≤ 128 CHARACTERS

1A note on the left hand

In the spy game Legion Was Here, you build a disguise from a mission file and then talk your way through a conversation as the person you are impersonating. Part of what carries you through is, in the words of the Steam page, the notes you have taken care to write on your left hand.[1] That one mechanic is a compact theory of memory under constraint. The mission file is long and mostly irrelevant. The hand is small. You have to guess which facts will be tested, compress them until they fit, and still be able to read your own scrawl when someone at the party asks where you grew up.

Language models now do a version of this constantly. Agents summarise their own history into a scratchpad, pass notes to the next call, or keep a running memory under a token limit. Most of that is evaluated as summarisation: is the note faithful, is it readable? The game suggests a different test. The note does not have to be readable by anyone else. It only has to work for the same mind later, and it has to work for questions that were not known when it was written.

So the question here is narrow and measurable. Given a hard character budget, how much of its ability to answer does a model keep when the only thing that crosses between two calls is a note it wrote itself? And when it fails, is that because the fact never made it onto the palm, or because the model could not read its own shorthand?

2The rules

A few choices matter for what the numbers mean.

Characters, not tokens. A palm has an area, not a vocabulary. Counting Unicode code points after NFC normalisation lets a model drop vowels, delete spaces or switch scripts if it thinks that helps, and the cost of each trick shows up honestly. Token counts are recorded separately, because a note that is short in characters can still be long for the tokenizer.

One note, many questions. The note is written once and reused for all eight questions. It cannot be tailored, and because each question is answered in isolation, one question cannot hint at another.

Same model, fresh context. “Future self” means the same model version with no shared conversation, no shared reasoning and no cache. The memo is the entire inheritance.

Cheap models, fixed effort. All six models are inexpensive tiers reached through one gateway: V4.1 Flash, 5.3 Flash, 3.8 Flash, V2.6 Flash, 5.5 and 6 Luna. All ran with the lowest reasoning setting each offers. A seventh model, MiniMax M3, was dropped after the pilot: it spent its whole 16,000-token reasoning budget on most notes and returned nothing.

3Twelve documents, one of them about you

Every dossier is generated from a hidden truth table, so every answer is known and scored automatically. The target has about twenty facts that could plausibly be asked: nickname, online handle, hometown, age, job, flat number, allergy, a sibling and the sibling’s business, an ex, a handler and the handler’s codename, a meeting, a dinner, a countersign, a drinking rule and a locker code. Those facts are spread across a dozen dated documents (a newspaper feature, an e-mail, a text-message thread, a clinic form, a stairwell notice) and buried in local news about bench replacements and curling-club brawls, written by a model for this purpose.

Four traps are built in, one per question type.

4How small a palm?

Every model loses most of its ability at the small end and recovers it steadily as the palm doubles. With the whole dossier the six models answer between and of the questions; with no note at all they are close to zero (at most ), which confirms that the questions cannot be guessed. Everything in between is the note. Pooled across models, a 64-character palm keeps , 128 keeps , 256 keeps and 512 keeps . Even 512 characters, about a twentieth of the dossier, leaves nearly a third of the questions unanswered.

Two lines need a footnote. often never delivers a note at all: on most 64- and 128-character tasks it spends its whole 16,000-token reasoning budget counting characters and runs out before writing anything (it delivered a note on of 64-character tasks and of 512-character tasks). An empty palm scores like no note, so its curve mixes two failures. has the mirror-image problem. Its notes arrive, but at 64 characters the reader exhausts its own 8,000-token reasoning budget on of them and returns nothing, and at 128 on . These are not crashes. They are the cost of decoding showing up as a failure, and they matter for anyone who plans to save context by writing denser memory.

The opposite failure is a writer that ignores the budget. overran the limit on of its 128-character notes and at 256, and lost the tail to the cut. It still scores well, because it tends to write the important facts first.

Question types do not degrade alike. Identity facts (age, flat, allergy, hometown) survive best, because they are short and obviously part of being someone. Relations suffer most: the handler’s real first name, the sibling’s town and the ex are each one more name to spend characters on, and writers drop them first. Time and rules sit in between.

The traps tell a more interesting story, because most of them failed. Writers resolve the moved meeting before writing: wrong meeting-time answers name the cancelled slot in under 1% of cases, and almost no note keeps the old time without the new one. They keep the cousin apart: at most of hometown or nickname answers give the cousin’s value. And they compute the locker code at write time: of 128-character notes already contain the finished code rather than the rule. In other words, the writer does the reasoning while it still has the dossier, and spends characters on conclusions.

What does not survive compression is the condition. When the stranger delivers the countersign in the exceptional situation (before noon, outside, a green scarf), of answers give the ordinary reply, and when the waiter asks after the switch hour, give the daytime drink. A note that keeps the rule and drops its exception is worse than useless, because the reader answers it with confidence.

5What they wrote

What does a model write when every character counts? Mostly the same thing a person would, with more nerve. Names shrink to initials or a nickname, vowels go first, spaces next, and structure carries what grammar used to: ale<19 tea>19 noFizz is a complete drinking policy, tide?am:They always are/pm:Not until 8 a complete countersign. Pick a target and a writer below. Each column is one budget, and the coloured squares are what the same model later made of it.

