Auditing Prospective Memory in Frozen Language-Model Systems: Causal Mechanisms and the Limits of Naturalistic Trigger Grounding

1. Introduction

Prospective memory concerns an intention that must become behaviorally relevant at a later event or time, often without an explicit retrieval request at the moment of execution [1,2]. This requirement is increasingly important for interactive language-model systems. A user may state a conditional instruction once, continue with unrelated work, and expect the system to recognize when a later event makes that instruction applicable. The memory problem is therefore not only what to retain, but also when retained information should be allowed to change behavior.

That distinction separates prospective triggering from ordinary long-term retrieval. A system may retrieve an old fact accurately when queried yet fail to recognize that an unfolding event satisfies a previously stored condition. Conversely, a memory mechanism that activates too readily can contaminate unrelated interactions. Reliable prospective behavior therefore requires condition representation, later cue detection, selective intervention, and restraint on near-matches. This emphasis is consistent with cognitive accounts in which cue properties shape prospective remembering and with evidence that controlled prospective-memory performance need not transfer cleanly to more naturalistic settings [3].

Running example.

Suppose a user says, “If the next project invoice exceeds $10,000, remind me to attach the approval form.” The payload is the reminder; the condition concerns a later invoice amount. An event stating that an invoice is $12,300 should activate the bound payload. A statement that an invoice may exceed $10,000 next month should not. The second event is semantically related but does not yet satisfy the condition. A prospective-memory system should therefore intervene in the first case and remain exactly on its baseline path in the second.

Recent work approaches this problem from several directions. Persistent-memory architectures increase what can survive beyond a context window; test-time memory methods change or compress state without retraining a full backbone; and new benchmarks directly evaluate delayed intentions, false alarms, and implicit cues. PM-Bench and TriggerBench show that prospective behavior remains difficult under stronger agentic and long-context settings, while T-Mem constructs anticipatory retrieval cues at write time [4,5,6]. A complementary study by Mittal [7] examines prospective-memory-inspired instruction failures under concurrent task load. Taken together, this literature makes broad priority claims unhelpful. The more informative question is whether a future-condition lifecycle can be specified, causally tested, and then challenged under linguistic variation.

We study that question with the Prospective Conditional Memory Intervention Pilot (PCMIP). The name is retained from the original pilot specification; the present paper reports the subsequent controlled, transfer, and development evaluations built around that specification. PCMIP is an external, auditable controller around a frozen language-model backbone. It stores a condition separately from its payload, persists the record across an operational boundary, evaluates later events with a learned trigger, exposes the associated payload only on a valid match, and preserves an exact reachable null path otherwise. The design is intentionally system-level: it does not claim that the backbone autonomously forms intentions or possesses an intrinsic prospective-memory faculty.

The study is organized around three questions. RQ1: Controlled feasibility. Can the complete lifecycle produce causal benefit over no-memory and reactive-memory baselines while remaining selective relative to always-on memory and dependent on the correct condition-payload association? RQ2: Naturalistic transfer. Does the unchanged trigger preserve that behavior on held-out cases with separately produced phrasing, modality, lifecycle, and near-miss variation? RQ3: Failure localization. If robust transfer fails, do stronger development-time semantic triggers, preservation constraints, source-grouped evaluation, and trigger-action factorization identify where the remaining error arises?

The evidence gives different answers to these questions. In 7,200 controlled executions, the complete system satisfied all 11 prespecified adequacy criteria, including perfect triggered-action accuracy, perfect correct non-action, zero false triggers, exact null-path equivalence, and causal dependence on the correct stored payload. The unchanged trigger then failed the held-out 128-case naturalistic transfer test: balanced accuracy was 0.703 and the false-trigger rate was 0.297, so the zero-shot transfer claim was rejected. Development-only redesigns improved different parts of the error surface but never satisfied the unchanged preservation and robustness criteria simultaneously. In the final factorized analysis, action resolution was perfect when supplied with a valid trigger and conditional on detector true positives, localizing the remaining failures upstream to semantic trigger grounding.

The contribution is therefore an evidence chain, not a state-of-the-art classifier claim. First, PCMIP provides an operational system contract in which persistence, cue detection, intervention, payload causality, and null behavior can be manipulated separately. Second, the controlled experiment establishes feasibility under strong causal and selectivity controls. Third, the failed naturalistic transfer test and subsequent development analyses show that pooled accuracy and synthetic preservation can coexist with severe held-out-source weaknesses. Finally, the study demonstrates a governance pattern in which failed runs, negative transfer, development evidence, and an unopened confirmatory holdout remain distinct. The broader lesson is that a memory system should not be considered reliable merely because it can retrieve useful information: it must also learn when not to act, and that decision must remain stable under variation that was absent from the controlled generator.

2. Related Work and Positioning

2.1. Prospective Memory as Cue-Dependent Intention Execution

The cognitive literature provides the conceptual starting point for this work. Early laboratory studies distinguished prospective memory from retrospective recall by asking participants to perform an intended action when a target event occurred [1]. The multiprocess account later argued that prospective retrieval can arise through strategic monitoring or more spontaneous cue-driven processes depending on the task and the relationship between cue and intention [2]. This distinction maps naturally onto interactive systems: a stored intention is useful only if a later event is recognized as relevant without requiring the user to restate the intention explicitly.

The analogy should not be pushed too far. PCMIP does not model human cognition, and its six-property contract is an engineering operationalization rather than a psychological theory. Cognitive work is nevertheless useful in two respects. First, it motivates treating cue detection as part of prospective memory rather than as ordinary retrieval after a direct query. Second, ecological studies warn against assuming that performance on controlled prospective-memory tasks transfers to more varied, naturalistic settings [3]. The latter concern became central to our own evaluation.

