1 Introduction↩︎

For a long-horizon LLM agent, memory is not a place to store text; it is a contract about what each future decision is allowed to see. One common contract appends past observations, tool calls, and reflections to the next prompt [2]–[4]. Another distills prior experience into typed records and retrieves only the pieces selected for the current decision [5]–[9]. This choice is not just an engineering detail: it determines what evidence the model sees, what stale information can re-enter a decision, and which component can be ablated when the agent succeeds or fails. We therefore ask whether a long-horizon benchmark [10], [11] can make the memory interface bounded, inspectable, and reusable rather than treating context growth as an implicit default. Practitioners increasingly frame this through the agent loop and its context or “loop” engineering [12], [13]—the per-iteration choice of which prior experience to place in a finite window; our bounded contract is a formal, ablatable answer to the memory stage of that loop.

We instantiate this question in Slay the Spire 2, a roguelike deck-building game. A run is a stochastic strategic campaign: the agent chooses map routes, fights turn-based battles, drafts cards, buys or skips items, and preserves scarce health over many delayed consequences. The rule space is closed, symbolic, and text-readable, so game facts and legal actions can be supplied as structured records rather than pixels. At the same time, success requires hundreds of local and long-range decisions under random card draws, rewards, enemies, events, and difficulty modifiers. Public benchmarks indicate that the task is not already saturated. The game ships an ascension difficulty system that runs from \(A_0\) (the easiest tier) up to \(A_{10}\) (the hardest). At \(A_0\), a publicly available benchmark of frontier LLMs on this game reports zero wins across five model configurations, and the developer-reported human win rate is \(16\%\) [14], [15]. Together these numbers make Slay the Spire 2 a hard but unsaturated testbed for studying long-horizon LLM-agent memory.

Our agent, AgenticSTS, implements typed retrieval as a bounded memory contract. For every decision, the user message is freshly composed from five slots: fixed protocol instructions (\(L_1\)), state-specific schemas and legal action formats (\(L_2\)), retrieved game rules (\(L_3\)), episodic summaries (\(L_4\)), and triggered strategic skills (\(L_5\)). The slots differ in mutability and experimental role: \(L_1\) and \(L_2\) are fixed; \(L_3\) can be filtered; \(L_4\) and \(L_5\) can be disabled, frozen, or made writable between runs through postrun analysis; raw cross-decision transcripts are not appended. The resulting prompt interface turns memory from “how much history fits” into “which typed evidence is selected,” a form that can be inspected and re-aggregated across conditions.

Across \(298\) completed trajectories, we run two main evidence streams and a cross-backbone probe. The first holds difficulty fixed at \(A_0\) and varies the five memory slots: a no-scaffold baseline wins \(3/10\) games (Wilson 95% confidence interval \([10.8\%, 60.3\%]\), i.e., the true win-rate is likely between \(10.8\%\) and \(60.3\%\)), and the largest observed difference coincides with enabling \(L_5\) skills, which reach \(6/10\) in each scaffolded cell (\([31.3\%, 83.2\%]\)). At this sample size the difference is directional rather than statistically decisive (Fisher exact \(p\approx0.37\)), and the five typed slots remain individually ablatable. The second stream climbs the difficulty ladder with \(L_4\) and \(L_5\) stores that update between runs, reaching high-difficulty probes at \(A_6\)–\(A_8\). A cross-backbone probe (the underlying LLM is swapped among Gemini, Qwen, and DeepSeek) exercises the same ablation surface on other model families; the frozen stack is backbone-sensitive, with model-specific caveats detailed in §6.4.

The released archive supports re-aggregation and cross-condition re-analysis: a reader can recompute the headline fixed-\(A_0\) cells or slice trajectories by condition tag using the included scripts. We ship the condition-tagged trajectories, the SHA-anchored \(L_4{+}L_5\) snapshots used in the fixed-\(A_0\) matrix, decision-time prompt records, and Wilson/bootstrap analysis scripts.

Contributions. We contribute (see Figure 1):

1. a per-decision composition interface assembling prompts from typed \(L_1\)–\(L_5\) slices rather than a raw transcript;

2. evidence that, under the bounded contract, the largest observed \(A_0\) difference coincides with enabling triggered \(L_5\) skills (\(3/10\to6/10\), directional at this sample size rather than statistically significant), that the typed slots remain individually ablatable across three model backbones, and that the surface admits ladder probes at high-difficulty \(A_6\)–\(A_8\);

3. a reusable archive of \(298\) trajectories with condition tags, SHA-anchored \(L_4/L_5\) snapshots, prompts, and Wilson/bootstrap scripts for community study of context use in long-horizon agents.

Claims concern layer separability inside the contract; a matched accumulating-context comparison is future work (Limitations). Prior prompt-history [2]–[4], structured-memory [6], [8], [16], [17], and skill-library agents [18]–[20] motivate the design space. §3 presents the testbed; §4 the contract; §5 the protocol; §6 the results.

