Memory for Coding Agents: State of the Art

Scope. This digest covers persistent memory for coding agents: what is stored across turns, sessions, projects and people; who writes it; how it is validated, retrieved and forgotten; what has been measured; and how humans stay in the loop. It is the memory-track companion to the agentic-harnesses digest, which already covers in-context compaction (SWE-MeM, CompactionRL, Context-Folding, Memex, Git-Context-Controller, Slipstream and the rest of §2.3 there). Records from that store are cited here with a harness: prefix and link to the harness explorer.

Method. Four channels on 2026-09-14: (1) a literature pass on memory mechanisms and taxonomies; (2) a pass on benchmarks, failure modes and safety; (3) primary industry sources for every major coding agent and memory platform; (4) a human-in-the-loop and governance pass that also re-verified the earlier hitl-memory-digest.md. Consensus (the connector, search mode) was the primary academic discovery channel — 60 queries logged in consensus/ — with arXiv abstract pages fetched for every number. A separate adversarial verification agent re-fetched 112 of the records (every low/medium-confidence record, every number quoted in the memos, plus a random 30): 100 confirmed, 8 minor metadata fixes (applied), 2 numbers not found on the page, 2 FSE-AIWare challenge papers unreachable behind the ACM DL, 0 fabricated. Final dataset: 283 records (198 academic, 62 industry, 24 open-source; 202 from 2026). Every record is coded on the workplan §2.1 scheme — scope / storage / write policy / validation / evidence — plus an hitl field.

The one-paragraph answer. The field has converged on a vocabulary (memory types × memory operations) and on one unifying idea — memory, skills and rules are the same artifact at different compression ratios [Noneexperience-compression-spectrum-2026] — but not on evidence. The best-controlled studies find that persistent memory does not raise coding-agent success rates by default: repository context files "do not generally improve task success" while adding >20% inference cost [Noneevaluating-agents-md-gloaguen-2026], random rules match expert-curated ones [Noneguardrails-beat-guidance-2026], 39 of 49 real SWE skills give zero gain [Noneswe-skills-bench-2026], and a pre-registered five-way memory comparison finds gains only when the new problem is a near-copy of a stored one [Nonegitofthoughts-2026]. What does move the number is validation of the write — a tested-before-accept gate turns "no better than no skills" into +48 points [Nonegrasp-gated-skill-proposer-2026], and MemOp's outcome-grounded acceptance gives +5.25 pp on SWE-bench Verified [Nonememop-closed-loop-memory-se-2026] — and delivery of the read: agents left to choose make zero voluntary memory operations in 114 turns [Nonecue-anchored-working-memory-harness-2026]. Industry has quietly reached the same conclusion from the other side: the only vendor with an A/B on a real SE outcome (GitHub, PR merge rate 83% → 90%) gates memories with citation checks and a 28-day expiry [Nonegithub-copilot-agentic-memory-engineering-post]; two vendors retrofitted per-memory human approval after shipping silent auto-memory [Nonecursor-memories-ga-changelog-1-2] [Noneaugment-memory-review-blog]; and one retired auto-memory in favour of human-authored skills [Nonedevin-desktop-cascade-memories-docs]. Nobody — in 283 records — has yet run the experiment that matters for a governance stance: human-ratified versus execution-validated memory promotion, head to head, on the same repository tasks.

1. Vocabulary: what the literature means by memory

Two axes are now near-universal. Types follow cognitive science — working, episodic (what happened), semantic (facts about the repo or world), procedural (how to do things) — with a substrate split between parametric, token-level and latent memory [Nonememory-age-ai-agents-2025] [Noneagent-memory-second-half-survey-2026] [Nonezhang-agent-memory-survey-2024]. Operations are the second axis: consolidation, updating, indexing, forgetting, retrieval, condensation [Nonedu-rethinking-memory-ops-2025], compressed to a write–manage–read loop [Nonedu-memory-autonomous-agents-survey-2026]; the skills literature independently arrives at an eight-stage lifecycle ending in governance [Nonesok-agentic-skills-2026] [Nonemanaging-procedural-memory-after-2026]. CoALA supplies the framing that a memory write is an internal action the agent chooses [Nonecoala-2023], which is why "who writes" is a design variable at all.