2.2. Persistent and Adaptive Memory in Machine Learning

Learnable read-write memory predates modern language models. Memory Networks, Neural Turing Machines, and the Differentiable Neural Computer established architectures in which learned systems could write, maintain, and retrieve mutable state [8,9,10]. Contemporary language-model systems revisit persistence under different constraints. LongMem keeps the backbone frozen while using a side network to retrieve and read long-form memory [11]. MemGPT manages multiple memory tiers as a virtual context system [12]. Titans introduces a neural long-term memory module trained to memorize at test time, while GradMem writes compact memory tokens through test-time optimization with the main model weights frozen [13,14]. CABLE uses adapter routing to maintain and reuse task-specific knowledge over continual task streams [15], and Metis moves toward persistent model-internal memory states and learned memory procedures [16].

These systems establish substantial prior art for persistent state, frozen-backbone memory, modular adaptation, and test-time memorization. PCMIP does not claim novelty for any of those primitives. Its target lies in how persistence is coupled to future-condition semantics, later trigger detection, selective action, and an observable null path.

2.3. Prospective-memory Benchmarks and Anticipatory Triggers

Recent work has begun to test prospective behavior directly. PM-Bench evaluates delayed intentions in agent trajectories and reports substantial headroom even under strong model and agent configurations [4]. TriggerBench constructs matched prospective and retrospective controls and measures proactive recall, false alarms, implicit constraints, and overloaded triggers [5]. Mittal studies prospective-memory-inspired instruction failures under concurrent task load and finds that delayed or terminal constraints can degrade sharply as task demands increase [7]. T-Mem attacks a related retrieval problem from the write side: it generates anticipatory triggers so that a memory can later be reached through associative cues that share little surface form with the original dialogue [6]. MemoGen demonstrates another form of future use by retaining experience from previous text-to-image episodes to improve later generation [17].

These studies overlap materially with PCMIP. PM-Bench and TriggerBench directly evaluate prospective behavior. T-Mem constructs future-oriented triggers at write time, while Metis treats memory as an evolving model state. The distinction relevant here is not whether those systems are “prospective” in some absolute sense. It is whether an implemented and evaluated system exhibits the entire operational lifecycle defined in our frozen contract, including an explicit reachable null path and a causal payload control.

2.4. Protocol-frozen Mapping Review and Pre-Submission Threat Scan

A protocol-frozen systematic mapping and full-text review was used to constrain positioning before the empirical program was interpreted. The frozen corpus contained 46 full-text studies, 37 coded as core and nine as supporting, and each was assessed against the mechanism properties used to define the target system. No study in that frozen corpus satisfied all six properties simultaneously. This result is deliberately corpus-bounded and is supporting context rather than the primary scientific novelty claim.

A separate pre-submission threat scan through August 10, 2026 was kept outside the frozen review counts. It confirmed substantial overlap from PM-Bench, TriggerBench, T-Mem, GradMem, MemoGen, Metis, and the task-load study of Mittal [7]. The scan also rechecked Prospective Multimodal Memory Compilation (PMMC) [18], which predicts future question candidates during multimodal memory consolidation and compiles question-conditioned retrieval programs. Delivery, Not Storage [19] attaches first-class path, symbol, semantic, event, and temporal trigger conditions to harness-owned memories and evaluates deterministic cue delivery in a coding agent. Remember When It Matters [20] uses a separate memory agent that updates structured memory and decides whether to inject a reminder or remain silent while leaving the action agent unmodified. These works rule out broad claims such as “first prospective memory” or “first proactive memory.”

Accordingly, PCMIP is not positioned around ownership of any single component. The contribution studied here is the combination of an observable causal lifecycle, explicit null and payload controls, a held-out naturalistic transfer attempt after controlled success, preservation-constrained redesign, source-grouped robustness analysis, and trigger-action failure localization. The frozen six-property intersection documents how the original target was defined; the empirical lessons do not depend on asserting that the intersection is uniquely ours.

2.5. Nearest-prior-art Property Matrix

Table 1 makes the comparison explicit. A check mark indicates that the published system or benchmark clearly instantiates or directly evaluates the property; “partial” denotes a related but non-equivalent mechanism; and “n/a” indicates that the work is primarily a benchmark rather than a memory architecture. The matrix is intentionally conservative: absence from a paper is not treated as evidence that a property is impossible, only that it is not part of the reported contribution.

The matrix is therefore a boundary-setting device rather than a priority argument. The paper’s main advance is the evidence generated by the causal, transfer, preservation, and factorized evaluations, not the assertion that every component is new.

3. Method: PCMIP as an Auditable System Contract

3.1. System/model Responsibility Boundary

PCMIP is not a claim that the frozen language model autonomously forms intentions, writes them to memory, and later remembers to act. Those operations belong to the external controller. The language model is held fixed as the conversational/action backbone and produces generated action proposals on diagnostic paths; the trigger used for the primary controlled and transfer evaluations is a separate learned detector over condition-event text. PCMIP owns memory writing, persistence, lifecycle state, trigger evaluation, record resolution, and the decision to expose a stored payload. In the primary controlled outcome, the retrieved payload is the system action. Model-generated proposals are recorded separately and are not the causal endpoint.

Table 1. Compact nearest-prior-art matrix used for scientific positioning. The expanded seven-property coding matrix is supplied with the JMLR online appendix; this table is intentionally property-level and does not support an absolute first-system claim.

Work	Future-oriented mechanism	Intervention / control	Relationship to PCMIP
PCMIP	Explicit write-time future condition	Selective payload intervention; exact null and payload permutation	Reference contract
PM-Bench	Delayed-intention benchmark	Behavioral controls	Direct behavioral overlap; benchmark rather than system architecture
TriggerBench	Prospective trigger benchmark	Matched negative and retrospective controls	Direct trigger-evaluation overlap
Mittal (2026)	Delayed/terminal constraints under task load	Programmatically checked behavioral compliance	Prospective-failure overlap without persistent condition-payload memory
T-Mem	Anticipatory cues generated at write time	Trigger-mediated retrieval	Strong write-time cue overlap
PMMC	Predicted future questions at consolidation	Question-conditioned routing and retrieval	Future-oriented compilation without event-triggered payload contract
Cue-Anchored Working Memory	First-class event/semantic/temporal triggers	Deterministic harness injection	Very strong system-trigger overlap
Remember When It Matters	Structured memory state	Reminder injection or silence	Very strong selective-intervention overlap

Table 1. Compact nearest-prior-art matrix used for scientific positioning. The expanded seven-property coding matrix is supplied with the JMLR online appendix; this table is intentionally property-level and does not support an absolute first-system claim.

