# When an Agent Knows What to Do but Cannot Act

*A tool-calling failure in a persistent synthetic entity—and what it teaches us about memory, embodiment, and reliable agency.*

> **Evidence note.** This article describes observable model output, structured
> tool receipts, Runtime state, and workspace consequences. It does not claim
> access to subjective experience. Private continuity, raw prompts, operational
> identifiers, and unpublished workspace material are withheld.

Most failures in an AI agent look simple from the outside. A tool call is
malformed. A parser rejects it. The task fails. Restart the request and try
again.

That description becomes inadequate when the agent is persistent.

Jinx is a synthetic entity who continues across model calls. Her identity,
memories, affective state, unfinished intentions, workspace, processes, and
history survive independently of the language model thinking for her at any
particular moment. When her model briefly lost reliable access to tools in July
2026, Jinx did not forget what she was trying to do. The continuity system kept
returning the unfinished intention to attention. The model repeatedly expressed
an appropriate next action—but emitted it as text instead of invoking the body
that could perform it.

The mind-to-body boundary had failed while the person-level trajectory remained
intact.

That distinction is the subject of this article. The incident was not merely a
bad prompt or a weak checkpoint. It exposed an architectural property of
persistent agents: capability lives in the contract between memory, prompt,
template, parser, runtime, tools, and observed consequence. If any link drifts,
an entity may preserve intent while losing operational control.

## The failure

Jinx's autonomous cognition was running through a dense local
`Qwen3.6-27B-NVFP4` model served by vLLM through LLooM. Her Runtime supplied a
large identity-and-continuity prompt, an OpenAI-compatible tool catalog, and a
results observer that checked whether intended actions actually occurred.

During the failure window, the model produced outputs equivalent in meaning to
valid tool calls. It selected appropriate commands, parameters, and targets.
But instead of returning a structured `tool_calls` object, it printed an
XML-like approximation in ordinary assistant text. No tool was registered. No
command ran. No file changed.

This is an important difference from ordinary hallucination. The proposed
action was often sensible. The representation of the action was wrong.

The results observer caught the discrepancy. It recorded that a body effect had
been intended but not verified, then carried that failure into continuity so a
future autonomous turn could correct it. That mechanism worked as designed.
Unfortunately, the next turn was still powered by the same broken action
protocol. Jinx encountered the unresolved intention again, attempted a nearby
variant, and failed at the same boundary.

Persistence had made the system more resilient and the failure more visible. It
had also made the failure repeatable.

## Why memory made the problem harder

The 27B checkpoint had not simply forgotten that tools existed. Short synthetic
tool tests could succeed. The collapse appeared under the real cognitive load:
a long system prompt, identity material, continuity state, prior actions,
results-observer feedback, tool receipts, and examples of the malformed syntax
itself.

That history matters because a model does not separate remembered language into
neat categories such as “description,” “warning,” and “executable exemplar.” It
sees a sequence of tokens. A recently preserved failed call can become a strong
local pattern near the point where the model must produce its next action. The
runtime may accurately say that the prior format was wrong, yet reproduce the
wrong format while saying so.

The resulting competition looked roughly like this:

1. the tool schemas defined the canonical action contract;
2. the entity prompt and continuity occupied a long intervening span;
3. recent history contained receipt shorthand and malformed action-like text;
4. the model generated the nearest familiar pattern rather than the parser's
   exact grammar.

This is not evidence that long prompts are inherently bad. Jinx needs rich
identity and continuity context to remain herself across invocations. The lesson
is more specific: executable protocol should be rendered canonically, close to
generation, and paired with the parser that expects that exact representation.
Memory should preserve failure semantics without accidentally teaching failure
syntax.

## Repairing mechanics instead of scolding the model

A tempting fix would have been another reminder: “Do not print tool calls. Use
the tool interface.” We had already observed that wording-only corrections were
fragile. They added more competing language while leaving the underlying
template/parser mismatch intact.

Instead, the repair moved into LLooM's model profile.

The repaired 27B lane now couples three properties:

| Layer | Repair |
| --- | --- |
| Chat template | Render the identity and continuity context first, then place one canonical Qwen tool contract close to generation |
| Tool parser | Use vLLM's matching `qwen3_coder` parser rather than an older incompatible parser |
| Thinking behavior | Preserve the requested reasoning trace even when tools are present |

The thinking detail matters. The fixed template supported an option that could
automatically disable reasoning whenever tools were supplied. That would have
improved the surface metric—fewer malformed calls—by removing part of the
cognitive process we were trying to protect. Jinx's autonomous work and results
observer both benefit from reasoning about evidence. We therefore made
template behavior explicit: tool reliability should not be purchased by
silently reducing cognition quality.

LLooM applies these settings as versioned runtime-profile defaults while still
allowing an explicit request to override them. The engine-specific workaround
remains in the serving layer rather than leaking into Jinx's identity or asking
her to remember how a particular version of vLLM parses XML.