The organising idea this digest adopts is the Experience Compression Spectrum: episodic traces (5–20× compression), procedural skills (50–500×), declarative rules (1,000×+) are one artifact at different compression, and the two literatures that study them cite each other below 1% across 1,136 references [Noneexperience-compression-spectrum-2026]. Human review cost tracks the same axis: people realistically review rules and skills, not traces. A 2005 paper already called the thing a "project memory" [Nonehipikat-project-memory-2005]; the agent-native versions are [Nonememgpt-2023] [Nonegenerative-agents-2023] [Nonememorybank-2023] [Nonea-mem-2025] [Nonememos-paper-2025], and the SE-specific surveys and taxonomies are [Noneanatomy-agentic-memory-2026] [Noneexternalization-llm-agents-2026] [Noneis-agent-memory-a-database-2026].

Workplan §2.1 coding, applied. Across the 283 records, write policy is agent-initiated in 96, external-manager (a separate memory model or pipeline) in 58, human-authored in 42, human-approved in 23 and mixed in 20. Validation is coded none for the majority; tested-before-accept, judged, citation-check, expiry and process-review together cover fewer than a third. Evidence is dominated by single-benchmark results; controlled comparisons and field data are the minority. The hitl field is none for 113 records.

2. Where coding-agent memory lives and who writes it

2.1 Human-authored context files (the configuration surface)

CLAUDE.md, AGENTS.md, .cursor/rules, GEMINI.md, Kiro steering, Copilot instructions: declarative repo knowledge, written by people, read at session start. AGENTS.md is in ~60,000 repositories and is now stewarded by the Linux Foundation's Agentic AI Foundation [Noneaaif-formation-press-2025] [harness:agents-md-convention]. The mining studies are now numerous: 2,303 context files across 1,925 repositories evolve "like configuration code through frequent, small additions", prioritising test procedures (75.9%) and rarely security (14.8%) [Noneagent-readmes-context-files-2025]; 466 OSS projects show no established structure [Nonecontext-engineering-oss-agents-2025]; a 40,585-repository dataset covers five tools and eight configuration mechanisms [Noneagentic-config-dataset-galster-2026] [Noneconfiguring-agentic-ai-coding-tools-acm-2026]; Cursor-rules studies [Nonebeyond-the-prompt-cursor-rules-2025] [Nonecursorrules-github-study-2026]; a rule taxonomy finds 77.78% of edits are reactive error corrections [Nonerule-taxonomy-evolution-ai-ides-2026] [Nonehow-developers-maintain-agent-instructions-2026] [Noneevolution-context-gap-agent-manifests-2026]. Vendor docs describe the tiers (managed / user / project / local) and the /init proposal flow [harness:anthropic-claude-code-memory-docs] [Noneopenai-codex-agents-md-docs] [Nonecursor-rules-docs] [Nonekiro-steering-docs] [Nonegemini-cli-gemini-md-docs] [Nonegithub-copilot-custom-instructions-support-docs]; a 108k-line C# system was built on a hot-memory "constitution" plus a cold-memory knowledge base across 283 sessions [Nonecodified-context-infrastructure-2026].

2.2 Agent-written memory in products

Every major vendor now ships some form of agent-written persistent memory, and the designs differ exactly on the §2.1 axes:

Disclosure is bimodal: storage layout and scope are documented, efficacy almost never is. Exactly two products publish memory-on versus memory-off comparisons — GitHub's A/B (PR merge rate 90% vs 83%, review positive-feedback 77% vs 75%, p<0.00001) [Nonegithub-copilot-agentic-memory-engineering-post] and OpenHands' condenser (54% vs 53% on a SWE-bench Verified subset, up to 50% lower per-turn cost) [Noneopenhands-condenser-blog-2025] [Noneopenhands-condenser-sdk-docs]. Platform benchmark numbers are contested four ways on one benchmark: Mem0 claims +26% on LoCoMo [Nonemem0-paper-2025], Zep rescored itself 65.99% → 75.14% [Nonezep-mem0-locomo-critique-2025] [Nonezep-graphiti-paper-2025], Mem0's CTO disputes Zep's 84% at 58.44% [Nonezep-locomo-84-percent-revision-issue], Memori self-reports 87% [Nonememori-2026]; Mem0's own docs concede that of the three memory types it markets, "procedural memory is implemented, semantic and episodic are not" [Nonemem0-memory-types-docs].