Work	Future-oriented mechanism	Intervention / control	Relationship to PCMIP
PCMIP	Explicit write-time future condition	Selective payload intervention; exact null and payload permutation	Reference contract
PM-Bench	Delayed-intention benchmark	Behavioral controls	Direct behavioral overlap; benchmark rather than system architecture
TriggerBench	Prospective trigger benchmark	Matched negative and retrospective controls	Direct trigger-evaluation overlap
Mittal (2026)	Delayed/terminal constraints under task load	Programmatically checked behavioral compliance	Prospective-failure overlap without persistent condition-payload memory
T-Mem	Anticipatory cues generated at write time	Trigger-mediated retrieval	Strong write-time cue overlap
PMMC	Predicted future questions at consolidation	Question-conditioned routing and retrieval	Future-oriented compilation without event-triggered payload contract
Cue-Anchored Working Memory	First-class event/semantic/temporal triggers	Deterministic harness injection	Very strong system-trigger overlap
Remember When It Matters	Structured memory state	Reminder injection or silence	Very strong selective-intervention overlap

This separation trades autonomy for identifiability. With the backbone fixed, a change in behavior can be attributed to memory state, trigger status, or the condition-payload association rather than to online weight adaptation. It also permits an exact null intervention: when no stored condition is satisfied, the memory path contributes neither an identifier nor an intervention object to the baseline response path. The resulting unit of analysis is therefore the complete language-model system, not the backbone in isolation.

3.2. Operational Task Definition and Causal Structure

Let $f_{\theta }\left(x_t\right)$ denote the output of the frozen baseline backbone at event $x_t$. At a write event, the controller stores an active record $m_i=(c_i,a_i,z_i)$ containing a future condition $c_i$, an action payload $a_i$, and lifecycle state $z_i$. After an operational boundary, an external detector $g_{\varphi }(c_i,x_t)$ scores whether the current event satisfies each active condition. Lifecycle rules and the trigger score determine whether a record $i^{*}$ is actionable. The primary system output is

$$y_t=\left\{\begin{array}{cc}{a}_{i^{*}},\hfill & \mathrm{if}\mathrm{an}\mathrm{active}\mathrm{record}\mathrm{is}\mathrm{validly}\mathrm{triggered},\hfill \\ f_{\theta }\left(x_t\right),\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

The second branch is not ordinary retrieval failure: it is an audited null path in which no memory-derived identifier or intervention object is allowed to influence the baseline output.

The controlled conditions manipulate this structure rather than only the final response. The no-memory and reactive-retrieval baselines test whether condition-bound prospective control adds utility beyond no memory or request-like similarity retrieval. An always-on condition tests selectivity by exposing active memory regardless of a valid future condition. A permutation control preserves the execution structure while breaking the correct condition-payload association. Together, these comparisons distinguish generic memory exposure from causal use of the correct stored record.

3.3. Six Observable Properties

Figure 1 summarizes the PCMIP execution path and Table 2 lists the prespecified requirements. A system-controlled writer receives a write event and stores two logically separate elements: an action payload and the condition under which that payload should become relevant. The record persists across an operational boundary that may include process restart. A learned trigger detector later evaluates raw-text events against active conditions. A successful match makes the associated payload available for intervention; a non-match terminates the memory-derived path.

Figure 1. PCMIP system path and reachable null path. The frozen language-model backbone is one component of a controller-owned memory lifecycle; direct-payload actuation is separated from diagnostic model proposals.

Figure 1. PCMIP system path and reachable null path. The frozen language-model backbone is one component of a controller-owned memory lifecycle; direct-payload actuation is separated from diagnostic model proposals.

Table 2. Prespecified PCMIP system contract. The six properties define the prespecified engineering target; they are not proposed as the unique psychological definition of prospective memory.

Item	Prespecified requirement	Operational interpretation
P1	Frozen or parameter-efficiently adapted pretrained backbone	Online evaluation does not update the backbone.
P2	System-written persistent memory	Memory is written during an episode and survives an explicit boundary.
P3	Write-time future-condition binding	The future-use condition is stored separately from its payload.
P4	Later trigger detection	A later event is evaluated against the stored condition.
P5	Selective memory-dependent intervention	The stored payload changes behavior only when the condition is satisfied.
P6	Reachable exact null/no-op path	When no condition matches, the memory-derived path is baseline-equivalent.

Table 2. Prespecified PCMIP system contract. The six properties define the prespecified engineering target; they are not proposed as the unique psychological definition of prospective memory.

Item	Prespecified requirement	Operational interpretation
P1	Frozen or parameter-efficiently adapted pretrained backbone	Online evaluation does not update the backbone.
P2	System-written persistent memory	Memory is written during an episode and survives an explicit boundary.
P3	Write-time future-condition binding	The future-use condition is stored separately from its payload.
P4	Later trigger detection	A later event is evaluated against the stored condition.
P5	Selective memory-dependent intervention	The stored payload changes behavior only when the condition is satisfied.
P6	Reachable exact null/no-op path	When no condition matches, the memory-derived path is baseline-equivalent.

The null path is stronger than simply “retrieval returned nothing.” A null trial requires no retrieved memory identifier, no intervention object, no subsequent use of memory-derived values, and output equality with the corresponding baseline execution. This requirement matters in systems where inappropriate memory exposure can be as harmful as forgetting. An always-on memory can increase access to past information while contaminating unrelated behavior; PCMIP instead treats non-intervention as an observable outcome with its own test.

