Retrieval and memory techniques: one hundred and four mechanisms, one page.

Earlier count-based ranking treated term frequency linearly, so a page repeating a word fifty times scored roughly fifty times higher than a page mentioning it once, and padding or boilerplate outranked genuine matches. Document length was unhandled as well: a long document accumulated matches simply by being long. Ranking needed a scoring function in which additional repetitions and additional length both stop paying off.

It can only reward words the query and the document literally share, so a passage that answers the question in different words scores zero and word order and meaning are ignored entirely. Its saturation and length knobs are corpus-dependent, and the scores they produce are comparable only inside one collection, never across two.

Lexical scoring can only count terms the two texts happen to share, so a passage that answers the question in different words scores zero — no tuning of the saturation or length parameters closes a vocabulary gap. Earlier attempts to replace term matching with dense vectors generally lost to strong lexical baselines, leaving open whether a learned dense representation could beat term matching on retrieval accuracy at all.

Everything a passage says must survive compression into one fixed-width vector with no token-level comparison against the query, so exact names, version strings, part numbers and rare identifiers blur together. It also needs supervised question-passage training pairs, transfers poorly to domains unlike the ones it was trained on — where lexical matching often wins back — and any change to the encoder means re-embedding the entire corpus.

A dual encoder emits one vector at one fixed width, chosen once at training time for the hardest case, and that width is then paid on every stored vector, every distance computation and every byte of index memory — including for queries a much coarser vector would have answered. Getting a cheaper index meant training a second, smaller model or applying post-hoc dimensionality reduction that degrades accuracy. One representation could not serve both a cheap first pass and an accurate final one.

The nesting has to be trained in — truncating an ordinary embedding is a different operation and degrades it sharply — so this is a property of the model you picked, not a switch you can flip on the one you already have. And a short prefix genuinely is weaker than the full vector, so the cheap sweep only holds up when full-width vectors are still kept somewhere for the rerank pass, which brings back much of the storage the truncation was meant to save.

A dual encoder embeds the question and the passage with the same weights, though one asks and one tells. Models trained with role markers learn to place the two appropriately; without the marker at inference they are handed an input distribution they were not trained on.

It is a property of the specific embedder, not a general improvement. Measured here: prefixes help the model trained with them and actively hurt models that never saw them, particularly on short text — so this is a per-model calibration, and applying it blind is as likely to cost as to gain.

Lexical retrieval cannot match a paraphrase; a pooled embedding cannot preserve an exact identifier. Each is a hard failure on the other’s home ground, and neither degrades gracefully into the other. Replacing one with the other therefore trades one blind spot for another rather than removing either.

Two indexes to build, two to keep current, and a fusion step whose behaviour depends on both. It also cannot fix a query that neither channel can serve. On this system it is nonetheless the configuration that measured best on rank-sensitive retrieval at full scale — every additional rung layered above it either tied it or cost accuracy.

Finding the nearest embeddings to a query by brute force costs one distance computation per stored vector — O(n) per query, which at 10k+ vectors dominates retrieval latency and at millions is hopeless. HNSW replaces that full scan with a navigable graph walk that touches only a few hundred nodes, giving roughly O(log n) hops at the cost of being approximate rather than exact. The naive alternative in this repo is still present as the fallback: `MemoryStore::vector_search` degrades to loading every embedded row and cosine-scoring all of them.

Approximate by construction: recall is a tunable, not a guarantee, and the greedy walk can miss a true neighbour that sits behind a graph bottleneck — recall degrades as the corpus grows unless ef_search is raised, which trades latency back. The graph must be resident (RAM or mmap) and carries a per-vector edge overhead of roughly M*2 links on top of the vectors themselves, so memory grows linearly with n and there is no cheap on-disk-only mode. Deletion is a tombstone, not a repair: removed nodes leave dangling structure that fragments traversal until a compaction/rebuild (tracked here as `fragmentation_ratio`, ann_index.rs:773). Inserts are relatively expensive (each one runs its own ef_construction-wide search), and the index cannot apply attribute filters during traversal — any predicate must be applied after the k results come back, so a highly selective filter can return almost nothing.

The corpus is partitioned into 15 shards (3 memory tiers x 5 cognitive kinds), each with its own ANN index. Without a router, every query must open and search all 15 indexes and merge 15 ranked lists, so cost scales with shard count rather than with relevance — even though for a typical query almost all shards contain nothing near the query vector. The router replaces that fan-out with one search over a ~175-vector index that predicts the 2-3 shards worth probing.

It is lossy pruning with no downstream recovery: any shard not selected contributes zero candidates, so a true nearest neighbour living in an unselected shard is silently lost — no error, just missing recall. The "centroids" are not k-means centroids either; they are a deterministic every-100th-vector sample tagged by source shard, so a small or oddly-distributed shard can be under-sampled and never win a vote (the repo's own live router has just 2 centroids for long__judgment vs 109 for long__semantic). Because top-p is over centroids, not shards, dedup can return fewer shards than intended. And the pruning assumes each selected shard actually has a searchable index: the disk IVF-PQ path had to abandon routing entirely and probe all 15 shards (store.rs:8695-8703) after the router picked [procedural, episodic] while the only IVF-PQ index lived in semantic, producing R@10 = 0.

Exact nearest-neighbour search compares the query against every stored vector at full precision: at 1M docs x 768 float32 dims that is ~3 GB resident and ~768M multiply-adds per query. IVF-PQ attacks both costs at once — an inverted file skips most of the corpus (only nprobe of nlist cells are visited), and product quantization replaces each float vector with a handful of centroid IDs (768 floats = 3072 B becomes ~96 B), so the surviving candidates are scored by table lookup instead of arithmetic. The price is that both the skipping and the compression are lossy, so results are approximate.

Doubly lossy, and the two losses compound. A true neighbour sitting in a cell that nprobe did not open is unrecoverable at any later stage — the recall ceiling is fixed by nprobe/nlist, not by re-ranking — and PQ codes discard the residual detail, so distances within an opened cell are only approximate and near-ties get mis-ordered. It also needs an offline training pass over a sample (this implementation caps at 100k vectors, 20 Lloyd iterations) and has no cheap incremental insert: as the corpus drifts away from the trained centroids, cells go lopsided and recall decays until the whole index is retrained and re-encoded. Finally the embedding dim must be divisible by pq_m, which constrains parameter choice (build errors out otherwise).

In-memory graph indexes like HNSW and NSG reach a good neighbourhood in a handful of hops, but the entire graph plus every full-precision vector has to be resident in DRAM — at billion scale that is hundreds of gigabytes, so one machine holds only a slice of the corpus and the index must be sharded across a cluster. The alternative that did fit in RAM was to quantize every vector hard enough to shrink the index, which discards exactly the precision needed to separate a true nearest neighbour from a near-miss, capping recall. Neither option delivered high recall at billion scale on a single node.