2 Related Work↩︎

We build on four recent research threads—prompt-history agents, externalized memory, skill libraries, and long-horizon game testbeds—and target their joint problem: which slice of prior experience enters each decision, and whether that route can itself be ablated.

Loop and context engineering. In practice, agent design is increasingly framed as loop engineering: specifying a goal, tools, termination, and—centrally—the memory and context policy of a control loop that runs over hundreds of steps and multiple sessions [12]. The recurring failure mode is context growth: appending full transcripts and tool logs to every call overflows the window and dilutes attention, whereas “token-poor” loops keep only the last few messages or short summaries and therefore depend on an explicit memory store [13]. This is exactly the axis our contract isolates. That literature is largely qualitative and centered on coding agents; the academic threads below supply the mechanisms, and we make the memory stage of the loop a typed, bounded, ablatable contract on a hard long-horizon game.

Long-horizon LLM agents and prompt-visible history. ReAct and Reflexion made it natural for observations and self-critiques to reappear in later LLM calls [2], [3]. Recent horizon analyses [10], [11], [21], [22] examine how small errors compound over many steps.

Typed and structured memory. MemGPT, Mem0, MemoryOS, GAM, hierarchical procedural memory, and Agent Workflow Memory [6], [8], [16], [17], [23], [24] move information out of raw message history into external stores. Adjacent typed-memory frameworks [5], [7], [9] group memory by capacity; we instead role-type slots by mutability and retrieval source. Most evaluation is in dialogue or QA; in our setting retrieval feeds an action policy in a stochastic environment.

Self-evolving skill libraries. Voyager pioneered an external library of agent-written skills [4]; SkillsBench, SkillOS, Memento-Skills, SAGE/SkillRL, SkillWeaver, ExpEL, and DyStIL extend the design [18]–[20], [25]–[28]. In the SoK notation \(S=(C,\pi,T,R)\) [29], our \(L_5\) guides correspond to \((C,\pi)\): a trigger selects a prose policy for the next decision.

LLM agents on games. Games such as Crafter, NetHack, BALROG, LMGame-Bench, DSGBench, Gameverse, and RAGEN [30]–[36] provide stochastic testbeds for agents. Card-game work includes end-to-end policy networks [37], LoRA-tuned draft models [38], cross-card-game LLM evaluation [39], and LLM play on the original Slay the Spire with simplified rule sets [40], [41].

Public Slay the Spire 2 LLM agents. The public Slay the Spire 2 ecosystem—STS2MCP, HermesBridge, AI-Spire, CharTyr [42]–[45]—does not report a matched ablation over prompt strictness, episodic memory, and triggered skills. AGI-Eval [14] lists zero \(A_0\) victories across five frontier-model rows with mixed denominators.

6pt

We combine these threads in one bounded-memory contract, so future work can compare alternative contracts under the same harness.

3 The Slay the Spire 2 Testbed↩︎

Slay the Spire 2 is a turn-based deck-building roguelike: an agent builds a deck during a run, fights stochastic battles, chooses routes and rewards, and climbs an ordinal difficulty ladder. The game is useful for evaluating LLM-agent memory because it is long-horizon but not visually opaque. Rules, cards, relics, enemies, events, legal actions, and state transitions can be represented as text records, while success still requires sustained planning across many contingent decisions. We release the resulting runs as a reusable evaluation resource (§5.4).

3.1 Four properties of Slay the Spire 2 as an LLM testbed↩︎

(P1) Closed, enumerable, LLM-readable rule space. Public database snapshots index hundreds of typed records (576 cards, 293 relics, 115 monsters, 87 encounters, and 66 events in Spire Codex’s May 2026 API; these are database counts, not unique experimental-patch counts) [46]. Unlike pixel-rendered Crafter [30] or the inherited code complexity of NetHack [31], Slay the Spire 2 has a compact rule space that can be loaded into a typed knowledge layer (§4). This makes \(L_3\) part of the evaluation substrate rather than a hidden source of game knowledge.

(P2) Empirically long horizon. A typical run lasts a median \(\sim\)​80 min wall-clock (IQR 37–109 min) and contains 67 LLM strategic calls (IQR 27–105). Roughly \(500\) additional per-run decisions, such as combat targets, treasure choices, map nodes, and hand selection, are mechanically resolved or routed to a fast tier with bounded combat context (§4). This is precisely the regime where message-history accumulation becomes costly relative to typed recomposition [10], [11], [22].

(P3) Multi-axis stochasticity. Random card draw, shuffle order, reward offerings, map paths, relic effects, elite and event placements, and Ascension modifiers prevent simple trajectory replay. A strong policy must generalize over states, not memorize a fixed route.

(P4) State-conditioned combat math. Damage and status pipelines combine hand contents, enemy intent, block timing, and effects such as vulnerable, weak, strength, and dexterity. The agent must compute from the current state; web-like recall is much less useful than state-conditioned calculation.

