Chapter 10: Memory as a Controlled State Transition

Last month, the model inferred Jordan’s delivery address for O-1001 might be outdated from an ambiguous note. This week, Jordan confirms a new address in the Northline account portal. A blind put leaves two active addresses — or overwrites the old row with no lineage. Never superseding is just as bad: a weak inference keeps steering a reship to the wrong place.

Remembering is not “write whatever the model said.” It is a governed transition.

new evidence → controller G → accept | reject | supersede | decay | erase → one active fact

This chapter adds (m_{t+1} = G(m_t, e_t, u_t)): evidence quality, contradiction handling, consolidation, decay, and privacy delete — so Resolution uses the portal-confirmed address while audit still explains the change.

First principles

[ m_{t+1} = G(m_t, e_t, u_t) ]

The equation says that memory changes through a controller, not as an automatic side effect of every model turn:

• Evidence quality — require provenance and a minimum quality bar for profile facts.
• Contradiction — supersede a weaker or older belief while preserving lineage.
• Consolidation — merge duplicates when appropriate; the teaching controller uses supersede.
• Forgetting / decay — reduce confidence over time and tombstone cold records.
• Privacy delete — erase a value while retaining only the record needed for the defined retention policy.

For the address update, the portal confirmation is stronger evidence than the model inference, so the controller should create a new active fact and mark the old one as superseded. This lets Resolution use the current address while an operator can still explain the change.

The model may propose a memory write, but (G) decides whether to accept, reject, supersede, decay, or erase it. Do not store every turn, and do not preserve every fact forever.

Concrete example

Old evidence: address_status=outdated_inferred (inference, 0.55).
New evidence: address_status=confirmed (portal confirm, 0.92) with contradicts_key pointing at the old record.
Controller decision: SUPERSEDE. Old row keeps superseded_by; new row is active.

Diagram

flowchart TD
  E[evidence e_t] --> C{confidence >= min?}
  C -->|no| R[REJECT]
  C --> P{profile without provenance?}
  P -->|yes| R
  P --> X{contradicts_key set?}
  X -->|yes| S{new conf >= old conf?}
  S -->|yes| SUP[SUPERSEDE + write]
  S -->|no| R
  X -->|no| W{weaker than existing same key?}
  W -->|yes| R
  W -->|no| A[ACCEPT + put]

Notice: rejection is a first-class outcome — silence is how bad memories accumulate.

Implementation

PYTHONPATH=. python examples/ch10_controller.py

shopops/memory/controller.py:

ctl = MemoryController(InMemoryStore(), min_confidence=0.4)
ctl.consider(MemoryEvidence(
    key="O-1001:ship_address",
    kind=MemoryKind.PROFILE,
    value={"status": "outdated_inferred"},
    provenance="model_inference",
    confidence=0.5,
))
ctl.consider(MemoryEvidence(
    key="O-1001:ship_address-v2",
    kind=MemoryKind.PROFILE,
    value={"status": "confirmed"},
    provenance="portal:address_confirm",
    confidence=0.92,
    contradicts_key="O-1001:ship_address",
))
# → SUPERSEDE

Privacy delete:

ctl.privacy_delete("O-1001:phone")  # value cleared, deleted flag set

Decay job (teaching):

ctl.apply_decay(days=30)  # reduce confidence; delete if too cold

Failure modes

Write-all. Every assistant turn becomes “memory”; context poisoning becomes permanent.

Never-forget. Stale exception tags block reasonable strategies.

Confidence theater. Models emit 0.99 for guesses; if you trust uncalibrated scores, (G) is cosplay. Prefer evidence classes (portal_confirm > inference) over raw floats when you can.

Delete that doesn’t delete. Soft-delete flags ignored by search; PII still retrieved into prompts.

Uncontrolled online learning. Outcome feedback silently mutates policy memory (blocked harder in Ch 41/45).

Supersede without audit. You cannot explain to a reviewer why the old address vanished.

Production considerations

• Unit-test contradictions the way you unit-test policy denies.
• Represent evidence class explicitly (portal_confirm, customer_stated, model_inference) — do not rely only on float confidence.
• GDPR-style erasure: define whether tombstones remain for audit; document retention. [VERIFY SOURCE for jurisdiction-specific obligations — treat as illustrative]
• Run decay as a scheduled job with metrics (memory_decayed, memory_tombstoned).
• Feed controller decisions into traces: accepted/rejected/superseded.
• Keep humans in the loop for high-impact profile changes (income, exception, legal representation).

Chapter summary

• Remembering is (m_{t+1}=G(m_t,e_t,u_t)), not automatic logging.
• Accept / reject / supersede are the verbs.
• O-1001: address confirm supersedes outdated inference with lineage.
• Provenance and confidence floors beat write-all.
• Decay and privacy delete are production features.
• Uncalibrated model confidence is a hazard input to (G).
• Controller + store + assembler form the memory path into the loop.
• Code: shopops/memory/controller.py, examples/ch10_controller.py.

Exercises

1. Implement a temporal decay job over SQLite memory; assert old inferences fall below min_confidence and disappear from search.
2. On privacy delete, redact PII fields and prove they never re-enter ContextAssembler output.
3. Add evidence-class ranking (portal_confirm > customer_stated > inference) that overrides raw confidence ties.
4. Write a unit test where weaker contradictory evidence is rejected and the stronger old fact remains.

References

• Packer et al., MemGPT / OS-metaphor memory — motivation for controlled write paths. [VERIFY SOURCE]
• Knowledge-base contradiction / belief revision literature (high-level). [VERIFY SOURCE]
• Privacy regulation overviews (GDPR erasure concepts) — jurisdiction-specific; illustrative only. [VERIFY SOURCE]
• Sutton & Barto — state update intuition; memory as part of agent state. [VERIFY SOURCE for edition]

Cliff into Part IV

You now have a loop, typed state, assembled context, tools with policy, reliable transports, an FSM, checkpoints, and controlled memory. Next, Part IV asks how the policy chooses actions under uncertainty — planning, ReAct, and structured decisions — without pretending cognition is magic.