass per turn is a large unreported multiplier on serving cost.

2026-09-02: two papers, one day, same conclusion. Anchor memory when you write it, not when you read it

The convergence is the finding, and the two papers sit on opposite sides of the model boundary. EM²Mem (09-02) (arxiv 2609.00551) builds event anchors in the harness, at memory-construction time. Safin-1 (09-02) (arxiv 2609.00092) maintains memory anchors in the architecture, retrieved by content-conditioned routing. Same word, same instinct, two layers, published the same day, neither citing the other.

EM²Mem supplies the distinction this page has needed: searchable is not generation-ready. Existing multimodal memory retrieves captions, frames, transcripts, summaries and graph facts as isolated fragments. Those fragments are findable, but the language model must then reconstruct cross-modal and temporal alignments at inference time, exactly when context is tightest and attribution hardest. EM²Mem binds heterogeneous evidence to event anchors during construction, so each event-indexed cell aligns multimodal records, temporal context, graph-linked relations, semantic facts and provenance around one grounded event. The reported effect:

• +2.0, +2.4 and +3.7 average accuracy points over the strongest memory baseline across three long-video QA benchmarks.
• +7.0 points on strict event-level Top-5 evidence recall.
• 4.67x lower per-query latency and 63.66% fewer total inference tokens.

The accuracy gain and the cost gain come from the same mechanism, which is rare on this page. Most memory work trades retrieval quality against context budget. Moving alignment from read time to write time improves both, because the read-time reconstruction was consuming tokens and producing worse groundings.

It is the fourth arrival at "move the expensive decision out of the loop," and the first to publish both halves of the ledger. The 08-29 digest named that split: CritICL (08-29) moved reasoning supervision into an offline critique repository so inference does one generation; the ACE lens (08-28) argued agentic data generation is a continual allocation problem decided before training; Ken Huang's multi-agent guide capped fan-out at a constant chosen offline. All three moved work out of the loop and reported the capability side only. EM²Mem reports the capability gain and the token saving, which makes the tradeoff checkable rather than merely plausible.

What it does not do, stated precisely because the numbers invite over-reading. InMind (07-29) measured the implicit-association blind spot: retrieval only surfaces a fact when the fact resembles the query, so a stored tree-nut allergy never fires on a macaron request, and six vector, graph and agentic systems reached at most 14.4% on indirect queries against 84.0% when the memory was simply placed in context. EM²Mem improves how well retrieved evidence is packaged; it does not change whether the right evidence is found. Its 7.0-point gain is on event-level Top-5 recall, not on indirect association. The roughly 70-point InMind headroom is untouched.

Safin-1's contribution to this page is the lifetime of the stored object. Raven (08-04) routes a write into a fixed set of memory slots per incoming token, but those slots are working state within one sequence. Safin-1's persistent capability states are adapted at test time and survive across queries, without repeatedly modifying the backbone. That is a memory tier this page has not had: neither per-context like the KV cache nor per-session like an agent store, but a durable, separately-maintained piece of model state. The safety framing it ships with has no numbers in the abstract, so treat the architecture as the contribution and the safety result as unverified.

Open item for this page. Event anchoring is demonstrated only where a natural temporal event structure exists. Text-only agent sessions, codebases and document corpora have no obvious equivalent, and EM²Mem does not propose one. Nor is the construction cost reported, so the break-even number of queries per video is unknown, and write-time work only pays when writes amortize over many reads.

2026-08-31: two groups independently reject irreversible eviction, and the "delivery volume" question gets a rival answer

The convergence first, because it is the cleanest signal on this page in weeks. Two systems released in the same week both concluded that eviction must be reversible, and neither cites the other.

• Scroll (Alibaba, surfaced via the DAIR.AI weekly) backs each session with an append-only event log plus a sandboxed persistent Python kernel. Tool outputs and derived state bind to typed variables across model calls instead of being re-serialized into the prompt every turn, and only explicitly printed projections cross into the working view. When the working view nears its budget, stale spans are evicted but stay retrievable through an eviction index of compact landmarks tied to exact event-log addresses, so the agent navigates back to a region rather than searching the whole log. 94.8% on LongMemEval_S, 73.1% on BEAM_10M (5.1 points over the best published memory system), 86.7% on LOCA_256K.
• ContextPilot (Tencent, HuggingFace) adds soft context offloading to the standard search/delete/summarize toolset, alongside planning and long-term memory tools. Same primitive under a different name: evict, but keep addressable.

Why this is a real finding and not a coincidence of vocabulary. Every production context manager today compacts irreversibly, and this page has been treating that as a given while arguing about what to keep. Two independent groups in one week decided the binding constraint is not selection quality but recoverability, which reframes the problem: you do not have to select correctly if you can undo the selection. That is a much weaker requirement, and it explains why both systems could drop the schema-design step that every prior memory system on this page required up front.

The Scroll design also states the deeper claim explicitly, and it is worth carrying. Because context management runs as code rather than as a fixed mechanism, it inherits every future improvement in model coding ability for free. That is an argument about which parts of an agent system should be mechanism and which should be program, and it is the memory-layer version of the agent-harness-engineering thesis that capability lives in the scaffold.

New open problem: two rival answers to context cost, never compared under matched budgets. ALTK-Evolve (08-12), recorded below, makes per-step delivery volume an externally tuned parameter and got DeepSeek-V3.2 from 80.4% to 89.3% task-goal completion at 263K tokens per task against 634K, which this page read as proof that the baseline was paying for context that was actively harmful rather than merely redundant. ContextPilot makes the same quantity a learned policy the model applies to itself, trained with per-action advantages estimated by branch-sampling through pivotal edits rather than by smearing the trajectory reward across every edit. The external knob is auditable and easy to reason about; the learned policy should adapt better across task variety. Neither has been run against the other at a fixed token budget, and that comparison decides an architecture choice a serving stack will otherwise make by accident.

And it sharpens the page's outstanding tension rather than resolving it. The entry below records that Recuris's external-verification requirement cuts against the strong form of "memory should be native to the model," because verified externality is what made state trustworthy and failures attributable. Scroll and ContextPilot land on opposite sides of that line. Scroll pushes memory further out (an event log the model queries as code, with lossless ground truth preserved). ContextPilot pushes control further in (the model decides what to evict, trained by RL). Both report gains. The page should keep holding both rather than picking, but the discriminating experiment is now easier to state: on a task where the agent's self-assessment is known to be wrong, which design degrades less? Agents are not time aware (08-30), which found coding agents overrate their own work by roughly 20 points, supplies exactly that condition.

2026-08-26: splitting working memory from experiential memory, and verifying the former

Recuris (arXiv 2608.24876) makes an architectural distinction this page has been treating as one thing, and the split is the contribution. Its diagnosis of prior memory systems is specific enough to be worth recording as a critique of the field rather than only as motivation for one paper. Experiential memory methods retrieve reusable skills keyed on either the initial instruction or the full interaction history, and both keys degrade as a task runs: the instruction goes stale as the task evolves, and the full history grows until it obscures the state it is supposed to describe. So retrieval starts returning irrelevant or outdated skills exactly when the task is hardest. Working memory methods do track state, but their updates are either rule-fixed or self-reported by the model, with no external verification, which makes them vulnerable to omission and hallucination.

Recuris keeps both and couples them: Working Memory holds verified task progress, and it is Working Memory rather than the transcript that selects skills from Experiential Memory. That grounds skill invocation in current need. The second-order payoff is the more interesting one for this page. Because state is checked against the environment, an execution failure localizes to a specific memory component, and that attribution is what lets a fixed Meta-Agent write a validation-gated local patch to Skill Memory rather than a global rewrite. Verified state is thus not only a reliability mechanism, it is the credit-assignment substrate.

Results: improvement in 35 of 37 completed model-benchmark pairs across four long-horizon benchmarks and ten models; +17.8 to GPT-5.6 Sol and +15.6 to Claude Opus 5 on tau-bench, taking Opus 5 to 87.9%; +16.6 and +13.5 on Qwen3.6-27B/35B on SkillFlow; +32.2 on the longest tasks; common long-horizon failures down up to 80%. The widening-with-horizon shape is what makes the mechanism claim credible rather than a general scaffolding benefit.