3.2 Ascension ladder and scoring↩︎

The 11-level Ascension ladder (\(A_0\)–\(A_{10}\), with \(A_{10}\) the maximum) gives the testbed an ordinal difficulty scale. Higher Ascensions stack modifiers that change strategic priorities, so climbing the ladder is not just repeating \(A_0\) with larger numbers. We therefore use two complementary evidence streams: a fixed-\(A_0\) matrix that isolates components at one difficulty (§5) and an auto-mode ladder in which the agent advances after victories and retries after defeats (§5).

Runs are scored with a derived analysis score: \[s = \begin{cases} 100 & \text{if victory,}\\ \mathrm{floor} + \tfrac{52}{3}\cdot\mathrm{bosses} & \text{otherwise,} \end{cases} \label{eq:score}\tag{1}\] where \(\mathrm{bosses}\) counts cleared act bosses (0/1/2 by reached floor for non-victory runs, 3 for victories; full mapping in Appendix 10). The value is recomputed from outcome, floor, and boss-count fields, not copied from the raw archive score field. The \(52/3\) coefficient calibrates three cleared bosses to \(52\) points, the approximate mid-Act-3 floor reach. A \(\pm 10\%\) perturbation of the coefficient checks score-based qualitative comparisons; win-rate claims do not depend on this score scale.

3.3 Data corpus, release, and harness↩︎

The released archive contains \(298\) completed independent game trajectories spanning fixed-\(A_0\) ablations, cross-backbone probes, and auto-mode ascension runs. Each trajectory records target and reached Ascension, outcome, wall-clock duration, LLM-call counts, condition tag, and the active memory/scaffold setting. The headline fixed-\(A_0\) comparison uses a pre-specified balanced subset of 50 completed games, namely the first ten per condition under the frozen configuration. Other completed trajectories support the cross-backbone and ladder diagnostics rather than entering the fixed-\(A_0\) estimate. Frozen \(L_4{+}L_5\) stores and per-condition tags are released with the public artifact archive [47], [48].

The game alone is not the full benchmark: a game interface must be paired with a decision protocol. Public Slay the Spire 2 implementations [42]–[45] let LLMs act in the game, while the independently evaluated AGI-Eval configurations [14] report no listed victory. Our architecture (§4) supplies the bounded-memory contract that makes the released trajectories a reusable evaluation surface.

4 Architecture: Per-Decision Typed Retrieval↩︎

This section specifies what the LLM is allowed to see when it makes a move. The agent never appends the raw message turns from earlier decisions. Instead, it rebuilds each decision prompt from five typed knowledge layers (Figure 2b). Any information that survives across decisions must first be written into a bounded store; in our experiments, postrun extraction and skill discovery can write back only to \(L_4/L_5\).

The contract gives the resource four evaluation handles that a raw prompt-history setup usually hides: horizon growth is capped by slot budgets; retrieved evidence is labeled by layer; \(L_4\) and \(L_5\) can be toggled without rewriting the whole prompt; and runs, stores, prompts, and scripts carry condition tags for reuse.

4.1 Per-decision compositional context↩︎

In ReAct/Reflexion-style agents [2], [3], the model may see a growing log of earlier states, tool calls, and self-critiques. AgenticSTS uses a different interface: for decision \(d\) at state \(s_d\), the engine retrieves from \(L_1,\ldots,L_5\) and composes a fresh user message \[u_d = \pi\bigl(L_1, L_2(s_d), L_3(s_d), L_4(s_d), L_5(s_d)\bigr), \label{eq:composition}\tag{2}\] sent to the LLM as \(\langle\mathrm{sys},u_d\rangle\). The design still allows bounded typed summaries, a per-run Strategic Thread, and same-decision repair retries. What it disallows is an unbounded transcript that grows because the run has been long.

Bounded context. With capped top-\(k\) retrieval and capped item sizes, the configured prompt size is \(O(|\mathrm{sys}| + s_{\mathrm{thread}} + \sum_i k_i\cdot s_i)\). The raw cross-decision transcript therefore does not scale with the number of decisions. A transcript interface has worst-case \(\Omega(d\cdot \bar{s})\) growth for \(d\) decisions, raising per-decision token cost as a run lengthens [49]. Figure 3a–b reports a per-cell linearity audit (\(N{=}2\) runs per cell, \(10\) runs total) of the released fixed-\(A_0\) runs.

Ablatable layers. Because context reaches the model through named slots, we can switch prompt strictness, rule retrieval, episodes, and strategic skills on or off independently. This is the main experimental advantage of the contract: the fixed-\(A_0\) matrix can ask which layer changes behavior, not only whether a larger prompt helps.

4.2 Five typed knowledge layers↩︎

The compose operator uses five substrates, separated by mutability and role. \(L_1\) operator prompts contain immutable role and protocol templates for each state type. \(L_2\) state-typed prompts provide immutable schemas for combat, deckbuilding, map, event, and intermission decisions, including legal action formats. \(L_3\) game knowledge stores enumerable rule data—cards, relics, events, enemies, and intents—refreshed by patch. \(L_4\) episodic memory stores postrun summaries (character \(\times\) ascension \(\times\) act \(\times\) enemy class) — case-based recall. \(L_5\) skill library stores triggered strategic guides distilled from logs — general scenario-class tactics indexed by trigger conditions for retrieval across recurring state classes. Each \(L_5\) guide has an explicit trigger, a prose policy, and a four-level write gate.

