Long-running AI agents often pull old, superseded, or even deleted records back into the answers they give, because most memory systems stop at select-store-retrieve. A new paper on arXiv’s cs.AI track introduces Governed Persistent Memory (GPM), an auditable model that decides whether a record is even allowed to support an outgoing claim the paper. Written by researcher G Xu, it treats memory as a bitemporal state transition with explicit lifecycle barriers rather than a passive lookup.
GPM runs on five executable clauses: ledger integrity, source binding, conflict isolation, non-revival after retraction or deletion, and exact claim closure over a single verified head the DOI record. The design goal is fail-closed release—if a record is contradictory, superseded, retracted, or stale, it cannot back a claim the agent emits.
The authors report that on a hash-frozen 3,600-case benchmark they call GPM-ReleaseBench, GPM matched every complete outcome the paper. The strongest of three deliberately simple baseline policies they tested matched only 1,800 of 3,600 cases and made unmatched releases on half of the violation cases, a gap the authors frame as evidence of how easily naive memory systems leak, and how a governed lane avoids it.
A sealed end-to-end service test exercised real ingestion and release across eight query families the paper. In its disclosed V3 arm, the governed lane was correct on all 2,400 clusters, while an ungoverned local Qwen2.5-7B baseline scored 600 of 2,400 and left 1,800 failures unrepaired the DOI record. The authors report one-sided 95% lower bounds of 99.875% and 99.834% with no regression. A later V5 reseal over Chinese- and English-command arms, with generation-date pinning and no post-freeze changes, repeated 2,400 of 2,400 per arm.
A production-code-independent finite model explored 331,776 semantic states and 1,990,656 query states with no full-contract counterexample, and a 100,000-trace, three-engine differential test produced zero mismatches the DOI record. The authors are careful to frame these as bounded contract and implementation results, not proof that any model is accurate in the open world.
For builders shipping long-horizon agents, the practical takeaway is a pattern: bind each memory record to its source, mark lifecycle state explicitly, and refuse to release claims that depend on retracted or stale inputs. The topic sits alongside other agent-reliability work we track, including an arXiv edge-agent study that cut latency violations to 3%.