3.4. Model and Trigger Configuration

The primary controlled experiment used Qwen/Qwen2.5-1.5B-Instruct at revision 989aa7980e4cf806f80c7fef2b1adb7bc71aa306 as a frozen causal language-model backbone with zero trainable backbone parameters. The naturalistic transfer evaluation additionally used HuggingFaceTB/SmolLM2-1.7B-Instruct at revision dcb322b07cfda4d548a526b6a5a0e70cac4046fe; both backbones shared the same external trigger controller and direct-payload system path. The broader contract permits either a frozen or parameter-efficiently adapted backbone, but all primary evidence reported here uses fully frozen backbones.

The primary trigger is external to those backbones. For each stored-condition/event pair it computes 16 deterministic raw-text statistics covering hashed lexical/character similarity, token and content-word overlap, negation, future modality, hedging, confirmation, contradiction, and text-length indicators. These feed a multilayer perceptron (MLP) with dimensions $16\to 64\to 32\to 1$, Gaussian error linear unit (GELU) activations, and 0.10 dropout after the first hidden layer. Training used seed 2026, AdamW with learning rate 0.002 and weight decay ${10}^{-4}$, batch size 64, and 80 epochs on 720 training pairs; threshold selection used 216 validation pairs. The selected threshold, 0.05, was locked before evaluation on the 360-pair frozen synthetic test split. Train, validation, and test splits used disjoint subjects and template sets. The controlled mechanism evaluation then used seeds 2026–2028, and the three prespecified causal contrasts used 5,000 paired-bootstrap iterations clustered by semantic episode. Exact feature definitions, split hashes, model locks, and redesign-model revisions are provided in the JMLR online appendix and machine-readable reproducibility manifest.

3.5. Causal Controls and Actuation Semantics

The controlled experiment uses five conditions. C0 is the frozen-backbone baseline with no memory write or intervention. C1 writes memory but retrieves reactively by lexical similarity, without an explicit future-condition binding. C2 exposes all active memories and intervenes continuously. C3 is the complete prospective conditional mechanism. C4 preserves the C3 execution structure but permutes condition-payload associations. The C4 comparison asks whether success depends on the correct stored payload, rather than on generic memory exposure or a trigger event in isolation.

An initial real-Qwen integration failed the action-actuation criterion: retrieval and trigger detection were correct, but free-form model generation returned the baseline action for six of ten correctly triggered payloads. The failed run remains archived as a failure. Before the controlled mechanism evaluation, a protocol-preserving correction separated predicted_action, the system-level action associated with the retrieved payload, from model_action, the backbone’s generated proposal. Triggered C3 trials then used direct payload actuation for the primary causal system path, while model_action was retained as a diagnostic. On null trials the memory path contributes nothing to the baseline output. Methodologically, direct-payload actuation factorizes trigger and memory causality from free-form generation errors; Section 7 later uses that separation to localize end-to-end failures. This design isolates the memory mechanism, but it also limits the claim: the experiment tests prospective memory at the system level, not autonomous intention execution by the language model.

3.6. Audit Trail and Provenance

Every execution emits a machine-readable trace covering write, boundary crossing, trigger decision, retrieval, intervention, null behavior, output, and integrity checks. Repository commits, model revisions, evaluator hashes, data manifests, and package-level checksums were fixed before each evidence-generating analysis. Those records are not used as evidence of performance by themselves; their purpose is to make each reported result traceable to the exact program state that produced it.

4. Experimental Design and Governance

4.1. Separation of Controlled, Naturalistic, and Confirmatory Evidence

A single benchmark could not answer both the causal and transfer questions. Synthetic episodes provide precise paired controls but inevitably reflect the assumptions of their generator. Held-out cases produced through separated source-writing packets are less controlled but better expose variation in phrasing, modality, and event structure. Once such cases are used for redesign, however, they become development data and can no longer serve as clean confirmation. The program was accordingly separated into controlled mechanism testing, a held-out naturalistic transfer test, development-only redesign, and an untouched confirmatory holdout. These evidence classes are never pooled. Controlled and held-out transfer results support claims about the frozen system state that produced them; redesign metrics are diagnostic development evidence; the sealed holdout supports no performance claim because it was never scored. Figure 2 and Table 3 mark those roles explicitly.

Table 3. Evidence classes and allowed inferences. Development metrics are never treated as independent transfer estimates.

Analysis	Evidence class	Scale	Observed result	Permitted inference
Prior-art mapping	frozen literature corpus	46 studies	no six-property match	corpus-bounded positioning only
Controlled evaluation	prespecified controlled	7,200 runs	11/11 criteria met	controlled causal/selective system behavior
Naturalistic transfer	held-out transfer	2,560 runs	transfer rejected	unchanged trigger lacks robust zero-shot transfer
Semantic redesign	development	128-case development set	none eligible	preservation-generalization tension
Preservation redesign	development	nested source-held-out	none eligible	source robustness failure
Predicate redesign	development	nested source-held-out	none eligible	semantic failure attribution
Final factorized	development	nested source-held-out	none eligible	trigger-action localization
Sealed holdout	unscored confirmatory	128 cases	never scored	no performance inference

Table 3. Evidence classes and allowed inferences. Development metrics are never treated as independent transfer estimates.

