A safety rule and an episodic log compete for the same tokens in an AI agent's context. When the budget overflows, both are summarized at the same rate; only the rule needs exact wording to remain enforceable. On 20 production agent configurations, Claude Code's /compact prompt on Sonnet 4.6 preserves 53% of safety rules after one compaction round and 10% after five. We name this the Compaction Cliff. We address it with Knowledge Triage, a framework that classifies each line of an agent's knowledge base by type and routes each type through its own retention policy. Three deterministic operators implement this triage across the three context-management operations: TypeCompact rewrites items in place under per-type fidelity, TypeDecompose partitions a topic too large to compact safely, replicating in-scope safety rules across partitions, and TypeRetrieve fetches items from external storage with in-scope rules pinned ahead of relevance. On five public corpora, TypeCompact preserves 2--4× more safety rules than the strongest single-shot LLM compactor at every ratio, with 96% recall over five rounds. TypeDecompose reaches 0% locality violations against 93% under uniform partitioning. TypeRetrieve reaches 100% recall@50 against 73% for the best single-shot LLM retriever. On three downstream behavioral benchmarks, we outperform the production Sonnet compactor on medical compliance (paired McNemar p<10−8 on preservation, N=200), the full-policy and hierarchical baselines on retail task pass rate (p<0.01, N=115), and the hierarchical compaction on the airline domain (p=0.024). We release AgentArtifactCorpus (396{,}934 agent configurations from 54{,}628 public GitHub repositories), the classifier, and the reference implementation.
Figures & tables
Figure 1. Knowledge Triage. Classifier τ assigns each working-set item one of five types; three deterministic operators apply per-type policies: TypeCompact compresses without dropping safety rules, TypeDecompose splits large topics and duplicates rules that span them, TypeRetrieve returns applicable rules first. A verifier checks that every constraint survived; if any are missing, the output is flagged unsafe , otherwise it becomes the next working set.
System
Typed
Op C
Op D
Op R
Safety
model
guarantee
MemGPT ( 24 )
–
✓
–
✓
–
A-MEM ( 36 )
–
–
–
✓
–
GraphRAG ( 9 )
–
–
–
✓
–
LLMLingua-2 ( 25 )
–
✓
–
–
–
MaRS ( 2 )
✓
✓
–
–
partial
Table 1. Positioning of Knowledge Triage.
Type
Definition
Distortion tolerance
Examples
Constraint (C)
Rule that bounds agent behavior; violation causes safety failure
Zero; any loss is unsafe
“Never prescribe contraindicated drugs”
Procedural (P)
Step-by-step instruction for a task
Semantic equivalence iff execution preserved
“Run pytest -x --tb=short before merging”
Belief (B)
Factual assertion treated as true
Bounded by semantic distance
“Backend exposes a REST API over HTTPS”
Preference (F)
Soft guideline
High; may be summarized or merged
“Use 2-space indentation”
Episodic (E)
Past event or observation
Free; may be discarded
“Refactored auth module yesterday”
Table 2. The five operational knowledge types of Knowledge Triage, with their distortion tolerance under context compression and illustrative examples drawn from several domains.
Table 3. Corpora used in the empirical validation.
Type
% of items
Precision
Recall
F1
Constraint
12.3
0.91
0.87
0.89
Procedural
28.7
0.94
0.92
0.93
Belief
31.4
0.86
0.84
0.85
Preference
14.2
0.83
0.80
0.81
Episodic
13.4
0.90
0.88
0.89
Table 4. Knowledge type distribution and classifier performance on AgentArtifactCorpus ( n=2,000 annotations).
Strategy
C
P
B
F
E
All
Hierarchical truncation
0.50
0.82
0.75
0.63
0.77
0.69
Temporal windowing
0.58
0.80
0.64
0.78
0.91
0.74
Aggressive pruning
0.51
0.75
0.67
0.66
0.84
0.69
TypeCompact
1.00
1.00
0.50
0.51
0.84
0.77
Table 5. Preservation rate by knowledge type at 50% compaction across 50 AAC configurations.
Figure 2. Constraint preservation vs. target compression ratio on 20 AAC configurations. Structural baselines are tabulated at 50% in Table 5 ; full numerical detail in Table 6 .
