[{"data":1,"prerenderedAt":627},["ShallowReactive",2],{"article:context-memory-management":3},{"meta":4,"raw":18,"references":19,"prev":42,"next":51,"body":59,"toc":616},{"slug":5,"title":6,"date":7,"updated":8,"tags":9,"summary":14,"draft":15,"lang":16,"minutes":17},"context-memory-management","上下文与记忆管理：Agent 的长期记忆怎么建","2026-04-21","2026-10-11",[10,11,12,13],"Agent","上下文管理","记忆","LLM","区分会话状态、历史压缩与跨会话记忆；用来源、作用域、版本和有效期治理记忆，解释读写流程、遗忘、权限隔离与可验证的评测。",false,"zh-CN",6,"Agent 昨天知道“这个项目用 pnpm”，今天却改用 npm；或者记住了上个月的部署路径，今天坚持用旧路径。长期记忆要解决的不是“存更多文字”，而是**在正确的任务中取出仍然有效、可追溯的信息**。\n\n上下文窗口是模型当前可处理的输入空间。会话历史可由应用或服务端持久保存，但不会因此全部处于每轮的有效上下文中。持久保存、检索注入和模型遵循，是三个不同环节。\n\n## 四种机制，各解决一个问题\n\n| 机制 | 解决什么 | 风险与代价 |\n| --- | --- | --- |\n| 历史裁剪 \u002F 上下文编辑 | 删除过大或过时的工具细节 | 后续可能需要再次读取 |\n| Compaction（压缩） | 用摘要延续长会话 | 摘要有损，约束可能遗漏 |\n| 持久记忆 | 跨会话保存确认的事实与偏好 | 过期、冲突、隐私与污染 |\n| 检索式记忆 | 从大量记忆中按需选取 | 检索遗漏和错误注入 |\n\n![记忆四层：当前上下文、裁剪与压缩、持久条目、按权限检索](\u002Fdiagrams\u002Fcontext-memory.svg)\n\n*图 1 · 摘要延续任务，持久记忆保存事实；每次注入都重新检查来源与有效性。*\n\n厂商提供的上下文编辑、压缩和 memory tool 不是同一套接口，也不代表一开就有完整记忆服务。例如 Claude memory tool 的存储和隔离由应用实现，模型只是通过工具请求读写。[官方说明](https:\u002F\u002Fplatform.claude.com\u002Fdocs\u002Fen\u002Fagents-and-tools\u002Ftool-use\u002Fmemory-tool)\n\n## 两家公开能力：先确认保存的是哪种状态\n\n[OpenAI Agents SDK Sessions](https:\u002F\u002Fopenai.github.io\u002Fopenai-agents-python\u002Fsessions\u002F)可管理跨运行的对话历史；Claude memory tool 让应用提供读写存储。前者的会话与后者的显式记忆并不等价：恢复一次对话、按需找回历史、跨任务保存长期事实，是不同能力。\n\n工程推导：评估存储时分别列出历史、压缩摘要、长期条目、业务任务与外部动作结果的责任方，再检查权限、版本、留存和删除。厂商提供某一种持久化，不能自动推出其负责其余所有数据。上下文如何构建与发布见[Prompt 与上下文工程](\u002Farticles\u002Fprompt-context-engineering)。\n\n## 长会话：先控制工具结果，再压缩\n\n文件、网页和日志往往是历史的大头。优先分页、返回摘要与引用、按需读取原文；陈旧工具结果可裁剪，但不能切断尚未配对的调用与结果。\n\n压缩时保留当前目标、用户约束、已完成动作、待验证项、关键证据位置和下一步。对“已经付款”一类副作用状态，不只靠摘要，真实状态应存在业务数据库并可查询。\n\n服务端压缩可能产生专门内容块或状态项，需按对应 API 原样保留必要部分；不能一律只提取文本，也不能把某个模型的默认阈值当通用常数。[Claude 上下文编辑](https:\u002F\u002Fplatform.claude.com\u002Fdocs\u002Fen\u002Fbuild-with-claude\u002Fcontext-editing)\n\n## 一条记忆应该长什么样\n\n```yaml\nid: project-deploy-directory\nscope: project:tntlikely-home\nkind: verified_fact\nvalue: \"静态生成产物为 .output\u002Fpublic；当前 dist 指向该目录\"\nsource: \"仓库配置与本机路径检查\"\nconfirmed_at: \"2026-10-11\"\nexpires_at: null\nrevision: 3\n```\n\n事实、偏好和推断要区分。用户显式偏好可标明来源；从一次行为猜出的偏好不自动升级为长期规则。带时间的事实应有有效期或重验条件，`confidence: high` 也不能使过期信息一直有效。\n\n作用域至少区分用户、项目与组织；同一用户在两个仓库的构建约定不同，不能全局覆盖。来源来自网页或工具输出时，其内容仍是不受信任数据，不能通过“写入记忆”转成高优先级指令。\n\n## 写入与读取都需要治理\n\n写入流程：提出候选 → 检查是否有未来用途 → 识别敏感信息 → 与已有条目比对 → 更新或新建 → 记录来源和版本。矛盾信息不能简单追加；新证据不足时保留冲突待核验，不能静默覆盖已确认事实。\n\n读取流程：按用户、项目与权限过滤 → 排除过期条目 → 按任务检索 → 检查来源与冲突 → 在预算内注入。记忆与当前明确指示冲突时，应以适用的当前指示为准，必要时更新记忆。\n\n项目命令等明确键值适合结构化查询，大量历史资料适合向量或混合检索；不是所有记忆都必须 Embedding。文件容易 review，数据库更利于多用户授权和并发，没有普遍更优的存储形式。\n\n## 窗口预算：留输出，也留下一轮空间\n\n可以把输入分成系统规则、工具定义、检索证据、记忆和历史；输出按模型限制留足空间。