PUBLIC FIELD GUIDE · 26 pages · version 2026-09-03
A multi-agent continuity design that starts from source, time, and conflict, and closes through action, verification, and behavior change
Language: English · 中文
Open PDF in browser · English PDF is an optional follow-up; this HTML is the English reading surface.
Reading contract. This is not a product brochure, and not an internal system dressed up as a finished open-source release. Novelty status: the individual components have mature precedents; the contribution claim is organizing them into one user-auditable operating contract. Epistemic status: a mix of synthetic invariants, single-owner historical motive, design policy, and explicit open gaps. Fixture output consistency is high; real behavioral gain, privacy bounds, and distributed safety are not yet established. What remains: matched held-out replay, external reproduction, cross-executor target-side verification, and long-horizon behavior metrics. Four fixtures passing only prove that pre-coded synthetic invariants match expected outputs — not production validity, model obedience, privacy safety, independent verification, distributed durability, or exactly-once.
Long-term memory is an operating contract: claims that carry source, validity window, and conflict state enter rules and permissions, then close through action, receipts, target-side verification, repair, and behavior change.
For a close read, continue from the system map and Arcs A–D below. Long-term memory is not “storing the past”; it is letting a claim constrain action, accept re-verification, and be repaired, withdrawn, or retired when needed.
ARC A · 01–03 · From retrieval to control
ARC B · 04–07 · Facts · time · negative knowledge
ARC C · 08–11 · Concurrency · power · completion semantics
ARC D · 12–14 · From experience to behavior change
Also
Retrieval still matters, but it only answers “where might relevant past be?” Continuity must also answer four other families of questions.
| Arc | Core question | Corresponding design |
|---|---|---|
| A | Why can retrieval still lead to wrong action? | constitution, raw / projection, pre-action gate |
| B | When does a fact hold? | valid time, unknown / conflict, supersede, tombstone |
| C | How do agents avoid duplication, overreach, and false completion? | claim, lease, authority epoch, fence, receipt, verification |
| D | Did an episode actually change the system? | candidate, validation, promotion, rollback, behavior delta |
Three minimal distinctions. (1) retrieved ≠ remembered: a rule that never enters the pre-action boundary is only something that might be recalled. (2) unknown / conflict, done / verified, and intent / outcome are not interchangeable. (3) What transfers is not a set of hyperparameters, but the loop “incident → parameter → anti-signal → re-verification.”
It did not start as the shape it has now. April 2026 began from sleep-inspired consolidation; real use pushed the problem from “how to remember” toward “how to constrain and verify.”
The most important correction: early “raw + compiled + mirror” solved the division of evidence vs abstraction, but did not automatically solve critical-rule miss-loading, temporal conflict, authority, concurrency, false completion, or stop propagation. Later mechanisms came from those failure types — not from an ideal architecture diagram drawn first. Early public point: LessWrong — Starshard: Sleep-Inspired Memory Consolidation for a Multi-Agent Personal System (2026-04-21).
FAILURE
When a system executes real actions across sessions, amnesia does not only worsen answers — it causes repeat execution, revival of old conclusions, and false completion. Traditional memory often aims to “let the model find the past.” The dangerous failures happen after retrieval: who may act, whether someone is already doing it, whether the current conclusion still holds, whether completion has target-side evidence.
DESIGN
Define long-term continuity as a control chain. Retrieval supplies candidate context; rules, permissions, work claim, receipts, re-verification, and repair decide what the system may do and when an action is closed.
EVIDENCE
A synthetic cross-session state machine can stably replay two families of state: query-contingent / missing / self-report vs pre-action / claimed / unverified. That proves state semantics were encoded — not that real models obey them.
FALSIFIER
If ordinary thread history or RAG, on the same held-out tasks, stably eliminates repeat execution, revived conclusions, and false completion at lower complexity, a heavier control layer is unnecessary.
FAILURE
Semantic retrieval is query-contingent: the model first judges relevance, then the system fetches. Precisely when the model does not notice risk, prohibitions, identity bounds, and irreversible-action conditions are most likely to be absent. A rule that appears only on query hit is not an execution boundary.
DESIGN
Place a small set of unmissable rules into an unbypassable pre-action gate. Implementation may be an always-loaded constitution or a mandatory policy lookup before action; the key is not “put it in the prompt,” but that the call chain cannot skip it.
