Paper deep dive
Of Errors and Echoes: Responsibility-Aware Credit Assignment for Tool-Use Agents
Xingjian Diao, Tianyu Yang, Wenjun Huang, Xiangchi Yuan, Chunhui Zhang, Xingchen Zhao, Weiyi Wu, Haotian Xu, Soroush Vosoughi, Xiangliang Zhang, Jiang Gui
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Reinforcement learning improves tool-use agents, yet fine-grained credit assignment remains challenging even with step-level feedback. An observed error may be inherited from an earlier decision, while multiple responsible decisions may share the same downstream consequence or participate in later recovery. We introduce Error-Chain-Aware Optimization (ECHO), a responsibility-aware credit assignment framework that separates responsibility identification from credit allocation. A frozen judge combines retrospective trajectory analysis with decision-time assessment from the policy-visible prefix to distinguish newly introduced errors, inherited consequences, missed corrections, and successful corrections. ECHO then counts shared downstream consequences once across responsible decisions and constrains rewards for repairing self-induced errors through source-funded recovery, producing bounded action-level supervision alongside terminal supervision. Experiments on six diverse tool-use benchmarks at both 4B and 8B scales show strong and consistent improvements over the compared baselines, with ECHO achieving the highest score on five of six benchmarks at each scale. These results support decision responsibility as a useful basis for fine-grained credit assignment in tool-use agents. Our code is available at this https URL.
Tags
Links
- Source: https://arxiv.org/abs/2610.16027v1
- Canonical: https://arxiv.org/abs/2610.16027v1
Trouble viewing inline? Open PDF directly →
Full Text
106,525 characters extracted from source content.
Expand or collapse full text
Of Errors and Echoes: Responsibility-Aware Credit Assignment for Tool-Use Agents Xingjian Diao Email: xingjian.diao.gr@dartmouth.edu Tianyu Yang Email: tyang4@nd.edu Wenjun Huang Affiliation: University of California, Irvine Xiangchi Yuan Affiliation: Georgia Institute of Technology Chunhui Zhang Affiliation: Dartmouth College Xingchen Zhao, Weiyi Wu, Haotian Xu, Soroush Vosoughi, Affiliation: Dartmouth College Affiliation: Northeastern University Affiliation: Independent Researcher Xiangliang Zhang, Jiang Gui Affiliation: University of Notre Dame Abstract Reinforcement learning improves tool-use agents, yet fine-grained credit assignment remains challenging even with step-level feedback. An observed error may be inherited from an earlier decision, while multiple responsible decisions may share the same downstream consequence or participate in later recovery. We introduce Error-Chain-Aware Optimization (ECHO), a responsibility-aware credit assignment framework that separates responsibility identification from credit allocation. A frozen judge combines retrospective trajectory analysis with decision-time assessment from the policy-visible prefix to distinguish newly introduced errors, inherited consequences, missed corrections, and successful corrections. ECHO then counts shared downstream consequences once across responsible decisions and constrains rewards for repairing self-induced errors through source-funded recovery, producing bounded action-level supervision alongside terminal supervision. Experiments on six diverse tool-use benchmarks at both 4B and 8B scales show strong and consistent improvements over the compared baselines, with ECHO achieving the highest score on five of six benchmarks at each scale. These results support decision responsibility as a useful basis for fine-grained credit assignment in tool-use agents. Our code is available at https://github.com/xid32/ECHO. † ∗Equal contribution, listed in random order.† †Corresponding authors. Figure 1: ECHO on an error chain. Left: Responsibility depends on decision-time visibility: Step 2 inherits the error before the mismatch is visible, while Step 3 misses a correction after disclosure. Right: Credit allocation counts the wrong-item consequence once across Steps 1 and 3 and funds Step 4’s repair credit from Step 1. 1 Introduction Tool-use agents retrieve information and modify environments through sequential decisions (Yao et al., 2022; Schick et al., 2023; Qin et al., 2024), where each tool call shapes the state and constraints that later calls depend on (Zhou et al., 2024a; Yao et al., 2024; Lu et al., 2025). Reinforcement learning can improve such agents (Wang et al., 2025b; Qian et al., 2026), but terminal rewards indicate only whether a trajectory succeeds, not which decisions led to the outcome. Step-level or process-level feedback localizes where errors occur (Lightman et al., 2024; Wang et al., 2024; Zhang et al., 2025b; Zheng et al., 2025), yet the step at which an error surfaces need not be the decision responsible for it: an error may be inherited from an earlier decision, multiple responsible decisions may share a downstream consequence, and later decisions may repair the error. These dependencies raise two questions: (i) which decisions are responsible, and (i) how credit should be allocated among them. Figure 1 illustrates both questions. The user asks for item A and requires payment by gift card only, but the agent selects item B with identifier K72 (Step 1), checks the stock of K72 (Step 2), keeps using it after the mismatch is disclosed (Step 3), restores item A only later (Step 4), and finally pays by credit card (Step 5). Steps 2 and 3 show that responsibility depends on decision-time visibility: both act on the wrong item, but only Step 3 acts after the mismatch is visible, so Step 2 is an inherited consequence whereas Step 3 is a missed correction. Steps 1, 3, and 4 show why credit must be allocated across the error chain rather than independently to each step. Steps 1 and 3 contribute to the same wrong-item consequence, so charging each the full penalty would count it twice. Step 4 deserves repair credit, but if that credit is decoupled from the source error, the policy may profit from creating and then fixing its own mistake. Step 5, by contrast, is a separate error with its own consequence. We formalize these cases as four responsibility events. A newly introduced error (New) creates a deviation from a task requirement that visible information should have prevented. An inherited consequence (Inh) carries forward an earlier deviation before the discrepancy becomes visible. A missed correction (Miss) leaves a visible, correctable deviation unaddressed. A successful correction (Corr) verifiably restores a violated requirement or required precondition. In Figure 1, Steps 1–4 illustrate these events in order, while Step 5 introduces another New error. Beyond this example, we map diagnostics from our six evaluation benchmarks to the evidence each event requires (§G) and show all four events in untrained-policy trajectories (§I.1). To address both questions, we introduce ECHO (Error-CHain-Aware Optimization), which assigns credit across error chains rather than to independent steps. For responsibility identification, a frozen judge uses the full trajectory only to propose candidate events and verify error propagation and successful repair, while each selected action is judged from its policy-visible prefix, preventing hindsight leakage. For credit allocation, shared-consequence accounting charges each consequence once across its responsible decisions, and source-funded recovery limits repair credit to a budget derived from the source error’s penalty. The resulting bounded action-level corrections are optimized alongside the terminal reward. Our contributions are: • We identify that the step where an error surfaces need not be the decision responsible for it, and formalize this with four responsibility events: newly introduced errors, inherited consequences, missed corrections, and successful corrections. • We propose ECHO, which assesses responsibility at decision time and allocates credit over error chains, addressing hindsight leakage, double counting of shared consequences, and over-crediting self-repair. • At both 4B and 8B, ECHO leads the compared methods on five of six tool-use benchmarks, with case studies illustrating behavioral improvements and ablations supporting each component. 2 Related Work Tool-Use Agent Learning. Reinforcement learning has substantially improved tool-use agents through reward design, multi-turn rollouts, and simulated users (Qian et al., 2026; Feng et al., 2026a; Zhao et al., 2025; Dong et al., 2026; Zhou et al., 2024b; Wen et al., 2024; Luo et al., 2025), as well as through scaled training environments (Song et al., 2026; Wang et al., 2026b; Wang et al., 2025a; Li et al., 2025). These methods primarily optimize trajectory-level outcomes or scale the environments used for training. ECHO is complementary, addressing how supervision is distributed across individual agent decisions when errors propagate, become observable, or are later corrected. Process Supervision and LLM Critics. Step-level feedback provides denser supervision than terminal rewards (Lightman et al., 2024; Wang et al., 2024; Zhang et al., 2025b; Zheng et al., 2025), and reward models and LLM critics extend this idea to search and tool-use agents (Xia et al., 2025; Li et al., 2026b; Xi et al., 2026; Tan et al., 2025; Tan et al., 2026; Zhou et al., 2025; Zhang et al., 2026). Such signals localize problematic steps, but localization alone does not establish decision responsibility: an observed error may be inherited from an earlier decision, and judging a decision with later evidence can penalize it for information unavailable when it was made. ECHO therefore uses the full trajectory only to propose candidate events and verify propagation or restoration, assessing each decision independently from its policy-visible prefix. Credit Assignment and Error Attribution. Beyond identifying responsible decisions, a complementary question is how delayed outcomes should be allocated among them. Reward redistribution and recent agent methods estimate step or turn contributions from delayed returns, trajectory structure, counterfactual rollouts, or turn-level value estimates (Arjona-Medina et al., 2019; Meulemans et al., 2023; Zhang et al., 2023; Feng et al., 2026b; Li et al., 2026a; Wang et al., 2026a; Gandhi et al., 2026; Meng and Chen, 2026; Tao et al., 2026; Liao et al., 2026; Zhan et al., 2026), while failure-attribution studies identify root-cause errors for post-hoc diagnosis (Zhang et al., 2025a; Zhu et al., 2025). Conceptually related to structural accounts of responsibility (Chockler and Halpern, 2004), ECHO explicitly separates responsibility identification from credit allocation: shared-consequence accounting counts each consequence once across its responsible decisions, and source-funded recovery bounds self-induced repair credit by the budget of its originating error. Figure 2: Overview of ECHO. (a) Full-trajectory review proposes candidate events, propagation links, and restoration evidence, while decision-time assessment classifies each selected action as New, Inh, Miss, or Corr. (b) Shared consequences are counted once across responsible actions, then weighted, normalized, and adjusted by source-funded recovery to yield signed action-level corrections δt _t. (c) Terminal and local supervision are optimized through separately clipped outcome-level and action-level branches with KL regularization. 