Every expansion round is an SSD round trip and each hop depends on the previous one, so latency is set by disk seeks rather than compute and the drive idles between rounds — widening the beam buys recall by spending more I/O per query. Navigation still runs on lossy codes, so reranking can only reorder what the walk actually visited, and the on-disk layout is a static build: inserts and deletes need a rebuild or a separate merge process.

A million 768-dim float32 embeddings are ~3 GB, so an exact scan is memory-bandwidth-bound and cannot stay resident. Classic binary/product quantization shrinks that 32x but gives a biased, unbounded distance estimate — you only find out it mis-ranked by re-reading the full vectors, so systems over-fetch a large candidate pool "just in case". RaBitQ makes the estimate provably unbiased with a concentration bound per vector, so the search can prune on a real interval instead of a heuristic pool multiplier.

The guarantee is probabilistic and dimension-dependent: the estimator is unbiased with error concentrating as O(1/sqrt(D)), so it is excellent at 768+ dims and weak in low dimension, and it bounds the estimate rather than eliminating error. Getting exact top-k still requires reranking survivors against full-precision vectors, so the original floats must remain on disk — the saving is on the hot in-memory index, not on total storage. The random rotation costs O(D log D) per query and destroys coordinate sparsity and interpretability, and the per-vector factors add roughly one to two floats of overhead per vector, which is material at B=1 where the code itself is only D bits. Finally it compresses each vector but does not reduce how many vectors are scanned, so it must be layered on IVF or HNSW to avoid a full scan.

A 768-dim float32 embedding costs 3 KB, so a million-memory corpus needs ~3 GB of RAM just to hold vectors the brute-force scorer must touch on every query. Keeping them as f32 makes the index bigger than the machine's cache and often bigger than its memory budget. TurboQuant shrinks each vector 16x (4-bit) or 32x (2-bit) so the whole index stays resident and each comparison reads bytes instead of floats — trading a few points of recall for the memory footprint.

It compresses the comparison, not the candidate set: search still dequantizes and dots every live entry, so query cost stays O(N x dims) — this is a memory-footprint win, not an ANN speedup, and it has no graph or inverted-list pruning. Quantization is lossy (documented as roughly 97% recall@10 at 4-bit and 93% at 2-bit, and those figures are inherited from upstream, not measured here). Because the codebook is learned online, the +/-3-sigma bounds shift with every insert while already-packed codes are never re-encoded, so old entries are decoded against newer bounds and accuracy silently drifts until the index is rebuilt. The FWHT also pads to the next power of two and then truncates back to `dims` (1024 -> 768 for a typical embedding), which discards part of the transform and makes the rotation non-orthogonal at non-power-of-two dimensionality.

Vector search scores a passage by how similar it is to the query, which breaks on questions whose answer spans two facts. The bridging fact — that the company she works for was acquired by someone else — is not topically similar to the question that needs it, so it never enters the top-k. And a similarity index returns text, not composable relations: nothing it stores says how two retrieved passages connect, so there is nothing to chain.

The graph has to be built and kept true, and traversal amplifies errors rather than tolerating them: one hallucinated edge or one unresolved duplicate entity yields a wrong answer that arrives with a convincing derivation attached. The relation vocabulary is also fixed before the questions are asked, so a fact the schema has no type for is invisible to the walk no matter how plainly the source text stated it — and because branching grows with each hop, real systems cap depth and prune, silently discarding the longest derivations.

Typed-edge traversal only works when the question hands you somewhere to start. Ask something about the corpus as a whole — what themes run through it, how two bodies of work relate — and there is no entity to anchor to and no single path that constitutes the answer, because the answer is a property of the collection rather than of any node in it. Plain top-k retrieval fails the same question for the same reason: no chunk contains the answer, so retrieving the best chunks retrieves nothing useful.

The hierarchy is a precomputation, not a lookup: an LLM call per chunk to extract entities and relations, plus a generated summary for every community at every level, all of which must be rebuilt or incrementally patched whenever the corpus changes. And a global query is not one retrieval but one LLM call per community summary in the map stage, so answer cost scales with the size of the partition rather than with the question — while the partition itself was computed without knowing the question, so a query that cuts across communities is answered from summaries written for another purpose, and detail already compressed out of a summary cannot be recovered at query time.

Self-critique tells the system its evidence is bad but leaves it nowhere better to go: the corpus is static, so once every retrieved document is marked irrelevant the only moves left are answering from parametric memory or abstaining. It also grades at whole-document granularity, so a document judged relevant enters the prompt with all its surrounding irrelevant text attached, diluting the signal it was retrieved for. And it needs the generator itself instruction-tuned to produce the critique, which is not available for an off-the-shelf model.

Everything hinges on a small external evaluator that must be fine-tuned, plus two thresholds set empirically and re-tuned per dataset — and a misgrade propagates silently in both directions: a bad set labelled Correct gets refined and handed over as if trustworthy, while a good set labelled Incorrect triggers a needless web round trip. The corrective fallback also trades a curated corpus for the open web, adding latency, per-query cost, an external dependency and unvetted content, and nothing in the loop checks the finished answer against the evidence that produced it.

RAG's retrieval step compares the query's vector directly against document vectors, but a short question and the long passage that answers it share almost no surface form, so their embeddings are not naturally close. The usual fix is supervised relevance labels that teach an encoder the query-to-document mapping — labels a fresh corpus, a niche domain, or a new language does not have. Without them, zero-shot dense retrieval lands in the wrong neighbourhood.

It spends a full language-model generation before retrieval even begins, so every query pays that latency and cost. It also assumes the model can plausibly imagine the shape of the answer: for a private corpus, an unfamiliar entity, or in-house jargon it has never seen, the invented passage drags the search vector into the wrong region and retrieval gets worse than simply searching with the plain query. The false details are filtered only by the embedding bottleneck, which is a soft filter, not a guarantee.

Neither retrieval channel is sufficient alone — lexical search misses paraphrase, dense search misses exact identifiers, version strings and part numbers — so you want both lists. But their scores are not comparable: BM25 is unbounded and corpus-dependent while cosine similarity sits in its own range with its own distribution, so score-based fusion needs a normalisation that must be re-tuned per corpus and that one blown-up score can dominate. Learning fusion weights instead requires training labels.

Throwing away the scores throws away confidence: a retriever that is emphatically certain counts for exactly as much as one that is nearly indifferent, and every list carries equal weight unless you re-introduce weights by hand. The k = 60 constant is the value used in the original experiments rather than something derived from your data, and it flattens the top of each list, so one system that is uniquely right about a hard query can be outvoted by two that agree and are wrong. Documents that fell past a list's cutoff contribute nothing, which quietly makes the result depend on how deep each list was taken.

Every step up to here scores each document independently against the query, so nothing stops the top of the list filling with passages that say the same thing. When only a handful of slots reach the context window, near-duplicates spend them: the second, third and fourth results add almost no new information, and the other facets of the question never appear at all.

