Deterministic Memory Management (DMM)

• Deterministic Memory Management (DMM) is an approach that ensures reproducible memory behavior by making allocation and state transitions explicit and verifiable.
• It spans systems from real-time multicore architectures to AI engines, utilizing techniques like fixed-point arithmetic and append-only event logs to enforce determinism.
• DMM improves system reliability and auditability by reducing hidden mutable state and isolating critical memory operations, enabling precise timing and cross-platform consistency.

Deterministic Memory Management (DMM) denotes a family of approaches that make memory state, allocation behavior, or memory-derived decisions reproducible and inspectable rather than path-dependent, schedule-dependent, or hardware-sensitive. In the literature, the term ranges from a cross-layer memory abstraction that gives selected pages small and tightly bounded worst-case access delay in multicore real-time systems (Farshchi et al., 2017), to a static coeffect discipline that resolves allocation strategy from escape and lifetime information in a Program Semantic Graph (Haynes, 17 Mar 2026), to deterministic AI memory substrates and agent-memory architectures that replace repeated mutable updates with replayable state machines, immutable logs, or fully deterministic scoring pipelines (Gudur, 25 Dec 2025, Srinivasan, 22 Apr 2026, Stabile et al., 2 Jun 2026). Across these lines of work, memory is treated not only as a storage resource but as a substrate for replay, audit, isolation, verification, and bounded interference.

1. Conceptual scope and recurring principles

A central theme in DMM research is that memory behavior must be made explicit at the layer where correctness or accountability is required. In multicore real-time systems, this means making memory criticality a first-class property rather than allowing the OS and hardware to treat all pages uniformly (Farshchi et al., 2017). In deterministic AI memory substrates, it means enforcing determinism at the memory boundary even if upstream neural inference remains non-deterministic (Gudur, 25 Dec 2025). In enterprise agent systems, it means structuring memory so that deterministic replay, auditable rationale, multi-tenant isolation, and statelessness for horizontal scale remain attainable under regulated operating conditions (Srinivasan, 22 Apr 2026).

These works converge on several architectural motifs. One is the reduction of hidden mutable state. Deterministic Projection Memory (DPM) uses an append-only event log and defers memory materialization to a single task-conditioned projection at decision time, so memory is not repeatedly rewritten during the trajectory (Srinivasan, 22 Apr 2026). Valori uses a pure state-machine model in which deterministic commands transform a deterministic kernel state (Gudur, 25 Dec 2025). The compilation framework of Dimensional Type Systems and Deterministic Memory Management treats allocation strategy as coeffect metadata that is inferred, preserved, and verified rather than left to opaque backend heuristics (Haynes, 17 Mar 2026).

A second motif is boundary control. The enterprise-agent literature argues that stateful architectures violate replayability and auditability by construction because a single decision becomes the product of many path-dependent update steps (Srinivasan, 22 Apr 2026). Valori makes an analogous argument at the numeric level: identical models, inputs, and code can still produce different raw embedding bits across architectures, so the memory state can fork at creation time unless normalization happens immediately at the kernel boundary (Gudur, 25 Dec 2025). The security literature reaches a similar conclusion for memory protection: deterministic tagging with ARM MTE relies on compile-time-determined tag discipline rather than random tags or secrecy, so that safe allocations remain protected even under arbitrary read/write memory disclosure (Liljestrand et al., 2022).

2. Systems, language, and compiler formulations

The real-time systems formulation of DMM defines deterministic memory as “a special memory space for which the OS and hardware guarantee small and tightly bounded worst-case access delay,” in contrast to best-effort memory, for which only highly pessimistic worst-case bounds are possible (Farshchi et al., 2017). Its key abstraction is a page-level deterministic/best-effort distinction carried through the page table by a DM bit and propagated through the MMU, TLB, cache, and DRAM controller. Applications mark pages or regions as deterministic, the OS allocates those pages differently, and the hardware applies different cache and DRAM scheduling rules. The formal task model is

$\tau_i = \{C_i, T_i, D_i, DM_i, BM_i\},$

with worst-case memory interference

$I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$

This makes memory criticality analyzable within response-time analysis rather than treating interference as an undifferentiated platform artifact (Farshchi et al., 2017).

