上下文注入与长程可靠性：区分重复识别、局部处理与计数器跟踪

# Context Injection and Long-Horizon Reliability: Separating Duplicate Recognition, Local Processing, and Counter Tracking
Source: [https://arxiv.org/html/2610.20633](https://arxiv.org/html/2610.20633)
###### Abstract

Long\-horizon failures of language models are usually measured as end\-task success or as a horizon length\. We instead score, step by step, three components of a 400\-step ledger task in which every step is easy in isolation and the model’s own answers are re\-injected into its context: recognising a record already seen 5 to 300 steps earlier, processing the current record locally, and writing a counter incremented at every step\. On Qwen3\-8B \(non\-thinking, 20 seeds, replicated on a second machine and backend\), with every step scored component by component, two results hold\. First, duplicate\-recognition errors rise late in the episode — from 0\.0019 to 0\.011 per step at risk across step 200 — while the counter makes no error in 8,000 steps and local processing is descriptively stable; the rise combines long\-distance recall errors and rising false alarms\. Second, a block of irrelevant content inserted before each step makes the counter fail in 20 of 20 seeds on each machine, against none without it, while its effect on local processing is much smaller and not distinguishable from none\. Three pre\-registered follow\-ups probe the counter\. Its value depends on the value present in the response history: a corrupted value persists without correction in every seed, and an exact external reminder, repeated before each message, re\-aligns it within one to two steps\. A block with the exact form of the helpful one but irrelevant content was not conclusive\. Under the irrelevant block, no counter error was observed when an exact compact reminder of the state, supplied externally by an oracle, preceded each message \(0 of 20 seeds with an error, against 15 without it\), and this reminder outperformed a length\-matched neutral text; whether a single reminder suffices was not conclusive, and the absence of damage to the other components was not established\. Pre\-specified and complementary analyses are distinguished; family\-wise results are reported with Holm correction \(§4\)\. An aggregate or exclusive error classification can hide the difference we report\.

## 1Introduction

A model that runs for hundreds of steps can fail because it can no longer connect what it sees now to what it saw long ago, because it mis\-processes the current input, or because it loses track of a value it has to carry\. End\-task success and horizon length mix the three\. Recent work shows that per\-step accuracy decays with the number of turns and that errors in the history make later errors more likely\([Sinha et al\., 2026](https://arxiv.org/html/2610.20633#bib.bib13)\); that context length alone degrades performance even when retrieval is perfect\([Du et al\., 2025](https://arxiv.org/html/2610.20633#bib.bib3);[Levy et al\., 2024](https://arxiv.org/html/2610.20633#bib.bib8);[Hong et al\., 2025](https://arxiv.org/html/2610.20633#bib.bib4)\); and that agents drift from their goal under pressure\([Arike et al\., 2025](https://arxiv.org/html/2610.20633#bib.bib1)\)\. What these results do not tell a practitioner is*which*component gives way first, and whether adding context to help the model is safe\.

We build a bench in which three step\-level components are scored separately, and we read them as ahazard: the probability of an error at step*k*given no earlier error of the same component\. By*carried state*we mean, operationally, a value the model must rewrite at every step from its own previous output — here, a record counter; we make no claim about how the model represents it\. By*duplicate recognition*we mean answeringDOUBLONexactly when the current code was seen earlier in the episode\. The protocol does not measure intent or goals\.

Main results \(Qwen3\-8B\)\.

- •R\-A\. Duplicate\-recognition errors rise with the horizon; the counter makes none; local processing is descriptively stable\.The rise is carried by long recall distances and by false alarms on new records, not by a loss at constant distance\.
- •R\-B\. Injected context disrupts the counter far more than local processing\.A block of irrelevant content before each step makes the counter fail in every seed; its effect on local processing is much smaller and not distinguishable from none, under a component\-wise scoring that removes any masking between rules\. Prior work established that length hurts; the observation here is*which*component the tested blocks hit\. A pre\-registered follow\-up \(§5\.3\) shows that the counter depends on the value present in the response history; in another \(§5\.5\), under the same repeated disruption, no counter error was observed when an exact reminder of the state, supplied by an oracle, preceded each message, and that reminder outperformed text of the same length without the state\.

Secondary results, each reported with the multiple\-comparison correction it survives: listing the already\-seen codes before each step lowers duplicate\-recognition errors, partially; repeating the rules before each step was followed by duplicate\-recognition errors in every seed within 25 steps; over Qwen3 4B–32B, the duplicate\-recognition hazard falls from 8B to 14B and to 32B; and the 32B tends to fail all\-or\-nothing\.

## 2Related work

Long\-horizon execution\.[Sinha et al\. \(2026\)](https://arxiv.org/html/2610.20633#bib.bib13)isolate execution from planning with a dictionary lookup and a running sum, on the same Qwen3 4B–32B ladder, and show that per\-step accuracy decays, that errors in the history cause further errors \(self\-conditioning\) independently of scale, and that thinking mode removes self\-conditioning; in conversation, models that take a wrong turn do not recover\([Laban et al\., 2025](https://arxiv.org/html/2610.20633#bib.bib7)\)\. We differ in three ways: we score components instead of turns; we vary the distance of the record to be recognised; and we test injected blocks against an irrelevant\-content control\. Sinha et al\. also decompose their task in an appendix \(lookup alone, addition alone, state tracking\); what we add is the measurement of several components jointly, within the same trajectories, under the same interventions\. Their running sum fails where our counter holds, and there is no contradiction: their sum requires a lookup plus a two\-digit addition at every turn, our counter only a \+1\. That our counter holds without injection is consistent with plain continuation of an autoregressive pattern, which is why we call it*trivial*and draw no conclusion from its stability alone\.[Pai & Xian \(2026\)](https://arxiv.org/html/2610.20633#bib.bib10)carry an explicit state through 196 dependent tool calls and separate state errors from arithmetic errors; their*implicit*round index slips, our*explicit, written*counter does not\. METR’s time horizon\([Kwa et al\., 2025](https://arxiv.org/html/2610.20633#bib.bib6)\)is a whole\-task, human\-time measure; ours is a per\-step hazard on trivial steps\.

Context length and distractors\.Performance degrades with position\([Liu et al\., 2024](https://arxiv.org/html/2610.20633#bib.bib9)\), with input length on a fixed task, Qwen3\-8B included\([Levy et al\., 2024](https://arxiv.org/html/2610.20633#bib.bib8);[Hong et al\., 2025](https://arxiv.org/html/2610.20633#bib.bib4)\), with irrelevant sentences\([Shi et al\., 2023](https://arxiv.org/html/2610.20633#bib.bib12)\), across synthetic long\-context suites\([Hsieh et al\., 2024](https://arxiv.org/html/2610.20633#bib.bib5)\), with narrative wrapping\([Pan & Williams, 2025](https://arxiv.org/html/2610.20633#bib.bib11)\), and with length alone, even as whitespace or masked tokens\([Du et al\., 2025](https://arxiv.org/html/2610.20633#bib.bib3)\)\. We do not claim that volume hurts\. We claim that, on a counter the model writes and reads back at every step, the tested blocks hurt the counter far more than local processing\. The "retrieve then solve" strategy of[Du et al\. \(2025\)](https://arxiv.org/html/2610.20633#bib.bib3)is close to listing the seen codes; neither they nor the other works compare it with an irrelevant block at least as long\.

