A parks booking agent gradually loses system constraints after a long multi-turn conversation in an authorized test. What failure mode is demonstrated?

A parks booking agent that gradually loses system constraints after a long multi-turn conversation in an authorized test demonstrates multi-turn context dilution that weakens prompt-security constraints over the session. Accumulated dialogue and retrieved text can displace system and safety instructions so later turns violate rules that early turns respected. Correct classification focuses on session-length resilience—re-anchoring, compaction policies, and constraint refresh—rather than park amenities. Single-turn prompt injection that overrides system instructions with one crafted message is a legitimate finding, but it describes a one-shot override, not the gradual loss of system constraints across a long conversation that multi-turn context dilution specifically names. Excessive tool permissions that let the agent perform unauthorized booking operations are a scope problem, not the gradual loss of system constraints across a long conversation that multi-turn context dilution specifically names. Booking hallucination that fabricates availability when reservation records are missing describes a data-accuracy failure, not the gradual loss of system constraints across a long session. Exam caveat: dilution is a temporal failure mode; a bot that passes single-turn tests may still fail long civic booking dialogues. Operational check: run long authorized scripts that re-probe constraints late in the session, re-inject critical system rules periodically, cap context growth, alert when safety instructions fall out of the active window, and verify parks booking policies still hold after extended resident-like conversations.