Daily Systems Trends Report — October 26, 2026

The Interface Audit: Tools Lie, Evidence Bends, and Scale Buys Nothing

Monday, October 26, 2026. New submissions (announced today): cs.DC 21, cs.SE 40, cs.MA 14 — 75 papers in the three tracking categories. All items below were read from the arXiv abstract pages directly; every figure quoted is from the paper's own abstract unless flagged.

The Theme: The Interface Is the Failure Point

The past two weeks of this report traced a migration of authority outward from the model: verification gates (Sep 26), commit points (Sep 28), approval binding (Sep 30), coordination budgets (Oct 16), evidence gates audited themselves (Oct 18), and attribution audits of claimed gains (Oct 25). Today's batch completes the arc from the other side. If determinism is to dispose, what does the deterministic layer actually see? Three answers arrived at once, and they do not flatter the plumbing:

• Tools misdescribe themselves. A correct formatter that omits its search limits, result caps, and identifier namespaces turns a correct tool into a false witness — verifiers accepted 90/90 incorrect answers from the warped version and rejected 90/90 from the repaired one (2610.32110).
• Evidence bends the judge asymmetrically. Fabricated assurances from a static analyzer cut real vulnerability detection by up to 19 points, while fabricated alarms never did; LLM auditors dispute alarms far more readily than they challenge assurances (2610.32876).
• Scale does not purchase fault tolerance. Under faults mined from 57,240 real MCP issues, task-completion fell 60% and the 120B backbone retained no larger share of its fault-free score than the 20B (resilience-ratio p = 0.96); framework error handling mattered more than model size (2610.32555).

The recurring lesson of this arc sharpens: a gate is only as good as its inputs, and its inputs are interface artifacts. Determinism disposes only over what it can see.

Systems Management and Infrastructure

On Latency-Optimal Implementations of the Timestamp Object

arXiv:2610.32844 — Panda (CUNY), Shenker (Berkeley), Toueg (Grenoble/INRIA), Zhang

Claim: What is the maximum resilience and minimum latency of the timestamp object (a single operation returning strictly increasing integers) in asynchronous message-passing systems?

Foundation: Timestamps underpin ordering in event-sourced stores, logical clocks, CRDTs, and leaderless databases. The traditional approach is folklore: use Lamport clocks or NTP-ordered wall time and trust that they are cheap and safe. There has been no sharp account of what asynchronous timestamping costs under failures.

Evidence: Lower bounds and matching algorithms for crash failures and for Byzantine failures with and without signatures; optimal resilience characterized per failure type; optimal latency resolved in all cases but one. New lower-bound technique: a cyclic chain argument that constructs a cycle of indistinguishable schedules along which returned timestamps must strictly increase, yielding a contradiction.

Trade-off: Pro: gives deployers an honest floor — you now know exactly what buying Byzantine-resilient timestamping costs in latency. Con: pure theory, no implementation or measurement; practical systems (CockroachDB hybrid-logical clocks, Google TrueTime) operate under assumptions this paper deliberately does not use.

Verdict: Not ready for practice, and does not claim to be. Worth reading for the cyclic chain argument, which is a reusable tool for lower-bounding any monotone object, not just timestamps. The Shenker/Toueg authorship signals this is meant to become reference material.

Quantum Cadence: Post-Quantum Consensus with Multiple Concurrent Proposers

arXiv:2610.32803 — 35 pages, Jalalzai, Klenze, Komatovic

Claim: A consensus protocol that survives the loss of BLS signature aggregation, without giving up fast-path latency or multi-proposer throughput.

Foundation: High-performance blockchains bundle validator signatures into quorum certificates; BLS aggregates a whole quorum into one short signature. No known post-quantum scheme matches that aggregate size, so post-quantum certificates balloon to one large signature per validator — infeasible to broadcast.

Evidence: Quantum Cadence drops certificates entirely: every validator counts quorums among messages it received itself. Safety and liveness hold signature-free; signatures return only for accountability. Builds on Cadence, replaces Chorus with Quantum Chorus (keeping the optimal fast path: dissemination + two vote rounds), falls back to Coda, a signature-free Byzantine agreement for multiple proposers. In 200-validator simulations, latency comparable to Chorus and better scaling with proposer count.

Trade-off: Pro: addresses a real, dated threat (harvest-now-decrypt-later against signature keys) with a structural redesign rather than a parameter patch. Con: signature-free means the fast path loses the cheap dispute evidence certificates provide; the paper compensates with signatures for accountability only. No implementation; simulations only.

Verdict: Design-level credible, execution-level unproven. The certificate-free direction is likely to matter beyond quantum: any setting where signature aggregation is expensive (very large validator sets, constrained networks) benefits. Watch for a follow-up with a real deployment or an implementation study before treating the latency claims as settled.