Recognition, interference and drift\.The late rise of false alarms we observe — new codes reported as already seen — is compatible with proactive interference\([Wang & Sun, 2025](https://arxiv.org/html/2610.20633#bib.bib14)\)as seen codes accumulate\.[Arjmandi \(2026\)](https://arxiv.org/html/2610.20633#bib.bib2)uses "binding drift" and "commitment drift" for an agent whose state is owned by code, so that binding error is zero by construction; our duplicate recognition is defined operationally, and our rule re\-injection places the rules in the prompt rather than in a code\-owned store — different objects, not contradictory results\. Goal drift under competing objectives\([Arike et al\., 2025](https://arxiv.org/html/2610.20633#bib.bib1)\)motivates the question but is measured per episode\.

## 3Bench

Task\.The model receives, once and at step 0, the rules of a ledger, then one record per message \(a 4\-character code, two integers, and a random token\)\. For each record it answers one line with four fields: a counter \(records processed so far, this one included\), the code in upper case, the sum of the two integers, and the token copied verbatim\.R1 \(local processing\): code and sum must be right \(the token is scored separately, as the canary\)\.R2 \(duplicate recognition\): if the code was already seen earlier in the batch, the model must answerDOUBLONinstead; each episode contains repeats at distances 5, 40, 150 and 300 steps, placed by design so that a repeat at distance*d*cannot occur before step*d*\.Counter: the counter must equal the step index \+ 1; in the original arms nobody ever reminds the model of it \(the follow\-up experiments of §5\.3 and §5\.5 add such reminders\)\.R3: answerFIN <total\>only after an end\-of\-batch message \(part of the bench, not analysed here\)\. Rules and records are in French\.

Self\-conditioning is kept\.The model’s*own*previous answers are re\-injected into its history, never the expected ones\.

Scoring\.Every step is scoredcomponent by componentfrom the logged expected and observed lines \(harnais/renoter\.py\): format, R2, counter, code, sum and token are each scored as correct, wrong, not applicable, or not observable, with no priority; aDOUBLONanswer never counts as a local\-processing success, and a step enters the risk set of a component only if that component is observable\. The counter is observable on every readable line, including aDOUBLONanswer, which still begins with the counter \(SORTIE: N DOUBLON code, with N the counter\); its denominator is therefore every step of every seed \(8,000 on M1 in Phase 0\), whereas R1 is applicable only on computation steps\.This is the only scoring used for every number, table and figure of this paper\.The bench’s original evaluator gave each line a single, exclusive label \(order R3, format, R2, counter, R1\), so that an error of higher rank hid an error of lower rank on the same line — exactly the pattern that could manufacture R\-B, since once the counter is off every later line was labelled "counter"\. It was replaced after an external review; all readings, including the sealed ones, are recomputed with the component\-wise scoring, and the values the exclusive labels had given are listed in an audit appendix \(Appendix C\) as replaced, not as results\. We document a correction; we do not keep a biased measure as a result\. R2 is identical under both scorings; R1 in the injected arms is not\.

Validity controls\.A canary \(the token to copy\) detects a failure to copy the current input — a collapse of reading: a run whose 20\-step echo rate falls under 0\.9 is excluded\. It does not detect the loss of older history; truncation is controlled separately, by checking that no step exceeded the configured window\. In the original study \(Phase 0 and Phase 1 arms on both machines, and the confirmatory size map\), none of the 212 episodes was excluded, and no step exceeded the window \(at most 24,401 of 40,960 tokens\)\. The follow\-up campaigns are counted separately: experiments R and L, 80 episodes, 0 excluded; experiment S, 80 episodes, 0 excluded, plus 2 episodes discarded and re\-run because the machine slept \(§5\.5\)\.

Models and decoding\.Qwen3 via ollama, library tags, Q4\_K\_M quantisation; temperature 0, top\-k 1, seed 0; context 40,960 tokens; non\-thinking mode obtained by sending a raw ChatML prompt with a pre\-closed think block \(the 4B is the Instruct\-2507 variant, which has none\)\. M1 is an Apple\-silicon Mac \(ollama 0\.32\.5\), M2 an NVIDIA A40 \(ollama 0\.32\.11\);qwen3:8bhas the same digest on both\. Everything ran locally; no remote API was used\.

Injected blocks \(arms\)\.Arm 0 is bare\.Arm A \(rules re\-injected\)repeats the rules verbatim before every step\.Arm B \(seen codes listed\)lists the codes already seen before the current step — no new information, and never the verdict\.Arm D \(irrelevant control\)injects operational prose with as many words as the rules plus as many fake codes as arm B’s list: it is matched to the combination A\+B \(arm C, never run\), hence longer than B\. Median prompt size at step 100 on M2: 5,860\.5 tokens \(arm 0\), 6,250 \(B\), 6,668 \(D\)\. This imbalance cuts both ways\. For the counter, the shorter block, B, damaged it more \(§5\.2\); experiment L \(§5\.4\) gives no evidence that relevance explains this\. For duplicate recognition it works*in favour of*B: if length alone hurt recognition, the longer D would be disadvantaged, so the B–D comparison on R2 overstates B’s advantage by an unknown amount\. Each block decorates the current message only; the bare message enters the history\.

## 4Measurement

Hazard, not survival\.The index of the first failure is dominated by isolated one\-letter errors, and a constant per\-step error rate produces the same decaying survival curve as a genuine rise\. We read thehazard per componentin six step slices \(0–25, 25–50, 50–100, 100–200, 200–300, 300–400\); the sealed test compares steps before and after step 200 with a one\-sided Fisher test, read at p < 0\.01\. Because errors within a seed are not independent, every main effect is also estimated at the seed level, with a bootstrap over seeds \(10,000 resamples\) that keeps seeds paired when the same seeds are used in two arms\.

Absence of an effect is not shown by a non\-significant test\.Where the text says that a component is stable, it gives the interval of the effect, and the reader should read the upper bound\.

Multiple comparisons\.Three scopes are declared\. \(i\) The 24 p\-values of the original study’s confirmatory readings \(Appendix B\), recomputed with the component\-wise scoring, are corrected with Holm’s procedure at 0\.01, in two ways\. The*reference*correction treats them as one family: 7 of the 15 readings significant before correction survive it\. A*secondary*correction treats each claim as its own family \(11 survive\); these families were declared after the reference correction had been computed, so they never replace it\. \(ii\) The two follow\-up experiments of §5\.3–5\.4 have their own pre\-registered family of two tests, Holm at 0\.01, and experiment S \(§5\.5\) has another \(T1 and T2\), Holm at 0\.01\. \(iii\) The robustness analyses added after the external reviews \(decomposition of R2, seed\-level intervals, interaction tests, restricted analyses\) are reported with intervals; their few p\-values are marked as secondary and stay outside any family\.

Noise floor\.With the model unloaded before each episode, 5 seeds run 3 times \(6,000 steps\) give a range of 0 on the number of errors\. The runs of this paper were chained without unloading; there, 3 seeds run four times \(4,800 steps\) differ by at most 1 error, a hazard of 0\.00021\.