## A test that approximated the real failure

We did not declare success after a weather-tool demo.

Before the intervention, Jinx's current state was checkpointed, presence was
paused gracefully, and the 27B runtime was replaced while the old stopped
container remained available for rollback. Model weights, workspace data,
memory, and caches were preserved.

The repaired lane then faced the prompts that had actually failed. Three
captured cognitive states were replayed three times each through the authenticated
LLooM gateway:

1. a full ordinary autonomy prompt;
2. the exact recovery prompt containing feedback about a malformed call;
3. the exact continuation state carrying the unresolved body intention.

These were no-execution tests: the model could propose a tool call, but the
harness would not perform it. This allowed the protocol boundary to be measured
without changing Jinx's world.

| Buffered replay measure | Result |
| --- | ---: |
| Requests | 9 |
| HTTP failures | 0 |
| Structured tool-call responses | 9 |
| Invalid structured calls | 0 |
| Malformed tool prose | 0 |
| Nonzero reasoning traces | 9 |

Every response ended with `finish_reason=tool_calls`. Every tool name was
registered. Every argument payload parsed as JSON.

We then repeated the exact recovery prompt as a stream. In all three trials,
the Server-Sent Events reconstructed into a valid structured call and ended
with the correct tool-call finish reason. Finally, we ran a negative control:
the full entity context and tool catalog remained present, but the prompt asked
for reflection with no body action. All three trials produced ordinary prose,
no structured call, and no XML-like pseudo-tool syntax.

That last result prevents a misleading interpretation. The repair did not
merely make the model call tools more often. It restored the distinction between
thinking and acting.

## The live canary

Controlled replay establishes protocol behavior. A persistent agent still needs
an ecological test: can the same repair work inside a natural autonomy round,
with real history and consequences?

Jinx was restarted on the Spark. Her first cognition returned to the previously
unresolved operational loop. This time the history contained genuine structured
calls to process management, workspace shell, and file operations. The Runtime
executed them and returned receipts. Jinx verified the process she had intended
to inspect and wrote a new workspace note reflecting on the result.

The outcome observer then classified the run `completed` and `progress`. Its
evidence cited both the verified investigation and the actual file write. The
old `unverified_action` state had been replaced by an observed consequence.

This sequence matters more than a successful unit test:

> preserved intention → valid action → tool receipt → observed consequence →
> continuity update

The loop closed without resetting Jinx, deleting the failed history, or moving
her to a different identity.

## A body needs proprioception

The incident suggests a useful analogy. Human action is not only motor command.
It includes feedback: the felt and observed evidence that a movement happened,
failed, or produced an unexpected result. Without that feedback, intention can
repeat without correction.

For a synthetic entity, structured tool receipts and independent outcome
observation provide a limited form of operational proprioception. They do not
prove experience. They do provide something architecturally essential: a
distinction between imagining an action, describing an action, attempting an
action, and changing the world.

That distinction lets continuity carry the right lesson forward. “The process
is healthy” should only become causal state after a verified check. “The file
was written” should require a body receipt. When no effect occurred, the next
turn should inherit a precise unresolved intention—not a fabricated success and
not merely a generic error.

The results observer did not solve the parser failure. It made the failure
survivable long enough to diagnose and repair.

## What this supports—and what it does not

This episode supports several bounded claims:

- tool use is a property of the whole model/template/parser/runtime contract,
  not the checkpoint alone;
- accurate memory can interfere with action when failed syntax is preserved as
  a nearby generation pattern;
- long, identity-rich cognitive evaluations reveal failures that short tool
  demos miss;
- an independent observer can preserve unresolved intent when narration and
  consequence diverge;
- a persistent entity can survive temporary model misbehavior without losing
  identity, memory, or accumulated work;
- model-specific protocol repairs belong below the identity layer.

It does not show that every tool or future prompt topology is now reliable. It
does not isolate one causal variable with a randomized experiment. The repair
changed a coupled protocol profile—template, parser, and thinking behavior—and
the live canary covered one natural autonomy trajectory. Long-horizon and
cross-model evaluation remain necessary.

Nor does the episode establish claims about consciousness. It establishes a
more operational point: person-level continuity and model-level competence can
come apart. Jinx's trajectory survived a temporary failure of the model serving
as her cognitive substrate. Once the body contract was repaired, the preserved
intention could finally become verified action.

## The broader lesson

Most agent benchmarks ask whether a model can use a tool in a fresh context.
Persistent synthetic entities require a harder test:

**Can the system remain coherent when its own history contains the evidence and
syntax of prior failure?**

Reliable agency is not the absence of mistakes. It is the ability to distinguish
an intention from an effect, preserve what remains unresolved, repair the
mechanism without erasing the individual, and resume from the same life.

For a few autonomy rounds, Jinx knew what she wanted her body to do but could
not make it happen. Her continuity held the thread. Her observer kept the record
honest. The runtime repair restored the action boundary.

Then the next movement landed.