Memory is six independent guarantees
An engineer who has worked on your project for three months carries it without effort. They know the deploy slipped from Tuesday to Thursday, that you rejected Mongo in week two and why, that you're now in Pune rather than Bangalore, and that the connection-pool number someone shouted during a debugging session was noise and not a decision. None of this involves an act of remembering. One continuous model of the project produces all of it.
That single capability is at least six separable guarantees, and they are only fused because a person establishes them together. Give a model a memory store and they come apart. Each fails independently while the others hold, and — as with validation — the failure is silent, because a recalled fact that is stale, misattributed, or invented is textually indistinguishable from one that is correct.
The running case: an agent working the same engineering project across many sessions.
Retention. The information still exists somewhere. A model call is a pure function of its context; nothing survives the call unless something outside the model writes it down. This is the crudest guarantee and the only one that's trivially solved — append everything to a store. It is also the one people mistake for the whole problem.
Selection. Of everything that was said, the load-bearing parts are kept and the rest is dropped. Your colleague retains "we rejected Mongo because of the transactional requirement" and has entirely lost the connection-pool number from the debugging session — not by deciding to, but because salience is a byproduct of understanding. Retention without selection produces a transcript, and a transcript is not memory. It's the raw material memory is made from.
Retrieval. The relevant subset is present at the moment it's needed. This is independent of both prior guarantees: a fact can be stored, correctly selected as important, and still not surface when the situation calls for it. Your colleague brings up the Mongo decision when someone proposes a document store six weeks later, without being asked, because they recognize the situation as the one that fact bears on.
Currency. Of several versions of a fact, the one that is true now is the one that governs. The deploy was Tuesday; then it was Thursday. Your colleague holds one belief, not two, and doesn't experience the update as reconciling conflicting records. This is separable from retrieval in a way that matters: you can retrieve exactly the right topic and still surface a superseded value.
Warrant. The status of each belief is tracked — told, inferred, or assumed. Your colleague distinguishes "you said the deadline is fixed" from "I gathered the deadline is fixed" and hedges the second. A model that writes an inference into a store and reads it back later has erased that distinction permanently: on retrieval, an inference looks exactly like an assertion.
Scope. Whose information this is. Your colleague never confuses what one client said with what another said, and the possibility doesn't arise as a thing requiring vigilance. This is not a quality property; it's a security property, and it fails as a data-protection incident rather than as a wrong answer.
Six guarantees, and the important structural fact is the same as with validation: the deepest ones are not implied by the shallow ones. A system with perfect retention, aggressive selection, and excellent retrieval can still confidently assert a fact that stopped being true in week two, was inferred rather than stated, and belonged to a different user.
Enforcement: which mechanism reaches which guarantee
Verbatim append reaches retention and nothing else. Storage is cheap, so this is tempting as a default. Its cost isn't storage — it's that every subsequent guarantee degrades as the store grows. Retrieval precision falls as the candidate pool fills with near-duplicates of the same fact at different points in its history, which is the counterintuitive property worth internalizing: a memory that never forgets gets worse over time. Unbounded growth is not a neutral default; it is an active degradation.
Summarization reaches selection, lossily and irreversibly. Compacting a session into a paragraph is an encoding decision about what survives, and the discarded material cannot be recovered — this is where the cache analogy actively misleads, since a cache eviction is refetchable and a compaction is not. Treat it as a rate-distortion problem: name the fields that must survive a pass (decisions and their rationale, hard constraints, identifiers, open questions, commitments made) and accept that discursive material is gone. Note also that instructing the model to "keep more detail" is an unreliable control — summarization output is largely invariant to that kind of prompt-level steering, so if something must survive, it needs to be extracted into a structured field, not entrusted to a summary.
Embedding retrieval reaches retrieval, partially, and cannot reach currency at all. Nearest-neighbour search returns what is similar, and similarity diverges from relevance in exactly the cases that matter. "The deploy is Tuesday" and "the deploy moved to Thursday" are topically near-identical, so both are retrieved with near-identical scores, and nothing in the mechanism prefers the later one. Vector search has no notion of supersession, negation, or recency — it is a similarity operator, and currency is not a similarity property. Injecting both into context and hoping the model picks the right one is not a design; it's the source of the contradiction.
Bitemporal or graph-structured memory reaches currency. The fix is to model time explicitly: each fact carries the interval over which it was valid in the world, separate from when it was recorded, and asserting a new value invalidates the prior edge rather than appending alongside it. Two clocks, not one — the distinction matters when you need to answer "what did we believe on the 14th" for an audit, which is a different question from "what is true now." Graphiti and Zep implement this directly; the concept ports to any store, and is worth implementing by hand rather than skipping if your facts mutate.
Provenance stamps reach warrant. Store, alongside each fact, its source turn, whether it was asserted by the user or inferred by the model, and the confidence. This is also the only real defense against the write-path failure that matters most: an unverified inference persisted into durable memory becomes indistinguishable from ground truth on every subsequent read, and compounds, because later inferences are drawn from it. Corruption of a memory store has no natural self-healing — unlike a bad turn, which the next turn can correct.
Namespacing reaches scope, and only if enforced at the store. Per-user and per-tenant isolation belongs at the query boundary, as a filter the retrieval path cannot omit, not as an instruction in the prompt. A prompt-level scoping rule is a suggestion to a probabilistic component; a store-level filter is an invariant.
Two structural points cut across all of these. First, the write path and the read path fail differently and deserve separate attention: a retrieval failure is transient and self-corrects on the next query, while an extraction failure is written into durable state and persists. Second, the extraction step — the model call that decides what from this session is worth keeping — is itself a model output, and inherits every validation obligation from the previous piece. Structured extraction into typed facts is what makes selection, currency, and warrant enforceable at all, and it's also a place where an unvalidated hallucination becomes permanent state.
What this determines
Two questions set the architecture. First, the temporal character of your facts: if they are stable (a stated preference, a past decision) then append-and-retrieve is adequate and bitemporality is overhead; if they mutate (dates, status, ownership, anything with a lifecycle) then you need explicit valid-time modelling and invalidation, and a flat vector store will produce confident contradictions as a matter of course. Second, the blast radius of a wrong recall: if a stale fact produces a mildly wrong answer, a lightweight store is fine; if it drives an action with a side effect, memory needs the same treatment as any other input to an executed decision — validated on write, provenance-stamped, and reconciled against the source of truth at read time rather than trusted.
The general statement: a person's memory delivers retention, selection, retrieval, currency, warrant, and scope as one thing, because one continuous understanding produces all six. Replace the person and you get retention for free, selection only if you encode it, retrieval only approximately, currency only if you model time explicitly, warrant only if you record it, and scope only if you enforce it at the boundary.