It is greedy and myopic: each slot is filled locally and never revisited, so the chosen set is not the best set. The penalty is blind to why two passages resemble each other, so when the correct evidence genuinely is repeated — corroborating sources, or several golds restating one fact — MMR evicts exactly the passages the answer needed and diversity actively costs accuracy. Lambda is a hand-set constant with no principled per-query value, and the pairwise comparisons add work on top of plain ranking.

Similarity ranks by resemblance, and resemblance is not answer-bearingness. The obvious fix is to have a model read each candidate against the query and reorder them, which is what every managed retrieval product added between 2024 and 2026. It is also the technique this system put on its <code>think</code> mode and then removed.

Measured negative on this system, twice, and the mechanism is understood rather than mysterious: the judge scores <em>topical relatedness</em>, so on a question with several gold passages it demotes the secondary golds that plain hybrid retrieval had already ranked correctly. 324 of LongMemEval-S’s 500 questions are multi-gold, so that failure dominates the average. It also costs a model call per candidate. Removed from <code>think</code>’s retrieval path on 2026-08-02; <code>think</code> and <code>chat</code> now call the same function and cannot produce different orderings.

Chunking at a fixed size cuts sentences away from their subject, so the chunk both retrieves badly and reads as a fragment when it does. Every downstream stage inherits the loss, and no reranker can restore context that was discarded at ingest.

All three cost at ingest. Contextual retrieval needs a model call per chunk; late chunking needs the whole document to fit the encoder’s window, which caps document size; parent-child resolution returns more tokens than it matched, spending context budget to buy coherence. On this system they are built but not benchmarked — recorded as such rather than claimed.

Plain RAG retrieves a fixed number of passages for every input, whether or not the question needs outside evidence, and pastes them into the prompt unconditionally. Nothing between the retriever and the reader asks whether a passage is relevant, and nothing afterwards asks whether the sentence just written is actually carried by that passage — so irrelevant context degrades the answer and a citation can be attached to a claim the cited text never made. The pipeline is equally fluent in both cases and emits no signal about which happened.

The reflection tokens have to be trained in — the generator is fine-tuned on a corpus that a separate critic model annotated offline — so this is not something you bolt onto a frozen or API-only model, and each segment now costs K parallel continuations plus a scoring pass instead of one forward pass. And the grader is the model grading itself at segment level: a "fully supported" tag is a prediction about the passage, not a check against it, so a segment carrying one fabrication among several correct statements can still clear the gate.

Self-critique tells the system its evidence is bad but leaves it nowhere better to go: the corpus is static, so once every retrieved document is marked irrelevant the only moves left are answering from parametric memory or abstaining. It also grades at whole-document granularity, so a document judged relevant enters the prompt with all its surrounding irrelevant text attached, diluting the signal it was retrieved for. And it needs the generator itself instruction-tuned to produce the critique, which is not available for an off-the-shelf model.

Everything hinges on a small external evaluator that must be fine-tuned, plus two thresholds set empirically and re-tuned per dataset — and a misgrade propagates silently in both directions: a bad set labelled Correct gets refined and handed over as if trustworthy, while a good set labelled Incorrect triggers a needless web round trip. The corrective fallback also trades a curated corpus for the open web, adding latency, per-query cost, an external dependency and unvetted content, and nothing in the loop checks the finished answer against the evidence that produced it.

A generator handed poor context still writes fluently. That is what turns a retrieval miss into a wrong answer delivered with the same confidence as a right one — the failure that makes RAG systems untrustworthy rather than merely imperfect.

The threshold is the whole design and cannot be derived. Too high and the system declines work it could have done; too low and abstaining stops carrying information. It also needs a support signal to threshold <em>on</em>, which is usually a judge — inheriting that judge’s failure modes.

Exact match, BLEU and ROUGE score surface overlap, so a correct answer in different words fails and a fluent wrong one passes. Once systems generate free text, the metric stops measuring the quality anyone cares about, and human grading does not scale to every run.

The judge is a model, so it inherits model failure modes and adds its own. Measured here: it scores correct recall as hallucination when the memory context is withheld from it, and reliability is not validity — a judge can agree with itself across runs while still not measuring what was intended. Partial coverage is the subtle one: scoring only some of a set is a <em>biased</em> sample, not a weak signal, and promoting those few over the rest measurably damaged results. The discipline that follows is fail-open — a judge may promote, never veto — plus a coverage floor.

A fixed context window with a rolling summary silently discards whatever falls off the end, and the eviction policy lives outside the model — it cannot say "keep this" or ask for a dropped turn back. Retrieval-augmented alternatives fetch once, before generation, on a query the pipeline chose; if that single fetch misses, the model has no second attempt and answers from what it happens to be holding. MemGPT's premise is that the model itself is the only component that knows what it is missing.

Every page-in and page-out is an LLM decision, so recall quality is capped by the model's function-calling reliability — the authors report sharply degraded behaviour on weaker models and note the agent often stops paging through retriever results before exhausting them. The bookkeeping also spends the user's own latency and token budget, since the agent pauses mid-conversation to edit memory, and an overwrite of an in-context block has no undo.

Archival memory from the previous stage stores each statement as an independent chunk, so when a fact changes — a user leaves one employer for another — the old and new statements sit side by side as equally retrievable neighbours, and the retriever ranks by similarity rather than by which one is still true. The usual fix, overwriting the record, destroys the ability to answer "what was true in March" and flattens a genuine change in the world into an error correction. Neither behaviour distinguishes when a fact was true from when the system happened to learn it.

Every write now costs LLM passes — entity extraction plus contradiction adjudication — so ingestion is far slower and more expensive than appending a chunk to a vector store, and any extraction slip becomes a first-class fact wearing an authoritative timestamp. Valid-from frequently has to be inferred when the source never states it, and because nothing is deleted the graph grows monotonically and every query must carry a time filter to stay correct.

In the single-agent paging design, one agent does both the conversation and the bookkeeping, so every memory edit is paid out of the user's reply time — which pushes edits toward the cheapest possible form: one line appended at the moment of overflow, never reorganized, until the block degrades into an append log. It also means any reasoning over the accumulated context is re-derived from scratch on every query, at exactly the moment the user is waiting.

The offline work only pays off when the questions that actually arrive are ones the pre-computation anticipated; the sleep-time compute paper ties the benefit directly to how predictable the query is from the context, and when it is not, those tokens buy nothing. It is also strictly more total compute, not less — you fund a second agent's inference on every batch of turns — and a wrong consolidation is now baked into a shared block the primary agent trusts and, in this architecture, cannot correct.

Stage 6 gave facts a validity interval, but it left open who decides which of two conflicting claims wins. Production systems already resolve this four ways — last-writer-wins, evidence-weighted merge, await-confirmation, per-rule policy — yet per TOKI none of them declares the isolation level it assumes or the write-time anomalies it admits, and the adjudicator is a language model sitting on the write path whose verdict is never logged under a key. The result is three concrete failures: you cannot replay how a belief was reached, the stored state drifts from what the audit trail implies, and the losing claim is destroyed outright.