EVIDENCE
This is a control contract and a testable hypothesis — not the assertion that “always-loaded is always better.” Compare rule recall, violation rate, context tax, and false blocks before assigning a rule to hot vs cold tier.
FALSIFIER
If retrieval-only does not show higher miss rate on enough held-out scenes, or always-loaded rules cause worse interference and false blocks, that rule should return to on-demand tier.
FAILURE
A shorter, prettier memory may wash out source, conditions, and counterexamples. If summary, profile, or rule becomes the only truth, later systems cannot know who the conclusion came from, what the situation was, or replay and repair when a projection is wrong.
DESIGN
Keep append-oriented raw events; treat compiled memory, indexes, person profiles, and public text as rebuildable projections. Derived conclusions must point back to source events. Projections may update; they must not rewrite sources backwards.
EVIDENCE
A synthetic lineage fixture shows raw → compiled → redacted public projection, and verifies that after deleting a projection it can be regenerated from retained sources. Append-oriented is not permanent retention: access control, retention windows, and controlled deletion still apply.
FALSIFIER
If a projection cannot point back to sources, replay changes decision boundaries, or public derivatives mix in private originals, evidence layering has failed.
FAILURE
The real judgment is whether this information must arrive uninvited before action. Frequency and semantic similarity favor common content and can suppress rarely mentioned rules that must never be missed; loading all “important” content always dilutes attention.
DESIGN
Hot tier holds only identity bounds, unmissable rules, current owner state, and the active control surface. Cold tier holds history, background knowledge, long evidence, and queryable detail. Admission is set by miss cost jointly with interference cost.
EVIDENCE
The split comes from repeated calibration in real use; exact size, hyperparameters, and refresh cadence depend on a specific owner, model, and task, and should not be copied as universal parameters.
FALSIFIER
If hot tier balloons and rules dilute each other, or cold recall routinely arrives after action, admission policy needs retuning; “more context” is not an automatic fix.
FAILURE
Person facts and long preferences need at least known / unknown / conflict. Simple key-value overwrite miswrites “not found” as false, lets low-confidence transcription overwrite into a new fact, or arbitrarily picks the newer sentence under conflict.
DESIGN
Facts carry valid time, source, and confidence. unknown means insufficient evidence. conflict is computed from still-valid incompatible evidence relations — not declared by an agent.
EVIDENCE
Deterministic temporal replay can produce known, unknown, computed conflict, and superseded. That proves projector rule consistency — not that inputs are true, and not a full bitemporal database.
FALSIFIER
If a single-value overwrite model equally preserves source, expresses unknown, and keeps consistent decision boundaries after replay, the extra states bring no net value.
FAILURE
Negative knowledge is not garbage; it is a control object that stops old routes from reviving. If failed experiments are deleted or left as “didn’t work well,” the next agent easily re-derives, re-commits, and re-spends the same cost under similar conditions.
DESIGN
supersede closes the validity window of an old fact; tombstone stores the failed route, scope, evidence, revival conditions, and re-test conditions. It is not a permanent ban — it is a stop credential with bounds.
EVIDENCE
Temporal primitives can stop superseded conclusions from entering the current projection. Whether real redo decreases still needs matched replay: repeat rate with vs without tombstone on similar tasks.
FALSIFIER
If tombstones cause many false blocks, or do not reduce route revival, shrink their scope, demote to audit-only, or retire them.
FAILURE
A confident decimal neither launders a weak source nor grants action rights. Compressing provenance into a single confidence makes repeated hearsay look like independent evidence; worse, the system may sneak from “believe this sentence” to “may send mail, pay, or change permissions on it.”
DESIGN
Record separately: who said it, original vs hearsay, when it is valid, how sure the system is, and who may act. Evidence updates may change belief; authority comes only from authentication and authorization paths — not from probability.
EVIDENCE
Currently schema and governance contract; a unified confidence scale across models and media is not established. The conservative default is to keep source class and uncertainty rather than forge precise probabilities.
FALSIFIER
If low-quality sources can still drown first-hand evidence by volume, or high confidence automatically crosses permission gates, the belief supply chain remains unsafe.
FAILURE
An executor’s self-reported completion is only an event that must be checked. File exists, command returned zero, process alive, or worker said “done” can all be false positives. They do not prove target state, scope of effect, or current freshness.
DESIGN
Separate intent receipt from outcome receipt. Verification must be fresh, same-scope, target-side readback or otherwise checkable evidence. “Independent” also requires different failure domains — not merely another agent reading the same log.
