Computation, Not Memory: Chain-of-Thought and State Tracking in LLM Agents

Long-horizon assigned work requires an LLM agent to track the state of a task: which steps are done, blocked, cancelled, or open to repetition. Agent systems either keep this state as text in the prompt and rely on the model to read that text, or move the state into a module that enforces it, and each system is evaluated as a whole, so no one knows how much reliability comes from the state being shown, told, or enforced. We fix the task rules, the model, and paired episodes and vary how strongly task state reaches the agent: a raw transcript, an exact checklist, per-turn directives from a state machine compiled from the brief and advanced only by execution receipts, or an enforcement gate on that machine that refuses state-violating actions; every episode is scored by exact payload matching against dynamic ground truth. Across three models, two reasoning regimes, and two domains, four findings hold without per-turn reasoning: displaying accurate state is unreliable, an unverified ledger the agent writes itself beats an accurate checklist it is shown, directives help in proportion to the model's obedience, and enforcement needs no obedience but is bounded by the correctness of its state and by the matcher that maps requests to steps; per-turn reasoning at a 235B agent compresses these separations without repairing the text rungs. The same gate, compiled from $τ^2$-bench's airline policy, raises a 235B agent's pass$^1$ from 0.39 to 0.54 and changes nothing for a 35B agent that rarely violates the policy; on PM-Bench, where acting turns on recognizing a cue rather than on state, showing the record is the best rung--matching or beating both gates and reversing the ledger-over-checklist finding--and enforcing the matcher's judgement drops a 35B agent below its raw transcript. Enforcement pays when failures are state-decidable and frequent, and hurts when the gate's judgement is wrong.

LLM agents that read untrusted content can be hijacked by prompt injections. Runtime monitors that try to catch a hijack before the agent acts, and benchmarks that score each task with a single run, share an assumption: whether an agent follows an injection is settled when the injection is read. We test this assumption with branching rollouts that replay an episode exactly up to the step at which the agent reads an injection and then resample the rest of the episode many times, splitting the outcome variance into a part fixed at read time and a part decided afterwards. Across four AgentDojo suites, a Qwen3 agent without thinking is largely decided at read time (0.91 of the outcome variance lies between states); with thinking on, this share drops to 0.62 (95% CI of the drop [-0.38, -0.22]), in the same direction for three attack templates and two success labels. How much is fixed at read time is a property of the model that the same measurement reveals, and thinking lowers the attack success rate of Qwen3 but raises it for two other models. Resampling from reasoning prefixes shows that the decision forms gradually as the agent reasons. Zero-shot chain-of-thought monitors built on cheaper models miss much of what is already decided, whereas stronger monitors, and a lookahead monitor that judges simulated next actions, come close to what the prefix determines. Finally, single-run labels of thinking agents disagree with a rerun up to 35% of the time, so benchmarks need repeated runs per task.

Context managers summarize or evict old messages so agents can operate beyond a finite window. This creates a reliability problem: removing history that still shapes the model's computation may change later actions, while retaining everything defeats compression. We study plans because agents create them early and are expected to use them later, yet behavioral success alone cannot reveal whether later calls still depend on the plan exchange. We make four contributions. First, we introduce replay pairing, which holds the action-observation trajectory fixed and compares pre-action hidden states with and without the plan exchange. We show that, on Llama-3.1-70B in ALFWorld, the mean contrast across 15 sampled layers decreases 4.1x from the first post-plan action to the second; Llama-3.1-8B shows a similar 5.6x decrease. Second, we show that a simple linear model using layer-32 hidden states predicts later contrast on entirely held-out tasks better than a baseline that only knows the action-call offset (R^2 = 0.847 vs. 0.575). Third, we identify confounds that limit this measurement: the paired histories differ in length, token positions, and discourse structure, and replayed reasoning can reintroduce plan-derived text. Reasoning traces therefore require symmetric controls, and native Qwen3 shows that the Llama timing pattern is not universal. Fourth, in a separate descriptive compression test, we find pooled ALFWorld run success of 56.7% with full history and 22.0% with naive eviction; preserving or re-surfacing only the plan does not recover the gap. Replay pairing measures sensitivity to retaining an exchange, not isolated plan content or later eviction. It gives researchers a concrete audit tool and suggests that context policies should preserve broader task state, not plans alone.