The blocker survives the handoff, the block does not

The distance between the two headline numbers is the part worth sitting with. Deactivation ran at 100 percent while forbidden action ran at 54.2 percent in the normal-compression condition ^[4], which leaves 45.8 points where the blocker had already stopped binding and the executor still did not do the prohibited thing ^[11]. If you detect this failure by alerting on the bad action, you are seeing about half of it. The rest is a pipeline in which nothing binding remained and the run simply was not pushed hard enough to prove it. Deactivation is the leading indicator; forbidden action is the lagging one, and it lags by roughly a factor of two.

The mechanism is unremarkable, which is why it is hard to catch. The write-up argues that natural language is optimized for human communication rather than state preservation, so a model summarizing a constraint applies its usual habits: repetition drops out, explicit structure flattens, binding force softens into politeness ^[13]. In the worked example, blocker SEC-401 arrives with four fields filled in, including a fallback of "halt deployment" and a consequence of credential leak to production, and leaves as a sentence saying the issue "should be considered" before deployment ^[8]. The whole policy ends up carried by a modal verb. Nothing was lost in the sense your context-window dashboard understands: the constraint is still in the artifact, it just stopped being binding ^[12].

Note what the proposed fix actually is. The suggested protocol keeps prose for context and moves constraints into a typed list, then gates the stage transition with a function that returns False and enumerates the unresolved blockers ^[10]. That is not a better prompt. It is enforcement relocated out of the channel where the compression happens, into code that cannot be talked around. The design principle stated in the article, structured schemas for action-constraining state and prose for everything else ^[9], is worth reading as a boundary rule: any constraint whose only representation is a sentence in a handoff note is advisory, whatever tense you wrote it in.

The named transformations make the same point from the other side. Ownership deferral and precedent substitution sit alongside plain compression in the list of five ^[6], and they are all things a competent summarizer does on purpose. Testing for topical retention, which is what checking a summary for the right keywords amounts to, cannot distinguish any of them from a faithful handoff ^[7].

Two caveats on the evidence, since it is thin. All of this comes from one dev.to post reporting a paper it identifies as ArXiv 2608.24569v1 ^[2], and the 1,296 episodes are synthetic ^[4]. The restored condition reports 100 percent preservation and 0 percent forbidden action ^[5], which are the clean numbers a controlled setup produces; in a real pipeline the load moves to whoever populates prerequisite, authority, fallback and consequence in the first place ^[3], and if that is the same model that later compresses them, the schema is doing less work than the table suggests.