Context Rot Is a Receipts Problem: Why Forgetting Agents Cannot Be Fixed With Better Retrieval
An agent at 60% context fill drops from 94% to 41% instruction adherence. Compaction shrinks the window cheaply. Yet every major summarization strategy scores under 2.5 out of 5 on preserving the record of what actually changed. Here is why context engineering alone cannot close that gap.
Context Rot Is a Receipts Problem: Why Forgetting Agents Cannot Be Fixed With Better Retrieval
An agent at 60% context fill drops from 94% to 41% instruction adherence. Compaction shrinks the window cheaply. Yet every major summarization strategy scores under 2.5 out of 5 on preserving the record of what actually changed. The industry spent 2026 optimising retrieval. The unsolved problem sits one layer down, in whether memory can prove what it did.
The one paragraph that matters
Context rot is real and well measured. The dominant 2026 response treats it as a retrieval and compaction problem: curate the window harder, summarise more intelligently, tier the memory, choose the right vendor. That response is measurably incomplete, for one specific reason.
Every compaction scheme is lossy, and the loss is invisible. Once a summary replaces raw history, there is no way to determine what the summary dropped. In 2025, Factory AI evaluated 36,000 real engineering session messages across three summarization strategies and found that all three scored between 2.19 and 2.45 out of 5 on artifact trail preservation, meaning the ability to reconstruct which files were created, modified, or deleted across a session. The technology to record that perfectly already exists. It lives in audit logs, version control, and hash chains. Almost no agent runtime uses it for memory.
The durable fix is architectural: agent memory has to become an append-only, verifiable record rather than a lossy narrative. Then forgetting stops being a data-loss event, because the fact never depended on sitting inside the attention window in the first place.
📉The sixty percent cliff
The most useful dataset on this problem came from a practitioner rather than a lab. A post in r/LocalLLaMA in January 2026 tracked 847 agent runs spanning 5 to 200+ turns, measuring instruction adherence, constraint violations, repetition rate, and task completion.
The finding: degradation is not linear. There is a cliff.
Around 60 to 70% utilisation, something breaks. The reported symptoms were specific and recognisable: the agent follows patterns from early conversation instead of recent instructions, drops constraints stated 30+ turns ago, repeats tool calls it already made, and hallucinates state that was true earlier but no longer holds.
That last symptom is the dangerous one. A forgotten constraint produces a refusal. A hallucinated state produces a confident wrong answer.
🧪Context rot is real, measured, and older than its name
Chroma's July 2025 technical report evaluated 18 LLMs, including GPT-4.1, Claude 4, Gemini 2.5, and Qwen3, and established the core finding that underpins everything since: models do not process context uniformly. Performance degrades as input length grows, across every experiment, including trivially simple ones like replicating a sequence of repeated words.
Two results from that report matter more than the headline.
Long context benchmarks measure the wrong thing
Needle in a Haystack tests lexical retrieval, where the query and the answer share wording. Models score near-perfect, which is why long context came to feel solved. Chroma's semantic variants, where the answer carries the same information in different words, degrade sharply with length. Real user questions are semantic. A user asks how the overseas expansion is going rather than repeating their own phrasing back at the system.
Padding a conversational memory destroys recall
On LongMemEval, Chroma compared a focused condition of roughly 100 tokens of relevant history against a full condition padded to 120k tokens with unrelated conversations. All Claude models performed significantly better in the focused condition. Same knowledge, same model, 1200x the tokens, materially worse answers.
One more Chroma result should end a piece of folk advice. The long-cited primacy and recency pattern, where information at the start and end of a window is recalled best, did not reproduce. No position held a consistent advantage. Putting your important instruction first is a habit rather than a technique.
🛑The finding that reframes the debate: premature termination
In 2026, researchers studying context rot in long-horizon search agents (arXiv 2606.29718) ran a systematic study across four flagship models and three benchmarks, and identified a behaviour that reframes the entire problem.
They call it premature termination: under extensive context, models give up, or submit an uncertain incorrect answer, long before exhausting the context window. There is still room. The model stops.