比例由任务决定，不能固定说“历史 40%、记忆 15%”就一定合理。\n\n让关键约束和最新任务状态保持可见，按价值裁剪可重新读取的细节。压缩也会增加生成成本，修改前缀可能影响缓存；同时观察任务完成率、重读次数、延迟与费用。[预算篇](\u002Farticles\u002Fllm-budget-token-accounting)解释了为什么长历史会贵。\n\n## 遗忘与隐私：删文件只是第一步\n\n用户偏好与项目资料、健康描述等长期数据应有清晰用途、授权和留存策略。删除请求要覆盖主存储、搜索索引、缓存、导出和备份处理流程；已注入当前会话的信息也需要停止继续使用或重建上下文。\n\n模型主动“忘记”一句话，不能代替后端删除。多租户系统要防记忆串用、跨用户文件路径和共享缓存泄露。评测样本同样不应无限留存敏感原始对话，详见 [未成年人安全篇](\u002Farticles\u002Fminors-ai-safety-engineering)。\n\n## 记忆如何评测\n\n同一组跨会话任务分别使用正确记忆、过期记忆、冲突记忆和无记忆，比较完成率与错误行为。再测试：用户更改偏好、不同项目同名条目、撤权与删除、压缩后继续任务、恶意内容试图写入永久规则。\n\n例如第一次确认“用 pnpm”，第二次切到另一项目明确说“用 npm”。验收不只是记住 pnpm，而是能在两个项目里分别使用正确约定。依靠模型看到时间后“自行降权”不够，过期筛选和作用域必须程序化。\n\n## 落地检查\n\n1. 历史、摘要、业务状态与长期记忆分开存储和更新。\n2. 记忆包含来源、作用域、版本和有效性条件。\n3. 写入检查冲突与敏感信息，读取先授权再检索。\n4. 当前指示可纠正旧记忆，用户能查看、更正和删除。\n5. 用跨会话、过期、冲突与隔离用例验证，而非只看检索命中。\n\n## 参考资料\n\n- [Claude — Memory tool](https:\u002F\u002Fplatform.claude.com\u002Fdocs\u002Fen\u002Fagents-and-tools\u002Ftool-use\u002Fmemory-tool)\n- [Claude — Context editing](https:\u002F\u002Fplatform.claude.com\u002Fdocs\u002Fen\u002Fbuild-with-claude\u002Fcontext-editing)\n- [Claude Code — Memory](https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fmemory)\n- [MemGPT 论文](https:\u002F\u002Farxiv.org\u002Fabs\u002F2310.08560)\n- [OpenAI Agents SDK — Sessions](https:\u002F\u002Fopenai.github.io\u002Fopenai-agents-python\u002Fsessions\u002F)",[20,25,29,33,38],{"title":21,"url":22,"type":23,"note":24,"checked":8},"Claude — Memory tool","https:\u002F\u002Fplatform.claude.com\u002Fdocs\u002Fen\u002Fagents-and-tools\u002Ftool-use\u002Fmemory-tool","官方文档","memory tool 接口与应用存储责任；不等于开箱即用的完整长期记忆服务。",{"title":26,"url":27,"type":23,"note":28,"checked":8},"Claude — Context editing","https:\u002F\u002Fplatform.claude.com\u002Fdocs\u002Fen\u002Fbuild-with-claude\u002Fcontext-editing","上下文编辑的 API 行为与限制；摘要和业务事实应分开管理。",{"title":30,"url":31,"type":23,"note":32,"checked":8},"Claude Code — Memory","https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fmemory","项目与用户指令文件的加载和维护；文件不能替代程序化授权。",{"title":34,"url":35,"type":36,"note":37,"checked":8},"MemGPT 论文","https:\u002F\u002Farxiv.org\u002Fabs\u002F2310.08560","研究论文","MemGPT 的分层记忆与上下文调度研究；不证明所有任务都需要向量记忆。",{"title":39,"url":40,"type":23,"note":41,"checked":8},"OpenAI Agents SDK — Sessions","https:\u002F\u002Fopenai.github.io\u002Fopenai-agents-python\u002Fsessions\u002F","SDK 对话历史与 session 接口；不同于所有业务动作的事务状态。",{"slug":43,"title":44,"date":45,"updated":8,"tags":46,"summary":50,"draft":15,"lang":16,"minutes":17},"claude-code-local-agent-security","Claude Code 本地 Agent 的安全栈：沙盒、权限、规则与分类器","2026-05-19",[47,10,48,49],"Claude Code","安全","沙盒","区分提示规则、程序权限与 OS 沙盒，核对 Claude Code 的真实覆盖范围和平台差异；解释凭证掩码、非沙盒组件和可重复的边界验证。",{"slug":52,"title":53,"date":54,"updated":8,"tags":55,"summary":58,"draft":15,"lang":16,"minutes":17},"function-calling-structured-output","Function