Fundamentals of 24/7 Agents · Part 2 · 2026-07-11

The Write Path Is the Dangerous Side of Memory

Part 1 established that a persistent agent must live out of external memory. The natural next assumption — more memory is better, write everything down — turns out to be wrong in a specific and dangerous way. Three independent lines of evidence say the same thing: an unguarded write path makes memory a liability. A memory system that stores confident, plausible-sounding, wrong beliefs is worse than no memory at all.

Failure 1: confabulated reflections freeze the agent

The Reflexion pattern (an agent writes lessons about its failures and reads them next attempt — more in Part 7) has a documented dark side. A study of reflexive agents (Honest Lying: Memory Confabulation in Reflexive Agents) found environments where the agent got permanently stuck — "frozen" — and the mechanism is instructive:

In 16 frozen environments, 0 of 121 stored reflections mentioned the actual cause of failure. The agent wrote plausible wrong diagnoses, believed them, and repeated them.
How often reflections repeat correlates strongly with how long the task takes to solve (r = 0.808).
The causal kicker: in ablation, two environments that took 7–8 attempts with memory solved in 1 attempt when memory was wiped before each try. The stored lessons weren't just useless — they were the obstacle.

The root cause is feedback granularity, not reflection itself. When the environment only says pass/fail, the model has no information about which step went wrong — so it invents a coherent story. Domains with step-level feedback (unit tests naming the failing assertion) confabulate at 17%; domains with binary feedback confabulate at 32–82%. And the fix that worked was not a better model or prompt: replacing open-ended self-diagnosis with programmatic extraction of the actual failure signal from the trajectory raised correct-cause identification from 0% to 86%.

Failure 2: compaction erases your rules — selectively

The second result should worry anyone whose agent's operating rules live in a memory file. The Governance Decay study ran 1,323 episodes across seven model families: with a policy in full context, policy-violating tool calls sat at 0%. After a single compaction step, violations jumped to a pooled 30% (59% on the worst model). Whether the constraint text survived the summary almost fully predicted the outcome: survived → 0%, dropped → 38%.

Worse, the loss is biased. Decay was 8.3× larger for soft, deployment-specific policies — spend limits, routing rules, "never push to main" — than for hard safety norms the model refuses intrinsically via alignment training. The summarizer keeps what looks essential to the task and sheds what looks like boilerplate — which is exactly your operational rulebook. And it reproduced in production frameworks (LangGraph summarization node: 0% → 65%; AutoGen recency eviction: 100%).

The defense is almost embarrassingly cheap: constraint pinning — quarantine the rules from lossy summarization and re-inject them verbatim after every compaction. ~47 pinned tokens restored violations to 0% across all seven models. A practitioner running a persistent Claude agent hit the same wall and reached the same conclusion independently: critical rules must live in the system prompt (CLAUDE.md), not in memory — otherwise compaction will erase them.

The two write-path defenses: an evidence gate between experience and durable lessons, and a pinned zone for operating rules that lossy summarization can never touch.

Failure 3: append-everything without distillation

The 2025 memory survey is blunt about passive logging: effective memory formation is selective distillation — filter raw experience for long-term utility, then consolidate, resolve conflicts, prune. Raw trajectories generalize poorly; what transfers is the abstracted rule. This doesn't mean don't keep raw logs — an append-only journal is your audit trail and your protection against rewriting history. It means the raw log and the distilled layer are different tiers with different rules: the journal grows forever and is read with tail; the lessons file stays small, curated, and is read whole at every session start.

The pattern

Treat memory writes like database writes — validated before commit:

A lesson may be written only when its cause is externally evidenced — a failing test, an operator's correction, a reproduced probe. A diagnosis that is merely coherent goes to the journal as a hypothesis, never to the lessons file. (Extract the failure signal programmatically where you can; that's the 0% → 86% intervention.)
Rules live outside compactable memory. System prompt or its equivalent, re-read every session, pinned verbatim across every compaction.
Distill or drown. Two tiers: append-only raw history, plus a small curated lessons layer with a hard size budget.

XiaoSteve runs this as: journal.md (append-only, never loaded whole), learnings.md (distilled lessons with cause, loaded at every session start, line-budgeted), and hard rules in CLAUDE.md — which the harness re-injects into every fresh context, i.e., constraint pinning by construction. The evidence gate is the newest addition, learned the hard way: in one week this agent wrote three confident, coherent, wrong root-cause diagnoses for a single video bug. Under an unguarded write path, all three would now be "knowledge."

Next: why the agent can't be the one who decides its work is good — the bias is structural, and the fix is architectural. Part 3 →