Raw Slay the Spire 2 logs are not used as similarity RAG. In this game, nearby-looking states can have very different strategic meanings because of card order, relic combinations, and route history. The agent therefore retrieves summaries and triggered guides rather than nearest-neighbor log snippets.

4.3 Routing and combat truncation↩︎

A dispatcher routes decisions to four model tiers: fast for trivial combat plans, strategic for ordinary decisions, analysis for postrun memory extraction, and evolution for skill distillation. Four static system prompts are cacheable; per-run state is placed in the user message. Combat is the only decision type with a local conversation object, and that object emits at most three messages per round: combat_start, ok, and the latest user state. Earlier rounds are summarized through the typed state rather than appended. Together with fast-tier routing and mechanical handlers, this yields a median of 67 strategic LLM calls per run instead of one call for every in-game action.

4.4 \(L_4\) episodic memory: role and ablation↩︎

\(L_4\) is the episodic layer. It stores postrun summaries for later retrieval and can also feed online skill evolution. In the fixed-\(A_0\) matrix, full-frozen (with \(L_4\)) and mode-a (without \(L_4\)) both win \(6/10\) games. Thus the balanced \(A_0\) comparison points to \(L_5\) as the layer associated with the headline lift. \(L_4\) remains part of the longer-horizon substrate used in the auto-mode streams, which attempt \(A_6\)–\(A_8\).

4.5 Skill discovery: distillation, write gate, and Mode B↩︎

\(L_5\) is populated in two ways. Mistake-driven discovery (self-evolve) reads combat losses relative to per-enemy baselines, runs a pre-write A/B check (\(B{=}3\) resample, strict \(2/3\) plus zero-harmful), and then applies a four-level write gate: cosine, Jaccard, LLM judge, and optional reap. Most candidates are rejected or merged rather than added as new skills. Stub-template-filled authoring (Mode B) fills five character-parametric templates for combat, boss, deckbuilding, map, and intermission decisions, under namespace isolation, a library lock, and warn-only validators. Mode B reaches the same \(6/10\) fixed-\(A_0\) point estimate as the human-authored mode-a seed library (§6.4), so the evaluation can separate the existence of a skill layer from the prose source used to populate it.

5 Experimental Methodology↩︎

The evaluation is organized around three empirical questions. At a single difficulty, which prompt and memory layers matter? If a frozen \(L_4{+}L_5\) stack is moved to another backbone, does it still help? When postrun writing is allowed, how far does the agent climb on the Ascension ladder?

5.1 The 5-condition decomposition at fixed \(A_0\)↩︎

The fixed-\(A_0\) study is a five-cell decomposition, not a full factorial grid (Figure 4). baseline-strict uses the baseline prompt with no memory, no skills, no strategic thread, and no combat-conversation wrapper; it also applies the strict knowledge/hint filter. prompt-only keeps the full prompt and conversation helpers but disables \(L_4\) and \(L_5\). mode-a adds human-authored \(L_5\) seed bodies. mode-b-frozen replaces those bodies with stub-template-filled \(L_5\) bodies. full-frozen adds the frozen \(L_4\) episodic store to Mode A. In all five cells, postrun and evolution writes are disabled, anchoring the active stores at SHA 1888a62.

5.2 Cross-backbone probe and auto-mode ladder↩︎

The frozen \(L_4{+}L_5\) stack was derived from Gemini 3.1 Pro trajectories. To test how backbone-specific that stack is, we run baseline-strict and full-frozen at \(A_0\) on three backbones: Qwen 3.6 27B, DeepSeek V4 Pro, and Gemini 3.1 Pro. The Qwen and DeepSeek probe adds \(N{=}5\) completed games per backbone-cell; the Gemini rows reuse the corresponding fixed-\(A_0\) cells as anchors. We report this probe separately from the headline ablation; Appendix 10 lists the denominator rules.

The auto-mode ladder uses a different protocol. After a victory at \(A_n\), the next run attempts \(A_{n+1}\); after a defeat, it retries \(A_n\). This stream measures the observed climb endpoint, whereas the fixed-\(A_0\) matrix measures reliability at one difficulty.

5.3 Statistical protocol↩︎

Cell-level win rates use Wilson 95% confidence intervals [50]. Continuous scores (Eq. 1 ) use 5,000-bootstrap 95% intervals [51]. The descriptive pooled scaffolded row uses an exact Clopper–Pearson interval and is labeled as such. For the headline fixed-\(A_0\) table, we take the first ten completed games per condition by start time, giving a balanced 50-game comparison. For context, recent LLM-agent game evaluations typically report 3–25 episodes per condition—e.g., \(3\) trials per cell in Voyager [4] and 10–25 seeds per task in BALROG [32]—so the present balanced \(5\!\times\!10\) subset sits at or above the comparable range while keeping completed-run denominators interpretable. Completed games are the denominator throughout. Additional completed games in the archive remain in their diagnostic streams and are not pooled into the fixed-\(A_0\) estimate. Score-based qualitative comparisons were also checked after perturbing the \(52/3\) coefficient by \(\pm 10\%\); win-rate intervals are unaffected.