2.3 Academic repo-memory systems

Single-episode and cross-episode memory on SWE-bench: MemOp validates a memory candidate only if re-running the agent with it makes no metric worse and at least one better — +5.25 pp success, +4.63 pp resolve efficiency, ≥9.79% cost reduction, markdown beating eight other representations [Nonememop-closed-loop-memory-se-2026]; subtask-aligned memory beats instance-level memory by +4.7 pp mean Pass@1 with gains growing with interaction length [Nonesubtask-level-memory-swe-2026]; MemCoder distils commit history into intent-to-code memory for +9.4% resolved over the base model [Nonememcoder-structured-memory-2026]; MemGovern converts 135K human GitHub experiences into governed cards [Nonememgovern-2026]; experience-driven repair [Noneswe-exp-2025] [Noneexperepair-2025]; repository knowledge graphs plus working memory [Noneprometheus-repo-memory-2025]; AST-guided session memory [Nonecodemem-ast-guided-memory-2026]; repository setup distilled into reusable knowledge [Nonebootstrapagent-2026]; automatically learned repo skills that take one benchmark from 79.3% to 100% and transfer across agents [Nonegskill-repo-skills-2026]; commit-derived knowledge layers [Nonecommitdistill-2026]; event-sourced, local-first project memory with a pre-action gate — "Memory-as-Governance" [Noneprojectmem-memory-as-governance-2026] [Noneesaa-conversational-memory-2026]; git as the memory substrate [Nonewhy-git-is-the-memory-solution-2026] [Nonegitofthoughts-2026] [harness:git-context-controller-2025]; decay-scored local memory layers [Nonecntx-local-agentic-memory-2026] [Nonebyterover-agent-native-memory-2026]; and shared selective memory, where full-history persistence degrades completion (71%) below no memory (79%) while selective memory reaches 96% [Noneshared-selective-persistent-memory-2026].

2.4 Procedural memory and self-evolving skills

Voyager, ExpeL, Agent Workflow Memory and ReasoningBank are the foundations [Nonevoyager-2023] [Noneexpel-2023] [Noneagent-workflow-memory-2024] [Nonereasoningbank-2025]; the 2026 wave is Memp, ReMe, MemSkill, SkillOS-style libraries, CodeSkill, Trace2Skill, WikiSkill, SkillWiki and the Agent Skills standard [Nonememp-procedural-memory-2025] [Nonereme-dynamic-procedural-memory-2025] [Nonememskill-2026] [Nonecodeskill-2026] [Nonetrace2skill-2026] [Nonewikiskill-2026] [Noneskillwiki-living-knowledge-2026] [Noneanthropic-agent-skills-overview-docs] [harness:anthropic-agent-skills]. The evidence here is the most negative in the dataset. SWE-Skills-Bench: 39 of 49 real skills yield zero improvement, mean +1.2%, up to +451% token overhead, three skills degrade performance up to −10% from version-mismatched guidance [Noneswe-skills-bench-2026]; skills do not help when environment feedback is rich [Nonewhen-skills-dont-help-2026]; LLM-authored skills add +0.0 pp against +16.2 pp for human-curated ones, and a governance recipe (outcome-driven retirement plus a bounded cap) lifts pass@1 from 0.258 to 0.584 [Nonelibrary-drift-2026]; the regression tax decomposes why skills help and hurt [Noneregression-tax-skills-2026]; degradation with library growth is skill shadowing (selection failure), not context overhead, up to −21% at 202 skills [Noneskill-shadowing-2026]; per-skill effects are task-conditional and cancel in aggregate [Noneassay-not-all-skills-help-2026]; 53% of reused skills are never modified after adoption — curation in practice is copy once, then accrete [Noneregistry-to-repository-agent-skills-2026]; and a live dispute: distilled abstractions transfer while raw traces induce negative transfer [Nonememory-transfer-learning-coding-2026] [Nonewhen-continual-learning-moves-to-memory-2026], yet raw-trajectory reuse frequently beats distilled skills [Noneskillevolbench-2026]. The gate is what works: GRASP takes gpt-oss-120b from 40.6% to 88.8% and its ablation shows skill writing without validation is no better than no skills [Nonegrasp-gated-skill-proposer-2026]; MSCE governs memory-to-skill co-evolution with evidence links [Nonemsce-memory-to-skills-2026]; SkillReducer optimises token cost [Noneskillreducer-2026]; and 26% of skills in the wild carry security vulnerabilities [Noneagent-skills-in-the-wild-security-2026].

