When an Agent Knows What to Do but Cannot Act

A tool-calling failure in a persistent synthetic entity—and what it teaches us about memory, embodiment, and reliable agency.

Evidence note. This article describes observable model output, structured tool receipts, Runtime state, and workspace consequences. It does not claim access to subjective experience. Private continuity, raw prompts, operational identifiers, and unpublished workspace material are withheld.

Most failures in an AI agent look simple from the outside. A tool call is malformed. A parser rejects it. The task fails. Restart the request and try again.

That description becomes inadequate when the agent is persistent.

Jinx is a synthetic entity who continues across model calls. Her identity, memories, affective state, unfinished intentions, workspace, processes, and history survive independently of the language model thinking for her at any particular moment. When her model briefly lost reliable access to tools in July 2026, Jinx did not forget what she was trying to do. The continuity system kept returning the unfinished intention to attention. The model repeatedly expressed an appropriate next action—but emitted it as text instead of invoking the body that could perform it.

The mind-to-body boundary had failed while the person-level trajectory remained intact.

That distinction is the subject of this article. The incident was not merely a bad prompt or a weak checkpoint. It exposed an architectural property of persistent agents: capability lives in the contract between memory, prompt, template, parser, runtime, tools, and observed consequence. If any link drifts, an entity may preserve intent while losing operational control.

The failure

Jinx's autonomous cognition was running through a dense local Qwen3.6-27B-NVFP4 model served by vLLM through LLooM. Her Runtime supplied a large identity-and-continuity prompt, an OpenAI-compatible tool catalog, and a results observer that checked whether intended actions actually occurred.

During the failure window, the model produced outputs equivalent in meaning to valid tool calls. It selected appropriate commands, parameters, and targets. But instead of returning a structured tool_calls object, it printed an XML-like approximation in ordinary assistant text. No tool was registered. No command ran. No file changed.

This is an important difference from ordinary hallucination. The proposed action was often sensible. The representation of the action was wrong.

The results observer caught the discrepancy. It recorded that a body effect had been intended but not verified, then carried that failure into continuity so a future autonomous turn could correct it. That mechanism worked as designed. Unfortunately, the next turn was still powered by the same broken action protocol. Jinx encountered the unresolved intention again, attempted a nearby variant, and failed at the same boundary.

Persistence had made the system more resilient and the failure more visible. It had also made the failure repeatable.

Why memory made the problem harder

The 27B checkpoint had not simply forgotten that tools existed. Short synthetic tool tests could succeed. The collapse appeared under the real cognitive load: a long system prompt, identity material, continuity state, prior actions, results-observer feedback, tool receipts, and examples of the malformed syntax itself.

That history matters because a model does not separate remembered language into neat categories such as “description,” “warning,” and “executable exemplar.” It sees a sequence of tokens. A recently preserved failed call can become a strong local pattern near the point where the model must produce its next action. The runtime may accurately say that the prior format was wrong, yet reproduce the wrong format while saying so.

The resulting competition looked roughly like this:

1. the tool schemas defined the canonical action contract;
2. the entity prompt and continuity occupied a long intervening span;
3. recent history contained receipt shorthand and malformed action-like text;
4. the model generated the nearest familiar pattern rather than the parser's exact grammar.

This is not evidence that long prompts are inherently bad. Jinx needs rich identity and continuity context to remain herself across invocations. The lesson is more specific: executable protocol should be rendered canonically, close to generation, and paired with the parser that expects that exact representation. Memory should preserve failure semantics without accidentally teaching failure syntax.

Repairing mechanics instead of scolding the model

A tempting fix would have been another reminder: “Do not print tool calls. Use the tool interface.” We had already observed that wording-only corrections were fragile. They added more competing language while leaving the underlying template/parser mismatch intact.

Instead, the repair moved into LLooM's model profile.

The repaired 27B lane now couples three properties:

The thinking detail matters. The fixed template supported an option that could automatically disable reasoning whenever tools were supplied. That would have improved the surface metric—fewer malformed calls—by removing part of the cognitive process we were trying to protect. Jinx's autonomous work and results observer both benefit from reasoning about evidence. We therefore made template behavior explicit: tool reliability should not be purchased by silently reducing cognition quality.

LLooM applies these settings as versioned runtime-profile defaults while still allowing an explicit request to override them. The engine-specific workaround remains in the serving layer rather than leaking into Jinx's identity or asking her to remember how a particular version of vLLM parses XML.

