Trustworthy on-device long-term memory for agents

What is actually being asked

The questions people bring to a long-lived device are comparative rather than instantaneous. Has she been quieter this week than last. Does he still use that chair. Is this the same animal who has been waking us early. Answering any of them requires memory in a strong sense: a durable, comparable account of past days, not a directory of clips ordered by filename.

An assistant that reasons over such an account inherits its weaknesses. If two collars have been conflated, or if half the evidence cannot be placed on a wall clock, the resulting summary is not merely imprecise—it is a confident description of a week that did not happen, delivered in the same tone as a correct one.

Memory as a publication with preconditions

We treat memory as something published rather than something accumulated. Raw evidence is retained as it arrives, but a higher-level account is built only from evidence whose subject, timing and originating device can be established, and it becomes readable to an assistant only after that build succeeds.

The layering follows the same rule. Days of evidence support a compact account of how a stretch of time looked, which in turn supports a view of what recurs. Each level carries its own state, and a level that cannot be built says so, with the reason attached. When a build fails, the previously accepted account remains readable rather than being replaced by a degraded one; when nothing has ever qualified, the honest surface is that nothing is ready.

What the first production build published

Deployed on the development hub, the first production build read a substantial history—on the order of 2,500 recorded events, nearly 200 activity spans and a few dozen accepted structured observations—and published no higher-level account at all.

The reason was in the inputs, and the coverage statistics said so plainly. Of those events, none carried a trusted identified subject; the same was true of every activity span. Every accepted observation lacked a usable clock, and no animal identity had been confirmed. The upper layers therefore reported not-ready with explicit causes rather than emitting a plausible-looking summary over unattributed data.

We regard that as the intended outcome rather than a disappointing one. The alternative—relaxing the identity, timing or anchoring requirements until something renders—produces a demo that works and a product that misleads.

Confirming an animal does not rewrite the past

Later the same day, a household animal was formally enrolled from reviewed photographic evidence, giving the system its first confirmed identity. A forced rebuild still published nothing.

This is the correct behaviour and worth stating explicitly. Confirming who lives in a home resolves exactly one precondition. It does not retroactively assign a subject to thousands of historical events recorded before any identity existed, and it does not supply a wall clock to observations that never had one. Enrolment left prior evidence untouched, created no recognition claims and rewrote no history; the remaining blockers stayed visible as unattributed events and unsynchronised observations.

A memory system that improved its own past on the strength of a new fact would be far more impressive and considerably less trustworthy.

Reading should be cheap and non-destructive

A memory surface that an assistant may consult repeatedly has to be inexpensive to read. Under a hundred consecutive reads, roughly half were answered as unchanged rather than rebuilt, and the underlying store was byte-for-byte identical before and after, including its journal. Scheduled reconsideration did not silently rebuild the account every minute.

The same run bounded the resource footprint: the build process peaked at around fifty megabytes of resident memory, and reading the published account stayed in the single-digit milliseconds. Those are modest numbers by design, because this component shares a small device with capture, tracking and interpretation.

What leaves the house

Some derived summary is expected to travel, so the boundary matters. Identifiers and compact descriptions can leave; the recorded media does not have to accompany them. An assistant answering a later question should retrieve evidence through a narrow, auditable interface rather than roam the device’s storage.

For a household the promise is not that the product has memory. It is that a quiet week stays quiet until the device can substantiate it, that a visiting animal cannot inherit last month’s history, and that “not ready” remains an available answer.