Scope Before You Persist: Preventing Cross-Family Interference in Agent Memory

• Persistent deployment is framed as converting local feedback into a sequence of improvements that remains useful across recurring task families.The introduction motivates grounded feedback, deployed trajectories, and matched-compute controls given risks from unreliable self-correction, shared actor–judge shortcuts, and gains that may not transfer or recur.Source: §1 · p. 1
• The research question is when persistent skill editing improves an agent across recurring task families rather than only the family that supplied the latest feedback.A frozen actor solves discovery tasks, a frozen model edits a 360-character policy, and a gate chooses whether to deploy it.Source: §1 · p. 1
• The paper distinguishes whether an update is supported from where it should apply, because evidence from one family may not justify global deployment.Source: §1 · p. 1
• The study introduces ProcStream-RSI, a 12-round procedural stream with recurring task families and fixed hidden checkpoints, and evaluates deployed-policy sequences rather than an archive-best checkpoint.Source: §1 · p. 1
• A locally valid edit can change unrelated families when deployed through one compact global skill, an interaction the paper calls cross-family interference.Source: §1 · pp. 1–2
• In a fixed-output intervention, scoped retrieval prevents observed cross-family harm and supports repeated updates across a 12-round stream.The intervention holds proposals, decisions, programs, and scores fixed while changing retrieval.Source: §1 · p. 2
• Family-scoped retrieval raises mean trajectory utility and preserves locally certified gains, while global controls fall below Static across eight 12-round streams.The introduction presents scope matching as necessary alongside proposal quality and gate accuracy.Source: §1 · p. 2
• Continual adaptation means sequentially accepted edits remain useful as deployed family-scoped memory evolves.Source: §1 · p. 2

• Inference-time refinement and verbal memory can improve outputs without weight updates, while self-training updates weights using answers, filters, comparisons, or rewards (Shinn et al., 2023; Zelikman et al., 2022; Singh et al., 2023; Yuan et al., 2024).The passage notes that both approaches rely on a quality asymmetry between generation and selection, and that ungrounded or exploitable selection can lead to saturation, regression, or collapse (Huang et al., 2024; Herel & Mikolov, 2024; Song et al., 2024; Shafayat et al., 2025).Source: §2 · p. 2
• Prior systems edit prompts, tools, workflows, or coding agents, while this study evaluates the deployed lineage under partial verification rather than the best archive member (Yin et al., 2024; Zhang et al., 2025).The closest cited continual evaluation reports transfer and improvement in a second phase only for a regression-aware optimizer (Wang et al., 2026a).Source: §2 · p. 2
• Actor and judge systems can converge on shared shortcuts without gradient updates, motivating attention to evaluator error dependence (Pan et al., 2024).The paper uses deterministic execution and metamorphic relations alongside actor-visible tests, with sealed execution separating same-probe certification error from prospective cross-family interference.Source: §2 · p. 2
• The procedural stream uses generated instances and held-out cases to measure adaptation within recurring contracts, while a frozen HumanEval+ sample serves as an external transfer diagnostic.The passage situates this design alongside work showing sparse base tests can overestimate code correctness and benchmarks broadening instruction and library coverage (Liu et al., 2023; Zhuo et al., 2025).Source: §2 · p. 2

3 CONTINUAL SELF-IMPROVEMENT AS DEPLOYMENT

• A frozen actor solves discovery tasks using the current persistent skill, a frozen editor proposes a replacement, and a gate evaluates the incumbent and proposal before choosing the next skill.Confirmatory runs inherit only the current skill; proposed meta-skill text is ignored and generated task programs are ephemeral outputs.Source: §3 · pp. 2–3
• Evaluation reports terminal and mean trajectory utility, backward transfer, worst-family retention, and a separate final-bank score rather than archive-best utility for primary claims.Source: §3 · p. 3

3.1 WHY FALSE ACCEPTANCE CONTROLS DRIFT

• The drift analysis frames expected deployed change using proposal benefit probability and gain, harmful-proposal loss, and a gate’s acceptance rates for beneficial and harmful proposals.Source: §3.1 · p. 3
• For an AND gate, conditionally independent evidence channels multiply false-acceptance rates, but identical false-acceptance events leave that rate unchanged.Marginal verifier accuracy is therefore insufficient, and the analysis cannot protect an unscoped global edit from interactions with task families not yet seen by the evidence.Source: §3.1 · p. 3

3.2 FAMILY-SCOPED RETRIEVAL

• Scoped-ORC stores an accepted candidate in the current family’s slot and supplies that slot for matching tasks, using the initial policy when no accepted slot exists.Source: §3.2 · p. 3
• The scope comparison keeps the active policy at 360 characters and leaves proposal generation and gating unchanged, isolating the effect of cross-family exposure.In the round-0 comparison, Global- and Scoped-ORC share discovery outputs, candidate, probe evidence, and acceptance decision.Source: §3.2 · p. 3