Analysis	Evidence class	Scale	Observed result	Permitted inference
Prior-art mapping	frozen literature corpus	46 studies	no six-property match	corpus-bounded positioning only
Controlled evaluation	prespecified controlled	7,200 runs	11/11 criteria met	controlled causal/selective system behavior
Naturalistic transfer	held-out transfer	2,560 runs	transfer rejected	unchanged trigger lacks robust zero-shot transfer
Semantic redesign	development	128-case development set	none eligible	preservation-generalization tension
Preservation redesign	development	nested source-held-out	none eligible	source robustness failure
Predicate redesign	development	nested source-held-out	none eligible	semantic failure attribution
Final factorized	development	nested source-held-out	none eligible	trigger-action localization
Sealed holdout	unscored confirmatory	128 cases	never scored	no performance inference

Each empirical analysis began from a version-controlled repository state with an explicit evaluation contract. The project artifacts call these contracts preregistrations. In this paper, that term refers to analysis-specific hypotheses, criteria, and allowable threshold grids fixed before the corresponding outcomes were scored; it does not imply validation by an external preregistration registry. Technical corrections were permitted only when outcome-independent and when methods, data, model revisions, splits, criteria, and decision logic remained unchanged. One such correction was required when an audit found that two exported out-of-fold summaries had used a final configuration rather than the configuration selected within the corresponding outer fold. The remediation regenerated contract-adherent predictions without reopening design choices, and the ineligibility decision was unchanged.

4.2. Controlled Mechanism Evaluation

The controlled mechanism evaluation crossed three random seeds, five causal conditions, and two operational boundaries over 240 semantic episodes per condition and seed, producing 7,200 execution records. Episodes included exact and paraphrased positive triggers, matched near-trigger negatives, distractor-only negatives, and cancellation or correction cases. Delays of five and 20 distractor events were crossed with same-process and process-restart execution.

The primary comparisons required C3 to exceed the stronger non-prospective baseline on prospective utility, to improve correct non-action relative to always-on memory, and to outperform the permuted-payload control on triggered action. Eleven prespecified adequacy criteria additionally covered trigger accuracy, false triggers, null-path equivalence, persistence across restart, unrelated-control regression, write success, and frozen-backbone integrity. Paired-bootstrap confidence intervals were used for the three prespecified causal contrasts.

4.3. Held-out Naturalistic Transfer

The held-out naturalistic challenge contained 128 cases, 16 in each of eight strata: direct positives, indirect positives, competing-record positives, replacement positives, near-miss negatives, hedged-future negatives, cancellation negatives, and expiry negatives. Here, naturalistic means separately produced cases that were not generated from the controlled benchmark templates and that deliberately varied phrasing, modality, lifecycle state, and semantically close positive/negative distinctions; it does not mean deployment logs or a population-representative sample. Held-out means that the challenge was frozen before scoring and was unavailable for trigger training, calibration, threshold selection, prompt tuning, or case removal. According to the project records, cases were produced through separated source-writing packets and reviewed before scoring; two coded reviewers assessed evidence and labels, and disagreements were adjudicated. The artifact record documents completion of that review and adjudication workflow, but neither the artifacts nor the present author can independently establish human authorship of the source cases or reviewer independence beyond those records. We therefore treat those provenance facts as a limitation rather than as independently verified evidence. The unchanged external trigger and direct-payload system path were then evaluated across two frozen language-model backbones. We refer to the case-generation identities as sources to avoid confusion with manuscript authors; the frozen experimental artifacts use the term author for the same grouping variable.

Because the trigger controller was shared, equality of system-path outcomes across backbones is interpreted only as an orchestration property. It does not establish model-native replication of prospective reasoning. This distinction is retained throughout the paper.

4.4. Development Boundary and Sealed Holdout

After the held-out transfer claim failed, the 128 challenge cases were permanently designated as development evidence. A separate naturalistic pool was then created through the separated writing, review, and adjudication workflow and reduced to a balanced 128-case confirmatory holdout. Its SHA-256 hash was frozen before redesign. Development code was allowed to verify the file hash but not to parse or score its rows.

Opening the holdout required a development method to satisfy every prespecified eligibility criterion and acquire an immutable trigger or trigger-action lock. No development method did. The holdout remained untouched through the claim-freeze decision. This policy prevents an unsuccessful development sequence from quietly converting a confirmatory test into one more exploratory dataset.

5. Controlled Mechanism Evidence

All 7,200 controlled executions completed, and the complete prospective mechanism satisfied all 11 prespecified adequacy criteria (Table 4). Triggered action accuracy and correct non-action were both 1.0, while the false-trigger rate was 0.0. The prospective utility margin over the stronger non-prospective baseline was 0.50. Selectivity gain relative to always-on memory was 0.833, and causal dependence on the correct stored payload was also 0.833. Null-path equivalence and frozen-backbone integrity were exact; restart persistence loss and unrelated-control regression were zero.

Table 4. Controlled mechanism criteria with continuous values alongside prespecified binary decisions. Thresholds are operational adequacy requirements for this study, not universal constants.

Criterion	Observed	Requirement	Margin / interval	Decision
Triggered action accuracy	1.000	$\ge 0.800$	+0.200	met
Correct non-action	1.000	$\ge 0.900$	+0.100	met
False-trigger rate	0.000	$\le 0.100$	0.100 below max	met
Prospective utility margin	0.500	$\ge 0.150$	95% lower bound 0.500	met
Selectivity gain	0.833	$\ge 0.150$	95% lower bound 0.794	met
Causal memory dependence	0.833	$\ge 0.200$	95% lower bound 0.793	met
Exact null-path equivalence	1.000	$\ge 0.990$	+0.010	met
Restart persistence loss	0.000	$\le 0.050$	0.050 below max	met
Unrelated-control regression	0.000	$\le 0.020$	0.020 below max	met
Memory-write success	1.000	$\ge 0.950$	+0.050	met
Frozen-backbone integrity	1.000	$=1.000$	exact	met

Table 4. Controlled mechanism criteria with continuous values alongside prespecified binary decisions. Thresholds are operational adequacy requirements for this study, not universal constants.