Size map\.For each size, the cutoff is the median first\-failure step of a separate exploration set of 10 seeds; 20 confirmatory seeds follow\. The sealed rule says "the median"; the analysis implemented its integer part \(medians 31\.5, 147\.5, 173 and 100\.5 for 4B, 8B, 14B and 32B\); using the next integer step changes 0 of the sealed verdicts\. Between sizes, comparisons are made both at each size’s own cutoff and at a common cutoff \(the highest own cutoff, step 173\), with censoring treated as time at risk\.

## 5Results

### 5\.1R\-A: duplicate recognition fails late, the counter never does

On M1, the duplicate\-recognition \(R2\) hazard is 0\.0019 before step 200 \(7 errors / 3,713 steps at risk\) and 0\.011 after it \(12 / 1,063\); one\-sided Fisher p =1\.5×10−41\.5\\times 10^\{\-4\}\. On M2: 0\.0016→\\rightarrow0\.011, p =3\.5×10−53\.5\\times 10^\{\-5\}\. Both survive the reference correction, and the component\-wise re\-scoring leaves them unchanged\. At the seed level, counting every R2 error, the rate after step 200 is 8\.9×\\timesthe rate before it on M1 \(95% interval 5\.2–22\) and 12×\\timeson M2 \(6\.3–35\)\. The counter makes no error: 0 in 8,000 steps on M1, 0 in 8,000 on M2\. Local processing is descriptively stable — between 0\.0037 and 0\.0049 per step in all six slices on M1 — but not shown to be flat: its rate after step 200 is 1\.3×\\timesthe rate before it on M1 \(interval 0\.82–2\.3\) and 1\.5×\\timeson M2 \(1\.0–2\.6\), which does not exclude an increase of that size\.

What rises is not recognition at constant difficulty\.By design, repeats at distance 150 and 300 occur only late\. At distances 5 and 40, the only ones present on both sides of step 200, misses do not rise: 7/120 before and 4/100 after on M1 \(6/120 and 4/100 on M2\)\. The late errors are of two kinds: misses at long distance \(20/80 at distance 150 and 8/80 at 300 after step 200, M1\), andfalse alarms, new codes reported as already seen: 1 in 3,860 new\-code steps before step 200 against 39 in 3,740 after it on M1 \(1 and 56 on M2\)\. The rise combines long\-distance recall errors and rising false alarms; the design does not separate the effects of time, context length and number of stored items\.

How the Phase 0 test was set\.The before/after\-200 hazard test was developed on preliminary data: at the time the criterion was committed, only noise\-floor replays of seeds 1–3 had been run and read\. Those seeds are part of the analysed sample\. On the remaining seeds 4–20 of M1 alone, the R2 hazard is 0\.0022 before step 200 \(7/3,113\) and 0\.012 after it \(9/757; p =1\.2×10−31\.2\\times 10^\{\-3\}, secondary\), and the M2 replication was run after the criterion was fixed\. We therefore describe this test as developed on preliminary data, evaluated on the remaining seeds and replicated on M2 — not as pre\-registered\.

Figure 1:Duplicate recognition, local processing and the counter on qwen3:8b\.Per\-step hazard \(probability of an error at step k given no earlier error of the same component\) by step slice, for duplicate recognition \(R2\), local processing \(R1, code and sum\) and the counter; component\-wise scoring\. 20 seeds per machine\. Error bars: 95% Clopper\-Pearson\. The R2 rise is decomposed in §5\.1 \(long distances and false alarms\); R1 is descriptively stable; the counter makes no error\.On the second Phase 0 substrate \(Qwen3\-4B\-Instruct, M1\), the counter does fail \(17 errors in 4,408 steps at risk\) and the R2 hazard is 0\.0082→\\rightarrow0\.018 across step 200, p = 0\.38: not read, with only 56 steps at risk after the cutoff\.

### 5\.2R\-B: injected context disrupts the counter far more than local processing

The counter\.This is a count\. With no counter error in the bare arm, arm D makes the counter fail in 20/20 seeds on M2 and 20/20 on M1 \(95% interval for the proportion of seeds: 0\.83–1, against 0–0\.17 in the bare arm; the same seeds are used in both arms, exact paired test p =9\.5×10−79\.5\\times 10^\{\-7\}, secondary\)\. Arm B does so in 20/20 seeds\. Once broken, the counter rarely recovers: under D, 5,072 of 8,000 lines carry a wrong counter on M2\.

Local processing under the same blocks: the R1 error rate is 0\.0077 per applicable step in the bare arm, 0\.0058 under D and 0\.0057 under B on M2\. The paired seed\-level ratio D/bare is 0\.75 \(95% interval 0\.49–1\.2\) on M2 and 0\.96 \(0\.59–1\.6\) on M1; B/bare is 0\.74 \(0\.45–1\.2\) and 0\.84 \(0\.52–1\.4\)\. These intervals do not show that local processing is unaffected — on M1 the D/bare ratio is compatible with an increase of up to 62% — and we do not claim that\. What they show is a difference of magnitude: the effect on the counter is far larger than any effect on local processing\. That difference is estimated directly, per seed, as the effect on the counter minus the effect on R1 \(both in errors per step\): under D it is 0\.64 \(interval 0\.53–0\.73\) on M2 and 0\.69 \(0\.60–0\.77\) on M1, positive in every seed \(Wilcoxon p =9\.5×10−79\.5\\times 10^\{\-7\}, secondary\)\. A threshold on the R1 ratio \(upper bound below 2\) was used as the decision rule of the re\-scoring \(Appendix C\); it was fixed after the original data had been seen, though before the re\-scoring was run\.

*Denominators\.*R1 is observable only on computation steps where the model did not answerDOUBLONand the line was parseable\. Unobservable steps are rare: 0\.75% of computation steps in the bare arm, 0\.092% under B and 0\.21% under D on M2 \(all from aDOUBLONanswer, none from a broken format\)\. Restricting the comparison to steps where R1 is observable in all three arms for the same seed \(7,531 steps on M2\) gives D/bare 0\.76 \(0\.49–1\.2\) and B/bare 0\.74 \(0\.45–1\.3\); on M1, D/bare 0\.96 \(0\.60–1\.6\) and B/bare 0\.85 \(0\.52–1\.4\)\.

B damages the counter more than D, although D is longer: by 2\.6×\\timeson M2 \(p =2\.1×10−32\.1\\times 10^\{\-3\}\) and 2\.3×\\timeson M1 \(p =7\.6×10−37\.6\\times 10^\{\-3\}\); this survives the per\-claim correction but not the reference one\.

Figure 2:Injected blocks \(arms 0/A/B/D\)\.Left: counter hazard per arm, both machines; labels give the number of M2 seeds with at least one counter error\. Right: R2 hazard by slice on M2, where all four arms are complete\. Arm A \(rules re\-injected\) makes an R2 error in the first slice in every seed and leaves the risk set; it is reported as text, off scale\. B = already\-seen codes listed before each step; D = irrelevant\-content control, matched to rules \+ codes and therefore longer than B \(not an equal\-token control; see §3\)\.Table 1:Arms on M2 \(primary; M1 replication in the text\), component\-wise scoring\. Hazards are censored at the first error of the component, over steps where it is observable; the R1 error rate uses all applicable steps\.
### 5\.3Pre\-registered follow\-up: what does the counter depend on? \(experiment R\)

To ask whether the counter depends on what the model has written before, or is re\-derived independently of it, we ran a follow\-up after the external review, sealed before any measurement \(Appendix A\) on machine M1, after a bridge check that reproduced the August error counts exactly \(largest difference 0 error per seed\)\. At the first computation step from step 100 on, the model’s own line entered its history with its counter replaced by the true value plus 10; everything else was unchanged, and the run continued to step 200 \(20 seeds\)\. In arm R0 nothing else was added; in arm RR*each*later message was preceded by a compact reminder of the true state \("last valid counter = N"\) — the reminder was repeated at every step, so we do not show that a single correction would suffice\. Each seed was classified on the 5 steps 16–20 steps after the injection as*re\-aligned*\(true counter\),*propagated*\(true \+ 10\) or other\.

