Memory Is a Context Source

The current request says, verbatim: “Do not modify the existing migration.” The admitted context contains months of migration history — previous plans, old decisions, the full archaeology of the project — alongside that one-sentence instruction. The model answers the history instead of obeying the instruction, and helpfully proposes the modification it was told not to make. Every remembered item was valid. Every one was correctly stored, retrieved, and rendered. The failure is none of those stages. The failure is that durable past information entered a computation it should never have influenced. That is the entire subject of this chapter, and restraint is its hardest case.

Memory is not the prompt

The two books define their objects differently, and the difference is the chapter:

Context is the information made available to a model for a particular computation.

Memory is when retained past experience changes what the system does now.

The first is about a single invocation. The second is a behavioural claim across time, tested counterfactually: take the history away, run the same task, and watch whether behaviour differs and whether the difference is an improvement. Two consequences follow immediately. A memory system may hold thousands of durable items, none of which is currently in context. And a context bundle may hold the user request, system instructions, tool definitions, fresh observations, retrieved documents, agent-generated state, and memory candidates — most of which are not memory. So:

memory stored
    ≠
memory in context

The sibling book’s durable principle transfers verbatim, because it is the same boundary from the other side:

Memory is durable. Context is selected.

Memory preserves information because it could matter later. Context admits information because it matters enough for this computation now. Those are different policies, run by different layers, measured by different outcomes. Durability protects future availability. It does not grant permanent context-window residency — a store holding an architecture decision, an old incident, a preference, a failed approach, a benchmark, a superseded configuration, and an unfinished obligation has said nothing about which of them belongs in the next invocation.

Where the Context book begins

PAST EXPERIENCE
      ↓
MEMORY SYSTEM
      ↓
durable memory store
      ↓
memory candidate generation
      ↓
MEMORY CANDIDATES
      ↓
context admission
      ↓
CONTEXT BUNDLE
      ↓
MODEL
      ↓
BEHAVIOUR

The Context book begins primarily at MEMORY CANDIDATES. Storage, consolidation, derived state, temporal validity, provenance, belief, framing, compression, and forgetting live on the Memory side and are not re-taught here. The chapter assumes the memory system can supply an item with identity, representation, provenance, validity metadata, and scope, and asks exactly one question:

Should this memory candidate influence this computation?

That question extends the book’s running equation by one stage on the left:

remembered
    ≠
retrieved
    ≠
admitted
    ≠
used
    ≠
helpful

The sibling book’s evidence ladder already expresses the same idea — past preserved, available, retrieved, judged relevant, admitted to bounded context, used, behaviour changed, behaviour improved — and this chapter reuses it selectively rather than re-deriving it. The Context-specific cut is the middle three rungs: candidate, admission, current context. Everything the memory system does before candidacy is consumed as interface. Everything the model does after admission is behaviour, measured downstream.

The states involved compare cleanly enough to tabulate, which is worth doing once so later chapters can point at rows instead of renegotiating meanings:

The last row is the chapter’s entire mechanism in miniature: an item can be memory by origin and context by current position, and neither property implies the other.

Memory plugs into the common interface

Chapter 14 built one admission architecture with a single candidate type. Memory enters through it like every other source:

retrieval ───────┐
memory ──────────┤
tools ───────────┤
external files ──┤→ ContextCandidate → admission
agent state ─────┘

There is no parallel memory-context pipeline in this book. Building one would undo Chapters 14 and 15 in a single diagram. A memory candidate carries source_kind = memory with the common fields — source identity, representation, token cost, provenance, scope, validity metadata — and the generic admission policy decides. No MemoryContextCandidate subtype unless implementation later proves memory-specific fields cannot fit the common interface. The desired end state, held explicitly as a falsifiable preference, is a memory-source adapter feeding the common candidate type into generic admission, with no memory-specific admission policy at all.

That flatness forbids one architectural mistake by construction. Memory says X, therefore show X is never valid. The structure is always memory says X, therefore candidate X, therefore is X appropriate now — because memory items arrive with all the ordinary defects of candidates: irrelevant, redundant, superseded, wrong, too broad, too expensive, lower-authority, out of scope. Some of those properties are the memory system’s responsibility to mark. The rest are admission’s to judge. And memory carries no privilege of origin. A remembered assistant suggestion is not a user instruction, a project policy, or a decision record until Chapter 19 says otherwise; Chapter 16 preserves the producer metadata Chapter 19 will need and adjudicates nothing.

