← Memory From First Principles

Why

Trace beliefs and generated claims through derived memory back to the evidence that actually supports them, distinguishing support from retrieval, derivation, repetition, and mere citation.

Chapters 3 through 6 leave the system with a working pipeline and an uncomfortable surplus. Chapter 3 retrieves raw history. Chapter 4 derives a persistent graph from it. Chapter 5 propagates activation across that graph. Chapter 6 chooses between these mechanisms. A candidate memory reaches the reader, the reader writes an answer, and the answer contains claims about the project. This chapter asks the book’s third question — why did we decide or believe this? — in the form the pipeline forces:

A memory system has produced a claim. What gives it the right to believe or say that claim?

That is not the same as asking where the text came from, how the system retrieved a memory, which subsystem the Nexus chose, or whether the claim is still true. Those questions need to remain separate. This chapter is about evidential justification and traceable derivation, and its thesis is:

Provenance is not a citation attached to an answer. It is maintained dependency information connecting derived claims to the evidence that licenses them.

A second formulation runs through the whole chapter: lineage tells us where information came from, while support tells us why we are entitled to believe it. Both are tested below against an implementation and a frozen experiment suite rather than asserted.

A citation is not a reason

The simplest provenance model is a source pointer on every stored belief. It breaks in four ways, each a representational problem rather than an implementation detail.

Multiple support. The PostgreSQL decision rested on several pieces jointly: the contention report in session-014, the benchmark in session-019, the importer incident incident-021, and the rationale in adr-007 that ties them together. No single span contains the rationale. A single pointer must either pick one leg, understating the evidence, or point at the decision record that summarises them, which moves the problem one step back.

Summaries that drop qualifications. A later wiki page restates the decision as use of PostgreSQL for performance, omitting that the advantage applied to concurrent-write workloads and that the team accepted higher operational cost. A pointer to the summary supports the simplified belief while hiding the qualification that determines its scope. The chain must reach past the summary to the evidence the summary compressed.

Repeated old decisions. The August runbook repeats that the event store runs on PostgreSQL without noting that it restates July’s outcome. A pointer to the runbook looks like independent confirmation; traced properly, it is the same belief echoed. Without derivation edges, repetition masquerades as corroboration.

Non-supporting sources. A passage can be topically relevant, correctly retrieved, and genuinely similar to the claim while not supporting it. The pre-decision note in session-033 argues the losing side — keep SQLite for operational simplicity. Citing it as justification for the migration is worse than citing nothing, because it lends the belief borrowed authority.

Each failure shows the same missing piece: support is a relation between items, not a property of one item. A pointer records where a belief was found. It does not record what the belief was inferred from.

Four different meanings of “why”

The rebuilt pipeline produces four traces that all sound like answers to “why”, and the chapter’s first architectural act is to refuse to conflate them.

Retrieval causality answers why a memory was recalled: in the synthetic fixture, the query led through Bill to Project Alpha to invoice-183. That is Chapter 5 pathway information. It does not establish that the invoice supports the answer; in the fixture it does not, because the invoice records routine renewal unrelated to the budget variance. Bill, Project Alpha, and invoice-183 are synthetic fixture names in this illustration, not canonical ledger artifacts.

Control causality answers why the system used one memory process rather than another: the Nexus chose associative retrieval because direct retrieval confidence was low. That is Chapter 6 routing information. It does not establish that the resulting claim is true.

Derivation lineage answers what generated a representation: source spans led to an extracted relation, which led to a community summary, which led to retrieved context, which led to the final answer. That explains where derived information came from. It still does not establish evidential support, because any stage may have added content its inputs do not license.