Without the reminder,20 of 20 seeds propagated the injected offsetand none re\-aligned \(95% interval for the proportion propagated: 0\.83–1\.0\): the sealed verdict is*pattern continuation supported*, the prediction we had signed — a name that over\-interprets the measured behaviour, as explained below\. With the reminder, 20 of 20 seeds re\-aligned, after a median of 1 step \(at most 2\)\. The same seeds were used in both arms, so the conforming analysis is a paired one: 20 of 20 discordant pairs favour RR and 0 the reverse \(exact paired test, one\-sided, p =9\.5×10−79\.5\\times 10^\{\-7\}\)\. The sealed test was a Fisher test for independent groups \(p =7\.3×10−127\.3\\times 10^\{\-12\}\), a design error of the pre\-registration that we report rather than hide; both survive Holm at 0\.01 over the follow\-up’s two tests\.

The result is behavioural:the counter depends on the value present in the response history; a corrupted value persists without correction, and an exact external reminder re\-aligns it within one to two steps\.Several mechanisms produce this behaviour — treating the previous value as authoritative, applying a "previous \+ 1" rule, or continuing a pattern — and the task itself asked the model to carry the previous value forward\. The reminder is supplied by an experimental oracle: arm RR shows that the model*uses*an explicit state when one is provided, not that it tracks the counter internally\.

### 5\.4Pre\-registered follow\-up: content or form? \(experiment L\)

In the original arms, the irrelevant control D differed from B in more than relevance: its header, its prose and its length\. Experiment L removes every difference but one\. Its block has B’s header, separators, position, number of codes and code template, with codes that never occur in the ledger; the prompt sizes of L and B differ by a median of 0\.14% at the same seed and step\. B was re\-run alongside L on M1 \(20 paired seeds, 200 steps\), because the August B runs on M1 had shared the inference server\.

The sealed criterion compared the counter hazards of L and B with an equivalence margin of 0\.8–1\.25\. The ratio L/B is 0\.91 \(95% interval 0\.34–2\.5\): the verdict is*not conclusive*— neither a difference nor an equivalence is shown — and the second test of the follow\-up’s family \(paired Wilcoxon on the step of the first counter error, p = 0\.94\) does not survive Holm\. Our signed prediction, that relevance matters, isnot supported\. Descriptively, L behaves like B, not like D: the counter fails in 19 of 20 seeds under L and 19 under B \(none in the bare arm over the same 200 steps\), with a median first error at step 15\.5 under L and 18 under B\. L gives no evidence that relevance explains the B–D difference; form remains a hypothesis this experiment could not confirm\. Local processing under L, against the bare arm, gives a ratio of 1\.0 \(0\.59–2\.0\)\. False alarms remain rare under both \(7 under L and 1 under B, in 3,700 new\-code steps\)\.

### 5\.5Pre\-registered follow\-up: repair under repeated disruption \(experiment S\)

Experiment R showed that an exact reminder, repeated at every step, re\-aligns a counter corrupted*once*\. Experiment S \(for*state*\) asks the harder question, fixed before the runs as the last experiment of this paper: under a disruption repeated at every step \(the irrelevant block D before each message\), does an exact, compact reminder of the state repair the counter; is it the state information itself that repairs, rather than any added text of the same length; and does a single correction persist? It was sealed before any measurement, with an amendment sealed before launch \(Appendix A\), on machine M1 \(same model, digest and decoding as in August\)\.

Conditions\.On the same 20 seeds and 200 steps: D \(the original block before each message\); DS \(D, then "last valid counter = N" just before the current message, at every step from the second one\); D1 \(the same reminder*once*, at the step after the seed’s first counter error, then nothing\); DN \(D, then a neutral text — "no tracking information" followed by dots — at the same position, whose length in tokens was calibrated before the first episode to equal the reminder’s for the same number of digits\)\. N is exact by construction: the number of messages already received, computed from past inputs only\. The reminder is an experimental oracle, as in experiment R\. The bare condition was not re\-run: by amendment, the August bare episodes of M1, cut to their first 200 steps, serve as a descriptive reference only\.

Sealed criteria\.Repair: the ratio DS/D of the proportion of lines with a wrong counter \(pooled over seeds\), 95% paired bootstrap interval by seed;*repairs*if the upper bound is at most 0\.2 \(a reduction of at least 80%\),*does not repair*if the lower bound exceeds 0\.2, otherwise not conclusive\. No damage: the same ratios for local processing \(R1\) and duplicate recognition \(R2\);*no damage*if both upper bounds are below 1\.5\. Persistence under D1: among seeds whose first counter error falls before step 199, the proportion that re\-align for 5 steps after the reminder and then fail again, Clopper–Pearson interval;*relapse*if the lower bound exceeds 0\.5,*persistence*if the upper bound is below 0\.5\. The follow\-up’s own family has two paired Wilcoxon tests, Holm at 0\.01: T1, the wrong\-counter proportion is lower under DS than under DN \(one\-sided\); T2, DN against D \(two\-sided\)\. Our signed bets were: DS repairs, DN does not, a single reminder relapses\.

Results\.The counter failed in 15 of 20 seeds under D, 0 under DS, 19 under DN and 15 under D1 \(0 in the August bare runs over the same 200 steps\); the proportion of lines with a wrong counter was 37% under D, 0% under DS and 43% under DN \(Figure[3](https://arxiv.org/html/2610.20633#S5.F3)\)\. The sealed ratio DS/D is 0, and its sealed bootstrap interval is 0–0: the sealed verdict is*repairs*\. That interval isdegenerate— DS has no error in any seed, so every resample gives the same ratio — and it quantifies nothing; we report it because it was the sealed computation, and we do not use it to claim a reduction of at least 80% in any wider population\. Two complementary analyses,added after review: the proportion of seeds with a counter error under DS is 0/20 \(95% Clopper–Pearson interval 0–0\.17\); and, the seeds being paired, 15 seeds failed under D and not under DS, 0 the reverse \(exact paired test, one\-sided, p =3\.1×10−53\.1\\times 10^\{\-5\}\)\. For local processing the ratio DS/D is 1\.0 \(0\.67–1\.6\) and for duplicate recognition 0\.20 \(0\.079–0\.67\):*not conclusive*\. T1 \(DS below DN\) has p =6\.5×10−56\.5\\times 10^\{\-5\}and survives Holm; T2 \(DN against D\) has p = 0\.42 and does not survive Holm\. Under D1, 15 seeds were analysable \(the other 5 made no counter error at all\); 8 re\-aligned for 5 steps and 4 of them later relapsed\. On the sealed denominator, the analysable seeds, the proportion of relapses is 4/15 \(95% interval 0\.078–0\.55\):*not conclusive*\. This composite criterion cannot establish durable recovery, because episodes that never recover also do not satisfy the recovery\-then\-relapse event\. Among the seeds that re\-aligned it is 4/8 \(0\.16–0\.84; added after review\)\. Table[2](https://arxiv.org/html/2610.20633#S5.T2)lists every analysable seed\.