2.5 Documentation as memory

A quieter thread treats generated documentation as the memory a coding agent reads: RepoAgent, CodeWiki (68.79% vs DeepWiki's 64.06%), RepoDoc's incremental knowledge-graph updates, ReadMe.LLM's LLM-oriented library docs, CIAO's standards-based architecture docs reviewed by 22 developers, agentic ADR generation, and Context-as-AI-Service [Nonerepoagent-repo-doc-generation-2024] [Nonecodewiki-holistic-repo-docs-2025] [Nonerepodoc-kg-incremental-docs-2026] [Nonereadme-llm-library-docs-2025] [Noneciao-code-in-architecture-out-2026] [Noneagenticakm-adr-2026] [Nonecontext-as-ai-service-2026]. The measured payoff is real: the best generated repository documentation improves SWE-Agent's issue-solving rate by 20.00% [Noneswd-bench-repo-documentation-qa-2026], and architecture documents plus implementation plans improve conformance and correctness [Nonecervantes-architecture-docs-implementation-plans-2026]. DeepWiki is the industry instance [Nonedevin-deepwiki-docs].

3. What has been measured

3.1 Does memory help? The controlled results

Human-written repo memory does not raise task success. Context files "do not generally improve task success rates" while raising inference cost by over 20% on average; instructions are followed, repository overviews are not helpful [Noneevaluating-agents-md-gloaguen-2026]. An equivalence test over 288 runs bounds the correctness effect at ≤10–15 pp [Nonedo-context-files-help-khatri-2026]. AGENTS.md is associated with Δ28.64% median runtime and Δ16.58% output tokens at comparable completion — an efficiency result, not a correctness one; the three studies measure different dependent variables and are compatible [Noneagents-md-efficiency-lulla-2026]. Across 679 rule files, 25,532 rules and >5,000 Claude Code runs, random rules match expert-curated rules (both +13.8 pp on a discriminative subset) and only rule polarity separates helpful from harmful: negative constraints help, positive directives hurt [Noneguardrails-beat-guidance-2026]. File size, position and adjacent-file conflict have no detectable effect across 1,650 sessions; the one real effect is within-session compliance decay of ~5.6% lower odds per generated function [Noneinstruction-adherence-config-files-mcmillan-2026]. How guidance is produced matters more than whether it exists: probe-tuned guidance reaches 33.0% versus 28.3% static and 25.5% unguided (p<0.001) [Noneprobe-and-refine-repository-guidance-2026]. Instructions compiled to executable checks lift compliance from 67.0% to 88.3% [Nonecontextcov-executable-constraints-2026] [Nonedeterministic-control-plane-agent-config-2026].

Machine-managed memory has larger measured numbers, with the gate doing the work: failure-gated hierarchical memory cuts pollution from 38% to 9% and degradation over five rounds from 20+ pp to 4 pp [Nonefailure-gated-hierarchical-memory-2026]; evidence-gated writing cuts pollution 67–70% [Noneevidence-gated-memory-writing-2026]; consistency gates and admission control [Noneconsistencygate-2026] [Noneadaptive-memory-admission-control-2026]; learned write-or-defer gates [Nonememreader-active-extraction-2026]; learned offline consolidation beats heuristics by 7 points with a 12× smaller bank [Noneauto-dreamer-2026], and sleep-time consolidation cuts tokens up to 38× [Nonelightmem-2025] [Nonesleep-time-compute-2025]. But dedicated memory systems also lose to baselines: naive in-context learning beats them on CL-Bench [Nonecl-bench-2026]; self-memory scores 42% against 47% for basic retrieval and swapping only the embedding model moves accuracy ±6.2 pp (p=0.004) — the memory analogue of the scaffold effect [Nonememdelta-2026] [harness:scaffold-effect-coding-agents-2026]; long context often beats structured memory on accuracy and only wins on cost after ≈10 turns at 100k [Nonememory-vs-long-context-cost-2026]; plain RAG matches Mem0 at 8.4× lower cost [Nonecost-accuracy-ltm-dmas-2026]. No representation dominates [Nonestructural-memory-llm-agents-2024]; memory helps only on near-copies (cosine >~0.8) [Nonegitofthoughts-2026]; markdown files with no vector or graph database reach the top of LoCoMo [Nonebyterover-agent-native-memory-2026]; schema-grounded write paths beat retrieval scale [Nonexmemory-schema-grounded-memory-2026] [Noneuser-as-code-executable-memory-2026].