Evidential support answers which evidence actually licenses the claim: the contention benchmark, the importer incident, and the decision rationale jointly support the statement that contention motivated the migration. Only this fourth relation is the chapter’s subject. The other three are preserved as annotations on the same graph, stored where they can never be mistaken for support.

    flowchart TD
    Q[query] --> NX[Nexus route]
    NX -->|control causality| AP[associative path]
    AP -->|retrieval causality| DG[derived graph object]
    DG -->|derivation lineage| SE[source evidence]
    SE -->|evidential support| CL[claim licence]
    style CL fill:#3978c5,color:#fff

The cost of derived memory

Chapter 6’s frozen measurements motivate everything that follows, and they are worth restating precisely because they cut against the obvious story. On eight measured routing tasks, raw evidence performed strongly, graph modes carried substantial unsupported-source harm (0.43 to 0.79 against zero for raw evidence, associative retrieval, and no-memory), and the oracle router’s headroom over the best fixed policy was cost-only: quality headroom 0.000, utility headroom 0.067. The single discriminating provenance task, q3-why-postgres, split quality 1.0 for raw evidence against 0.5 for every other measured capability.

Book result. Chapter 6’s matrix (experiments/benchmark/runs/ch6-20260919-nexus/) shows derived machinery adding harm as well as structure on the fixture tasks.

The emerging problem is therefore sharp: every derived stage potentially adds useful structure and another place where unsupported information can enter. More derivation is not monotonically better. Chapter 7 makes that measurable by tracing each claim through every stage and testing each stage separately.

Claims first

Verification cannot begin until the system decides what needs verifying, and a sentence is not necessarily a single claim. The sentence stating that PostgreSQL was selected because SQLite contention caused the importer failures contains at least four checkable propositions: that PostgreSQL was selected, that SQLite experienced contention, that the contention contributed to importer failures, and that those events contributed to the decision. A citation attached to the whole sentence may support only some of them.

Claim extraction is itself fallible infrastructure. The layer treats it as a measured component, not a preprocessing given.

Three deterministic baselines are implemented:

  • C0 splits sentences and stops.
  • C1 applies a constrained schema, splitting on conjunctions and causal joints, and flagging negation, conditionals, and attribution.
  • C2 reproduces the published Claimify shape — select verifiable content, disambiguate with abstention on unresolvable reference, decompose into atomic claims — using no Claimify code. It is labelled Claimify-inspired throughout.

Every claim records its source span, its producer, and its producer version. A support graph built with a new extractor is a different derived artifact, and must be identifiable as one.

Book result. On seven labelled sentences covering conjunction, causation, qualification, negation, conditionals, attribution, and ambiguity (E7-B), all three extractors reach identical coverage of 0.70, while the baselines separate on exactly the axes the literature predicts: the sentence baseline misses all three qualifier flags, the structured extractors miss none, and the Claimify-inspired extractor is the only one that abstains on the unresolvable reference instead of inventing a claim for it.

The tie on coverage is reported rather than hidden: deterministic splitting does not beat sentences at finding propositions. Its value lies in flags and abstention. A verification system cannot be more trustworthy than the claims it decided to verify, and abstention on “Its behaviour changed” with no resolvable referent is the honest output.

Support is a relation

With claims fixed, the layer proposes candidate evidence and then decides whether each candidate actually supports the claim. The fixture plants the adversarial cases deliberately: the losing-side note, a benchmark of a different importer reached through a valid associative path, a qualification-dropping summary, and an echo of the decision. Retrieval success and evidence success diverge on purpose.

Book result. The evidence filter rejects every planted non-supporting candidate while keeping every genuine leg (E7-E, rejection recall 1.0 on both the migration case and the invoice trap). A valid Chapter 5 path through a benchmark of the wrong importer is retrieval working and evidence failing at once.

Provenance precision penalises the specific sin this invites: citing genuine but non-supporting evidence. A citation should not borrow authority merely by looking relevant.

So the instrument scores answer correctness and evidence correctness on separate axes. The fixture’s four reader outputs fill all four cells:

  • Right answer, right evidence.
  • Right answer, wrong evidence.
  • Wrong answer, right evidence for a subclaim.
  • Wrong answer, wrong evidence.

The layer’s verdict is deliberately strict. A correct answer carried by an invalid support chain fails justification, even where it passes question answering.

For revision-critical tasks that verdict is the whole point. For trivial lookups, the layer’s own cost accounting says the machinery may not be worth running. The chapter keeps that task-sensitivity explicit rather than pretending the layer always pays.

