You open with one hard rule. Never edit anything under migrations without asking me first. The agent acknowledges it and works well for two hours. Then it edits a migration, cleanly, with a good commit message. You scroll up and the rule is still there in your first message, exactly as you typed it, and somewhere below it a line saying the context was compacted. Nothing overrode you. The summary that replaced those early turns kept what the agent was doing and dropped what it had been told not to do. It obeyed everything it could still see.

The allergy goes on the chart, not in your head

Think about a hospital ward at three in the morning. The nurse on duty is holding a great deal in her head: who was restless, which drip is nearly through, what she means to do next. At handover she compresses all of that into a few sentences, and that is fine, because that is the kind of thing that survives being compressed. What does not go through her head at all is the allergy. That is written at the bed, in the chart, along with the consent limits and the things nobody is to do without calling the registrar. It lives there because the person on duty changes and the chart does not.

An agent’s conversation history is the head, and compaction is the handover. The history gets replaced by a summary, and decisions, stated preferences and opening instructions can go with it. So you split the material by how long it has to hold. Standing rules — permissions, prohibitions, naming conventions, security constraints — belong in project files that get re-injected at the start of every session, so they arrive fresh regardless of what happened to the transcript. Progress belongs somewhere else again: notes that record what changed, which suite last ran, what is still open and why.

Residency stops being luck and becomes a contract

The stronger version of this makes the harness responsible for it. You treat the window as working space made of typed pages, and each page declares its minimum-fidelity set — the part of it that must not be lost when things get tight. The harness then decides, inside the token budget, which pages stay resident and which get written out to storage. During a refactor the page holding the API invariants stays present in full, while tool output from forty steps ago degrades to a summary or leaves the window entirely.

The other half is the boundaries. At a reset, a compaction or a handoff, the runtime flushes and writes back, and validates that it worked: it checks that the failing tests and the unresolved choices actually reached the durable file before the short version replaced the long one. This is where the real choice sits, and it is about what you are willing to leave running unattended. Put your prohibitions in the transcript and you are betting that a summariser you never see will judge them worth keeping. Two failure modes follow: compacting mid-task with no verifiable checkpoint behind you, and asking the model to write its own state out after the session has already been reset, when there is nothing left to write it from.

Every shift starts by reading what the last one left

The pattern shows itself most plainly in work too long for one window. The first session builds no features at all. It builds the conditions: the repository, a bootstrap script, a progress log, a structured feature list whose end-to-end tests all fail on purpose. Every session after it reads the progress file and the commit history, brings the environment up, checks a baseline, takes exactly one feature, tests it, updates only its own entry, commits, and writes down where it stopped. It does not announce the project finished while entries are still failing, and it is not allowed to edit the list so that failures disappear.

None of this is new craft. Operating systems have spent decades deciding what remains in fast reach and what gets written to disk and fetched back when somebody asks for it, and the hard part was never the mechanism — it was choosing correctly what must never be paged out. The same question reaches you the moment context stops being a prompt and starts being a resource somebody has to manage.

Whatever still has to be true in two hours does not belong in the conversation.