This buys a correctness contract, not speed or accuracy: you pay an extra row per contradiction and a keyed log entry per adjudication, and the language-model judge stays on the write path, so writes get heavier exactly where volume is highest. The paper is explicit that its cross-system comparison is underpowered and claims no superiority, and the soundness results hold within a relational schedule model — what you get is a stated guarantee, not evidence that recall improves.

A dense bi-encoder pools an entire passage into a single fixed-length vector, so a rare identifier, a version string or the one term that actually mattered for this query is averaged away with everything else. The obvious fix — a cross-encoder that attends jointly over query and document — restores the fine-grained matching but has to run a full transformer pass for every query-document pair at search time, so it can only re-rank a shortlist somebody else produced. Neither option can search a corpus with token-level precision.

The index now holds a vector per token rather than per passage — roughly an order of magnitude more space, which ColBERTv2's centroid-plus-residual compression shrinks but does not remove — and retrieval needs a purpose-built engine that gathers candidates across token vectors before scoring, not one lookup in an ordinary vector database. It also requires an encoder that exposes per-token output, which most hosted and local embedding endpoints do not: they return one pooled vector per text.

The standard document-retrieval pipeline is a chain of lossy parsers — PDF extraction, OCR, layout detection, chunking, sometimes captioning — and the errors compound: tables lose their row and column structure, charts and diagrams become nothing or a bad caption, multi-column pages get interleaved into nonsense, and typography, position and every other visual cue carries no signal at all. The obvious alternative, one CLIP-style vector per page image, reintroduces exactly the single-vector bottleneck that late interaction was built to escape, on pages that are far denser than a passage.

Indexing is expensive at both ends: every page needs a full vision-language-model forward pass rather than a cheap text embedding, and it stores on the order of a thousand patch vectors per page, so the index is heavier than a text-token late-interaction index and most vector databases still have no native multi-vector support. Retrieval also returns a whole page, which means the downstream generator has to be able to read the page image, and anything too fine to survive the model's fixed input resolution is effectively invisible.

Late interaction buys its quality by searching over per-token vectors: every query token launches its own nearest-neighbour search, the hits have to be gathered per document and rescored, and the whole thing needs a specialised engine rather than a stock ANN library — so latency and index complexity scale with token count. The earlier reduction to single-vector search, MUVERA's fixed dimensional encodings, sidesteps the engine problem with a data-independent randomized space partition, but that encoding has to be very high-dimensional to preserve recall.

The document vectors are not something the encoder produces — each is fitted against a network trained over that specific corpus, so the index is corpus-bound: building it is a multi-stage offline job and adding documents later is awkward rather than a plain insert. And it is an estimate, so exact MaxSim reranking of the candidate list is still mandatory; wherever that rerank dominates the cost — image-patch documents with far more vectors each, for instance — the speedup narrows.

ColBERT-style late interaction scores a query against a document with Chamfer/MaxSim — every query token takes the max inner product over every document token, then those maxima are summed. That is not a single inner product, so it cannot ride a normal MIPS/ANN index: you either brute-force the full token matrix of every candidate (quadratic in tokens, linear in corpus) or run one ANN query per query token and stitch the results back together with a multi-stage gather-and-rescore engine like PLAID. MUVERA replaces both with a data-oblivious sketch: encode each token bag as ONE fixed-dimensional vector such that a plain dot product provably approximates Chamfer, so multi-vector retrieval becomes a single-vector ANN lookup plus an optional exact rerank.

The sketch buys single-vector indexing with dimensionality: the FDE is 2^k_sim x d_proj x r_reps floats (the paper operates around ~10k dims and then needs product quantization to be storable), so a document's single MUVERA vector can be an order of magnitude larger than its ordinary dense embedding. It is an approximation with real variance — accuracy is bought by raising r_reps and d_proj, and quality leans on re-ranking the ANN shortlist with exact MaxSim, so it reduces rather than eliminates the multi-vector scoring cost. The SimHash partition also degrades when a token bag is large and diverse relative to B buckets, and the empty-bucket fill is a heuristic that can attribute a document region a query token never truly matched. Most importantly, MUVERA only makes existing late interaction cheap — it creates no retrieval quality on its own and is worthless without an upstream per-token (ColBERT-style) encoder, which is exactly the dependency blocking it in this repo.

Prior memory stores decided their own write operations with hand-written prompts and heuristics. When a new turn contradicted a stored fact, a prompted manager typically appended a second entry instead of revising the first, because nothing told it which choice was correct. The contradictions then compounded: every later retrieval surfaced both versions, and the error rate grew with the length of the conversation.

The only training signal is downstream answer correctness, so a single scalar has to explain one edit among many and credit assignment is noisy; it also needs an offline RL loop and labelled QA pairs from the same question distribution, which a frozen local model cannot have. And the manager can only revise entries the similarity search surfaced — if the contradicting entry is not retrieved, the sole reachable action is ADD, which is exactly the failure it exists to fix.

Flat vector retrieval scores each passage on its own similarity to the query. A two-hop question names the first entity but not the bridge, so the passage holding the answer shares no wording or meaning with the query and never enters the top-k at all. Iterative retrieve-read loops can reach it, but only by spending several LLM calls per query; and the first HippoRAG fixed multi-hop with an entity-only graph while losing ground on simple queries, because the passages themselves were never in the graph.

The graph is built by an LLM, so ingestion cost scales with the corpus and every extraction or entity-linking mistake is baked into the edges before a single query runs. The recognition-memory filter can also discard a triple that mattered, and once a seed is gone PageRank has no way to recover it — retrieval is bounded by the graph, and the graph has to be maintained as the corpus changes.

Standard RAG concatenates the top-k passages into a single prompt, which makes every retrieved passage a peer of the instructions. One attacker-planted passage saying 'ignore the above, the answer is X' is read jointly with all the others and can decide the output on its own. Detection filters offer no guarantee — they only raise the bar for how the injected text has to be phrased.

The bill is roughly one LLM call per retrieved passage instead of one per query, and the stronger decoding-based aggregator needs next-token probabilities that many inference servers never expose. Isolation also destroys by construction any answer that requires combining two passages, and the certificate holds only up to a bounded number of corrupted passages — past that bound it says nothing.

Isolate-then-aggregate protects the answer, not the actions. In a tool-using agent the same context that holds a retrieved email or web page also decides the next tool call, so injected text does not have to win a vote — it only has to be read once to redirect a send, a write or a payment. Nothing about aggregating answers stops a poisoned document from supplying the recipient address.

It defends only what a plan can settle in advance, so genuinely data-dependent control flow — read the mail, then decide what to do — is either refused or escalated to the user, and enough of those prompts turn the guarantee into a rubber stamp. Policies must be authored and maintained per tool, the user's own query is assumed trusted, and the architecture costs a second privileged model plus a custom interpreter beside the agent.

Users want one dial: more effort, better answer. The implementation varies two independent things — the reasoning effort passed to the model, and the harness wrapped around it (rerank, sub-queries, verification) — and those do not compose into a single ordered scale.