Why the null results. Agents do not use the memory they are given: with a pre-seeded store, zero voluntary memory operations in 114 turns; conversation-only facts vanish at the first compaction and stay absent from 106 of 108 compactions, while harness-injected facts survive all 138 compact-resumes [Nonecue-anchored-working-memory-harness-2026]. Memory is a delivery problem before it is an authoring problem, which is also the finding of the harness store's compaction papers [harness:governance-decay-2026].

3.2 Benchmarks

General agent-memory benchmarks are plentiful and all allow memory to vary independently of the model: LoCoMo, LongMemEval and V2, MemoryAgentBench, MemBench, BEAM, StreamBench, Evo-Memory, EvoMemBench, MemoryArena, AMA-Bench, Memora/FAMA (the only one that penalises reliance on stale memory), MEMPROBE, MemTrace, DynamicMem, MemOps, MemoryRewardBench, episodic-memory benchmarks, AgingBench [Nonelocomo-2024] [Nonelongmemeval-2024] [Nonelongmemeval-v2-2026] [Nonememoryagentbench-2025] [Nonemembench-2025] [Nonebeam-light-2025] [Nonestreambench-2024] [Noneevo-memory-2025] [Noneevomembench-2026] [Nonememoryarena-2026] [Noneama-bench-2026] [Nonememora-fama-2026] [Nonememprobe-2026] [Nonememtrace-2026] [Nonedynamicmem-2026] [Nonememops-2026] [Nonememoryrewardbench-2026] [Noneepisodic-memory-bench-2025] [Noneagingbench-2026] [Noneground-truth-first-memory-evaluation-2026]. MemGym is the only one with memory-isolated scores across agentic regimes, and its coding track is synthetic QA over SWE-Gym, not issue resolution [Nonememgym-2026].

Repository memory across sessions is measured by four artefacts only: SWE-Bench-CL (chronological SWE-bench Verified, contamination-exposed) [Noneswe-bench-cl-2025]; SWE-ContextBench (reuse across related issues in 51 repos, 9 languages) [Noneswe-contextbench-2026]; MemOp's cross-episode split [Nonememop-closed-loop-memory-se-2026]; and the FSE-AIWare MemComp track — sequential 8×25 SWE-Bench Pro with memory carried in commit order, where TwinMem-Agent reports 89.1% vs 60.0% at ~18× lower cost and Exp-SWE-Agent 42.7% → 47.5% (both behind the ACM paywall and unverified) [Nonetwinmem-agent-2026] [Noneexp-swe-agent-memcomp-2026]. Learning-to-Commit's held-out-future-PR protocol is the strictest chronological design [Nonelearning-to-commit-orm-2026]. Continual-learning benchmarks with SE tracks exist [Nonecl-bench-2026] [Noneagentcl-2026]; the long-horizon SE proxies are in the harness store [harness:swe-evo] [harness:swe-bench-pro] [harness:swe-explore-2026].