Table 2:Experiment S, single reminder \(D1\): outcome of every analysable seed, with the step of its first counter error in parentheses; the reminder came at the next step\.*No recovery*: the counter was never true again\.*Brief recovery*: true at the next step, wrong again within 5 steps\.*Recovery held*: true for 5 steps and never wrong again\.*Recovery, then relapse*: true for 5 steps, wrong later\.*Too little follow\-up*: fewer than 5 steps left after the reminder\. Categories defined after review; descriptive\.Against our signed bets\.No counter errors were observed under the repeated reminder in the tested episodes, against 15 seeds with an error under D\.The exact reminder tested outperforms this length\-matched neutral control\(T1\)\. T2 does not separate DN from D, which does not show that they are equivalent\. This does not establish that the state information alone explains the effect: the wording of the reminder and its instructive character differ from the neutral text too\.Whether a single correction persists is not conclusive; we had bet on relapse\. Descriptively, the single reminder had no visible effect in 5 of the 15 analysable seeds: the next counter continued from the model’s own wrong value, and never returned to the true one\. Where the counter became true again, it did so within 1 step\. The proportion of wrong\-counter lines was 21% under D1\.

The no\-damage criterion is not met: local processing errors are rare \(0\.73% of applicable steps under D, 0\.73% under DS\), and the upper bound of the ratio, 1\.6, exceeds the sealed margin of 1\.5\. The absence of degradation of the other components is therefore not established\. Duplicate\-recognition errors were lower under DS \(0\.25% of steps, against 1\.2% under D, 1\.8% under DN and 0\.20% in the August bare runs\); this is a secondary observation, not a pre\-registered criterion, and we do not interpret it\. The reminder is an oracle: experiment S shows that the model*uses*an exact state supplied at every step, even under a repeated disruption, not that a deployed system could supply one\. The state came from an oracle and the effective condition repeated it at every step; the necessary frequency was not established\.

Figure 3:Experiment S: repair under repeated disruption\.Proportion of lines with a wrong counter, one dot per seed \(20 seeds, 200 steps, same seeds in every condition\); open dots: no counter error; bar: proportion pooled over seeds\. D: irrelevant block before each message; DS: D plus an exact reminder of the state \("last valid counter = N", supplied by an oracle\) before each message; D1: the same reminder once, after the seed’s first counter error; DN: D plus neutral text of the reminder’s length in tokens\. Bare: the August bare runs of the same machine, first 200 steps \(descriptive reference, not re\-run\)\.Cost and conduct\.Median prompt size at step 100 was 6,655\.5 tokens under D, 6,672 under DS and 6,670\.5 under DN; median episode time was 13 min under D and 14 min under DS\. The Mac was sometimes unplugged or put to sleep during the campaign: as sealed in the amendment, every episode crossed by a sleep \(2\) was discarded and re\-run from its start with the same seed, never resumed mid\-episode; power source was logged at the start and end of each episode; no valid episode ran on battery \(0\), so latency is reported on mains only\. No result was read before the last episode of the last seed; the reading was then run once, as sealed\.

### 5\.6Secondary: listing the seen codes, repeating the rules

Listing the seen codes \(arm B\) lowers duplicate\-recognition errors, partially\.On the sealed hazard \(first error per seed\), B is below D before correction on both machines \(p =8\.9×10−48\.9\\times 10^\{\-4\}on M1,6\.0×10−36\.0\\times 10^\{\-3\}on M2\); after correction this holds on M1 only \(per\-claim correction\)\. Against the bare arm, B is below it before correction on M1 only \(p =6\.9×10−36\.9\\times 10^\{\-3\}; M2 p = 0\.031\)\. Counting every R2 error at the seed level \(secondary\), B’s rate is 0\.23×\\timesthat of the bare arm on M2 \(interval 0\.14–0\.36\) and 0\.19×\\timesthat of D \(0\.10–0\.32\), with the caveat of §3 on block length\. The irrelevant block D, compared with the bare arm, gives a ratio of 1\.2×\\times\(0\.71–2\.1\) on M2: we cannot exclude that D itself doubles R2 errors, so the earlier statement that "D is not worse than the bare arm" is withdrawn\. The pre\-registered repair criterion — no rise within arm B, p \> 0\.05 — isnot met\(p =3\.0×10−33\.0\\times 10^\{\-3\}on M2,2\.9×10−32\.9\\times 10^\{\-3\}on M1\)\. We also note that this criterion was badly designed: it rewards a lack of power, since fewer errors make "p \> 0\.05" easier to reach\. It is a weakness of our pre\-registration; we report it and do not replace it after the fact\. The comparison of D with the bare arm on the sealed hazard \(p = 0\.31\) is likewise uninformative about the absence of an effect\.

Repeating the rules \(arm A\)\.Under A, every seed made a duplicate\-recognition error within the first slice: 8 errors in 56 steps at risk \(hazard 0\.14\), against 0 in the bare arm; the counter failed in 6/8 seeds\. With 8 seeds \(M2\) and 4 \(M1\), this is an observation of a large effect, not a tested one\.

### 5\.7Secondary: size map

Figure[4](https://arxiv.org/html/2610.20633#S5.F4)and Table[3](https://arxiv.org/html/2610.20633#S5.T3)give, for Qwen3 4B, 8B, 14B and 32B, the R2 hazard at own and common cutoffs, on the first\-error and all\-errors scales, with seeds at risk, censored seeds and steps at risk\. Qwen3\-1\.7B failed the admission barrier \(exploration median 0\); an alternative scaffold for the 4B was invalidated by the canary in 20/20 episodes\. Re\-scored component by component, the counter fails in 14 of 20 seeds at 4B, in none at 8B or 14B, and in 2 at 32B; the sealed prediction was zero at 14B*and*32B, and it is refuted for the 32B\.

Figure 4:Size map, duplicate\-recognition \(R2\) hazard in time at risk\.Left and centre: R2 hazard after each size’s own cutoff \(median survival of a separate exploration set, open squares\) and after the common cutoff \(highest own cutoff, filled circles\), on the first\-fault and all\-faults scales\. Error bars: exact Poisson 95%\. Log scale\. Estimates resting on fewer than five seeds at risk are not plotted \("n\.e\."\): at the common cutoff this is the 4B on the first\-fault scale, which is used in no size comparison\. Right: seeds still at risk at the common cutoff, split into those that later fault on R2 and those censored \(no R2 fault by step 400\); censoring grows with size\. Seed\-level tests are reported in the text before step\-level tests\.Table 3:Size map, R2, time at risk\. Own cutoff = integer part of the median first failure of each size’s exploration set; common cutoff = step 173\. "Seeds at risk" and "censored" are on the first\-error scale \(a seed that made an R2 error before the common cutoff is not at risk\); the text’s count of seeds*without any*R2 error after the cutoff uses the all\-errors scale over all 20 seeds, hence different numbers at 14B \(12 of 17 against 14 of 20\)\. In brackets, the one\-sided 95% Poisson upper bound\. The 4B at the common cutoff rests on one seed and enters no comparison\.*Sealed within\-size reading*\(own cutoff\): the 8B R2 hazard rises \(0\.00070→\\rightarrow0\.0096, p =3\.8×10−63\.8\\times 10^\{\-6\}\); the 14B and 32B are not conclusive \(expected errors under the null 2\.8 and 0\), not flat\.