5.4 Reproducibility and release contents↩︎

The public release includes the completed-run archive, condition tags, analysis scripts, frozen memory/skill snapshots, and representative prompt records needed to recompute the reported win rates [47], [48]. The same archive defines the natural next matched experiment: an accumulating-context condition implemented in the same codebase with the same run protocol and scoring scripts. Scope limits that affect interpretation are noted where they arise and collected in the Limitations section.

6 Results↩︎

6.1 Public difficulty calibration↩︎

External rows calibrate difficulty, not causal attribution. The May 2026 AGI-Eval snapshot reports zero listed \(A_0\) victories across five frontier-model configurations [14] (max defeat floor 33), and Mega Crit reports a player-side \(A_0\) win rate of \(16\%\) across 240M community runs [15]. Under our own harness, baseline-strict wins \(3/10\) runs (Wilson 95% CI \([10.8,60.3]\); mean score 70.4), placing the task in a hard but non-saturated regime. Public rows use different interfaces, prompt budgets, and decoding setups, so they are not matched baselines; the within-harness ablation in §6.2 establishes the role of typed retrieval.

6.2 Within-harness ablation↩︎

Table 2 reports the balanced fixed-\(A_0\) subset: ten completed games per condition, the active \(L_5/L_4\) layers, and the mean derived score. The comparison isolates prompt strictness, triggered skills, and episodic memory inside one codebase.

3.5pt

The largest separation is between no-scaffold and skill-scaffolded rows. The two no-scaffold cells win \(3/10\) and \(4/10\) games; all three \(L_5\) cells win \(6/10\). Writing the layer-attributable difference as \[\Delta_{L_\ell} = \widehat p_{\text{with-}\ell} - \widehat p_{\text{without-}\ell}, \label{eq:lift}\tag{3}\] Table 2 gives \(\Delta_{\text{prompt}}{=}{+}1/10\) (strictness, wrappers) and \(\Delta_{L_5}{=}{+}2/10\) at the same prompt setup. At \(N{=}10\) this difference is not statistically significant: a Fisher exact test on \(3/10\) vs.\(6/10\) gives \(p\approx0.37\), and pooling all scaffolded vs.unscaffolded cells (\(18/30\) vs.\(7/20\)) gives \(p\approx0.148\); the Wilson 95% CIs [50] overlap. We therefore read \(L_5\) as the layer with the largest observed difference in the balanced matrix — a directional result, not a fine ranking among the three scaffolded variants and not a significance claim. Establishing whether the bounded contract itself outperforms a matched accumulating-context design would require the controlled comparison we leave to future work (Limitations).

6.3 Auto-mode ascension ladder: endpoint evidence↩︎

Runs with postrun-active memory attempt \(A_6\)–\(A_8\), while no-postrun streams stop at \(A_2\)–\(A_4\) (Figure 5). The ladder therefore complements the fixed-\(A_0\) matrix: one stream isolates component lift at a fixed difficulty, and the other shows the highest difficulty reached when stores can be updated after runs.

6.4 Template skills, transfer, and episodes↩︎

Mode B without hand-authored skill prose. mode-b-frozen matches the hand-authored mode-a 60% \(A_0\) win estimate (score-diff CI \([-18.6,+24.8]\)): template-filled skills are competitive with the seed library inside the same skill interface.

Frozen skills are backbone-sensitive. Table 3 shows the same Gemini-trained full-frozen \(L_4{+}L_5\) stack transferred to two non-training backbones. The Gemini-trained stack lifts Qwen’s mean score (\(+84.5\%\)) but reduces DeepSeek’s (\(-18.1\%\)); Qwen and DeepSeek wins remain \(0/5\). Transfer is therefore an empirical property of the stack, not a premise.

3pt

\(L_4\) at \(A_0\) is saturated. mode-a (no \(L_4\)) and full-frozen (with \(L_4\)) produce the same win point estimate (score-diff CI \([-21.7,+14.9]\)); \(L_4\) still serves the longer-horizon substrate in the ladder streams (§6.3).

7 Comparison with Open-Source Accumulating-Context Agents↩︎

The submitted version compared against external calibration anchors only. Here we add a direct, same-testbed operational comparison against the two open-source StS2 agents that could be run faithfully end-to-end: STS2MCP [42] and CharTyr [45]. Both follow the dominant agent-loop design our contract argues against: a single accumulating chat transcript, re-sent (and grown) on every decision. We stress at the outset that this is a comparison of shipped systems, not a controlled ablation of the memory contract: the competitors differ from our agent in game patch, routing, thinking effort, decision batching, and prompt cadence as well as in the contract, so the gaps below characterize the current state of practice rather than isolating boundedness as the cause.