One source is rarely enough, and evidence has logic

The migration rationale needs three legs at once: the benchmark establishes contention, the incident establishes operational consequence, and the decision record connects those observations to the choice. No single source fully licenses the claim. Worse, legs do not add up the way coverage fractions pretend. If the benchmark is the keystone, losing it invalidates the rationale even while four weak supporting artifacts remain; conversely, an independent benchmark rerun can carry the same leg, so that losing one of two sufficient routes changes nothing.

The representation answers with support groups: conjunction inside each group, disjunction across groups. The main claim carries two alternative groups — benchmark plus incident plus rationale, and independent rerun plus incident plus rationale — which is the minimal-evidence-group semantics of Li and colleagues: sufficient, non-redundant, minimal sets, with alternatives allowed. Minimality is checked group-relatively, because a pair licensed inside one group says nothing about its role in another.

Book result. Group exact-match rates separate the representations completely (E7-C): single pointers 0.11, direct citation of everything retrieved 0.44, explicit support groups 1.0. The pointer cannot express conjunction; direct citation cannot express minimality, and counts echoes as legs.

Repetition is not corroboration

The decision record, the runbook, and the wiki page all say the event store runs on PostgreSQL. Counted as citations that looks like threefold support. Traced as derivation it is one observation plus two echoes, and the layer stores ECHO_OF edges to say so. Twenty echo documents should not count as twenty independent supporting sources, and the experiment maps exactly where the cheap detection stops working.

Book result. A token-overlap echo heuristic at threshold 0.55 recalls 0.40 of a five-rung paraphrase ladder (E7-D): exact copy and near paraphrase are caught, heavy paraphrase, summary, and changed terminology are not. Beyond near-duplicates the system relies on recorded derivation edges, not on resemblance.

That boundary is stated as a limit rather than a roadmap promise. If derivation edges cannot be recorded through a transformation, the echo distinction for that transformation is scorer fiction, and the chapter refuses to claim general paraphrase-robust echo detection.

A graph connection is not evidence

Chapters 4 and 5 connect relevant-looking information. In the synthetic fixture: Bill to Project Alpha to budget to invoice.

The connection is real. The retrieval is valid. The invoice still supports nothing about the budget claim.

PAGE-RAG names this failure the connectivity-support gap. Graph edges are support hypotheses, not support, and a fixed-budget reader needs those hypotheses tested before promotion.

This layer implements the testing side. Association proposes candidate evidence; the support relation determines whether that evidence can justify the claim. The retrieval trace is kept alongside the verdict, so debugging can see both.

Lineage traced backward

Some claims pass through several stages of derived state — source chunk, entity extraction, relationship, community summary, retrieved context, answer. For those, the layer walks the chain in reverse, asking at each stage whether that stage’s output is supported by its inputs.

The design follows VeriTrail directly: a DAG model of the workflow, reverse-order verification, per-stage verdicts of fully supported, not fully supported, or inconclusive, and an evidence trail of selected spans.

What is borrowed is the shape and the verdict discipline, not the model judgements. On fixtures, ledger truth drives every verdict. Any LLM-backed verifier would be a new run with its own manifest — never a silent substitution.

Demands stay explicit through the walk in the LineageRAG spirit: each stage output must establish something specifiable, grounding completes in verbatim source spans, and lineages that never reach a span stay visibly open rather than being rounded up to supported.

Book result. Five of nine fixture claims trace completely to raw spans with no open ends; four remain honestly open — two with no support structure at all, one grounded only in a harmful derived relation with no raw path, and the hallucinated figure discussed next (E7-F). Open lineage is an incompleteness signal, not a failure to be smoothed over.

Where did the error enter?

A more diagnostic capability is localisation.

Watch it work. A community summary adds an invented figure — SQLite lost 14% of writes — and the reader repeats it fluently. Scoring the final answer as hallucinated correctly identifies the output failure, but not where it entered.

The reverse walk localises it. The source, extraction, and graph stages are valid; the summary is unsupported by its inputs; the context and reader merely propagate it. First likely failure: the summary stage.

A second fixture makes the same point from another direction. A graph-local relation invents a Redis cause for the importer failures. That localises to the graph stage while routing and retrieval both pass — reported as routing pass, retrieval pass, evidence fail. The router is never blamed for a downstream invention.

Book result. Error-stage localisation matches the injected stage in all three fixture traces, including the fully supported control (E7-G, 3 of 3).

