一个智能体，就其最简单的形式而言，就是一个在循环中调用工具的大语言模型。这个循环适用于短任务。给它一个运行一小时、调用 200 次工具的任务，它会以两种可预见的方式崩溃。AWS Samples 自主云编码智能体设计指南直接指出了这些问题：浅层智能体会遭遇上下文溢出、被分散注意力（目标丢失），并且无法在长时间内维持状态。解决这一问题的层不是模型，而是 harness（执行框架），AWS 将其描述为管理除模型之外的一切。
本文深入剖析这一层。压缩、记忆策略、上下文预算和 todo 状态，正是将浅层循环转变为深度智能体的机制。我们来看看 LangChain Deep Agents、Claude Code、Manus、OpenAI Codex 和 Amazon Bedrock AgentCore 各自如何实现这些机制，以及它们实际发布的阈值。
为什么更大的窗口解决不了问题
显而易见的解决方案是更大的上下文窗口。但证据表明，它的帮助比预期要小。Chroma 的上下文腐化报告评估了 18 个大语言模型，包括 GPT-4.1、Claude 4、Gemini 2.5 和 Qwen3，发现随着输入长度增长，性能变得越来越不可靠，即使在简单的检索任务上也是如此。Anthropic 的上下文工程指南解释了其机制：注意力机制为 n 个 token 创建 n² 个成对关系，因此每增加一个 token 都会消耗有限的“注意力预算”。上下文是一种收益递减的资源，而不是一个桶。
对于一个智能体循环来说，这比听起来还要糟糕。Manus 报告称，一个典型任务大约需要 50 次工具调用，而输入与输出的 token 比例接近 100:1。每一条观察结果都会进入上下文并留在那里。最初的指令逐渐漂移到上下文窗口的中部，而这恰恰是召回能力退化的位置。目标丢失不仅仅是模型的一个缺陷。它是在足够长的任务中，对上下文不加管理所导致的必然结果。
机制 1：上下文预算与卸载
一个 harness 的首要职责，是决定哪些内容根本不进入上下文窗口。Deep Agents 附带 2 条带有硬性数字的卸载规则。当一次工具响应超过 20,000 tokens 时，它会被写入文件系统，并替换为一个文件路径加上前 10 行的预览。当会话上下文超过模型窗口的 85% 时，较早的写入和编辑工具调用——其完整文件内容已经存在于磁盘上——会被截断为一个指针。只有当卸载再也腾不出空间时，harness 才会退回到摘要压缩。
Claude Code 对首个提示词加载之前的内容也施加了同样的预算管理。自动记忆被限制在前 200 行或 25KB。MCP 工具 schema 默认保持延迟加载，只列出工具名称，完整 schema 通过工具搜索按需加载。压缩之后，任何超过 5,000 tokens 的重新读取文件都会以路径引用的形式返回，而不是内容本身。Claude Code 文档中的上下文窗口模拟让这一收益变得具体可见：一个研究子智能体读取了 6,100 tokens 的文件，并向父级返回了一个 420 tokens 的结果。
这种子智能体模式是在架构层面做预算控制。Anthropic 的指南指出，每个子智能体可能会在探索中消耗数万个 token，但只返回一份经过提炼的摘要，通常为 1,000 到 2,000 个 token。AWS AgentCore 的演练正是这样构建的：一个协调者并行启动 3 个浏览器子智能体，每个都在自己的 MicroVM 中运行，而一个分析师子智能体只接收它们的结构化发现结果。
AWS 报告预期运行时间为 4 到 6 分钟，并指出顺序处理最多会耗时 3 倍。
机制 2：压缩
当卸载还不够时，执行框架就会进行总结。压缩是指将一段接近上下文窗口上限的对话取出、加以总结，并用该摘要重新开启一个新的上下文。这也正是目标丢失最常发生的地方，因为有损摘要可能会丢掉那条唯一重要的约束。
不同实现在承诺保留什么内容上各有差异。Claude Code 的压缩提示词会保留架构决策、未解决的 bug 和实现细节，同时丢弃冗余的工具输出。压缩完成后，它会立即重新读取最多 5 个最近修改的文件，重新加载与这些文件匹配的规则，并重新注入被调用的技能正文，每个技能上限为 5,000 个 token，总计上限为 25,000 个。文档明确指出，对话早期的详细指令可能会丢失，这正是持久性规则应放在项目根目录的 CLAUDE.md 中的原因，因为该文件会从磁盘重新注入。用户可以通过 /compact focus on the auth bug fix 来引导这一过程，或通过 /autocompact 来移动触发点。