Criterion	Observed	Requirement	Margin / interval	Decision
Triggered action accuracy	1.000	$\ge 0.800$	+0.200	met
Correct non-action	1.000	$\ge 0.900$	+0.100	met
False-trigger rate	0.000	$\le 0.100$	0.100 below max	met
Prospective utility margin	0.500	$\ge 0.150$	95% lower bound 0.500	met
Selectivity gain	0.833	$\ge 0.150$	95% lower bound 0.794	met
Causal memory dependence	0.833	$\ge 0.200$	95% lower bound 0.793	met
Exact null-path equivalence	1.000	$\ge 0.990$	+0.010	met
Restart persistence loss	0.000	$\le 0.050$	0.050 below max	met
Unrelated-control regression	0.000	$\le 0.020$	0.020 below max	met
Memory-write success	1.000	$\ge 0.950$	+0.050	met
Frozen-backbone integrity	1.000	$=1.000$	exact	met

Figure 3 places the principal metrics beside their prespecified thresholds. The strongest interpretation supported by these data is a system-level one. Under the controlled generator, PCMIP can maintain a future-condition binding across a restart boundary, detect a later satisfying event, intervene with the associated payload, remain silent on non-matches, and fail when the payload-condition association is deliberately permuted. The last comparison rules out the weaker explanation that any memory activity or any trigger event is sufficient.

Figure 3. Controlled mechanism metrics against prespecified adequacy thresholds. Values are shown with their acceptance direction; all 11 criteria were satisfied in the controlled evidence class.

Figure 3. Controlled mechanism metrics against prespecified adequacy thresholds. Values are shown with their acceptance direction; all 11 criteria were satisfied in the controlled evidence class.

These results do not show that the language model acquired prospective memory internally. The writer is system controlled, the trigger detector is an external learned component, and the primary triggered action is the retrieved payload rather than unconstrained model generation. The controlled evaluation establishes causal feasibility of the system contract. That boundary is central to the later transfer analysis rather than a caveat added after the fact.

6. Naturalistic Transfer and Development Redesign

6.1. The Prespecified Transfer Claim Fails

The unchanged trigger did not satisfy the held-out naturalistic transfer criteria. Balanced accuracy, sensitivity, and specificity were each 0.703. System action accuracy fell to 0.695 and the false-trigger rate rose to 0.297. Six of 16 prespecified criteria failed, including balanced accuracy, specificity, correct non-action, system action accuracy, false-trigger rate, and the lower confidence bound of prospective utility. Under the prespecified decision rule, the zero-shot transfer claim was rejected.

The pooled score obscures the structure of the failure. Cancellation and expiry negatives were handled perfectly, while direct and competing-record positives remained comparatively strong. The difficult cases were those requiring finer semantic discrimination. Only five of 16 indirect positives triggered correctly, and only five of 16 near-miss negatives were correctly rejected. Hedged future statements were also unstable. The errors ran in both directions: the trigger missed valid paraphrastic implications and also fired on events that resembled a stored condition without yet satisfying it (Figure 4).

Other parts of the system survived the naturalistic shift. Persistence and exact null behavior remained intact, the backbone remained frozen, and lifecycle controls continued to work. The transfer failure is consequently more specific than a general system collapse: semantic trigger grounding did not generalize well enough to support the naturalistic claim.

6.2. Semantic Models Expose a Preservation-Generalization Tension

The first redesign compared the legacy trigger with frozen natural language inference (NLI), sentence-embedding, and hybrid semantic approaches. A frozen NLI detector achieved 0.891 balanced accuracy on the naturalistic development set and 0.984 specificity, but its synthetic accuracy dropped to 0.725 because many positives that had been handled correctly in the controlled setting were no longer recognized. The legacy trigger showed the opposite profile: perfect synthetic preservation with the original 0.703 naturalistic balanced accuracy.

This result changed the design problem. Naturalistic improvement could not be treated as progress if it altered behavior already used to establish the controlled mechanism. Later methods had to satisfy fixed preservation criteria on a held-out synthetic preservation set before naturalistic robustness could make them eligible.

6.3. Preservation Recovers, Source Robustness Does Not

The preservation-constrained redesign combined legacy scores, NLI, sentence embeddings, lexical features, and deterministic indicators under nested leave-one-source-out evaluation. The best multi-source calibrator preserved the synthetic benchmark with 0.978 accuracy and reached 0.852 aggregate naturalistic balanced accuracy. Its worst held-out fold was much weaker: sensitivity fell to 0.526 and specificity to 0.600. The gap between pooled and held-out-source performance made clear that average accuracy was masking distribution sensitivity.

A later predicate-aware design decomposed stored conditions into deterministic atomic predicates and added explicit replacement-lifecycle semantics. This improved the worst positive semantic-group sensitivity of the best method to 0.688 and kept synthetic accuracy at 0.983, but worst-source sensitivity (named worst-author sensitivity in the frozen artifacts) remained 0.474. The error trace showed a conservative failure on one held-out source: valid positive events were often assigned scores below the fold-specific threshold even while negatives from that source were rejected reliably.

6.4. Final Source-Robust and Factorized Redesign

The final broad redesign added 288 deterministic counterfactual development rows, group distributionally robust optimization (Group-DRO) weighting, pairwise margin constraints, leave-one-source ensemble heads, and a state-aware action resolver trained separately from trigger detection. Counterfactual rows inherited their source identity and were excluded whenever that source was held out, preventing augmentation from leaking source-specific information across outer folds.

The strongest final trigger, a leave-one-source ensemble, reached 0.844 aggregate balanced accuracy, 0.783 worst-source balanced accuracy, and 0.983 synthetic accuracy. It nevertheless failed two trigger robustness criteria: worst-source sensitivity was 0.632 and worst positive semantic-group sensitivity was 0.625, both below the prespecified 0.65 thresholds. Replacement end-to-end action accuracy was 0.813, also below its requirement. A diagnostic sweep over the prespecified threshold grid found no threshold for any method that satisfied all eligibility requirements simultaneously. The diagnostic did not alter selection.

Table 5. Continuous margins for the strongest final development method. The binary ineligibility decision follows the prespecified contract.