EVIDENCE
A synthetic receipt checker can keep self-report as done and upgrade to verified only after readback conditions hold. That proves state-transition rules — not that real observation sources are reliable.
FALSIFIER
If verified can appear without new evidence, with mismatched scope, or with expired evidence, completion semantics are already lost.
FAILURE
“I cannot see it” does not imply “it is dead,” still less “a new worker may safely take over.” Disconnect, lost heartbeat, and vanished session only mean observation degraded. The old executor may still run, or may resume later and write. Treating invisibility as death creates double-write and overreach.
DESIGN
liveness describes observability; authority describes who is allowed to continue; effect admission describes whether downstream resources accept its writes. Record them separately and connect them through epoch / fence.
EVIDENCE
A three-axis synthetic fixture can simultaneously represent liveness=unknown, authority=revoked, effect=blocked without smuggling any one into another.
FALSIFIER
If a system re-issues irreversible actions on heartbeat expiry alone, and downstream cannot refuse an old epoch, double effects can still occur on recovery.
FAILURE
“Who should do it” and “who can still write” are not the same problem. After lease expiry a new worker may take over, but the old worker may not know it lost authority. If the place where effects happen does not check epoch, late writes are still accepted.
DESIGN
Work claim coordinates intent; resource-side fence rejects stale epochs where side effects actually occur. Idempotency keys reduce retry duplication but do not replace causal identity, authority contraction, and owner-stop.
EVIDENCE
Single-process simulation can show expected invariants: new epoch takes over; old epoch is refused. That is not evidence that production downstream resources already implement fencing, and it does not claim exactly-once.
FALSIFIER
If the fence exists only in the coordination database while real downstream still accepts old writers, the control layer has not sealed causal reach.
FAILURE
Every channel must answer: what event closes this loop? A message, task, reminder, or command being “sent” only proves intent left the sender. It may be lost, duplicated, delayed, rejected, or executed with the receipt lost.
DESIGN
A closed-loop channel at least includes receipt/readback, durable state, timeout, repair/escalation, bounded retry, and final reconcile. owner-stop is an absorbing state: old watchdogs or late results must not quietly restart the same authority epoch.
EVIDENCE
A synthetic crash matrix can distinguish intent-created, delivery-unknown, effect-verified, and repair-open. Real transport reliability still depends on each adapter’s observation and downstream bounds.
FALSIFIER
If the system cannot give a unique auditable terminal state under lost receipt, duplicate delivery, and late-after-stop, it is still fire-and-forget.
FAILURE
Compressing old text is not turning experience into verifiable system change. A summary may be shorter without answering: which action produced which outcome, which rule should change, what side effects the change causes, how to roll back on failure.
DESIGN
A consolidation chain should include episode → outcome → candidate → validation → promotion / rollback. Candidate changes may enter task, behavior, audit-only, tombstone, or nothing — not always long-term rules.
EVIDENCE
A deterministic routing fixture can map different evidence strengths to different terminals. Routing rules are currently explicit policy, not automatically learned; they do not prove candidate rules are safe after deployment.
FALSIFIER
If consolidation only produces smoother summaries and cannot point to changes in next behavior, stop conditions, or verification plans, it is still archiving, not learning.
FAILURE
Storage volume, recall rate, and summary quality are intermediate metrics. A system can have huge memory, pretty graphs, and high recall, and still repeat the same class of mistakes if experience never received correct credit and never entered the execution boundary.
DESIGN
Write behavior change as a falsifiable delta: what specifically changes next in judgment, action, stop condition, human escalation, or tool path; also record anti-signal, re-test date, and rollback conditions.
EVIDENCE
Strongest current evidence is replayable candidate-routing machinery plus historical motive; real gain needs held-out tasks, baseline contrast, and repeat-failure rate inside a time window.
FALSIFIER
If long-term storage keeps growing while matched failures, human re-explanation, and error revival do not fall, the system is only hoarding information.
FAILURE
Public status must allow downgrade — not rewrite a roadmap as a completion manifesto. Architecture diagrams, hash equality, an online repo, or one demo pass are easily narratively upgraded into “the system is already reliable,” erasing the distance among code, runtime, policy, and real effect.
DESIGN
Each claim uses multi-select status: code-present, runtime-probed, enforced-on-specified-path, policy, historical, unknown. New evidence may upgrade; anti-signals must be able to downgrade or withdraw.
