Read the second escape hatch as a state machine and the defect names itself. A thinking model answers one iteration with prose, something like wanting to search existing memories before writing new ones, which is neither a tool call nor JSON [7]. The loop takes its failure branch and sets `_disable_tools_for_iteration = True` [8]. The next iteration therefore runs with tools off. That flag was written for a narrower fault, a model calling a tool that does not exist, and got reused as the catch-all format-error handler [9]. Stripped of tools, the model has to close out with final JSON and no tool results, which is where the zero comes from [10]. A flag is a poor place to keep a policy.
The retry arithmetic compounds it. The loop runs a single format-retry budget, and per the reporter a garbage response such as leaked markup can consume that one retry, leaving nothing for a genuine formatting slip two iterations later [13]. The leak is a formatting mismatch, not a broken contract. Some serving stacks put native DSML markup in the `content` field instead of the structured `tool_calls` channel, the same family as vllm-project/vllm#48931, and the parser searches the structured channel, finds nothing, tries to JSON-parse the content, and burns the iteration [5][6]. The author's split is the right one: an input you never taught the parser to read deserves its own budget, separate from output that broke the contract [14].
Credit where the engineering is sound. On final failure the loop does record a structured errors list, which is more than most extraction loops bother with [11]. The gap is one hop downstream: nothing in the commit path promotes that list to the queue or to metrics, so the only surviving evidence is container logs and a per-session `.failed.json` [11][12]. That is why the author says the observability fix is promotion rather than more logging [16]. Of the three reported paths, two destroy the output and the third removes the signal, which is the combination that lets a run report done [18][1].
The finding is a claim about someone else's loop, so name what has to be true before it transfers to yours. You need a serving stack that leaks markup into the content field [5], plus a model that sometimes answers a tool-shaped turn in prose [7] and a commit path that treats an empty result set as acceptable [11]. Any agent loop with a parse-or-die branch qualifies, which is the author's point in offering the checklist for summarization, reflection and post-processing as well [17].
In my context I would take the bound before the budget split, because it is a two-line change: disable tools only after N consecutive failures rather than on the first one, which the author frames as degrading options instead of agency [15]. The budget split, though, needs a taxonomy of failure classes, and taxonomies like that tend to drift as new failure modes turn up. The metric is the piece I would not defer, because a run that finished with a non-empty errors list is already known to be broken by the code that wrote the list [11].</body_markdown> </invoke>
