Abstract
A language-model session is bounded. The work it is applied to is not. When the boundary is reached, current systems compensate by re-reading static instruction files, by compressing the transcript, or by retrieving similar past utterances. All three preserve text and lose state. We describe an architecture in which the persistent unit is an engram: a proposition carrying class, provenance, temporal order and supersession, held in an append-only store outside the model and consulted as a constraint on behaviour rather than supplied as additional prompt. We set out how engrams are formed, how retrieval is routed by class, why prohibitions are evaluated before inference rather than after it, and how the same store carries knowledge between domains that were never explicitly linked. The model becomes an interchangeable faculty. The subject persists.
1 · The boundary, and what is currently done about it
Everything a model knows in a session is what fits in its context. Real work exceeds that: an afternoon of debugging, a month of decisions, a client relationship measured in years. At the boundary, three compensations are in general use.
Instruction files, a markdown document the model reads at the start of every session, carry what a person remembered to write down, in advance, by hand. They describe intentions, never outcomes: nothing the work itself discovers can enter them without a human noticing and editing. Compression at overflow replaces the transcript with a summary the model writes about itself. What survives is whatever the summariser judged salient in that moment, and the judgement is not reproducible. Similarity retrieval stores utterances, embeds the new message and returns the nearest neighbours. The sentence where a decision was made and the sentence where it was reversed are both retrievable, with equal confidence and no way to tell which still holds.
The three fail in the same way. Each preserves text that a model may read, and none preserves state that the system must respect. That distinction is the subject of this paper.
2 · The engram
The persistent unit here is not a message, a chunk or a summary. It is an engram: a proposition the system has settled, stored with the metadata required to reason about it later. Five fields do the work.
The proposition.One claim, written as a claim. “The Postgres migration is abandoned; Ana owns the schema” rather than the four paragraphs of conversation in which that became true. A claim can be true or false, can be superseded, and can be checked against a request. A paragraph of dialogue can only be matched.
Class. Engrams are typed by what kind of thing they are: a conclusion about the work, a disposition about the person, an objective being pursued, a prohibition, an observation returned by a tool. Class is not a tag for filtering. It determines how an engram is retrieved, how strongly it is weighted, and whether it is consulted at all in a given operation.
Salience. A scalar that survives the moment of writing. Not everything concluded deserves equal standing, and importance assigned at write time is more reliable than importance inferred at read time from lexical overlap.
Provenance. What produced this engram, and when: a statement by the operator, an inference from working, the result of an executed action, an ingested document. Provenance is what makes supersession decidable: given two engrams that conflict, the system has the ordering and the authority tier needed to know which one now holds, instead of returning both and letting a model guess.
Position in an append-only sequence. Nothing is overwritten. A later engram supersedes an earlier one by reference, which means the history of what was believed remains intact and auditable even as the current state changes.
The consequence of these five fields together: the store can answer not only “what is relevant to this question” but “what is currently true, what caused it, and what it replaced.” No similarity index over transcripts can answer the second, because the information required was never recorded.
3 · Formation: what becomes an engram
Engrams are written during work, not at the end of it. A turn that settles something, whether a decision, a constraint, a fact about how the operator works or the outcome of an executed action, produces one or more propositions, each classed and given provenance at the moment it is formed, while the evidence for it is still present.
This timing is the point. Compression at overflow asks a model to reconstruct significance from a transcript it is about to discard, under pressure, in one pass. Writing at formation asks a much easier question, what did this exchange settle?, at the moment the answer is obvious. The store therefore accumulates conclusions continuously, and the session boundary becomes an event with no informational consequence: what the state holds before compaction is exactly what it holds after.
4 · Retrieval routed by class
A single undifferentiated index answers every question the same way, which is why retrieval-augmented systems return a plausible paragraph when what was needed was a decision. Here, class is consulted first.