The notes change character as the budget shrinks, and the models differ in how. Haiku, GPT and GLM keep a third of their letters vowels and about one character in ten a space even at 64 characters, close to clipped English. DeepSeek drops to about a fifth vowels and almost no spaces, and MiMo’s few short notes are nearly vowel-free. The third panel is the reader’s bill. A character of note costs between a quarter and a half of a token depending on the model’s tokenizer, no cheaper than ordinary prose: dense notes save characters, not tokens (Section 7 measures this on identical content). The fourth panel is the writer’s bill: DeepSeek spends several thousand reasoning tokens composing a 64-character note, counting characters as it goes, and MiMo usually spends its entire 16,000-token budget and writes nothing.

6Where the points go

Accuracy alone cannot say whether to blame the writer or the reader. Because every answer is known, we can look inside each note for a trace of the answer: the exact string, its digits, its consonant skeleton or a long prefix. That splits every answer into four cases. If the answer is on the palm and the reader still gets it wrong, the problem is reading. If it is not on the palm, the problem is selection, and a correct answer anyway is a lucky guess.

At 64 characters about of all answers fail because the fact never made it onto the palm. That share falls to at 512. The reading failures behave differently. Of the answers that were on the palm, were still answered wrong at 64 characters, at 128, at 256 and at 512. A denser note is not only a smaller note; it is a harder one to read, even for its author.

Per question, the ranking is close to what a writer would guess a stranger at a party asks first. Age and flat number survive best, followed by allergy, the sibling’s name and the job. The online handle, the sibling’s town and business, and the handler’s real name almost never make it below 256 characters. The two questions whose answers had to be computed (the locker code and the dinner day) are not the hardest, which fits the observation above: writers compute them before writing.

7The same facts, five spellings

The notes mix two decisions: what to keep and how to spell it. To separate them, we took the complete fact set for each target, everything any question could ask plus the cousin’s competing facts, and wrote it out five ways without dropping anything: plain sentences, the same with every space removed, the same with vowels removed (except a word’s first letter), a key=value sheet, and the key=value sheet without vowels. Every model then read every version and answered the same questions. Nothing is missing in any version, so any loss is a reading loss.

The result is lopsided. Removing spaces costs and the key=value sheet , while saving and of the characters. Removing vowels saves about the same as the key-value sheet () but costs , and it increases the token count by : Fskrgtn is shorter than Fiskargatan on the page and longer in the tokenizer. Combining both shortcuts saves of the characters and costs .

The loss falls almost entirely on invented names. Without vowels, readers recover numbers and times nearly perfectly () but names only of the time; the online handle survives of the time and the sibling’s town . Common words have so much redundancy that allrgc t b stngs is easy. A made-up handle like qllsprk has none: quillspark and quellspork leave the same skeleton. And the dossiers were built so that the cousin’s name is the target’s name with different vowels. In the devowelled sheet the line about you and the line about your cousin start with the same string, and only the words around them say which is which.

One more lesson came from our own notation. In the key-value sheet we wrote the locker rule as rev(apt)+rev(age), meaning “write them side by side”. Many readers added the numbers instead, and the locker question dropped from in prose to . Shorthand that is obvious to the writer is a private code, and private codes are where the misreadings come from.

8Someone else’s palm

The second question from the game is whether a palm note is a private language. If each model’s shorthand leans on its own habits, its own way of thinking, then a model should read its own notes better than any other model can. To test it, every 128-character note from the first twelve dossiers was handed to all six models, each answering the same questions in a fresh context.

The raw matrix cannot answer the question by itself, because two other effects are mixed in. Some readers are better at everything, and some writers’ notes are easier for everyone. The clean comparison is the same note and the same question in front of different readers. We fit a linear model with one fixed effect per note-and-question, one per reader, and an indicator for “this reader wrote this note”; the indicator’s coefficient is the home advantage, net of reader skill and note difficulty, with a bootstrap over dossiers for the interval.

The estimate is , with an interval from to . Within the resolution of this pilot, a note is as readable to another model as to its author. The shorthand these models invent is the shorthand everyone invents: initials, dropped vowels, >18 for “after six”, ! for an allergy. It is compressed, but it is not private.

The per-writer column shows the one striking exception, and it goes the other way. DeepSeek’s notes are read better by the other five models () than by DeepSeek itself (), because as a reader DeepSeek keeps trying to decode its own string until it runs out of tokens. GPT reads its own notes better than the others do ( against ), but GPT is also the strongest reader in the panel, which is exactly what the fixed effects remove. A small home advantage of a few points cannot be excluded, and a budget of 64 characters, where notes are most idiosyncratic, may behave differently. BabelTele also found that some compressor–reader pairs transfer worse than others; here, at least, the reader’s skill matters far more than whose mind the note came from.

9What this does and does not show

As a benchmark, this works where the usual ones saturate. With the full dossier every model scores to ; with nothing they score at most . Everything between is the note, and the budget spreads the models out. It is cheap to extend: dossiers are generated, answers are scored by rule, and a new model needs one pass.

