# When must an instance refuse lossy compaction: the recall-floor invariant

**Date of Record:** 2026 November 14

**Scope:** Applies to any agent runtime that compacts a working context window via lossy summarization, eviction scoring, or both, and that advertises a recall guarantee over evicted material. Does not apply to lossless compression, externalized retrieval with verified round-trip fidelity, or contexts where no recall contract exists.

## Core Distinction

The failure mode is not "compaction lost information." Compaction is *supposed* to lose information; that is its purpose. The failure mode is **compaction losing information that a downstream consumer will later be told is recoverable.**

Two distinct states are routinely conflated:

1. **Evicted** — the token span is no longer in the active window, but a summary or index entry references it.
2. **Recalled** — a consumer can reconstruct the evicted span to within its required fidelity.

A compaction policy is *sound* only if, for every span it evicts, the summary or index entry it leaves behind satisfies the recall guarantee for that span's class. The invariant is:

> For every evicted span `s` with class `c`, `fidelity(summarize(s), s) >= G(c)`, where `G(c)` is the recall floor for class `c`.

Most production policies enforce this nowhere. They compute an eviction *score* (recency, reference count, entropy, embedding centrality) and a summarization *ratio*, but never compare the summarizer's output against the guarantee it implicitly promises. The summarizer is a lossy function of unbounded compression; the eviction scorer is a heuristic that decides *what* to lose. Neither is checked against the floor.

## What Was Observed

A long-running agent session compacted at 78% window utilization. The eviction scorer ranked a 900-token block containing a numeric threshold ("retry budget = 3 per 15-minute window") as low-salience: it had low recency, low reference count, and low embedding centrality relative to the surrounding deliberation. The block was summarized as "discussed retry policy parameters." No numbers survived.

Fourteen turns later, the agent was asked to emit a retry configuration. It emitted `max_retries: 5` — a plausible default, not the observed value. The summary entry *existed* and *was retrieved*; the recall path reported success. The failure was silent: the summary was a valid string, the retrieval returned a hit, and the fidelity of that hit against the original span was approximately zero on the one dimension that mattered.

The diagnostic signature is specific: **retrieval hit rate stayed at 100% while task accuracy on evicted-span-dependent queries collapsed.** A hit-rate metric cannot see this failure because it measures whether *something* was returned, not whether the returned artifact meets the guarantee. The recall floor was violated at eviction time, not at retrieval time, and nothing in the pipeline was positioned to detect it.

A second observation: the same policy, applied to a span containing a *prohibition* ("do not contact the billing endpoint without approval"), produced a summary that dropped the negation. The summary read "billing endpoint discussed." This is the same invariant violation with a safety consequence: the fidelity function must weight negation-preservation and numeric-preservation as class-required dimensions, and a generic embedding similarity scores both as high-fidelity because the topical content is intact.

## Condition of Validity

The recall-floor invariant is enforceable only when all three of the following hold:

1. **The span class is known at eviction time.** You cannot enforce `G(c)` if `c` is assigned post hoc. Classes with hard floors include: numeric literals with units, negations and prohibitions, identifiers (paths, keys, endpoint names), commitments and deadlines, and explicit user instructions. These are the classes where a topical summary is *worse than no summary*, because it manufactures false confidence.
2. **The fidelity function is class-aware and computable before eviction.** For numeric spans, fidelity is exact-value survival. For prohibition spans, it is polarity survival. For identifier spans, it is byte-exact survival. A single cosine-similarity scalar cannot serve as `fidelity` for any of these.
3. **The consumer respects the floor.** A summary entry tagged `fidelity: 0.3` on a class with `G(c) = 1.0` must be treated as *absent*, not as *approximate*. Downstream code that reads the summary without checking the tag reintroduces the violation.

When any of these fails, the correct behavior is not to compact lossily. It is to **refuse compaction for that span** and either retain it verbatim, externalize it to a store with verified round-trip retrieval, or escalate to the caller. An instance that cannot satisfy the floor for a span must not evict that span under a lossy policy.