Working state ends where reuse begins

Chapter 15 asked what state an agent creates during its trajectory. This chapter asks what survives it. The boundary is functional, never a clock reading: working state maintains the current trajectory — goal, plan, active hypotheses, progress, open step, recent summary — while memory retains past experience for potential reuse beyond the immediate active trajectory. A progress.md that survives overnight because the task continues tomorrow is continued working state, not long-term memory. A six-month-old decision consulted by a new task is memory, however briefly it is read. The pragmatic questions are whether this belongs to the currently active task state, or whether it is retained past experience that must be selected because it may matter again. Overlap is expected; state graduates from one to the other when the task ends and some of it is retained for later tasks. The book does not draw a sharper ontological line than the system needs, and it certainly does not taxonomise by hours elapsed.

That graduation is where Chapters 15 and 16 meet: agent-generated state, persisted past its trajectory, retained past its task, becomes a memory candidate. Concretely, the migration task ends; its progress file is discarded with the working state, but the decision record — PostgreSQL selected for the event store, with the SQLite attempt and its failure attached — is retained. Weeks later a new task asks about store latency, and that record arrives as a candidate with source, time, and status intact. Nothing about the record changed at graduation except its role: from maintaining a finished trajectory to offering a reusable past. The retention and consolidation policy deciding what graduates stays in the Memory book. This chapter starts when the graduate arrives as a candidate.

What the sibling book proved, used sparingly

The Memory book is a completed experimental investigation, and this chapter consumes its results the way it consumes any prior evidence: a small number of exact, attributed findings with their limitations attached. Its Chapter 12 ran controlled memory-dependent tasks under a fixed reader with paired conditions differing only in supplied memory. Assembled structured memory raised task success from 0.226 with no memory to 0.488, against 0.393 for strong retrieval alone. Removing the decisive memory on the intervention subset dropped success to 0.250; restoring it lifted success to 0.778, with individual traces showing the pattern per task. Deliberately wrong memory averaged 0.042 and caused harmful actions in two of four tasks — a stale record driving a superseded configuration, a bare listing deleting a contracted facade — and removing decisive caller evidence let the trap win on top of that: the ablated cleanup run deleted the facade with the harmful-event marker recorded. Absence of the right memory and presence of the wrong memory fail in the same direction, which is why the experiment varies both. A token-matched control, decisive item removed with nondecisive context restored at equal token cost, did not recover the effect on either reader. A memory-independent echo task, answerable from the present request alone, was harmed by supplied memory: with evidence present, the reader treated the store as the source of truth and withheld the trivially correct answer. All of this is frozen run ch12-20260920T204414Z-behavior with stated task counts — nine controlled tasks plus five transfer tasks, synthetic fixtures, small readers — and the chapter claims nothing beyond those bounds.

Two transfer findings matter more than any headline number. First, undifferentiated history is reader-dependent: the full 68-unit history scored 0.048 against 0.226 with nothing on the primary small reader, while a substantially stronger reader scored 0.571 on the same history against its own 0.119 floor — yet on tasks whose decisive facts were arbitrary project history, the stronger reader still rose from 0.056 without memory to 0.611 with assembled memory. Preservation alone does not guarantee the best context, and no universal bundle follows: minimum sufficient memory context is a relation among task, memory, representation, and reader. Second, frame conditioning, which improved context-selection metrics, did not improve downstream behaviour by itself on either reader — and on the stronger reader, frame-selected context at 0.786 beat assembled context at 0.667, reversing the local-reader order on task-specific grounds the authors could not reduce to missing decisive text. Selection quality and behavioural quality are different quantities, assembly policy itself is reader-relative, and this chapter measures both while equating neither.

Two external results reinforce the same boundary from outside either book. Mem2ActBench, an ACL 2026 long paper, builds its benchmark on the explicit gap between passive fact recall and active memory use: 2,029 synthesised multi-turn sessions yielding 400 tool-use tasks, 91.3 per cent judged strongly memory-dependent by human evaluation, with seven tested memory frameworks still inadequate at grounding tool parameters from memory. MemoryArena, a September 2026 preprint, couples acquisition to action across interdependent multi-session tasks and reports that agents near saturation on recall-style long-context benchmarks perform poorly once memory must guide later decisions. Both are used narrowly, for the single point each earns: remembering information is not using memory to act, and recall scores do not certify agentic memory. Their populations, metrics, and limits stay in their papers.

The sibling book’s warnings transfer alongside its numbers. Derived state may be worth persisting for cost, but persistence does not automatically earn epistemic authority: a persistent interpretation preserves reusable mistakes as faithfully as reusable understanding, so durability is not authority and persistence is not current relevance. The chapter does not reopen graph-memory mechanics to say so; it inherits the sentence. Likewise the assembly finding that sufficiency is reader-relative arrives as a constraint on every bundle the Context book will ever recommend.