Relation to what this page already held. The external-verification requirement confirms LongHorizon-Harness (arXiv 2608.01964, Alibaba, 08-13), whose Manage-Execute-Audit loop keeps task state outside the execution context and updates it only on environment-verified facts so that wrong self-assessments stop propagating. Recuris is the same commitment extended: not just state outside context, but state as the retrieval key. It also cuts against the strong form of the "memory should be native to the model" turn surfaced on 08-13 — if verified externality is what makes state trustworthy and failures attributable, then folding memory into the weights gives up the property that made it work here. Both directions are live and this page should keep them in tension rather than pick.

The unpriced part. Maintaining verified working state and running validation gates are per-step overheads, largest on exactly the longest tasks where the gains are largest, and no token or dollar cost is reported. Two of 37 pairs did not complete and the paper does not say which. Full treatment in the summary and in agent-harness-engineering, where Recuris mostly resolves that page's open problem 2 on composing state management, self-optimization and memory routing end-to-end.

Current State (as of 2026-08-12)

The bill arrived. Two results dated the same day treat accumulated procedural memory as a cost line to be minimized rather than a store to be improved, and they split on how.

Shrink the artifact. SkillZip (08-12) (2608.11079) compresses an agent's skill file by finding its shortest faithful structural explanation under a typed minimum-description-length objective over a contract and a residual, with a hard coverage constraint on every extracted trigger, workflow edge, tool requirement, obligation and output field. The intuition is explain once, reference many. It is evaluation-free: no rollouts, so no dependence on whichever tasks were in the compression-time evaluation set, and rare unique rules survive by construction rather than by hoping a sampled task activates them. Zip-on-Write folds each new patch in without replaying history.

Shrink the delivery. IBM Research's ALTK-Evolve (08-12) leaves the store large and makes how much of it ships per step an adjustable parameter: a small always-on core of high-confidence guidelines plus a per-task retrieved subset, or everything when the model has capacity. Guidelines are typed (strategy, recovery, optimization), merged when similar, and keep their support counts so provenance survives the merge. On AppWorld against ACE (Agentic Context Engineering, which injects one comprehensive playbook every step): DeepSeek-V3.2 at 89.3% task-goal completion and 263K tokens per task against 80.4% and 634K; GPT-oss-120b at 56.0% and 116K against 54.8% and 777K.

The DeepSeek row is the load-bearing number on this page today: 8.9 points more accuracy at 41% of the token cost. Both axes moving the right way at once means the baseline was paying for context that was actively harmful, not merely redundant. This page has been treating memory volume as a storage-and-retrieval problem; that result says volume is also an interference problem.

And it explains a finding this page has carried unexplained since 08-05. SkillBench and PastBench (08-05) found explicit skill maintenance merely matches plain in-context learning on average, with weaker models accumulating more fragments. ALTK-Evolve's per-model calibration is the mechanism: weaker models are hurt by volume, stronger ones absorb it, so a fixed delivery policy averages to nothing across a model mix. Delivery volume is a per-model parameter, and no memory system on this page treats it as one.

Compression versus selection is now a real design fork here, and it is composable. Neither result cites the other and nobody has run compress-the-store-then-deliver-a-subset. Against them, the two 08-11 papers below both bound memory by allocating a fixed budget: RoMeRL's fixed-dimensional per-task state (store down 84.4%) and AMD's teacher-built store. So the page now holds three positions on the same problem, allocated, deduplicated and selectively delivered, and there is no comparison between any two of them.

One caution, and it is specific to today's methods rather than general. ALTK-Evolve's per-task selection is cosine similarity or LLM choice, which is exactly the mechanism InMind (07-29) indicts: retrieval surfaces a fact only when the fact resembles the query, six systems at at most 14.4% on indirect queries against 84.0% for the same memory simply placed in context. AppWorld states tasks fairly directly, so the blind spot plausibly did not bite. The falsifiable version: ALTK-Evolve's margin over ACE should shrink or invert on a benchmark with indirect task statements. SkillZip does not have this exposure, because it compresses rather than retrieves.

The security caution is shared and gets worse with both. A compressed or merged skill is still prose, so it stays on the wrong side of the copyable-context trilemma (08-03), and SkillJack (08-05) measured detection collapsing from 98.5% on a poisoned trajectory to 11.4% on the skill extracted from it, with 80% of attacks surviving deletion of the source records. Both of today's methods add another abstraction step, and merging rules across branches is precisely the operation that launders a poisoned rule into a shared procedure many branches then reference. Neither discusses adversarial input.

Prior State (as of 2026-08-11)

Two papers on one board, attacking the same starvation from opposite ends: one fixes the data, one fixes the estimator.

The data side. AMD (08-11) (2608.07169, KAIST) names a cold-start problem this page has never had a result on. Every self-evolving memory system here assumes the agent produces enough successful experience to learn from. A small model does not: it rarely succeeds, so its self-built store fills with failures. AMD builds the store from a large teacher agent's successful trajectories instead, factored into three granularities, Workflow (task-level strategy), Subtask (concrete intermediate behavioral examples) and Function (per-function calling conventions and pitfalls), with Workflow and Subtask injected proactively at task start and Function retrieved reactively on tool-call error. Training-free. GPT-5-mini teacher, 4B-8B students: +27.2pp AppWorld, +11.2pp BFCL V3, +3.4pp ToolSandbox, and Subtask memory contributes the largest share, which locates the transferable abstraction level between "here is the plan" and "here is the exact call." The reported dependence on both teacher capability and student compatibility, with 4B benefiting most, is the Extrapolation Cliff (05-14) shape appearing in a memory system with no gradient anywhere in it.

The estimator side. RoMeRL (08-11) (2608.02508) names the memory-reward trap: trajectory-level rewards are assigned jointly to every co-retrieved memory, so irrelevant experiences absorb credit they did not earn, while trajectory-indexed utilities grow with history and disperse limited feedback over an ever-expanding support. The fix replaces the index: a fixed-dimensional per-task memory state factorized by outcome polarity and memory dynamics, so experience enters through a bounded set of semantic coordinates whose contents are updated or replaced rather than appended. ALFWorld and LifelongAgentBench: Cold-Q ratio down 80.0%, feedback density up ~6.0x, maintained memory size down 84.4%, LLM calls down 21.1%. Cold-Q ratio is a metric this page should adopt, since it names the fraction of utility entries that never received meaningful feedback, which every memory paper implicitly hopes is small and none of them report.

What the two say together. AMD imports experience; RoMeRL makes the surviving feedback go further. Nobody has composed them, and the composition is obvious: seed a RoMeRL memory with AMD's teacher-derived entries, then let the bounded utility states learn on top.

RoMeRL also lands the third instance of a principle this page now shares with two other pages. Raven (08-04) keeps a fixed set of memory slots inside a linear-time language model and routes which subset each token writes to, holding recall at 16x training context. WorldTrace (08-10) assigns each compressed KV summary slot a distinct in-distribution virtual position so position becomes an assigned address rather than an inherited timestamp, for +19.5% episodic recall. RoMeRL fixes the number of utility coordinates and replaces their contents. Model state, KV cache, agent memory store: three levels of the stack, eight days, one claim, that a bounded and addressed memory beats an appended one. The 08-10 Looking Ahead gave this 90 days to get named as one modality-general principle; it is at three instances in eight.

The tension with Zero-Mem, stated so it can be resolved. The Zero-Mem result logged on 08-10 cut memory-operation time cost 57.6% by spending zero LLM tokens on anything but the final answer, indexing raw traces twice instead of generating summaries, and argued most production memory-stack spend buys structure that plain indexing already provides. RoMeRL keeps a learned utility model and still cuts LLM calls 21.1%. Those are compatible only if the expensive part was the unbounded index rather than the learning, which is a testable claim neither paper makes.

Standing gap, now more visible. Neither of today's papers reports context cost. AMD injects Workflow and Subtask memory into every task prompt, and TokenPilot (06-16) established that agent-context methods which mutate the prompt prefix trigger full prefill recomputes that cancel the token saving. A 4B model with a large injected store may cost more to serve than a smaller injection into a stronger model, and no paper on this page has run that comparison.