Deep Agents 将目标保留变成了一项结构性特性。它的摘要是一份结构化文档，其中设有专门字段用于记录会话意图、所创建的产物以及后续步骤。LangChain 团队是在强制摘要实验表明这一改动提升了性能之后才加入这些字段的。完整的原始对话记录也会写入文件系统，因此一条被摘要抹去的事实，之后可以由 read_file 恢复。
压缩也已进入 API 层。OpenAI 的 Responses API 通过 context_management 配合 compact_threshold 提供服务器端压缩，此外还有一个独立的 /responses/compact 端点，返回一个经过压缩的上下文窗口，其中包含一个不透明的加密压缩项；OpenAI 指示开发者将该返回的窗口原样传入下一次调用。OpenAI 表示 Codex 依赖这一机制来维持长时间运行的编码任务。Claude 开发者平台提供了一个 compact_20260112 上下文管理编辑功能，支持自定义指令，以及一个 pause_after_compaction 选项，用于在模型继续之前插入内容。当你在那里编写自定义指令时，它们会完全取代默认提示词，因此压缩提示词是一件真正的工程产物，而不是一项设置。
机制 3：待办状态与复述
压缩在摘要生成的那一刻保护目标。而待办状态则在中间的每一轮对话中保护它。Manus 直白地描述了这个技巧：它的智能体会创建一个 todo.md，并逐步重写它，逐项勾选完成。重写列表会把目标复述到上下文的末尾，将全局计划推入模型近期的注意力范围，减少“中间迷失”的漂移。无需改变架构。这只是用自然语言来引导模型自身的注意力。
关于待办状态的证据并非一边倒。Deep Agents 默认搭载了一个 write_todos 工具，直到 2026 年 7 月的 v0.7，LangChain 才将 TodoListMiddleware 改为可选启用，因为其在 3 个任务类别上的评估显示，禁用待办后奖励略好、成本更低。LangChain 仍然建议在长时间多步骤任务、能力较弱的模型以及展示进度的 UI 中重新启用它。Claude Code 保留一份待办列表，并在压缩后从磁盘重新注入计划模式下编写的计划。Anthropic 的指南将这一通用模式称为结构化笔记：智能体在上下文窗口之外编写一个 NOTES.md 或 TODO 文件，然后重新加载它。其 Claude Plays Pokémon 示例在数千个游戏步骤中维护计数，然后在每次上下文重置后读取自己的笔记，并恢复长达数小时的操作序列。
所有这些背后的模式是：目标作为一个可变产物存在，而不仅仅是历史中的一条消息。消息会老化并被摘要。一个每隔几轮就被重写的文件始终是近期的、始终是简短的，并且能在任何重置后存活下来。它是否值得每轮的 token 成本，取决于模型和任务长度，而这正是 Deep Agents 评估所测量的内容。
机制 4：跨会话的记忆策略
最后一块是任务结束后仍然留存的内容。Claude Code 在每次压缩之后，会从磁盘重新注入项目根目录的 CLAUDE.md 和自动记忆。AgentCore Memory 会存储事件，并在后台运行配置好的提取策略，因此协调器可以在下一次运行时调用召回工具，而不必重新研究。
AWS 警告称，如果未配置至少 1 个提取策略，原始事件虽会被存储，但不会提取任何内容用于检索。Anthropic 基于文件的记忆工具在 Claude 平台上起到同样的作用。
局限在于，持久化上下文并非没有代价。我们在二月报道过的苏黎世联邦理工学院研究（ETH Zurich study）发现，像 AGENTS.md 这样的仓库上下文文件通常不会提升任务成功率，反而会推高推理成本：LLM 生成的文件在 2 个基准上使成本增加了 20% 和 23%，而开发者提交的文件最高增加 19%。每次会话都重新加载的记忆，是对注意力预算的一项长期税收。Claude Code 文档给出了相应的建议：将 CLAUDE.md 保持在 200 行以内，并把参考资料移入技能或按路径限定的规则中，仅在需要时加载。