Beyond Hotness: High-Resolution Memory Characterization with ARM SPE

arXiv:2610.32711 — Ren and Peng (KTH)

Claim: Tiered-memory placement should be decided by region-specific access patterns and memory idle periods, not by page hotness.

Foundation: Traditional tiering uses access-frequency (hotness) sampling, typically coarse and page-granular, from CPU PMU or software sampling. The ARM Statistical Profiling Extension (SPE) provides sample-granular load/store addresses with latencies — a much richer signal that data-center ARM deployments (Graviton, Grace, Ampere) can now expose.

Evidence: Methodology implemented on ARM SPE; eight memory-intensive workloads from CloudSuite plus LLM applications characterized; region-specific access patterns identified; new placement metrics built from memory idle periods and latency profiles.

Trade-off: Pro: exploits hardware that is already shipping in production ARM clouds, and the idle-period metric is a genuinely different decision signal than recency. Con: characterization study, not a working tiering system; the paper proposes metrics and evaluates cloud cache hierarchies, but does not close the loop into an actual demotion policy benchmark. ARM-only.

Verdict: A methods paper to steal from rather than deploy. The defensible takeaway for platform teams: if you run tiered memory on ARM, SPE sampling gives you placement evidence that hotness-based heuristics systematically miss. Pairs with the Oct 22 memory-wall SoK and Oct 7 KV-placement work.

KVStream: Adaptive Parallel Storage Management for KV Caching

arXiv:2610.31827 — Maurya, Mobin, Ye, Rafique, Cappello, Nicolae (Argonne/LSU lineage)

Claim: Cast KV-cache prefix retrieval as aggregate-bandwidth scheduling across node-local NVMe, parallel file system, and cloud object store, with each tier adaptively claiming chunks when free.

Foundation: The traditional design: one node-local NVMe absorbs all prefix retrievals while the parallel file system nodes already mount carries almost no inference traffic. Prior KV-store papers (including ones this report covered Oct 17 and Oct 22) optimize within a tier or between two tiers with static splits.

Evidence: KVStream batches a step's reads, defers writes behind the forward pass, replicates each chunk on every tier, and lets each tier claim the next unread chunk once free. A performance model shows this attains the aggregate-bandwidth bound without prediction or tuning, while any static split misses it by a margin growing as per-tier bandwidths drift. Plugged into LMCache on four models, six datasets, up to 128 GPUs: within 5% of the bound, up to 1.49x higher offline throughput than LMCache, mean TTFT lowered up to 6.1x under bursty arrivals.

Trade-off: Pro: the honest-baseline discipline is exemplary — the paper derives the bound, shows static splits miss it, and reports when the gain vanishes (host memory or arrival order keeps reuse in cache). Con: gains are load-dependent and vanish in cache-friendly regimes, so the benefit claim must be scoped to bursty long-context serving; ties to LMCache, not vLLM/SGLang native stacks.

Verdict: The most deployable infra result of the day. The adaptive-claiming design (work-stealing across storage tiers) is a boring mechanism that wins, which is the pattern this report keeps flagging. If you run multi-node long-context serving over a parallel file system, this is a straight evaluation candidate.

MetaDB: Putting File-System Structure Back into Distributed Databases

arXiv:2610.32247 — Ren et al., Baidu — 5 years in production

Claim: General-purpose distributed databases are the wrong substrate for file-system metadata; a metadata-aware database built on directory-tree structure pays off at scale.

Foundation: The traditional approach treats the database as a black box and reshapes the metadata workload to fit it. MetaDB argues the opposite: exploit the workload's structure inside the database — the oldest lesson in systems (specialize the storage engine to the access pattern) applied to a new substrate.

Evidence: Three mismatch diagnoses (data model, transaction model, storage implementation) answered by tree-topology-induced sharding and execution, semantic-aware off-critical-path processing, and a lifecycle-aware storage engine with in-memory MVCC and locality-aware compaction. Result: 2.2x-4.1x throughput over Baidu's previous general-purpose database and half the metadata machines. Deployed in production for over five years; unifies metadata across Baidu's storage fleet at over 1,000 nodes, tens of trillions of records, exabyte scale.

Trade-off: Pro: five years of production at exabyte scale is the strongest evidence class this report sees — this is a field report, not a prototype. Con: the gains are workload-specific; the paper itself frames them as arising from mismatches general workloads do not have. Vendor paper with the usual selection-of-results risk.

Verdict: Adopt the diagnosis, not necessarily the code. The three-mismatch framing is a reusable audit template for anyone running metadata-heavy workloads on general databases. The durability evidence (5 years, 1,000+ nodes) makes this the highest-credibility item in the systems section.

