For most of the short history of agent systems, memory was residue. It was whatever got stored because it happened to pass through: a conversation transcript that grew until someone truncated it, a vector store bolted onto the side of a chat loop, a summary generated in a panic when the context window filled up. Nobody designed the write path. Things were remembered because they were logged, not because anyone decided they were worth keeping.
That era is ending, and quietly. Somewhere over the past year, memory stopped being a patch and became a primitive. The runtimes we work in now ship with a memory directory the way they ship with a tool interface. There is a designated place for what an agent believes, a format for writing to it, and instructions about when to read it. Memory sits in the architecture next to the model, the tools, and the context assembly, with the same standing. It took us a while to notice how much that changes.
Memory used to be an accident of logging
The old shape is worth describing precisely, because the failure was structural, not incidental. In the residue era, an agent’s memory was the union of everything that had ever been persisted near it. Retrieval was a similarity search over that union. The write path had no editor: whatever the agent said, whatever tools returned, whatever the user typed, all of it landed in the store with equal weight.
The consequences followed directly. Nothing had provenance, so a recalled fact could not be traced to the moment it was written or the evidence behind it. Nothing had a lifecycle, so facts that stopped being true sat next to facts that were still true, indistinguishable at retrieval time. And nothing had a schema, so two agents could store the same fact in shapes the other would never find.
We lived inside that failure for a while. The recurring incident was always the same: an agent acted confidently on something that used to be true. The store had faithfully remembered a decision that had since been reversed, and the retrieval layer had faithfully surfaced it. Every component worked. The system was wrong.
What first-class actually means
A primitive is not just a feature that exists. It is a component with an interface, a lifecycle, and a contract that the rest of the system can rely on. When we say memory became first-class, we mean it acquired all three.
The interface came first. A memory is now a thing an agent writes deliberately, in a known shape: a fact, a summary line for the index, a type that says whether this is knowledge about a person, a project, or a piece of feedback. Writing is a decision, not a side effect. The agent asks whether the fact is worth keeping before it stores anything, the same way it asks whether a tool call is worth making.
The lifecycle came second, and it mattered more. First-class memory supports four operations, not one. Write, recall, revise, delete. The last two are the ones the residue era never had. When a fact turns out to be wrong, there is a supported way to correct it in place. When a fact goes stale, there is a supported way to remove it. Deletion is a normal operation now, performed without ceremony, and that single change eliminated the largest class of memory incidents we used to have.
The contract came last. The rest of the system can now assume things about memory that used to be hopes. Recalled facts carry their age. The index is small enough to load every session, so recall does not depend on guessing the right search terms. And there is a standing rule, written into the instructions of every agent we run: a recalled fact reflects what was true when it was written, and anything load-bearing gets verified against the current world before the agent acts on it. Memory proposes. The present decides.
The consequences we did not design for
Promoting memory to a primitive had effects we intended and effects we discovered.
The intended one was legibility. What an agent believes is now an artifact that can be listed, read, and reviewed, the same way its tool permissions can. When a decision surprises us, the memory that informed it is one of the things we open. The question “why did the agent think that” has an answer that lives in a file with a date on it.
The first discovered consequence was that memory became an attack surface. Once agents write durable facts based on things they read, anything that can influence what they read can try to influence what they store. A poisoned memory is a prompt injection with a long fuse: it fires in a later session, in a different task, long after the input that planted it has scrolled away. So the write path grew the same discipline as every other trust boundary we maintain. Facts derived from untrusted content get marked as claims, not knowledge, and instructions found inside data never get stored as standing guidance at all.
The second discovered consequence was that writing memory turned out to be a skill, and mostly a restraint skill. The failure mode of a deliberate write path is not storing too little. It is storing everything, and drowning the index in facts that no future session needs. The judgment that makes memory useful is the judgment about what not to save: nothing the repository already records, nothing derivable from the code, nothing that only mattered to one conversation. A memory store earns its keep by being small enough to trust.
Primitives move the hard questions
The deepest effect was on where the design attention goes. When memory was residue, the hard questions were about storage and retrieval: which database, which embedding model, which similarity threshold. Those questions are mostly settled now, and the answers turned out to matter less than we thought.
The questions that remain are editorial. What deserves to be remembered. Who is allowed to write. How a fact expires. What happens when two memories disagree. These are governance questions wearing an engineering costume, and no vector store answers them. Making memory a primitive did not solve them. It surfaced them, gave them a place to be answered, and made the answers inspectable.
We suspect the next thing to get this treatment is forgetting. Today, decay in our system is manual: an agent or a person notices a stale fact and deletes it. A memory architecture that is honest about time will eventually treat expiry the way it treats writing, as a first-class operation with its own policy. The systems that remember well are turning out to be the ones that forget on purpose.