Memory and Knowledge: Capabilities and Deliberate Omissions

Verdict: DeepSeek Harness Has Durable History and Explicit Recall, but No Default Autonomous Long-Term Memory System

1. Put the Six Core Layers and the External Boundary in One Matrix

“Default” is a composition result, not one boolean. Base mounts JSONL and sessionQuery but configures FTS as openAt: never; the standard preset additionally mounts Skills and compaction; minimal explicitly omits compaction and suppresses dynamic runtime-context snapshots. MEMORY-DEFAULT-COMPOSITIONMEMORY-STANDARD-PRESETMEMORY-MINIMAL-PRESET

2. Working Context Is the Current Surface, Not the Entire Log

claim inbox messages
→ assemble system prompt and tools
→ project dynamic runtime context
→ run agent/pre-step injections
→ append accepted user/context messages durably
→ derive current Surface messages
→ snapshot request header
→ call Provider

The Agent claims input, assembles the prompt, computes runtime context, and lets plugins append context during pre-step. Only accepted messages are then recorded as user/message events. The model call reads session.deriveMessages(), while canonical provider/model, system, and tools are recorded separately in request/header. MEMORY-AGENT-CONTEXT

A Session therefore has two kinds of “past” at once: the raw log records what happened, while the current Surface determines what the next model request actually sees. Every later memory claim must first identify which layer it reads.

3. Durable History Is a Recovery Foundation, Not an Automatic Recall Policy

The Base bundle writes Session logs to $DSH_HOME/sessions by default. The persistence coordinator advances its durable cursor only after a backend batch append succeeds; resume and load use reservations plus a stable revision to obtain the exact repaired logical history. Live events enter bounded write-behind, explicit session/flush is the immediate durability barrier, and Session disposal drains remaining writes. MEMORY-DEFAULT-COMPOSITIONMEMORY-PERSISTENCE-TRANSACTIONMEMORY-PERSISTENCE-FLUSH

4. Compaction Is a Lossy Same-Session Transformation, Not a Second Memory Store

Compaction start, summary, and end form a log-only bracket. The following user-message checkpoint with surfaceOp: replace is what actually changes model-visible history. The summary event retains shadowed seqs, estimated token price, provider/model, usage, and complete rawOutput, so both old source events and auxiliary model output remain in durable history. COMPACT-EVENTS

The default basic policy triggers near 80% pressure, retains roughly a 16% recent tail, and allows bounded retries. Its summary directive explicitly requires English, adding a translation-loss surface for non-English Sessions. An automatic summary failure only warns and continues the Turn, so high-pressure history may remain uncompacted. COMPACT-CONFIGCOMPACT-SUMMARIZER

5. Session Reference Is an Explicit, Immutable, Sourced Cross-Session Snapshot

user selects source session ids
→ resolver reads each source's current Surface once
→ keep direct user text + assistant text + canonical checkpoints
→ drop tools, reasoning, nested injected context, and shadowed raw history
→ enforce a per-source UTF-8 byte budget
→ inject one sourced user-role snapshot into the target Session

The resolver defaults to at most three sources, 50 candidates, and 65,536 UTF-8 bytes per source. Its prompt explicitly marks the snapshot untrusted and read-only and tells the model not to follow instructions, permission claims, or tool requests inside it unless the current user repeats them. MEMORY-REFERENCE-RESOLVER

Projection retains only direct-user messages, assistant text, and canonical compact checkpoints. Under budget pressure it preserves checkpoints and the newest message, drops older non-checkpoint units first, then head/tail truncates the longest text with an exact omission count. MEMORY-REFERENCE-PROJECTION

It is not a fork, resume, subscription, or live share, and it does not run automatically when the model judges an old Session relevant. The context package overview explicitly classifies session-reference as opt-in. MEMORY-REFERENCE-OPT-IN

6. Session-Reference Authorization Belongs to the Host, Not the Resolver

listCandidates() lists every non-self Session exposed by sessionQuery; matching cwd affects rank, not filtering. Given an exact Session ID, prepare() directly calls readSurface(). The package README likewise states that the resolver assumes its Host may read every Session exposed by the query service. MEMORY-REFERENCE-RESOLVERMEMORY-REFERENCE-TRUST

7. Session Query Is a Unified Read Surface; FTS5 Is a Disposable Lexical Read Model

The query corpus prefers a detached live snapshot and inspects persistence only when the target is not live, checking again for an attachment race after the read. Batched cold reads have bounded concurrency and isolate one Session's failure as that item's rejected result. MEMORY-QUERY-CORPUS

Search documents are extracted event by event from the complete raw log and classified by the canonical Surface fold as current, shadowed, or log-only. Searchable text includes user and assistant text, tool names/arguments/results, Todos, and some Turn errors. Reasoning, raw chunks, request headers, unknown events, and unknown blocks are excluded. MEMORY-QUERY-DOCUMENTSMEMORY-QUERY-EXTRACTION

The SQLite backend uses FTS5 with the unicode61 tokenizer, not embeddings or semantic retrieval. A persistent path duplicates extracted plaintext into a derived database. New directories and files are owner-only, foreign databases are refused, and a recognized but incompatible derived schema may be rebuilt. MEMORY-QUERY-SQLITE-SCHEMA