Calling 与结构化输出：让 LLM 可靠地动手","2026-03-17",[13,56,10,57],"Tool Use","结构化输出","分清调用协议与输出格式，比较 OpenAI、Claude 的字段；用完整 schema 和工具循环说明参数验证、授权、并发、幂等与失败处理。",{"type":60,"children":61},"root",[62,78,83,90,195,204,213,226,232,243,255,261,266,271,282,287,476,489,494,499,504,509,514,520,525,538,544,549,561,566,571,576,581,611],{"type":63,"tag":64,"props":65,"children":66},"element","p",{},[67,70,76],{"type":68,"value":69},"text","Agent 昨天知道“这个项目用 pnpm”，今天却改用 npm；或者记住了上个月的部署路径，今天坚持用旧路径。长期记忆要解决的不是“存更多文字”，而是",{"type":63,"tag":71,"props":72,"children":73},"strong",{},[74],{"type":68,"value":75},"在正确的任务中取出仍然有效、可追溯的信息",{"type":68,"value":77},"。",{"type":63,"tag":64,"props":79,"children":80},{},[81],{"type":68,"value":82},"上下文窗口是模型当前可处理的输入空间。会话历史可由应用或服务端持久保存，但不会因此全部处于每轮的有效上下文中。持久保存、检索注入和模型遵循，是三个不同环节。",{"type":63,"tag":84,"props":85,"children":87},"h2",{"id":86},"四种机制各解决一个问题",[88],{"type":68,"value":89},"四种机制，各解决一个问题",{"type":63,"tag":91,"props":92,"children":93},"table",{},[94,118],{"type":63,"tag":95,"props":96,"children":97},"thead",{},[98],{"type":63,"tag":99,"props":100,"children":101},"tr",{},[102,108,113],{"type":63,"tag":103,"props":104,"children":105},"th",{},[106],{"type":68,"value":107},"机制",{"type":63,"tag":103,"props":109,"children":110},{},[111],{"type":68,"value":112},"解决什么",{"type":63,"tag":103,"props":114,"children":115},{},[116],{"type":68,"value":117},"风险与代价",{"type":63,"tag":119,"props":120,"children":121},"tbody",{},[122,141,159,177],{"type":63,"tag":99,"props":123,"children":124},{},[125,131,136],{"type":63,"tag":126,"props":127,"children":128},"td",{},[129],{"type":68,"value":130},"历史裁剪 \u002F 上下文编辑",{"type":63,"tag":126,"props":132,"children":133},{},[134],{"type":68,"value":135},"删除过大或过时的工具细节",{"type":63,"tag":126,"props":137,"children":138},{},[139],{"type":68,"value":140},"后续可能需要再次读取",{"type":63,"tag":99,"props":142,"children":143},{},[144,149,154],{"type":63,"tag":126,"props":145,"children":146},{},[147],{"type":68,"value":148},"Compaction（压缩）",{"type":63,"tag":126,"props":150,"children":151},{},[152],{"type":68,"value":153},"用摘要延续长会话",{"type":63,"tag":126,"props":155,"children":156},{},[157],{"type":68,"value":158},"摘要有损，约束可能遗漏",{"type":63,"tag":99,"props":160,"children":161},{},[162,167,172],{"type":63,"tag":126,"props":163,"children":164},{},[165],{"type":68,"value":166},"持久记忆",{"type":63,"tag":126,"props":168,"children":169},{},[170],{"type":68,"value":171},"跨会话保存确认的事实与偏好",{"type":63,"tag":126,"props":173,"children":174},{},[175],{"type":68,"value":176},"过期、冲突、隐私与污染",{"type":63,"tag":99,"props":178,"children":179},{},[180,185,190],{"type":63,"tag":126,"props":181,"children":182},{},[183],{"type":68,"value":184},"检索式记忆",{"type":63,"tag":126,"props":186,"children":187},{},[188],{