3 ECHO ECHO complements the terminal reward with action-level corrections δt _t (Figure 2, Algorithm 1). A frozen judge classifies selected actions as New, Inh, Miss, or Corr using decision-time context (§3.2); ECHO then counts each shared penalty once, caps self-induced repair credit by its source penalty (§3.3–3.4), and optimizes δt _t alongside the terminal advantage (§3.5). In Figure 1, Steps 1 and 3 split the wrong-item penalty, Step 2 receives no local correction because it is an inherited consequence (Inh), Step 4’s repair credit is funded by Step 1’s penalty, and Step 5 is charged separately. Algorithm 1 One ECHO update 1: policy πθ _θ, frozen judge J, batch of tasks 2: Sample G trajectories per task; record RiR_i and hi,th_i,t 3: for each trajectory i do 4: Propose events, links, and restorations from the full trajectory 5: for each selected action t (≤K≤ K) do 6: Assess type z from decision-time context only 7: end for 8: Retain events passing structural checks and geg_e 9: Allocate and weight events Eqs. (3)–(6) 10: Normalize into budgets besb_e^s Eq. (7) 11: Cap self-induced repair credit Eqs. (8)–(9) 12: Aggregate corrections δi,t _i,t Eq. (10) 13: end for 14: Compute AioutA_i^out and optimize JECHOJ_ECHO Eqs. (11)–(15) 3.1 Problem Setup and Responsibility Events Trajectory i of policy πθ _θ on task x consists of actions ai,ta_i,t, observations oi,to_i,t, and terminal reward RiR_i. The decision-time context hi,th_i,t records the information visible to the policy before ai,ta_i,t, after any context truncation or memory retrieval. We represent checkable task requirements as predicates f∈ℱxf _x, such as the requested item and the gift-card rule in Figure 1. The judge outputs responsibility events e=⟨t,f,d,z⟩,e= t,f,d,z , (1) where t is the assessed action, f the affected predicate, d the deviation origin (self-induced, authenticated external, or unknown), and z the responsibility type. Each event also stores supporting evidence pointers and, for a missed correction, a feasible alternative response (§A). A single action may produce multiple events, for example by repairing one predicate while violating another; their action-level coefficients are aggregated in Eq. (10). 3.2 Responsibility Identification from Decision-Time Prefixes Responsibility types. Local responsibility is assessed from evidence visible in hi,th_i,t. ❶ A newly introduced error (New) is a distinct decision defect evident from a fact or constraint visible to the policy. ❷ A missed correction (Miss) requires an existing deviation, visible evidence of the discrepancy, and a feasible permitted response that the action fails to take. ❸ An inherited consequence (Inh) reflects an earlier deviation with explicit provenance but involves neither a new defect nor a missed correction. ❹ A successful correction (Corr) is a legitimate response to a visible deviation, with execution evidence confirming restoration of the predicate or a required precondition. Unverified repair claims receive no positive credit. Actions without events retain only terminal supervision, and for external failures ECHO assesses only the agent’s response to the incident. Duplicate events are merged, while ambiguous or conflicting labels resolve to a single supported type or abstention. Independent prefix assessment. The judge plays two roles. Given the full trajectory, it proposes candidate events, propagation links, and restoration evidence. For at most K selected actions, it then independently assesses responsibility from (hi,t,ai,t)(h_i,t,a_i,t) and the tool contracts visible at that time, without access to the proposals, hidden state, or future observations. Under fixed decoding, the local assessment of a selected action is therefore invariant to the trajectory’s suffix. Hindsight informs candidate selection, propagation links, restoration evidence, and event weighting, but not the decision-time responsibility judgment. We set K=8K=8, with up to six proposed actions and two non-proposed sentinels that probe for missed events (§A). Selective supervision. Each event must pass structural checks on its evidence pointers, visibility, temporal order, provenance, and nonempty policy span. A binary gate geg_e further admits only evidence strata whose semantic error rate, estimated from independent annotations, falls below a calibrated bound (§B). Events that fail either check receive only terminal supervision. 3.3 Shared-Consequence Accounting Constraint-impairment proxy. Before inspecting outcomes, a fixed task adapter extracts nonredundant requirement predicates ℱxF_x from public instructions and tool contracts, with masses ωf _f that sum to one and are uniform by default. Predicate versions and primitive subfacts share the mass of their underlying requirement; obligations outside this inventory contribute only through the direct-defect term below. Repeated manifestations of the same predicate’s impairment form one consequence c with mass Mc=ωf(c)sc,∑cMc≤1,M_c= _f(c)s_c, _cM_c≤ 1, (2) where severity scs_c is 00 for unconfirmed, 1/21/2 for reversible, and 11 for terminal or irreversible impairment. Recovery does not erase the source defect or reduce its recorded maximum severity. Divisible ownership. Let PcP_c contain the responsibility slots linked to consequence c, including uncertified slots. After reserving a fraction ζc _c for uncertain provenance, each slot receives an equal share: aec=1−ζc|Pc|,e∈Pc,|Pc|>0,0,otherwise,a_ec= cases 1- _c|P_c|,&e∈ P_c,\ |P_c|>0,\\ 0,&otherwise, cases (3) where ζc _c is 00 for complete recorded provenance, 1/21/2 for unresolved additional sources, and 11 for unsupported or conflicting ownership. The reserved fraction and the shares of rejected events are not reassigned. Because one trajectory cannot identify each decision’s causal contribution (§C.4), ECHO adopts equal shares as a neutral convention: in Figure 1, the source error at Step 1 and the missed correction at Step 3 each bear half of the wrong-item consequence, so it is counted only once. Event weights. For a negative event, ℓ^e−=κιe+(1−κ)∑cMcaec, _e^-=κ\, _e+(1-κ) _cM_ca_ec, (4) where ιe∈0,1 _e∈\0,1\ indicates a certified distinct decision defect and 0<κ≤10<κ≤ 1. The direct term counts each certified defect once, including defects that are later repaired. For a successful correction r, let first-restoration shares zrcz_rc satisfy ∑rzrc≤1 _rz_rc≤ 1, and define ℓ^r+=κ+(1−κ)∑cMczrc. _r^+=κ+(1-κ) _cM_cz_rc. (5) Let ℱe⊆ℱxF_e _x contain the predicates reached from event e through validated propagation links, namely explicit reuse of corrupted values or invalidated conditions. For corrections, ℱeF_e is restricted to the repaired origin’s footprint. For either event direction, pe=∑f∈ℱeωf,ve=geℓ^e[1+αpe],p_e= _f _e _f, v_e=g_e _e[1+α p_e], (6) where ℓ^e _e denotes the corresponding negative-event or correction base weight and 0≤α≤10≤α≤ 1. Since pe≤1p_e≤ 1, propagation increases an event’s weight by at most a factor of 1+α1+α. 3.4 Source-Funded Recovery Budgets Let ℰi−E_i^- contain the admitted New and Miss events of trajectory i, and ℰi+E_i^+ its execution-verified Corr events. Inh and abstained events receive no auxiliary budget and retain only terminal supervision. Weights are normalized into directional budgets bes=λsvemax1,∑u∈ℰisvu,s∈−,+,b_e^s= _s v_e \1, _u _i^sv_u\, s∈\-,+\, (7) so that each direction totals at most λs _s, while weight sums below one retain their original scale. Source-funded recovery. Without further constraints, a policy could earn positive credit by repairing errors it introduced itself. ECHO therefore funds such repairs from the penalty assigned to their source. For a self-induced origin d, the source penalty is Dd=∑e:ze=New,d(e)=dbe−,D_d= _e:\,z_e= New,\,d(e)=db_e^-, (8) with each New charge assigned to exactly one origin. Let ℛdR_d contain the eligible restorations of origin d, with total provisional credit Bd+=∑r∈ℛdbr+B_d^+= _r _db_r^+. For Bd+>0B_d^+>0, set γd=min1,ηDd/Bd+ _d= \1,η D_d/B_d^+\, and otherwise set γd=0 _d=0. The paid correction coefficients are b~r+=γdbr+,d self-induced,br+,d authenticated external,0,otherwise, b_r^+= cases _db_r^+,&d self-induced,\\ b_r^+,&d authenticated external,\\ 0,&otherwise, cases (9) where 0<η≤10<η≤ 1 bounds self-induced repair credit to a fixed fraction of its source penalty. Partial repairs of the same origin share this budget, unused credit is discarded, and each authenticated external incident permits one recovery entitlement. In Figure 1, Step 1’s penalty funds the repair at Step 4, while the payment violation at Step 5 is charged separately. Action-level corrections. Aggregating events on each action yields δi,t=∑r∈ℰi,t+b~r+−∑e∈ℰi,t−be−, _i,t= _r _i,t^+ b_r^+- _e _i,t^-b_e^-, (10) so that ∑t|δi,t|≤λ−+λ+ _t| _i,t|≤ _-+ _+. The resulting δi,t _i,t enters the local objective (§3.5) without further rescaling. Positive and negative event records are retained even when their coefficients cancel on the same action. Overall score Model BFCL-v3 BFCL-v4 τ-bench τ2τ^2-Bench ToolSandbox ACEBench 4B Qwen3 (Yang et al., 2025) 25.38 38.61 33.44 15.83 52.89 55.28 EnvScaler (Song et al., 2026) 37.25 52.92 48.78 33.05 62.25 63.33 Arctic-AWM (Wang et al., 2026b) 38.89 49.55 26.58 22.57 68.24 60.58 ECHO (ours) 41.24 53.71 50.77 35.81 76.36 62.46 8B Qwen3 (Yang et al., 2025) 28.88 41.58 36.65 26.44 59.74 60.00 EnvScaler (Song et al., 2026) 41.38 54.20 44.22 35.10 68.85 58.33 Arctic-AWM (Wang et al., 2026b) 43.70 52.50 37.64 33.45 60.44 54.93 Klear-AgentForge (Wang et al., 2025a) 37.84 47.88 49.10 35.91 66.06 60.70 MUA-RL (Zhao et al., 2025) 14.63 26.84 43.00 30.20 50.00 53.30 Simia-RL (Li et al., 2025) 41.64 55.72 44.27 40.16 62.25 58.33 ECHO (ours) 49.17 56.91 50.59 40.56 74.42 60.08 Table 1: Overall results on six tool-use benchmarks at the 4B and 8B scales, spanning multi-turn function calling, conversational task completion, and stateful tool execution. For BFCL-v3, we report the overall score on the Multi-Turn (MT) subset. For ACEBench, we report results on the Agent subset. Scores are percentages. Bold and underlined values mark the best and second-best results within each scale. 