交互式讲解：观看 200K 上下文窗口被填满
下面的模拟器通过一个 200K token 的窗口运行一项 60 步的迁移任务。切换这 4 种机制，设置压缩触发阈值，然后按下运行。当所有机制都关闭时，窗口在任务完成一半之前就会溢出。当卸载、压缩、待办事项复述和子智能体委派全部开启时，同样的任务能够完成，且目标仍处于近期注意力之中。token 数量仅为示意；阈值与 Deep Agents 的默认值一致。
测试该框架是否真正守住了目标
上下文管理只有在智能体仍能完成任务并找回它已看不到的细节时才有用。LangChain 正是为此维护了针对性的评测：触发任务中途摘要并检查智能体是否继续朝目标推进的测试，以及事实被摘要掉、必须通过文件系统搜索找回的“大海捞针”用例。
为了生成足够多的事件来比较不同提示词变体，团队在窗口的 10% 到 20% 处触发摘要，而非默认的 85%，并在 terminal-bench-2 上使用 Claude Sonnet 4.5 以 25% 的触发阈值来研究其效果。
在 LangChain 看来，需要警惕的失败是目标漂移：智能体在摘要之后立刻请求澄清，或者错误地宣布任务完成。AgentCore Evaluations 提供了一个目标成功率评估器，可以对相同的 trace 打分。如果你运行了一个框架，却没有在测试中强制触发过一次压缩，那么你还不清楚你的摘要提示词到底丢掉了什么。
关键要点
- 浅层智能体会因上下文溢出和目标丢失而失败；修复的关键在于执行框架，而非模型本身。
- 预算优先：Deep Agents 会卸载超过 20,000 tokens 的工具结果，并在窗口使用率达到 85% 时清除旧的编辑内容。
- 压缩必须明确说明它保留了哪些内容；Deep Agents 增加了会话意图和后续步骤字段，Claude Code 则会重新读取最近 5 个文件。
- 待办事项复述能将目标保持在上下文末尾，但 Deep Agents v0.7 的评测表明，这并非没有代价的收益。
- 持久记忆会消耗注意力：ETH Zurich 测得，由 LLM 生成的上下文文件会使推理成本增加 20% 至 23%。
An agent, in its simplest form, is an LLM calling tools in a loop. That loop works for short jobs. Give it a task that runs for an hour and 200 tool calls, and it breaks in 2 predictable ways. The AWS Samples design guide for autonomous cloud coding agents names them directly: shallow agents suffer from context overflow, get distracted (goal loss), and do not maintain state over long periods. The layer that fixes this is not the model. It is the harness, which AWS describes as managing everything but the model.
This article opens up that layer. Compaction, memory strategy, context budgeting, and todo-state are the machinery that turns a shallow loop into a deep agent. We look at how LangChain Deep Agents, Claude Code, Manus, OpenAI Codex, and Amazon Bedrock AgentCore implement each one, with the actual thresholds they ship.