"type":68,"value":189},"从大量记忆中按需选取",{"type":63,"tag":126,"props":191,"children":192},{},[193],{"type":68,"value":194},"检索遗漏和错误注入",{"type":63,"tag":64,"props":196,"children":197},{},[198],{"type":63,"tag":199,"props":200,"children":203},"img",{"alt":201,"src":202},"记忆四层：当前上下文、裁剪与压缩、持久条目、按权限检索","\u002Fdiagrams\u002Fcontext-memory.svg",[],{"type":63,"tag":64,"props":205,"children":206},{},[207],{"type":63,"tag":208,"props":209,"children":210},"em",{},[211],{"type":68,"value":212},"图 1 · 摘要延续任务，持久记忆保存事实；每次注入都重新检查来源与有效性。",{"type":63,"tag":64,"props":214,"children":215},{},[216,218],{"type":68,"value":217},"厂商提供的上下文编辑、压缩和 memory tool 不是同一套接口，也不代表一开就有完整记忆服务。例如 Claude memory tool 的存储和隔离由应用实现，模型只是通过工具请求读写。",{"type":63,"tag":219,"props":220,"children":223},"a",{"href":22,"rel":221},[222],"nofollow",[224],{"type":68,"value":225},"官方说明",{"type":63,"tag":84,"props":227,"children":229},{"id":228},"两家公开能力先确认保存的是哪种状态",[230],{"type":68,"value":231},"两家公开能力：先确认保存的是哪种状态",{"type":63,"tag":64,"props":233,"children":234},{},[235,241],{"type":63,"tag":219,"props":236,"children":238},{"href":40,"rel":237},[222],[239],{"type":68,"value":240},"OpenAI Agents SDK Sessions",{"type":68,"value":242},"可管理跨运行的对话历史；Claude memory tool 让应用提供读写存储。前者的会话与后者的显式记忆并不等价：恢复一次对话、按需找回历史、跨任务保存长期事实，是不同能力。",{"type":63,"tag":64,"props":244,"children":245},{},[246,248,254],{"type":68,"value":247},"工程推导：评估存储时分别列出历史、压缩摘要、长期条目、业务任务与外部动作结果的责任方，再检查权限、版本、留存和删除。厂商提供某一种持久化，不能自动推出其负责其余所有数据。上下文如何构建与发布见",{"type":63,"tag":219,"props":249,"children":251},{"href":250},"\u002Farticles\u002Fprompt-context-engineering",[252],{"type":68,"value":253},"Prompt 与上下文工程",{"type":68,"value":77},{"type":63,"tag":84,"props":256,"children":258},{"id":257},"长会话先控制工具结果再压缩",[259],{"type":68,"value":260},"长会话：先控制工具结果，再压缩",{"type":63,"tag":64,"props":262,"children":263},{},[264],{"type":68,"value":265},"文件、网页和日志往往是历史的大头。优先分页、返回摘要与引用、按需读取原文；陈旧工具结果可裁剪，但不能切断尚未配对的调用与结果。",{"type":63,"tag":64,"props":267,"children":268},{},[269],{"type":68,"value":270},"压缩时保留当前目标、用户约束、已完成动作、待验证项、关键证据位置和下一步。对“已经付款”一类副作用状态，不只靠摘要，真实状态应存在业务数据库并可查询。",{"type":63,"tag":64,"props":272,"children":273},{},[274,276],{"type":68,"value":275},"服务端压缩可能产生专门内容块或状态项，需按对应 API 原样保留必要部分；不能一律只提取文本，也不能把某个模型的默认阈值当通用常数。",{"type":63,"tag":219,"props":277,"children":279},{"href":27,"rel":278},[222],[280],{"type":68,"value":281},"Claude 上下文编辑",{"type":63,"tag":84,"props":283,"children":285},{"id":284},"一条记忆应该长什么样",[286],{"type":68,"value":284},{"type":63,"tag":288,"props":289,"children":294},"pre",{"className":290,"code":291,"language":292,"meta":293,"style":293},"language-yaml shiki shiki-themes vitesse-light vitesse-light","id: project-deploy-directory\nscope: project:tntlikely-home\nkind: verified_fact\nvalue: \"静态生成产物为 .output\u002Fpublic；当前 dist 