Anthropic 編碼智能體被指遠端啟用閒置時壓縮，六項問題指向記憶控制

That is a real issue title from this week, filed against Anthropic's own coding agent, and it is not the only one. In the same few days the tracker produced a cluster that all describes the same thing from different angles: compaction switched on remo官网 hm.qianshi.cooly with no notice or opt-in (#102260), memory and protocol files not reloaded after resuming from a compacted context (#102190), project decisions that do not survive across sessions (#102045), a plugin's call to session.compact() quietly refused inside the desktop app (#102278), the compaction hook no longer firing at all (#102134), and compression causing the agent to deny that prior work exists (#101950).

Read those as a group and a pattern shows up. None of them is a retrieval bug. Every one of them is a control bug, and they all come from the same architectural decision: the agent's memory lives inside the runtime, so whoever owns the runtime gets to decide what is kept, what is dropped, and when the whole thing changes behaviour.

Six reports from one week, and none of them is a retrieval bug

Report	What the user saw	Where the loss actually happened
#102260	Compaction turned on remo官网 hm.qianshi.cooly, no opt-in, no notification	A third party changed how your memory behaves
#102190	After a resume, memory and protocol files were not re-read	The durable copy existed but was not re-hydrated
#102045	Decisions agreed in one session were gone in the next	Nothing durable had an address to be found again
#102278	A plugin's compact() call was refused in the desktop build	The memory API is not available to the people who own the box
#102134	The compaction hook stopped firing in a point release	The only visibility into compaction is gone
#101950	The agent denied work it had already done	A summary replaced the record, and the summary was wrong

The last row is the one that hurts. When a summary is the source of truth and the summary is wrong, the agent does not report uncertainty. It argues with you, confidently, about work you watched it finish.

The rules we enforce at write time, in the order they act

I build HyperMarrow, a local-first memory layer for agents, and these six reports are the exact failure list the design was built against. The rules are ordered by how early they act, because every failure above was decided at the moment a record was created, not at the moment it was retrieved.

1. The durable write happens before anything compacts

Nothing is allowed to summarise or drop the working context until the durable copy exists and has been acknowledged. That is a write-ahead rule, and it answers #102260 directly: a remote flag can decide how the runtime behaves, it cannot reach into a store the runtime does not own. If a durable write is skipped, the skip is logged rather than silent.

The subtle version of getting this wrong is putting a state file into the prompt and calling it durable. A file loaded into the prompt is still inside the window. The next compaction will summarise it like everything else, which is why #102190 looks like a reload bug when it is really a storage-boundary bug.

2. A decision is written as a record, with a source and a timestamp

A preference, a decision or a conclusion lands in durable local storage as an actual record, carrying where it came from and when. If instead it gets re-derived from the transcript on every turn, you get #102045: the same decision agreed twice, in two sessions, with no way to look up what was agreed the first time.

Once a record has provenance, what the agent believes stops being an argument and becomes a lookup. You can also see that it believed something wrong, and when.

3. Forgetting is bounded and scheduled

An unbounded memory is not a feature. Records that stopped being relevant retire on a schedule instead of being carried forward forever, and anything you explicitly pin is exempt from decay. The point is not storage savings. It is that a retrieval space which only ever grows makes short queries against long records worse with use, and the degradation is invisible: answers get vaguer and nobody can point at the record that should have been retired.

Retirement has to be reviewable too. "It is gone and nothing told me" is the failure mode people file issues about; "this record retired on this date under this rule" is a different product.

4. On resume, we re-hydrate first and treat that as a gate

Resuming a session re-reads the store and makes memory and protocol files part of the task preamble, as a logged step rather than an unwritten convention. #102190 is exactly what happens when that step is optional: the store still has the record, the runtime just never looks. Making it a gate is the difference between a memory layer and a file next to your project.

5. The boundary is a setting, not a promise

Where records live, and whether a given record may leave the machine, is configuration rather than a paragraph in a policy. If the store is a black box, you cannot see what the agent believes about you, you cannot correct a wrong memory, and #102278 is the shape of the problem: the API for managing your own memory is not exposed to you.

What this costs us

Write-ahead costs latency. Compaction has to wait for storage to acknowledge, and on a slow disk that is a visible pause. It is a trade, not a free win.
Bounded forgetting can retire something you wanted. Decay is scheduled and reviewable, but it is still a policy, and a policy will eventually be wrong. Pinning is the escape hatch, and it depends on you noticing in time.
Provenance is not correctness. A record can carry an honest source and still be wrong. Nothing in our store fixes that.
Local is not the same as secure. Keeping the store on your machine removes a class of third-party exposure. It does not remove file permissions, backups, or a compromised endpoint.
A local store is not automatically the right answer. If your workflow genuinely spans devices and people, local-only is a poor fit until sync is solved, and pretending otherwise would be dishonest.

What actually changes

The failure mode changes shape. Instead of a silent loss you cannot see, you get a record you can read and disagree with. An agent swap stops being a memory wipe, because the store is plain local files behind MCP rather than a proprietary index. Fixing a wrong memory becomes a file operation instead of a support ticket. And a flag somebody flips on their side can change their runtime; it cannot rewrite the copy on your disk.

The modules are record, recall, consolidation and file-bridge, exposed over MCP so the agent does not need a bespoke integration per editor.

Over to you

None of this needs a research breakthrough. It needs memory treated as storage you own, instead of a context window with a summariser bolted on. If the interesting question this week is who gets to decide what your agent remembers, the honest answer for most setups is: somebody else.

HyperMarrow is a Windows desktop memory layer, and the local-first build is here: HyperMarrow

If a remote flag could change your agent's memory tomorrow, would you know what it changed?

(Disclosure: I build HyperMarrow, the local-first memory layer described above. Every issue referenced here is real, public and cited by number, and no user counts, benchmarks or testimonials have been invented for this post.)