Dispositions about the operator are not retrieved competitively at all. They are present in every exchange, because they are relevant to every exchange and would rarely win a nearest-neighbour contest against topical text. Prohibitions are not retrieved either. They are evaluated, which is the subject of the next section. Conclusions and ingested knowledge are retrieved by meaning: an embedding model and a reranker, both running locally, score candidates within the classes the operation calls for, and salience and recency participate in the ranking rather than being simulated by keyword weighting.
The practical property is that a question asked months later in words never used before returns the conclusion rather than the conversation, and that a question about a document is answered from documents, not from a half-remembered exchange that happened to share vocabulary.
5 · Constraint before inference
Safety logic is conventionally placed downstream of the model: the model proposes an action and a policy layer inspects the proposal. Placed upstream instead, a proposed action is validated against the persistent state before any request reaches a model.
Three properties follow. The guarantee is vendor-independent: the same boundary holds across model swaps, including to a model running locally with no network, because the boundary was never a property of the model. It is deterministic: the same state and the same request produce the same result, so the boundary is testable rather than observed. And it is free: a refusal consumes no inference, so the safest path is also the cheapest one.
This is only possible because prohibitions are state rather than text. An instruction file that says what not to do is a request to a model. A prohibition in the store is a precondition on the action space, enforced by the machine that holds it.
6 · Acquired knowledge in the same space
A partner that knows only what happened in its own window is still a window. Documents, repositories, prior conversations and research are ingested as engrams into the same store, under their own classes, with their own provenance, not into a separate index queried separately.
One space is what makes the interesting behaviour possible. A constraint written in a client’s budget document and a decision reached while writing trading logic are, structurally, the same kind of object: classed propositions with provenance in one retrievable store. A query about position sizing can therefore surface the budget constraint, because retrieval crosses domains that were never linked by hand.
This is the sense in which the system is intelligent about your work specifically. Not a larger index and not a better model, but knowledge from one part of a working life answering a question in another, because both were recorded as propositions in the same place.
7 · The model as an interchangeable faculty
Language is the one capability the system does not own. A model is attached when language is required and detached when it is not: a subscription-backed engine, a provider reached with a key, or a model running on the operator’s own hardware with no network at all.
Because identity, conclusions, objectives and prohibitions live in the store, swapping the model changes the voice and nothing else. The same partner answers, with the same knowledge and the same boundaries, on a different engine mid-conversation. Between the two sits a local router that selects an engine per request, serves repeated reads from a content-addressed cache, whose key includes a hash of the bytes read so a stale answer cannot be returned, and moves to another provider when one becomes unavailable rather than failing the conversation.
The cost curve follows from the architecture. Context is retrieved rather than re-sent, repeated reads are not paid for twice, and the proportion of a request that is re-established background falls as the store grows.
8 · Retraction without rewriting
A store that accumulates must also relinquish, and how it does so determines whether its history means anything. Removal here is expressed as a further entry: a retraction that suppresses a proposition without erasing the fact that it was once held, entering the same signed sequence as everything else.
The guarantee this buys is that a correction and a fabrication after the fact remain distinguishable. The operator can verify not only what the system currently holds, but what it has stopped holding and when. That property binds the authors of the system as much as anyone else.
9 · One store, several machines
The store replicates. Each machine keeps a full copy and works offline. One of them, the operator’s own first machine and not a hosted service, assigns every change a single global order as it arrives, and every device applies that same order. Convergence is therefore an ordering property rather than a heuristic merge, and the identity is a single file that can be moved whole.
10 · The test
The architecture makes a claim that can be checked without trusting the description: remove the model.
A system whose memory is prompt material has nothing left, because what it knew existed only as input to an inference that is no longer running. A system whose state is resident still holds who the operator is, what was concluded, what is being pursued and what is forbidden, and it enforces the last of those with no model present at all. Attach a different engine tomorrow and the same subject speaks in a different voice.
That is the difference between improving an answer and creating something that persists between answers.