Skip to content

Action-Gated Context Trimming for Long-Horizon Agents

Where lost state cannot be refetched, hold every item an open dependency needs and stop trimming before an irreversible write.

Action-gated context trimming makes the retention budget a function of workflow state rather than a constant. In Gaggar's guardrail condition the trimmer holds an item whole while the action that consumes it is still pending. It compresses less in the steps before an irreversible or externally state-changing action. When it cannot reconstruct a required entity, constraint, or dependency with exact correspondence, it pulls the archived material back in (Gaggar, arXiv:2609.16461v1). The unit of protection is the open dependency rather than the line type or the token count.

Check these conditions first

The evidence supports this only under conditions many setups do not meet.

  • Your state is not refetchable. On AppWorld, where an agent can re-query persistent application state, plain recency truncation matched or slightly exceeded summary-based compaction at 16K, 8K and 4K budgets across 147 tasks; summarization pulled ahead only at the tightest budget, 72.8 percent against 42.2 percent (Min et al., arXiv:2608.06503v1). Where a dropped observation costs one extra tool call, guardrails buy little.
  • Budgets are tight. Gaggar's test of the guardrail against fixed protocol-aware trimming, 2.11-fold success odds, covers retention of 35 percent or below. At 50 percent retention the protocol-aware and adaptive arms scored 3.2 percentage points above full context, 95 percent CI 1.9 to 4.5, at a mean token saving of 47.1 percent (arXiv:2609.16461v1). That result pools both arms, so it does not show the guardrail pays under moderate pressure.
  • Something already marks an open dependency as open. The trimmer that produced these numbers was handed two independent annotations of protocol-critical dependencies, with disagreements resolved before the experiments ran (arXiv:2609.16461v1). Treat the result as a ceiling on what an automatic classifier delivers, not as its expected score.

Why it works

Operational criticality tracks dependency state, which is why no fixed rule captures it. A resource identifier is non-compressible while the call that consumes it is pending, and expendable the moment that call returns. Any policy keyed to age, type, or semantic similarity ranks it wrongly at one of those two moments.

The size of the gap shows in what generic compactors drop. Across multi-turn chat, agentic trajectory, and long-horizon research settings, compactors retained 17 percent of injected session constraints on average, and most scored below running the same task with no compaction at all. A constraint-aware extractor added beside the same compactor, changing neither the compactor nor the model, lifted retention above 90 percent (Wang et al., arXiv:2608.11242v1). What changed was that something tracked which items were still binding.

Gating on the next action rather than on the budget handles the cost asymmetry. A wrong trim before a read costs a re-read; a wrong trim before an external write changes the environment and propagates through every later step. The signal arrives in time to act on. Compression and recall needs are encoded in pre-action hidden states, and those signals depend on current task state and are not explained by context length or interaction progress (Wang et al., arXiv:2609.27286v1).

When this backfires

  • The workflow is short and dependency-light. Under guardrailed trimming, low-complexity workflows showed no critical threshold anywhere in a grid that bottomed out at 15 percent retained context (arXiv:2609.16461v1). There is nothing for the guardrail to protect.
  • Your dependency marker closes too early. It then deletes the identifier a recency window would have deleted, and you maintain a classifier for the privilege.
  • You A/B on single runs. Compression turns reliably-solved tasks into intermittently-solved ones, widening the gap between solving a task in at least one of two runs and solving it in both (arXiv:2608.06503v1). Report both numbers or a bad budget will look safe.
  • Runs are not ending on window exhaustion. Buy a wider window before you build a dependency tracker.
  • You expect the source numbers to transfer. The guardrail results, confidence intervals included, come from one preprint that names no model family, task count, or run count, and offers its data only on request (arXiv:2609.16461v1). Its direction is corroborated independently; its effect sizes are not.

Key Takeaways

  • Gate on the open dependency and the next action's reversibility, not on a retention percentage.
  • Measure first. Where a dropped observation can be re-fetched from the environment, recency truncation matched summarization at 16K, 8K and 4K budgets and only lost at the tightest one.
  • Instrument repeated-run consistency, not mean success, when comparing budgets.
  • If you build one guardrail, make it the freeze on trimming in the steps before an external write. That is where a wrong trim stops being recoverable.
Emerging — single recent source Last reviewed: 2026-09-24