Their controlled experiment held query difficulty fixed by sampling five trajectories per query and grouping them by length rank, which means the query set was identical across groups while average trajectory length rose. Premature termination rate still climbed monotonically. The quitting is caused by context length itself.
❌ What teams assumed
- Context management delivers better information to the model
- Smarter summaries mean higher accuracy
- The budget is a quality setting
✅ What the study found
- Management works by lowering peak context length
- Lower peak length suppresses the quit reflex
- The agent then explores further and answers better
Their mitigation analysis delivered the second surprise. They evaluated seven context management methods across three categories and concluded that context management functions as a test-time scaling strategy: it works by lowering peak context length, which suppresses premature termination and lets the agent explore further. They also noted the trade honestly. Management methods reduce the premature termination rate and improve accuracy, at the cost of more tool calls and more unfinished trajectories.
🧭The myth: context rot is a retrieval problem
Here is the consensus position, stated fairly. Context engineering superseded prompt engineering, and the field now generally decomposes into four operations on the context window:
- Write: putting things into a scratchpad, a memory store, or a file the agent can read back
- Select: retrieving the right things, whether documents, tools, memories, or files
- Compress: summarisation and hierarchical compaction
- Isolate: sub-agents working in clean windows so streams do not contaminate each other
Memory then split off into its own product category with at least five recognisably different design camps. Mem0 distils extracted user profiles. Honcho models the user's mental model through reflective learning. OpenViking treats context as an operating system with a hierarchical file paradigm and skills as first-class objects. MemPalace keeps everything and organises it spatially. ByteRover keeps hierarchical knowledge as inspectable Markdown. These products do not interoperate. Each optimises a different failure mode.
This is genuinely good work, and it has produced real gains. The industry is working one axis very hard.
⚖️Complexity does not pay
If retrieval and compaction were the whole story, you would expect the more sophisticated method to win. The data says otherwise.
JetBrains Research published The Complexity Trap (arXiv 2508.21433) at the DL4Code workshop at NeurIPS 2025, comparing three strategies on SWE-agent with SWE-bench Verified, 500 instances per configuration, spanning Qwen3-32B, Qwen3-32B thinking, Qwen3-Coder 480B, and Gemini 2.5 Flash:
- Raw Agent: let context grow unchecked
- Observation Masking: keep the latest N turns intact, replace older tool output with placeholders
- LLM Summarization: a separate model compresses older interactions, most recent turns untouched
The result: Observation Masking was 52% cheaper than Raw on Qwen3-Coder 480B while improving solve rate by 2.6%. LLM Summarization cut cost too, at 50.4%, but could not consistently or significantly beat the simpler strategy on either axis. In four of five configurations, masking was the cheaper option.
Their hybrid of masking plus summarization cut a further 7% against pure masking and 11% against pure summarization, saving roughly USD 35 across the full benchmark.
The state of the art in 2025 was paying for an extra model call on every compaction cycle, in exchange for a strategy a sliding window matches or beats. The field responded by investing in smarter summarisation, which is the same bet with a larger stake.
📉The artifact trail problem
Here is the measurement that should govern how you build agent memory, and it is almost never quoted.
Factory AI evaluated three summarization approaches against 36,000 real engineering session messages in blind scoring. On summary quality, the anchored iterative approach, which incrementally merges new information into a persistent summary with explicit sections for decisions, file modifications, and next steps, scored 3.70 out of 5, ahead of Anthropic's approach at 3.44 and OpenAI's at 3.35. That is a real result and a real improvement.
On artifact trail preservation, meaning the ability to track which files were created, modified, or deleted across the session, all three approaches scored between 2.19 and 2.45 out of 5. A near-tie at barely above coin-flip, across every state-of-the-art method.
The gap is the finding. Summarisation preserves a narrative adequately. It cannot preserve a manifest.
And the loss compounds. Each compression generation operates on the output of the last, which is exactly the failure practitioners describe in r/AI_Agents as becoming a summary of a summary of a summary. A detail that survives generation one can be dropped in generation two, with nothing in the system recording that it was ever there. Claude Code's own documentation concedes the point plainly: this compression is lossy and details get dropped.