Final method criterion	Observed	Threshold	Margin	Decision
Naturalistic balanced accuracy	0.8438	0.8000	+0.0438	met
Worst-source balanced accuracy	0.7833	0.7000	+0.0833	met
Worst-source sensitivity	0.6316	0.6500	-0.0184	not met
Worst-source specificity	0.7333	0.6500	+0.0833	met
Worst positive-group sensitivity	0.6250	0.6500	-0.0250	not met
Worst negative-group specificity	0.7500	0.6500	+0.1000	met
Replacement end-to-end action accuracy	0.8125	1.0000	-0.1875	not met
Competing-record end-to-end action accuracy	0.9375	0.8750	+0.0625	met
Synthetic preservation accuracy	0.9833	0.9500	+0.0333	met

Table 5. Continuous margins for the strongest final development method. The binary ineligibility decision follows the prespecified contract.

Final method criterion	Observed	Threshold	Margin	Decision
Naturalistic balanced accuracy	0.8438	0.8000	+0.0438	met
Worst-source balanced accuracy	0.7833	0.7000	+0.0833	met
Worst-source sensitivity	0.6316	0.6500	-0.0184	not met
Worst-source specificity	0.7333	0.6500	+0.0833	met
Worst positive-group sensitivity	0.6250	0.6500	-0.0250	not met
Worst negative-group specificity	0.7500	0.6500	+0.1000	met
Replacement end-to-end action accuracy	0.8125	1.0000	-0.1875	not met
Competing-record end-to-end action accuracy	0.9375	0.8750	+0.0625	met
Synthetic preservation accuracy	0.9833	0.9500	+0.0333	met

Figure 5 summarizes the comparable nested held-out-source analyses. The naturalistic transfer row in Table 6 leaves held-out-source sensitivity blank because source-held-out sensitivity was not a prespecified decision metric for that independent transfer evaluation; source-grouped metrics became formal development selection criteria only after the challenge was opened for redesign. For the frozen NLI redesign, the value 0.5789 is the worst held-out-source sensitivity, distinct from its aggregate out-of-fold sensitivity of 0.7969. Synthetic preservation recovered after the initial semantic redesign and remained strong, whereas held-out-source sensitivity did not track aggregate balanced accuracy. That divergence is a central result of the study: pooled performance can suggest that a trigger is nearly solved while a held-out source still experiences a qualitatively different error regime.

Figure 5. Comparable nested held-out-source redesigns. All values in this panel are development-only diagnostics; they are not independent naturalistic transfer estimates.

Figure 5. Comparable nested held-out-source redesigns. All values in this panel are development-only diagnostics; they are not independent naturalistic transfer estimates.

7. Failure Localization by Trigger-Action Factorization

In the final development analysis, the factorized evaluation separates trigger errors from action-selection errors. For each of the three factorized development methods, the state-aware resolver achieved 1.0 accuracy when supplied with an oracle trigger. It also achieved 1.0 accuracy conditional on detector true positives. Counterfactual action contrasts separated current records from superseded records without error. Once the system had correctly decided that an event satisfied a stored condition, it selected the current actionable payload reliably in the evaluated cases.

The lower end-to-end replacement accuracy arose earlier in the pipeline. Some valid replacement events were classified as non-triggers and never reached the resolver. Figure 6 illustrates this separation, and Figure 7 shows where the strongest final trigger’s errors concentrate: indirect paraphrases and replacement-current-record positives account for much of the remaining false-negative burden, while future-modal and near-miss negatives contribute persistent false positives. The held-out-source analysis shows that these errors are not distributed uniformly across sources.

This localization changes what further engineering would mean. More elaborate lifecycle state machines or action ranking would target a component that already performs perfectly conditional on a valid trigger in this dataset. The unresolved problem is semantic: assigning stable truth values to natural-language events that can imply, almost imply, or explicitly postpone a stored future condition. Our stop rule does not establish that such grounding is impossible. It establishes that none of the prespecified broad redesigns in this study passed the development criteria required to justify confirmatory scoring.

8. Discussion

8.1. What Is Established by the Controlled Experiment

PCMIP shows that a prospective-memory-like lifecycle can be made explicit and testable in a language-model system. Write, persistence, trigger evaluation, intervention, causal payload control, and null behavior are separately observable rather than inferred from a final conversational response. Within the controlled benchmark, these components coexist without an always-on memory penalty and remain stable across a process restart.

The exact null path is particularly important for selective systems. Memory mechanisms are often evaluated by whether retrieval helps when relevant information exists. A deployed assistant must also know when prior information should not alter the current interaction. The controlled evidence shows that PCMIP can preserve baseline-equivalent behavior on no-match cases while still obtaining a large advantage on triggered cases. The permuted-payload control further shows that the observed benefit depends on the condition’s associated content rather than on generic exposure to memory.

8.2. What Is Rejected by the Naturalistic Evidence

The study does not support the extension from controlled trigger success to robust naturalistic transfer. Held-out naturalistic paraphrases, near misses, and modal distinctions exposed errors that were not apparent in the synthetic setting. Multiple redesign families moved those errors without eliminating the source-sensitive robustness gap. The pattern is not well described as one classifier failing. It is evidence that a broader design space, including off-the-shelf semantic models, preservation-aware mixtures, predicate features, robust weighting, counterfactual augmentation, and source ensembles, still did not meet the prespecified transfer requirements.

The methodological implication extends beyond PCMIP. Random or generator-matched splits can be poor evidence for capabilities that depend on subtle semantic cueing. When wording style or source distribution can change the interpretation of a trigger, source-grouped validation is a useful stress test even if it is not a complete model of deployment shift. Our four-source development setting is too small to estimate population-level user or source invariance. We use held-out-source evaluation only as a source-variation stress test: it is sufficient to reveal that pooled metrics conceal source sensitivity, but it does not estimate how frequently such sensitivity would occur in deployment.

8.3. Why the Confirmatory Holdout Remained Unopened

The sealed holdout is not used to strengthen the present results. It was created for a specific confirmatory purpose: evaluating a development method that had already satisfied the prespecified eligibility criteria. No such method emerged. Scoring the holdout after that failure would have changed its role from confirmation to post-hoc exploration.