• Each task is tested through four public examples, four private exact-output tests hidden from the actor and editor, and at least six answer-free metamorphic checks.For each task and channel, ORC measures the candidate-minus-incumbent pass-rate difference.Source: §4 · p. 3
• ORC partitions probe instances into the current family and separate historical-family groups, then computes deterministic one-sided 95% paired-bootstrap lower bounds for each group and channel.Groups contain at least four tasks; bootstrap samples are enumerated when nn ≤ 50,000 and otherwise estimated with 2,000 seeded draws.Source: §4 · p. 3
• With δnew = 0 and δreg = 0.02, deployment also requires that private and metamorphic evaluations report no unsafe program.The conjunction prevents a gain in one channel from averaging away a regression in another; rejected proposals do not affect later actor or editor prompts.Source: §4 · p. 4

5.1 PROCSTREAM-RSI

• PROCSTREAM-RSI v3.1 is a fixed-semantics, 12-round code-repair stream designed to make retention across recurring families observable.Each stream has 123 tasks; hidden cases are unavailable online, and neutral public examples contrast with private and hidden cases that exercise family rules.Source: §5.1 · p. 4

5.2 METHODS AND CONTROLS

• Controls include never-deploy Frozen-compute, always-deploy Latest-only, Self-judge, Replay, full ORC, and final-only Batch-ORC.Static never proposes an update.Source: §5.2 · p. 4
• Batch-ORC tests sequential advantage over a cumulative one-shot update, while Frozen-compute tests the effect of additional calls.Source: §5.2 · p. 4

5.3 SCOPE AND RANDOMIZED-ENTRY EXTENSION

• A fixed-output intervention changes only task-to-skill retrieval, then paired randomized-entry streams test scope prospectively while matching proposals and gate decisions.The randomized extension uses 18 streams, with two streams beginning with each of nine families; its primary contrast is hidden checkpoint utility.Source: §5.3 · pp. 4–5

5.4 MODEL, RUNS, AND OUTCOMES

• The main study evaluates eight unseen 12-round streams, while extensions test transfer and full-length paired Global-ORC versus Scoped-ORC adaptation.The main analysis treats complete streams as independent units; the full-length extension uses 27 seeds, three per first family, and permits multiple accepted slots.Source: §5.4 · p. 5

Global controls

• 0.713 mean trajectory utility for ORC was below Static’s 0.775, and 6/8 ORC acceptances reduced the next fixed hidden checkpoint.The accepted rule raised boundary-family hidden utility by 0.398 on average while changing missing, rotation, tie-breaking, and chunk families by −0.461, −0.234, −0.148, and −0.117.Source: §6 · pp. 5–6, Table 1 · p. 6

Fixed retrieval-scope intervention

• 0.816 mean trajectory utility under fixed-completion Scoped-ORC exceeded 0.713 for Global-ORC and 0.775 for Static, with zero harmful deployments versus six under global retrieval.The intervention held proposals and gate decisions fixed; the paired advantage over Global-ORC was 0.103 [0.052, 0.151].Source: §6 · p. 6, Table 4 · p. 7

Balanced randomized-entry replication

• 0.041 was the paired Scoped-minus-Global utility effect in 18 balanced randomized-entry streams, where scoped deployment had 0 harmful accepted updates versus 3 under global deployment.The paired interval was [-0.004, 0.107]; the deployments shared the current-family change by construction, while mean non-current-family changes were -0.047 and 0.000.Source: §6 · pp. 6–7

Full randomized-order extension

• 0.063 [0.037, 0.094] higher mean hidden trajectory utility for Scoped-ORC than Global-ORC across 27 streams, with 63 versus 12 accepted updates and 0/63 versus 6/12 harmful acceptances.Scoped-ORC had multiple acceptances in 19/27 streams, compared with 2 streams for Global-ORC.Source: §6 · p. 7

Evidence selection and deployment scope

• 0.752 and 0.998 AUROC for public and private/metamorphic evidence, respectively, coexisted with only two of eight locally safe ORC acceptances improving the next global checkpoint.The results indicate that strong within-scope selection still requires scope-matched deployment.Source: §6 · p. 7

7 CONCLUSION

• Scoped deployment raises mean trajectory utility by 0.063, accepts 63 updates versus 12 globally, and yields harmful counts of 0/63 versus 6/12.The paper concludes that evidence justifying an update should also determine where it is retrieved.Source: §7 · p. 7
• Table 5 reports a balanced randomized-entry replication over 18 streams, with two streams per first family and stream-bootstrap 95% intervals.Source: Table 5 · p. 8
• Figure 1 tracks hidden checkpoint trajectories over 27 paired 12-round streams and evaluates router utility under oracle, miss-fallback, and learned routing.Source: Figure 1 · p. 8