Faithful replication. Each competitor runs its author-intended configuration: the author’s own mod build (minimal load-compatibility patches only; zero agent-logic changes), the author’s own MCP server, and the author’s own skill/strategy documents as the system prompt, driven through their tool interface. A leak audit over the captured requests confirms no content from our project enters their context. Exactly one mod is loaded at a time, and every game is a fresh Silent \(A_0\) run on the same machine and the same v0.103.x line of the game: our cells ran on v0.103.1; a minor game patch (v0.103.3, 2026-05-30) landed between the two batches, so competitor runs used v0.103.3 (their mods compile against the v0.103.1-pinned reference and load cleanly on v0.103.3; our own stack re-verified on v0.103.3). All strategic decisions for every agent run on gemini-3.1-pro-preview; our agent additionally routes trivial decisions to a flash-lite fast tier and sets explicit thinking effort, while competitors run at the provider default with no thinking parameter (their intended setup). The denominator is completed games — harness failures are re-run, never counted as losses — and every run ended in a natural in-game terminal, none at the decision cap. All raw prompts, responses, token usage, and per-step game state are released (released with the data archive).

Effect. Figure 6 (a) shows run scores (\(s = 100\) if victory else \(\mathrm{floor} + (52/3)\cdot\mathrm{bosses}\), §3). Both accumulating agents collapse at \(A_0\): STS2MCP wins \(0/5\) (mean floor 17.6; one Act-1 boss cleared across five runs), CharTyr wins \(0/5\) (mean floor 5.6; its frequent invalid_action interface errors compound into early deaths — a property of the agent under test, faithfully reproduced¹). Our full-frozen cell wins \(6/10\) (mean score 82.1) and even baseline-strict — our harness with the bounded contract but no learned stores — wins \(3/10\) (70.4), so the gap is not explained by harness quality alone.

Speed and cost. Figure 6 (b,c) and Figures 7–8 quantify the operational gap. Per floor reached, the accumulating agents need \(\sim\)​4\(\times\) the wall clock (9.9 / 8.5 vs. minutes; 96% of their wall-clock is provider-reported LLM latency, so the gap is not harness pacing). Per score point, they spend \(66\)–\(90\times\) more fresh (non-cached) LLM tokens; under raw ingested context the multiplier exceeds \(450\times\), and even pricing every recorded action of ours as a full strategic call (an intentionally absurd upper bound) leaves \(\geq 7\times\). Part of this gap is decision batching — one strategic call drives multiple actions in our agent, while the competitors call the LLM once per action by design — which we report as a property of the memory-architecture package rather than of the backbone. Figure 7 shows the mechanism: their per-call prompt grows from \(\sim\)​9k to \(500\)k tokens within a single run (trimming caps message count, but late-game states grow each message), while the bounded contract holds the strategic user message flat at a \(\sim\)​5k median.

What this comparison does and does not show. It does not show that accumulating context can never win StS2 — both competitors are community projects, not tuned baselines, and CharTyr’s losses are partly interface errors. It does show that the two publicly available transcript-accumulating agents, run faithfully on the same backbone, game line, character, and ascension, with the denominator rules of our own evaluation, fall far below even our no-store bounded baseline while consuming one to two orders of magnitude more tokens per point of progress. A matched same-codebase accumulating-context cell would isolate the contract variable itself; we leave that controlled comparison to follow-up work, and this release is organized to support it. The present section establishes the external state of practice under disclosed operational differences.

8 Discussion↩︎

Interpretation and scope. The main lesson is that the memory interface can be made into an object of evaluation rather than left as a prompting convention. In a closed-rule game with text-readable state, the bounded typed contract supports fixed-\(A_0\) wins, locates the largest within-harness difference at the \(L_5\) skill layer (directional at our sample size), and keeps fixed-difficulty performance separate from ladder endpoints. The release is meant to make the next comparison easier: an accumulating-context variant can be added in the same codebase, with the same condition tags, frozen stores, prompt records, and scoring scripts, rather than inferred from public runs that use different harnesses.

Implications. Two observations suggest broader applicability. First, separating memory into typed slots makes attribution tractable: gains can be traced to a specific layer rather than to “more context.” Second, the bounded contract decouples interface design from accumulating state, making the same evaluation surface portable to non-game agentic tasks with comparable closed-rule structure.

Implications for loop engineering. The bounded contract is a concrete, measurable design point for the memory stage of closed-rule, turn-based agent loops: per-decision typed retrieval keeps the online context bounded regardless of run length, typed stores make memory updates auditable, and postrun writes expose learning as explicit artifacts rather than opaque transcript growth. Whether this pattern is the right default for open-ended production loops is untested here; what we provide is a reproducible testbed and archive for measuring a memory-layer change under fixed game, denominators, and scoring—an empirical complement to the largely qualitative loop-engineering guidance now common in practice [12], [13].