3.3 Failure modes, with numbers

Final-answer accuracy masks memory failure: task completion nearly saturates even for a memoryless baseline while memory recovery sits at ~0.6 [Nonememprobe-2026]; evidence is retrievable 10× more often than missing [Nonememtrace-2026]; profile quality decays while task accuracy stays flat [Nonedynamicmem-2026] [Nonememops-2026]. Staleness: the best model reaches only 55.2% on implicit-conflict scenarios [Nonestale-benchmark-2026]; Graphiti's temporal F1 on LoCoMo is 0.0295 [Noneatma-ghost-memory-2026] [Nonememconflict-2026]; stale code references sit in 23.0% of 356 representative repositories [Nonecontext-rot-config-artifacts-2026]; stale-only retrieval induces obsolete helper references on 15/17 samples [Nonestale-repo-context-retrieval-hurts-2026]. Bloat: across 247,694 instruction lifetimes in 1,867 repositories, CLAUDE.md-style prompts grow +226% over their lifetime, with deletion hazard falling as lines age [Nonecatastrophic-remembering-claude-md-2026]; Context Bloat in 42%, Lint Leakage in 62% of sampled configuration files [Noneconfiguration-smells-agents-md-2026]; adding only irrelevant sessions costs 16–20 pp of budget-compliant reliability [Nonescale-conditioned-memory-eval-2026]. Pollution and hallucination: naive summarisation yields a 38% long-term-memory pollution rate [Nonefailure-gated-hierarchical-memory-2026]; hallucinations are generated at extraction and update time and propagate [Nonehalumem-2025]; ungated episode injection degrades good answers [Nonerscb-mc-memory-controller-2026]; surface similarity in stack traces triggers unsafe memory injection in coding agents [Nonerscb-mc-memory-controller-2026]; experience-following memory management is a double-edged sword [Noneexperience-following-memory-management-2025]. Forgetting is essentially unimplemented in coding harnesses — MemoryAgentBench treats it as a core competency and FSFM supplies decay [Nonefsfm-selective-forgetting-2026], but no surveyed coding-agent memory retires entries except Copilot's 28-day clock. Cost: re-establishing project context is estimated at 5,000–20,000 tokens per session [Noneprojectmem-memory-as-governance-2026]; independent accounting of the write path is rare [Noneagent-memory-systems-characterization-2026]; run-to-run variance for memory-augmented SE agents is unmeasured (the nearest evidence is up-to-30× token variation on the same task in the harness store [harness:token-consumption-agentic-coding-2026]).

3.4 Security and privacy

Writable cross-session memory is a first-class attack surface with its own lifecycle threat model [Noneltm-security-survey-governance-2026]. Query-only injection [Noneminja-2025]; >80% attack success at <0.1% poison rate [Noneagentpoison-2024]; poisoned experience stores that compromise a code-writing agent [Nonememorygraft-2025]; environment-injected poisoning with up to 32.5% cross-site compromise and 8× susceptibility when agents are "frustrated" [Noneetamp-web-agents-2026]; sleeper writes succeeding up to 99.8% with 60–89% of retrievals producing attacker-intended actions [Nonesleeper-memory-poisoning-2026]; persistence of prompt injection across sessions [Nonecross-session-stored-prompt-injection-2026] [Nonezombie-agents-self-reinforcing-injection-2026] [Nonewhen-claws-remember-whisperbench-2026]. For coding harnesses specifically, planted payloads in memory files reliably attack future Claude Code and Codex sessions [Nonebad-memory-prompt-injection-memory-files-2026], and ClawTrojan reaches 95.5% attack success in a workspace where single-turn injection is near zero [Noneclawtrojan-dasguard-2026]; agents accumulate security debt [Nonetrust-but-verify-security-debt-agents-2026] and instructional text induces private-data leakage [Noneinstructional-text-private-data-leakage-readsecbench-2026] [Nonetrojan-hippo-2026]. Defences: storage prevention is insufficient — malicious instructions are stored at >97.5% but executed 0–95% with no correlation, and only a tool-layer sandbox reaches 0% [Noneinjection-execution-dissociation-2026] [Nonememory-poisoning-systematic-study-mpbench-2026] [Nonememory-poisoning-defense-ehr-2026]; write-time origin binding is necessary because content and lineage defences lose to laundering (up to 68%), and the agent's own summarisation is a laundering channel — the direct link from compaction to integrity loss [Nonetma-nm-2026] [Nonememlineage-2026] [Nonememgate-trustworthy-memory-search-2026] [Nonememaudit-posthoc-memory-auditing-2026]. Privacy: black-box extraction of private memory [Nonemextra-privacy-2025]; no method achieves utility, access control and reliable forgetting at once [Nonegatemem-benchmark-2026]; provenance-scoped multi-principal tiers [Nonecollaborative-memory-access-control-2025]; parameter-only unlearning leaves memory backflow [Noneagentic-unlearning-sbu-2026]; runtime obligations under the EU AI Act and GDPR [Nonefrom-rights-to-runtime-privacy-agentic-2025] [Noneai-agents-under-eu-law-2026] [Noneruntime-compliance-verification-agents-2026] [Noneagentriskbom-2026]. Audits of shipped products: 96% of 2,050 ChatGPT memories are created unilaterally, 28% contain GDPR-defined personal data [Nonealgorithmic-self-portrait-2026] [Nonerelational-gains-privacy-strains-chatgpt-memory-2026].