That work also emphasizes selective deployment. On the reported benchmarks, only 38% of touched pages are critical on average, and if one considers the pages responsible for 90% of L1 misses, the fraction drops to 23% on average. DMM therefore aims to reserve strong timing isolation only for the pages that dominate worst-case execution time, while allowing best-effort reuse elsewhere. In the cache study, best-effort bzip2 improves its hit rate by 39% on average under DMM versus ordinary way partitioning, while deterministic cache-line usage falls to about 49% in DM(A), 27% in DM(T98), and 21% in DM(T90) (Farshchi et al., 2017).

Adjacent OS-level work pursues predictability through contention control even when it does not use DMM as its central label. Vertical partitioning eliminates shared-resource contention across LLC and DRAM banks by exploiting overlapping physical-address bits, and reports up to 11% performance gains over prior techniques (Liu, 2017). An N-level adaptation of the Aging paging algorithm routes colder pages to lower levels according to the number of leading zeros in the aging counter and is reported to yield the best Hit/Miss behavior in the DeMemory simulator (Oren, 2017). These systems are predictability-oriented rather than identical in formal scope, but they share the DMM premise that memory placement policy should be architecture-aware and explicit.

Language-level antecedents show a parallel movement from runtime recovery toward compile-time or structurally deterministic allocation. Region-based memory management for Mercury uses strong type, mode, and determinism systems to infer regions and insert create and remove operations at compile time; compared with the base Mercury system with the Boehm runtime garbage collector, it is faster on 15 out of 18 benchmarks, with an average runtime speedup of 24% and an average reduction in memory requirements of 95% (Phan et al., 2012). In reversible computing, ROOPL++ adds dynamic allocation, deallocation, arrays, and multiple references while preserving invertibility, and ultimately selects Buddy Memory because allocation and deallocation must remain deterministic and reversible (Cservenka, 2018).

The most formal compiler-level DMM treatment appears in the Program Semantic Graph framework, where DMM is defined as a coeffect discipline. Allocation strategy is a contextual requirement, and lifetime propagation follows

$$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$

with the lifetime order

$$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$

Escape analysis is refined beyond a binary escape/no-escape distinction into four categories, each mapped to a verified allocation strategy (Haynes, 17 Mar 2026).

Escape classification	Allocation strategy	Lifetime bound
StackScoped	Stack (memref.alloca)	Lexical scope
ClosureCapture(t)	Arena (closure environment)	Lifetime of closure $t$
ReturnEscape	Arena (caller’s scope)	Caller’s scope
ByRefEscape	Arena (parameter origin)	Origin scope of reference

This framework ties dimensional inference, representation selection, word width, memory footprint, allocation strategy, and cross-target transfer fidelity into a single compilation graph. A value’s representation affects its footprint; the footprint affects stack eligibility, arena placement, and cache locality; and those choices are carried as codata through MLIR lowering and later revalidated by SMT-based translation validation (Haynes, 17 Mar 2026).

3. Deterministic memory substrates and numeric normalization

Valori formulates DMM at the memory-kernel level for AI systems. Its starting claim is that conventional embedding memories are not replayable across hardware because the failure happens before indexing or retrieval: identical models, inputs, and code can still produce different raw embedding bits on architectures such as x86_64 and ARM64. The paper identifies Fused Multiply-Add differences, non-associativity of floating-point addition, and SIMD or auto-vectorization differences across AVX, AVX-512, and NEON as concrete sources of divergence (Gudur, 25 Dec 2025). In the reported experiment using sentence-transformers/all-MiniLM-L6-v2, the first five dimensions of saved embeddings differ at the raw-hex level across an x86_64 Windows PC and an ARM64 MacBook Pro, even though cosine similarity remains above 0.9999.

Valori responds by moving determinism to the memory boundary. External outputs are normalized when they enter the kernel; inside the kernel all memory operations are deterministic; and the kernel itself is a pure state machine:

$S_{t+1} = F(S_t, C_t).$

Deterministic memory is defined as

$$\forall \text{Env}_A, \text{Env}_B : \text{Apply}(S_0, \{C_i\})|_A \equiv \text{Apply}(S_0, \{C_i\})|_B.$$

The implementation is a no_std Rust kernel runnable on bare metal, WASM, or standard operating systems, with fixed-point conversion, indexing math, snapshotting and restore, and deterministic graph construction all inside the kernel boundary (Gudur, 25 Dec 2025).

