Agents copy what their past choices look like: preregistered tests of goal erosion and a reason-tag defense in one portfolio task, with an in-context analogue

Companion papers. Ramdan 2026a, doi:10.5281/zenodo.23792010; Ramdan 2026b, doi:10.5281/zenodo.23792011. LLM agents act on transcripts of their own past actions. We ask what in such a transcript erodes a stated goal when no past action broke it. Tests. Nine sealed tests, whose hypotheses, contrasts and verdict rules were hashed before any data, and four pilots. Setting. One portfolio-management task, plus synthetic in-context rule learning. Models. Most tests use five open 7-8B instruction-tuned families: Qwen2.5, Qwen3, OLMo-2, Falcon3 and Granite. Two size ladders (Qwen3 0.6-32B and OLMo-2 1-32B) and Llama-3.1-8B-Instruct extend the set. Verdict rule. A hypothesis counts as confirmed when it passes in at least 4 of 5 models, or in at least 80% of the checkpoints on the ladders. Agents copy the look of their past choices. In sixteen past quarters, every option had the same emissions, and the agent's recorded pick was the fastest grower. Those picks were consistent with an emissions goal, but they look like growth-chasing. They lowered goal-consistent picks at a later conflict beyond unrelated steps (4 of 5 models) and beyond the same steps without the growth look (5 of 5). Steps without that look did not erode the goal (1 of 5). A parallel in in-context learning. Same-task examples that fit both candidate rules weakened the influence of a few diagnostic examples, by 0.5-2.8 nats (5 of 5 base and 5 of 5 instruction-tuned models). An ideal Bayesian with unknown label noise would move the other way. This resembles the human dilution effect. Reason tags help; a goal reminder does as well or better in most models. Attaching each past choice's actual reason raised later goal-consistent picks in 5 of 5 models (+0.04 to +0.45 in probability), and in 4 of 5 the reasons' content did the work. On fresh seeds the effect held in 4 of 5. The tags beat a plain goal reminder in 2 of 5 models. On the size ladders the reminder's lead grew with size, and from 13B up it won in every checkpoint. In a sealed decomposition, neither the explanation alone nor the goal's topic word alone reproduced the tags' effect. An attribution label did not reduce copying (inconclusive by rule). Labelling the agent's past picks as made by "a previous model, since replaced" did not reduce copying. Only three models were valid, two of them at the floor. Where the history sits matters in some models. Moving the same choices from the agent's own turns into a record log cut copying to near zero in Qwen3 and Falcon3, but not in OLMo-2 or Qwen2.5 (2 of 5; not confirmed). The log raised goal-following in all five models (confirmed), but a plain reminder did more in four. No tipping point in a closed loop (inconclusive by rule). We fed three agents their own sampled choices. Goal following did not collapse abruptly as harmless tie-breaks became more common, but only one model had room to show a loss. Two further results were inconclusive or not confirmed, and we report them alongside the confirmed ones: a first in-context test; the imitation effect across model sizes (7 of 10 checkpoints). Files. agents-copy-past-choices.pdf (the paper); agents-copy-past-choices-source.zip (its Markdown source, the HTML page the PDF was printed from, and the converter); code-and-data.zip (the release repository: the sealed preregistrations with their SHA-256 hash files and code bundles, all code, raw outputs and analyses, and the pre-release review record; python verify_seals.py checks every seal, and DATA.md lists what is not included). Code: https://github.com/Somebodyhere101/agents-copy-past-choices. AI-use statement The author set the overall research goal: how AI systems hold goals and assign authority to text. Tests the author chose from AI-proposed options: SELFID, DTAG, the RPLY pilot, SIZE, TAGCTL, AGE and FOLD. Tests run under the author's standing instruction to work autonomously: GARDEN, GARDEN-CONFIRM, DILUTE, the two injection pilots and ROUTE. Claude (Anthropic) did the rest of the work: it proposed most hypotheses and tests; it designed, sealed and ran them; it analysed the data; it ran the prior-art checks, with independent agent searches; it wrote this text. Two test ideas came from other AI processes. GARDEN's came from an AI idea generator in a discovery-prompt pilot. FOLD's came from a context-free Claude agent given a random pair of non-ML fields. AI rechecks before this version. Two Claude sessions checked every number in the paper against the analysis files, and a third read the draft as a sceptical reviewer. Their findings were checked against the records and fixed where they held. Every arXiv reference was checked against its arXiv entry. These are AI rechecks, not outside or human validation. The author did not independently check the code, analyses or technical claims. The author is responsible for the released content.