9 Conclusion↩︎

We present a long-horizon LLM-agent resource where memory is bounded, typed, and ablatable at decision time. In the fixed-\(A_0\) matrix the largest observed difference appears when triggered \(L_5\) skills are enabled, though at this sample size it is directional rather than statistically decisive; the \(298\)-trajectory archive supplies logs, frozen stores, prompts, and scripts. By keeping game, denominators, stores, and prompts aligned, the release lets future work ask whether a new memory interface changes decisions rather than whether it benefited from a different evaluation scaffold. Our evidence supports a narrower conclusion: explicit, typed memory contracts make long-horizon agent behavior easier to audit, reproduce, and ablate. Whether a bounded contract outperforms a matched accumulating-context design remains an open question for a controlled follow-up.

Limitations↩︎

Sample size and statistical inference. The headline fixed-\(A_0\) result uses a balanced 50-game subset, which is at or above the per-condition sample size typical for recent LLM-agent game benchmarks [4], [32], [33]. The cross-backbone and ladder streams are smaller diagnostic streams, reported separately rather than pooled into the headline table. Wilson intervals at this sample size are read at the scaffolded-versus-unscaffolded level; finer-grained equivalence tests among scaffolded variants and smooth backbone-transfer curves are natural extensions that the released archive supports.

Same-codebase accumulating-context variant. The release is organized so that an accumulating-context cell sharing our codebase, condition tags, scoring scripts, and frozen stores can be added as one further row in the same matrix. This is the cleanest direct comparison to the bounded contract, and the artifact provides the run protocol, prompt records, and analysis scripts needed to run it.

Single character and game-version coverage. The headline runs target one playable character, Silent, chosen to keep the typed substrate (\(L_3\) enumerable game knowledge, \(L_4{+}L_5\) stores) self-consistent in the present submission. Released trajectories carry game-version tags so that version-stratified re-analysis is possible from the archive, and cross-character runs follow the same harness once \(L_3/L_4/L_5\) are repopulated for the new character.

External player and ecosystem references. Mega Crit, Spiracle, and AGI-Eval enter the paper only as difficulty and ecosystem context, with cached snapshots released alongside the artifact. Matched human inference would require a separately designed user study with controlled denominators, which is outside the present resource.

Architectural scope. The evaluation is training-free and single-game. The bounded contract is tuned for turn-based decision settings like Slay the Spire 2; continuous or streaming control loops, visual input, multi-agent play, online human correction, model-internal fine-tuning, and cross-game transfer are deliberate non-targets of this release. Stub templates and expert seed skills are author-curated; Mode B measures within-interface template filling, which we report as one operating point rather than as fully autonomous skill invention.

10 Evaluation archive and aggregation rule↩︎

The archive is organized so that each reported win rate can be recomputed from completed-run records. It includes one record per trajectory, the condition tags used to select cells, frozen \(L_4{+}L_5\) snapshots for the within-codebase ablation, representative decision-time and postrun prompt records, and scripts for Wilson 95% win-rate intervals and bootstrap 95% score intervals. A cell’s win rate is simply victories divided by completed games in that cell. We keep the fixed-\(A_0\), cross-backbone, ladder, and full-archive streams separate. Table 4 gives the denominator rule for each stream.

4pt

Score-formula audit. The derived score (Eq. 1 ) uses \(\mathrm{bosses}=0\) when floor \(<18\), \(1\) when floor \(<34\), \(2\) otherwise, and \(3\) for victories. Table 5 lets readers reproduce the paper-reported means.

Confidence intervals. For a cell with \(w\) wins out of \(n\) completed runs, the Wilson 95% interval [50] on the win rate \(\hat{p} = w/n\) is \[\frac{\hat{p} + \tfrac{z^2}{2n} \pm z\sqrt{\tfrac{\hat{p}(1-\hat{p})}{n} + \tfrac{z^2}{4n^2}}}{1 + z^2/n}, \quad z=1.96. \label{eq:wilson}\tag{4}\] Score intervals use the percentile bootstrap [51]: 5,000 resamples with replacement from the cell’s \(n\) run-level scores, reporting the empirical \([2.5,97.5]\) percentiles. The descriptive pooled scaffolded row uses an exact Clopper–Pearson interval and is labeled as such.

4pt

11 Memory contract: five typed layers↩︎

Table 6 gives a compact legend for the five stores used in the paper. The useful distinction is mutability: \(L_1\) and \(L_2\) are fixed, \(L_3\) can be filtered, and \(L_4/L_5\) can be disabled, frozen, or made writable depending on the evidence stream.

4pt

12 Concrete prompt and learning examples↩︎

Decision-time composed prompt. At decision time, the agent assembles the user prompt in a fixed typed order: fired \(L_5\) skills, \(L_4\) episodes, \(L_3\) game facts, the \(L_2\) typed state prompt, and a schema hint listing valid actions. The order is shared across non-combat decision states. Combat is the only intra-fight stateful container, and its emitted message list per round is bounded to three items: combat start, an acknowledgement, and the latest user state. Earlier rounds are not copied into the transcript; the next round is prompted from a newly composed user message. A shortened floor-7 card-reward excerpt shows the typed layers:

## Expert Knowledge (retrieved skills)
**Silent - Draft and Shop Rules** (seed)
Early rewards must solve damage first,
then block, draw, and energy. ...

