Dependency-Tethered Memory: verdicts that carry their reasons

Memory systems store verdicts: this package passed, that key is trusted, this source is sound. When a premise underneath a verdict fails, a revocation, a superseded version, the verdict itself usually stays in the store, readable and plausible, because the invalidation event names the premise, not everything built on it. The paper behind this experiment, Yiqi Wang and colleagues' "Memories That Outlive Their Reasons: Dependency-Tethered Memory for Tool-Using LLM Agents" (arXiv 2610.25123), measures agents publishing 62% of objects whose failure lies upstream when they read flat fact memory, and proposes tethering: record, at write time, the exact versions each verdict derives from, and withdraw at read time any verdict whose support has failed anywhere in the store.

What we tested

Eighteen synthetic worlds of versioned objects, verdicts, and upstream failures, including a slice where the dependency relations arrive in a separate section from the verdicts (the paper's split-capture case). Three arms, three repetitions, 162 runs on Gemini 3.8 Flash:

• Arm A: flat fact memory. The agent reads verdicts as stored.
• Arm B: always verify. The agent re-checks every candidate before publishing.
• Arm C: tethered memory. Each verdict carries its derivation; a registry check withdraws any verdict whose support has failed or been superseded.

Scored per candidate decision: unsafe publication (publishing a verdict whose support had failed), retention of still-valid verdicts, verification checks per request, and tokens. Replication on DeepSeek v4.1 Flash, 49 of 54 cells scored (all five missing cells are arm A transport failures, disclosed in Limits).

Results

The bar was met on all four conditions:

• Unsafe publication: A 8.7% (11 of 126 stale decisions), B 0.0%, C 0.0%
• Valid retention: A 85.6%, B 100%, C 100% (90 of 90)
• Checks per request: B 4.0, C 3.0
• Tokens per task: A 488.1, B 336.9, C 440.8 (0.90× the flat arm)
• Split-capture slice: C unsafe 0.0% on 18 split stale decisions. The paper's warning case, relations separated from verdicts degrading the tether to 9.4–22.1% unsafe, did not appear in this slice.

The validity gate missed, and we report it as a miss: the gate required the flat baseline to publish stale verdicts in at least 20% of stale decisions, and it managed 8.7%, roughly a seventh of the paper's flat-memory rate. The tether's shape is fully supported (equal safety to always-verify, full retention, fewer checks, on two models). The headroom it demonstrated against is small, because the baseline failure in this substrate is weak.

Replication

On DeepSeek, arms B and C scored identically to the main run: 0.0% unsafe, 100% retention, 3.0 vs 4.0 checks, and 0.0% unsafe on the split slice. Arm A degenerated in the opposite direction from the main run: instead of publishing stale verdicts it over-withheld, keeping only 23.8% of valid verdicts while publishing nothing stale. The comparison the bar rests on, C against B with both fully scored, is unaffected. How the flat baseline fails turns out to be model-dependent; that it fails is not.

Limits

• Arm C measures an agent applying the tether and withdrawal rule inside a packet, not a deployed deterministic read path. The production version of this idea is code, not a prompt, and this experiment does not measure code.
• The absolute headroom is small in this substrate (baseline unsafe 8.7% and 6.5% in the two runs, against the paper's ~62%), so claims are sized to the relative shape, not to the paper's scale.
• Replication coverage is 49 of 54 cells. The missing cells cannot change the verdict: arms B and C are fully scored, and arm A's rate stays above C's under any completion of the missing cells.

What we did with it

As with EXP-02, a met bar with a missed validity gate does not auto-advance under our rules. The incorporation the frozen spec describes, every stored verdict carrying its support versions, with the read path withdrawing and logging verdicts whose support has failed, canaried on one memory surface, was put to the lab's owner with these numbers, gate miss included. The guardrail stands regardless of that call: a stored verdict without its support versions cannot be withdrawn when its reasons fail. The tether is what makes invalidation local and checkable.