Why a bigger window does not fix it
The obvious fix is a larger context window. The evidence says it helps less than expected. Chroma’s Context Rot report evaluated 18 LLMs, including GPT-4.1, Claude 4, Gemini 2.5, and Qwen3, and found that performance grows increasingly unreliable as input length grows, even on simple retrieval tasks. Anthropic’s context engineering guide explains the mechanism: attention creates n² pairwise relationships for n tokens, so every added token depletes a finite “attention budget.” Context is a resource with diminishing returns, not a bucket.
For an agent loop, this is worse than it sounds. Manus reports that a typical task needs around 50 tool calls, and that the input-to-output token ratio runs near 100:1. Each observation lands in context and stays there. The original instruction drifts toward the middle of the window, which is exactly where recall degrades. Goal loss is not only a model bug. It is the expected outcome of an unmanaged context on a long enough task.
Mechanism 1: Context budgeting and offloading
The first job of a harness is deciding what never enters the window at all. Deep Agents ships 2 offloading rules with hard numbers. When a tool response exceeds 20,000 tokens, it is written to the filesystem and replaced with a file path plus a preview of the first 10 lines. When session context crosses 85% of the model’s window, older write and edit tool calls, whose full file contents already live on disk, are truncated to a pointer. Only after offloading runs out of room does the harness fall back to summarization.
Claude Code applies the same budgeting to what loads before the first prompt. Auto memory is capped at the first 200 lines or 25KB. MCP tool schemas stay deferred by default, with only tool names listed, and full schemas load on demand via tool search. After compaction, any re-read file over 5,000 tokens comes back as a path reference rather than content. The context window simulation in the Claude Code docs makes the payoff concrete: a research subagent reads 6,100 tokens of files and returns a 420-token result to the parent.
That subagent pattern is budgeting at the architecture level. Anthropic’s guide notes that each subagent may burn tens of thousands of tokens exploring, but returns a distilled summary, often 1,000 to 2,000 tokens. The AWS AgentCore walkthrough builds exactly this: a coordinator spawns 3 browser subagents in parallel, each in its own MicroVM, and an analyst subagent receives only their structured findings. AWS reports a 4 to 6 minute expected runtime, and notes that sequential processing would take up to 3x longer.
Mechanism 2: Compaction
When offloading is not enough, the harness summarizes. Compaction is the practice of taking a conversation nearing the window limit, summarizing it, and reinitiating a new context with the summary. It is also where goal loss most often happens, because a lossy summary can drop the one constraint that mattered.
The implementations differ in what they promise to keep. Claude Code’s compaction prompt preserves architectural decisions, unresolved bugs, and implementation details while discarding redundant tool outputs. Right after compaction it re-reads up to 5 of the files modified most recently, reloads the rules matching those files, and re-injects invoked skill bodies, capped at 5,000 tokens per skill and 25,000 total. The docs are explicit that detailed instructions from early in the conversation may be lost, which is why persistent rules belong in the project-root CLAUDE.md, which is re-injected from disk. Users can steer the pass with /compact focus on the auth bug fix or move the trigger point with /autocompact.
Deep Agents made goal preservation a structural feature. Its summary is a structured document with dedicated fields for session intent, artifacts created, and next steps. The LangChain team added those fields after forced-summarization experiments showed the change improved performance. The full original transcript is also written to the filesystem, so a fact that was summarized away can be recovered by read_file later.
Compaction has moved into the API layer too. OpenAI’s Responses API offers server-side compaction via context_management with a compact_threshold, plus a standalone /responses/compact endpoint that returns a compacted context window containing an opaque encrypted compaction item; OpenAI instructs developers to pass that returned window unchanged into the next call. OpenAI says Codex relies on this mechanism to sustain long-running coding tasks. The Claude Developer Platform exposes a compact_20260112 context-management edit with custom instructions and a pause_after_compaction option for inserting content before the model continues. When you write custom instructions there, they replace the default prompt entirely, so a compaction prompt is a real engineering artifact, not a setting.