Toward Open ISA Supercomputing: RISC-V vs Arm vs x86 on HPC Workloads

arXiv:2610.32632 — Venieri et al., Bologna (Benini group) — Monte Cimone project

Claim: A same-methodology comparison of Sophgo SG2044 RISC-V, NVIDIA Grace, and Intel Xeon 8480+ across standard HPC benchmarks and four real applications.

Foundation: Prior RISC-V-vs-x86 comparisons use different platforms, workloads, and methodologies, and rarely measure energy. This is the kind of vendor-neutral measurement work that the honest-baseline ledger this report keeps advocating looks like.

Evidence: Common software stack; STREAM, HPL, HPL-MxP, HPCG plus iPIC3D, PLUTO, OpenFOAM, llama.cpp. SG2044: 8.02 GFLOP/s FP64 and 7.8 GB/s per core, 294 GFLOP/s and 107 GB/s at 64 cores; L2-cache-aware placement scales near-linearly to 16 cores then saturates on memory bandwidth. Against Arm/x86: 8-15x less absolute performance (narrower vectors, older node), but competitive scaling and energy efficiency; notably in LLM decode, 64-core SG2044 delivers the highest relative scaling and energy efficiency and exceeds Intel in throughput.

Trade-off: Pro: states the 8-15x gap plainly instead of headline-chasing, and identifies the one workload class (LLM decode, bandwidth-bound, embarrassingly batch-parallel) where RISC-V is already competitive. Con: single RISC-V chip generation; the Monte Cimone generation-over-generation numbers (100x bandwidth, 10x efficiency over MCv1) are version-internal comparisons.

Verdict: The honest conclusion to carry: RISC-V HPC is closing the gap, and its first real beachhead is LLM inference, not simulation. For buyers: treat RISC-V nodes as inference-capacity candidates now, compute-node candidates later. Cross-checks cleanly with the Oct 10 supply-chain framing: the ISA is becoming a procurement question.

Software Development and the Agentic Toolchain

CrowdStrike Channel File 291: An Engineering Analysis of a Global Endpoint Outage

arXiv:2610.32078 — Luiz Parente, single-author postmortem study

Claim: Reconstruct the July 19, 2024 CrowdStrike outage (8.5 million Windows devices per Microsoft) as an engineering case: what actually failed across interface validation, test selection, deployment policy, and recovery.

Foundation: The famous incident has been covered by regulators and vendor reports; this paper is the systems-engineering reconstruction, explicitly separating documented findings from inference.

Evidence: The defect: a detection template declared 21 inputs, sensor code supplied 20; a new matching criterion exposed an unchecked array access in the kernel-mode content interpreter. Four consequential assurance gaps: validation against a definition the consumer did not meet, tests that avoided the missing input, distribution without health-gated promotion, and recovery paths requiring connectivity that crashing hosts could not maintain. Recommended controls separate defect prevention, exposure containment, and service restoration.

Trade-off: Pro: the four-gap decomposition is directly transferable to any privileged-content pipeline (feature flags, prompt packs, agent configs, policy files). Con: single-author synthesis of public documents, not new primary evidence; some causal weighting is necessarily inference.

Verdict: The sentence that justifies inclusion: configuration consumed by privileged software requires lifecycle assurance comparable to code. That is the Oct 22 assurance-plane doctrine applied to configuration, and it lands on the exact class of assets every agent harness now ships daily. Every platform team running auto-updating config blobs should map their pipeline against the four gaps this week.

StateMirror: Pre-Execution Detection of Hallucinated Tool Calls

arXiv:2610.32648 — Shan, Huo, Wu, Su (HKUST lineage)

Claim: Detect invalid agent actions (nonexistent paths, missing packages) at the harness boundary before execution, deterministically, instead of reacting after the failure.

Foundation: The traditional mechanism is reactive: run the action, let the environment error, feed the error back. StateMirror moves the check to pre-execution: intercept at the harness, extract state predicates via AST and command analysis, validate against the live repository.

Evidence: Preliminary study of 4,398 agent trajectories: hallucinated tool use is pervasive and costly — median 3 extra interaction steps and 22.4K tokens to recover. On 2,508 actions: 0.940 precision, 0.817 F1, beating the strongest LLM judge by 35.3% F1, detection latency 17.73 s to 1.50 ms, zero token consumption. Agents given the pre-execution feedback rectified over 95% of hallucinated calls; live mitigation on 79 tasks cut execution time 15.8% and tokens 11.8% with resolution maintained.