🕳️The architectural void
There is a structural reason memory got bolted onto language models rather than emerging from them.
The KV cache persists for roughly 5 to 10 minutes depending on provider and load, then it is gone. The model's trained weights are permanent. Between those two timescales there is nothing. No native medium-term memory. No architectural slot representing the fact that you spoke with this user last Tuesday.
Everything filling that gap is a heuristic: RAG, vector databases, file systems, knowledge graphs, curated system prompts. A widely argued point in the r/LocalLLaMA thread on KV cache architecture is that these are bridges over an architectural void. They work as lookup systems attached to a model with no internal medium-term store.
🧾What receipts-based memory looks like
A memory system earns the right to be called trustworthy when it delivers four properties. Each one is achievable today with boring technology.
Append-only, tamper-evident recording
Every relevant event lands in a hash-chained log where each record carries an index, a timestamp, a payload, a hash, and the previous record's hash. Any retroactive edit breaks the chain at that point and every point after it. You do not need to prevent an operator from lying. You need the lie to be detectable.
Advancement gated on evidence, never self-report
An agent that decides it finished, and a supervisor that trusts that declaration, have no verification layer at all. Gate progression on observable artifacts instead: required file classes produced, decision counts hit, event counts reached. The supervisor's own conclusion about whether work is done should never be an input to the determination that work is done.
Artifact claims validated against the record at submission time
This is the direct fix for the 2.19-to-2.45 problem. When an agent submits an artifact claiming it satisfies requirement R, the system resolves R against the session's existing evidence before accepting the submission. Fabricated references get rejected on the spot, rather than surviving until a human reads a summary three compactions later.
Failures written down instead of re-remembered
A resolved failure belongs in a durable, content-addressed store with a real lifecycle: open, in progress, resolved, validated, rejected. Content addressing means the artifact's identity is derived from its bytes, so the record cannot be quietly swapped. The second time your team hits the same class of failure, the lesson is already written down and already findable, and no one has to rely on an agent remembering it.
🛡️How KNIRV builds this
KNIRV is a decentralized trusted execution network, and its memory design was arrived at by running agents under supervision and discovering what the logs were missing. Four implementation details map directly onto the properties above. All of them ship.
The event log is a hash chain, by default
Sessions write to an append-only eventlog.jsonl alongside a parallel eventlog.hashchain. Each entry carries an index, timestamp, type, payload, previous hash, and its own hash. Memory here is a custody chain, so reconstructing a session means walking the chain rather than trusting a narrative.
The supervisor is a pure reducer
State plus an event produces a new state and an effect. The reducer performs no I/O and spawns no processes, which means the entire decision logic is a testable function rather than a pile of side effects. Phase progression through plan, plan review, develop, commit cleanup, commit, develop review, and complete is driven by evidence checks against the active workspace session. Agent self-report and exit codes are excluded as advancement inputs.
Evidence gates validate claims at submission
Artifacts declare which requirements they prove, and those references are checked against the session's existing evidence at submission time. Fabricated references are rejected. An agent cannot assert that it produced something and have the assertion accepted on trust.
The CLI answers why, directly
knirv why <file>:<line> and knirv blame <file> walk the evidence chain back to the originating event. That command is the entire argument in one verb. Retrieval answers what looks similar to this. Receipts answer why is this line here.
Failures become skills with a real lifecycle
When supervised work fails, the CLI builds an error pack and submits a signed ErrorNode commit (knirv.error-node-commit.v1) to the graph. ErrorNodes cluster by embedding similarity, and a resolved cluster mints a SkillNode, verified with rollback on failure. The property that matters for memory is content addressing: the skill's identity is knirv+sha256:<hex>, derived from its contents, so the artifact cannot be swapped without detection. Each ErrorNode carries a failure count and a status that moves through open, in progress, resolved, validated, and rejected, which makes recurrence visible.