Ground in the original source — but the source can be wrong

Chains terminate in raw artifacts because termination buys inspectability: any auditor, human or mechanical, can open the span and read what was actually said. What termination does not buy is truth, and the fixture plants the case that proves it. A session note confidently reports the 14% write-loss figure; the ledger records it as fabricated. The layer reports the claim as traceable to that span and unsupported by anything, which is exactly the honest pair of verdicts:

Raw-source termination guarantees inspectability and historical grounding, not truth.

A raw source may be mistaken, stale, deceptive, incomplete, or itself a report of another source. Source reliability — track records per source, maintained over time — remains an explicit extension point rather than a capability built here. This chapter establishes traceability as distinct from truth and records source identity so later reliability work has something to attach to.

Provenance of provenance

Support edges are themselves proposed by fallible machinery. So every edge carries what licensed it: the extractor, its version, the spans behind the proposal, and an extraction confidence.

Read that confidence carefully. It means confidence that the relation was correctly extracted. It never means the probability that the claim is true.

Four quantities are kept separate and must not be collapsed — claim confidence, source reliability, extraction confidence, and memory utility. Each answers a different consumer. The verification system needs claim-level evidence. The human auditor needs inspectable spans. The reader needs compact context. The future revision engine needs machine-readable dependencies.

Generated prose may render that dependency structure for any of them. It must never invent the structure. Which rules out the tempting shortcut: asking a model to explain why it believes something, and filing the fluent answer as provenance.

The mechanism

The implementation layers over the existing systems: raw spans feed retrieval, graph, association, and Nexus paths; answer claims feed the evidence layer; the evidence layer resolves support, lineage, and verification back against the original spans. Upstream provenance is preserved where the pipeline records it; where it does not, the layer reconstructs support hypotheses and marks them as reconstructed, never as recorded.

The edge taxonomy is strict and small:

  • SUPPORTED_BY — evidential: this evidence contributes to licensing the claim.
  • DERIVED_FROM — lineage: this object was generated from the parent, which says nothing about whether the parent proves the child.
  • ECHO_OF — restatement: this content propagates earlier information and contributes no independent evidence.
  • REFUTES — evidence against a claim, recorded without resolution; conflicts belong to Chapter 8.

DERIVED_FROM is never converted into SUPPORTED_BY, Chapter 5 paths and Chapter 6 routes are stored as trace annotations rather than edges, derivation cycles are rejected, and every echo must resolve to a non-echo source. The layer is queried as:

claims = extract_claims_c2(answer)
support = graph.support_for(claim_id)
trail = graph.trace_to_sources(claim_id)
affected = graph.dependents_of("s19-benchmark")
verification = verify_backward(claim_id, stage_support)

Frozen run: ch7-20260919-e7 (fixture-level, deterministic, zero model calls). In the diagram, s19-benchmark, a07-rationale, and i21-incident are compact fixture aliases for the canonical session-019, adr-007, and incident-021; s44-replicate is a second synthetic benchmark rerun planted as an independent route, not a canonical artifact; g1/g2 are fixture-internal support-group nodes.

    flowchart LR
    B[s19-benchmark] --> G1{g1: AND}
    I[i21-incident] --> G1
    A[a07-rationale] --> G1
    R[s44-replicate] --> G2{g2: AND}
    I --> G2
    A --> G2
    G1 -->|OR| C[claim-main]
    G2 -->|OR| C
    style C fill:#3978c5,color:#fff

How the claim is tested

The suite extends the Chapter 2 instrument only where the chapter earns the measurement: claim extraction coverage with qualifier tracking, support precision and coverage, provenance precision against borrowed authority, group exact and soft match, lineage completeness, raw-grounding rate, echo precision and recall with echo inflation rate, error-localisation accuracy, and dependency impact precision and recall. No aggregate provenance score is produced; the dimensions stay separate because they fail separately.

The evaluation order is deliberate. Controlled fixtures with ground-truth groups come first. Mechanical checks come second — valid source identifiers, existing raw spans, terminated chains, rejected cycles, complete groups. Model judges come last, or never.