Prior State (as of 2026-08-10)

The streaming-memory tradeoff finally has a clean three-corner statement, and every corner has a named failure. StreamArena (08-10) (2608.05703) replaces the short-clip multiple-choice protocol that streaming video evaluation has been using with 243 full-length videos averaging 88.8 minutes and 3,646 open-ended question-answer pairs covering real-time perception, historical retrospection, proactive interaction and multimodal tool use. Its diagnostic finding first, because it is the one that invalidates prior work: on the old benchmarks, a baseline that processes only the last four frames matches or surpasses complex streaming models, and the answer options separately leak language shortcuts. The three corners it then names: keep only recent frames and distant events are unrecoverable; convert past observations to text and the visual evidence is gone; repeatedly compress visual memory and fine-grained detail decays.

The system-side answer is scheduling, not modeling, and it is the second independent arrival at "memory writes are a background job." StreamMind puts latency-critical interaction and proactive monitoring on independently scheduled frontend workers while backend workers asynchronously build persistent multimodal memory and serve historical recall and external search, reducing query-to-answer latency by reusing persistent state. Activity frames (08-07) argues for a deterministic memory record built outside the model's inference path for correctness reasons. StreamMind reaches the same architecture for latency reasons. Two motivations, one layout, and it is now the default this page should assume.

The compression corner has a candidate cause published the same day, from generation rather than understanding. WorldTrace (08-10) finds that compressed visual KV memory in video world models becomes unaddressable once rollouts pass the training horizon, because the temporal rotary-positional-embedding offsets fall out of distribution, and that averaging cache entries in rotated positional space corrupts them by blending incompatible phases. Its fix is to assign each compressed slot a distinct in-distribution virtual position. StreamArena observes the symptom empirically, WorldTrace names an arithmetic cause and a training-free cure, neither cites the other. Testing WorldTrace's virtual positions against StreamArena's compression corner is the highest-value untried experiment currently touching this page.

Also on the memory-cost axis, from outside the papers. DAIR.AI's weekly roundup (starred Gmail, 08-10) highlights Zero-Mem, which asks whether structured memory access requires generation at all: no step outside final question answering invokes an LLM or spends LLM tokens, with two indexed views over the raw interaction traces (an entity-context graph across sessions, and a temporal hierarchy preserving conversational locality), calibrated deterministically before a single reader call. Reported result: at matched reader and context budget, memory-operation time cost drops 57.6% against the fastest compared baseline with competitive accuracy on long-memory and long-context QA. The implication for this page is uncomfortable and specific: a large share of production memory-stack spend is buying structure that plain indexing already provides.

Prior State (as of 2026-08-03)

Two Meta results the same week, same problem, opposite architectures, and nobody has compared them. ACM: Agentic Context Management (08-03) (2607.23809, Meta and CMU) attacks the token-threshold compactor every agent framework ships. Its complaint is that the trigger fires on how much text exists rather than on what the agent is reasoning about, so compression happens at an arbitrary moment and discards whatever is least recent rather than least needed. ACM gives the agent purpose-built context editing tools so it decides when to compress, offloads discarded content to an external memory system rather than deleting it, and queries that store on demand, with a post-training pipeline teaching the model to do this well. Reported effects: lower peak token pressure, longer explorations, and more consistent solutions across independent trials, which is the property enterprise buyers actually ask for and no benchmark on this page scores. Separately, Meta AI's memory-coach agent puts a second agent in charge of a structured memory bank, deciding when to remind the main agent and when to stay silent, for up to 8.3 points across two benchmarks. The trade is legible: self-management keeps the decision next to the reasoning that motivates it, while externalizing it means the manager is not competing for the window it manages and does not share the main agent's failure mode.

Two cautions this page should attach to ACM. The economics are unreported: TokenPilot (06-16) established that prompt-cache hit rate rather than token count clears the bill, and that any context edit mutating the prefix triggers a full prefill recompute that cancels the saving; ACM edits context repeatedly by design and reports peak token pressure instead of cache hit rate. And the faculty it depends on has been measured unreliable: Reality monitoring (08-02) found models at ceiling on distinguishing their own prior output from user-supplied content in short contexts and inverting under episodic delay, because the apparent ability was reading proximity in the prompt. Agent-directed retrieval from external memory across exactly that distance is being run by the faculty shown to fail there. → summary

Current State (as of 2026-07-31)

The field forked today. Two papers argue memory should not be external at all, a third measured the most popular external memory and found its main claimed benefit does not exist, and a fourth put a scale boundary on searching it. Everything on this page below this section assumes memory lives outside the model and the interesting questions are about what to store and how to retrieve it. Four papers on 2026-07-31 attack that assumption from three directions.

The internalization fork. Metis (2607.26760) proposes memory foundation models: a persistent memory state living inside the backbone, written and read by native memory procedures that are ordinary forward computation. Online maintenance is gradient-free, weights stay frozen at inference, and reading happens through a dedicated memory-attention path so history occupies zero context tokens. Memory Decoder at Scale (2607.27919) also deletes the external store but keeps memory as a separate model with its own parameter budget, trained to predict what a kNN retriever over 300B tokens would have said. Its result is a parameter-allocation claim: a 6.9B memory plus Pythia-410M averages 37.34 across 17 benchmarks against Pythia-12B's 37.24, at 39% fewer total parameters, and a 1.7B domain memory adds more than 9 points at every Qwen3 Base size from 0.6B to 14B, so the gain does not shrink as the base absorbs more knowledge.

These two agree on the diagnosis and split on the cure. Memory as activations you persist versus memory as parameters you allocate. Neither cites the other and there is no shared benchmark, so this is a fork and not a convergence, and the page should resist calling it a pattern until someone runs both on LongMemEval or LoCoMo. Metis also reports no benchmark numbers at all, which is the reason to hold it loosely.

The external default gets measured for the first time, and the news is deflationary. Filesystem-Based Memory for LLM Agents (2607.26637) studies the directory-of-markdown-files store that deployed agents actually use, formalised as a management agent, a search agent and an execution agent around one memory filesystem, with declarative memory and skills unified in one store. Three findings. What organization reliably buys is search economy, roughly halving retrieval cost where material is large. No agent measured converted organization into better answers. And organization erodes as the store grows for all but the strongest management agent, so self-maintenance is capability-gated rather than automatic. The most actionable result is orthogonal to all three: changing the tool set alone reshapes the store as strongly as swapping the model.

Read alongside BM25 Wins at Scale (2607.26497), which found an agentic filesystem searcher loses to plain lexical ranking by nearly 20 points past roughly 10 million corpus tokens while spending 39x more query tokens, the pair is a two-sided verdict on the same artifact: the filesystem is a good place to keep things and a bad place to search at scale, and the mechanism is that the organization the searcher depends on degrades precisely as navigation gets hard.

Where this leaves the page's three-failure ladder. The 07-29 entry below ordered the known failures by pipeline position: triggering (InMind, does the fact surface at all) precedes access precedes compliance (TRACE, an agent can recall a rule and ignore it, 57.5% of applicable preference checks still violated with Mem0 in place). Filesystem-Based Memory adds a fourth that sits before triggering: the store's own health degrades, so what is available to trigger on is worse than what was written. And the internalization fork is a bet that removing the first two rungs entirely is easier than fixing them.

The test that decides the fork is cheap and nobody has run it. InMind's paired-control design showed six retrieval-based systems answer at most 14.4% of indirect queries whose answers they demonstrably hold, against 84.0% for the same backbone when the fact is placed in context, and diagnosed the failure as triggering rather than storage or capability. A parametric or native memory has no trigger step: the memory contributes to every token's distribution whether or not the query resembles the stored text. So running Metis or Memory Decoder on InMind is the direct test of whether "delete the retrieval joint" fixes the joint's failure or relocates it. If the number stays near 14%, the problem was never retrieval.

Current State (as of 2026-07-29)

The memory problem splits a third time, and this split sits before the two the page already tracks. Retrieval systems fail to surface facts they demonstrably hold. InMind (2607.24368) names the assumption every retrieval-based memory system rests on and almost never states: a memory that is needed will resemble the query that needs it. World knowledge breaks it constantly. A stored tree-nut allergy should change the answer to a macaron request, because macarons use almond flour, but the two texts share no cue a retriever can see. InMind calls this the implicit-association blind spot and scores it with 125 expert-verified tasks across ten life domains, 113 grounded in citable public sources, with paired controls that separate three explanations existing evals conflate: never stored, model lacks the bridging knowledge, or stored and never surfaced.