Make the record the memory. Once provenance is attached at write time, prompt-level context management becomes a performance optimisation rather than a correctness requirement. You can compress aggressively because the underlying facts still exist somewhere durable and verifiable. You can trust the agent's summary of what happened because the chain behind it can be replayed.
📋A migration checklist
If you are building or operating agents in production this quarter:
❓Questions people actually ask
What is context rot?
Context rot is the observed decline in a large language model's reliability as input length grows, even when the window has not been filled. Chroma's 2025 report evaluated 18 models and found performance degrades consistently with input length, including on trivial tasks like replicating repeated words. The widely cited primacy and recency advantage did not reproduce in those experiments.
At what context fill percentage do agents start failing?
The cliff sits around 60 to 70% utilisation. One practitioner dataset tracking 847 agent runs found instruction adherence falling from 94% in the first quarter of the window to 41% in the final quarter, with constraint violations rising from 2.1% to 31.7%. Production guidance generally targets 30 to 40% utilisation, which means a 200k-token window should hold 60k to 80k tokens of actual content.
Does LLM summarization beat simpler context windowing?
On current published evidence it does not. JetBrains Research found observation masking was 52% cheaper than leaving context unmanaged while improving solve rate by 2.6% on Qwen3-Coder 480B, and LLM summarization could not consistently or significantly outperform it. Their hybrid approach cut a further 7% against masking alone and 11% against summarization alone.
Why do agents give up before they run out of context?
A 2026 study (arXiv 2606.29718) identified this as premature termination, where models give up or submit uncertain incorrect answers with substantial window remaining. The rate correlates positively with context length even when query difficulty is held constant. Context management reduces premature termination primarily by lowering peak context length, functioning as a test-time scaling strategy.
What is the artifact trail problem in agent memory?
It is the inability to reconstruct which files were created, modified, or deleted across a session after summarization has run. In a blind evaluation of 36,000 real session messages, three leading summarization strategies scored between 2.19 and 2.45 out of 5 on this dimension, against 3.70 for summary quality. Summarization preserves narrative well and manifests poorly, and the loss compounds across compression generations.
How do you make agent memory verifiable?
Four properties do it. Record every relevant event in an append-only hash-chained log where each entry carries an index, timestamp, payload, previous hash, and its own hash, so retroactive edits break the chain. Gate phase advancement on observable artifacts rather than agent self-report. Validate that artifact requirement references resolve against existing session evidence at submission time, rejecting fabricated references on the spot. Finally, write resolved failures into a content-addressed store with a real lifecycle, so recurrence becomes cheap to learn from.
- Chroma, Context Rot: How Increasing Input Tokens Impacts LLM Performance, July 2025. Evaluated 18 models including GPT-4.1, Claude 4, Gemini 2.5, and Qwen3.
- Lindenbauer et al. (JetBrains Research), The Complexity Trap: Simple Observation Masking Is as Efficient as LLM Summarization for Agent Context Management, arXiv:2508.21433, DL4Code workshop at NeurIPS 2025. SWE-bench Verified, 500 instances per configuration.
- Diagnosing and Mitigating Context Rot in Long-horizon Search, arXiv:2606.29718, 2026. Source of the premature termination finding and the seven-method mitigation analysis.
- Xu et al. (ByteDance), ContextPipe: Database-Inspired Context Assembly for Long-Horizon Agents, arXiv:2609.00749, September 2026.
- Anthropic, Effective context engineering for AI agents, September 2025. Defines context as a finite resource with diminishing marginal returns.
- Xu et al., Grounding Agent Memory in Contextual Intent (STITCH and CAME-Bench), Findings of ACL 2026.
- Red Hat, From context to dreams: architecting memory for AI agents, June 2026.
- r/LocalLLaMA, I tracked context degradation across 847 agent runs, January 2026. Source of the reliability and violation figures in Exhibit A.
- r/AI_Agents, My agent kept forgetting things mid-conversation, June 2026.
- KNIRV Network technical documentation and open-source repository. github.com/guiperry/KNIRV_NETWORK.