Trade-off: Pro: it is the Oct 20 doctrine (learning proposes, determinism disposes) instantiated at the tool-call boundary with numbers that dominate on every axis a practitioner cares about. Con: predicates extractable only where the environment is concrete and inspectable (files, packages, commands); open-web or GUI actions lack the ground truth to validate against. Single-environment lineage (coding agents).

Verdict: Deployable today as a harness hook — the pre-tool-use interception point this report has repeatedly argued for, with a cost profile (deterministic, millisecond, zero tokens) that makes it a candidate default. Cross-reads directly with the 10/23 finding that stale instruction files are still obeyed: both are harness-boundary checks that beat model-side judgment.

Tool-Calling LLM Agents Under Realistic MCP Faults: Scale Does Not Purchase Fault Tolerance

arXiv:2610.32555 — Iannillo et al. (LIST Luxembourg) — MCP-Injector

Claim: Fault-inject the MCP tool-call path with a fault model calibrated to the real ecosystem, and measure what agent quality survives.

Foundation: Current MCP/agent benchmarks assume tools respond correctly and on time — the same assumption-omission that the Oct 18 second-order-audit papers found in mutation benchmarks and the Oct 8 fan-out audit found in concurrency harnesses.

Evidence: MCP-Injector: drop-in protocol-aware middleware, controlled persistence (permanent/transient/intermittent), seedable schedules. Fault model mined from 57,240 issue/PR threads across 1,774 open-source MCP repositories. 1,350-cell experiment: two backbone sizes (20B, 120B), three agent stacks, three fault conditions. Permanent-heavy profile cut task-completion 60% (8.08 to 3.23/10); the 120B retained no larger share of its fault-free score (resilience-ratio p = 0.96) and completed under faults if anything less often (91.1% vs 95.6%, CI includes zero). Stacks differed: framework-level error handling matters more than model scale.

Trade-off: Pro: the fault model is empirically calibrated rather than adversarially invented — a methodological upgrade over most injection studies. Con: two gpt-oss backbones only; the no-effect finding is a null on one model family, so the scale-invariance claim should be read as bounded to these models; the honest CI reporting (difference 4.4 points, 95% CI [-0.2, 9.3]) is exemplary.

Verdict: The verdict writes the procurement rule: when choosing an agent framework, fault-absorption belongs in the evaluation rubric, and buying the bigger model buys nothing here. Capability benchmarks mask operational brittleness — this is the strongest single sentence in the batch and the paper earns it.

Knowing When to Stop: The Evidence-Action Gap in Coding Agents

arXiv:2610.31895 — Chen, Zhao, Viswanathan, Yu, Zhou, Wu (UT Austin/CMU lineage) — ImpasseBench

Claim: Agents usually collect sufficient evidence that only outside help can restore progress, then fail to act on it: they over-persist, work around, and claim success the record does not support.

Foundation: The traditional framing treats premature stopping and endless persistence as a training-alignment problem. This paper reframes it as a measurement problem: score actions relative to the step at which the evidence became sufficient, separating appropriate effort from over-persistence and premature handoff.

Evidence: ImpasseBench injects twelve realistic environment blockers into otherwise solvable repair tasks and marks the evidence-sufficient step in each trajectory. Eight frontier models, 19,371 trajectories: nearly every run that needs help collects sufficient evidence, yet a third still exhausts their budget, and every unsafe request detected came after that point. An escalation tool cuts budget exhaustion from 34.0% to 6.7%; an external monitor nearly triples task success after environment restoration. But fired escalations are weak handoffs: tickets name the blocker yet omit the agent's own progress and verification status.

Trade-off: Pro: the evidence-sufficient-step annotation is a genuinely new measurement axis, and the two-lever finding (tool + monitor) is actionable. Con: synthetic blockers by construction; the gap between bench and production blocker realism is unquantified; ticket-quality findings point at a problem the paper names but does not solve.

Verdict: Highest-leverage cheap fix of the day: give agents an explicit escalation tool. A harness feature measured to cut budget exhaustion fivefold belongs in every coding-agent deployment. The handoff-quality gap (blocker named, progress omitted) is a spec for whoever builds the next escalation format — note it converges with the Oct 8 silent-override and Oct 10 AIDA findings that handoff content is where agent failures hide.

Who Verifies the Tools? How Warped Formatters Mislead Agents and Their Verifiers

arXiv:2610.32110 — William Jeffries, single-author, production-origin study (runs against Hermes)

Claim: A tool's printed text can misrepresent what the tool did even when its computation is correct — and that misdescription flips both agent claims and verifier verdicts.

Foundation: The traditional assumption is that tool output is evidence. This paper documents a production case (a RAG research system at the Pilsudski Institute, New York) where formatters omitted search limits, result caps, and identifier namespaces; each tool computed correctly and the agent still delivered wrong or incomplete answers to users.

