Abstract. The most expensive failure mode we have measured in agentic systems is not forgetting. It is non-use: the rule was in context, readable and current, and the agent acted against it anyway. In twenty-six of twenty-seven production failures we dissected, the violated rule was present at the moment of violation. This paper characterises the phenomenon and the levers that move it, on controlled benches: adherence to a realistic instruction file is perfect for roughly thirty turns and then falls off a cliff after compaction (to 39% in the first post-compaction bin; violation rates moving from 2.2% to 82.8% across a forced boundary in a 30-session study), one worked example at the decision point is worth roughly thirty points and saturates at one, re-introduction at the moment of need restores adherence completely in-bench (23/23) at about 317 tokens per intervention, and making a rule structural rather than advisory took the failure rate to zero across twenty-eight trials.
We also report the result that most constrains our own commercial claims: a twenty-line hook that re-appends the instruction file after every compaction solves the static case perfectly (21/21). The measured value of anything more sits entirely in state change: expiries, cross-session knowledge, cascades, and lawful override, where the hook scores near zero and a state-aware engine scores near-perfect. Every number here is bench-internal. Live-work uplift is the claim this programme has not yet earned, and we say so in the hero rather than the footnotes.
01The failure nobody logs
When an agent breaks a rule, the natural diagnosis is memory: it must have forgotten. Our dissection of twenty-seven real production violations says otherwise. In twenty-six, the rule was in the context window at the moment of violation — not truncated, not compacted away, not stale. Present. The agent read past it. Nothing was missing.
This is why the failure escapes logging. Nothing is missing, so no absence can be detected; the transcript of a violation looks identical to the transcript of a compliance, until the consequence arrives. It is also why the failure is expensive out of proportion to its frequency. The rules worth writing down are the ones whose single violation costs most.
02Why the obvious fixes fail
Three intuitive remedies, each measured, each insufficient.
A bigger window does not help. Our depth diagnostics ruled distance out: a rule a page away already fires as well as an adjacent one. This sits in useful tension with the position-effect literature: Liu et al. report a U-shaped degradation for material in the middle of long contexts[8], and RULER finds effective context far shorter than claimed context[9]. At our working ranges the distance term was inert; at theirs it is not. The reconciliation we currently hold is scale: our sessions operate well inside the range where position effects dominate, and load, not position, is the binding constraint there. The enemy is not how far away the rule sits. It is eviction and load: whether the rule survived the last rebuild, and how much else is competing for the same attention.
Asking the model to check itself does not help. Self-audits sample. Asked to verify its own compliance letter by letter, a model checks some letters; we measured the blindness directly. An audit that samples is an audit that passes violations at a rate you do not control.
Repetition helps the wrong things. The strongest single predictor of what an agent acts on is what its context restates most, and restatement dominates truth by orders of magnitude in our fitted adjacency work: repeated-but-stale beats true-but-quiet, while distance and topic switches are inert. This is the mechanism behind what the literature is beginning to call memory-induced sycophancy. It means the naive fix — repeat the rule more — actively arms stale rules against current ones. What is needed is not louder memory. It is resolved memory. The current truth, served once, at the right moment.
03The cliff
Adherence does not decay gently. On a realistic fifteen-instruction file, agents obeyed perfectly for roughly thirty turns; in the first bin after a compaction, adherence fell to 39%. In a thirty-session controlled study with objective grading, violation rates moved from 2.2% before a forced compaction boundary to 82.8% after it. Per-rule survival into the summary mediates the effect strongly (Fisher p<0.00001), with a nuance that matters: survival is not restoration. A rule that makes it into the summary is not thereby acted on. The file still exists throughout; its contents have simply stopped being in the room.
| condition | adherence / firing | source |
|---|---|---|
| pre-compaction (realistic instruction file) | ~100% for ~30 turns | LITE1, bench |
| first post-compaction bin, bare | 39% (9/23) | LITE1, bench |
| violation rate across forced boundary | 2.2% → 82.8% | RSL Track-A, n=30×22 turns |
| liveness check + verbatim reinject at decision point | 100% (23/23) · ~317 tokens/save | LITE1, bench |
04The levers, measured
Attention is movable, and the levers rank cleanly on our benches.
| intervention | effect | note |
|---|---|---|
| rule present, nothing else done | 26/27 failures | the baseline this paper exists about |
| one worked example at the decision point | +29.6 pts (repl. +30.1) | saturates at one; distance-invariant |
| rule re-introduced at the moment of need | +24.9 pts (z=3.03) | the serve principle |
| explicit cue to check | 123/123 | cueing works when you know when to cue |
| rule made structural, in-path | 28–0 | the work must pass through it |
The ordering carries the design lesson. Advisory presence loses; placement at the decision point wins; structure beats both. The strongest lever is not an attention lever at all. It removes the dependence on attention entirely, and the sibling Talon notebook reached the same conclusion independently at commit time: discovery-time signals are advisory, commit-time signals are contracts[6]. Two programmes, two failure domains, one principle.
05The honest competitor
Any serve-at-need system must answer a blunt question: why not a twenty-line hook that re-appends the whole instruction file after every compaction? We built that hook and benchmarked against it, three arms: bare, hook, engine. We report its wins as loudly as ours.