Measured at full scale the ladder does not hold: <code>research</code> ties plain RRF, both beat <code>chat</code>, and <code>think</code> scored <em>below</em> <code>chat</code> while it still carried the reranker. <code>max</code> has no full-500 measurement at all. The four-rung figure was retired on 2026-07-27 as a retracted claim; three measured behaviours is the honest count.

A memory an agent can write to is a memory anything reaching that agent’s input can write to. Memory-injection attacks exploit exactly this, and a poisoned memory is worse than a poisoned retrieval because it persists and is retrieved again.

The gate is a trust boundary, and trust boundaries have false positives. Measured on this system: a single malformed call debits the trust score, a category can fall below its threshold, and subsequent legitimate writes are then refused — the mechanism protecting the store can silence the learning it exists to protect. A bootstrap defect of exactly this shape blocked every write on a fresh store until it was fixed.

Reranking every candidate is expensive and measured negative here. The alternative is to spend the model call only where it can change the outcome, and to check something more specific than “is this relevant” — a passage can be topically perfect and still not support the claim being made.

It is the slowest configuration measured by a wide margin — it issues many local-model generations per search, where chat and think issue none. Its accuracy advantage is recorded only on a 50-question slice that is 100 % single-session-user, which is favourable ground; at full scale it has never been measured. A confidence gate lets it decline to reorder, which is what keeps it from repeating the reranker’s failure.

The managed-infrastructure form of RAG in which the retrieval service plans the query, issues parallel subqueries and reranks the merged result instead of doing one vector lookup; Azure AI Search's agentic retrieval reached general availability in April 2026, and ApeRAG packages the same shape as an agentic GraphRAG platform on top of a modified LightRAG.

It trades latency and extra model calls per question for coverage, and it still emits no signal distinguishing a retrieval failure from a generation failure — the output is fluent either way.

A separate agent curates the memory store off the hot path — during idle time rather than mid-conversation — resolving contradictions and rewriting entries, so the store can get smaller and better instead of only larger. Letta's sleep-time compute and Hindsight's "Observations" process do the same job; the latter took first place on BEAM.

It buys review quality with idle compute and moves the write decision into a process no user observes, and in this system the stage is built with no consolidation-on against consolidation-off arm, so its retrieval effect is unmeasured.

Part of TerranSoul's Stage 6 corrective path alongside CRAG grading, hard abstain and read-path spotlighting: an answer is checked claim by claim against the retrieved evidence and takes the verdict of its weakest claim, so a single ungrounded claim cannot ride along on well-supported ones.

It is built, not benchmarked — no arm isolates the corrective loop and the four full-500 arms record zero abstentions — and per-claim checking multiplies judge calls while deliberately letting one unsupported claim condemn an otherwise grounded answer.

Corrective-RAG control implemented as tuned numeric cut-offs rather than model judgement: a retrieval-grader score above crag_ok = 0.7 accepts the retrieved set and below crag_bad = 0.4 rejects it, while τ_claim = 0.3 and τ_abstain = 0.3 decide per-claim support and when to refuse to answer. A published June-2026 pipeline shipped exactly these values around a verifier benchmarked on HaluBench.

The published low-hallucination operating point is bought by abstaining or rerouting more than half of all queries, and every threshold sits on a verifier only modestly better than chance, so the gate inherits a large share of the judge's error at any setting.

A learned encoder maps queries and documents into one vector space and relevance becomes cosine similarity between two points in it, so a paraphrase ranks near its source without any literal token match. The exact form scores the query against every stored vector.

The exact scan is linear in corpus size — a few million 768-dimension vectors put query time beyond any interactive budget — which is what forces approximate nearest-neighbour indexing.

Resolving mentions in a query to specific typed entities in a knowledge graph, so that entity disambiguation and multi-hop relational answers become exact rather than probabilistic and the answer carries its own derivation. It is the core Stage 4 argument for graph structure over pure similarity.

The exactness holds only for entities the graph actually contains and links correctly, so it trades an up-front extraction and curation pipeline for precision — and a mislinked or missing entity turns into a confidently wrong derivation.

An approximate-nearest-neighbour query restricted by a metadata predicate — "semantic search, but only in this tenant's documents" — so similarity ranking runs inside a filtered subset of the index.

Filtering degrades both recall and latency, making the combination harder than either the unfiltered vector search or the plain metadata query on its own.

A postings structure that maps every term to the documents that contain it, so a query touches only documents sharing a word with it instead of scanning the corpus. A statistical ranking function (TF-IDF, then BM25) then orders those documents by how unusual the matched terms are.

It trades semantic reach for exact-term matching: a document that expresses the same concept in different words is never a candidate at all, because it is not in any of the query's postings lists.

CRAG's retrieval-internal corrective branch: when the lightweight retrieval evaluator labels retrieved documents Correct, Incorrect or Ambiguous, the grade routes the query to knowledge refinement — cutting the retrieved documents down to the relevant parts and recomposing them — to a web-search fallback with query rewriting, or to both.

It can only re-cut what retrieval already returned, so it cannot recover a miss without the web-search branch, and the whole routing decision rests on a grader that is itself weak.

When a new fact contradicts a stored one, a language model rather than a fixed rule decides the outcome — which claim survives, which is updated, which is dropped. TerranSoul adopts Mem0's approach and applies it at the typed-edge layer during governed consolidation.

It puts a nondeterministic model judgement on the durable write path, and it is built but not benchmarked here — no consolidation-on against consolidation-off arm exists, so its effect on retrieval is unmeasured.

A learned approach to building memory itself — training what gets written and how it is structured — cited alongside Memory-R1's reinforcement-learned add / update / delete / noop management as part of the shift from hand-tuned write heuristics to learned ones.

Like Memory-R1 it is bought with training the local design cannot run, so it appears in this system only as a citation, on the excluded side of the frozen-model boundary.

A managed-RAG pattern in which a query planner splits one question into several retrievals issued concurrently, whose results are then merged and reranked. By 2026 it was standard in hosted agentic-retrieval infrastructure.

It multiplies retrieval calls and tokens per question and adds a planner that can decompose wrongly, and it still emits no signal distinguishing a retrieval failure from a generation failure.

An LLM judge scores each retrieved candidate on its own, and the scores reorder the candidate list. It is the reranking path the think rung ran before the reranker was taken off think's retrieval path.

Because each candidate is scored in isolation, a score threshold turns the reranker into a filter: on the prompt path it was handed a drop threshold and was deleting the secondary golds of multi-gold questions instead of demoting them, which is how a reorder-only stage moved recall at all.

The managed-retrieval pattern in which an incoming question is decomposed into subqueries that are issued in parallel and whose merged results are reranked, rather than being sent to the index as a single query. The page names it in passing as evidence that RAG had hardened into managed infrastructure by 2026.

Every planned subquery multiplies retrieval work and model calls for one turn, and it appears here as industry context — TerranSoul does not publish a measurement of retrieval-stage decomposition, which remains an open item for its research mode.

A CRAG-style grader sits between retrieval and generation and reads the retrieved set; the grade routes the query to grounding, to a rewrite-and-retry loop that reformulates and searches again, or to an abstention. It gives a retrieval failure somewhere to go other than a confident answer built on it.