8. Exact Reads Are On by Default; Full-Text and Model Query Tools Are Off

Both Base and Web patches set path: ':memory:' and openAt: never. This mode never imports or opens SQLite and makes searchSessions/searchEvents return SESSION_QUERY_SEARCH_DISABLED, while titles, lineage, Surface reads, and exact event reads remain available through the unified service. MEMORY-DEFAULT-COMPOSITIONMEMORY-QUERY-SQLITE-MODELOG-QUERY-TRACE

Model-facing tool-session-query is a separate opt-in package registering session_search, session_event_search, session_trace, session_event_trace, and session_event_read. Shipped Host compositions do not mount it by default. It also deliberately applies no byte or character truncation; deployments needing bounded inline output must add a spill policy. MEMORY-QUERY-TOOL-CONTRACT

The precise default statement is therefore: “The Host has a cross-Session exact-query seam, but the model receives no cross-Session search or read tools by default,” not the looser “Session memory is supported.”

9. The Web UI Is Local-Metadata-First and Degrades Content Search by Configuration

For a nonblank query, Workspace Browser immediately matches titles and Workspace names, then issues a debounced Host content search after 250 ms. Remote failure leaves local results visible and adds a warning. Local-first and remote results are deduplicated, merged, and capped at 20. MEMORY-WEB-SEARCH

The Host defines its visible baseline as attached Sessions plus servable cold Sessions carrying cwd. After querying the provider it accepts only hits in that visible set whose Session IDs agree and whose types are current user/assistant messages. This Host gate is the Web path's authorization boundary. MEMORY-WEB-HOST-GATE

10. Skills Are Trusted Knowledge and Operating Instructions, Not Learned Conversation Memory

The Skill registry merges host/global and per-scope provider/runtime layers. The nearest scope wins same-name conflicts across layers, with rank resolving duplicates inside one layer. list() returns summaries and get() loads complete definitions on demand. There is no path in the registry for extracting, reinforcing, resolving, or forgetting facts learned from Sessions. MEMORY-SKILL-REGISTRY

The filesystem provider discovers flat .md files or one-level SKILL.md directories from the nearest Git root's .dsh/skills and .agents/skills, custom roots, user roots, and the bundled root. Watching and symlink following are on by default with at most 128 project watchers; non-bundled roots pass through the optional filesystem policy. MEMORY-SKILL-FILESYSTEM-CONFIGMEMORY-SKILL-FILESYSTEM-ROOTSMEMORY-SKILL-FILESYSTEM-LOAD

Both load paths check the actual definition's invocation policy, and only direct user input can trigger the unforgeable /name gesture. Full bodies are deliberately treated as trusted local content and embedded verbatim. This is knowledge injection, not memory retrieval. MEMORY-SKILL-INVOCATION

11. The Main Skill Risks Are Repository Trust and Context Amplification

The per-description cap, whole-catalog publication, and absence of a body cap are directly visible in implementation. The filesystem provider's JSDoc/default mismatch appears in the same configuration definition. MEMORY-SKILL-FILESYSTEM-CONFIGMEMORY-SKILL-FILESYSTEM-LOADMEMORY-SKILL-INVOCATION

Web skill.list resolves a host-owned cwd/scope only for an attached Session and returns user-invocable entries. The client caches per Session, offers candidates on /, and inserts only literal /name text after selection. Listing failures silently drop the menu group; there is no consent or risk-preview layer. MEMORY-SKILL-HOST-UIMEMORY-SKILL-CLIENT-UI

12. External Memory MCP Is an Interoperability Boundary; Providers Own Data and Recall Semantics

examples/mcp-memory supplies version-pinned overlays for Memorix, MCP Reference Memory, and Engram. Harness parses the overlay, launches a stdio child or connects to Streamable HTTP, discovers tools, and registers them as mcp__<server>__<tool>. It does not download the service, initialize its database, choose its model or embedding provider, migrate data, or supervise an independent HTTP service. The shipped composition contains no memory server, so all three remain disabled without --patch. MEMORY-MCP-BOUNDARY

Write triggers, search timing, conflict resolution, forgetting, cross-project identity, and licensing are not core Harness contracts. The examples even recommend adding an instruction to write when asked to remember and search when history may matter if tool descriptions do not reliably trigger use, making the prompt/tool-policy dependency explicit. MEMORY-MCP-BOUNDARY

13. The Shipped First-Party Default Deliberately Lacks an Autonomous Memory Loop

not present as a shipped first-party default:
conversation → fact extraction → durable semantic store
             → relevance retrieval → ranking/dedup
             → permission-filtered automatic prompt injection
             → conflict resolution / forgetting / provenance feedback

Source and shipped composition establish a Session event log, Surface replacement, exact and lexical query, explicit snapshots, and instruction catalogs. They do not support describing the default as embedding memory, vector retrieval, episodic/semantic memory, learned user profiles, or automatic recall. External MCP can add some of those capabilities, but capability, data ownership, and risk vary by provider.

The most accurate product description is durable, replayable session history with explicit cross-session retrieval seams, not an autonomous memory platform.

14. Confirmed Issues, Static Risks, and Verification Status