一句话：提出有界状态机编排框架，将 LLM 作为规划器用于内存快照诊断分析，提升多步推理的稳定性与准确率。
内存快照往往是系统严重故障、恶意注入或疑似入侵后唯一可靠的运行时证据，但其分析仍高度依赖人工与工具。本文提出一种有界状态机编排框架，把大语言模型作为规划器嵌入受控的“规划→执行→终结”流程，在模式定义的诊断原语之上工作。该设计强制显式控制流、模式校验的工具调用、执行解耦以及基于投影的上下文缩减，从而稳定对大型运行时工件上的多步推理。作者在三个 Windows 内存快照（一个受控良性负载和两个真实恶意软件样本）上用 45 个调查查询进行评估，正面查询获得 82.9% 的正确且有依据的回答，负面查询正确率 100%，工具输出规模最多减少 89%，并在实验快照中识别出两个真实恶意软件样本。
Memory snapshots are often the only reliable runtime artifact available after severe system failures, injected malicious activity, or suspected compromise, yet their analysis remains manual and tool-intensive. We present a bounded state-machine orchestration framework that integrates a large language model (LLM) as a planner within a controlled plan→execute→finalize process over schema-defined diagnostic primitives. The design enforces explicit control flow, schema-validated tool invocation, decoupled execution, and projection-based context reduction to stabilize multi-step reasoning over large runtime artifacts. Evaluated on three Windows memory snapshots, including one controlled benign workload and two real-world malware samples, using 45 investigation queries, the framework achieves 82.9% correct and grounded responses on positive queries and 100% correctness on negative queries, while reducing tool-output size by up to 89%. It also identifies two real-world malware samples within the experimental memory snapshots.