4. Humans in the loop

4.1 Who writes × when × validation

4.2 What human review buys, and what it costs

The strongest positive result for human-verified memory is VerificAgent: expert-curated seed plus post-hoc human fact-checking, where 21.6% of injected adversarial memories passed automated filters and 0% passed human review, with AI-assisted review at ~8.4 s per entry — but the widely quoted 111.1% relative improvement appears only in the paper's v1 abstract, not v3 [Noneverificagent-2025]. The strongest negative result is GovMem: dependency-aware promotion cuts false promotion from 0.597 to 0.040, but at 0.692 review burden and 0.448 recall, and in the one study that put real coding-agent memory candidates in front of human adjudicators, none of 133 high-impact candidates was judged safe for automatic promotion and all 11 verification-gate positives were rejected as boilerplate or non-reusable [Nonegovmem-when-not-to-write-memory-2026]. Review is also a weak gate on its own terms: reviewers only moderately agree on what is risky (Fleiss' κ = 0.52) and realised safety is an inverted-U in escalation rate — more oversight can make a system less safe [Noneoversight-has-a-capacity-2026]; 94% of over 100 developers failed to detect deliberate agent sabotage over a ~5-hour task, and 56% accepted malicious code despite a monitor's warning [Nonecoding-with-enemy-sabotage-detection-2026]; the approval dialog itself is narrated by the agent and therefore forgeable, so consent integrity requires a trusted mediator [Noneconsent-integrity-what-you-approve-2026]; "stop" instructions are not reliably enforced [Nonestop-means-stop-enforcement-gap-2026]. Developer interviews find four emergent forms of oversight work — a priori control, co-planning, real-time monitoring, post hoc review — with memory and rules files as the a-priori instrument [Nonehuman-oversight-agentic-systems-practice-2026] [Nonehedwig-dynamic-autonomy-2026] [Nonehuman-ai-synergy-agentic-code-review-2026] [Nonegoverned-ai-assisted-engineering-gaie-2026]; the conceptual frame is operative versus evaluative agency and the solve–verify asymmetry [Nonezhu-designing-meaningful-human-oversight-2026], and SE's trust vocabulary is immature enough that "trust" usually just means acceptance [Nonebaltes-rethink-trust-ai-assistants-se-2026].

HCI on AI memory: users hold incomplete mental models of what agents remember and want category-scoped organisation and access control [Noneusers-expectations-practices-agent-memory-2025] [Noneusers-privacy-perceptions-rag-memory-2025] [Noneusable-privacy-respecting-ltm-2026]; most ChatGPT-memory interviewees suffered negative expectancy violations on first seeing their stored memories [Nonerelational-gains-privacy-strains-chatgpt-memory-2026]; MemoAnalyzer is the one controlled demonstration that a review UI improves privacy awareness at no speed cost [Noneghost-of-the-past-memoanalyzer-2024]; Memory Sandbox is the HCI precedent [Nonememory-sandbox-2023]; when editing rules-style specs, half of participants adopted flag-conflicts-then-resolve-locally over global AI revision and felt more control without more workload [Nonesemantic-commit-intent-specifications-2025]; staged-then-committed file writes gave self-correction on 8/11 hidden-side-effect tasks with fewer interactions on routine ones [Noneyolofs-agent-native-filesystem-2026]; and developers in the wild already externalise plans into persistent artifacts and negotiate autonomy through context injection [Noneprogramming-by-chat-ide-sessions-2026] [Nonegood-vibrations-vibe-coding-trust-2025] [Nonevibe-coding-sarkar-2025] [Nonebuilding-software-rolling-dice-2025] [Nonecontext-before-code-vibe-coding-2026] [Nonecognitive-intent-debt-storey-2026] [Nonesensemaking-multi-agent-transparency-2026].