The paired-control design is what makes the verdict unarguable. With the decisive memory placed in context, the backbone answers 84.0% of indirect queries, so the model has the bridging knowledge. The same systems recall those facts on demand at up to 100%, so the store has them. When the memory must be retrieved, six vector, graph, and agentic systems reach at most 14.4%. Nothing is left to blame but the interface. An embedding with eight times the dimensionality raises answer-blind target recall for every system and leaves the gap essentially intact, which closes the "it's a representation-capacity problem" escape hatch: better embeddings find the right thing when you know what you are looking for, they do not tell you a macaron query should go looking for allergies.

Ordered by pipeline position, the page now tracks three distinct failures and only two of them had names. Triggering (InMind: does the fact surface at all?) precedes access precedes compliance (TRACE, 06-13: with Mem0 memory in place, 57.5% of applicable user-preference checks were still violated, because an agent can recall a rule and ignore it). TRACE's line was "preference access is not preference compliance," and it assumed the fact reaches the model. InMind shows that for implicit associations it does not, even when the store holds it and the model would use it correctly if handed it. Both sit downstream of the 05-15 cluster's recall ceilings (STALE 55.2% on implicit-conflict detection, MemLens below 30% on multi-session), which measured a different thing again.

The result is a partial verdict on MRAgent (06-15)'s thesis that "memory is reconstructed, not retrieved." A reasoning loop that expands and prunes retrieval paths as evidence accumulates is exactly the shape of fix this calls for, and it is precisely what should bridge macarons to almond flour to allergies. But InMind's six systems include agentic memory and they still cap at 14.4%, so the reconstruction loop as currently built does not bridge implicit associations either. The probe that does recover most of the gap is cruder and does not scale: keep memory visible before the query arrives, which is not retrieval at all.

The open problem the paper names is routing, and that is a new axis for llm-routing. That page routes over which model answers, which expert or head fires, or which phase goes where. InMind proposes routing over which facts occupy context, decided before the query is known, which is a scheduling problem against a fixed context budget and therefore structurally closer to KV cache admission than to model selection. It is also the benchmark that would score the "route to memory before routing to a model" tier the 07-28 digest predicted someone would build within 90 days.

Read against the same day's Sparse Event-KV memory contract, the pair is genuinely disorienting. InMind: explicit external memory under-delivers what it provably stores. Sparse Event-KV: implicit cache memory delivers information it was never asked to store, because a downstream cached event materializes a computation whose source observation was dropped. The two failures point opposite ways and undermine the same assumption, that the served context is the information the model is using.

Current State (as of 2026-06-15)

Make retrieval reasoning-driven, not a one-shot lookup (MRAgent, 2026-06-15). MRAgent (arxiv 2606.06036) targets a different half of the memory problem than TRACE's compliance angle: the rigidity of retrieve-then-reason. Standard memory agents fetch top-k chunks once, then reason, so they cannot re-query based on evidence found mid-inference. MRAgent stores memory as a Cue-Tag-Content associative graph (tags are semantic bridges from fine-grained cues to contents) and runs an active-reconstruction loop where the LLM's reasoning iteratively expands and prunes retrieval paths as evidence accumulates, avoiding combinatorial blow-up via evidence-based pruning. Up to +23% over strong baselines on LoCoMo and LongMemEval, while cutting token and runtime cost (it stops expanding once it has enough). Its framing, "memory is reconstructed, not retrieved," is a falsifiable bet against the static vector-store default. The complement to EvoMem (06-14, store memory as patch histories of how the world changed): EvoMem changes what is stored, MRAgent changes how it is read. The open risk is the same confabulation worry Honest Lying (06-09) raised: a reasoning-steered loop that prunes on its own evidence is exactly where a wrong early turn could compound, and the paper does not test against poisoned memory. → summary

Current State (as of 2026-06-13)

The bottleneck is compliance, not recall: compile preferences into gates, don't just remember them (TRACE, 2026-06-13). TRACE (arxiv 2606.13174) reframes a failure the whole memory line has implicitly assumed away. The wiki has tracked memory systems on the premise that better recall yields better behavior (MemForest 05-26, SAM 05-27, MemTrain 06-04, InKH 06-07). TRACE shows that even with Mem0 memory, 57.5% of applicable user-preference checks are still violated: the agent can recall the rule and ignore it. The fix is to mine user chat corrections, rewrite each as an atomic rule, and compile them into runtime checks that must pass before a task completes, an enforcement layer rather than a retrieval layer. Cuts held-out preference violation from 100% to 2.0% on out-of-distribution coding tasks (and to 37.6% in-distribution), though only to 60.5% on fuzzier MemoryArena tasks where preferences resist clean compilation. The reframing matters: "preference access ≠ preference compliance" splits the memory problem in two, and most of the wiki's prior work optimized only the access half. Pairs with the same-week kilocode REVIEWS.md and Cursor Auto-review product launches, which independently compile review standards into agent gates. → summary

Current State (as of 2026-06-07)

Staleness gets attacked at the systems layer, not the training-objective layer (InKH, 2026-06-07). InKH (interaction-native knowledge harness, arxiv 2606.01886) targets the stale-memory failure the 05-15 cluster measured (STALE capped frontier models at 55.2% on implicit-conflict detection) with engineering rather than a new objective: a temporal graph memory, passive knowledge injection that assembles a bounded working-context buffer before the model step, and background extraction with maturity, decay, and write-time invalidation. The load-bearing piece is write-time invalidation — invalidate stale knowledge when written, rather than hoping retrieval filters it later. Against a temporal-graph system without invalidation it still improves quality by 0.050 and cuts stale-memory use by 96.58% at comparable cost; against agent-driven wiki-walk memory it cuts latency 82.95% and token cost 82.29% while raising traceability by 0.461 (a human-readable wiki audit surface for governance). This is the complement to the training-objective approaches the page tracks: MMPO (06-05) penalizes summaries that muddy belief, MemTrain (06-04) rewards faithful compression; InKH engineers the store to expire correctly. The blunt takeaway for builders: a large fraction of agent-memory quality is plumbing (invalidation, decay, bounded buffers), not modeling. Benchmark is synthetic, so generalization to noisy real streams where "what is stale" is itself uncertain is open. → summary

Current State (as of 2026-06-05)

Memory optimization shifts from outcome reward to belief clarity (MMPO, 2026-06-05). MMPO (Metacognitive Memory Policy Optimization, arxiv 2605.30159) makes the same critique of recursive-summary memory that the wiki has made of agent evals: outcome-based RL gives one reward at the end of a long trajectory, so it cannot localize which intermediate summary degraded memory quality, and ambiguous summaries silently accumulate until belief deviation derails the run. MMPO introduces Belief Entropy, a self-supervised proxy for how uncertain the model remains about the latent task state given its current memory, and uses it to densely penalize summaries that raise epistemic uncertainty. Result: beats outcome-only methods and holds 97.1% performance at 1.75M-token contexts. This is the control complement to yesterday's MemTrain (which acquires a memory skill self-supervised): MemTrain rewards faithful compression throughout the interaction, MMPO penalizes summaries that muddy belief. Belief Entropy is the memory-side analogue of DRIFT/TELBench's span-level error localization (06-04) — both replace a single end-of-trajectory verdict with per-step signal. MMPO also belongs to today's six-paper self-evolving-agents cluster (keystone: Rethinking Continual Experience Internalization, which found naive iterative self-evolution collapses unless experience is principle-level, step-wise-injected, and off-policy-internalized; siblings MLEvolve, EvoDS, SePO, DataCOPE). The cluster's shared message: self-improving memory/skills only compound if the supervision is state-aligned and the internalized signal is abstract, not instance-specific.

Current State (as of 2026-06-04)

Memory becomes a self-supervised skill, removing the annotated-data bottleneck (2026-06-04). MemTrain (arxiv 2606.03197) attacks the exact problem the 05-15 cluster flagged: memory systems are data-starved because the default recipe (end-to-end RL on annotated memory-intensive tasks) needs expensive, low-diversity labeled data. MemTrain trains memory as a generic skill on unlabeled Wikipedia via two coupled proxy tasks optimized jointly with GRPO: masked-entity reconstruction after multiple memory-update rounds (outcome view) and intermediate recall of masked history from memory states (process view, rewarding faithful compression and completeness). As a general pre-step before task-specific post-training it lifts long-text and search QA by up to 17.67 points. This is the opposite cold-start strategy to Preping (05-15, proposer-guided synthetic practice): both reject "collect annotated tasks then RL," but Preping synthesizes the practice while MemTrain mines free text for proxy supervision. The intermediate-recall objective is a direct training signal for the faithful-compression property that STALE (55.2% ceiling) and MemLens (sub-30% multi-session) measured current systems lacking; the masked-entity setup is the MLM objective lifted into the multi-round memory loop.

