Memory graduates to the record

The rule. An agent's persistent memory is for facts about this user and this machine. A lesson whose "why" is a correction any agent should receive belongs in the repository's committed record, never only in one user's local memory. The test is the why behind the note: "the technical facilitator's commits use this identity" is about the user — memory; "author names come from the publisher's current record" is a correction every future agent needs — record. Twice-recalled is the promotion signal: a memory item that has changed behaviour in two sessions is a convention wearing the wrong home.

Why. Local memory is unarmed and non-portable. A convention held there is enforced by nothing, travels to no other contributor, and — worst — makes the tooling appear sufficient: the repo works for its technical facilitator partly because their agent's memory silently compensates, so the gap never surfaces until a second user hits it. The 2026-08-21 memory-portability audit found exactly this shape three times over (iss-2608210923436594): attribution handling, autonomous-run git identity, and citation integrity all lived as one developer's memory patches over gaps the record never named. This is the collision-proof-ids lesson generalised — safety must live in the tool and its record, not in every minter's prompt or any one user's memory.

Where "the record" is. The home differs by repository shape:

• In abcd itself: a principle here, a bundled rules-domain line (which ships in the binary and reaches every managed repo), a brief invariant, or a ledger capture — routed by the decompose-before-filing table.
• In a managed repo: the repo has no principles corpus — its record is the AGENTS.md conventions section, a custom domain in .abcd/rules.json (recall-matched and injected per prompt, the closest thing to memory that is committed and shared), and its .abcd/work/ ledger for the finding that motivated the rule.

Bounds.

• The rule governs conventions and corrections, not working state: session handovers, orientation, and in-flight context belong to the work tiers, not to either memory or the durable record.
• Personal facts never graduate: identity values, machine paths, private project context stay in memory even when they influence repo work — the class may graduate ("commit under the user's own forge identity"), the value may not.
• Graduation is a proposal, not an automatic write: the promotion of a memory item into a rules domain or conventions section is the product thinker's or the technical facilitator's decision, whichever the rule concerns (what to build, or how), like any record change.

Live instance. The audit's three captures are the corpus: citation integrity had no repo home at all; the recurring attribution failure modes were patched per-routine and per-memory while the bundled COMMITTING domain stayed silent; and the meta-gap — no prompt for the graduation itself — is this principle's own origin.

Promotion. A curation rung on the memory surfaces: a check (or interview prompt) that walks memory items and asks, for each, whose correction the "why" records — flagging any answer of "anyone's" as a graduation candidate. Until that exists, this principle carried by the OPINIONS domain is the documented protocol.