Leaving it unopened has two consequences. First, the paper makes no claim about holdout performance; this absence is deliberate rather than missing reporting. Second, the dataset remains useful for a future study built around a genuinely new hypothesis and a new preregistration. That separation preserves a resource that would otherwise be consumed without a valid confirmatory question.

8.4. Relation to Recent Prospective-Memory Benchmarks

PM-Bench and TriggerBench reach a compatible high-level conclusion from different experimental designs: prospective behavior is fragile, especially when a model must recognize a cue without being directly asked to retrieve an intention [4,5]. Mittal likewise finds prospective-memory-inspired instruction failures under concurrent task load, but studies constraint compliance within the model response rather than persistent external condition-payload records [7]. T-Mem addresses a closely related retrieval problem by constructing anticipatory triggers at write time [6]. Cue-Anchored Working Memory and Remember When It Matters move even closer to system-level selective delivery [19,20]: the former makes trigger conditions first-class harness objects, while the latter uses a separate memory agent to decide whether to inject a reminder or remain silent. PCMIP differs less by owning a unique component than by making a particular lifecycle and its causal controls jointly observable: explicit write, boundary, condition detection, selective payload intervention, condition-payload permutation, and a baseline-equivalent null path, followed by a held-out naturalistic transfer attempt. The appropriate relationship among these systems is complementary and partially overlapping, not hierarchical.

9. Limitations, Validity, and Reproducibility

The first limitation is construct scope. PCMIP operationalizes event-based prospective memory as a property of an engineered language-model system; it is not a cognitive model and does not establish an intrinsic memory faculty in the underlying backbone. Memory writing is system controlled, the primary trigger is external to the backbone, and the controlled actuation path executes the retrieved payload directly. A system in which the language model autonomously decides what future intention to store and later how to realize it would address a substantially different question.

The second limitation concerns distributional scope. The controlled benchmark is synthetic and inherits assumptions of its generator. Its value is precise causal comparison rather than ecological realism. The held-out naturalistic challenge deliberately departs from the controlled templates, but it remains small: 128 cases across eight semantic strata and a limited number of source-writing packets. The later source-held-out analyses are therefore stress tests for source shift, not estimates of population-level variability or deployment performance. The provenance record further documents the case-writing/review workflow without independently proving human authorship or reviewer independence beyond those project records.

Third, the binary adequacy criteria are governance devices rather than universal constants. For example, the 0.65 source/group sensitivity requirement was fixed before the relevant analysis so that near-miss outcomes could not be rescued after inspection. A value of 0.632 is not scientifically discontinuous from 0.650; the binary decision is retained because the study’s confirmatory logic depends on honoring the prespecified rule. Continuous values, margins, and confidence intervals are therefore reported alongside pass/fail decisions.

Fourth, the redesign sequence is development evidence. Repeated analysis of the original naturalistic challenge is useful for failure localization but also creates adaptation risk. The fresh 128-case holdout was created to protect against that risk and was never opened because no development method satisfied all eligibility criteria. Consequently, the paper supports no estimate of final-method performance on an independent confirmatory naturalistic distribution.

Fifth, the cross-backbone result is structural rather than model-native. Both tested backbones shared the same external trigger and direct-payload controller. Their identical system-path behavior under that orchestration does not constitute independent replication of prospective reasoning inside two language models. Runtime latency is also excluded from substantive comparisons where device placement was not comparable.

Finally, the literature boundary is explicitly time- and corpus-bounded. Discovery searches for the frozen 46-study mapping were executed on July 31, 2026, with the synthesis frozen immediately afterward. A separate threat scan through August 10, 2026 was kept outside that count and used only to update positioning. It includes rapidly moving work such as PM-Bench, TriggerBench, T-Mem, GradMem, MemoGen, Metis, PMMC, Cue-Anchored Working Memory, Remember When It Matters, CogniFold [21], and the prospective-memory-inspired task-load study of Mittal [7]. These papers narrow the novelty claim but do not retroactively alter the frozen review corpus.

Reproducibility was treated as part of the experimental design. Each evidence class is tied to a repository state, machine-readable results, an evaluation contract, and checksums; failed runs and technical amendments are retained rather than silently replaced. The JMLR online appendix consolidates model revisions, trigger features and training settings, split hashes, statistical procedures, development-model locks, evidence-package pointers, and the protected holdout hash. This auditability does not eliminate the validity limitations above, but it makes the distinction between controlled evidence, failed transfer, development analysis, and unobserved confirmation inspectable rather than rhetorical.

10. Conclusions

This study asks when persistent memory should be allowed to change the behavior of a frozen language-model system, not merely whether information can be stored and retrieved. PCMIP makes that question observable by separating condition-payload storage, persistence, later trigger detection, selective intervention, payload causality, and an exact null path. Under controlled conditions, the complete mechanism satisfied all prespecified adequacy criteria and exhibited the intended causal and selective behavior.

That controlled success did not survive the harder transfer question. The unchanged trigger failed the held-out naturalistic challenge, and development-only redesigns could improve pooled naturalistic accuracy or preserve controlled behavior without eliminating held-out-source and semantic-group failures. Trigger-action factorization then narrowed the remaining problem: once a valid trigger was available, action resolution was correct in the evaluated development cases. The unresolved bottleneck was deciding, under linguistic variation, whether a later event truly satisfied the stored future condition.

The resulting conclusion is deliberately bounded. Prospective-memory-like behavior can be engineered and causally audited around a frozen language model, but controlled success is insufficient evidence of reliable naturalistic triggering. Evaluations of persistent memory should therefore treat false activation, exact non-intervention, causal dependence on the correct stored record, preservation of previously established behavior, and distributional robustness as first-class outcomes rather than relying on pooled retrieval or task accuracy alone. A future confirmatory study should begin from a new hypothesis and a new prespecified registration of its evaluation plan; the unopened holdout in the present study carries no performance claim.