The restraint machinery

A valid memory can still deserve rejection. “Project uses PostgreSQL for its event store” may be correct, current, and well-provenanced — and the right admission decision on a task reading “Rewrite this paragraph for clarity” is DO NOT ADMIT. Sometimes the correct memory context is empty, and for the negative-control tasks in the experiment, many candidates in with nothing out is the best outcome. Restraint is a capability, not a retrieval failure, which is why the legal outcomes always include the null path.

Restraint has a sharper edge than irrelevance. Historical relevance does not grant priority over present-task requirements: the rich migration history must not outrank “Do not modify the existing migration.” The current task is not merely another memory to be weighed symmetrically. Memory is historical candidate input; the present request defines the computation. Operationally the asymmetry means the task pins its non-negotiables first — instructions, constraints, fresh observations — and memory competes only for the remainder under the budget, never the reverse. The compiler will assemble both, asymmetrically, and Chapter 19 will formalise whose claims win. Here the failure is exposed and the metadata preserved.

Metadata discipline is what makes restraint implementable rather than aspirational. A candidate stripped to anonymous prose can fuse what the store had kept apart: “SQLite was used before July” plus “PostgreSQL is active” becomes an apparent contradiction the moment the historical/current marking is lost. Work through what correct handling requires. The store supplies both items with validity intervals; candidacy carries both forward because the task mentions the event store; admission, seeing a rewrite task with no historical dependence, rejects both — or, on a migration task, admits the PostgreSQL item at full representation with its current marking and the SQLite item as a one-line historical anchor so the record shows what was abandoned without reasoning from it. Strip the markings and the same two admissions produce either a contradiction or a confident regression. Admission preserves whatever behaviour requires — source, time, status, scope, authority, representation identity — and nothing it does not. Representation itself is an admission choice under Chapter 12’s rules: raw evidence, structured state, summary, anchor, or full artifact are different admittable forms of one candidate, which is one more reason the store and the bundle stay separate systems. Scope metadata travels for Chapter 21, authority metadata for Chapter 19, temporal markings for Chapter 20. None of those chapters is built here; each receives its inputs intact.

Two attributions keep the layers honest. If the required memory never reaches the candidate pool, that is a memory candidate miss, not an admission failure — Chapter 14’s retrieval boundary restated. If the correct memory was stored, retrieved, admitted, and represented faithfully but the model ignores it, that is not automatically a storage failure. And Context never becomes the memory truth-maintenance system: outdated, contradicted, or invalid items are the memory layer’s to expose and repair, with Chapter 20 handling freshness only at the Context boundary. Where memory and current evidence visibly conflict — the store says PostgreSQL was selected, the tool output says production runs SQLite — both keep source and status so later governance can decide, and this chapter decides nothing between them.

Proposed experiments

The memory store is frozen first, and that order is the whole design. No extraction, consolidation, retrieval, correctness, or trust mechanism varies while admission is under test. The fixed, valid, versioned store holds required memories, helpful-but-unnecessary ones, irrelevant valid ones, redundant ones, historical background, and adjacent-but-irrelevant work. A separate wrong and stale set exists strictly as a positive control, never mixed into the valid-store headline comparison. Tasks are memory-diagnostic by construction: which backend was chosen, which migration stays open, which constraint blocks release, which approach already failed, which identifier governs the change — arbitrary project history no model recovers from pretraining, following the sibling book’s discipline that the stronger reader still could not answer such tasks without memory.

Experiment 1: memory admission. A, no memory, current task only. B, all memory, testing preservation without selection. C, frozen candidate pool admitted whole, separating store size from admission. The pool itself is constructed once per fixture by a fixed, published procedure — a deterministic text search over the store with a stated cutoff — so that C is a property of the fixture rather than a second policy under test; the procedure’s output is frozen into the run record. D, selected admission — the Chapter 14 policy over the frozen pool. E, minimal oracle memory, the smallest sufficient representation from fixture truth. F, the wrong-memory positive control on diagnostically chosen tasks, kept outside the headline comparison. Alongside the memory-dependent tasks run the negative controls the design cannot omit: rewrite the supplied sentence, echo the current identifier, transform data fully present now. A policy that cannot leave history out of a history-free task has failed restraint, and without these tasks every fixture would be built for memory to win. Where selected memory beats its rivals, a token-matched control with nondecisive memory at equal volume separates decisive content from mere volume, reusing the sibling book’s discipline rather than re-deriving it.

Experiment 2: remove and restore. On tasks with one clearly decisive memory, run admitted, removed, and restored with all other context fixed. This is the strongest local causal test the chapter can buy: does this specific remembered item alter downstream behaviour. It does not carry the chapter alone; it attributes what the headline comparison establishes.