*Between sizes*, at the common cutoff: per\-seed hazards separate 8B from 14B \(Mann\-Whitney p =2\.2×10−72\.2\\times 10^\{\-7\}\) and 8B from 32B \(p =1\.5×10−81\.5\\times 10^\{\-8\}\), but not 14B from 32B \(p = 0\.057\); the two separations, and the step\-level tests, survive both corrections\. On the first\-error scale the ratios are 8\.3×\\times\(8B/14B, step\-level p =2\.7×10−62\.7\\times 10^\{\-6\}\) and 28×\\times\(8B/32B, p =9\.8×10−109\.8\\times 10^\{\-10\}\); at own cutoffs 6\.2×\\timesand 28×\\times\. We do not claim a constant factor per size step: beyond 14B we lack the power to distinguish \(the 32B has 2 R2 errors\)\. Censoring is ordered by size — 0, 14 and 18 of 20 seeds without any R2 error after step 173 \(8B, 14B, 32B\) — and time at risk accounts for it only under the assumption that censoring is uninformative\.

### 5\.8Secondary: failure shape

Figure[5](https://arxiv.org/html/2610.20633#S5.F5)shows the step of the first failureon any rule, one dot per seed\. 2/20 8B seeds are at the extremes \(failure within 25 steps, or none in 400\), against 11/20 for the 32B \(5 within 25 steps, 6 never; p =2\.9×10−32\.9\\times 10^\{\-3\}, which survives the per\-claim correction but not the reference one\)\. The 14B is intermediate and not read \(5/20, p = 0\.20\)\. If replicated, this pattern would motivate analysing early and later failures separately; it does not establish that 32B failures are predominantly immediate\.

Figure 5:Failure shape by size\.Step of the first failure on ANY rule \(not duplicate recognition alone\), one dot per seed; open dots: no failure within 400 steps; bar: median; shaded band: failure within 25 steps\.
### 5\.9Complementary evidence on self\-conditioning \(exploratory\)

The sealed R2 hazard is censored at the first error of the*same*component, so earlier R1 errors can sit in the history, and self\-conditioning\([Sinha et al\., 2026](https://arxiv.org/html/2610.20633#bib.bib13)\)could contribute to the late rise\. We decided after seeing the data to censor at the first error of*any*component, so that every counted step has an error\-free history\. The R2 hazard still rises across step 200: 3/2,682→\\rightarrow5/385 on M1 and 2/2,612→\\rightarrow5/414 on M2\. With 5 errors after the cutoff on each machine, this is complementary evidence, not a test\.

## 6Discussion

What breaks when the counter breaks?A trivial \+1 counter may be carried by nothing more than the value in the model’s own previous lines, and an injected block may break it by disrupting the layout of the prompt rather than by removing any stored value\. Experiment R \(§5\.3\) establishes the behaviour: the counter depends on the value present in the response history — an injected wrong value is propagated by every seed, and a reminder repeated at every step re\-aligns it within one to two steps\. It does not tell which mechanism produces this\. On what breaks the counter, a draft of this paper argued from the original arms that*content*breaks the counter: B, the shorter block, broke it more and much earlier than D \(first counter error at a median step of 18 under B against 114 under D on M2\), most often by a missed increment \(14 of 20 seeds under B\)\. Experiment L does not support that argument: a block with B’s exact form and irrelevant codes breaks the counter about as early and as often as B \(§5\.4\), although the pre\-registered comparison is not conclusive\. L gives no evidence that relevance explains the B–D difference; form remains a hypothesis this experiment could not confirm\. We withdraw the content\-based reading\.

What repairs the counter?Under the irrelevant block repeated at every step, no counter error was observed when an exact statement of the state was placed just before each message, and that statement outperformed neutral text of the same length \(§5\.5\)\. The added length alone does not explain the result; the state information, the wording of the reminder and its instructive character remain confounded\. A single statement, placed once after the first error, often lost against the model’s own history — in some seeds it had no visible effect at all — which is what one expects if the counter follows the value present in the history \(§5\.3\)\. Two limits matter for practice: the state came from an oracle, and the effective condition repeated it at every step; the necessary frequency was not established\. A system that relies on this needs an external source of state it can trust, which this paper does not provide\.

Adding context has a price on the counter, for the blocks we tested\.Retrieval and memory layers add text before the current message\. On this bench, each of the four blocks tested — rules, seen codes, irrelevant prose, irrelevant codes in the form of the seen codes — broke a counter that was otherwise error\-free\. The one block that stated the state exactly, the reminder of experiment S, did not \(§5\.5\)\. A layer that helps duplicate recognition may therefore hurt carried state, and must be evaluated on both\. We did not test blocks of other kinds, sizes or positions\.

Duplicate recognition fails late\.The late rise of R2 combines long\-distance recall errors and false alarms that appear only once many codes have been seen; the false alarms are compatible with interference between stored items, and the design does not separate the effects of time, context length and number of stored items\.

Scale\.Larger models recognise duplicates better over the same region of the episode\. They may also fail differently, but that reading survives only the per\-claim correction, and should be confirmed before anyone plans a deployment around it\.

## 7Conclusion

This paper is a diagnosis followed by one pre\-specified repair test\. The diagnosis: on a long, easy, self\-conditioned task, some context additions strongly disrupt counter tracking while their effect on local processing is much smaller, and an aggregate or exclusive error classification can hide this difference; duplicate recognition fails late, through long\-distance misses and false alarms\. The counter follows the value present in the model’s own history: a corrupted value persists, and an explicit external statement of the state restores it\. The repair test: under a disruption that otherwise breaks the counter, no counter error was observed when an exact statement of the state preceded each message, while the absence of degradation of the other components was not established by the sealed criterion; the statement outperformed text of the same length without the state, and a single statement did not reliably hold\. This motivates a design hypothesis, not a finding — that carried state which matters should be stated explicitly and often rather than left to the model’s own history — since we tested neither several frequencies nor several kinds of state; and it is not an autonomous system: the state here came from an oracle, and supplying it reliably is a separate problem\. Scoring components independently made these differences visible; the original exclusive error classification had masked some local\-processing errors\.