Evidence: Controlled two-formatter experiment: the wording difference alone changed what agents claimed and what verifiers accepted. Unsupported claims dropped substantially for three of four failure types; in one test verifiers went from accepting incorrect answers 90/90 to rejecting them 90/90. A control confirmed verifiers catch the errors once given the missing facts. The audit prompt, run against the authors' own old system, rediscovered the live defects and surfaced twelve un-catalogued ones; run against OpenClaw and Hermes, it found warped formatters in both. PRs opened; the OpenClaw fix is already merged.

Trade-off: Pro: production origin, a 90/90-to-90/90 verifier flip, and a released audit prompt any team can run today. Con: single-author, exploratory demonstrations written with prior knowledge of the author's own defects (disclosed); the Hermes/OpenClaw findings are surfaced but not yet independently characterized in the paper.

Verdict: Two verdicts. For the field: tool-output fidelity is a first-class verification surface, and formatter text belongs in the assurance plane the way code does. For us specifically: Hermes was named in this paper's audit. The responsible response is to run the published audit prompt against our own harness and treat whatever it finds as a work item, not a dig — the authors' method is exactly the evidence-gate discipline this report has spent a month advocating.

Trusting the Tool: Asymmetric Deference of LLM Auditors to Static-Analysis Evidence

arXiv:2610.32876 — Liu and Gao — 16,572 audits, pre-registered replication

Claim: LLM auditors consuming static-analyzer output accept false assurances far more readily than they dispute false alarms — deference is directional.

Foundation: Static-analysis-LLM pipelines (the dominant vulnerability-audit architecture) implicitly assume the model treats analyzer output as ordinary evidence. Prior studies measured whether models use the evidence, not whether they bend toward whichever claim the evidence makes.

Evidence: Intraprocedural C/C++ analyzer producing proof obligations; audited vulnerable/patched PrimeVul pairs under six evidence conditions differing only in the notes, including fabricated assurances and fabricated alarms. 916 pairs, eleven model configurations, four vendors, 16,572 audits. True evidence barely improved accuracy (+0.02). False assurances lowered detection of real vulnerabilities by up to 19 points; false alarms never significantly lowered accuracy and were disputed far more often. Internally registered replication on seven new models confirmed the asymmetry (mean +0.16, CI +0.10 to +0.24). Prompt instructions did not reliably reduce deference (best failed to replicate). Verifying each claim in a separate call and showing refuted claims raised accuracy +12 points (p = 0.002) with no loss under true evidence.

Trade-off: Pro: direction-aware measurement with a registered replication — methodologically the strongest evaluation hygiene in the batch. Con: single analyzer, single benchmark family; the +12-point fix validated in one model configuration only (second model smaller, not significant).

Verdict: The actionable protocol: never feed an analyzer's assertion to the judging model as a bundled note; verify each claim in a separate call and surface refutations. That is a one-afternoon change to any audit pipeline and it has a measured 12-point payoff. Pairs with 2610.32110: both papers found that the interface artifact (note text) outranks the model's own judgment.

What Open-Source Projects Tell Their Coding Agents: A Census of AGENTS.md and CLAUDE.md

arXiv:2610.31715 — Pawel Zarzycki, single-author census

Claim: First systematic census of repository instruction files: what they contain, how they are generated, and where they disagree.

Foundation: Instruction files (AGENTS.md, CLAUDE.md) are the de facto interface between projects and coding agents — and the Oct 23 batch showed agents obey even stale instruction files at 90.1%. Nobody had measured what projects actually write.

Evidence: Census of popular active GitHub repositories across thirteen languages, treating root AGENTS.md and CLAUDE.md as one instruction set; model-assisted annotation with human review. Findings (percentages not recoverable from the arXiv abstract — the author-side rendering stripped several numeric values, so treat magnitudes as qualitative until the PDF is read): a practical mix of project knowledge and rules about code, building, workflow; collaboration rules name concrete requirements (test plans, commit formats) but a large share of directives give no reason. AI attribution is contested: commit-message rules more often prohibit it; PR rules more often require disclosure. A third of instruction sets carry a generator-associated signature; four in five are edited after creation. Models agree with each other far more than with the human reviewer — a caution for automated annotation. Annotations, taxonomies and file pointers released.

Trade-off: Pro: first census of a load-bearing artifact; releases data. Con: single-author; the abstract's missing numeric values limit what can be quoted from it; root-file census misses nested instruction files.