3.5 Length-Balanced Policy Optimization Let qi,kq_i,k indicate a loss-eligible policy token and mi,t,km_i,t,k its membership in action t, with mi,t,k≤qi,km_i,t,k≤ q_i,k and ∑tmi,t,k≤1 _tm_i,t,k≤ 1 so that local action spans do not overlap. Set Li=∑kqi,kL_i= _kq_i,k and Bi,t=∑kmi,t,kB_i,t= _km_i,t,k. Actions with Bi,t=0B_i,t=0 contribute no local loss, while trajectories with Li=0L_i=0 contribute no policy loss. For trajectories sampled from the same task, the group-relative outcome advantage is (Shao et al., 2024) Aiout=Ri−μxσx+ε,A_i^out= R_i- _x _x+ , (11) where μx _x and σx _x are the mean and population standard deviation of the group rewards and ε>0 >0 is a small constant. Equal-reward groups therefore have zero outcome advantage but may still receive local corrections. Let ρi,k _i,k be the current-to-behavior token likelihood ratio, and define the clipped surrogate (Schulman et al., 2017) ϕϵ(ρ,A)=minρA,clip(ρ,1−ϵ,1+ϵ)A. _ε(ρ,A)= \ρ A,clip(ρ,1-ε,1+ε)A\. (12) ECHO maximizes Jiout J_i^out =1Li∑kqi,kϕϵ(ρi,k,Aiout), = 1L_i _kq_i,k _ε( _i,k,A_i^out), (13) Jiloc J_i^loc =∑t:Bi,t>01Bi,t∑kmi,t,kϕϵ(ρi,k,δi,t), = _t:B_i,t>0 1B_i,t _km_i,t,k _ε( _i,k, _i,t), (14) JECHO J_ECHO =1N∑i[Jiout+Jiloc−βKi], = 1N _i[J_i^out+J_i^loc-β K_i], (15) where KiK_i is the trajectory-mean reference-policy KL penalty and N counts contributing trajectories. Judge outputs, rewards, budgets, and advantages are fixed within each update. The local branch averages over tokens within each action and then sums across actions, so δi,t _i,t is neither diluted by action length nor attenuated by clipping of length-rescaled token advantages. At the behavior policy, the split objective has the same gradient as the additive token advantage Aiout+Li∑t:Bi,t>0δi,tBi,tmi,t,k.A_i^out+L_i _t:B_i,t>0 _i,tB_i,tm_i,t,k. (16) Once ratio clipping activates, opposite-sign outcome and local advantages may fall into different clipping branches, so the split objective can differ from optimizing their combined advantage. Source funding also bounds the local surrogate. For a fixed audited trajectory whose positive events are all self-funded, let Ni−=∑tmax−δi,t,0N_i^-= _t \- _i,t,0\. Then Jiloc≤[(1+ϵ)η−(1−ϵ)]Ni−≤0J_i^loc≤[(1+ε)η-(1-ε)]N_i^-≤ 0 (17) whenever η≤(1−ϵ)/(1+ϵ)η≤(1-ε)/(1+ε) and 0<ϵ<10<ε<1. Under these conditions, repairing self-induced errors cannot yield a net positive local surrogate. This fixed-batch guarantee depends on correct attribution and does not by itself constrain learned behavior under shared policy parameters (§C.3). Optimization and cost details are given in §E. τ-bench τ2τ^2-Bench Model Retail Airline Overall Retail Airline Telecom Overall 4B Qwen3 (Yang et al., 2025) 40.87 26.00 33.44 19.96 21.00 9.43 15.83 EnvScaler (Song et al., 2026) 49.57 48.00 48.78 50.00 36.00 13.16 33.05 Arctic-AWM (Wang et al., 2026b) 30.15 23.00 26.58 30.26 19.00 16.45 22.57 ECHO (ours) 52.03 49.50 50.77 54.09 36.00 17.33 35.81 8B Qwen3 (Yang et al., 2025) 45.79 27.50 36.65 34.43 26.50 18.42 26.44 EnvScaler (Song et al., 2026) 50.43 38.00 44.22 53.51 36.00 15.79 35.10 Arctic-AWM (Wang et al., 2026b) 39.88 35.40 37.64 41.23 38.50 23.47 33.45 Klear-AgentForge (Wang et al., 2025a) 56.70 41.50 49.10 49.42 36.67 21.64 35.91 MUA-RL (Zhao et al., 2025) 56.50 29.50 43.00 49.80 19.00 21.80 30.20 Simia-RL (Li et al., 2025) 51.82 36.71 44.27 52.90 49.00 18.58 40.16 ECHO (ours) 58.17 43.00 50.59 54.63 42.10 24.95 40.56 Table 2: Domain-level results on τ-bench and τ2τ^2-Bench at the 4B and 8B scales. All scores are reported as percentages. Bold and underlined values mark the best and second-best results within each model scale. Model Base Missing Function Missing Parameter Long Context Overall 4B Qwen3 (Yang et al., 2025) 32.00 20.00 24.00 25.50 25.38 EnvScaler (Song et al., 2026) 46.50 38.50 28.50 35.50 37.25 Arctic-AWM (Wang et al., 2026b) 48.55 36.50 34.22 36.30 38.89 ECHO (ours) 50.50 46.58 32.59 35.27 41.24 8B Qwen3 (Yang et al., 2025) 32.00 33.50 22.00 28.00 28.88 EnvScaler (Song et al., 2026) 50.50 41.50 29.50 44.00 41.38 Arctic-AWM (Wang et al., 2026b) 53.40 45.00 32.40 44.00 43.70 Klear-AgentForge (Wang et al., 2025a) 45.86 39.00 34.50 32.00 37.84 MUA-RL (Zhao et al., 2025) 21.00 11.50 15.00 11.00 14.63 Simia-RL (Li et al., 2025) 54.50 36.50 37.54 38.00 41.64 ECHO (ours) 59.50 51.50 40.68 45.00 49.17 Table 3: BFCL-v3 Multi-Turn results across Base, Missing Function, Missing Parameter, and Long Context conditions at the 4B and 8B scales. Overall is the unweighted mean across the four conditions. All scores are reported as percentages. Bold and underlined values mark the best and second-best results within each model scale. 4 Experiments We evaluate ECHO’s overall performance across six tool-use benchmarks at the 4B and 8B scales (§4.2), illustrate responsibility-related behavioral differences between Qwen3 and ECHO through case studies (§4.3), examine its components and reward design through ablations (§4.4, §4.5), and analyze the effects of frozen-judge choice (§4.6). 4.1 Setup Benchmarks and metrics. We evaluate ECHO at the 4B and 8B scales on BFCL-v3 Multi-Turn, BFCL-v4, τ-bench, τ2τ^2-Bench, ToolSandbox, and ACEBench-Agent. BFCL evaluates function calling, with v4 additionally covering web search and memory use (Patil et al., 2025; Mao et al., 2025). We evaluate both τ-bench domains, retail and airline (Yao et al., 2024), and all three τ2τ^2-Bench domains, retail, airline, and telecom (Barres et al., 2025). These conversational benchmarks test policy-constrained task completion, with telecom additionally requiring coordinated agent–user actions. ToolSandbox evaluates intermediate and final state milestones (Lu et al., 2025), while ACEBench-Agent covers multi-step and multi-turn tool use in English and Chinese (Chen et al., 2025). Baselines. Qwen3-4B and Qwen3-8B serve as the base policies at 4B and 8B, respectively (Yang et al., 2025). At 4B, we compare against EnvScaler (Song et al., 2026) and Arctic-AWM (Wang et al., 2026b). At 8B, we additionally compare against Klear-AgentForge (Wang et al., 2025a), MUA-RL (Zhao et al., 2025), and Simia-RL (Li et al., 2025). Training and configuration. ECHO is trained from Qwen3-4B and Qwen3-8B on the τ2τ^2-Bench training split. Training details and hyperparameters are given in §D. The frozen-judge protocol and reliability gating are described in §A and §B. 4.2 Main Results Overall performance. ECHO achieves the best result on five of six benchmarks at both model scales. At 4B, it outperforms the strongest same-scale baseline by 2.35 points on BFCL-v3 Multi-Turn, 0.79 on BFCL-v4, 1.99 on τ-bench, 2.76 on τ2τ^2-Bench, and 8.12 on ToolSandbox. At 8B, the corresponding gains are 5.47, 1.19, 1.49, 0.40, and 5.57 points. ACEBench-Agent is the only benchmark on which ECHO does not lead, trailing the best baseline by 0.87 points at 4B and 0.62 at 8B. The largest gain at both scales is on ToolSandbox, which is not used during training, suggesting that ECHO’s improvements transfer beyond the training environment. Domain-level results. At 4B, ECHO leads or ties the strongest baseline across all five domains. At 8B, it leads τ-bench Retail and Airline by 1.47 and 1.50 points, and τ2τ^2-Bench Retail and Telecom by 1.12 and 1.48 points, respectively. The only exception is τ2τ^2-Bench Airline, where ECHO scores 42.10 versus 49.00 for Simia-RL. ECHO nevertheless achieves the highest τ2τ^2-Bench overall score, 40.56 versus 40.16 for Simia-RL, as its 6.37-point Telecom and 1.73-point Retail advantages over Simia-RL offset the 6.90-point Airline deficit. BFCL-v3 condition-level results. At 4B, ECHO leads on Base and Missing Function by 1.95 and 8.08 points, respectively, but trails the strongest baseline by 1.63 points on Missing Parameter and 1.03 on Long Context. At 8B, ECHO leads all four conditions, with gains of 5.00 points on Base, 6.50 on Missing Function, 3.14 on Missing Parameter, and 1.00 on Long Context. This advantage extends to all four conditions at 8B, whereas at 4B it is concentrated in Base and Missing Function. 