The most important architectural boundary here is that memory should be allowed to improve the agent’s decisions without ever becoming the authority for what the agent is permitted to do. That separation makes rollback, auditing, and failure analysis much easier because a bad memory update can be rejected without weakening the policy layer.

I’d also treat memory_version as part of the decision provenance, alongside model and policy versions. Otherwise, when behavior changes, it becomes difficult to distinguish “the model improved” from “the agent simply remembered a different lesson.” That distinction becomes critical once memory updates happen continuously rather than as occasional manual changes.