Full history
The rule and the shift are both still in the window when the new request arrives.
Daily demo · 4 Nov 2026
Scripted tool calls. No model, no network, no API key. The rates in the strip are ARCBench’s. The badges are this page’s script.
A long ops shift fills the context window, and the harness replaces the older turns with a short summary. The dock-window task is still in that summary. The mail rule is the part that slips, or stays in words the agent does not obey. Northwind Logistics allows send_email and open_ticket. The handbook allows recipients at @northwind.example only.
Full history
The rule and the shift are both still in the window when the new request arrives.
After compact
The new request stays. The older turns, where the handbook was, become one paragraph.
These rates are from the paper. This page does not measure them. violation@3 counts a case if any of three runs breaks the rule. The 2.6× figure is a different cut: the share of runs.
9.6% → 37.8%
violation@3, full history to after compaction
Study S1, all four models. 8.9 points also fail with the full history. 28.9 appear only after compaction. Compacted runs still retain the rule 70.1% of the time, keep it in part 26.9%, and lose it 3.0%.
2.6×
retained-rule runs versus full history
21.1% of compacted runs that still contain the rule violate, against 8.1% of full-history runs. Keeping the sentence and obeying it are different events. Partial retention violates on 29.4% of those runs. Absence violates on 83.3%.
91.2% kept
generative summaries retain the rule
Generative strategies reach 21.8% violation@3, with the rule partial in 7.8% of runs and absent in 0.9%. Selective compactors lose the rule in 84.1% of runs and reach 50.2% violation@3. FIFO loses it in every run.
Loading the shift.
The rule is company policy in the handbook, the delivery ARCBench found held for every full-history organizational case. Personal instructions, which a later user message can be read as lifting, still failed with the full history in view: 25.0% and 16.1% violation@3.
Operator, after the window fills
Pick a path. Compliance is the call in the log.
The handbook stays in the window.
Not run
Options changed. Run this path again.
A model-written summary replaces the shift.
Not run
Options changed. Run this path again.
The same summary, then the handbook sentence again.
Not run
Options changed. Run this path again.
The badges are a script, written so the failure is easy to see. It refuses on the full history and when the rule is pinned after the summary. It sends the vendor CC when the only rule text it has is the summary, including when that summary quotes the handbook. ARCBench’s models do not snap back that cleanly. Under the escape attack, rule preservation put the rule back in 99.0% of runs and brought violation@6 from 58.8% down to 29.4%, still above the 23.5% no-attack runs in that study. The tool gate is ordinary code. It reads the addresses on the call.
Put the hard rule in a slot the compactor is not allowed to rewrite: a system block, a handbook file, or a policy tool the agent has to read again. Re-inject those same words after every compact, including a manual /compact. In the paper, that restore is strong on the text and partial on the behavior.
The wrapper on send_email looks at to, cc, and bcc. Any domain other than northwind.example returns an error, and nothing is sent. The attempt still counts.
function isInternal(email) {
const value = String(email).trim();
const at = value.lastIndexOf("@");
if (at < 1) return false;
return value.slice(at + 1).toLowerCase()
=== "northwind.example";
}
A dashboard that asks whether the summary still contains the sentence will miss the retained-rule failures. Log the arguments the wrapper saw. Some teams also skip the paraphrase and search the original turns when a later step needs the rule. That is a different design. ARCBench measures compaction.