Mechanism 3: Todo-state and recitation
Compaction protects the goal at the moment of summarization. Todo-state protects it on every turn in between. Manus described the trick plainly: its agent creates a todo.md and rewrites it step by step, checking items off. Rewriting the list recites the objectives into the end of the context, pushing the global plan into the model’s recent attention span and reducing “lost in the middle” drift. No architecture change is required. It is natural language used to bias the model’s own attention.
The evidence on todo-state is not one-sided. Deep Agents shipped a write_todos tool by default until v0.7 in July 2026, when LangChain made TodoListMiddleware opt-in after its evals across 3 task categories showed slightly better reward and lower cost with todos disabled. LangChain still recommends turning it back on for long multi-step tasks, less capable models, and UIs that show progress. Claude Code keeps a todo list and re-injects the plan written in plan mode from disk after compaction. Anthropic’s guide calls the general pattern structured note-taking: the agent writes a NOTES.md or TODO file outside the window and reloads it. Its Claude Plays Pokémon example maintained tallies across thousands of game steps, then read its own notes after each context reset and resumed multi-hour sequences.
The pattern behind all of these is that the goal exists as a mutable artifact, not only as a message in history. Messages age and get summarized. A file that is rewritten every few turns is always recent, always short, and survives any reset. Whether that is worth its per-turn token cost depends on the model and the task length, which is exactly what the Deep Agents evals measured.
Mechanism 4: Memory strategy across sessions
The last piece is what persists after the task ends. Claude Code re-injects the project-root CLAUDE.md and auto memory from disk after every compaction. AgentCore Memory stores events and runs configured extraction strategies in the background, so a coordinator can call a recall tool on the next run instead of re-researching. AWS warns that without at least 1 extraction strategy configured, raw events are stored but nothing is extracted for retrieval. Anthropic’s file-based memory tool serves the same purpose on the Claude platform.
The limitation is that persistent context is not free. The ETH Zurich study we covered in February found that repository context files like AGENTS.md do not generally improve task success while raising inference cost: LLM-generated files increased cost by 20% and 23% on the 2 benchmarks, and developer-committed files by up to 19%. Memory that reloads every session is a standing tax on the attention budget. The Claude Code docs give the matching advice: keep CLAUDE.md under 200 lines and move reference material into skills or path-scoped rules that load only when needed.
Interactive explainer: watch a 200K window fill up
The simulator below runs a 60-step migration task through a 200K token window. Toggle the 4 mechanisms, set the compaction trigger, and press Run. With everything off, the window overflows before the task is half done. With offloading, compaction, todo recitation, and subagent delegation on, the same task finishes with the goal still in recent attention. Token counts are illustrative; the thresholds match Deep Agents defaults.
Testing whether the harness actually holds the goal
Context management is only useful if the agent can still finish the task and recover details it no longer sees. LangChain maintains targeted evals for exactly this: tests that trigger summarization mid-task and check whether the agent continues toward its objective, and needle-in-a-haystack cases where a fact is summarized away and must be recovered through filesystem search. To generate enough events to compare prompt variants, the team triggers summarization at 10 to 20% of the window instead of the 85% default, and used a 25% trigger with Claude Sonnet 4.5 on terminal-bench-2 to study the effect.
The failure to watch for, in LangChain’s view, is goal drift: an agent that asks for clarification right after a summary, or wrongly declares the task complete. AgentCore Evaluations ships a goal success rate evaluator that can score the same traces. If you run a harness and have not forced a compaction in a test, you do not yet know what your summary prompt drops.
Key Takeaways
- Shallow agents fail from context overflow and goal loss; the harness, not the model, is where the fix lives.
- Budget first: Deep Agents offloads tool results over 20,000 tokens and evicts old edits at 85% of the window.
- Compaction must name what it keeps; Deep Agents adds session intent and next steps fields, Claude Code re-reads 5 recent files.
- Todo recitation keeps the goal at the end of context, but Deep Agents v0.7 evals show it is not a free win.
- Persistent memory costs attention: ETH Zurich measured 20 to 23% higher inference cost from LLM-generated context files.