8 LIMITATIONS AND BROADER IMPACT

• The study covers inspectable scaffold edits with one frozen model and nine code-contract families.A cumulative one-shot control for compounding, open-world and wrong-slot routing, and additional editor/search backbones remain future work.Source: §8 · p. 8
• Generated programs ran in a pinned, network-free, least-privilege Docker sandbox with resource limits and AST validation; no personal data or human subjects were involved.Source: §8 · p. 8
• Figure 2 summarizes mean fixed-bank hidden performance across t = 0 and 12 deployment decisions, separating scope controls from permissive baselines.Source: Figure 2 · p. 9
• Table 6 describes a full 12-round randomized-order extension across 27 paired streams, with intervals and harmful updates defined by next-checkpoint reduction.Source: Table 6 · p. 9

REPRODUCIBILITY

• The supplement archives code, manifests, hashes, prompts, seeds, policies, immutable artifacts, response IDs, tests, analysis scripts, and a dated deviation log.Source: REPRODUCIBILITY · p. 11
• Online runners reject sealed manifests, while the auditor checks hidden cases, manifest and split matches, duplicate artifacts, and code hashes.Incomplete cells are archived and replayed from round zero under unique identifiers; partial results do not enter the analysis.Source: REPRODUCIBILITY · p. 11
• A transactional study-wide ledger records provider use and shared-cache reuse, while method-level resource comparisons reconstruct uncached endpoint use from metadata.Source: REPRODUCIBILITY · p. 11

AI USE STATEMENT

• Generative AI tools supported literature review, experiments, code, manuscript work, and interpretation; the authors reviewed the work and take responsibility for its correctness.Source: AI USE STATEMENT · p. 11

A SECONDARY SELECTION AND TRANSFER DIAGNOSTICS

• Six of eight ORC acceptances reduced the next global checkpoint despite all being safe on same-family gate probes.The public component had AUROC 0.752 and accuracy 0.564; on HumanEval+, Global-ORC scored 0.895 versus Static’s 0.914.Source: A SECONDARY SELECTION AND TRANSFER… · p. 11
• On sealed GPT-OSS banks, scoped retrieval reached 0.960, 0.020 above Static, with bootstrap 95% interval [0.004, 0.035].Its 0.010 advantage over Global-ORC had interval [−0.033, 0.055].Source: A SECONDARY SELECTION AND TRANSFER… · p. 11

B PROOF OF THE GATE-DRIFT PROPOSITION

• Under conditional independence, all m channels falsely accept a harmful proposal with probability equal to the product of their false-acceptance probabilities.If false-acceptance events are identical, their conjunction retains probability β.Source: B PROOF OF THE GATE-DRIFT PROPOSITION · p. 12

C EVIDENCE ROLES AND LEAKAGE BOUNDARIES

• Private exact-output tests and metamorphic outcomes reach only the online gate; sealed hidden cases are loaded only by the model-free auditor.Source: C EVIDENCE ROLES AND LEAKAGE BOUNDARIES · p. 12

D QUALITATIVE LINEAGE ANALYSIS

• ORC lineages accept only the round-0 boundary-family proposal; locally valid rules can lower fixed-checkpoint performance after global deployment, then the gate freezes the policy.The seed examples illustrate the mechanism rather than establish a separate statistical claim.Source: D QUALITATIVE LINEAGE ANALYSIS · p. 12

E PILOT AND PROTOCOL CHANGES

• Pilot and protocol changes excluded saturated or incomplete runs, retained the conservative non-degenerate threshold, and raised the batch budget to prevent evidence truncation.The budget correction changed cost, not evidence or acceptance logic.Source: E PILOT AND PROTOCOL CHANGES · p. 12

F FULL RANDOMIZED-ORDER EXTENSION DETAILS

• The extension pairs Global- and Scoped-ORC across 27 outcome-blind streams, with three streams per starting family and family-specific slots for accepted scoped updates.The initial policy serves as fallback when a family has no accepted slot.Source: F FULL RANDOMIZED-ORDER EXTENSION… · p. 12
• Oracle routing selects the family slot; a character 3–5-gram Naive Bayes router also achieved 243/243 correct routes on held-out checkpoint prompts.The learned-router evaluation is an in-distribution diagnostic because prompt templates are shared.Source: F FULL RANDOMIZED-ORDER EXTENSION… · pp. 12–13

G SANDBOX AND BUDGET CHECKS

• The sandbox and budget checks cover file-access restrictions, process and network controls, timeouts, manifest integrity, ORC logic, and shared-ledger accounting.Returned provider cost is authoritative, and ambiguous post-dispatch timeouts are charged at their conservative reservation.Source: G SANDBOX AND BUDGET CHECKS · p. 13