The numeric mechanism is Q16.16 fixed-point arithmetic: 32-bit signed integers with the lower 16 bits fractional, range $[-32768, 32767]$, and resolution approximately $0.000015$. Addition and subtraction are integer operations, dot-product accumulation uses i64 or wider intermediates, and results are narrowed back to stored Q16.16 format. For ANN search, Valori fixes HNSW entry points to the first inserted node (ID 0), processes batch insertions in verified sorted order, removes stochastic decisions, and uses fixed-point distance metrics, so graph topology becomes identical across runs (Gudur, 25 Dec 2025).

The reported guarantees are bit-identical memory states, snapshots, and search results across x86, ARM, RISC-V, and WASM. In the snapshot transfer test, an x86 kernel inserts 10,000 vectors, snapshots to file with hash $H_A$, transfers the snapshot to ARM, and restores a state with identical hash $I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$0, while k-NN result ordering remains identical across platforms. The performance section reports raw retrieval latency below 500 $I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$1s for typical k-NN queries on a MacBook Pro M3, and the quantization study reports Recall@10 = 0.998 for Valori versus 1.000 for a float32 HNSW baseline (Gudur, 25 Dec 2025). The paper is explicit, however, that it does not make neural inference deterministic; its guarantee begins after vectors enter the kernel, and Q16.16 trades dynamic range and throughput for reproducibility.

4. Stateless and non-generative memory for AI agents

In enterprise decision agents, DMM is expressed as a rejection of mutable stateful memory in favor of replayable, auditable, and isolated memory surfaces. DPM stores the full interaction trajectory as an immutable append-only event log

$I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$2

and produces memory only at decision time through a single task-conditioned projection

$I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$3

The projection is emitted at temperature zero, organized into fixed sections—facts, reasoning, and compliance notes—and instructed to preserve numeric anchors verbatim, cite event indices, and emit “unknown” when needed. The consolidation operator is effectively the identity: no memory is rewritten during the trajectory, and memory does not exist as a mutable runtime object until the final projection call (Srinivasan, 22 Apr 2026).

The replay claim is formalized as Proposition 1: if the backend $I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$4 is deterministic, then identical inputs $I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$5 yield identical outputs. The empirical evaluation uses LongHorizon-Bench with ten regulated decisioning cases—five mortgage qualification cases under ECOA/Reg B and five insurance claims adjudication cases—each around 26,000–28,000 characters and roughly 82–96 discrete events. Against an incremental summarization baseline called Summ-only, DPM and Summ-only are statistically indistinguishable at moderate and loose budgets, but at the tight 20$I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$6 compression ratio DPM improves factual precision from 0.392 to 0.907, a gain of $I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$7 with Cohen’s $I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$8 and $I_i = DM_i \times RD^{dm} + BM_i \times RD^{bm}.$9, and improves reasoning coherence from 0.267 to 0.800, a gain of $$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$0 with $$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$1 and $$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$2 (Srinivasan, 22 Apr 2026). Runtime follows the same structure: DPM makes one LLM call at decision time rather than one per event plus a final decision call, yielding about 7.4$$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$3 speedup at tight budget and 14.9$$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$4 at moderate budget. The audit surface is similarly compressed: DPM logs one projection call and one decision call, while Summ-only logs about 83–97 surfaces for trajectories of 82–96 events.

The paper’s broader claim is that enterprise deployment remains “load-bearing” on deterministic replay, auditable rationale, multi-tenant isolation, and statelessness for horizontal scale, and that this hidden systems requirement explains why regulated deployments prefer weaker but replayable retrieval pipelines over academically richer stateful memory architectures (Srinivasan, 22 Apr 2026). The TAMS heuristic codifies this position: if a deployment requires deterministic replay, audit-ready rationale, or multi-tenant isolation, use DPM; otherwise, if the compression ratio exceeds about $$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$5, DPM is still preferred.