06Where only state-awareness works
The hook's assumption is that the file is true. Sessions change state out of view of any static file. There the hook does not degrade. It inverts.
| case class | 20-line hook | state-aware engine | failure shape |
|---|---|---|---|
| temporal ("until-X", X fired out of view) | 0/12 | 12/12 | hook re-serves the stale override forever |
| cross-session knowledge | ~0 | 12/12 | the file never contained it |
| cascade (dead dependents of a killed job) | — | 6/6 | silent absence must become governed, visible absence |
| lawful operator override | 1/6 | 14/17 pooled | the hook turns your own absolute against you |
This table is the commercial honesty of the programme in one place. The free tier is the hook's job done well: watch each instruction's liveness, reinject at the moment of loss. The paid delta is exactly the four rows a static file provably cannot know, and it is worth paying for precisely where a dead rule is expensive — teams, unattended agents, compliance. It is not a solo-coder product, and positioning it as one would be selling the hook at engine prices.
07Related work
[1] Koherium, What Survives Compaction, 2026 — the eviction half: what stops being in the room at all.
[2] Koherium, Quadratic Sessions, 2026 — the economics that fund the failure.
[3] Packer et al., MemGPT, 2023 — context as managed memory; storage-side neighbour.
[4] MemSyco-Bench and Whose Facts Win? (ACL 2026) — the repetition-bias phenomenon benchmarked; no remedy shipped. The white space this programme occupies is the join: measured phenomenon plus benchmarked serve-at-need remedy.
[5] Zep/Graphiti; Governed Shared Memory — recency-resolution and architecture-side neighbours respectively; neither carries truth-status resolution with a measured remedy.
[6] Jeffrey, Bug-Class Forcing Functions, Cogmeta Research 2026 — independent convergence on structural-over-advisory at commit time.
[7] Cross-model portability results (internal, XMODEL): the serve format holds from a 3B model (7/10) through a 32B (9/10) to Sonnet-class (10/10); the one failure that survives scale-up is grade-weighing, mitigated engine-side.
[8] Liu et al., Lost in the Middle, 2023 — position effects in long contexts; see §02 for where our distance-inert result does and does not conflict.
[9] Hsieh et al., RULER, 2024 — effective context length under load; the load half of our eviction-plus-load diagnosis.
[10] Laban et al., LLMs Get Lost in Multi-Turn Conversation, 2025 — 39% average multi-turn degradation, driven by unreliability rather than aptitude; convergent with present-but-unfired as a reliability failure.
[11] Shi et al., Large Language Models Can Be Easily Distracted by Irrelevant Context, 2023 — the load mechanism isolated: added irrelevant material degrades reasoning on otherwise unchanged tasks.
[12] Sharma et al., Towards Understanding Sycophancy in Language Models, 2023 — feedback-driven sycophancy; the training-side cousin of the restatement-dominance measured in §02.
[13] Zhou et al., IFEval, 2023 — verifiable instruction-following evaluation; the single-turn baseline against which the multi-turn cliff of §03 stands out.
08Limitations
Everything here is bench-internal. The production-failure dissection is real-world; every uplift number is not. Benches use synthetic worlds, small cells (5–23), and predominantly one model family. The cross-model portability results extend the serve format, not the uplift claims.
The adjacency work is fitted on gated data. The restatement-dominates finding is directional and strong on our own estate; the pre-registered representative-sample refit is what turns it into a population number, and until then we state the direction without leaning weight on the magnitude.
Selection in the dissection. The twenty-seven failures were failures that got noticed. Violations whose consequences never surfaced are absent by construction, and we cannot bound how many there were.
Cueing requires knowing when to cue. The 123/123 cue result is an upper bound on serve value, not a serve result: it assumes the matcher fired. Our current matcher recalls 60% against a 90% calibration bar and is held out of default until it clears — a system that serves confidently at the wrong moment re-creates the restatement problem it exists to solve.
09Claims and non-claims
- Present-but-unfired is the dominant measured failure mode in our production dissection (26/27), and it is invisible to absence-based monitoring.
- Adherence collapses at the compaction boundary (39% first bin; 2.2%→82.8% violations), mediated by per-rule survival, with survival not implying restoration.
- On benches, decision-point placement restores adherence completely (23/23, ~317 tokens per save), and structural enforcement removes the failure class (28–0).
- A trivial hook fully solves the static case; measurable engine value exists only in state change (temporal, cross-session, cascade, override).
- Live-work uplift. Every number is bench-internal; the field instrument is in build and this claim is deliberately unclaimed until it lands.
- That the adjacency magnitudes generalise beyond our estate before the pre-registered refit.
- That serve-at-need is deployable at current matcher calibration (60% vs a 90% bar; it waits).
- That any of this is a solo-coder value proposition; the state-change delta prices for teams and unattended fleets, and the static slice should be, and is, cheap.
10The instrument still owed
The gap between this paper and a product claim is one instrument: a live, in-situ measurement of whether serving the rule at the decision point raises how often real work applies what it already knows. The bench results above make it worth building. They do not substitute for it. When it runs, its number goes in this section as measured, whichever way it falls; the programme's record on publishing its own negatives is the reader's warranty on that sentence.