Every rule you write for an AI agent is a hill in this landscape. Its height is how strongly the rule is written. Turn up the context load and the water rises, and the low, weak rules go under first.
A written rule competes for a finite budget of attention. As the working context fills, the level rises and the weakly-written rules drown. The agent quietly stops acting on them. Even a high-stakes Never… drowns if it's written weak (cyan). The rules you can't afford to lose don't belong in prose at all: move them to a runtime gate, which runs as code, not attention. Drag to orbit; drag the load to raise the level.
Instruction strength in context
The rules that went under first were written weak: vague verbs, buried constraints, no number to check against. A weak instruction is a low hill, first under when the level climbs. Here's how to build taller ones.
Instruction surface lint
type a rule, or load a weak exampleThis is a lint, not a score. A little regex reliably catches the surface tells: hedges, shouting, politeness, a ban placed before its directive. It deliberately won't grade your rule out of 100. The real strength analysis in reporails runs server-side and goes far deeper: whole-file attention, topic scatter, how each rule competes with everything around it. Fix the obvious tells here; run the engine for the rest.
What makes an instruction stick
These are the patterns that survived measurement when we built a linter that scores instruction files. They're the ones that actually change what the model does.
- 01The golden pattern: directive → reason → constraint. Human instinct writes the ban first, and that activates the forbidden thing before the model learns what to do. Order it: what to do, one line of why, the constraint last.
- 02Command, don't suggest.
Use,Run,Never,Always. "consider," "should," "try to" all read as optional, because they are. - 03Name the thing.
pytest tests/ -v, not "run the tests." A vague rule is indistinguishable from the model's own defaults. - 04Prohibitions are the inverse. For a "never," don't name the construct. Naming it anchors the forbidden concept. Say the category: "never use dynamic code execution," not "never use
eval()." - 05Elaborate, with distinct terms. Too terse is invisible; filler dilutes. Name several different concrete aspects, not the same word three times.
- 06Weaknesses compound. Hedged and vague and buried don't add up; they multiply, so three small flaws land near zero.
- 07Put the important rule last. Last-seen wins; line one is the weakest slot. Bold and CAPS don't rescue a bad position.
- 08Your rival is the default. Weak or contradictory rules don't average out. The model falls back to what it already does. Beat the default or don't bother.
- 09Lowercase the "never."
Never edit generated files, notNEVER…. Caps makes the model fixate on the shouted word instead of the ban around it.
Each pattern links to its rule in the full measured ruleset.
Same rule. Two channels. One fades, one doesn't.
Every instruction you can write in prose lives on the attention channel, and everything on that channel decays as the context fills. Moving a rule onto the runtime channel is the only thing that takes it off the attention channel, where the fade happens.
Written attention
System prompt, CLAUDE.md, a rule you typed, a reminder mid-thread. It's probabilistic, and it thins under load. When it fails it fails silently. Nothing tells you the rule stopped mattering.
Runtime gate
A PreToolUse hook, a permission deny, a check that runs before the action. It's deterministic: it runs as code, not attention, so the fade doesn't apply. It fails loudly, or not at all.
What you just watched
At a fresh session the water is low and every hill stands clear. The agent has attention to spare and follows them all. As load climbs the level rises, and the shortest rules go under first, in order of how well they were written. That ordering isn't cosmetic: it's why the rule you care about most is usually the one you should stop asking for and start enforcing. The three high-stakes Never… rules (cyan) sit at only modest height. A bare ban can't be made strongest without naming the very thing it forbids, so it drowns like any weak rule. A rule you can't afford to have crowded out of attention shouldn't be left on this channel at all. Move it to a runtime gate, where it's refused as code, not attention. The fade is a property of attention; code doesn't have it.
The uncomfortable part is the silence. A faded prose rule doesn't throw. There's no log line that says "I stopped following your instruction." The task just comes back subtly wrong, and the rule reads perfectly fine when you go back and check it. The instruction was never the problem. The channel it lived on was.
The field is an illustrative model built for this demo, not a measurement of any specific system or corpus. The hill heights are a fixed, hand-reviewed set. Each one is placed by how well the rule is written per the patterns below, not computed live. The coach is the live scorer, and it is a transparent heuristic, not the real engine. What the field dramatizes is real: well-written guidance survives more context load, and weak guidance drowns first. So is the fix it points to. A high-stakes rule belongs on a runtime gate, which runs as code, not attention.
Run this on your own rules
The field above is a hand-placed illustration. reporails runs the strength analysis on your actual CLAUDE.md and agent instruction files: whole-file attention, topic scatter, and how each rule competes with the ones around it.
CLAUDE.md →