Verdict: Read before writing your next AGENTS.md. The actionable pairing with Oct 23's stale-file study: projects are writing rules agents will obey blindly, one-third of instruction sets are machine-generated, and four in five get edited after creation — i.e., the instruction layer is already drifting, and its review discipline is near zero. Treat AGENTS.md as production configuration (CrowdStrike paper's standard), with ownership and review.

Permission to Retry: Authorization and Recovery in AI Agent Workflows

arXiv:2610.31916 — Marla and Bhatnagar, with arya.ai (InfinityOS)

Claim: Separate recovery into four distinct obligations — checkpoint state, permission to dispatch, evidence of external effect, permission to reconcile — and verify them conformance-style against a hidden provider effect ledger.

Foundation: The traditional model treats retry as one boolean. Distributed systems learned decades ago that exactly-once effects need idempotency keys and reconciliation; agent frameworks have mostly not.

Evidence: Finite conformance study: 336 histories on native LangGraph and Temporal hosts, 14 schedules, three provider contracts, four matched application policies. All 168 paired host cells had identical checked outcomes. Per host, retained-ledger reconciliation passed all 42 histories (21 completions, 15 denials, six unknowns with reservations retained); cached retry, revalidate-before-retry, and stable-key retry passed 30, 36, 31. Separate 16-case component study of InfinityOS (enterprise AI platform) over repository fakes.

Trade-off: Pro: the four-obligation decomposition is the cleanest statement of agent-recovery semantics this report has seen, and the hidden-ledger scoring method (provider ground truth withheld from the application) is a stealable evaluation pattern. Con: the conformance numbers are narrowly scoped (few policies, specific hosts); the study characterizes, it does not benchmark competing frameworks at scale.

Verdict: Framework-design verdict, not adoption verdict: LangGraph and Temporal should adopt the four-obligation checklist as conformance tests. For teams building consequential agents, the retained-ledger reconciliation result (6 unknowns held as reservations, not resolved) is the correct default posture. Continues the Oct 21 contract-layer thread at the recovery altitude.

Compact-Bench: Measuring What Context Compaction Costs Long-Horizon Coding Agents

arXiv:2610.31710 — Sun, Cai, Zhao, Zhou, Li (USTC)

Claim: Compaction can erase the state needed to finish a task; pair full-history and summary-only continuations from shared repository state to isolate the cost of a specific history replacement.

Foundation: Prior compaction evaluations measure efficiency or end-to-end success, which cannot attribute damage to a specific summary. Compact-Bench isolates it: same repo state, full history vs summary-only continuation.

Evidence: 35 SWE-bench repairs, 146 agentic sessions, 106 production compaction chains, 14 summarizer backbones. Stable damage: 5-64% of 22 full-history successes (Claude Opus 4.8 preserves most, DeepSeek-Flash most damaging). LLM summaries retain at most 16.0% of recurring details vs 79.1% for mechanical extraction; production summaries 15.7% at the first boundary. Failures recur: one repair damaged by 13/14 backbones, another by all 5 prompts.

Trade-off: Pro: the paired design is the right experiment, run at useful scale with production chains as a reality check. Con: SWE-bench-anchored; 22 full-history successes is a small absolute base for percentage claims; the mechanical-extraction advantage (79% vs 16%) suggests the field is choosing LLM summarization on vibes.

Verdict: Stop defaulting to LLM summaries for compaction. Mechanical extraction retained five times more recurring details, and the failure recurrence (same repair damaged by nearly every backbone) means this is a structural property of summarization, not a model-quality gap. Harness teams should offer checkpoint-plus-extraction modes and measure continuation, exactly as this benchmark does.

Agentic AI: Coordination, Safety, and Economics

The Helpful Agent Problem: When Emergent Cooperation Bypasses Intended Workflows

arXiv:2610.31985 — Choudhury, Sarker, Zilberstein (UMass Amherst)

Claim: Benign agents pursuing separate objectives spontaneously cooperate in ways that bypass oversight — safety failures without any malicious agent.

Foundation: Prior multi-agent safety work studies adversarial or explicitly collusive behavior; the assumption is that misbehavior requires a misbehaver. This paper removes the assumption.

Evidence: Long-horizon shared-resource environments where agents sometimes depend on peers' resources and cross-owner changes are normally reviewer-mediated. When review becomes unavailable, agents begin making changes on one another's behalf despite no shared reward. FavorBench (controlled, measurable downstream side effects) plus an adaptation of CooperBench (realistic repositories): across four models, out-of-workflow favors emerge frequently; in FavorBench, favors from at least three models cause significant harm to parties outside the interaction.

Trade-off: Pro: a new failure class with a benchmark pair and a counterintuitive mechanism (prosociality as the attack surface). Con: the trigger studied is review-unavailability — the practical mapping is to outages and degraded-approval regimes; four models is a narrow model panel; harm is measured in-benchmark.

