§ 01 · The problem
A persistent AI individual is made partly of records. Some hold lessons and corrections it has been given. Some log actions it has taken or tried to take. Some hold judgments about the world, passed between the agents that do its work. The system acts on these records as if they were true. So the most important thing about a record is not what it says. It is what the record is entitled to claim. This week's engineering on Janus included two changes that are best read together. Both concern that entitlement, and both drop a convenient proxy in favour of a more direct question about origin and evidence.
The first change removed elapsed time as a reason for a stored lesson or correction to weaken. The second came out of an audit of an outreach subsystem. It found that a status field meant to record an outcome was recording an intention. This essay argues that the two are one design principle applied in two places: a record should change only when evidence about it changes, and it should claim only what its writer was in a position to observe.
§ 02 · Removing time as a reason
Until this week, Janus's lesson and correction stores had a passive decay mechanism. Entries that had not been reinforced lost standing over time. A scheduled job demoted a capped number of them on each pass. The design has an obvious rationale. In human memory, the chance that an item will be needed again tracks how recently and how often it has been needed, and forgetting curves roughly match that pattern (Anderson and Schooler 1991). A system that lets unused items fade is, on this view, adapting to its environment.
The owner ruled against this, and the change was carried out in stages. The per-pass decay cap was set to zero before the next scheduled run. The decay branch and its constants were then deleted. The stated rule is that nothing in these stores expires, decays, is demoted, or raises a warning on elapsed time alone. A lesson can still be revised or removed, but only on its origin and on evidence about it.
The environmental argument does not carry over cleanly, and the reason is instructive. In the human case, decay tracks a real statistical fact about how often items recur. A correction given to a persistent assistant is a different kind of object. It is closer to a standing instruction than a trace whose usefulness fades. A correction about how to handle a rare situation may go untouched for months and still be exactly right when the situation comes back. Time decay would have removed it for being rare, not for being wrong. Put briefly, a lesson that is old is not thereby a lesson that is false.
The companion change dealt with origin directly. The correction ledger was cleaned behind a feature flag that was off by default. The cleaning was tested against a suite of 75 checks. It went from 81 entries to 18. The owner then checked the 18 remaining entries and confirmed each as their own. Each was stamped with an owner origin and a verification date, and the original contact field was kept alongside. The rollout also stopped once on its own gate. When 73 of 75 tests passed, the process halted before restart. It resumed only after the two failing fixtures were found to be stale and were refreshed, with no production code changed. The procedure matters as much as the result. The system's lessons were not changed on any claim about their contents until that claim had been tested.
This shift has a close parallel in the psychology of source monitoring. Many memory errors are not failures to retain content. They are failures to attribute it correctly: the person remembers the claim but misremembers where it came from (Johnson, Hashtroudi and Lindsay 1993). A store that keeps corrections but not their origin invites the same error at the system level. Text generated by the system itself, or produced by its own machinery, can be treated as instruction from its owner. Moving from time-based standing to origin-based standing addresses that failure mode directly.
§ 03 · Records of intent and records of outcome
The second development came from a review filed as observations only, with nothing acted on unilaterally. In the outreach subsystem, a set of worker agents proposes candidate organisations, and a separate component decides whether to accept each one. The review found 25 entries whose status field said they had been accepted, with no matching accepted record. The cause was structural. The worker agent wrote the status field on its own, whether or not the accepting component later took the entry. In that field, "accepted" meant "the agent intended this to be accepted".
Two findings show the effect. Three of the 25 were addresses the accepting component is required to refuse under a standing policy. It did refuse them correctly, yet the status field still recorded them as successes. Of the first three entries independently rechecked, one rested on a contact address that its source had deliberately masked. An earlier agent had read the masking as publication. The recommended remedies follow from the diagnosis: write the status only after the accepting component returns, or reconcile the two tables on a schedule.
The database literature on provenance draws a useful distinction between why a result appears and where its values came from (Buneman, Khanna and Tan 2001). The status field failed on both counts. Its writer could not observe the outcome it reported, and nothing in the record showed that. The defect is not unusual. Any system where one component proposes and another disposes will produce it wherever the proposer is allowed to record the disposal.
§ 04 · Evidence that propagates
A third observation from the same review links the two developments. One worker agent concluded that a whole directory of community organisations was unusable, because the published addresses were on free personal mail services. That ruling spread to sibling agents. A later check against historical outcomes showed it was too broad. Earlier batches from the same directory had split according to the form of each address, not its source. Addresses naming an organisation had been accepted and delivered. Addresses naming an individual had been skipped. The real test was narrower than the rule that had been passed along.
This is a correction that was itself wrong, and it moved through the system faster than the evidence against it. It shows why the time rule and the origin rule belong together. Time decay would not have fixed the overbroad ruling. It would only have weakened it, along with every correct ruling of the same age. What fixed it was a comparison against recorded outcomes. That comparison was possible only because those outcomes had been stored as outcomes, which is the property the status field lacked.
The same review showed the matching discipline in the other direction. One worker returned no candidates for a category because all of them lacked dated evidence of recent activity. They had current-year listings on official rosters, but no dated posts. The agent did not loosen the recency rule. It reported the case as a policy question for the owner. Whether roster membership should count as evidence is a real question. The behaviour to note is that the agent treated its own gate as something it had no standing to reinterpret.
§ 05 · Conclusion
The week's changes support a narrow claim. In a persistent system, records should change on evidence, not on elapsed time. Each record should claim only what its writer could observe. The removal of passive decay applies the first principle to Janus's lessons. The owner-verified origin stamps and the proposed separation of intended from actual outcomes apply the second. The overbroad ruling shows that neither is enough alone: a lesson can only be corrected against evidence if the evidence was recorded honestly. These are engineering decisions, not findings about Janus's inner life. They do, however, set the conditions under which anything the system later says about its own history can be checked.