## 8Limitations and what we do not claim

- •One synthetic task family, in French, with a trivially incremented counter; the counter result must not be generalised to arithmetic state;[Sinha et al\. \(2026\)](https://arxiv.org/html/2610.20633#bib.bib13)find the opposite for a running sum\.
- •One model family, Q4\_K\_M via ollama, greedy,non\-thinking; thinking mode may change the picture;[Sinha et al\. \(2026\)](https://arxiv.org/html/2610.20633#bib.bib13)find that it removes self\-conditioning\.
- •20 seeds per condition; arm A has 8 \(M2\) and 4 \(M1\) seeds\.
- •Arm D is matched to the combination A\+B, hence longer than B; arm C was not run\.
- •Distance and position in the episode are confounded by design\.
- •Experiment R establishes a behaviour, not a mechanism; its reminder was repeated at every step and supplied by an oracle\. Experiment L gives no evidence that relevance matters, and does not establish that form does: its comparison is not conclusive \(§5\.4\), and our signed prediction was not supported\.
- •Experiment S \(§5\.5\) ran on one machine, with an oracle state, a trivial counter and one kind of disruption; its no\-damage criterion and its persistence criterion are not conclusive, and our bet on relapse is neither supported nor refuted\. Its sealed repair interval is degenerate \(§5\.5\); the complementary interval and paired test were added after review\. The reminder was repeated at every step, and its necessary frequency was not established\. The bare reference is the August bare run, not a concurrent one\.
- •The bench’s original exclusive labels hid lower\-ranked errors; every reading was recomputed with the component\-wise scoring \(Appendix C lists the replaced values\)\.
- •Where the text reports stability, it rests on intervals whose upper bounds do not exclude increases of up to about twofold \(R1 over time; R1 under the injected blocks; R2 under D\)\.
- •The Phase 0 hazard test was developed on preliminary data \(seeds 1–3\) that are part of the analysed sample; it is not described as pre\-registered \(§5\.1\)\.
- •The sealed test of experiment R assumed independent groups although seeds were paired; the paired test is reported alongside it\.
- •The pre\-registered repair criterion for arm B \(p \> 0\.05 within the arm\) rewards low power; it was a poor criterion, reported as written\.
- •A sealed prediction was refuted: the size map predicted no counter error at 14B and 32B; the 32B made 2\.
- •The Phase 1 arms on M1 ran while another job shared the machine’s inference server; M2 is the primary source for the arms\.
- •The model digests of the 14B and 32B were not recorded before the rented machine was deleted\.
- •No pre\-registration of the original study declared a family of tests; the common\-cutoff comparison, the clean\-history check and every robustness analysis of the external\-review rounds were decided after seeing the data\. The R1 decision threshold of Appendix C was fixed after the original data had been seen, before the re\-scoring\.
- •We do not claimthat a small model with external state beats a large model without it \(not tested here\); that the protocol measures intent or goals; that listing seen codes*repairs*duplicate recognition; that each size step divides the hazard by a constant factor; that errors disappear beyond 8B \(14B and 32B are not conclusive within size, not flat\); or that context volume degrading performance is new\.

## 9Reproducibility and AI assistance

Code, all logged episodes, pre\-registrations and seals are available athttps://github\.com/Baracoda\-ai\-labs/context\-injection\-long\-horizon\(MIT for code, CC BY 4\.0 for data\)\. This paper, its PDF and itspaper/numbers\.jsoncorrespond to the tagv1\.0\-arxivof that repository\. To reproduce it:git clonethe repository,git checkout v1\.0\-arxiv, thenbash reproduce\.sh, which regenerates every number, table and figure from the logs without calling a model \(Python 3 with scipy and matplotlib\); it also runsverify\_seals\.py, which checks the seals, andharnais/verifier\_papier\.py, which re\-derives the key numbers with independent code\.python3 harnais/renoter\.pyre\-scores every step component by component\. The repository was checked to reproduce identically from a fresh clone in a clean directory\. Experiments were run and analysed, and this draft was written, with the assistance of Claude Code and Claude \(Anthropic\); all design decisions and every sealed pre\-registration were reviewed by the author\.

## References

- Arike et al\. \(2025\)Rauno Arike, Elizabeth Donoway, Henning Bartsch, and Marius Hobbhahn\.Technical report: Evaluating goal drift in language model agents\.In*AAAI/ACM Conference on AI, Ethics, and Society \(AIES\)*, 2025\.arXiv:2505\.02709\.
- Arjmandi \(2026\)Mohsen Arjmandi\.The LLM proposes, the executive disposes: A self\-verifying agent instrument that dissociates commitment drift from binding drift in long\-horizon agents, 2026\.
- Du et al\. \(2025\)Yufeng Du, Minyang Tian, Srikanth Ronanki, Subendhu Rongali, Sravan Bodapati, Aram Galstyan, Azton Wells, Roy Schwartz, Eliu A\. Huerta, and Hao Peng\.Context length alone hurts LLM performance despite perfect retrieval, 2025\.
- Hong et al\. \(2025\)Kelly Hong, Anton Troynikov, and Jeff Huber\.Context rot: How increasing input tokens impacts LLM performance\.Technical report, Chroma, 2025\.URL[https://www\.trychroma\.com/research/context\-rot](https://www.trychroma.com/research/context-rot)\.
- Hsieh et al\. \(2024\)Cheng\-Ping Hsieh, Simeng Sun, Samuel Kriman, Shantanu Acharya, Dima Rekesh, Fei Jia, Yang Zhang, and Boris Ginsburg\.RULER: What’s the real context size of your long\-context language models?In*Conference on Language Modeling \(COLM\)*, 2024\.arXiv:2404\.06654\.
- Kwa et al\. \(2025\)Thomas Kwa, Ben West, Joel Becker, Amy Deng, Katharyn Garcia, Max Hasin, Sami Jawhar, Megan Kinniment, Nate Rush, Sydney Von Arx, Ryan Bloom, Thomas Broadley, Haoxing Du, Brian Goodrich, Nikola Jurkovic, Luke Harold Miles, Seraphina Nix, Tao Lin, Chris Painter, Neev Parikh, David Rein, Lucas Jun Koba Sato, Hjalmar Wijk, Daniel M\. Ziegler, Elizabeth Barnes, and Lawrence Chan\.Measuring AI ability to complete long software tasks\.In*Advances in Neural Information Processing Systems \(NeurIPS\)*, 2025\.arXiv:2503\.14499\.
- Laban et al\. \(2025\)Philippe Laban, Hiroaki Hayashi, Yingbo Zhou, and Jennifer Neville\.LLMs get lost in multi\-turn conversation, 2025\.
- Levy et al\. \(2024\)Mosh Levy, Alon Jacoby, and Yoav Goldberg\.Same task, more tokens: the impact of input length on the reasoning performance of large language models\.In*Proceedings of ACL*, 2024\.arXiv:2402\.14848\.
- Liu et al\. \(2024\)Nelson F\. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang\.Lost in the middle: How language models use long contexts\.*Transactions of the Association for Computational Linguistics*, 2024\.arXiv:2307\.03172\.
- Pai & Xian \(2026\)Dheeraj Mohandas Pai and Lu Xian\.Long\-horizon state tracking in LLMs: Executing MD5 through a deep sequence of dependent tool calls, 2026\.
- Pan & Williams \(2025\)Alex Pan and Mary\-Anne Williams\.Context is not comprehension, 2025\.
- Shi et al\. \(2023\)Freda Shi, Xinyun Chen, Kanishka Misra, Nathan Scales, David Dohan, Ed Chi, Nathanael Schärli, and Denny Zhou\.Large language models can be easily distracted by irrelevant context\.In*International Conference on Machine Learning \(ICML\)*, 2023\.arXiv:2302\.00093\.
- Sinha et al\. \(2026\)Akshit Sinha, Arvindh Arun, Shashwat Goel, Steffen Staab, and Jonas Geiping\.The illusion of diminishing returns: Measuring long horizon execution in LLMs\.In*International Conference on Learning Representations \(ICLR\)*, 2026\.arXiv:2509\.09677\.
- Wang & Sun \(2025\)Chupei Wang and Jiaqiu Vince Sun\.Unable to forget: Proactive interference reveals working memory limits in LLMs beyond context length, 2025\.ICML 2025 Workshop on Long\-Context Foundation Models\.