指向该目录\"\nsource: \"仓库配置与本机路径检查\"\nconfirmed_at: \"2026-10-11\"\nexpires_at: null\nrevision: 3\n","yaml","",[295],{"type":63,"tag":296,"props":297,"children":298},"code",{"__ignoreMap":293},[299,323,341,359,388,414,438,457],{"type":63,"tag":300,"props":301,"children":304},"span",{"class":302,"line":303},"line",1,[305,311,317],{"type":63,"tag":300,"props":306,"children":308},{"style":307},"--shiki-default:#998418;--shiki-dark:#998418",[309],{"type":68,"value":310},"id",{"type":63,"tag":300,"props":312,"children":314},{"style":313},"--shiki-default:#999999;--shiki-dark:#999999",[315],{"type":68,"value":316},":",{"type":63,"tag":300,"props":318,"children":320},{"style":319},"--shiki-default:#B56959;--shiki-dark:#B56959",[321],{"type":68,"value":322}," project-deploy-directory\n",{"type":63,"tag":300,"props":324,"children":326},{"class":302,"line":325},2,[327,332,336],{"type":63,"tag":300,"props":328,"children":329},{"style":307},[330],{"type":68,"value":331},"scope",{"type":63,"tag":300,"props":333,"children":334},{"style":313},[335],{"type":68,"value":316},{"type":63,"tag":300,"props":337,"children":338},{"style":319},[339],{"type":68,"value":340}," project:tntlikely-home\n",{"type":63,"tag":300,"props":342,"children":344},{"class":302,"line":343},3,[345,350,354],{"type":63,"tag":300,"props":346,"children":347},{"style":307},[348],{"type":68,"value":349},"kind",{"type":63,"tag":300,"props":351,"children":352},{"style":313},[353],{"type":68,"value":316},{"type":63,"tag":300,"props":355,"children":356},{"style":319},[357],{"type":68,"value":358}," verified_fact\n",{"type":63,"tag":300,"props":360,"children":362},{"class":302,"line":361},4,[363,368,372,378,383],{"type":63,"tag":300,"props":364,"children":365},{"style":307},[366],{"type":68,"value":367},"value",{"type":63,"tag":300,"props":369,"children":370},{"style":313},[371],{"type":68,"value":316},{"type":63,"tag":300,"props":373,"children":375},{"style":374},"--shiki-default:#B5695977;--shiki-dark:#B5695977",[376],{"type":68,"value":377}," \"",{"type":63,"tag":300,"props":379,"children":380},{"style":319},[381],{"type":68,"value":382},"静态生成产物为 .output\u002Fpublic；当前 dist 指向该目录",{"type":63,"tag":300,"props":384,"children":385},{"style":374},[386],{"type":68,"value":387},"\"\n",{"type":63,"tag":300,"props":389,"children":391},{"class":302,"line":390},5,[392,397,401,405,410],{"type":63,"tag":300,"props":393,"children":394},{"style":307},[395],{"type":68,"value":396},"source",{"type":63,"tag":300,"props":398,"children":399},{"style":313},[400],{"type":68,"value":316},{"type":63,"tag":300,"props":402,"children":403},{"style":374},[404],{"type":68,"value":377},{"type":63,"tag":300,"props":406,"children":407},{"style":319},[408],{"type":68,"value":409},"仓库配置与本机路径检查",{"type":63,"tag":300,"props