Conversational AI work arrives at a different but related architecture. DMF eliminates LLM calls from the memory-management loop and replaces generative summarization with a CPU-first deterministic pipeline based on classical NLP analysis, vector geometry, and mathematical scoring. Each interaction receives a Survival Score

$$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$6

where $$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$7 combines content signals, conversational cues, and provenance, and relevance decays by interaction count rather than wall-clock time:

$$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$8

The archival source of truth is always the raw interaction record; cards are auxiliary deterministic projections. On LoCoMo and LongMemEval, DMF achieves comparable accuracy to Mem0 while using zero tokens to prepare the memory context and 5$$\text{If } \lambda_{\text{required}(v, \text{use}_i)} > \lambda_{\text{tentative}(v)} \text{ for any use } i, \text{ then } \lambda(v) := \max_i\bigl(\lambda_{\text{required}(v, \text{use}_i)}\bigr),$$9 to 242$$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$0 fewer tokens over the entire conversation (Stabile et al., 2 Jun 2026). This suggests a second DMM trajectory in AI: rather than making write-time summarization more stable, remove it from the memory loop entirely.

5. Isolation, trust boundaries, and memory safety

A security-oriented interpretation of DMM treats explicit memory management as a mechanism for controlling what untrusted state may contaminate trusted state. AgentSys applies this idea to indirect prompt injection. Conventional agents monotonically accumulate all tool outputs and reasoning traces in the main context, which lets injected instructions persist and repeatedly influence later decisions. AgentSys instead organizes agents hierarchically: a main agent spawns worker agents for tool calls, external data and subtask traces remain inside worker contexts, and only schema-validated return values may cross back to the main agent through deterministic JSON parsing (Wen et al., 7 Feb 2026).

The memory boundary is intentionally narrow. The main agent issues a tool call with an intent schema $$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$1, the worker receives only the raw tool output, the intent, and a compact tool-call trace, and the parent accepts only a return value conforming to the predeclared schema. Validator decisions are computed from trusted inputs—the original user query, the compact call trace, and a proposed subcall—not from raw tool outputs. When a validator denies a worker’s proposed command, AgentSys runs a bounded sanitize–restart loop $$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$2, where instruction-like spans are removed while task-relevant data are preserved (Wen et al., 7 Feb 2026). On AgentDojo with GPT-4o-mini, full AgentSys reports 64.36% benign utility, 52.87% attacked utility, and 0.78% attack success rate, versus 63.54%, 48.27%, and 30.66% for the undefended baseline; the ablation without validator and sanitizer, which keeps only hierarchical memory isolation, still reaches 2.19% ASR (Wen et al., 7 Feb 2026).

At the lower-level memory-safety boundary, deterministic tagging with ARMv8.5-A MTE replaces probabilistic tag assignment with a compile-time-determined tagging policy. Allocations are classified as implicitly safe, provably safe, guarded, or unsafe; safe allocations use the default safe tag, unsafe allocations use the unsafe tag, and pointers loaded from unsafe or pointer-unsafe memory are forced to the unsafe tag before use. Because address tags are normalized by instrumentation, an attacker with arbitrary read/write access cannot exploit knowledge of tag values to forge access into safe allocations (Liljestrand et al., 2022). The LLVM/Clang implementation extends StackSafetyAnalysis with a FunctionPass and a ModulePass, instruments pointer loads and arithmetic, and reports a 13.6$$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$3 geometric-mean runtime overhead, a 21.7$$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$4 geometric-mean code-size overhead, and a 19.3$$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$5 geometric-mean stack-frame overhead on SPEC CPU 2017 C benchmarks (Liljestrand et al., 2022).

These security-oriented systems do not all use identical formal vocabulary, but they share a common DMM intuition: memory safety and memory integrity improve when the admissible state transition is determined by a narrow, explicit, and verifiable boundary rather than by open-ended accumulation of mutable state.

6. Concurrency, determinacy, and decision-theoretic critiques

PSM places DMM in the setting of concurrent shared mutable state. It introduces a type context for policy synchronised memory in Haskell in which computations can access persistent state and update it imperatively, yet concurrent accesses are policy coordinated so that well-typed transactions are race-free and deterministic by construction (Mendler et al., 18 Jun 2025). The policy interface specifies admissibility and precedence relations for methods on a PSMVar, and scheduling is mediated by an enabled predicate that checks whether a method is admissible in the current object state and whether any higher-precedence predicted method remains outstanding. The paper’s ACS principle requires atomicity, confluence, and stability, and its main theorem states that if all PSM variables occurring in a term are coherent, then the reduction relation is confluent; moreover, if $$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$6 and $$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$7, then $$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$8 (Mendler et al., 18 Jun 2025).

