Safety rules survive compaction as text but stop firing as rules.

arXiv 2608.11392 studies what happens when a long-running agent compacts its context: a standing constraint frequently persists as textual residue that no longer governs behavior. Behavioral replay shows models perform the prohibited action far more often with a degraded residue, with all-case gaps of +34 and +57 points across two replay models. Rule-form items are retained more often than matched facts, which is what makes presence-based auditing feel adequate. Grepping your summary for the constraint string is measuring the wrong thing.