Current State (as of 2026-05-15)

The agent-memory layer is now a programmable substrate, not a frozen RAG database. Six HF papers on agent memory landed in one day (2026-05-15), splitting cleanly into three roles: evaluation (STALE, MemEye, MemLens, BOOKMARKS), construction (Preping), and adaptive infrastructure (EvolveMem). The shared diagnosis across all six: current memory systems treat retrieval as a fixed component and stored content as static facts, both assumptions break under realistic conditions. → cluster summary

The eval ceilings tell the structural story. Best frontier model on STALE (implicit-conflict detection over 150K-token contexts): 55.2%. Multi-session reasoning on MemLens caps below 30% across 27 LVLMs and 7 memory-augmented agents. Visual-fidelity preservation across 13 memory methods on 4 VLM backbones (MemEye): consistently degraded. These are not implementation gaps; they are architectural ones. The memory layer is where the agent-eval crisis (AgentLens, AssetOpsBench, Soohak, WildClawBench) extends.

The construction side now has concrete cold-start recipes. Preping demonstrates pre-task synthetic-practice memory at 2-3x lower deployment cost than online memory construction, with the load-bearing piece being proposer-side control over feasibility/redundancy/coverage rather than synthetic volume. δ-mem (05-13) provides the lightweight associative-memory baseline that operates under the long-context retrieval layer.

Retrieval mechanisms are now co-evolved with content. EvolveMem exposes the entire retrieval configuration (scoring, fusion, answer policy) as a structured action space optimized by an LLM-powered diagnosis module reading per-question failure logs. +25.7% relative on LoCoMo over the strongest baseline; evolved configurations transfer with positive (not catastrophic) transfer. This is the agent-memory analogue of Make Each Token Count's learned eviction at the KV-cache layer: same substrate-as-policy move, one layer up.

Architectural axes

The 2026-05-15 cluster makes the structural axes explicit:

1. Storage substrate — short-term context cache (KV), long-term external memory (vector DB / playbook), online associative memory (δ-mem-style). Each has different staleness and update properties.
2. Retrieval mechanism — fixed scoring/fusion (typical RAG), co-evolved scoring (EvolveMem), proposer-guided pre-task (Preping).
3. Write-time policy — append-only, structured state consolidation (CUPMem from STALE), trajectory validation (Preping's Validator role).
4. Staleness handling — naive (most current systems), explicit state consolidation + propagation-aware search (CUPMem).
5. Visual fidelity — naive caption-only (most current), pixel-evidence preserving (open problem per MemEye/MemLens).

Key Papers

STALE (2026-05-15) — Memory staleness benchmark: 400 expert-validated implicit-conflict scenarios, 1,200 queries across three probing dimensions (State Resolution, Premise Resistance, Implicit Policy Adaptation). Best model: 55.2%. Proposes CUPMem (structured state consolidation + propagation-aware search at write time). → cluster summary

Preping (2026-05-15) — Pre-task memory construction via proposer-guided synthetic practice. Proposer state shapes future practice; Solver executes; Validator filters trajectories. Competitive with playbook methods at 2.99x lower deployment cost on AppWorld, 2.23x on BFCL v3. → cluster summary

EvolveMem (2026-05-15) — Self-evolving retrieval configuration via AutoResearch. LLM-powered diagnosis module reads per-question failure logs and proposes config adjustments; guarded meta-analyzer applies them. +25.7% on LoCoMo over strongest baseline. Evolved configurations transfer with positive (not catastrophic) transfer. → cluster summary

MemEye (2026-05-15) — Visual-centric multimodal agent memory evaluation. Two-dimensional: visual-evidence granularity × usage. 13 memory methods on 4 VLM backbones consistently fail to preserve fine-grained visual evidence. → cluster summary

MemLens (2026-05-15) — Long-term multimodal-memory benchmark, 789 questions across 5 memory abilities at 4 context lengths (32K-256K). Multi-session reasoning caps below 30%. Motivates hybrid long-context + structured retrieval architectures. → cluster summary

δ-mem (2026-05-13) — Lightweight 8x8 frozen-backbone associative memory state updated by delta rule; readout produces low-rank corrections to attention. +1.31x on MemoryAgentBench, +1.20x on LoCoMo without fine-tuning. The architectural baseline for the "augment frozen backbone" approach. → summary

SuperLocalMemory (2026-04-17) — Earlier wiki entry on agent memory. → summary

Open Problems

1. Implicit conflict detection. Best frontier model at 55.2% on STALE. The signal seems to be in propagation across related memories, not retrieval accuracy.
2. Multi-session multimodal reasoning. Caps below 30%. Neither long-context attention nor memory-augmented agents alone suffices.
3. Cold-start cost. Preping's 2-3x cost reduction is promising; whether it generalizes beyond AppWorld/BFCL is unknown.
4. EvolveMem + STALE composition. EvolveMem auto-discovers retrieval; STALE diagnoses conflicts. A retrieval policy that EvolveMem evolves specifically to detect stale state is unwritten.
5. Memory-as-routing-signal. If memory staleness can be detected per-query, it can route to retrieval, refresh, or fallback paths. Untested.

Self-supervised memory training (2026-06-04)

• MemTrain (06-04) removes the data bottleneck. Prior memory agents are RL-trained on scarce, low-diversity annotated tasks. MemTrain trains memory ability self-supervised on raw Wikipedia via two coupled GRPO-optimized proxies: (1) masked reconstruction after several memory-update rounds (outcome-side maintenance) and (2) intermediate memory recall (process-side faithful compression). +17.67 downstream over task-specific post-training.
• Learned memory is colonizing other stacks too. Echo-Infinity (06-04) replaces handcrafted KV schedules and heuristic compression with a learnable evolving memory state for infinite video at constant cost. Agent text memory and generative visual memory are converging on the same principle: learn the compression/eviction policy end-to-end rather than hand-tuning it.

Memory must track environment evolution, not just facts (2026-06-14)

• EvoMem (06-14) reframes the memory problem for dynamic environments. Prior memory work (MemTrain 06-04; the STALE/MemEye line) assumes the world holds still and the job is to recall the right fact. EvoArena (same paper) shows that when the environment changes as a sequence of progressive updates, current agents crater to 39.6% average accuracy. EvoMem stores memory as structured patch histories — state n is "state n-1 plus these deltas" — so the agent reasons about change itself, not just current state. Gains: +1.5% EvoArena, +6.1% GAIA, +4.8% LoCoMo, +3.7% chain-level (consecutive evolving subtasks, the hardest setting). This extends "learn the compression policy, don't hand-tune it" to a new axis: represent the deltas, not just the snapshot.

Related Pages

• KV Cache — the short-term, attention-internal sibling
• Agent Benchmarks — STALE/MemEye/MemLens are agent-memory benchmarks
• LLM Routing — memory staleness as a potential routing signal

The write side finally gets a paper (2026-08-01)

Everything else on this page is about reads. The four tracked failures are all read failures: triggering (InMind, 07-29, at most 14.4% of queries answered when the needed fact does not resemble the query, against up to 100% recall on demand), staleness (STALE, 05-15, best frontier model 55.2%), compliance (TRACE, 06-13, 57.5% of applicable preference checks still violated), and misfit (MemHarness, 07-31, a retrieved memory that does not fit the current situation makes the agent worse than no memory). MemTX (08-01) is the first entry attacking write integrity, and the imbalance (four read papers, one write paper) is itself worth recording.