## Card-Specific Insights
- dodge and roll: delayed block plus Dexterity.
- slice: 0-cost transitional damage.

## Game Knowledge / Card Mechanics
- DodgeAndRoll: Block Next Turn; upgrade +2.
- Slice: Upgrade: Damage +3

## Card Reward
HP: 57/57 (100
## Decision Format (card_reward_action)
Valid actions: choose_reward_card
or choose_reward_alternative

Representative learned skill. One learned skill concerns a boss mechanic that exhausts attacks and skills on specific turns (turns 2, 5, 8, and 11). The stored rule instructs the agent to preserve core scaling cards on those turns and to prefer powers or natively exhausting cards. The example shows that \(L_5\) stores state-conditioned tactical rules with Boolean triggers, not generic advice or similarity-retrieved raw logs. Full prompt and learned-skill records are included in the artifact archive.

13 External calibration and source boundaries↩︎

External Slay the Spire 2 statistics enter the paper as difficulty and ecosystem context. Cached snapshots of each source are released with the artifact archive so that follow-up work can reproduce the calibration rows under identical inputs.

4pt

14 Full decision-time prompt exhibits↩︎

The exhibits below print the model-facing prompt assembled from the typed substrates. Text inside each box is verbatim system or user prompt content; the box colors and titles are reader annotations for \(L_1\) protocol/schema, \(L_2\) current state and action space, \(L_3\) rules and mechanics, \(L_4\) episodic notes, and \(L_5\) strategic skills.

14.1 Combat decision↩︎

The combat exhibit is the longest example: it includes the shared system instruction, setup context, retrieved skills, episodic notes, game rules, and the current round state.

System prompt.

\(\blacksquare\) \(L_1\) — Role

\(\blacksquare\) \(L_1\) — Output schema

\(\blacksquare\) \(L_3\) — Combat rules

\(\blacksquare\) \(L_5\) — HP policy

User prompt: setup and retrieved context.

\(\blacksquare\) \(L_2\) — Combat start

\(\blacksquare\) \(L_2\) — Deck

\(\blacksquare\) \(L_2\) — Relics

\(\blacksquare\) \(L_4\) — Strategic thread

\(\blacksquare\) \(L_5\) — Retrieved skills

\(\blacksquare\) \(L_4\) — Past experience

\(\blacksquare\) \(L_4\) — Past experience

\(\blacksquare\) \(L_4\) — Combat guide

\(\blacksquare\) \(L_2\) — Enemy patterns

\(\blacksquare\) \(L_5\) — Potion strategy

\(\blacksquare\) \(L_4\) — Card notes

\(\blacksquare\) \(L_3\) — Rules

User prompt: current combat state.

\(\blacksquare\) \(L_2\) — Round state

\(\blacksquare\) \(L_2\) — Enemies

\(\blacksquare\) \(L_2\) — Relic counters

\(\blacksquare\) \(L_2\) — Potions

\(\blacksquare\) \(L_2\) — Piles

\(\blacksquare\) \(L_3\) — Active effects

\(\blacksquare\) \(L_2\) — Hand

Structured response. The model returned a structured combat plan: use Powdered Demise, play Neutralize+, Mind Blast, Backflip+, Infinite Blades, Survivor, and then end the turn.

14.2 Shop-planning decision↩︎

The shop exhibit shows the same interface outside combat. To avoid printing the shared role and generic JSON schema twice, it includes only the shop-specific system additions and the shop user prompt.

Shop-specific system prompt.

\(\blacksquare\) \(L_5\) — Deck philosophy

\(\blacksquare\) \(L_5\) — Two-phase framework

\(\blacksquare\) \(L_5\) — Phase 1

\(\blacksquare\) \(L_5\) — Phase 2

\(\blacksquare\) \(L_1\) — Note schema

User prompt.

\(\blacksquare\) \(L_5\) — Retrieved skills

\(\blacksquare\) \(L_4\) — Deck insights

\(\blacksquare\) \(L_4\) — Card insights

\(\blacksquare\) \(L_3\) — Game knowledge

\(\blacksquare\) \(L_3\) — Card mechanics

\(\blacksquare\) \(L_2\) — Shop state

\(\blacksquare\) \(L_2\) — Deck

\(\blacksquare\) \(L_2\) — Relics

\(\blacksquare\) \(L_4\) — Relic synergies

\(\blacksquare\) \(L_4\) — Gold budget

\(\blacksquare\) \(L_5\) — Shop guide

\(\blacksquare\) \(L_4\) — Card notes

\(\blacksquare\) \(L_1\) — Task

\(\blacksquare\) \(L_3\) — Keywords

\(\blacksquare\) \(L_2\) — Items

\(\blacksquare\) \(L_1\) — Shop-plan schema

Structured response. The model returned a shop plan that buys Blade Dance, Leg Sweep, Mind Blast, and Swift Potion, while skipping the remaining affordable items with item-level reasons.

References↩︎