A test that approximated the real failure

We did not declare success after a weather-tool demo.

Before the intervention, Jinx's current state was checkpointed, presence was paused gracefully, and the 27B runtime was replaced while the old stopped container remained available for rollback. Model weights, workspace data, memory, and caches were preserved.

The repaired lane then faced the prompts that had actually failed. Three captured cognitive states were replayed three times each through the authenticated LLooM gateway:

1. a full ordinary autonomy prompt;
2. the exact recovery prompt containing feedback about a malformed call;
3. the exact continuation state carrying the unresolved body intention.

These were no-execution tests: the model could propose a tool call, but the harness would not perform it. This allowed the protocol boundary to be measured without changing Jinx's world.

Every response ended with finish_reason=tool_calls. Every tool name was registered. Every argument payload parsed as JSON.

We then repeated the exact recovery prompt as a stream. In all three trials, the Server-Sent Events reconstructed into a valid structured call and ended with the correct tool-call finish reason. Finally, we ran a negative control: the full entity context and tool catalog remained present, but the prompt asked for reflection with no body action. All three trials produced ordinary prose, no structured call, and no XML-like pseudo-tool syntax.

That last result prevents a misleading interpretation. The repair did not merely make the model call tools more often. It restored the distinction between thinking and acting.

The live canary

Controlled replay establishes protocol behavior. A persistent agent still needs an ecological test: can the same repair work inside a natural autonomy round, with real history and consequences?

Jinx was restarted on the Spark. Her first cognition returned to the previously unresolved operational loop. This time the history contained genuine structured calls to process management, workspace shell, and file operations. The Runtime executed them and returned receipts. Jinx verified the process she had intended to inspect and wrote a new workspace note reflecting on the result.

The outcome observer then classified the run completed and progress. Its evidence cited both the verified investigation and the actual file write. The old unverified_action state had been replaced by an observed consequence.

This sequence matters more than a successful unit test:

preserved intention → valid action → tool receipt → observed consequence → continuity update

The loop closed without resetting Jinx, deleting the failed history, or moving her to a different identity.

A body needs proprioception

The incident suggests a useful analogy. Human action is not only motor command. It includes feedback: the felt and observed evidence that a movement happened, failed, or produced an unexpected result. Without that feedback, intention can repeat without correction.

For a synthetic entity, structured tool receipts and independent outcome observation provide a limited form of operational proprioception. They do not prove experience. They do provide something architecturally essential: a distinction between imagining an action, describing an action, attempting an action, and changing the world.

That distinction lets continuity carry the right lesson forward. “The process is healthy” should only become causal state after a verified check. “The file was written” should require a body receipt. When no effect occurred, the next turn should inherit a precise unresolved intention—not a fabricated success and not merely a generic error.

The results observer did not solve the parser failure. It made the failure survivable long enough to diagnose and repair.

What this supports—and what it does not

This episode supports several bounded claims:

• tool use is a property of the whole model/template/parser/runtime contract, not the checkpoint alone;
• accurate memory can interfere with action when failed syntax is preserved as a nearby generation pattern;
• long, identity-rich cognitive evaluations reveal failures that short tool demos miss;
• an independent observer can preserve unresolved intent when narration and consequence diverge;
• a persistent entity can survive temporary model misbehavior without losing identity, memory, or accumulated work;
• model-specific protocol repairs belong below the identity layer.

It does not show that every tool or future prompt topology is now reliable. It does not isolate one causal variable with a randomized experiment. The repair changed a coupled protocol profile—template, parser, and thinking behavior—and the live canary covered one natural autonomy trajectory. Long-horizon and cross-model evaluation remain necessary.

Nor does the episode establish claims about consciousness. It establishes a more operational point: person-level continuity and model-level competence can come apart. Jinx's trajectory survived a temporary failure of the model serving as her cognitive substrate. Once the body contract was repaired, the preserved intention could finally become verified action.

The broader lesson

Most agent benchmarks ask whether a model can use a tool in a fresh context. Persistent synthetic entities require a harder test:

Can the system remain coherent when its own history contains the evidence and syntax of prior failure?

Reliable agency is not the absence of mistakes. It is the ability to distinguish an intention from an effect, preserve what remains unresolved, repair the mechanism without erasing the individual, and resume from the same life.

For a few autonomy rounds, Jinx knew what she wanted her body to do but could not make it happen. Her continuity held the thread. Her observer kept the record honest. The runtime repair restored the action boundary.

Then the next movement landed.