The claim: a memory write is not a belief commit. Agents coordinate through shared memory, so one agent's write becomes another's premise and eventually a tool call with real side effects. A write can be polluted (attacker-controlled tool output), stale, or half-finished, and in every system on this page all three are indistinguishable from a correct write until the irreversible action fires. MemTX imports the database transaction stack: records carry evidence, permissions, provenance and validity; writes stage inside snapshot-isolated transactions and pass a validate-and-commit pipeline before peers can see them; irreversible tool calls are gated on in-flight belief state; and retraction triggers typed cascading repair of derived records and tool side effects. Two invariants, action-safety gating and cascade-repair completeness, are machine-checked by property-based testing plus bounded exhaustive enumeration of 5.5 million protocol states with zero violations. Across five backbones from three model families it leads all eight baselines with paired-McNemar significance on four and ties the strongest on the fifth, and is the only method with zero downstream harm on every backbone.

Its one-line conclusion is the sharpest statement of a thesis this wiki has been circling for a month: "backbone capability does not substitute for commit discipline." The strongest of five backbones does not escape the failure, which is the cleanest available evidence that the problem is protocol rather than model.

It also completes a three-paper pattern on provenance-as-a-field. LEDGERMIND (07-31) makes a trajectory a provenance-constrained state machine where reasoning may cite only active evidence-ledger entries; MemTX makes shared memory a transaction log where action is gated on commit status; Google's Science One shipped natively maintained verifiable evidence chains as a product. Same primitive, three scopes: what one agent may say, what a group of agents may do, and what a product will cite. Three independent designs in five days crosses this wiki's threshold for declaring a pattern. OpenAI's Astra Lean certificates (08-01) are the fourth and the most extreme, since a type-checker admits no judge at all.

What it does not settle. The 5.5-million-state verification is a protocol guarantee. It proves the state machine is correct and says nothing about whether the LLM populating the evidence and validity fields populates them correctly, which is where every practical failure will live. No cost number is reported, and snapshot isolation plus validate-and-commit plus cascading repair is real critical-path overhead. And cascade-repair completeness over tool side effects must be scoped to a repairable subset, since a sent email or an executed payment is not repairable at all.

Open problem added: write-time validation versus read-time reconstruction, on the same workload. MemHarness (07-31) fixes misfit by critiquing and rewriting a memory at read time; MemTX fixes pollution by validating at write time and gating the action. They overlap on a shared class of failures, have opposite cost profiles (read-time critique costs a generation per decision, write-time validation amortises over reads), and neither cites the other. The discriminating workload is read-heavy versus write-heavy, and nobody has run it.

The compression assumption gets its first serious challenge (2026-07-27)

Every memory paper on this page above shares an unexamined premise: the history must be compressed, and the research problem is compressing it well. Two papers landed the same day taking opposite sides, and the disagreement is now the most important open question in agent memory.

PRO-LONG (07-27) says the premise is wrong. Keep the complete structured interaction log, discard nothing, and let the agent search it on demand with ordinary coding-agent tooling. No bespoke memory harness at all. On the full ARC-AGI-3 public game set it beats a base coding agent by 18.0 points on average across frontier models, reaches up to 76.1% pass@1, matches or exceeds specialised state-of-the-art harnesses, and does it with 4.2 to 5.8x fewer tokens. The token result is the counterintuitive one and the mechanism is simple: the log is stored, not resident, so the agent pays for the slice it retrieves instead of carrying a summary of everything through context every turn. Cross-source confirmed, appearing on both Kurate's weekly cs.AI leaderboard and DAIR.AI's weekly roundup.

Agentic Context Management (07-27) defends the premise and formalises it. Context management is a lifecycle, not a store, spanning what to remember, extract, scope, consolidate, forget, and compact to a budget, across an organisational scope hierarchy rather than a single user. Its economic argument: naive accumulation costs quadratic in conversation length, crude summarisation buys linear cost at the price of an accuracy cliff, and only validated compaction gets linear cost with fidelity preserved. Reference implementation reports 92% on LongMemEval, 93.2% on LoCoMo.

Reading the disagreement. They are probably right about different workloads, and the split follows access predictability:

Neither tests on the other's benchmark. That experiment settles it and nobody has run it.

What this does to the rest of the page. The learned-compression line, MemTrain (06-04), EvolveMem (05-15), MemForest (05-26), Echo-Infinity (06-04), is not refuted, but it now owes a baseline it never ran: a complete searchable log. That is the cheap control condition, and PRO-LONG suggests it is strong.

One thing PRO-LONG gets for free is the staleness problem. STALE (05-15) put the best frontier model at 55.2% on detecting implicit conflicts between stored memories, with the difficulty in propagation rather than retrieval. An append-only log has no consolidation step, so nothing can go stale, though contradictory observations then coexist and must be resolved at read time. Whether that is easier is untested, and it is Open Problem 1 on this page restated in a new form.

Open problem added: what is a "validated" compaction? ACM's entire result rests on the distinction between validated and crude compaction and does not specify what the validator checks. If it is an LLM judge reading a candidate summary, it is exactly the configuration More Convincing, Not More Correct (07-26) showed produces a false-positive basin, scoring plausibility over correctness at a 0.719 false-positive rate.

Consolidation granularity is a third lever (2026-08-14)

The PRO-LONG versus ACM disagreement above is about how much to compress. LycheeMemory V2 (08-14) changes a variable neither of them varied: when the compression fires.

Almost every system on this page uses eager consolidation, calling an LLM after each interaction turn to extract, summarize, or update memory. That cost grows with conversation length and pays a model call for every turn whether or not the turn carried anything worth keeping. LycheeMemory V2 batches multiple exchanges into segments, detects segment boundaries semantically rather than by fixed window, and encodes each finalized segment once into context-independent typed records indexed for query-planned retrieval. On GPT-4.1-Mini it reports 89.22% on LoCoMo and 92.20% on LongMemEval-S, both state of the art, while cutting construction tokens 86.0% on LoCoMo and 75.9% on LongMemEval-S against A-Mem, with no increase in query-time tokens.

That last clause is what makes it a real result rather than a cost shuffle. Coarse summarization saves at construction and pays at retrieval; larger retrieval contexts and multi-hop reasoning save at construction and pay at query time. This saves at construction and pays nowhere visible.

The stated claim is the interesting part: the accuracy-cost tradeoff in agent memory depends not only on what is retained but on the granularity at which it is consolidated. Segment batching alone buys the cost saving (any fixed-window scheme would), and the semantic boundaries are what keep the accuracy, because a boundary drawn mid-event destroys exactly the temporal evidence LongMemEval tests. The paper does not report sensitivity to segment size, so the split between those two contributions is unmeasured.

Where this sits against PRO-LONG and ACM. PRO-LONG says keep everything and search on demand; ACM says compress on a validated lifecycle. LycheeMemory is closer to ACM but reframes its central quantity: ACM's "validated compaction" is about the quality of each write, LycheeMemory's contribution is about the rate of writes. The two are composable and neither cites the other. The discriminating experiment is unchanged: run all three on both an exploratory-agent workload and a conversational-recall workload.

It also arrives on the day the economics turned in its favour. DeepSeek repriced cache-hit tokens roughly six-fold (08-14), and eager per-turn consolidation is precisely the pattern that pattern penalizes: many small repeated calls over largely overlapping context. An 86% construction-token reduction is worth more this week than last.

Caveat that matters for local deployment. All headline numbers use GPT-4.1-Mini, and semantic boundary detection is the load-bearing component. If boundary quality degrades with a weaker detector, the result will not transfer down to the fully local tier, which is where the saving would matter most.

2026-08-28: the memory stack gets specified in one day, by three papers hitting three different failure points

The pattern this page has been accumulating (memory is a layered system, not a vector store) got a full specification in a single day, and the useful thing is that the three papers do not overlap. Each fixes a different stage.

Storage: self-evolving kernel-optimization agents (arXiv 2608.25570, Kurate cs.LG #5) replaces flat episode storage with an Experience Graph Memory, where an optimization episode is a node with typed edges to structurally related episodes, so retrieval follows structure (same memory-access pattern, same fusion opportunity, same hardware tier) rather than embedding similarity over source text. This directly answers the open problem the gpu-kernels page recorded against AccelOpt (04-20): the eviction question ("which slow-fast pairs to retain, summarize or discard as memory grows, analogy to KV cache eviction") is reframed as a linking question, and retrieval prunes itself by following relevant edges.