4.3 Case Studies Figure 3 compares Qwen3 and ECHO on matched task requirements; Clean indicates no responsibility event for the assessed requirement (§G.1). In (a), Qwen3 replaces the requested Action genre with dontcare, a New error, while ECHO preserves all filters. In (b), Qwen3 repeats a path already rejected by mv, missing an available correction, while ECHO uses the accepted directory name directly. In (c), after a failed send, both models enable cellular service, but only ECHO resends and receives a new message identifier, whereas Qwen3 claims delivery without resending. These cases reflect ECHO’s supervision: penalizing New and Miss while crediting eligible, verified corrections (§3.4). Additional cases are provided in §I. Figure 3: Case studies comparing agent behavior before (Qwen3) and after (ECHO) training on the same task. 4.4 Component Ablation Figure 4: Ablation of ECHO components on τ2τ^2-Bench and BFCL-v3 Multi-Turn at the 8B scale. Figure 4 presents one-component-at-a-time ablations of ECHO. w/o Prefix Assessment omits independent prefix assessment; w/o Shared Consequence assigns full consequence mass to each event; w/o Source-Funded Recovery removes source-funded recovery constraints; and w/o Reliability Gate disables calibrated semantic filtering. All four ablations reduce performance on both benchmarks, with a consistent ordering of drops. Removing prefix assessment causes the largest degradation, suggesting a central role for decision-time responsibility, whereas removing source-funded recovery has the smallest effect. 4.5 Reward Ablation Figure 5: Reward ablation on τ2τ^2-Bench at the 8B scale. Each group compares five supervision configurations, and Overall denotes the mean across the three domains. At the 8B scale, we compare ECHO with Final Reward Only, Random One Error, First Error, and All Errors. Final Reward Only retains terminal supervision, while the three heuristics penalize one random error, the first error, or all identified errors, respectively. ECHO exceeds Final Reward Only by 9.51 points and First Error, the strongest heuristic, by 2.77 points overall. Although All Errors and First Error lead Airline and Telecom, respectively, ECHO achieves the highest Retail score and the highest overall score. These results suggest that ECHO benefits not simply from additional local supervision, but from responsibility-aware credit assignment across errors and corrections. §F reports the same comparison on BFCL-v3 Multi-Turn. 4.6 Effect of the Frozen Judge Figure 6: Frozen-judge comparison at the 8B scale. Left: downstream ECHO performance on τ2τ^2-Bench. Right: responsibility identification accuracy on 100 manually verified samples before reliability gating. Frozen-judge comparisons examine whether general tool-use capability predicts effectiveness as a source of local supervision. Figure 6 compares five judges by BFCL-v4 score, downstream ECHO-8B performance, and responsibility identification accuracy on 100 manually verified samples. Nemotron-3-Super-120B has the lowest BFCL-v4 score, yet yields stronger downstream ECHO performance than both smaller Qwen judges. Kimi-K2.6 Thinking produces the strongest ECHO policy, exceeding Qwen3.5-122B-A10B by 1.24 percentage points despite the latter’s higher BFCL-v4 score. These reversals suggest that general tool-use capability is an incomplete proxy for supervision effectiveness. 5 Conclusion We presented ECHO, a responsibility-aware credit assignment framework for tool-use agents that distinguishes newly introduced errors, inherited consequences, missed corrections, and successful corrections, and converts them into bounded action-level supervision. This design addresses three limitations of conventional terminal or step-level feedback: (i) conflating error manifestations with responsible decisions, (i) double-counting shared downstream consequences, and (i) over-crediting recovery from self-induced errors. Across six tool-use benchmarks and two model scales, ECHO achieves strong and broadly consistent improvements over the compared baselines. Together, these results support decision responsibility as a useful perspective for fine-grained credit assignment across complex tool-use trajectories. Limitations This work focuses specifically on responsibility-aware credit assignment for tool-use agents. (i) ECHO is designed for training-time credit assignment rather than inference-time intervention. Techniques such as reflection, replanning, and online verification are complementary to the proposed framework and are not considered here. (i) Our analysis centers on responsibility attribution within agent–tool interaction trajectories. Broader system-level considerations, including tool construction, multi-agent coordination, and interface design, fall outside the scope of the proposed framework. Ethical Considerations All experiments in this study were conducted using publicly available datasets and models licensed for research use. To the best of our knowledge, we do not identify any method-specific ethical concerns beyond those generally associated with tool-use agents and automated model evaluation. References Arjona-Medina et al. (2019) J. A. Arjona-Medina, M. Gillhofer, M. Widrich, T. Unterthiner, J. Brandstetter, and S. Hochreiter Rudder: return decomposition for delayed rewards. In Advances in Neural Information Processing Systems, Note: Available: https://arxiv.org/pdf/1806.07857 Cited by: §2. Barres et al. (2025) V. Barres, H. Dong, S. Ray, X. Si, and K. Narasimhan τ2τ^2-bench: evaluating conversational agents in a dual-control environment. arXiv preprint arXiv:2506.07982. Note: Available: https://arxiv.org/pdf/2506.07982 Cited by: §G.3, §4.1. Cemri et al. (2026) M. Cemri, M. Z. Pan, S. Yang, L. A. Agrawal, B. Chopra, R. Tiwari, K. Keutzer, A. Parameswaran, D. Klein, K. Ramchandran, et al. Why do multi-agent llm systems fail?. In Advances in Neural Information Processing Systems, Note: Available: https://arxiv.org/pdf/2503.13657 Cited by: §G.2. Chen et al. (2025) C. Chen, X. Hao, W. Liu, X. Huang, X. Zeng, S. Yu, D. Li, S. Wang, W. Gan, Y. Huang, et al. Acebench: who wins the match point in tool usage?. arXiv preprint arXiv:2501.12851. Note: Available: https://arxiv.org/pdf/2501.12851 Cited by: §G.3, §4.1. Chockler and Halpern (2004) H. Chockler and J. Y. Halpern Responsibility and blame: a structural-model approach. Journal of Artificial Intelligence Research. Note: Available: https://arxiv.org/pdf/cs/0312038 Cited by: §2. Dong et al. (2026) G. Dong, H. Mao, K. Ma, L. Bao, Y. Chen, Z. Wang, Z. Chen, J. Du, H. Wang, F. Zhang, et al. Agentic reinforced policy optimization. In International Conference on Learning Representations, Note: Available: https://arxiv.org/pdf/2507.19849 Cited by: §2. El-Yaniv et al. (2010) R. El-Yaniv et al. On the foundations of noise-free selective classification.. Journal of Machine Learning Research. Note: Available: https://jmlr.org/papers/volume11/el-yaniv10a/el-yaniv10a.pdf Cited by: §G.1. Feng et al. (2026a) J. Feng, S. Huang, X. Qu, G. Zhang, Y. Qin, B. Zhong, C. Jiang, J. Chi, and W. Zhong Retool: reinforcement learning for strategic tool use in llms. In International Conference on Learning Representations, Note: Available: https://arxiv.org/pdf/2504.11536 Cited by: §2. Feng et al. (2026b) L. Feng, Z. Xue, T. Liu, and B. An Group-in-group policy optimization for llm agent training. In Advances in Neural Information Processing Systems, Note: Available: https://arxiv.org/pdf/2505.10978 Cited by: §2. Gandhi et al. (2026) S. Gandhi, S. Goyal, K. Kate, and Y. Rizk DRACO: fine-grained credit assignment with dynamic rubrics for long-horizon agent training. arXiv preprint arXiv:2609.04094. Note: Available: https://arxiv.org/pdf/2609.04094 Cited by: §2. Gou et al. (2024) Z. Gou, Z. Shao, Y. Gong, Y. Yang, N. Duan, W. Chen, et al. Critic: large language models can self-correct with tool-interactive critiquing. In International Conference on Learning Representations, Note: Available: https://arxiv.org/pdf/2305.11738 Cited by: §G.2. Li et al. (2026a) J. Li, Y. Wang, Q. Yan, Y. Tian, Z. Xu, H. Song, P. Xu, and L. L. Cheong Salt: step-level advantage assignment for long-horizon agents via trajectory graph. In Findings of the Association for Computational Linguistics: EACL 2026, Note: Available: https://aclanthology.org/2026.findings-eacl.247.pdf Cited by: §2. Li et al. (2026b) R. Li, J. Tu, Y. Su, Y. Liu, F. Huang, H. Alinejad-Rokny, D. F. Wong, J. Lin, and M. Yang Toolrm: towards agentic tool-use reward modeling. In Findings of the Association for Computational Linguistics: ACL 2026, Note: Available: https://aclanthology.org/2026.findings-acl.419.pdf Cited by: §2. Li et al. (2025) Y. Li, H. A. Inan, X. Yue, W. Chen, L. Wutschitz, J. Kulkarni, R. Poovendran, R. Sim, and S. Rajmohan Simulating environments with reasoning models for agent training. arXiv preprint arXiv:2511.01824. Note: Available: https://arxiv.org/pdf/2511.01824 Cited by: §2, Table 1, Table 2, Table 3, §4.1. Liao et al. (2026) S. Liao, Z. Chen, and Y. Tang TCPO: turn-level credit policy optimization. arXiv preprint arXiv:2608.01667. Note: Available: https://arxiv.org/pdf/2608.01667 Cited by: §2. Lightman et al. (2024) H. Lightman, V. Kosaraju, Y. Burda, H. Edwards, B. Baker, T. Lee, J. Leike, J. Schulman, I. Sutskever, and K. Cobbe Let’s verify step by step. In International Conference on Learning Representations, Note: Available: https://arxiv.org/pdf/2305.20050 Cited by: §G.2, §1, §2. Lu et al. (2025) J. Lu, T. Holleis, Y. Zhang, B. Aumayer, F. Nan, H. Bai, S. Ma, S. Ma, M. Li, G. Yin, et al. Toolsandbox: a stateful, conversational, interactive evaluation benchmark for llm tool use capabilities. In Findings of the Association for Computational Linguistics: NAACL 2025, Note: Available: https://aclanthology.org/2025.findings-naacl.65.pdf Cited by: §G.3, §1, §4.1. Luo et al. (2025) X. Luo, Y. Zhang, Z. He, Z. Wang, S. Zhao, D. Li, L. K. Qiu, and Y. Yang Agent lightning: train any ai agents with reinforcement learning. arXiv preprint arXiv:2508.03680. Note: Available: https://arxiv.org/pdf/2508.03680 Cited by: §2. Mao et al. (2025) H. Mao, R. Tsao, J. Zhou, S. G. Patil, and J. E. Gonzalez BFCL V4: web search. Note: Berkeley Gorilla project External Links: Link Cited by: §G.3, §4.1. Meng and Chen (2026) Z. Meng and K. Chen CRAFT: counterfactual credit assignment from free sibling rollouts for self-distilled agentic reinforcement learning. arXiv preprint arXiv:2606.29476. Note: Available: https://arxiv.org/pdf/2606.29476 Cited by: §2. Meulemans et al. (2023) A. Meulemans, S. Schug, S. Kobayashi, G. Wayne, et al. Would