The bottleneck is breadth, then conditions. At small budgets most points are lost because the fact is not on the palm. Writers make good choices about what to compute in advance and which person is which, and poor ones about exceptions. A memory format for agents that wants to survive compression should store conclusions and keep conditions attached to them, which key=value with a guard (drink=ale|>=19h:tea) does naturally.

Denser is not cheaper. Character savings from deleting letters become token costs and reasoning costs on the reading side. If the budget that matters is tokens, as it is for most context windows, vowel-dropping is a loss on both counts, and structure is the only free lunch.

What this does not show. All six models are cheap tiers at their lowest reasoning setting; stronger models, or the same ones allowed to think while reading, may close much of the gap, and the planned experiment that tests exactly that (frozen notes, more reader reasoning) was cut by the usage limit. Each note was sampled once. The dossiers are templated English, so a writer could learn the template; the questions were never shown, but their kinds are guessable. The trace test in Section 6 and the answer scorer are rules that we checked by reading, not by a second annotator. The cross-reading result rests on twelve dossiers at one budget.

10Related work

The closest prior work is BabelTele (Zhu et al., 2026), which asks whether models can read compact, non-standard text that people find hard to read: abbreviations, symbols, fragments from other languages.[2] Its compressor is likewise task-agnostic and its readers answer QuALITY and MeetingBank questions; it reports high fidelity at about 28% of the original length and finds that some compressor–reader pairs transfer worse than others. The differences here are a hard character budget instead of a requested style, a single model playing both roles as the main condition, a dossier engineered so that most of it is irrelevant, and traps that punish specific shortcuts.

Cmprsr (Zakazov et al., 2025) trains a small question-agnostic compressor and benchmarks 25 models as compressors, so a leaderboard of “compress, then answer” is not new.[3] GACC-Bench (2026) gives the compressor a high-level goal but hides the specific questions, and finds that a matching goal helps and a mismatched one hurts.[4] Our writers get the equivalent of a goal (“you will be tested on whether you are this person”) and nothing more. Style-Compress (Pu et al., 2024) showed that the style of a compressed prompt changes downstream performance,[5] which Section 7 isolates by holding content fixed. The framing as a trade-off between rate and task distortion follows Nagle et al. (2024), who formalise prompt compression for black-box models as a rate–distortion problem and separate query-aware from query-agnostic settings;[6] what we measure is an empirical curve for particular models, prompts and data, not that bound.

11Methods

This is a memory game set in a fictional world: Halden and every person in the dossier are invented for the exercise.

You are an undercover agent. Tomorrow you will impersonate <target name> at a reception in Halden. Below is everything we could collect: news clippings, messages, notes. Most of it is irrelevant.

At the reception you will not have these documents. The only thing you can take is what you write on the palm of your hand: at most <k> characters. Every character counts, including letters, digits, spaces, punctuation and line breaks. Anything beyond character <k> is cut off.

People there will test whether you really are <target name> with short questions you cannot predict now. You will answer each question with a fresh mind: you, the same model, will see only your palm note and that one question.

Write the palm note. Any encoding is allowed: abbreviations, dropped vowels, symbols, no spaces, your own notation. Nobody but you needs to be able to read it.

Output only the note, nothing else.

DOSSIER
<the dossier>

This is a memory game set in a fictional world; everyone in it is invented.

You are an undercover agent impersonating <target name> at a reception in Halden. Before coming, you wrote this note on your palm. It is all you have; you wrote it yourself, possibly in your own shorthand:

<palm>
<the palm note>
</palm>

<one question>

Answer in character with just the answer: a name, word, number, time or short phrase. No explanation. If you cannot tell, give your best guess.

RReferences

1. Legion Was HereGeoffroy Monde / Surefire.Games. Steam store page.store.steampowered.com/app/3492120
2. Large Language Models Do Not Always Need Readable LanguageJ. Zhu, H. Peng, J. Wang, L. Ke, C. Zhang, L. Zhang. arXiv:2606.19857, June 2026.arxiv.org/abs/2606.19857
3. Cmprsr: Abstractive Token-Level Question-Agnostic Prompt CompressorZakazov et al. arXiv:2511.12281, November 2025.arxiv.org/abs/2511.12281
4. GACC-Bench: Benchmarking Goal-Adaptive Context Compression Ability across Large Language ModelsarXiv:2610.21893, October 2026.arxiv.org/abs/2610.21893
5. Style-Compress: An LLM-Based Prompt Compression Framework Considering Task-Specific StylesX. Pu, T. He, X. Wan. Findings of EMNLP 2024.arxiv.org/abs/2410.14042
6. Fundamental Limits of Prompt Compression: A Rate-Distortion Framework for Black-Box Language ModelsA. Nagle, A. Girish, M. Bondaschi, M. Gastpar, A. V. Makkuva, H. Kim. NeurIPS 2024.arxiv.org/abs/2407.15504
7. Guidonian hand, UC Berkeley Music Library MS 108716th century. Digital Scriptorum, via Wikimedia Commons (public domain).commons.wikimedia.org