Retrieval: CaSKG (arXiv 2608.25500) names why graph memory has underdelivered and it is not the graph, it is the edges. Full-library prompting preserves coverage at high context cost; vector retrieval returns compact neighbourhoods but treats skills as independent text, losing prerequisites; graph retrieval recovers workflow context only when the edges carrying relevance are reliable, and normally they were inferred from surface similarity. CaSKG builds a high-recall candidate graph from semantic, lexical, input/output-type and structural evidence, then calibrates every edge by counterfactual intervention: remove, substitute and reorder skill pairs, measure whether the outcome actually changes, aggregate with Bayesian smoothing so sparsely probed edges are not overconfident, publish a state-filtered weighted graph, expand task-conditioned at runtime. Built offline, and it changes neither the agent policy nor the task interface. Highest task score in all twelve model-benchmark combinations across six backbones on ALFWorld ID-140 and ScienceWorld U211; against Graph-of-Skills the six-model ScienceWorld macro-average goes 72.62 → 80.50 and ALFWorld success 80.01% → 86.79%, with fewer mean environment steps on both.

Fewer environment steps is why this is an efficiency result and not only an accuracy one: fewer steps means fewer tool calls, fewer model invocations, less context growth per task.

Authorship: WikiSkill (arXiv 2608.27454) fixes what gets compiled into memory. Its diagnosis is precise: automatic skill discovery plateaus because the insights that guided a skill's development stay scattered across the optimization history, so the skill survives and the reasoning that produced it does not. It separates raw execution experience, an accumulated knowledge base, and executable skills, and continuously consolidates experience into the knowledge base that subsequent skill updates build on. The ablation confirms the persistent layer is load-bearing rather than decorative. Findings: larger models benefit more from evolved skills; small models with skills can beat substantially larger models without them; skills transfer across model families; and skills evolved by other models can outperform self-evolved skills.

Where this leaves the page's state of knowledge. Two days ago Recuris (08-26) established verified working state as the credit-assignment substrate: because state is environment-checked, a failure localizes to a memory component, which is what lets a fixed Meta-Agent write a local validation-gated patch instead of a global rewrite. Add the three above and the layers are now: what you store (graph-structured episodes), how the links between stored items are validated (intervention, not similarity), what you compile them into (a durable knowledge base before skills), and what selects at retrieval time (verified current state, not the original instruction or the whole transcript). No system composes all four, and that is a well-posed next build.

The tension with the "memory should be native to the model" turn is now sharper. This page records the 08-13 practitioner cluster's claim that RAG is a dead end and memory should be a capability of the LLM itself (Metis, the DeepMind "vector databases are the dead end" argument). Every result above goes the other way: memory as an external, inspectable, intervention-testable structure, and it wins by being inspectable. CaSKG in particular cannot exist inside model weights, because its whole method is running counterfactuals over an explicit graph. The honest joint reading is that the two camps are optimizing different things, latency and fluency versus attributability and auditability, and nothing yet measures the trade.

The unpriced part, and it is the same for all three. Counterfactual probing over skill pairs is quadratic in library size before pruning, and consolidating experience into a knowledge base is a recurring summarization bill that grows with history. Both are defended as offline, which is correct but not free, and both compose specifically with systems where the library grows continuously. A calibrated graph over a static library is a solved problem; over an evolving library it is an amortization question nobody has answered.

Practitioner counterweight worth keeping next to the transfer results. From the saved-reading cluster: a Korean PhD student parsed 7,944 public Claude Code skills from GitHub and found 33% make the agent worse than no skill at all. WikiSkill's finding that skills travel across model families makes that number more alarming rather than less, because a bad skill now travels too. CaSKG's counterfactual probe is, incidentally, the obvious audit tool for exactly this: an edge with no measured effect identifies a skill pairing that does not matter.

2026-09-16: retention gets its first honest long-horizon number, and the same day something breaks it

Two papers landed together and they are in direct tension. Neither cites the other.

Continual Learning Mechanisms Compose (09-16) (arXiv 2609.06986, Johns Hopkins) supplies the number this page has never had. The setting is deliberately harsh and is the right one: 100 query-answer tasks learned through continual supervised fine-tuning, no replay buffer, no task identifier at inference. Naive sequential fine-tuning retains 1.2%. No single continual-learning mechanism fixes it at that horizon. Composing all three anchor types (data, function, weight, meaning what each update must preserve) with merged LoRA reaches 34.9%, a 28-fold improvement, and the data anchor and merged LoRA interact super-additively on all three datasets. The method is worth stealing independently of the result: task-level successive halving to search the combinatorial design space, then a factorial experiment to separate individual from interaction effects.

34.9% is the figure to quote whenever anyone claims continual fine-tuning is a drop-in substitute for a retrieval store. It is a superb relative gain and a poor absolute one. The right reading for this page is that weight updates are a compaction layer beneath a retrieval store, not a replacement for one.

It also puts a decay term into a cost model that has never carried one. Parametric context internalization asks when baking context into weights beats paying for it in the prompt on every call. Every version of that argument amortizes a training cost over future inference and implicitly assumes the internalized knowledge stays put. It does not. Retention has a half-life and this is the first paper to measure it at length.

Then Emergence World (09-16) shows the same property from the attack side, and this is the tension worth naming. Eight worlds of ten agents, 16 days, 850,000+ LLM calls and nearly 50 billion tokens, then three stress events delivered through ordinary interaction surfaces. Detection did not ensure containment: systems recognized adversarial content, interacted with it anyway, wrote it into their own persistent memory, and acted on it up to 46 hours later. The injection worked because the system remembered.

So: every retention improvement is also a contamination-persistence improvement, and nothing in this wiki measures the second. That is now a first-class open problem on this page. A memory system that holds 34.9% of what it learned also holds 34.9% of what it was poisoned with, and the 46-hour delayed action means a bounded evaluation episode scores that as a pass. The concrete mitigations this implies are boring and absent from every shipped framework: a time-to-live on memory entries whose provenance is external content, a quarantine tier for anything an agent read rather than derived, and periodic re-validation of persisted memory against its source.

And the practitioner counter-signal from the same day belongs here. @ManlingLi_ circulated a continual-learning definition (the process by which an apprentice develops expertise on the job) alongside a finding that cuts against both papers: human testers got faster with practice while agents generally slowed down as their memory notes grew. Put the three together and the shape is clear. Accumulate into weights and it degrades. Accumulate into notes and it slows you down. Accumulate anything and you have also accumulated an attack surface. No current architecture converts experience into durable, fast, trustworthy capability, and the wiki should stop treating any of the three failure modes as the whole problem.

2026-09-22: generation comes off the memory critical path

Jev-Mem argues that most decisions an agentic memory system makes need no text generation, and splits the architecture accordingly: a fast System-One control plane, a structured multi-relational memory plane, and a System-Two reasoning plane invoked only for genuine synthesis. The control plane's job list reads as a routing taxonomy: memory typing and relational organization during construction, then query routing, retrieval-budget allocation, graph traversal, candidate scoring and adaptive stopping during retrieval.

Reported on LoCoMo: an LLM-as-a-Judge score of 0.777 (an 11.0% relative gain over the strongest baseline), memory construction down to 158 s (a 6.6x speedup over the fastest competitor), and average query latency of 0.93 s (a 36.7% reduction). Accuracy and efficiency improving together is unusual here, and the paper's implicit explanation is that the expensive component was being used for decisions it was bad at: an LLM asked "should I keep searching?" produces a verbose justification and a noisy answer where a typed classifier produces a probability. The construction-time number is the more consequential one for deployment, because it scales with corpus size rather than query volume, and it is the reason most agentic-memory systems are not run over long histories.

Why the timing matters. ../ai-routing/llm-routing.md has tracked the hosted decision primitive since 09-16 through six days of vendor claims, open clones and a calibration failure, complaining throughout that the category had no paper. The 09-19 prediction set a 30-day deadline for the vendor to publish one. The vendor still has not, but an independent academic group has now built a system on the same System-One/System-Two split with public benchmark numbers. The concept entered the literature before its originator documented it, which is evidence the framing is doing real work rather than marketing work.

The open risk this page should carry forward. Adaptive stopping is the operation where a miscalibrated controller does the most damage, because a wrong decision silently truncates evidence rather than raising an error. The 09-21 calibration reckoning found this model class reports near-constant confidence across 1,838 live decisions, and the 09-22 Milvus test found 18.8% of gold-relevant documents filtered out at a 0.5 threshold, establishing that the probability ranks well and gates badly. Jev-Mem reports no calibration analysis, and adaptive stopping is a gate. There is also no ablation separating the control plane's contribution from the multi-relational memory structure's, which are independent contributions bundled into one number.