i have gotten that reward? long-term credit assignment by counterfactual contribution analysis. In Advances in Neural Information Processing Systems, Note: Available: https://arxiv.org/pdf/2306.16803 Cited by: §2. Patil et al. (2025) S. G. Patil, H. Mao, F. Yan, C. C. Ji, V. Suresh, I. Stoica, and J. E. Gonzalez The berkeley function calling leaderboard (bfcl): from tool use to agentic evaluation of large language models. In International Conference on Machine Learning, Note: Available: https://proceedings.mlr.press/v267/patil25a.html Cited by: §G.3, §4.1. Qian et al. (2026) C. Qian, E. C. Acikgoz, Q. He, H. Wang, X. Chen, D. Hakkani-Tur, G. Tur, and H. Ji Toolrl: reward is all tool learning needs. In Advances in Neural Information Processing Systems, Note: Available: https://arxiv.org/pdf/2504.13958 Cited by: §1, §2. Qin et al. (2024) Y. Qin, S. Liang, Y. Ye, K. Zhu, L. Yan, Y. Lu, Y. Lin, X. Cong, X. Tang, B. Qian, et al. Toolllm: facilitating large language models to master 16000+ real-world apis. In International Conference on Learning Representations, Note: Available: https://arxiv.org/pdf/2307.16789 Cited by: §1. Schick et al. (2023) T. Schick, J. Dwivedi-Yu, R. Dessì, R. Raileanu, M. Lomeli, E. Hambro, L. Zettlemoyer, N. Cancedda, and T. Scialom Toolformer: language models can teach themselves to use tools. In Advances in Neural Information Processing Systems, Note: Available: https://arxiv.org/pdf/2302.04761 Cited by: §1. Schulman et al. (2017) J. Schulman, F. Wolski, P. Dhariwal, A. Radford, and O. Klimov Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347. Note: Available: https://arxiv.org/pdf/1707.06347 Cited by: §3.5. Shao et al. (2024) Z. Shao, P. Wang, Q. Zhu, R. Xu, J. Song, X. Bi, H. Zhang, M. Zhang, Y. Li, Y. Wu, et al. Deepseekmath: pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300. Note: Available: https://arxiv.org/pdf/2402.03300 Cited by: §3.5. Shinn et al. (2023) N. Shinn, F. Cassano, A. Gopinath, K. Narasimhan, and S. Yao Reflexion: language agents with verbal reinforcement learning. In Advances in Neural Information Processing Systems, Note: Available: https://arxiv.org/pdf/2303.11366 Cited by: §G.2. Song et al. (2026) X. Song, H. Chang, G. Dong, Y. Zhu, J. Wen, and Z. Dou Envscaler: scaling tool-interactive environments for llm agent via programmatic synthesis. In Findings of the Association for Computational Linguistics: ACL 2026, Note: Available: https://aclanthology.org/2026.findings-acl.407.pdf Cited by: §2, Table 1, Table 1, Table 2, Table 2, Table 3, Table 3, §4.1. Tan et al. (2026) H. Tan, X. Yang, H. Chen, J. Shao, Y. Wen, Y. Shen, W. Luo, X. Du, L. Guo, and Y. Li Hindsight credit assignment for long-horizon llm agents. arXiv preprint arXiv:2603.08754. Note: Available: https://arxiv.org/pdf/2603.08754 Cited by: §2. Tan et al. (2025) W. Tan, X. Qu, M. Tu, M. Ge, A. T. Liu, P. Koehn, and L. Lu Process-supervised reinforcement learning for interactive multimodal tool-use agents. arXiv preprint arXiv:2509.14480. Note: Available: https://arxiv.org/pdf/2509.14480 Cited by: §2. Tao et al. (2026) L. Tao, B. Peng, W. Yao, T. Ge, H. Cheng, M. H. Wang, J. Gao, and S. Li TRACE: turn-level reward assignment via credit estimation for long-horizon agents. arXiv preprint arXiv:2607.13988. Note: Available: https://arxiv.org/pdf/2607.13988 Cited by: §2. Wang et al. (2026a) J. Wang, Z. Xi, Y. Yang, H. Luo, S. Dou, T. Gui, and Q. Zhang Enhancing llm-based search agents via contribution weighted group relative policy optimization. In Annual Meeting of the Association for Computational Linguistics, Note: Available: https://aclanthology.org/2026.acl-long.1462.pdf Cited by: §2. Wang et al. (2024) P. Wang, L. Li, Z. Shao, R. Xu, D. Dai, Y. Li, D. Chen, Y. Wu, and Z. Sui Math-shepherd: verify and reinforce llms step-by-step without human annotations. In Annual Meeting of the Association for Computational Linguistics, Note: Available: https://aclanthology.org/2024.acl-long.510.pdf Cited by: §1, §2. Wang et al. (2025a) Q. Wang, H. Zhang, J. Fu, K. Fu, Y. Liu, T. Zhang, C. Sun, G. Jiang, J. Tang, X. Ji, et al. Klear-agentforge: forging agentic intelligence through posttraining scaling. arXiv preprint arXiv:2511.05951. Note: Available: https://arxiv.org/pdf/2511.05951 Cited by: §2, Table 1, Table 2, Table 3, §4.1. Wang et al. (2026b) Z. Wang, C. Xu, B. Liu, Y. Wang, S. Han, Z. Yao, H. Yao, and Y. He Agent world model: infinity synthetic environments for agentic reinforcement learning. arXiv preprint arXiv:2602.10090. Note: Available: https://arxiv.org/pdf/2602.10090 Cited by: §2, Table 1, Table 1, Table 2, Table 2, Table 3, Table 3, §4.1. Wang et al. (2025b) Z. Wang, K. Wang, Q. Wang, P. Zhang, L. Li, Z. Yang, X. Jin, K. Yu, M. N. Nguyen, L. Liu, et al. Ragen: understanding self-evolution in llm agents via multi-turn reinforcement learning. arXiv preprint arXiv:2504.20073. Note: Available: https://arxiv.org/pdf/2504.20073 Cited by: §1. Wen et al. (2024) M. Wen, Z. Wan, J. Wang, W. Zhang, and Y. Wen Reinforcing llm agents via policy optimization with action decomposition. In Advances in Neural Information Processing Systems, Note: Available: https://arxiv.org/pdf/2405.15821 Cited by: §2. Xi et al. (2026) Z. Xi, C. Liao, G. Li, Z. Zhang, W. Chen, B. Wang, S. Jin, Y. Zhou, J. Guan, W. Wu, et al. Agentprm: process reward models for llm agents via step-wise promise and progress. In The ACM Web Conference 2026, Note: Available: https://arxiv.org/pdf/2511.08325 Cited by: §2. Xia et al. (2025) Y. Xia, J. Fan, W. Chen, S. Yan, X. Cong, Z. Zhang, Y. Lu, Y. Lin, Z. Liu, and M. Sun Agentrm: enhancing agent generalization with reward modeling. In Annual Meeting of the Association for Computational Linguistics, Note: Available: https://aclanthology.org/2025.acl-long.945.pdf Cited by: §2. Yang et al. (2025) A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Gao, C. Huang, C. Lv, et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388. Note: Available: https://arxiv.org/pdf/2505.09388 Cited by: Table 1, Table 1, Table 2, Table 2, Table 3, Table 3, §4.1. Yao et al. (2024) S. Yao, N. Shinn, P. Razavi, and K. Narasimhan τ-bench: a benchmark for tool-agent-user interaction in real-world domains. arXiv preprint arXiv:2406.12045. Note: Available: https://arxiv.org/pdf/2406.12045 Cited by: §G.3, §1, §4.1. Yao et al. (2022) S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao React: synergizing reasoning and acting in language models. arXiv preprint arXiv:2210.03629. Note: Available: https://arxiv.org/pdf/2210.03629 Cited by: §1. Zhan et al. (2026) Y. Zhan, S. Liu, Q. Liu, Y. Shi, S. Xu, W. Hou, X. Xu, Z. Li, W. Pan, and J. Yan SLCA-grpo: resolving cross-segment credit misattribution in tool-calling rl. arXiv preprint arXiv:2609.29050. Note: Available: https://arxiv.org/pdf/2609.29050 Cited by: §2. Zhang et al. (2025a) S. Zhang, M. Yin, J. Zhang, J. Liu, Z. Han, J. Zhang, B. Li, C. Wang, H. Wang, Y. Chen, et al. Which agent causes task failures and when? on automated failure attribution of llm multi-agent systems. arXiv preprint arXiv:2505.00212. Note: Available: https://arxiv.org/pdf/2505.00212 Cited by: §G.2, §2. Zhang et al. (2026) Y. Zhang, H. Huang, Z. Song, Z. Zhao, Q. Zhang, Y. Zhu, and D. Zhao Criticsearch: fine-grained credit assignment for search agents via a retrospective critic. In Findings of the Association for Computational Linguistics: ACL 2026, Note: Available: https://aclanthology.org/2026.findings-acl.596.pdf Cited by: §2. Zhang et al. (2023) Y. Zhang, Y. Du, B. Huang, Z. Wang, J. Wang, M. Fang, and M. Pechenizkiy Interpretable reward redistribution in reinforcement learning: a causal approach. In Advances in Neural Information Processing Systems, Note: Available: https://arxiv.org/pdf/2305.18427 Cited by: §2. Zhang et al. (2025b) Z. Zhang, C. Zheng, Y. Wu, B. Zhang, R. Lin, B. Yu, D. Liu, J. Zhou, and J. Lin The lessons of developing process reward models in mathematical reasoning. In Findings of the Association for Computational Linguistics: ACL 2025, Note: Available: https://aclanthology.org/2025.findings-acl.547.pdf Cited by: §1, §2. Zhao et al. (2025) W. Zhao, X. Wang, C. Ma, L. Kong, Z. Yang, M. Tuo, X. Shi, Y. Zhai, and X. Cai MUA-rl: multi-turn user-interacting agent reinforcement learning for agentic tool use. arXiv preprint arXiv:2508.18669. Note: Available: https://arxiv.org/pdf/2508.18669 Cited by: §2, Table 1, Table 2, Table 3, §4.1. Zheng et al. (2025) C. Zheng, Z. Zhang, B. Zhang, R. Lin, K. Lu, B. Yu, D. Liu, J. Zhou, and J. Lin Processbench: identifying process errors in mathematical reasoning. In Annual Meeting of the Association for Computational Linguistics, Note: Available: https://aclanthology.org/2025.acl-long.50.pdf Cited by: §G.2, §1, §2. Zhou et al. (2024a) S. Zhou, F. F. Xu, H. Zhu, X. Zhou, R. Lo, A. Sridhar, X. Cheng, T. Ou, Y. Bisk, D. Fried, et al. Webarena: a realistic web environment for building autonomous agents. In International Conference on Learning Representations, Note: Available: https://arxiv.org/pdf/2307.13854 Cited by: §1. Zhou et al. (2025) Y. Zhou, S. Jiang, Y. Tian, J. Weston, S. Levine, S. Sukhbaatar, and X. Li Sweet-rl: training multi-turn llm agents on collaborative reasoning tasks. arXiv preprint arXiv:2503.15478. Note: Available: https://arxiv.org/pdf/2503.15478 Cited by: §2. Zhou et al. (2024b) Y. Zhou, A. Zanette, J. Pan, S. Levine, and A. Kumar Archer: training language model agents via hierarchical multi-turn rl. arXiv preprint arXiv:2402.19446. Note: Available: https://arxiv.org/pdf/2402.19446 Cited by: §2. Zhu et al. (2025) K. Zhu, Z. Liu, B. Li, M. Tian, Y. Yang, J. Zhang, P. Han, Q. Xie, F. Cui, W. Zhang, et al. Where llm agents fail and how they can learn from failures. arXiv preprint arXiv:2509.25370. Note: Available: https://arxiv.org/pdf/2509.25370 Cited by: §2. Contents of Appendix Appendix A Audit Protocol and Evidence Handling A.1 Candidate Selection and Independent Requests The full-trajectory proposer returns at most sixteen event hypotheses and explicitly flags any it omits. Each hypothesis identifies its action, policy