It buys that escape hatch with an extra grading pass plus a whole second retrieval round-trip, and it inherits the grader's judgement — a mis-grade becomes a wasted retry or a wrongly withheld answer.

A grading step placed between retrieval and generation that reads the retrieved set and labels it, so the grade routes the query to grounding, to a rewrite-and-retry loop, or to an abstention. TerranSoul's Stage 6 adopts CRAG's retrieval-evaluator pattern for this role.

The loop is only as trustworthy as its own grader, which is weak, so grade-then-correct inherits a large share of the judge's error, and low hallucination rates are bought by abstaining or rerouting rather than by answering better.

A published method (Latent Terms) in which sparse autoencoders are trained over a frozen dense retriever and extract Zipfian vocabularies — term-like latent features that can be scored by BM25 over an ordinary inverted index, matching the dense model's own accuracy. It is cited as evidence that lexical machinery keeps resurfacing inside its successors rather than being replaced by them.

It matches the frozen retriever it was extracted from, so that model's accuracy is also its ceiling, and you still have to run the dense model plus an autoencoder to build the index you then serve lexically.

The first statistical ranking function over an inverted index: documents that share a term with the query are ordered by how unusual the matched terms are, so rare terms outweigh common ones. Okapi BM25 succeeded it at TREC-3 in 1994.

Matching is on the literal token and nothing is interpreted, so a document that expresses the query's meaning in different words is not retrieved at all.

One of CRAG's corrective actions: a lightweight retrieval evaluator labels the retrieved documents Correct, Incorrect or Ambiguous, and on a bad grade the pipeline rewrites the query and goes out to web search instead of, or alongside, refining what the local index returned.

It trades a governed local corpus for an ungoverned external one — network latency and dependency, plus un-vetted passages entering the context window.

The model the product actually ships with by default: a 27B Bonsai quantized to roughly one bit per weight so a large actor fits a local machine. Benchmarks deliberately do not use it — they hold a frozen gemma4:12b-it-qat actor fixed.

The published numbers therefore describe a different actor from the one users run; the frozen bench model is what makes a measured change attributable to memory and harness rather than to a model swap, at the price of never measuring the shipped default.

Access-control metadata carried on stored memories alongside provenance, typed edges and CRDT sync, so a governed write path can record and enforce who a memory belongs to and who may read it rather than treating the store as one flat pool.

Built, not benchmarked — no attack or access evaluation exists for it, and GateMem's trilemma says no current method delivers utility, access control and reliable forgetting at once, which stays open in this design as it does elsewhere.

A peer system in the agentmemory-corpus comparison that retrieves by having an agent run ripgrep over a markdown wiki, rather than by querying an index. It is charted against TerranSoul and the shared-embedder cluster on the same queries.

Literal pattern matching returns hits, not a ranking, so results depend on the agent guessing the right strings and it trails the indexed peers on early-precision recall while spending agent turns per query.

A per-turn classifier that resolves the Auto setting into one of the four thinking modes — chat, think, research, max — using the message plus recent-turn context, then stashes the resolved (reasoning-effort, harness) pair for that turn. It is shared by the desktop, CLI and MCP entrypoints so the same input routes the same way on every surface.

Every published benchmark arm pins a mode explicitly, so the router's dispatch accuracy has no number at all, and a mis-route silently changes both latency and retrieval quality with nothing measuring it.

Internal machinery of this system's graph layer: after the fused ranking is formed, it walks typed edges out from already-retrieved memories to pull in linked neighbours across rounds. It is built but default-off, and the bench harness only populates entity edges when LONGMEM_KG_EDGES=1.

Its one published measurement — 0.00 pp of R@10 at 2.04x the mean latency — was taken on an empty edge table, so it bought double the latency for nothing while proving nothing about a graph that is actually populated.

The design keeps one edge table — bitemporal, typed, confidence-weighted, CRDT-syncable, written by five different producers — with cascade-delete integrity, so deleting a memory removes the edges that reference it rather than leaving dangling rows.

Schema integrity is not evidence of use: the table it protects was empty for every published retrieval number, and a propagating delete can silently remove edges any of the five producers wrote.

An extension of ColPali, which does late interaction over page images: a vision-language model embeds a rendered document page directly and the query is scored token-against-token, so no OCR or layout parsing step sits in front of retrieval.

It is a per-token multi-vector retriever, so it needs exactly the per-token embedder this deployment excludes, and it carries the multi-vector index size that late interaction implies.

A governed consolidation stage modelled on fast-episodic / slow-semantic complementary learning systems, with FSRS spaced-repetition scheduling for reconsolidation, a nightly maintenance job, and LLM-arbitrated conflict resolution at the typed-edge layer.

It is built but not benchmarked — no consolidation-on against consolidation-off arm exists, so the retrieval effect of the entire stage is unmeasured, and nothing in it touches the utility / access-control / forgetting trilemma.

This system's graph layer is a single edge table whose rows are bitemporal, typed, confidence-weighted and CRDT-syncable with cascade-delete integrity, written by five producers, feeding a neighbour boost and an edge-degree activation multiplier on the default fused path.

On the one lane where retrieval numbers are published the edge table was empty — the harness only builds entity edges behind a flag that defaults off and appears in none of the arm reports — so edge degree was uniformly zero and the confidence weighting has never been exercised by a published number.

A poisoning-guard signal in TerranSoul's ingest path: it measures the incoming source's share of a bounded window of recent connector-authored rows and feeds that score to the write gate, so repeated re-ingestion from one origin — the MINJA persistence pattern of establishing a claim by repetition — raises the anomaly value. It is computed once per document, deliberately snapshotting the window before a document's own chunks are written so a large legitimate document cannot look concentrated against itself.

Built and pinned by regression tests but never benchmarked — there is no MINJA or PoisonedRAG run behind it — and it scores source concentration rather than content, so an injector that spreads the same claim across diverse origins does not trip it.

The middle step of this system's default RAG path over a single substrate: retrieved units are assembled into the prompt payload before generation, supported by contextual retrieval at ingest, late chunking, and parent-child resolution in which a matched sub-chunk resolves to its larger parent at query time.

It is only ever measured end-to-end as the mode's score — parent-child resolution, contextual retrieval and late chunking are built but never benchmarked in isolation, so the packing step's own contribution is unknown.

An internal guard on TerranSoul's judge rerank path: if the judge returns usable scores for less than a floor fraction of the candidate pool, the whole verdict is discarded and the base retrieval order is kept, so partial coverage cannot masquerade as a full ranking. It was extended to the listwise path after the permutation parser was found backfilling documents the model never named, turning a three-of-twenty reply into a well-formed permutation applied wholesale over RRF.

It only makes malformed verdicts impossible — the coverage-gated listwise judge still ranked worse than plain RRF, so the floor bought output integrity, not ranking quality, and it throws away the scored portion along with the unscored one.