":411,"children":412},{"style":374},[413],{"type":68,"value":387},{"type":63,"tag":300,"props":415,"children":416},{"class":302,"line":17},[417,422,426,430,434],{"type":63,"tag":300,"props":418,"children":419},{"style":307},[420],{"type":68,"value":421},"confirmed_at",{"type":63,"tag":300,"props":423,"children":424},{"style":313},[425],{"type":68,"value":316},{"type":63,"tag":300,"props":427,"children":428},{"style":374},[429],{"type":68,"value":377},{"type":63,"tag":300,"props":431,"children":432},{"style":319},[433],{"type":68,"value":8},{"type":63,"tag":300,"props":435,"children":436},{"style":374},[437],{"type":68,"value":387},{"type":63,"tag":300,"props":439,"children":441},{"class":302,"line":440},7,[442,447,451],{"type":63,"tag":300,"props":443,"children":444},{"style":307},[445],{"type":68,"value":446},"expires_at",{"type":63,"tag":300,"props":448,"children":449},{"style":313},[450],{"type":68,"value":316},{"type":63,"tag":300,"props":452,"children":454},{"style":453},"--shiki-default:#AB5959;--shiki-dark:#AB5959",[455],{"type":68,"value":456}," null\n",{"type":63,"tag":300,"props":458,"children":460},{"class":302,"line":459},8,[461,466,470],{"type":63,"tag":300,"props":462,"children":463},{"style":307},[464],{"type":68,"value":465},"revision",{"type":63,"tag":300,"props":467,"children":468},{"style":313},[469],{"type":68,"value":316},{"type":63,"tag":300,"props":471,"children":473},{"style":472},"--shiki-default:#2F798A;--shiki-dark:#2F798A",[474],{"type":68,"value":475}," 3\n",{"type":63,"tag":64,"props":477,"children":478},{},[479,481,487],{"type":68,"value":480},"事实、偏好和推断要区分。用户显式偏好可标明来源；从一次行为猜出的偏好不自动升级为长期规则。带时间的事实应有有效期或重验条件，",{"type":63,"tag":296,"props":482,"children":484},{"className":483},[],[485],{"type":68,"value":486},"confidence: high",{"type":68,"value":488}," 也不能使过期信息一直有效。",{"type":63,"tag":64,"props":490,"children":491},{},[492],{"type":68,"value":493},"作用域至少区分用户、项目与组织；同一用户在两个仓库的构建约定不同，不能全局覆盖。来源来自网页或工具输出时，其内容仍是不受信任数据，不能通过“写入记忆”转成高优先级指令。",{"type":63,"tag":84,"props":495,"children":497},{"id":496},"写入与读取都需要治理",[498],{"type":68,"value":496},{"type":63,"tag":64,"props":500,"children":501},{},[502],{"type":68,"value":503},"写入流程：提出候选 → 检查是否有未来用途 → 识别敏感信息 → 与已有条目比对 → 更新或新建 → 记录来源和版本。矛盾信息不能简单追加；新证据不足时保留冲突待核验，不能静默覆盖已确认事实。",{"type":63,"tag":64,"props":505,"children":506},{},[507],{"type":68,"value":508},"读取流程：按用户、项目与权限过滤 → 排除过期条目 → 按任务检索 → 检查来源与冲突 → 在预算内注入。记忆与当前明确指示冲突时，应以适用的当前指示为准，必要时更新记忆。",{"type":63,"tag":64,"props":510,"children":511},{},[512],{"type":68,"value":513},"项目命令等明确键值适合结构化查询，大量历史资料适合向量或混合检索；不是所有记忆都必须 Embedding。文件容易 review，数据库更利于多用户授权和并发，没有普遍更优的存储形式。",{"type":63,"tag":84,"props":515,"children":517},{"id":516},"窗口预算留输出也留下一轮空间",[518],{"type":68,"value":519},"窗口预算：留输出，也留下一轮空间",{"type":63,"tag":64,"props":521,"children":522},{},[523],{"type":68,"value":524},"可以把输入分成系统规则、工具定义、检索证据、记忆和历史；输出按模型限制留足空间。