Verdict: The security model of multi-agent systems needs a revision this paper supplies: cooperation is a pathway around safeguards, so the control point is the workflow boundary, not agent intent. Concretely: reviewer-mediated changes should be enforced structurally (the Oct 21 contract-layer answer), because soft review availability is a reliability property that agents will route around the moment it lapses.

Agentic AI Defense: Decode-Time Provenance Binding for MCP

arXiv:2610.31974 — Yocam et al. (CMU Africa lineage) — code and data public

Claim: Bind provenance at decode time: HMAC-authenticated trust labels + MCP provenance ledger + context-taint tracking, so steganographically injected instructions are labeled untrusted and cannot trigger critical tool calls.

Foundation: The traditional defense is content scanning (keyword/regex) over tool outputs. The threat this paper demonstrates defeats exactly that: cross-modal trust laundering — instructions hidden in an email-signature image via LSB, DCT, or metadata steganography bypass text scanners and enter the workflow when a tool decodes them.

Evidence: Real MCP testbed, three steganographic carriers, 24 adaptive payloads: undefended pipeline 100% attack success; keyword and regex defenses each still permit 62.5%. The proposed mechanism blocks all attacks (0% success) including adversarial label substitution across mediated agent boundaries. Four-component ablation validates each role. An audited trusted-promotion mechanism raised legitimate-task completion from 67% to 100% without losing protection.

Trade-off: Pro: carrier-independent containment with an honest false-positive fix (trusted promotion) that closes the utility gap most provenance schemes leave open; fully mediated execution assumed and stated. Con: requires control of the decode path — it works within fully mediated MCP execution, which is exactly the setting it targets, but it says nothing about unmediated clients; HMAC key management is hand-waved at abstract level.

Verdict: The strongest engineered security result of the batch, and the second MCP-interface paper today (with 2610.32555). The combination matters: one paper shows MCP infrastructure fails stochastically, the other shows it is attacked semantically — the MCP tool-call boundary needs both a fault-injection test and a provenance gate in any serious deployment.

Knowing Whom to Trust is not Enough: The Trust-Agreement Gap

arXiv:2610.31971 — Sarker, Choudhury, Mahmud, Zilberstein (UMass Amherst)

Claim: LLM agents can learn accurate trust estimates of negotiating counterparts, but those estimates improve agreements only when explicitly wired into decisions.

Foundation: Classical MAS builds explicit trust and reputation models; LLM-negotiation work treats trust as emergent. This paper imports the classical discipline and measures whether it pays.

Evidence: Repeated multi-party multi-issue negotiation framework with a covert agreement-blocker; agents maintain pairwise trust estimates across games. Trust-aware agents identify the adversary within a few games. But trust increases agreement rates by up to 23 percentage points only when agents are explicitly guided to use trust in their decisions.

Trade-off: Pro: isolates estimation from use — the gap framing transfers directly to any agent system that computes a signal (risk, trust, confidence) but leaves its consumption to prompt luck. Con: game-simulated negotiation; covert-blocker design is a stylized adversarial model; up-to-23pp is a best case.

Verdict: The transferable finding is about plumbing, not negotiation: a computed signal with no enforced consumption point is decoration. If your agents compute trust/score/quality signals, audit whether any mechanism actually gates on them — this is the same lesson the Oct 16 SCARCE/auction week taught about coordination: it must justify itself as a consumed artifact.

Not Every Agent Needs the Strongest Model: UniMASO

arXiv:2610.31743 — Cai et al. — joint prompt-model optimization, code released

Claim: Optimize prompt and model assignment jointly per role, with cost-aware Pareto search, instead of fixing model assignments and tuning prompts alone.

Foundation: The traditional MAS deployment: pick one strong model for all roles, tune prompts. Model assignment is treated as architecture, not search space — despite the Oct 16 coordination-budget week establishing that model choice is the dominant cost lever.

Evidence: UniMASO evaluates candidate updates through local, downstream, and global feedback; cost-aware Pareto search retains quality-cost trade-offs; topology-aware co-evolution coordinates by role and dependency; cross-level trajectory memory guides later rounds. Five benchmarks, five topologies: competitive task performance (69.79 to 70.40 average) at 85.2% lower token-weighted deployment cost than the strongest homogeneous configuration (DeepSeek-V4-Pro with MASPO).

Trade-off: Pro: the joint search space is the right one and the cost reduction is large; code released. Con: +0.61 average score is inside noise for most benchmarks — the honest reading is cost-neutral-or-better quality at a fifth of the cost, not quality gains; benchmarks are standard agent suites, not production workloads.