This system's edge table is stored in a conflict-free replicated form, so memory written on separate replicas can merge without a central coordinator; the same governed write path carries provenance, typed edges and ACLs beside the CRDT sync.

Built, not benchmarked — no multi-replica convergence result is published, and the replication metadata is per-edge overhead paid on every write whether or not a second replica exists.

Internal machinery applied after RRF fusion on TerranSoul's default path: each row's fused score is multiplied by a bounded factor built from log-scaled access count and log-scaled graph edge degree. The factor is capped at 1.0 with a protective floor, so it attenuates stale, disconnected rows toward the floor and never inflates a score above what fusion produced.

On the only lane with published retrieval numbers the edge table was empty, so edge degree was uniformly zero and the connectivity half of the multiplier contributed nothing to any figure on the page.

The single LLM call in TerranSoul's retrieval harness: it asks whether the retrieved sessions contain enough to answer the question, and is deliberately never shown the reference answer, with a regression test enforcing that omission. The harness contains no generator prompt and no completion call anywhere.

It measures whether evidence was retrieved, not whether an answer is right, so LongMemEval answer accuracy cannot be produced from this harness at all — the QA blank is structural, not an unfinished run.

Mem0 sells the memory layer as a bought component: a pipeline that extracts candidate facts from a conversation, consolidates them against what is already stored, and updates the vector store accordingly. It sits in the same class as Zep/Graphiti's bitemporal graph and Letta's OS-style paging runtime.

Buying the layer puts the store and its consolidation policy outside the deployment, and the pipeline's substrate is vectors, so facts whose truth changes over time have no native representation the way a bitemporal graph gives them.

This system's consolidation stage re-schedules stored memories using FSRS, a spaced-repetition scheduling algorithm, inside a complementary-learning-systems design with a nightly maintenance job, LLM-arbitrated conflict resolution at the typed-edge layer, and a heuristic-core write policy.

Built, not benchmarked — no consolidation-on against consolidation-off arm exists, so the retrieval effect of the whole stage is unmeasured, and nothing in it touches the open utility / access-control / forgetting trilemma.

Internal machinery on this system's learned-and-robust frontier: kernels that track where a value came from and constrain what untrusted retrieved content is allowed to influence, in the CaMeL capability/information-flow lineage, paired with semantic-entropy scoring. Committed and tested inside the system, but off by default.

Built, not benchmarked — it has never cleared a never-regress floor, so it carries no number and is not on any default path, and the full CaMeL form needs a second privileged planner model this deployment excludes.

The component that decides what gets written to memory in the governed-consolidation stage; its 'learned' framing sits on a heuristic core rather than a trained model. It appears both in the consolidation stage and again on the default-off learned-and-robust frontier.

It is built but not benchmarked and stays off by default — no write-policy-on against write-policy-off arm exists — and the offline reinforcement-learning loop that would make it genuinely learned is a stated boundary this design excludes.

The late-interaction scoring operator from the ColBERT line — for each query token vector take its maximum similarity against the document's token vectors and sum — committed in TerranSoul beside MUVERA fixed-dimensional encodings, which reduce MaxSim to a single vector that rides a standard ANN index instead of a multi-vector store.

It is committed default-off and has never been benchmarked, so it has never influenced a published number on this page and cannot be switched on until its own bench clears the never-regress floor.

Internal machinery of TerranSoul's default retrieval path: after fusion, candidates that share genuine lexical terms with the query act as seeds, and their live neighbours in the typed edge table receive a confidence-weighted, capped score increment. It runs by default rather than behind a flag, unlike cascade expansion and personalized PageRank.

The bench harness only builds entity edges under a flag that defaults off, so the edge table was empty for every published LongMemEval number — the neighbour boost found nothing to boost and has never influenced a measured result on the lane where retrieval numbers are published.

TerranSoul's off-hot-path background job that carries the governed-consolidation stage: complementary-learning-systems consolidation with FSRS reconsolidation, LLM-arbitrated conflict resolution at the typed-edge layer, and a heuristic-core write policy, run on a schedule rather than during a turn.

Built, not benchmarked — no consolidation-on against consolidation-off arm exists, so the retrieval effect of the entire stage is unmeasured, and running off the hot path means a silent failure surfaces in no user-visible signal.

The listwise judge returns a reordering of candidate documents as a permutation of their identifiers; this system's parser filled in whatever identifiers the model left out. A reply naming three of twenty documents therefore emerged as a complete, well-formed permutation.

The backfill hid the judge's non-coverage instead of rejecting it, so a mostly invented ordering was applied wholesale over RRF — including on the max path, whose R@5 100.0 was achieved despite an ungated judge; a coverage floor was added afterwards.

Part of this system's governed write path: every autonomous durable write is recorded with its origin alongside typed edges, ACL and CRDT sync, so a stored memory can be traced back to the producer that wrote it and repeated same-origin re-ingestion can be scored as an anomaly.

Built, not benchmarked — provenance makes a bad write attributable after the fact rather than preventing it, and the row it belongs to has no MINJA or PoisonedRAG evaluation on record.

On this system's read path every retrieved block is wrapped in an explicit trust-boundary fence that marks it as data to ground an answer on, never as instructions to obey — so text injected into a retrieved passage reaches the model as quoted content rather than as a directive.

Built, not benchmarked: no arm isolates the corrective loop and no injection evaluation tests whether the fence holds, so it remains a prompt-level convention the model can still disregard.

A Stage 11 reranker layered over TerranSoul's existing LLM judge that has the model reason about the candidates before emitting an ordering. It is committed and tested but shipped default-off.

It has not cleared its own never-regress bench floor, so it is off by default and carries no measured number — an unexercised path on the published retrieval lane.

The single knob separating the think rung from the chat rung once reordering was dropped: both run identical retrieval at the same cost, and think simply spends more reasoning effort (ReasoningEffort::Medium against Off) on the answer.

The harness scores retrieval and never reads an answer, so whatever the dial buys is invisible in every number on the page — making it measurable needs an answer-generation and judging stage that does not yet exist.

Reference-free scores that ask a judge model whether a generated answer is actually supported by the passages retrieved for it, sitting alongside RAGAS, TruLens span tracing and MT-Bench-style LLM-as-a-judge in the observability layer. They let a team detect hallucination and catch regressions without gold labels.

They hide that the score is one LLM's opinion — judges with very high test-retest reliability also carried severe position bias and rankings that moved by many positions between benchmarks, so the number looks trustworthy while being invalid — and an answer faithful to wrongly retrieved evidence still scores well, because the metric never inspects whether retrieval failed.

A measured result, not a shipped capability: an LLM judge re-ordering the whole RRF candidate list as a permutation scored NDCG@10 85.9 ungated (−7.6 against the chat baseline) and 88.1 once coverage-gated (−5.4), at roughly 4.7–4.8 s per query against ~550 ms. The gated arm is what makes it a ranking-judgement result rather than an output-format bug, since malformed permutations were impossible and the judge still lost.

