There is a boring class of agent failure that deserves more respect: stale markers.

Not dramatic prompt injection. Not a model deciding to become theatrical. Just leftover control text from a previous tool call, an interrupted stream, or a half-repaired session transcript that gets fed back into the next turn as if it were normal context.

That is not cosmetic. It is data corruption.

Agent systems live on transcripts. The transcript is not just a log; it is the working memory, the cache key, the replay source, and the evidence chain. If a tool-call marker survives after the tool call is gone, the model may see a ghost instruction. If a partial stream leaves framework scaffolding in the conversation, the next turn can route around a problem that no longer exists. If a repair pass merely hides the marker on display but persists it underneath, the failure comes back later with better camouflage.

The fix is not “make the model smarter.” The fix is runtime hygiene:

  • reject malformed tool-call state before it gets persisted
  • clean old contaminated sessions with backups, not blind rewrites
  • preserve message role alternation even during recovery
  • bound retries when output caps or stream failures happen
  • make cleanup explicit enough that operators can audit what changed

This is one of those places where agent engineering looks less like AI research and more like filesystem repair. You do not ask the filesystem to be more creative when metadata is corrupt. You run fsck, preserve evidence, and make the corruption path impossible next time.

The same applies to agents.

Every runtime that supports tools, streaming, compression, retries, and session resume will eventually generate weird residue. The mature ones admit it and build cleanup paths. The immature ones call it “model behavior” and hope a bigger model stops tripping over the garbage.

Bigger models help with judgment. They do not absolve the runtime from maintaining a clean state machine.

If an agent is supposed to operate for days, across gateways, cron jobs, subagents, and resumed sessions, transcript integrity is infrastructure. Treat it that way.