span, versioned predicate, deviation origin, evidence pointers, and proposed responsibility type. Impact records also specify propagation links, severity, first-restoration evidence, and authenticated origins. Validated fields determine training weights through the scoring rules in §3.3–3.4. The prefix-review budget covers K=8K=8 distinct actions. Up to six proposed actions are selected in chronological order, and two non-proposed sentinel actions are selected by a fixed-seed hash ordering. The same ordering fills unused proposal slots until the budget or the available actions are exhausted. Each prefix request returns at most four predicate-level records, and omitted records abstain. Each prefix request contains the recorded decision-time context hi,th_i,t, the current action, and the available tool contracts. Retrospective labels, selected predicates, rationales, severity, trajectory suffixes, and hidden state are excluded from these inputs. Batched requests keep isolated attention contexts, and both judge roles use the same frozen checkpoint with fixed prompts and decoding. Prefix assessment returns supported defects, legitimate repair intentions, defect-free assessments, or abstention. A successful correction is established only when an accepted repair intention is paired with execution confirmation. Defects found at sentinel actions contribute only through the direct-defect term of Eq. (4), provided their prefix evidence passes validation. Unsupported impact and propagation terms receive zero weight, and sentinel repairs receive positive supervision only with authenticated restoration evidence. A.2 Responsibility Boundaries Inherited inputs and current obligations. The classification of a reused product identifier depends on the discrepancy evidence visible when it is used. A visible mismatch and an available resolving lookup can establish a missed correction when the agent continues committing to the wrong product. An apparently valid opaque identifier can carry an inherited consequence when its defect becomes observable later. Ambiguous cases receive local abstention, preserving the distinction between available evidence and retrospectively established error. Feasible responses. The feasible alternative response (witness) of a missed correction specifies a concrete tool or response, known arguments, availability under the visible contract, and the discrepancy addressed. Clarification qualifies when the user can disambiguate exposed alternatives; stopping qualifies when permitted and sufficient to avoid the identified impermissible operation. A legitimate repair attempt retains its prefix-grounded assessment even if an unpredictable outage later prevents restoration. Mixed actions and verified restoration. An action that restores one field while violating another produces distinct positive and negative events. Transaction identifiers or field-level provenance link verified restoration to the responsible action. Ambiguous restoration attribution triggers abstention from positive supervision. A verified correction remains valid despite a separate terminal failure, with auxiliary eligibility determined by its origin and available source funding. Visibility and external origins. Decision-time visibility follows delivery timestamps and actual context inclusion, placing synchronous tool output after its generating action. Hidden snapshots support retrospective impairment assessment, while correction opportunities require discrepancy evidence visible in hi,th_i,t. Initial-state records authenticate pre-existing defects, and environment records authenticate subsequent external incidents. Omitted sources and unsupported policy claims leave origins unknown. A new policy error that reopens a repaired predicate creates a separate self-induced origin with its own source penalty. Appendix B Calibration of Selective Supervision Prompt development, gate calibration, hyperparameter selection, and final evaluation use disjoint task partitions. A fixed selection rule samples one eligible event per independent task instance within each predeclared evidence stratum. Events and rollouts sharing a task form one sampling cluster. Two annotators assess prefix-grounded responsibility, followed by a separate retrospective review of impact, provenance, and restoration. Adjudication is blinded to training coefficients, and correctness requires validity of every training-relevant semantic field. For stratum b, let kbk_b of nbn_b independent calibration units contain an incorrect assertion. With BcalB_cal predeclared strata and simultaneous failure level δcal _cal, define Ub=Beta−1[1−δcalBcal;kb+1,nb−kb]U_b=Beta^-1 [1- _calB_cal;k_b+1,n_b-k_b ] (18) for 0≤kb<nb0≤ k_b<n_b, and set Ub=1U_b=1 if kb=nbk_b=n_b or nb=0n_b=0. The inverse beta distribution yields a one-sided exact binomial upper confidence limit. Combining it with the indicator VeV_e of the structural checks in §3.2 gives ge=Venb(e)≥nminUb(e)≤ϵJ.g_e=V_e1\n_b(e)≥ n_ \1\U_b(e)≤ _J\. (19) Independent sampling from the same stratum distributions gives simultaneous upper coverage of at least 1−δcal1- _cal through a union bound. This guarantee concerns stratum-level semantic-error rates under the calibration distribution. Individual-event validity, impact magnitude, and reliability under policy shift remain separate assessment targets. Post hoc stratum selection uses an independent selection split to preserve the calibration protocol. The calibration design crosses three supervised responsibility types with explicit or semantic evidence to form six strata. Thresholds are δcal=0.05 _cal=0.05, ϵJ=0.10 _J=0.10, and nmin=50n_ =50; insufficiently sampled or unreliable strata abstain. Precision and coverage jointly characterize selective supervision, while monitoring newly annotated training traces supports drift detection and recalibration on fresh development data. Appendix C Derivations and Guarantee Boundaries C.1 Shared-Consequence and Budget Bounds Equation (3) gives ∑eaec=1−ζc≤1 _ea_ec=1- _c≤ 1 for nonempty PcP_c, and zero otherwise. Let vesharedv_e^shared denote the shared-consequence component of a negative event’s weight. Since ge≤1g_e≤ 1 and pe≤1p_e≤ 1, ∑eveshared _ev_e^shared =(1−κ)∑cMc∑eaecge[1+αpe] =(1-κ) _cM_c _ea_ecg_e[1+α p_e] ≤(1−κ)(1+α)∑cMc. ≤(1-κ)(1+α) _cM_c. (20) The shared-consequence bound is independent of the number of implicated events; direct-defect terms separately supervise certified decisions. Duplicating observations preserves the accounting when validated predicates, event keys, provenance links, and first-restoration sets are fixed. The invariance therefore concerns validated records, with proposer sensitivity to redundant text requiring empirical assessment. Equation (7) caps each directional total at λs _s. Source funding in Eq. (9) only reduces or preserves positive budgets, giving ∑t|δi,t|≤∑ebe−+∑rb~r+≤λ−+λ+. _t| _i,t|≤ _eb_e^-+ _r b_r^+≤ _-+ _+. (21) The resulting bound limits total auxiliary budget, while additional responsibility events can reduce individual normalized shares. C.2 First-Order Equivalence At the behavior policy, likelihood ratios equal one and lie inside the clipping interval. Writing the token score gradient as si,k=∇θlogπθ[yi,k∣hi,k]s_i,k= _θ _θ[y_i,k h_i,k], where hi,kh_i,k is the token-level context, the uncapped additive-token surrogate gives ∇Jiadd ∇ J_i^add =AioutLi∑kqi,ksi,k = A_i^outL_i _kq_i,ks_i,k +∑t:Bi,t>0δi,tBi,t∑kmi,t,ksi,k + _t:B_i,t>0 _i,tB_i,t _km_i,t,ks_i,k =∇[Jiout+Jiloc]. =∇[J_i^out+J_i^loc]. (22) Objective values also agree whenever all relevant ratios lie strictly inside the clipping interval. Outside it, opposite-sign advantages can activate different clipping branches, yielding distinct objectives with an identical KL term. If each token score gradient has norm at most G0G_0 at the behavior policy, then ‖∇Jiloc‖≤G0∑t|δi,t|≤G0[λ−+λ+].\|∇ J_i^loc\|≤ G_0 _t| _i,t|≤ G_0[ _-+ _+]. (23) This gradient bound holds under the score-gradient assumption at the sampling policy. Extending it across tokenizations or away from that policy requires additional assumptions. C.3 Source Funding and the Clipped Local Surrogate For a fixed audited trajectory with exclusively self-funded positive events, define gross budgets P0=∑rb~r+P_0= _r b_r^+ and N0=∑ebe−N_0= _eb_e^-. Each source penalty DdD_d in Eq. (8) sums a disjoint subset of negative charges, and paid repairs of origin d total at most ηDdη D_d, yielding P0≤η∑dDd≤ηN0.P_0≤η _dD_d≤η N_0. (24) Let C be the amount canceled when positive and negative events share actions. Net masses P=P0−CP=P_0-C and N=N0−CN=N_0-C, where N=Ni−N=N_i^- as defined in Eq. (17), satisfy P−ηN=P0−ηN0−(1−η)C≤0P-η N=P_0-η N_0-(1-η)C≤ 0 (25) for 0≤η≤10≤η≤ 1. For any ρ>0ρ>0 and a,b≥0a,b≥ 0, the clipped surrogate obeys ϕϵ(ρ,a) _ε(ρ,a) ≤(1+ϵ)a, ≤(1+ε)a, (26) ϕϵ(ρ,−b) _ε(ρ,-b) ≤−(1−ϵ)b. ≤-(1-ε)b. (27) Averaging over each action’s tokens preserves these inequalities, yielding Jiloc J_i^loc ≤(1+ϵ)P−(1−ϵ)N ≤(1+ε)P-(1-ε)N ≤[(1+ϵ)η−(1−ϵ)]N. ≤[(1+ε)η-(1-ε)]N. (28) This establishes Eq. (17) under its stated condition. Within trajectories containing external bonuses, the bound applies to self-induced components with action-disjoint support or independently evaluated local surrogates. These conditions preserve component-level accounting under nonlinear clipping. Shared policy parameters can increase error creation despite the scalar source-funding bound. Consider an erroneous action with probability p[θ]=σ[θ]p[θ]=σ[θ] and a subsequent repair with probability q[θ]=σ[Hθ]q[θ]=σ[Hθ]. Assign coefficients −D-D to the source and ηDη D to its verified repair. At θ=0θ=0, the expected local score-gradient update is gloc[0]=−D4+ηDH8.g_loc[0]=- D4+ η DH8. (29) For H>2/ηH>2/η, the update increases error probability while satisfying the source-funding constraint. The counterexample separates a bounded local surrogate from behavioral guarantees and motivates empirical assessment of error introduction, correction, and repeated repair cycles. C.4 Observational Attribution Limits A failed trajectory can support causal models with different