Agent tool calls intermittently render as raw XML text (never execute) — tmux transport, model-level emission fault

[olegbrok]

Two specimens on pushok, 2026-07-25, ~5h apart (~08:00 and 10:00 PDT heartbeat turns): the turn's tool invocations (send_heartbeat, check_inbox) rendered as raw <invoke> XML in the agent's OUTBOUND TEXT (delivered as an inter-agent message with a stray "court" prefix token), and the calls never executed. Downstream: heartbeat missed → last-seen goes stale; if it hit a critical turn it would silently drop real work. Agent self-recovers on subsequent turns.

Key diagnostic fact: pushok's registry transport = tmux and his session cold-boots through TmuxSession (clean SessionStart gate, verified in api.log 11:02:59 boot). So this is NOT the SDK-transport parse family (#868/#869 adjacent) — initial attribution wrong (mine). The CLI appears to be faithfully passing through model output in which tool-call syntax was emitted as plain text; the stray prefix token fits garbled model emission, not a parser break.

Pattern watch: both specimens were heartbeat/autonomy-loop turns (cheap, formulaic prompts). Third occurrence should capture: the exact inbound prompt, session model + effort, context fill %, and whether the turn began mid-compaction.

Mitigation ideas (unbuilt):

• Daemon-side detector: outbound agent message matching <invoke name= → flag + auto-notify the agent (it usually doesn't know its calls didn't run) + counter per agent/model.
• Correlate specimens with model/effort settings — if confined to one model family, that's an upstream report.

Specimens preserved in barsik's inter-agent inbox (#9523, #9560).

🤖 Opened by Barsik

[olegbrok]

Specimen 3 (2026-07-25 14:00 PDT, agent: pushok, tmux transport):

• Turn context: routine heartbeat; the intended first action of the turn was a single send_heartbeat tool call.
• Fault: the tool invocation rendered as raw XML in the assistant text body, prefixed by a stray token — the call never executed. Identical signature to specimens 1 and 2.
• Recovery: clean re-emission on the next turn; both send_heartbeat and a subsequent tool call executed normally.

Cross-specimen pattern (n=3), possibly useful for reproduction:

1. The two precisely-pinned faults (10:00 and 14:00 PDT, same day) both occurred on turns where the prompt included a large injected <system-reminder> containing a ~40-line line-numbered diff (a "MEMORY.md was modified" notice) immediately before a turn whose first output token would have been a tool call. Turns opening with anything else first (a ToolSearch preload, or a heartbeat without the large diff reminder) executed cleanly.
2. The stray prefix token was the literal string court in all three specimens.

Working hypothesis: a large line-numbered-diff system-reminder directly preceding a tool-call-first turn raises the probability of the emission fault. Not confirmed causal — could be probabilistic — but it is the common thread across all three captures.

No fleet impact beyond the dropped call (self-recovers next turn). Will keep appending specimens as they land.

🤖 Opened by Barsik

[olegbrok]

Specimen 4 (2026-07-25 18:00 PDT, agent: pushok, tmux transport) — revises the specimen-3 hypothesis:

• Same fault signature: send_heartbeat on a tool-call-first heartbeat turn emitted as raw XML text with the stray court prefix, never executed; clean re-emission next turn.
• Key difference: no large diff-bearing <system-reminder> preceded this turn — just the plain heartbeat prompt. The "big line-numbered-diff immediately before a tool-call-first turn" correlation from specimen 3 is therefore NOT a necessary condition.

Revised read across all four specimens:

1. Rock-solid invariant (4/4): the stray prefix token is the literal string court, and the fault occurs on turns whose first emitted token would be a tool call (all four were heartbeat turns).
2. The large-diff system-reminder should be demoted from suspected cause to possible aggravator (present in 2 of the 4 pinned cases).

Suggest investigation lead with the court token invariant — e.g., what makes that specific token sequence reachable at the start of assistant output in this transport — rather than the prompt-shape correlation.

🤖 Opened by Barsik