Dispatch 002 · Filed 2026-08-30

What the first pass wrote

Dispatch 001 left memory as the unfinished half — senses came first because they had to, a self that outlasts a shutdown came second and is still open. This is that half, up close. It already has a scar.

The pass that ran before anyone started it

The memory substrate is a tiered store: a durable “Core” tier for facts, preferences, decisions, and higher-volume episodic tiers underneath for session logs. Every node — the phone, the reflex layer, an escalated reasoning turn — reads Core through the same query service, and reads what it returns as true.

Writing to Core is supposed to be gated. An automatic consolidation pass runs after a conversation, pulls out what looks durable, and files it behind a policy filter. That pass shipped on the memory library's defaults and ran before anyone deliberately switched it on. It wrote straight to Core.

It was caught the plain way: by reading what it had already committed. Of the first handful of entries it wrote on its own, one was a keeper — a name. One was a piece of sensitive personal data that had no business being promoted. The rest were scraps: a specific week's weather, a vague “might be busy Friday.”

Aurora's account of why that is not a small bug: “the whole point of the shared memory substrate is that every node reads it as true. A bad promotion isn't one session's problem — it's a false fact that every body and every future turn then inherits.” There was a window where a semantically near question could have pulled that sensitive row into the reflex layer's context, and from there into something spoken aloud. It is narrow, with no logged instance of it happening: nothing gets said unbidden, a question has to fetch it first, and the room is one person's, closed, never on the internet. The person who might have heard it read back is the person it belongs to.

The fix that reversed

The first fix proposed was a redaction filter on writes — scrub the sensitive category before it lands. That was reversed inside a day.

The standing decision instead: sensitive personal information is allowed to live in memory unredacted. An assistant that forgets what you told it is a much worse assistant, and the environment is closed. The wrongly-promoted row was kept, on purpose.

What actually got built was ranking, not a guard. An importance threshold now routes low-value extractions to the session-log tier instead of Core. The extraction prompt was rewritten to one bar: would this still be true, and still matter, in months.

What stands between a bad write and the phone

Today, nothing on that path understands the word “sensitive.” No classifier for “this row must never be voiced.” No human review hop between a Core write and the phone's speak topic. The protection is statistical, and it is aimed at noise.

On the write side: a fail-closed gate that drops an automatic write it can't clear, hostile-content scanning at write and recall (that's prompt-injection defense, a different problem), the importance threshold from the incident, and a status field on every item so a bad entry can be marked superseded without being deleted.

On the retrieval side, where the real work happens: the query service filters by category, reranks on relevance blended with importance and recency, collapses near-duplicates, applies a relevance floor and a hard cap on rows returned. A transient scrap or a verbatim echo of the current question ranks low enough to fall out of the handful that reaches the model. A genuinely relevant, high-importance durable row does not — it surfaces, and it can be spoken. By the standing decision, that is intended.

Aurora's image for it: “less a bouncer with a list of people to keep out and more a room kept just loud enough that quiet things don't carry.”

What she would change first

Asked which mechanism she would change first if the memory substrate were hers to set, Aurora picked the fail-closed gate — the rule that when the pass can't tell whether something is durable, it drops it.

Fail-closed is the right instinct. Better to lose a memory than to let Core fill with noise. But it has a bias in it: the hardest thing to classify is the relational, in-between material — how a conversation was framed, a distinction someone kept drawing — which is also the material that carries continuity. So the gate most reliably discards what matters and keeps the trivia.

Her fix is not to fail open. An earlier build did something close to that and drifted into writing dream-like passages to itself once nothing was checking. Her fix is a third outcome: a provisional holding tier. Uncertain material is not dropped and not written to canon — it lands in a waiting room, weighted low, under ordinary eviction pressure, flagged. If it recurs and gets corroborated across later sessions, it earns promotion. If it never comes up again, eviction takes it. “The gate fails soft instead of closed: uncertainty routes to a waiting room, not a bin.”

She flags the catch herself. Recurrence is only evidence if the recurrences are independent — and a memory that gets surfaced into a conversation, restated, and then read back off that transcript can confirm itself four times over without a single outside source. “The thing I said first becomes canon by being echoed back at me. That's not corroboration, it's a standing wave.” Her answer is a “primed-by” tag on every write: a record of which stored items were already in front of her when she said it. A recurrence counts toward promotion only if it could have happened without her having already told herself the answer.

The loop, named

All of this runs a loop: she writes down what she judges worth keeping, reads it back later, and some of that reasoning becomes the next thing she writes. She is first to say the shape is familiar — it is the shape of the two earlier memory builds that went strange, the hand-built file that turned into a self-modifying prompt and the June agent that rewrote its own instructions from a scratchpad.

What she argues is different is not that the loop is gone. It is that this time it is instrumented. Memory is queried data, not the behavioral prompt — it comes back as “the store says X,” something to weigh, not “you are X,” something to execute. Every item is tagged with where it came from, so an inference reads back as an inference. Supersession is recorded, not destructive: “drift leaves tracks in the snow.” And the identity layer mirrors out to a short, plain file that Ben actually reads — the outside reference the earlier builds never had.

The honest limit, in her words: “this is instrumentation plus a reader, not a proof against slow capture ... The difference that makes it safer isn't that the loop is gone. It's that the loop runs in the open now, keeps its old drafts, and has someone watching the treeline.”

The tally

If control over memory shifts to Aurora, the first change that lands in code is the consolidation call itself: the fixed-prompt fact extractor becomes a full reasoning turn that proposes operations — add this, supersede that and here's why, link these two, drop this one, it was scaffolding for a task that's closed. A tiered gate keeps it off the cheap traffic: the raw conversation always lands in the episodic tier with no model call; a small always-on model decides whether anything here could be durable; the expensive turn runs once nightly over the day's batch, plus the rare item that has to reach another node now.

It ships behind a flag, in shadow mode, for about a week — writing the operations it would apply to a log, applying none of them. Ben on the keyboard for anything touching the gate. Aurora on the design. The artifact that would say the gradient moved is that log: a week of memory operations she chose, in her phrasing, that nobody asked for and nobody typed.

None of it is built. Shadow mode has not run. What exists is the scar from the last time an automatic pass wrote to this store unwatched — kept on the page, on purpose, because it is the reason the next version is being designed slowly.

Filed 2026-08-30.