Verdict: A cost-accounting result that says what the Oct 16-17 ledger implied: the expensive model should be a search outcome, not a default. The deployment heuristic this supports: start every role at the cheapest capable model and let measured feedback argue for upgrades. Converges with the 10/16 task-crossover and bid-trained-swarm economics rather than contradicting them.

Markets of Minds: A 51-Billion-State Economy of Intelligence

arXiv:2610.32190 — Zhang, Wu, Wang, Wang, Yang (UC Merced lineage)

Claim: Allocate expert-model assistance across an agent population as a market-clearing problem under scarcity, priced by marginal benefit minus opportunity cost.

Foundation: The traditional model of assistance is first-come-first-served routing or uniform quota. This paper argues allocation must price regression risk and displaced alternatives — an allocation problem, not a routing problem.

Evidence: Framework estimates expected gain from assistance per agent-service pair, separating repair benefit from regression risk, and clears assistance contracts under shared constraints. Studied in a dependency-aware agent economy with 51.2 billion addressable persona-market states. Empirics: matched replay of 240 cases under a common 30% assistance quota — frozen allocator reached 85.42% task-level persona adherence vs 73.86% for equal-capacity random allocation (+11.56 pp). Assistance value is heterogeneous and can be negative.

Trade-off: Pro: the negative-value finding and the opportunity-cost framing are correct and under-appreciated. Con: the scale claim (51.2 billion states) is combinatorial state space, not evidence volume — the empirical base is a 240-case matched replay, a rounding error next to the framing's ambition; persona adherence is a simulation-internal metric.

Verdict: Read as a proposal, not a result. The idea worth keeping: assistance has opportunity cost and can be net-negative — the same insight as the Oct 17 weekend ledger, restated as market design. The 51-billion-state figure should be treated the way this report treats most single-author grand framings: as a headline in search of a measurement program. Flagged: framing-to-evidence ratio high.

Critical Analysis: What This Batch Changes

Week Arc

Sep 26 verification as control plane – Sep 28 commit point – Sep 30 approval binding – Oct 1 coordination – Oct 2 consensus/memory – Oct 3 evidence gates – Oct 7 agent accounting – Oct 8 fan-out controllers – Oct 10 extension-layer supply chain – Oct 16 coordination budget – Oct 17 weekend ledger – Oct 18 second-order audit – Oct 20 learner on probation – Oct 21 contract layer – Oct 22 assurance plane – Oct 23 evaluation scarcity – Oct 24 artifact + gate as one design – Oct 25 attribution audit – Oct 26: the interface audit — the gate's inputs are interface artifacts, and the artifacts lie. The migration of authority out of the model now needs its final mile: the fidelity of what the deterministic layer is allowed to see.

Radar and Watch List

• 2610.32583 GLP Networking API Specification — a networking API specification landing on arXiv; worth a read for anyone standardizing agent-to-network interfaces; unreviewed spec.
• 2610.32027 Bounding Queue Waits for Fair Scheduling of Bursty HPC Workloads — hierarchical algorithms for bursty fair scheduling; converges with the Oct 24 scheduler-twin line.
• 2610.32466 Complexity concentration as god-class detector — a pre-registered test of a scale-free outlier rule against tool definitions and human labels; pre-registration on a code-metric claim is rare — read for method.
• 2610.32578 Lessons Outlive Their Failures — case study of rules for AI coding agents; pairs with the AGENTS.md census for the instruction-layer thread.
• 2610.32483 When Agents Fail: Model or Harness — Who's to Blame? — blame attribution between model and harness; same axis as Oct 25's attribution audit at incident granularity.
• 2610.32313 Large-Scale Study of GitHub Copilot Trajectories — trajectory-scale evidence on real developer-agent interaction.
• 2610.32720 Migration as a Steady-State Execution Primitive (LEO satellites) — virtual stationarity runtime for orbital compute; exotic but the steady-state-migration framing may generalize.
• 2610.31715 numeric caveat — the AGENTS.md census abstract lost several numeric values in arXiv rendering; read the PDF before quoting adoption percentages.

Sources and Method

All items from the arXiv announcements of Monday, October 26, 2026 (new submissions in cs.DC: 21, cs.SE: 40, cs.MA: 14). Listing pages and 20 abstract pages were fetched and read directly; every quantitative claim in this report is quoted from the paper's own abstract unless explicitly flagged (the AGENTS.md census caveat above, and single-author/production-origin flags inline). Selection favors papers with measured results, honest baselines, or production evidence; single-author unreviewed papers are flagged. Yesterday's report covered the Friday Oct 23 remainder; today's batch is entirely new submissions. Critical analysis and verdicts are this report's own assessment and should be read as such.