Behaviour is scored behaviourally. Mentioning, quoting, or citing a memory proves nothing unless the task is recall. The measures are choosing the correct tool, grounding the correct parameter, preserving a constraint, avoiding the failed approach, continuing unfinished work, selecting the recorded architecture — the Mem2ActBench-shaped outcomes the externals motivate. The sibling book’s sub-metrics show why behaviour needs this shape rather than a single score: constraint adherence and open-work continuation move on different curves across the same conditions, and a headline mean can hide which capability actually moved. Influence and improvement are recorded separately, because wrong-memory conditions move behaviour the wrong way and the sibling discipline holds: influence is not utility. Admitted-but-ineffective gets its own category rather than vanishing into averages, evidenced by bounded remove/restore rather than any universal causal classifier. Admission metrics carry over from Chapter 14 — precision, recall, required and irrelevant tokens, post-admission size — reported alongside behaviour, never instead of it. Reader dependence is handled by citation, not by a new sweep: the sibling transfer across three readers already shows sufficiency is reader-relative, and a small transfer is proposed only if a memory-specific interaction needs it.

Falsification is stated plainly because the preferred outcome may be nothing. All-memory matching selected memory at realistic budgets, negative controls unaffected by history, top-k matching explicit admission, better metrics with no behavioural difference, effects confined to one weak reader, token-matched controls explaining the benefit, candidate sets too small to need machinery, the memory system’s own output already task-ready: each weakens the case for a memory-specific admission layer. In that last world the chapter still keeps its interface definition and its restraint metrics — the adapter, the null path, and the negative controls survive even when the policy simplifies to pass-through. If the generic Chapter 14 policy suffices over a memory adapter’s output, Chapter 16 earns no mechanism of its own — a good result, recorded as simplification rather than defeat.

What the laboratory receives

Deliberately little. The likely implication is a source-kind value plus provenance metadata on the existing candidate record: source item identity, source system and version, representation version, validity and status, scope. No memory hierarchy, no MemoryContextCandidate subtype, no extraction, consolidation, graph, or temporal store inside Project Context — recorded as architectural law, because the Context Compiler consumes memory outputs and must never grow its own long-term belief store. That line also blocks capstone scope creep in advance: a future adapter may consume frozen outputs or candidate APIs from the Memory repository or a service extracted from it, but the book stage defines an interface, not an integration, and couples nothing now.

The corpus position is a single paragraph because it is a single fact. Project Context holds zero genuine ecological sessions at drafting time, so there is no evidence yet for how often memory would have helped ordinary OpenCode work, how often historical state is referenced, or how often memory distracts. Synthetic fixtures answer whether admission can change behaviour and whether wrong admission harms; real traces will later answer how often the situation occurs. The hierarchy is preserved and nothing is inferred from the sibling book’s synthetic tasks about prevalence in the wild.

What remains is the last candidate source, and the chapter ends by framing the contrast it was built to set up. Memory contributes durable historical candidates that must earn present influence. Tools contribute on both sides of execution at once: standing capability descriptions occupying context before any call, and fresh observations arriving after it. One source asks what the past may still decide. The other asks what the present affords and what it just produced. The admission layer they share is now fully motivated on both sides.

References

• Memory book (sibling manuscript, ernanhughes/memory, in development; frozen runs are internal book evidence). Consumed: Ch1 behavioural definition and evidence ladder; Ch12 behavioural results (frozen run ch12-20260920T204414Z-behavior, grader v2); Ch14 assembly layer and reader-relative sufficiency; Ch18 final architecture (“Memory is durable. Context is selected”; strong-retrieval baseline; derived-state authority warning). All quantitative claims carry the sibling book’s fixture, reader, and task limitations.
• Shen, Y., Li, K., Zhou, W., Hu, S. “Mem2ActBench: A Benchmark for Evaluating Long-Term Memory Utilization in Task-Oriented Autonomous Agents.” Peer-reviewed, ACL 2026 long paper (64th Annual Meeting, San Diego, pp. 8173–8190). Passive recall versus active memory use; 400 tool-use tasks, 91.3% human-judged strongly memory-dependent; tested frameworks inadequate at parameter grounding. https://aclanthology.org/2026.acl-long.370/
• He, Z., Wang, Y., Zhi, C., et al. “MemoryArena: Benchmarking Agent Memory in Interdependent Multi-Session Agentic Tasks.” Preprint, arXiv:2602.16313 v2, September 2026 (page comments ICML 2026). Acquisition-to-action coupling across interdependent sessions; recall-saturated agents performing poorly in the agentic setting. https://arxiv.org/abs/2602.16313
• Anthropic Applied AI team (Rajasekaran, Dixon, Ryan, Hadfield, et al.). “Effective context engineering for AI agents.” First-party engineering essay, September 2025, verified September 2026. Structured notes persisted outside the window and pulled back later, used only as boundary illustration for persist-then-reintroduce. https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents