How Strongly Should Task State Influence an LLM Agent?

Returning rejection notices within the same turn eliminated visible false-completion replies without changing strict episode success relative to next-turn notices.

Retrieval used as the task record failed almost every episode through omissions; verbatim top-k recall added to the full transcript helped but stayed below directives, Mem0 augmentation did not help, and an unverified agent-written ledger outperformed the always-accurate displayed checklist while still leaking re-executions.

Adding an explicit one-shot rule primarily improved the raw text rung, especially with Qwen3-235B thinking; schedule controls showed smaller gains from the revised probe schedule, while stateful rungs moved little and the measured compile tax on enforcement was at most two episodes per cell.

Original-brief error decomposition showed re-execution and superseded execution leading the text-rung failures, directive-gate errors shrinking with obedience, and enforcement eliminating re-execution and superseded execution while leaving omissions and state-admitted unrequested bookings.

Trap-turn interventions showed a fresh-order hazard: Qwen3-235B often checked prerequisites and rebooked completed work unless a user-role directive explicitly said not to redo it, while many Qwen3.6-35B text-protocol errors were receipt-like booking lines written after prose that said no new work would be booked; this smaller-model mode nearly disappeared with real tool calls.

In a one-node precursor with 100 concurrent one-shot commitments and Qwen3.6-35B, a guarded trigger eliminated re-execution of consumed one-shots despite imperfect trigger recall; removing transcript sanitization restored much of the re-execution problem.

Re-execution remained the leading raw-transcript error at every amended-brief graph size tested.

In a second synthetic domain with release-engineering vocabulary but matched graph and schedule structure, both gate contrasts replicated while the exact checklist did not separate from the raw transcript.

On PM-Bench, showing the compiled intention record was the best rung, directives traded fewer misses for more false alarms, judgement-bound enforcement inherited matcher errors and harmed Qwen3.6-35B, and state-only enforcement returned roughly to self-ledger performance rather than beating the checklist.

Exact payload scoring responded correctly to clean and deliberately corrupted oracle agents, and an LLM-rater wording study found that almost all amended-brief redo probes read as re-mentions rather than fresh orders.

Across amended-brief graph sizes, the no-think ordering was non-decreasing in every cell, while thinking compressed the ladder and sometimes reversed adjacent point estimates; per-turn accuracy occupied a much narrower range than strict episode success.

Directive-gate performance tracked model obedience: all-trap obedience was 0.854 for Qwen3.6-35B, 0.948 for Qwen3-235B no-think at S=15 dense, 0.970 for Qwen3-235B thinking, and 1.000 for DeepSeek V4 Pro.

The gate matcher was nearly exact on canonical requests, while compilation was near-perfect for dependencies, codes, and cancellation but materially weaker for rewiring and, for Qwen3.6-35B, relaxed prerequisites.

Under the amended brief, stronger state coupling generally increased strict episode success without per-turn thinking; Qwen3-235B thinking compressed the ladder, including ties or non-significant adjacent gate contrasts in specified cells.

Across ten Qwen3-235B enforcement cells, the 68 omissions split into 35 compiled-state over-blocks, 17 agent declines of an ELIGIBLE directive, and 16 wrong-code or wrong-work-order bookings; every over-blocked omission occurred in an episode flagged by the ground-truth-free validator.

Held-out paraphrases left the text arms statistically unchanged but sharply reduced both gate arms by lowering matcher agreement; ambiguous two-step probes resolved to no step and were still sometimes booked because state-bound enforcement decides eligibility rather than intent.

Injecting flipped DONE bits and dropped edges monotonically degraded enforcement; spurious DONE was deterministically fatal in the reported single-event cases, and most damage arose when the agent silently obeyed an incorrect directive rather than from an explicit refusal.

Showing only the current checklist did not help, merely naming the matched step moved results in opposite directions by model, and moving directives into the system role sharply hurt both gate arms; the directive gain therefore depended on the instruction and its user-role placement.

A LangGraph tool-dispatch harness reproduced the coupling ordering. For Qwen3.6-35B, state-bound enforcement tied directives because it admitted eligible but unrequested prerequisite calls; request-bound enforcement removed those channels. For Qwen3-235B, both enforcement policies tied and refused no call.

The focused original-brief ladder reports Wilson confidence intervals for the two dense/small Qwen3-235B cells and DeepSeek V4 Pro; all adjacent no-think Qwen3-235B contrasts separated, while thinking converged at the top.

The amended one-shot sentence mainly reduced re-execution in the raw and checklist arms for Qwen3-235B, but Qwen3.6-35B's checklist did not improve and its primary-scoring re-executions increased.

Across the full original-brief inventory, the no-think ladder was non-decreasing and text-rung failures remained substantial; per-turn thinking did not repair the raw transcript under the underspecified brief, while directive and enforcement performance converged at stronger models.

In logged Qwen3-235B no-think jobs, gate arms used fewer agent tokens and completed faster than the raw and checklist arms despite adding matcher calls; the checklist was the most token-expensive because rendered state accumulated in history.

On paired tau2-bench airline runs, a compiled tool-dispatch gate raised Qwen3-235B pass^1 from 0.39 to 0.54 and eliminated executed rule violations, but changed little for Qwen3.6-35B because that model rarely attempted state-decidable violations; state shown and overridable notices lay between on pass^1 but leaked violations.