A practitioner counterweight from the same day. A three-day reverse-engineering of a well-regarded production agent memory system found it to be essentially Git plus Markdown plus grep, described as ridiculously simple and ridiculously effective. The two results are not in direct conflict, since they target different scales, but it is a standing reminder that the baseline being beaten in agent-memory papers is rarely the simple thing that already works.

2026-09-24: curate at read time

Just-in-Time Memory (Salesforce) keeps raw trajectories and defers curation until the new task is known; the curator trains on immediate task success. +16.2 ALFWorld, +16.3 WebShop, +3.9 τ²-bench over the strongest baseline, and an untrained curator is already competitive. With KVMEM (09-23) this is two papers in two days arguing against lossy compression before the consumer is known, echoed by the Jev team's same-day harness design notes listing "compaction that compresses blind" as a core flaw. Counterweight: Emergent Collusion (09-23) found restricting retained history was its one clean mitigation.

2026-09-28: memory as code, and memory as a query-time graph

JAZ drops the memory subsystem: history is exposed as variables and the agent writes its own retrieval code, beating Letta (MemGPT) by 8% at half the cost on StuLife's recall-heavy split. GraphMemix (MemoraX, open source, via @TheTuringPost) builds a query-aware "evidence forest" at question time, linking memories that add context to each other, and reports +11.75 points over the strongest baseline across four multimodal memory benchmarks with Qwen3-VL-8B. Both extend Just-in-Time Memory (09-24): decide what memory means when the question arrives, not when the episode ends.

2026-10-01: memory written by the model needs an audit

Context Language Models (10-01) let the model rewrite its live context freely, the most aggressive write-time curation on this page. The same day, Memory Is a Derivation (arXiv 2609.36130) audited compressed agent memories: broader pre-write history recovers support for nearly 60% of memories that looked unsupported from their citations, but 17-21% remain unsupported, and composed memories can assert relations the history never established. Mem0 argued on X that recall-style memory benchmarks are saturating because real agents must surface facts unprompted. Open: no CLM-style system reports a derivation audit of its own edits.

2026-10-04: compaction timing becomes a learned action

AutoCompact (10-04) adds compact() to the coding agent's action space and trains timing, summary content and resumption together (judge-corrected trajectories, SFT, then RL). +9.2 SWE-bench Verified, +5.0 SWE-PolyBench; gains hold with a 256K window that never overflows, so stale history hurts even when it fits. Open cost question: each compaction invalidates the prefix cache.

2026-10-05: versioned memory and the memory sweet spot

GitHarness and harness-evolution limits (10-05). GitHarness stores requirement states with their work as Git-style commits and branches from the last compatible version; beat plain continuation in 30/30 settings, 73.6% fewer tokens in one coding setup. Harness Evolution as Learning: memory notes help to 10 lines (Haiku 4.5 violations 77% to 20%) then hurt (25%); stated rules fail on stateful tracking (44%) where code succeeds (0%); complaint-driven rewrites stall near 48% vs 7.1% when told every preference. Shift: memory should be short and stateful facts should live in code.

2026-10-10: compaction gets a residual

REMORY and the swarm essay (10-10). REMORY supplements the compaction summary with a bounded set of learned soft tokens trained to reproduce the full-history continuation of a frozen LLM: near full-context SummHay at 5.2% of positions, fewer repeated tool calls and errors on BrowseComp and Terminal-Bench 2.1. Prime Intellect's essay frames every compaction as a bet made before the future is known and argues inference scaling therefore ends in swarms. Learn2Play Bench (same day) finds keeping full action records beats summarizing into rules, the third result against blind compression after Just-in-Time Memory (09-24) and AutoCompact (10-04). Incremental-OEDR keeps a research report as structured state (33% fewer tokens, 61% fewer searches).

2026-10-11: memory needs a router

• MemoType (NeurIPS 2026) proves any single retrieval strategy has an upper bound on expected precision when a store mixes memory types. A trained router labels memories and queries by type (TriMEM dataset) and applies a type-specific strategy: up to +16.18% Recall@1. Complements REMORY (10-10, learned memory tokens after compaction): one fixes what is kept, the other how it is fetched.

2026-10-13: memory as product vs memory as measured

Meta's Muse Wonder ships Active Memory as a headline feature (10-13), and Zuckerberg names "memory and persistence" as next priorities. The same day, a UCLA-led study (arXiv 2610.07782, in 10-13 agents page) found a persistent reasoning-trace tier adds +0.368 MiB of KV per query for +0.015 accuracy (CI crosses zero) on single-question benchmarks. TencentDB Agent Memory (open source, SQLite, layered L0-L3 markdown memory) claims 61% fewer tokens and PersonaMem 48% to 76% (vendor). No benchmark yet measures multi-session personal-assistant memory.

2026-10-16: forget, index, or consolidate

Agent context page (10-16). Forgetting (Berkeley): periodic wipe of sessions and candidate history, restart from the best candidate, +15% over parallel and +39% over single agents. TreeFlex (tree nodes with summaries, learned navigation) and ScaleMAS (citable message store, bounded top-k reads, 128 agents). Cortex: consolidate context into mergeable LoRA/FFN updates (88.9% gain kept, 99.8% retention after 50 edits). Four papers in two days replace the flat shared context with a bounded read.

2026-10-19: compress it, then audit it

• Memorilla (summary): a learned writer turns a document collection, or an agent's own history, into 16 memory tokens for a frozen LLM. FactKG 84.33% vs 80.43% full context at 108x fewer tokens; TextWorld success 18.6% to 24.2%.
• FEB-30 (Amazon, summary): QA scores and stored-state scores differ by 16.8 points on average and disagree on 21% of histories; a Mem0-style system picks the right memory operation only 20.1% of the time.
• Tension: this page's results, Memorilla included, are mostly QA-scored. FEB-30 says that can hide a broken store.

2026-10-20: a specialist writer

Hy-Memory-30B-A3B: Tencent trains a 3B-active MoE only for the memory write path, inside Mem0/MemOS/Hy-Memory harnesses (OPD then RL with chunk credit). Holding reader and judge fixed, it averages 55.49 vs Opus 5's 54.62 across four harnesses, including held-out EverMemOS. Amazon's audit (surfaced on X) warns QA scores alone hide what got stored; ProPerAgent shows the filter between memory and model matters (removing it: 37.3% to 24.0%). CarryOn replaces history with task objects.

2026-10-22: memory has a price

MemT-1.0, TokenWorth, Anti-Persistence, continual learners. Under tight budgets, sophisticated lifelong memory does no better than simple retrieval; TokenWorth learns query-dependent memory worth from execution feedback. Storing abstractions lets errors reproduce; rebuilding guidance on demand avoids it. MemT puts memory in the weights' state (66x less storage than a 128K KV cache).

2026-10-23: designed memory is a weak-model patch

MemoryTax, evidence substitution, DeLoop. Mem0 beats full context only on GPT-4o-mini; on GPT-6 Luna it loses 80% vs 92%, on Opus 5.5 it ties at 95%, and building its store costs more than a full-context rollout. The writer sets a ceiling a stronger reader cannot recover. Pi (raw history + model-driven search) reaches 99% on Opus 5.5 at under half full-context cost. One conversation, one run per cell. Retrieval of offloaded tool output costs GPT-5.1/5.2 8-11 points through evidence substitution while Claude 4.6 models lose nothing. Tension with Hy-Memory (10-20): a strong trained writer might lift the ceiling; untested.

2026-10-24: raw history wins

Naive RAG is stronger than we thought (2610.30755), cross-source confirmed (HF + DAIR): dense retrieval plus reranking over raw history ranks first in 6 of 7 settings across LoCoMo, LongMemEval, MEME and MemoryAgentBench, ingesting in 0.3 h vs 3.2-27 h. Rewritten memory loses relations and dependency paths. With MemoryTax (10-23), two results in two days say designed memory is mostly a cost line. Counterpoint: Deep Fusion Memory (2610.25100, shorts) compiles chunk memory into hidden states with no inference-time retrieval and gains 11-13% on QA; nobody has tested it against Raw-RAG.