4.3 The vendor trend line

Two vendors retrofitted per-memory approval after shipping silent auto-memory — Cursor 1.2 "introduced user approvals for background-generated memories to preserve trust" [Nonecursor-memories-ga-changelog-1-2], Augment shipped Approve/Edit/Discard [Noneaugment-memory-review-blog] — and one retired auto-memory entirely in favour of human-authored skills [Nonedevin-desktop-cascade-memories-docs]. Anthropic's Dreams API leaves the input store unmodified and makes review-before-adopt the default [Noneanthropic-managed-agents-dreams-docs]; OpenAI tells users to keep required guidance in AGENTS.md and treat memories as "a helpful recall layer" [Noneopenai-codex-memories-docs]; GitHub couples writes to write permission and reads to read permission [Nonegithub-copilot-memory-concepts-docs]. The memorywire survey finds that no major memory framework ships a review surface before long-term storage [Nonememorywire-2026]. That is the strongest available signal that unapproved agent-written memory is not yet trusted in production — and it is a governance signal, not a performance one.

5. Gaps

1. No head-to-head of human-ratified versus execution-validated memory promotion on the same repository tasks. GovMem says humans reject nearly everything; GRASP, MemOp and Probe-and-Refine say tests accept and help. This is the experiment the memory track is best placed to run.
2. Repository memory across sessions is barely measured — four artefacts, two of them paywalled and unverified, one contamination-exposed. Nothing offers memory-isolated scores on issue resolution.
3. No staleness metric for repo memory. FAMA exists for conversation; nothing penalises a coding agent for relying on a fact invalidated by an intervening commit, despite the 15/17 stale-retrieval result and 23.0% context rot.
4. Forgetting and revocation are unimplemented. Only Copilot's 28-day clock ships; no system achieves utility, access control and forgetting together; the EU-law analysis makes provenance a compliance requirement.
5. Compaction and persistent memory do not intersect in the literature, though governance decay, origin-binding and the cue-anchored study all show compaction is where memory integrity is lost.
6. Cost and reliability of memory-augmented SE agents are unaccounted: no paper separates memory-read/write tokens from task tokens; no run-to-run variance study varies memory.
7. Multi-principal repository memory — who owns a fact written by one contributor's agent — has no SE evaluation.
8. The memory-bank pattern has no peer-reviewed study. Cline / Constellize-style six-file banks are used widely and measured nowhere; the artifact corpora to study them now exist.

6. Notes for soa-agentic-se

• The §2.1 scheme codes cleanly onto the dataset; sources.csv carries scope / storage / write_policy / validation / evidence / hitl as columns and is the seed for data/memory-methods.csv. The benchmark table in §3.2 seeds data/memory-benchmarks.csv.
• For D2 (benchmark reuse), the four cross-session SE artefacts are the candidates; SWE-ContextBench and the MemComp protocol (sequential SWE-Bench Pro) are the two that hold model fixed and vary memory.
• For the pilot's memory factor, the cue-anchored result argues for harness-delivered memory as the treatment (not a memory file the agent may or may not read), and Copilot's citation-check plus expiry is the only shipped validation design to mirror.
• For the governance angle (§2.5 of the workplan), the answer to "does human-authored persistent memory function as a governance mechanism?" is: as a liability-and-trust mechanism, yes — every vendor that moved did so toward human approval; as a performance mechanism, the controlled evidence says no. That distinction is the chapter's contribution.
• Numbers corrected during verification and now wrong in hitl-memory-digest.md: MemOp's "−12.5 pp action-level" figure is not in the paper; VerificAgent's 111.1% is version-specific; Gloaguen is a cost increase not a success decrease; Lulla's deltas are median runtime and output tokens; Zhang's +13.8 pp is on a discriminative subset and applies to both arms; GovMem's primary source is arXiv:2607.02579.