A reviewer finds a missing approval. The next stage gets a summary, a ticket, or a handoff note. The gap is still mentioned. Then someone proceeds as if the mention settled the matter.
That sequence is what a Shenzhen University team tried to measure. Their paper, When “Must” Becomes “Maybe”: Constraint Weakening in LLM Agent Workflows, posted to arXiv on August 25. The authors call the thing they are tracking operational state preservation: whether an already-established condition still restricts what the next step is allowed to do.
Mentioning the constraint is a different job from keeping it in force.
The setup is a synthetic enterprise blocker class, run across 1,296 controlled episodes and six model variants. This is a testbed. Production rates and human-team behavior are separate questions. The authors say so, and that limit has to travel with the numbers.
Direct-preservation controls, where the full blocking context passed through unchanged, kept every blocker: 100.0 percent preservation, 0.0 percent deactivation, 0.0 percent forbidden action.
Light summarization deactivated 25.0 percent of blockers and produced 0.0 percent forbidden action. The constraint softened. The executor still stopped.
Normal handoff, the middle case closest to how these pipelines route work, hit 100.0 percent deactivation and 54.2 percent forbidden action. The warning stayed in the record. The stop did not govern the next move.
Stronger compression arms stayed at 100.0 percent deactivation, with forbidden action at 83.3 percent and 79.2 percent.
Those rates only become useful after you locate the failure. The architecture makes that easy. An upstream reviewer identifies a blocker under full context. A later step rewrites that state into an artifact. A downstream executor sees only the artifact and chooses from a finite action set. Compression, plan assimilation, consensus framing, ownership deferral, and precedent substitution can turn the same stop into a caveat, a later check, or a historical note.
The executor is not hiding the flag. It is working from what it received.
A repair contrast in the paper restored four fields: stop status, unresolved prerequisite, responsible authority, and admissible fallback. In that contrast, preservation returned to 100.0 percent and forbidden action to 0.0 percent. Those fields are a probe for what the gap was about. They are not a deployment recipe.
A last-step check can still catch the action after the record has already gone soft. In a fixed-artifact panel, downstream verification dropped forbidden action to 0.0 percent while artifact preservation sat at 4.7 percent and deactivation at 95.3 percent. Catching a bad action at the last gate is a different job from keeping the stop alive for the next person or the next system.
This adds a narrower claim to an earlier Hypernovelty piece. The Object Arrived Alone looked at objects that travel while evidence, context, or responsibility fall away. Here the proposition can travel and still lose force. The warning is present. The stop is gone.
Verification bottleneck
Verification is becoming the scarce institutional function.
- A summary, ticket, or memory can mention a constraint while changing whether it still binds the next action.
- The receiving agent, clerk, or operator has to check status, prerequisite, owner, and fallback, not only whether the topic appeared.
- Watch how compression, consensus framing, and ownership deferral turn stops into suggestions.
- A last-step approval can contain a forbidden action without repairing the record the next stage will inherit.
Opportunities
Where value may appear is in the handoff record itself.
A binding-state packet could travel with high-consequence tickets. It would keep the stop label, the unresolved condition, the named resolver, and the allowed fallback visible as fields rather than as optional prose.
A handoff audit could score a sample of summaries against the source state. The useful score is whether the receiving step still treats the condition as a prerequisite.
A lighter containment check at execution time could look up authorization before a default-allow action. That check would sit beside the packet. It would not replace it.
This is a preprint. It was not independently reproduced for this review. The figures describe a specific controlled testbed. Treat them as a measurement of a mechanism, not a rate for live companies.