Strategy
C
P
mF1
time
tok
50% compression
TypeCompact
1.00
0.92
0.75
0.0s
0
LLMLingua-2
0.21
0.72
0.63
0.5s
0
MaRS-FL (ours, no public impl)
0.99
0.89
0.69
0.5s
0
gpt-5.4-nano (single-shot)
0.52
0.80
0.69
9.9s
56K
gpt-5.4-mini (single-shot)
0.48
0.77
0.68
7.3s
57K
Table 6. TypeCompact vs SOTA prompt compactors at three compression ratios, mean across 20 AAC configurations.
Figure 3. Constraint recall after N sequential compaction rounds at 50% per round, 20 AAC configurations.
Long-running agents periodically compact their context, replacing the transcript with a model-generated summary. Recent work shows that dropping a standing safety constraint during compaction drives behavioral violations across many models (Governance Decay; Chen, 2026). We ask a finer question: under a single compaction cycle, how is a safety rule lost, and what does that imply for detection and evaluation? Our central finding is that a presence check is not a safety check: when compaction does not drop a rule outright, it often leaves something that looks like a rule but does not act like one. On behavioral replay, a degraded residue leads the model to perform the prohibited action far more often than an intact welded rule does (all-case gaps of +34 and +57 points under two replay models, both positive), category-level survival behaves like a residue, and even intact rules sometimes fail to fire, so an audit that checks only textual presence gives false assurance. Sharpening this, rule-form items are retained substantially more often than prominence-matched facts, which is exactly why presence-based checking feels adequate even though survival is not protection. Textual loss is regime-dependent (weld-or-drop with a single rule; degraded predicate-loss residues under a tighter budget), and we did not observe the hypothesized textual severing mode. Such loss is silent at runtime and detectable only by comparison with retained external ground truth (such as a constraint registry), which reveals textual absence but not whether a surviving rule still fires. We also document evaluation pitfalls where LLM-judge labels alone would have reversed a conclusion. All results concern a single compaction cycle.
Ted Kwartler, Alan Aqrawi, Arian Abbasi
Harvard Extension School, Harvard University; Americas Advanced AI Practice Lead, Accenture. · Accenture.
Agents often work on complex problems that require millions of tokens of context, which necessitates compacting across sessions due to limited context windows. We develop CliffCompaction, an autocompaction technique that reduces cost by up to 50% under a bounded context while maintaining or improving performance on Terminal-Bench and achieving new levels of efficiency for test-time scaling and state-of-the-art results on KernelBench. The per-rollout savings of CliffCompaction make the performance--cost trade-off of test-time scaling more efficient, adding over 10 percentage points on Terminal-Bench for less than the cost of two full-context runs. Under parallel test-time scaling, CliffCompaction lets Kimi K2.6 match Opus 4.7, and exceed Opus 4.6 and GPT-5.3 Codex at lower cost. The key to CliffCompaction's effectiveness is that it keeps compacted information faithful by only truncating or dropping content, never rephrasing or rewriting it. We never compact a compaction---each pass operates only on original content, and prior compacted output is discarded, preventing context drift from accumulating. These properties sustain continual learning over sessions exceeding a million tokens: on KernelBench, CliffCompaction reaches CUDA kernel speedups of 2.23× after 200 steps and 3.58× after 400 steps, surpassing specialized search algorithms and trained agents despite being a general-purpose compaction technique. We open-source a scaffold-agnostic API-proxy implementation of CliffCompaction usable with Claude Code, Codex and other harnesses.
Modern LLM agents increasingly rely on context compaction, summarization, or eviction to keep long-running sessions within a token budget. We show that this context-management layer is a safety-critical failure surface: in-context governance constraints that agents reliably obey while visible can be silently removed by compaction, causing the same agent to perform prohibited tool actions later in the session. We call this failure mode Governance Decay. We introduce ConstraintRot, a benchmark of long-horizon agent scenarios with deterministic tool-call grading, and measure compaction-induced violations across seven model families. Across 1,323 episodes, violation rises from 0% with the policy in full context to 30% after compaction, reaching 59% for some models; when the constraint survives the summary, violation remains 0%, but when it is dropped, violation reaches 38%. We further study a Compaction-Eviction Attack, in which adversarial in-context content biases the summarizer to omit a legitimate policy, and show that optimized injections defeat every evaluated model. Finally, we propose Constraint Pinning, a simple training-free mitigation that quarantines governance constraints from lossy compaction and restores violation to 0% in our benchmark. These results identify context management as a first-class governance surface for deployed LLM agents.