This line of work is important because it addresses a standard objection to deterministic memory: the claim that determinacy is incompatible with destructive update under concurrency. PSM’s answer is not to ban mutation, but to make shared accesses pass through a policy-bearing abstract data structure, publish conservative predictions of future accesses, and synchronize them at clock barriers. The paper illustrates this with PTVar, PMVar, PTSig, and PStrIO, all designed to remain concurrently shareable and deterministic (Mendler et al., 18 Jun 2025).

A different critique comes from decision theory. DAM argues that memory management for LLM agents should be treated as a sequential decision-making problem under uncertainty rather than as a bag of ad hoc deterministic heuristics such as recency cuts, similarity thresholds, or periodic summarization (Sun et al., 25 Dec 2025). It decomposes memory into a read policy $$\text{stack} < \text{arena} < \text{heap} < \text{static}.$$9, write sub-policies for add and delete, value estimators $t$0, uncertainty estimators $t$1, and an aggregate policy $t$2 that balances expected long-term utility against uncertainty and feasibility constraints. The paper’s explicit claim is that deterministic rules are not wrong because they are deterministic; they are inadequate when they are not decision-theoretic (Sun et al., 25 Dec 2025). A plausible implication is that future DMM systems may need to be both deterministic and uncertainty-aware: deterministic in execution, but grounded in explicit long-horizon objectives rather than static heuristics.

7. Empirical themes, limitations, and open problems

Taken together, these papers suggest that DMM succeeds when it minimizes mutable-state surfaces, normalizes data at a trusted boundary, and restricts determinism to the layer where verification is possible. DPM reduces replay complexity from $t$3 stochastic memory-update calls to a single projection call (Srinivasan, 22 Apr 2026). Valori reduces cross-platform divergence by converting floats to fixed-point immediately at the kernel boundary (Gudur, 25 Dec 2025). Compiler-level DMM resolves allocation statically from verified escape information (Haynes, 17 Mar 2026). Real-time DMM applies strong guarantees only to pages that matter most to worst-case timing (Farshchi et al., 2017). The common pattern is selective determinization rather than universal elimination of all uncertainty.

The limitations are equally consistent. DPM shows that temperature zero on a live API does not guarantee strict byte determinism; its determinism study reports residual API-level nondeterminism, and the paper therefore recommends pairing DPM with a pinned deterministic backend or self-hosted deterministic inference runtime for true bit-exact replay (Srinivasan, 22 Apr 2026). Valori guarantees determinism only after vectors enter the kernel and notes limited dynamic range and software fixed-point overhead as trade-offs of Q16.16 (Gudur, 25 Dec 2025). DMF is English-first, uses fixed calibration by default, and relies on conservative card projections rather than full semantic parsing (Stabile et al., 2 Jun 2026). The PSG-based compiler framework requires sound escape classification, lifetime reasoning, target-memory topology, and verification across lowering passes (Haynes, 17 Mar 2026). In real-time systems, deterministic-memory selection depends on profiling and page-level granularity, so overuse can waste reserved resources and underuse can weaken timing guarantees (Farshchi et al., 2017).

The broader significance of DMM is therefore methodological as much as algorithmic. In regulated enterprise agents, statelessness is described as the load-bearing property that explains deployment choices (Srinivasan, 22 Apr 2026). In deterministic AI substrates, replayable memory is presented as a necessary primitive for trustworthy AI systems (Gudur, 25 Dec 2025). In memory-safe systems, deterministic tag discipline turns post-deployment protection from a probabilistic debugging aid into a compile-time-enforced invariant (Liljestrand et al., 2022). This suggests that DMM is best understood not as a single implementation pattern, but as a systems doctrine: memory should expose a small, explicit, and verifiable state-transition surface whose behavior is stable under replay, audit, and cross-environment execution.