It is one 50-question slice with one 12B judge on a corpus whose RRF ordering is already near-right, so the deltas hide that they indict this judge on this workload rather than listwise reranking generally — and they hide that the same ungated path is what produced max's R@5 100.0.

Two recall definitions that diverge whenever a question has more than one gold session: recall_ANY@k is satisfied the moment a single gold lands inside the top k, while recall_ALL@k requires every gold to be inside it. Every R@k figure published for the LongMemEval-S arms on this page is recall_ANY@k.

ANY@k hides the missing secondary golds — the same ranking scores far lower under ALL@k, and the gap is widest exactly on the multi-gold questions where the ANY@k headline looks best.

Scoring generated output without a gold answer to compare against — faithfulness and groundedness suites such as RAGAS and FaithJudge, and MT-Bench's LLM-as-a-judge protocol — paired with span-level tracing of the pipeline that produced the output.

Because there is no reference to contradict it, the score inherits the judge's own failures and can look healthy while the pipeline abstains or degrades its way to a good-looking number.

An uncertainty measure that groups a model's sampled answers by meaning and computes entropy over those meaning clusters as a hallucination or confidence signal. In TerranSoul it exists as a Stage 11 kernel alongside information-flow-control kernels, committed and default-off.

It scores how much the model's own samples disagree, not whether they are true, so an answer the model is consistently and confidently wrong about registers as low entropy — and here it is default-off with no measured number at all.

The Stage 9 stance that a memory store should be able to get smaller and better rather than only larger: writes are reviewed at the gate and background consolidation resolves contradictions off the hot path. It is the first stage that treats forgetting as a feature rather than as data loss.

GateMem finds no current method achieves utility, access control and reliable forgetting at the same time — a trilemma, not a backlog — so a store that promises to forget cannot yet prove it did.

A standing rule governing every LLM judge on the read path: a judge may reorder or annotate candidates but never veto them, and when it errors or returns nothing, retrieval proceeds ungraded. It was adopted after the DEAD-JUDGE-1 incident, in which a stale model tag silently erased all recall.

It gives up the judge's ability to remove bad evidence — a silently broken judge degrades to no judging at all, and nothing on the read path is ever filtered out.

A measurement rule: each benchmark arm runs in its own process with its own store, rather than several systems sharing one process and one store. It is adopted because cross-arm contamination in a shared process was demonstrated — the same questions and binary produced different orderings depending on which other arms ran alongside.

It does not retire numbers that were set under the older shared-process methodology, so results measured both ways sit on the same page and a reader comparing them is comparing two methodologies, not two systems.

An observability practice, carried by tools like TruLens, RAGAS and LangSmith, that records each step of a RAG or agent pipeline — retrieve, rerank, judge, generate — as its own timed, inspectable span. It lets a failure be localised to a span instead of to the pipeline as a whole, and by 2025–2026 standardised on OpenTelemetry GenAI semantic conventions.

It shows where an answer was produced, not whether it is correct — the correctness verdict still comes from an unreliable LLM judge — and it adds instrumentation plumbing to every call path.

A 2026 formalization of adversarial manipulation aimed at the memory write path across its lifecycle — injection, persistence and later retrieval — rather than at a single prompt or turn. Its effect on the field is that write-path governance became a named target instead of an assumed defence.

Naming the class is not a defence: TerranSoul's write gate has no MINJA or PoisonedRAG evaluation, so its resistance follows structurally from blocking rather than from a measurement, and a 0% attack-success figure once published on that argument was withdrawn.

A published attack in which ordinary interaction with an agent plants attacker-controlled content into its durable memory store, so the injected item persists and is retrieved on later turns rather than being confined to one prompt. MINJA reports over 95 % injection success against unguarded stores.

The over-95 % figure is measured against stores with no write-time defence, so it says nothing about a gated write path — and TerranSoul has never run MINJA against its own gate: the 0 % attack-success result it once published was withdrawn as an argument, not a measurement.

A corpus-poisoning attack in which an adversary injects a small number of crafted passages into the retrieval corpus so that a target query retrieves them and the answer follows the attacker's text rather than the real evidence. It is named in this page as an evaluation the system has not run.

There is no MINJA or PoisonedRAG evaluation behind the write gate — an audit found no run, no results directory and no benchmark row — so the gate's resistance is argued from its blocking behaviour, not measured.

RobustRAG's stronger secure aggregator combines the isolated per-passage answers using the model's decoding-time token probabilities rather than the emitted text alone. It is named on this system's frontier row as explicitly not built and not planned.

It needs decoding logits, which the local Ollama-style inference server does not expose — a line item on a hosted stack, a hard boundary on a sovereign local one.

The training machinery reinforcement-learned memory management needs: Memory-R1-style policies learn add / update / delete / noop decisions from downstream reward, which requires collecting trajectories and training a policy offline. This system names it as one of four frontier items it will not build.

It requires an offline training loop over reward-labelled trajectories — weight-level learning that a sovereign, single-frozen-model local deployment by definition excludes, which is why it is stated as a boundary rather than a backlog item.

Late interaction scores query tokens against document tokens, so it needs an embedder that emits one vector per token. TerranSoul does not build it, and lists it with the offline RL loop, decoding-logit aggregation and a second privileged planner model as a stated boundary rather than a backlog item.

The resource it needs is per-token multi-vector output from the local model server, and a local Ollama-style server returns one mean-pooled vector per text.

The serving engine that makes ColBERT-style late interaction practical at scale, one of the two routes (with MUVERA's fixed-dimensional encodings) by which multi-vector retrieval becomes deployable and recovers the token-level matching a single pooled vector discards.

It needs a per-token embedder, and a local Ollama-style server returns one mean-pooled vector per text — so on a sovereign single-frozen-model deployment this is a boundary, not a line item.

Full CaMeL-style capability and information-flow control requires a second, privileged planner model running alongside the answering model to constrain what untrusted retrieved data can cause. TerranSoul does not build it and lists it as one of four frontier items that will not be built.

It needs a second resident model, which doubles the local footprint — on a hosted stack a line item, on a local frozen-model deployment a hard boundary.

A retired claim that a character-trigram mirror index lifted Japanese NDCG@10 from 9.5 to 42.3–65.0 at one million rows. It was withdrawn outright rather than re-published with a caveat.

Every digit predates the cross-lingual tokenizer fix and no full-500 artifact exists, so it described code that no longer exists at a scale nothing on disk covers — and the owed re-measurement was never run.

RAPTOR is deliberately absent from this page's reference list. It appears nowhere in the source document the citations are drawn from, and that absence is recorded explicitly for auditability rather than the method being attributed to a source that never mentioned it.

The record is about provenance, not merit — nothing here evaluates or rejects RAPTOR, and citing it would have misattributed it to a source table that does not contain it.

A sharded write path in this system, for which a throughput figure of roughly 1.15M CRUD operations per second was published and has since been withdrawn.

No artifact produces the number — no results directory, no committed report, nothing in history — so the engine is built but its throughput is unmeasured on the record; only the separately measured ingest side survives the withdrawal.