EVIDENCE
This guide includes four deterministic synthetic fixtures and checks against public materials; audience cold-read, external reproduction, and production benefit evaluation are unfinished, so it remains a public sharing draft.
FALSIFIER
If a claim cannot be downgraded by new evidence, or unknown is packaged as inevitable future completion, so-called auditability is only a visual label.
All artifacts are deterministic, synthetic, single-process state machines; expected output matches actual output. Each proves one boundary only.
| Arc | Invariant verified | Explicitly does not prove |
|---|---|---|
| A | Critical rules appear before action; claim vs verification states are distinguishable. | Real model obedience; concurrency safety. |
| B | known / unknown / conflict / superseded projections replay deterministically. | Input truth; full bitemporal store. |
| C | authority epoch, stale writer, owner-stop, and receipt transitions. | Fake fence ≠ production resource-side fencing; not exactly-once. |
| D | episode can route to task / behavior / audit-only / tombstone / nothing. | Hand-written policy; not real behavior gain or safe deploy. |
Why synthetic fixtures are still worth it: they compress conceptual arguments into checkable state transitions — same input must yield same projection, old epochs must be refused, unknown must not quietly become false. Lowest-layer contract tests, not real-world efficacy trials. Public re-verification status: code release still needs alignment with public-repo description and evidence bounds. This page reports artifact status; it does not pass off local runs as third-party reproduction.
“Implemented” is too coarse. Multi-select status says at which layer a claim actually holds:
Upgrade/downgrade rules: an architecture diagram cannot upgrade to code-present; code existence cannot upgrade to runtime-probed; process success cannot upgrade to target-state verified; another agent reading the same log is not automatically independent verification. When an anti-signal appears, status must be downgradable. Credibility comes not from the label itself but from whether scope, time, source, re-test method, and failure conditions sit beside the label.
Research cutoff 2026-09-03; based only on public first-hand documents — no inference about private implementations. The question is not who wins, but which segment of the chain is already done well by whom.
Safe composition difference: storage, retrieval, temporal facts, file memory, and background consolidation are already rich. Closing provenance, temporal conflict, authority, concurrency, action receipts, repair, and behavior change into one user-auditable chain still appears, in sampled public materials, mainly as scattered components plus application engineering. Private implementations are unknown.
Metabolism, sleep, immune, apoptosis help check whether closed-loop organs are missing; they are not claims of consciousness or biological life.
The metaphor is useful only if the architecture answers: where does input come from? how is it digested? how are errors isolated? how do failed organs exit? how does the system restore steady state? Without mechanism answers, drop the metaphor.
Not a demand to build a giant platform at once. Order principle: seal irreversible errors first, then optimize recall.
Public firewall: public projections generate only from controlled derivatives — never export directly from raw private corpora.
Minimal migration: first split done / verified, unknown / false, intent / outcome; then add pre-action gate and receipts for irreversible actions; only then complex retrieval, graphs, and automatic consolidation.
These gaps are not footnotes — they are inputs to the next round of experiments. Four fixtures passing only prove pre-coded synthetic invariants match expected outputs; they do not prove production validity, model obedience, privacy safety, independent verification, distributed durability, or exactly-once.
Highest-information next experiment. Pick a held-out multi-agent task set; fix model, token budget, tools, and inputs; compare retrieval-only vs control-chain arms; measure rule miss-loading, duplicate actions, false done, human re-explanation, recovery time, and false blocks. Every failure must be written back as an auditable sample.
Is your system a memory store, or a continuity layer? Do not start from the tech stack — ask three questions that can be verified on the spot.
If two of three can only be answered by a human re-reading chat logs, you may own storage, not continuity.
Final criterion: good long-term memory does not feel like “the system remembered a lot.” It feels like less repeated explanation, less confirming false completion, easier error tracing, a real ability to stop, and observable behavior change the next time a similar situation appears.
The fourteen claims will also be expanded as Chinese short notes over time; each carries a reproducible synthetic fixture, a “what it does not solve” card, and a condition that would overturn it. This English HTML is the parallel reading surface for the public field guide; an English PDF remains optional follow-up.
Cold-read feedback welcome — passages you cannot parse, sentences that feel over-claimed, and your own failure fixtures.
https://github.com/MachengShen/MachengShen.github.io/issues
About this document: a public-safe research field guide. It does not include private raw records, internal paths, runtime topology, precise deployment parameters, or unauthorized historical operational fingerprints. Public code reading paths will be added after repo description and evidence status are aligned.