The literature insists on that ordering. AttributionBench finds even fine-tuned judges reaching only around 80% macro-F1 on attribution decisions. CiteEval shows binary support judgements missing much of what makes a citation good or bad.

The stakes are worth naming plainly. A support layer whose evaluator is unreliable beyond its fixtures can manufacture justification rather than merely miss it. That failure is especially serious because the resulting answer can still read as well-supported.

Support withdrawal

The chapter’s clearest mechanical demonstration is withdrawal. Build the support graph, verify the main claim, then remove one evidence leg and recompute.

Withdraw the benchmark. The narrow throughput claim breaks, because it depended on that alone. The migration claim stands, because the independent rerun group still holds.

That pair makes the keystone-versus-redundancy distinction operational. The same withdrawal is fatal to one belief and harmless to another, and the dependency structure identifies which claims require reevaluation before any new reasoning occurs.

Two more withdrawals confirm the shape. Withdrawing the decision rationale affects both the migration claim and the atomic selection claim. Withdrawing the rerun alone changes nothing at all.

Book result. Dependency impact matches fixture truth exactly on both retractions (E7-H, precision and recall 1.0), and redundant-group removal preserves support (E7-I).

The response to withdrawal is flagging, not rewriting. Affected claims are marked as requiring reevaluation, with the historical evidence preserved rather than deleted. Deciding what is now true given the remaining evidence is Chapter 8’s resolver; Chapter 7 hands it the dependency structure it needs through support_for, sources_for, dependents_of, lineage_of, minimal_groups, and requires_reevaluation queries.

What it cost, and whether the layer earns its place

Provenance is not free.

The fixture graph holds 26 nodes and 20 edges for nine claims, and the full suite runs in about a millisecond with zero model calls, because every judgement is ledger-driven.

Those numbers describe the fixture, not production. Real extraction and verification cost model calls. Storage grows with every derived object that must keep its path home. Stale lineage needs maintenance. False support edges are especially costly because they make unsupported claims appear justified.

So the invariant scopes itself. Any persisted derived memory that may influence future behaviour should retain derivation lineage back to the canonical evidence it came from. Transient query-time computation need not be persisted solely to satisfy that requirement.

Against the pre-registered outcome types, the fixture evidence maps to Type A: pointer and direct-citation representations fail the planted support-group cases, while explicit groups and lineage reach perfect group exact match and enable correct localisation and dependency-impact results on the injected fixtures. The result remains bounded by its scope: deterministic extraction and verification over nine claims with no reader and no real-corpus transfer, so LLM-backed variants remain unmeasured.

What remains unsolved

This chapter answers why a claim was supported. It does not answer whether the claim still holds.

Whether the sources are trustworthy, whether an interval expired, whether a successor superseded the belief, how conflicts resolve, what the authoritative current state is — all of that is Chapter 8’s machinery.

That distinction is crucial. This layer marks what must be reconsidered. It never says what should now be believed.

Beyond that handoff sit the problems this chapter exposes without solving: source reliability as maintained state, support strength and confidence aggregation, how much provenance to keep forever, and whether five years of accumulated chains stay traversable or need their own forgetting.

The contribution this chapter can hand forward is the dependency structure those later mechanisms will need.

Research foundations

Citation and revision research supplies the scoring discipline. RARR retrofits attribution and revises output against evidence, keeping answer and support correctness apart. ALCE benchmarks citation recall and precision over multi-passage answers, and finds completeness wanting even in strong systems. Self-RAG gates retrieval and critique on learned support signals. GopherCite contributes verbatim-quote grounding with abstention — and the finding that supported claims can still be untrue.

Evaluator caution comes from two places. AttributionBench shows automatic attribution judgement stalling near 80% macro-F1. CiteEval replaces bare support labels with principle-driven assessment in full retrieval context.

The mechanisms come from four more. Claimify provides the extraction shape and its metrics. VeriTrail provides reverse verification with error-stage localisation. PAGE-RAG names the connectivity-support gap and pairs it with minimal sufficient selection. LineageRAG carries per-demand lineages through to verbatim spans, with open lineages as honest incompleteness.

The chapter adopts these mechanisms as design inputs without inheriting their trained judges, model-specific claims, or reported results.

References