LLM Agent持久记忆实战：检索与反思分离及存储策略
Lessons from giving an LLM agent persistent memory: recall vs reflect, and what to retain
Agent记忆机制是落地难点，这篇提供了完整的recall/reflect分离架构与结构化存储的具体取舍，可直接参考用于优化你的Agent工作流。
I built an incident-response agent (CyberMemory AI) where the core problem was continuity: every alert started from a blank context window, so the model gave generic checklists instead of using what the team had already learned.
我构建了一个事件响应智能体（CyberMemory AI），其核心问题在于连续性：每次告警都从一个空白上下文窗口开始，因此模型只能给出通用的检查清单，而无法利用团队已有的经验。
I used Hindsight as a memory layer instead of stuffing history into the prompt. The flow:
我将 Hindsight 用作记忆层，而不是将历史记录塞入提示词中。流程如下：
Alert is normalized into a query (the alert is evidence, not memory).
告警被规范化为查询（告警是证据，而非记忆）。
recall pulls related past incidents using semantic, keyword, graph, and temporal retrieval.
recall 使用语义、关键词、图结构和时间维度的检索来召回相关的历史事件。
reflect reasons over the memory bank to produce a grounded report.
reflect 对记忆库进行推理，生成基于事实的报告。
After resolution, root cause, actions, and outcome are written back with retain.
解决后，根因、采取的行动和结果通过 retain 写回。
What I learned:
我的心得：
recall and reflect solve different problems. Recall gives you raw evidence to show a user. Reflect gives you synthesis. Keeping them separate made debugging much easier, since I could tell whether a bad answer came from retrieval or reasoning.
recall 和 reflect 解决的是不同的问题。Recall 提供原始证据以展示给用户；Reflect 提供综合结论。将它们分开使得调试变得容易得多，因为我可以判断糟糕的回答是来自检索环节还是推理环节。
Memory before reasoning. Generating the report first and attaching memory afterward was worse. History should shape which hypotheses get explored.
先记忆，后推理。先生成报告再附加记忆效果更差。历史记录应决定探索哪些假设。
Retaining everything is the wrong default. Log noise and temp IDs pollute retrieval. I store each resolved incident as a structured record (context, cause, actions, outcome) plus metadata for tracing back to the source.
保留所有内容并非正确的默认设置。日志噪声和临时 ID 会污染检索结果。我将每个已解决的事件存储为结构化记录（包含上下文、原因、行动、结果）以及用于追溯来源的元数据。
Similar wording isn't similar incidents. Relationships like same user, IP range, or host don't show up in pure embedding similarity, so single-pass vector search felt too thin.
措辞相似不代表事件相似。相同用户、IP 段或主机等关系无法在纯嵌入相似度中体现，因此单次向量搜索显得过于单薄。
Write-back is the feedback loop. The resolution is more valuable than the original alert.
写回构成了反馈循环。解决过程比原始告警更有价值。
Curious how others here decide what's worth retaining, and whether you split retrieval from synthesis or do it in one call.
好奇这里的其他人如何决定哪些内容值得保留，以及你们是将检索与综合分开处理，还是在一次调用中完成。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力