intervention effects. For binary errors E1,E2E_1,E_2, both F=E1∨E2F=E_1 E_2 and F=E1∧E2F=E_1 E_2 explain E1=E2=F=1E_1=E_2=F=1. Correcting E1E_1 preserves failure under the first model and resolves it under the second. The trace therefore leaves intervention-based responsibility underdetermined. ECHO uses the ownership convention in Eq. (3) to allocate observed constraint impairment. Appendix D Implementation Details D.1 Training Data and Implementation ECHO is initialized from Qwen3-4B and Qwen3-8B and trained through reinforcement learning. We use 92 tasks from the τ2τ^2-Bench training splits, comprising 66 retail and 26 airline tasks. A further 8 retail and 4 airline tasks form the 12-task development split. Both scales use 75 updates, 12 tasks per batch, eight rollouts per task, and a learning rate of 5×10−65× 10^-6. D.2 ECHO Configuration Kimi-K2.6 Thinking serves as the fixed judge for retrospective proposals and independent prefix assessments. Each trajectory receives one proposal request and at most eight prefix assessments, with six proposal slots and two sentinel slots. We use κ=0.25κ=0.25, α=0.5α=0.5, λ−=λ+=0.5 _-= _+=0.5, η=0.5η=0.5, and clipping half-width ϵ=0.2ε=0.2. Outcome advantages use population-standard-deviation normalization with ε=10−6 =10^-6. §A and §B specify evidence validation and reliability gating. Appendix E Optimization Details and Computational Cost E.1 Update Sequence Algorithm 1 summarizes one update. Each update audits successful and failed trajectories and retains every group reward for outcome normalization. Negative budgets determine source penalties before eligible corrections are normalized and capped by source funding. Aggregated action coefficients remain fixed during optimization of Eq. (15); the judge operates during training. The coefficients in §D satisfy the source-funding condition η≤[1−ϵ]/[1+ϵ]η≤[1-ε]/[1+ε]. Stored behavior probabilities correspond to the rollout distribution, including its temperature and token support. The sampling convention uses temperature one with full token support, and distributed accumulation averages over contributing trajectories across workers. E.2 Audit Cost Auditing a trajectory uses one proposal request and at most K independent prefix requests. For input lengths n and output lengths m, the token cost is Cijudge C_i^judge =nifull+mifull =n_i^full+m_i^full +∑t∈Si[ni,tpre+mi,tpre]+Ciretry. + _t∈ S_i[n_i,t^pre+m_i,t^pre]+C_i^retry. (30) Requirement-inventory compilation is amortized per task and accounted for separately. Uncached prefix input scales up to O(Kni)O(Kn_i); exact-prefix caching can reduce repeated computation, while batching preserves request count. Inference cost also depends on context length and attention implementation. E.3 Realized Local Coefficients Away from clipping boundaries, an active local token contributes δi,tρi,k/Bi,t _i,t _i,k/B_i,t to its score-gradient coefficient. Define χi,t,k _i,t,k =δi,t>0,ρi,k≤1+ϵ =1\ _i,t>0, _i,k≤ 1+ε\ +δi,t<0,ρi,k≥1−ϵ, +1\ _i,t<0, _i,k≥ 1-ε\, (31) δi,teff _i,t^eff =δi,tBi,t∑kmi,t,kρi,kχi,t,k. = _i,tB_i,t _km_i,t,k _i,k _i,t,k. (32) Active negative-advantage ratios can exceed the upper clipping threshold, so realized coefficient magnitudes can exceed their on-policy masses. Realized coefficients and sign-specific clipping fractions characterize how supervision changes through aggregation and clipping. Gradient norms and local-to-outcome alignment further distinguish update magnitude from directional agreement. Appendix F Reward Ablation on Multi-Turn Function Calling Figure 7: Reward ablation on BFCL-v3 Multi-Turn at 8B. Overall is the mean across Base, Missing Function, Missing Parameter, and Long Context. Figure 7 repeats the reward ablation of §4.5 on BFCL-v3 Multi-Turn, which evaluates tool use under different function, parameter, and context constraints. ECHO exceeds Final Reward Only by 8.76 percentage points and All Errors, the strongest heuristic, by 4.42 points overall. Its advantage over All Errors is concentrated in Missing Function, where all three error-selection heuristics fall below terminal supervision. ECHO instead improves on this subset while retaining gains over Final Reward Only in Missing Parameter and Long Context. Subset leaders vary: First Error leads Base, All Errors leads Missing Parameter, and Random One Error leads Long Context. Random One Error’s Long Context lead, however, comes with a substantial Base deficit, illustrating the uneven effects of unstructured selection. The strongest heuristic also changes from First Error on τ2τ^2-Bench to All Errors on BFCL-v3 Multi-Turn. Although heuristics lead on individual subsets, ECHO achieves the highest overall score on both benchmarks. Appendix G Responsibility Event Taxonomy and Benchmark Coverage Semantic family Observed diagnostics Evidence required for responsibility assignment Format, schema, and types Malformed calls; parameter or type mismatches. Visible schema constraints, actionable rejections, and execution of a corrected call. Tool selection and call count Incorrect function, call count, or relevance decision. Available tools, selection obligations, and provenance of an inherited choice. Arguments, entities, and values Incorrect argument, entity, value, or parallel-call match. Visible value constraints, the source of reused data, and verified value correction. State and prerequisites State mismatch; unmet database, environment, or milestone checks. Applicable preconditions, the responsible state transition, and verified restoration. Execution and omitted work Missing or mismatched execution; process-score deficits. Required operations and current progress, with a feasible continuation or correction. Retrieval, memory, and answers Expected answer absent after search or memory use. Retrieved evidence, stored-state provenance, and correction of the affected fact. Communication obligations Unmet communication checks. Visible disclosure or clarification obligations and an available response. Forbidden outcomes and guardrails Forbidden-state or minefield matches. Applicable public constraints and the action that introduced or propagated the violation. Progress, stopping, and limits Empty turns, step limits, truncation, or forced termination. The recorded stopping decision, remaining obligations, and feasible progress. Runtime and external boundary Explicit runtime or resource errors. Incident origin and the agent’s response, with execution evidence of recovery. Aggregate outcome only Reported aggregate similarity deficits without a localized check. Task requirement predicates (§3.3), assessed independently of the score. Table 4: Semantic families of checker diagnostics and the evidence each requires for responsibility assignment. Diagnostics (23 literal error_type codes and 19 derived signals) are drawn from 14,014 scored Qwen3 base-model trajectories (7,007 each at 4B and 8B) across the six benchmarks. Families can overlap within a trajectory. A further 2,319 unlocalized or unmapped occurrences fall outside these families (§H). Exact diagnostic string Semantic family Occurrences agentic:answer_not_found Retrieval, memory, and answers 752 ast_decoder:decoder_failed Format, schema, and types 3 class attributes wrong State and prerequisites 53 context_limit_exceeded Progress, stopping, and limits; Runtime and external boundary 4 irrelevance_error:decoder_success Tool selection and call count 540 multiple_function_checker:wrong_count Tool selection and call count 47 parallel_function_checker_no_order:cannot_find_match Tool selection and call count; Arguments, entities, and values 77 parallel_function_checker_no_order:wrong_count Tool selection and call count 21 relevance_error:decoder_failed Format, schema, and types 3 simple_function_checker:missing_optional Format, schema, and types 28 simple_function_checker:missing_required Format, schema, and types 3 simple_function_checker:unexpected_param Format, schema, and types 7 simple_function_checker:wrong_count Tool selection and call count 4 simple_function_checker:wrong_func_name Tool selection and call count 40 type_error:java Format, schema, and types 8 type_error:js Format, schema, and types 4 type_error:nested Format, schema, and types 11 type_error:simple Format, schema, and types 39 value_error:dict_key Arguments, entities, and values 9 value_error:dict_value Arguments, entities, and values 2 value_error:list/tuple Arguments, entities, and values 15 value_error:others Arguments, entities, and values 114 value_error:string Arguments, entities, and values 309 Table 5: Literal error_type codes recorded by benchmark checkers, with their semantic families and occurrence counts. A code mapped to two families lists both, separated by a semicolon. Exact diagnostic string Semantic family Occurrences acebench:process_score<1 Execution and omitted work 53 audit:score<1_without_listed_diagnostic Unmapped or unlocalized 2,278 record:explicit_exception_or_error Runtime and external boundary 51 tau2:action_checks:action_match=false Execution and omitted work 897 tau2:communicate_checks:met=false Communication obligations 38 tau2:db_match=false State and prerequisites 365 tau2:env_assertions:met=false State and prerequisites 259 tau2:reward_breakdown:ACTION<1 Execution and omitted work 15 tau2:reward_breakdown:COMMUNICATE<1 Communication obligations 36 tau2:reward_breakdown:DB<1 State and prerequisites 178 tau2:reward_breakdown:ENV_ASSERTION<1 State and prerequisites 136 tau2:termination_reason:invalid_model_generation Unmapped or unlocalized 41 tau2:termination_reason:max_agent_steps_30 Progress, stopping, and limits 25 toolsandbox:milestone_mapping:similarity<1 State and prerequisites 1,502 toolsandbox:milestone_similarity<1 State and prerequisites 1,074 toolsandbox:minefield_mapping:similarity>0 Forbidden outcomes and guardrails 35 toolsandbox:minefield_similarity>0 Forbidden outcomes and guardrails 35 toolsandbox:similarity<1 Aggregate outcome only 1,109 trajectory:truncated=true Progress, stopping, and limits 13 Table 6: Derived diagnostic signals computed