Memory: the three tiers, and what breaks in each

The syllabus asks for "multi-tier state persistence components that address session
state, shared team state, and long-term semantic memory with lifecycle and
tenant-isolation policies". Three tiers, and each one breaks differently.

The three tiers

Session state lives for the conversation. It is the cheapest tier and the least
dangerous, because when the conversation ends it is gone.

Shared team state lives for the task and is visible to every agent working on
it. That visibility is the point — it is how agents coordinate without passing
everything through messages. It is also the risk: one bad write poisons the whole
team, and every agent downstream inherits it as fact.

Long-term semantic memory lives as long as policy says. This is the tier where
compliance lives, and the syllabus names the two policies that have to exist:
lifecycle — how long, and what deletes it — and tenant isolation — whose
memory is whose.

The vocabulary, and the verb that causes damage

Four words describe what happens to context during a run:

Accumulation — context grows as the conversation proceeds.
Retrieval — relevant external material is fetched.
Injection — it is placed into the prompt, in an order that matters.
Compaction — it is compressed to fit.

Compaction is the one to understand properly, because it does not lose information
randomly. It reliably preserves the shape and reliably loses the particulars.

After compaction the agent still knows it is handling a complaint about a delayed
order from a frustrated customer. It may no longer know the order number, the exact
date, or the precise wording of what was promised. The summary reads perfectly well.
That is what makes it dangerous.

The defence is to extract the facts that would cause harm if altered into typed
state — before compaction can touch them. Account numbers, amounts, dates,
identifiers, decisions already made. State is not subject to summarisation.

Three stores, three jobs

A way to hold the distinction:

Context is the desk — what is in front of the model right now. Finite, and
expensive.

Memory is the filing cabinet — what can be fetched back when needed. Persists
past the conversation.

State is the tick-list — typed, exact, small, and not something that gets
paraphrased.

Most memory problems are really a failure to put something in the third one.

Across an agent boundary

When one agent hands to another, the default should be a deliberate payload, not
the raw conversation.

Passing the conversation feels helpful and is usually wrong. It carries noise, it
carries cost — every hop re-sends everything — and it carries the previous agent's
mistakes and speculation as though they were established fact.

And before the handoff, resolve references. "It", "they", "that one" mean
something only if you have the history that made them meaningful. The receiving
agent does not.

The trap

Memory is a security surface, not just a quality one.

"The agent told me something about another customer" is not a bug report about
accuracy. It is a memory isolation failure, and it will be tested as a compliance
question rather than an engineering one.

Which is why the syllabus attaches tenant isolation to the long-term tier
explicitly. The moment memory persists across users, the question stops being
"does it remember well" and becomes "whose memory is this, and who is allowed to
see it".