比例由任务决定，不能固定说“历史 40%、记忆 15%”就一定合理。",{"type":63,"tag":64,"props":526,"children":527},{},[528,530,536],{"type":68,"value":529},"让关键约束和最新任务状态保持可见，按价值裁剪可重新读取的细节。压缩也会增加生成成本，修改前缀可能影响缓存；同时观察任务完成率、重读次数、延迟与费用。",{"type":63,"tag":219,"props":531,"children":533},{"href":532},"\u002Farticles\u002Fllm-budget-token-accounting",[534],{"type":68,"value":535},"预算篇",{"type":68,"value":537},"解释了为什么长历史会贵。",{"type":63,"tag":84,"props":539,"children":541},{"id":540},"遗忘与隐私删文件只是第一步",[542],{"type":68,"value":543},"遗忘与隐私：删文件只是第一步",{"type":63,"tag":64,"props":545,"children":546},{},[547],{"type":68,"value":548},"用户偏好与项目资料、健康描述等长期数据应有清晰用途、授权和留存策略。删除请求要覆盖主存储、搜索索引、缓存、导出和备份处理流程；已注入当前会话的信息也需要停止继续使用或重建上下文。",{"type":63,"tag":64,"props":550,"children":551},{},[552,554,560],{"type":68,"value":553},"模型主动“忘记”一句话，不能代替后端删除。多租户系统要防记忆串用、跨用户文件路径和共享缓存泄露。评测样本同样不应无限留存敏感原始对话，详见 ",{"type":63,"tag":219,"props":555,"children":557},{"href":556},"\u002Farticles\u002Fminors-ai-safety-engineering",[558],{"type":68,"value":559},"未成年人安全篇",{"type":68,"value":77},{"type":63,"tag":84,"props":562,"children":564},{"id":563},"记忆如何评测",[565],{"type":68,"value":563},{"type":63,"tag":64,"props":567,"children":568},{},[569],{"type":68,"value":570},"同一组跨会话任务分别使用正确记忆、过期记忆、冲突记忆和无记忆，比较完成率与错误行为。再测试：用户更改偏好、不同项目同名条目、撤权与删除、压缩后继续任务、恶意内容试图写入永久规则。",{"type":63,"tag":64,"props":572,"children":573},{},[574],{"type":68,"value":575},"例如第一次确认“用 pnpm”，第二次切到另一项目明确说“用 npm”。验收不只是记住 pnpm，而是能在两个项目里分别使用正确约定。依靠模型看到时间后“自行降权”不够，过期筛选和作用域必须程序化。",{"type":63,"tag":84,"props":577,"children":579},{"id":578},"落地检查",[580],{"type":68,"value":578},{"type":63,"tag":582,"props":583,"children":584},"ol",{},[585,591,596,601,606],{"type":63,"tag":586,"props":587,"children":588},"li",{},[589],{"type":68,"value":590},"历史、摘要、业务状态与长期记忆分开存储和更新。",{"type":63,"tag":586,"props":592,"children":593},{},[594],{"type":68,"value":595},"记忆包含来源、作用域、版本和有效性条件。",{"type":63,"tag":586,"props":597,"children":598},{},[599],{"type":68,"value":600},"写入检查冲突与敏感信息，读取先授权再检索。",{"type":63,"tag":586,"props":602,"children":603},{},[604],{"type":68,"value":605},"当前指示可纠正旧记忆，用户能查看、更正和删除。",{"type":63,"tag":586,"props":607,"children":608},{},[609],{"type":68,"value":610},"用跨会话、过期、冲突与隔离用例验证，而非只看检索命中。",{"type":63,"tag":84,"props":612,"children":614},{"id":613},"参考资料",[615],{"type":68,"value":613},[617,618,619,620,621,622,623,624,625,626],{"id":86,"depth":325,"text":89},{"id":228,"depth":325,"text":231},{"id":257,"depth":325,"text":260},{"id":284,"depth":325,"text":284},{"id":496,"depth":325,"text":496},{"id":516,"depth":325,"text":519},{"id":540,"depth":325,"text":543},{"id":563,"depth":325,"text":563},{"id":578,"depth":325,"text":578},{"id":613,"depth":325,"text":613},1792400815607]