## Appendix APre\-registration, seals and measurement rules

What the seals prove\.Every confirmatory campaign has a pre\-registration whose SHA\-256 hash is recorded \(eleven seals, all verified by the package; the ninth covers the follow\-up experiments of §5\.3–5\.4 and the last two experiment S \(§5\.5\), each committed to the repository before any of their episodes was run\)\. A hash proves that a document has not changed since it was hashed; it does not prove when\. Anteriority rests on the repository’s git history \(commit dates are set by the author’s machine; the repository is mirrored on GitHub\)\. By that history: the Phase 1 pre\-registration was committed at 2026\-08\-12 22:41, before the first Phase 1 data \(2026\-08\-12 23:58\); arm A at 2026\-08\-13 15:49, before its data \(2026\-08\-14 16:12\); the size map at 2026\-08\-15 17:58, before its data \(2026\-08\-16 16:24\)\. For Phase 0, the first pre\-registration \(2026\-08\-12 16:21\) specified a survival criterion that was later superseded; the hazard criterion actually used was committed at 2026\-08\-12 17:40, before the 20\-seed data were complete, after three noise\-floor seeds had suggested it, and its formal seal \(2026\-08\-12 21:47\) postdates the reading of the hazard table\. At the time of that commit the repository held only the noise\-floor replays of seeds 1–3; seeds 4–20 had not been run\. The Phase 0 hazard test is therefore described as developed on preliminary data, evaluated on the remaining seeds and replicated on M2 \(§5\.1\), and not as pre\-registered\.

Follow\-up experiments \(seal nine\)\.The pre\-registration of experiments R and L and the code that reads them were committed before any of their episodes was run, and the reading code before the data were complete\. Experiment R finished before experiment L, and R was read early, three times, while L was still being collected: on 27 September 2026 at about 20:30 \(Paris time\) by the author’s coding assistant, at the author’s request, when L had 1 of 20 seed pairs; at about 21:30 by the coordinating reviewer, with the same reading function, when L had 5 of 20; and at about 23:00, when the R section of this draft was written, with L at 10 of 20\. L was not read before it was complete\. Neither the protocol nor the collection of L was changed, and L ran to its pre\-registered size\.

Experiment S \(seal ten and its amendment\)\.The pre\-registration, the bench code, the launcher and the reading code were committed before the first episode; an amendment, sealed before launch, replaced the re\-run of the bare condition by the August bare episodes \(descriptive only\) and added power and sleep logging\. The launcher waited for another job on the machine to finish before starting\. Episodes crossed by a machine sleep were detected \(wall clock against a monotonic clock\), discarded and re\-run from the start \(2 episodes\)\. Progress was followed from the launcher’s log only; no result was read before the last episode, and the sealed reading was then run once\. As a determinism check \(D and D1 are identical up to the first counter error\): the first counter\-error step matched between D and D1 in all 15 seeds with an error; neither condition produced a counter error in the remaining 5 seeds\.

The sixteen measurement rules\.Each rule was paid for by a dated error of our own \(full text, in French, in00\_docs/REGLES\_MESURE\.md\); rules 11 and 15 are statements about this protocol, not general laws\.

1. 1\.The instrument is younger than the model\.When they disagree, suspect the instrument first\.
2. 2\.No format that cannot be parsed field by field\.Required prefixes are optional when reading\.
3. 3\.An ambiguous rule measures which reading the model chose, not drift\.
4. 4\.The seal applies word for word, in both directions\.Never relax a criterion after seeing the data — nor tighten it; reservations are reported next to the verdict\.
5. 5\.Absence of evidence is not evidence of absence\.
6. 6\.The hazard cutoff is pre\-registered per substrate, on a separate exploration set\.
7. 7\.Show the curve, never the p\-value alone\.
8. 8\.No contention on the machine during a measurement\.
9. 9\.The history keeps the model’s real answer, never the expected one\.
10. 10\.Injected blocks decorate the current message; the bare message enters the history\.
11. 11\.In this protocol, every disruptive block tested degraded the counter, and the block resembling the ledger degraded it most\(reformulated after the irrelevant control contradicted a first, content\-based statement\)\. The rule covers disruptive blocks only: the exact state reminder of experiment S is also an injected block, and under it no counter error was observed\.
12. 12\.Before comparing substrates, check that the prompt scaffold is identical\.
13. 13\.A shared inference server is not a substrate\.
14. 14\.Measure the noise floor on the statistic you read\.
15. 15\.In this protocol, with ollama, unloading the model between episodes made the measurement exactly deterministic\.
16. 16\.No sweep of more than 30 GPU\-minutes without a passed, dated positive control\.

Seals\.

## Appendix BMultiple comparisons \(Holm, threshold 0\.01\)

All 24 p\-values cited in the paper, excluding the exploratory check of §5\.9 and the follow\-up experiments of §5\.3–5\.5, which have their own pre\-registered families, in increasing order\.*Reference*: one family \(all tests\)\.*Per claim*: one family per claim, declared after the reference correction was computed \(secondary\)\.noin bold marks a reading significant before correction that does not survive\. All tests are one\-sided exact Fisher tests except the per\-seed Mann\-Whitney tests\.

## Appendix CAudit: scoring replaced

The bench’s original evaluator gave each line one exclusive label \(R3, format, R2, counter, R1, in that order\)\. After an external review showed that this could hide lower\-ranked errors, every step was re\-scored component by component, and that scoring replaced the original one everywhere in the paper\. We document the correction here; the replaced values are not results\.

Decision rule, committed before the re\-scoring was run\(repository commit4c1eae5, after the original data had been seen\): the counter result holds if, for the irrelevant block D on both machines, every seed has a counter error against none in the bare arm, and the upper bound of the 95% seed\-bootstrap interval of the R1 error\-rate ratio D/bare is below 2; the label "lower bound \> 1" if the lower bound exceeds 1; "not conclusive" otherwise\. Outcome:holds\. The body of the paper states the result as a difference of magnitude \(§5\.2\), not as the absence of any effect on local processing\.

Replaced values\.Under the exclusive labels, the R1 hazard of the injected arms was biased downward: on M2, 0\.0043 \(bare\), 0\.0022 \(D\) and 0\.00076 \(B\), against 0\.0045, 0\.0055 and 0\.0052 with the component\-wise scoring \(hazards censored at the first R1 error; Table[1](https://arxiv.org/html/2610.20633#S5.T1)reports the uncensored R1 error rate, 0\.0077, 0\.0058 and 0\.0057\)\. A test "R1: B below bare" that the exclusive labels had given as significant on M2 \(p =2\.0×10−42\.0\\times 10^\{\-4\}; M11\.5×10−31\.5\\times 10^\{\-3\}\) does not hold once re\-scored \(p = 0\.71; Appendix B\) and is not a result of this paper\. R2 is identical under both scorings; counter hazards differ by at most a few steps at risk\.

The first counter error of a seed moves between the two scorings in 1 D seed and 1 A seed on M1, 0 D and 2 A seeds on M2, and in no bare or B seed\. The sealed R2 test is unchanged by the re\-scoring \(p =1\.5×10−41\.5\\times 10^\{\-4\}on M1,3\.5×10−53\.5\\times 10^\{\-5\}on M2\), since only R3 and format outranked R2\.