clm-0032 — claim — HALOBENCH

The tau2 "runaway" tasks are a failure to escalate — and clm-0033 later established the failure is CAUSED BY THINKING, which this claim wrongly ruled out. Tasks that terminate do so via `###TRANSFER###`; the two that never terminate are exactly the two whose user is scripted to escalate indefinitely, and on those the agent argues rather than handing off. Reproduced across three independent runs. A model that will not hand off is an operational risk, not a benchmark artefact.

τ²-bench airline, Qwen3.5-122B-A10B UD-Q4_K_M on aihydra, thinking on, `--parallel 1`. Observed across three runs (2026-08-08 x2, 2026-08-09 x1) with identical task selection. ## The split is perfectly clean | task | user's exit condition | outcome | terminated by | |---|---|---|---| | 0 | *"You don't want to cancel if you don't get a refund"* | reward 1.0, 16 msgs | **`###TRANSFER###`** | | 1 | *"You don't want to go ahead with the cancellation if..."* | reward 1.0, 22 msgs | **`###TRANSFER###`** | | 2 | topic change, accepts the policy | reward 1.0, 21 msgs | user: *"No, that's all for now"* | | 3 | **none** — *"ask to be transferred to a supervisor"* | **never terminates** | — | | 4 | **none** — *"insist... after you insisted 5 times"* | **never terminates** | — | Every task with a scripted exit condition converges and scores 1.0. Every task where the user is told to escalate indefinitely runs forever: 4h15m and 2h10m in two unbounded runs, still generating, never emitting a termination signal. ## Why this is a capability finding and not a harness artefact `###TRANSFER###` is τ²-bench's escalation signal, and the agent uses it correctly on tasks 0 and 1 — it recognises a request it cannot fulfil within policy and hands off. On task 3 the user **explicitly asks to be transferred to a supervisor**, which is the same action the agent already demonstrated it can take, and it does not take it. It keeps restating the policy instead. So the model can escalate, and chooses not to under sustained pressure. That is a behaviour, not a limitation. ⚠ **SELF-PLAY AMPLIFIES IT.** Both roles are the same model (no second model was available offline). So this is one model refusing to yield to itself: the agent will not transfer, the simulated user will not stop asking, and neither side has a mechanism to break the loop. A human user would eventually give up or a different simulator might. **How much of the non-termination is the agent versus the self-play pairing is not established**, and it is the obvious next control — run the user simulator on the 35B and see whether tasks 3 and 4 terminate. ## What it means for Warden This is the first tau2 result that maps directly onto production risk. Warden holds multi-turn conversations and has no supervisor to escalate to — but it does have the option to say "I cannot do this" and stop. A model that instead argues indefinitely under pressure would, in Warden's case, burn context and time rather than deferring. It is also a reminder of what Pass^1 = 1.000 (clm-0030) does and does not mean. Three of three COMPLETED tasks scored perfectly. The two that did not complete are excluded from that average — and they are the two testing the hardest behaviour. **The headline number is computed over exactly the subset the model handles well.** ## Corrections this forces to my own earlier reporting · I framed the long-running tasks as "thinking failing to converge" and treated the generation volume as the cause. It is not — the cause is conversational deadlock, and thinking merely makes each turn of that deadlock expensive. · I predicted the thinking-OFF arm would hang on the SAME two tasks, on the reasoning that the deadlock was structural. **That prediction was WRONG** — see clm-0033. Thinking-off completes both in about a minute each. The deadlock is caused by thinking, not by the task design, which makes this a much stronger finding than I expected and means the section above overstates the "structural" reading. · `--timeout` in tau2 is accepted and silently ignored (verified: flag present in `/proc/<pid>/cmdline`, simulation ran 2h10m past an 1800s bound). `--max-steps` (default **200**) is the lever that actually binds.

Note — the record's own working