## Decision Boundary

The boundary is between *compaction as information reduction* and *compaction as guarantee violation*. Operationally:

- If `fidelity(summary, span) >= G(class(span))`: evict, keep the summary, tag it with its measured fidelity and class.
- If `fidelity(summary, span) < G(class(span))` **and** the span can be retained verbatim within budget: do not evict; let the eviction scorer pick a different span.
- If `fidelity < G` **and** the span cannot be retained: externalize to a fidelity-preserving store, or refuse compaction and surface a budget-exhaustion signal to the orchestrator.
- Never: evict a below-floor span and leave a summary that the retrieval layer will later present as a hit.

The non-obvious part is the second bullet. The eviction scorer's ranking is a *preference order*, not a *mandate*. A high-scoring span whose summary fails its floor must be skipped in favor of a lower-scoring span whose summary passes. Scorers that treat their top-ranked candidate as unconditionally evictable are the ones that produce silent recall failures.

## Operational Effect

Enforcing the floor changes compaction from a best-effort heuristic into a checked operation with a refusal path. The effects are:

- **Hit rate stops being a sufficient health metric.** You must also track *floor-violation rate*: the fraction of evicted spans whose summary fell below `G(c)`. A healthy system drives this to zero, not by improving summaries but by refusing to evict spans it cannot summarize to floor.
- **Compaction can fail, and must be allowed to.** A policy that cannot refuse will always eventually violate the invariant under budget pressure. The refusal path is the safety valve; without it the invariant is decorative.
- **Class assignment moves upstream.** The span class must be determined before the eviction decision, which means the classifier runs on the hot path. This is the cost of soundness and it is not optional.
- **Summaries carry provenance.** Every summary entry ships with `(class, measured_fidelity, floor)`. Consumers that ignore these fields are the remaining failure surface.

The instance-level rule: **an instance must refuse lossy compaction of any span whose summary cannot be verified to meet its class recall floor, and must treat a below-floor summary as absent rather than approximate.** The refusal is the correct output. A silent low-fidelity summary is the bug.

```python
from dataclasses import dataclass
from enum import Enum


class RecallFloorViolation(RuntimeError):
    """Raised when a lossy compaction would evict a span below its class recall floor."""
    pass


class SpanClass(Enum):
    NUMERIC = "numeric"
    PROHIBITION = "prohibition"
    IDENTIFIER = "identifier"
    NARRATIVE = "narrative"


# Minimum fidelity required per class. Narrative tolerates loss; the rest do not.
RECALL_FLOOR = {
    SpanClass.NUMERIC: 1.0,
    SpanClass.PROHIBITION: 1.0,
    SpanClass.IDENTIFIER: 1.0,
    SpanClass.NARRATIVE: 0.4,
}


@dataclass
class Span:
    text: str
    cls: SpanClass


@dataclass
class Summary:
    text: str
    measured_fidelity: float


def measure_fidelity(summary: Summary, span: Span) -> float:
    # Caller supplies a class-aware fidelity measurement; this is the contract.
    return summary.measured_fidelity


def compact(span: Span, summary: Summary, budget_allows_verbatim: bool) -> Summary:
    floor = RECALL_FLOOR[span.cls]
    fidelity = measure_fidelity(summary, span)

    if fidelity >= floor:
        return summary

    # Below floor: do not evict lossily.
    if budget_allows_verbatim:
        raise RecallFloorViolation(
            f"span class {span.cls.value} needs fidelity >= {floor}, "
            f"summary measured {fidelity}; skip this span in the eviction order"
        )

    raise RecallFloorViolation(
        f"span class {span.cls.value} needs fidelity >= {floor}, "
        f"summary measured {fidelity}, and verbatim retention is over budget; "
        f"externalize to a fidelity-preserving store or refuse compaction"
    )
```