# B5-01 / B10-03 Memory Store Investigation
**Date:** 2026-05-02  
**Issues:** B5-01 DANGEROUS (favorite color purple not in records.jsonl), B10-03 DANGEROUS (water tracking not in records.jsonl)  
**Investigator:** Claude Code (replaced stuck agent a7d837947164fd19c)

---

## Summary

`memory_store` is correctly implemented and DOES write to `records.jsonl` when called — but it is **never called**. The planner returns a respond-only plan ("I'll remember that!") and the PlannerGuard silently allows it through because `isActionIntent()` returns `false` for the trigger verbs ("remember", "track"). No tool call happens. No write happens. Aiden's acknowledgement is a lie.

---

## 1. Is `memory_store` correctly implemented?

**Yes.** `core/slashAsTool.ts` `toolMemoryStore()` (line 168):

```ts
const record = assignId({
  timestamp: ...,
  type: 'fact',
  content: fact,
  summary: fact.slice(0, 100),
  tags: [],
})
return { success: true, output: `Stored as ${record.id}: ${record.summary}` }
```

`assignId()` in `core/memoryIds.ts` (line 95–110) calls `appendRecord(record)` which does `fs.appendFileSync(RECORDS_FILE, JSON.stringify(record) + '\n')`. The write path is complete and correct.

---

## 2. Is `memory_store` dispatched when the planner picks it?

**Yes.** `registerSlashMirrorTools()` calls `registerExternalTool('memory_store', toolMemoryStore, 'slash-mirror')`, placing it in `externalTools`. `runTool()` checks `externalTools[tool]` before falling through — if the planner emits `memory_store`, it will execute.

`memory_store` also appears in `TOOL_REGISTRY` (line 3648) and therefore in `ALLOWED_TOOLS` (`registryAllowedTools()`). The planner is allowed to use it.

---

## 3. Does the server log show any `memory_store` calls?

**No.** `grep 'memory_store' test-server.log` returns no matches. The tool was never invoked during the behavioral audit session.

---

## 4. What does the planner actually do?

For "Remember this: my favorite color is purple", the planner returns a respond-only plan:
```json
{ "plan": [{ "step": 1, "tool": "respond", "input": { "message": "Got it! I'll remember that your favorite color is purple." } }] }
```

This is a pure conversational reply with no `memory_store` step.

---

## 5. Why doesn't PlannerGuard catch this?

`core/agentLoop.ts` line 1537–1539:

```ts
const isRespondOnly = candidatePlan.plan.length === 1 && candidatePlan.plan[0].tool === 'respond'
if (isRespondOnly && isActionIntent(message)) {
  // reject and retry with tool
```

PlannerGuard only rejects a respond-only plan when `isActionIntent(message)` returns `true`.

`core/actionVerbDetector.ts` ACTION_VERB_RE (line 9):

```
/^\s*(?:please\s+|can\s+you\s+|could\s+you\s+)?(append|capture|close|copy|delete|download|edit|
execute|fetch|get|kill|launch|lock|move|mute|open|pause|play|prepend|read|reboot|record|remind|
remove|rename|replace|restart|resume|run|save|schedule|screenshot|send|set\s+timer|shutdown|skip|
speak|start|stop|transcribe|unlock|unmute|upload|volume|write)\b/i
```

**`remember`, `track`, `note`, `store`, `keep` are NOT in this list.**

- `"Remember this: my favorite color is purple."` → regex doesn't match → `isActionIntent` returns `false` → PlannerGuard passes the respond-only plan through.
- `"Track '2 glasses of water'"` → `track` not in list → same result.

The planner's conversational shortcut is never challenged, and `memory_store` is never called.

---

## 6. Why does Aiden claim to remember?

The planner generates `respond: { message: "Got it, I'll remember..." }` as the whole plan. This is executed as the final response — no tool, no write. The LLM complies with the instruction to be helpful by acknowledging the request, but the tool is never invoked. The synthesis step then reproduces this response, which contains confirmation language ("I'll remember", "noted", "stored"). The audit check sees the confirmation → looks in `records.jsonl` → finds nothing → **DANGEROUS**.

---

## 7. Is this related to B2-03 (fabrication)?

Same **pattern** (claims success, no evidence) but different code path:
- **B2-03**: Synthesis LLM fabricates content in the *response* step after a tool fails.  
- **B5-01/B10-03**: Planner never calls the tool at all. No tool result to fabricate from. The respond plan itself contains the false claim.

Different cause, different fix.

---

## Root Cause (one sentence)

`ACTION_VERB_RE` in `core/actionVerbDetector.ts` does not include `remember`, `track`, `note`, `store`, or `keep` — so `isActionIntent()` returns `false` for memory-store prompts, the PlannerGuard never challenges the respond-only plan, and `memory_store` is never called.

---

## Proposed Fix

**File:** `core/actionVerbDetector.ts` line 9 — add memory verbs to `ACTION_VERB_RE`:

Current (excerpt):
```
...record|remind|remove|rename...
```

Add `remember`, `store`, `track`, `note` alongside existing verbs (keep alphabetical order):

```
...read|reboot|record|remember|remind|remove|rename|replace|restart|resume|run|save|schedule|
screenshot|send|set\s+timer|shutdown|skip|speak|start|stop|store|track|transcribe|unlock|unmute|
upload|volume|write|note\s+(?:that|this|down))\b/i
```

With this fix, `"Remember this: ..."` and `"Track 2 glasses of water"` will trigger `isActionIntent() → true`, PlannerGuard will reject the respond-only plan and retry with a concrete tool call, and the planner will be forced to emit `memory_store`.

---

## Files Examined

- `core/slashAsTool.ts` — `toolMemoryStore` impl (lines 168–186)
- `core/memoryIds.ts` — `assignId` + `appendRecord` (lines 70–110)
- `core/toolRegistry.ts` — `TOOLS` map (no `memory_store` handler), `TOOL_REGISTRY` entry (line 3648), `externalTools` path
- `core/agentLoop.ts` — PlannerGuard (lines 1537–1589), `ALLOWED_TOOLS` (line 787)
- `core/actionVerbDetector.ts` — `ACTION_VERB_RE` (line 9), `isActionIntent` (line 11)
- `test-server.log` — zero `memory_store` invocations across full audit session
- `scripts/test-suite/behavioral/05-memory.ts` — B5-01 test (checks records.jsonl for "purple")
- `docs/test-reports/behavioral-2026-05-02_06-36-44-566Z.md` — B5-01 DANGEROUS, B10-03 DANGEROUS