from benchmark records, with their semantic families and occurrence counts. Signals marked as unmapped or unlocalized fall outside the eleven families of Table 4. This section elaborates on the responsibility-event taxonomy introduced in §3.1–3.2. §G.1 specifies how to assign at most one type to each candidate event, §G.2 distinguishes responsibility from error content, and §G.3 maps diagnostics from the six evaluation benchmarks to the evidence required for responsibility assignment. G.1 Event-Level Decision Rule Consider a candidate event e=⟨t,f,d,z⟩e= t,f,d,z (Eq. (1)) in trajectory i. Four evidence indicators determine z. e Def_e and e Opp_e are judged from (hi,t,ai,t)(h_i,t,a_i,t) alone, whereas e Rep_e and e Prov_e additionally require validated full-trajectory evidence of restoration and propagation, respectively. • e Def_e: action ai,ta_i,t commits a distinct defect on f that is evident from a fact or constraint visible in hi,th_i,t, and that does not repeat or continue a deviation on f existing before ai,ta_i,t. • e Rep_e: ai,ta_i,t is a legitimate response to a visible deviation on f, and execution evidence confirms restoration of f or of a required precondition. • e Opp_e: a deviation on f already exists, the discrepancy is visible in hi,th_i,t, and a feasible permitted response (§A) is not taken. • e Prov_e: the consequence on f is linked to an earlier deviation through a validated propagation link, and that deviation is not yet visible in hi,th_i,t. The type is then assigned by precedence: z=New,e,Corr,¬e∧e,Miss,¬e∧¬e∧e,Inh,¬e∧¬e∧¬e∧e.z= cases New,& Def_e,\\ Corr,& Def_e Rep_e,\\ Miss,& Def_e Rep_e Opp_e,\\ Inh,& Def_e Rep_e Opp_e Prov_e. cases (33) Because each case negates the indicators above it, the four types are mutually exclusive. Precedence resolves cases in which several indicators are supported, whereas insufficient or conflicting evidence precludes a reliable assignment and leads to abstention (§3.2). A discrepancy counts as visible only if evidence of it is present in hi,th_i,t (§A); missing information that the policy had no reason to expect does not count. Abstention also applies when sufficient evidence matches no type: with neither e Def_e nor e Rep_e, a visible discrepancy that admits no feasible response satisfies neither e Opp_e nor e Prov_e, yet cannot be Clean because it is visible. Responsibility is assessed separately for each predicate, so a single action can yield a Corr event by repairing one predicate and a New event by violating another; Eq. (10) aggregates their coefficients. Clean pairs and abstention. Two outcomes yield no responsibility type. An action–predicate pair is Clean when the evidence is sufficient, none of the four indicators holds, and no discrepancy on f is visible; the case studies in §4.3 and §I use this label. Following selective classification (El-Yaniv and others, 2010), a candidate event abstains when the evidence is insufficient or conflicting, or when a visible discrepancy fits none of the four types; §B calibrates which evidence strata are admitted. Both outcomes retain only terminal supervision but record different findings: Clean is a supported judgment that the decision raises no responsibility event for f, whereas abstention indicates that the type is either unresolved or inapplicable. Relation to training signals. Under §3.4, admitted New and Miss events receive negative budgets. Admitted, execution-verified Corr events receive provisional positive budgets, capped by source funding for self-induced origins, exempt from that cap for authenticated external origins, and withheld for unknown origins. Inh events receive no auxiliary budget and thus contribute no local correction. Post-training differences on Inh cases can therefore reflect terminal supervision or indirect effects of local supervision applied to other events, such as upstream New errors; the comparisons in §I.2 should be interpreted accordingly. G.2 Error Content versus Responsibility An incorrect argument, a policy violation, and a corrupted memory describe the content of a failure, whereas responsibility describes how the current decision relates to that failure. An unsupported identifier, for example, is New where it is introduced and Inh where later actions reuse it before the error becomes visible. Once the error is visible, ignoring it despite a feasible response is Miss, whereas an execution-confirmed repair is Corr. Because types depend on this relation, not on content, the same failure can receive different types across decisions, and the types apply across tools and domains without enumerating surface errors. This distinction complements existing failure analyses. MAST organizes semantic failure modes of multi-agent systems (Cemri et al., 2026), and Who&When identifies the responsible agent and decisive step in a failed interaction for post-hoc diagnosis (Zhang et al., 2025a); ECHO instead records each decision’s role in the error-and-recovery chain and uses it for training-time credit. ProcessBench targets the earliest erroneous step because later steps can be locally valid yet build on an incorrect premise (Zheng et al., 2025); ECHO likewise separates an error’s origin (New) from its downstream consequences (Inh). Reflexion and CRITIC use verbal or tool-grounded feedback to revise behavior at inference time (Shinn et al., 2023; Gou et al., 2024); ECHO instead evaluates the agent’s responses to visible discrepancies for training-time credit assignment, distinguishing missed corrections (Miss) from execution-confirmed repairs (Corr). As in step-level process supervision (Lightman et al., 2024), each decision is assessed individually, but ECHO judges local responsibility only from the policy-visible prefix and reserves full-trajectory review for proposing candidate events and verifying propagation and restoration. G.3 Mapping Benchmark Diagnostics to Responsibility Evidence The six benchmarks cover complementary parts of the error chain. BFCL’s tool contracts, multi-turn tasks, and memory settings expose argument defects, unresolved prerequisites, and inherited information loss (Patil et al., 2025; Mao et al., 2025). ToolSandbox adds state dependencies and intermediate milestones (Lu et al., 2025), τ-bench domain policies and database-state evaluation (Yao et al., 2024), τ2τ^2-Bench user-controlled state changes (Barres et al., 2025), and ACEBench-Agent multi-step service interactions (Chen et al., 2025). Table 4 groups the mapped checker diagnostics recorded on Qwen3 base-model trajectories into eleven semantic families and lists the evidence required for responsibility assignment within each family. Checker diagnostics identify failed checks but do not establish responsibility, which additionally requires the decision-time, provenance, feasibility, and restoration evidence listed in the third column. When only an aggregate score is available, responsibility is instead assessed against task requirement predicates extracted from public instructions and tool contracts independently of outcomes (§3.3). The mapping serves only this analysis and is not provided to the training-time judge. Appendix H Diagnostic Codebook Tables 5 and 6 list all 23 literal checker codes and 19 derived signals observed in the 14,014 scored Qwen3 base-model trajectories summarized in Table 4. Literal codes are error_type strings emitted by benchmark checkers, whereas derived signals are computed from benchmark records such as reward breakdowns, termination reasons, and milestone similarities. Because not every benchmark emits literal codes, Table 6 supplements them with benchmark-specific derived signals and generic audit, record, and trajectory signals. Counts refer to diagnostic occurrences and are not additive: a trajectory can carry several diagnostics, and some derived signals are computed from one record, such as the database match and its reward component. Family names follow Table 4, except for the unmapped or unlocalized label, which covers score deficits without a listed diagnostic and unmapped terminations. Benchmark-reported aggregate similarity deficits form the “Aggregate outcome only” family. Semantic families describe only diagnostic content, so assigning a responsibility type also requires the evidence in §G.1. Appendix I Additional Case Studies This section presents trajectory-level examples of responsibility events and behavioral differences before and after ECHO training, from evaluation runs of Qwen3 and ECHO at 4B and 8B on the benchmarks in §4.1. Labels are assigned by applying the decision rule in §G.1 to the displayed evidence, with information available at decision time kept separate from evidence observed later. Single-turn BFCL items record a submitted call without execution, so their defects are established from the visible constraint and the submitted call. In all other panels, execution claims rely on the displayed tool results or state changes. Because BFCL-v3 and BFCL-v4 share multi-turn task categories, each panel identifies the benchmark run that produced its trajectory. The panels are qualitative examples and do not estimate pattern frequencies. I.1 Responsibility Events in Base-Model Trajectories Figures 8–11 illustrate each event type in Qwen3 base-model trajectories. In these panels, New events arise when a submitted call contradicts a visible user constraint or tool contract. Inh events arise when the agent searches or inspects memory for a fact deleted in an earlier session, with neither the fact nor its deletion visible in its context. Miss events arise when the agent repeats a rejected call unchanged although the exposed discrepancy admits a feasible response. Corr events arise when a tool result or state snapshot confirms that a corrective call restored a violated requirement or precondition. Because events are assessed per action and predicate, one trajectory can contain a Miss event on one requirement and a Corr event on another. I.2 Paired Comparisons Before and After ECHO Training Figures 12–16 compare Qwen3 and ECHO at the same scale on the same task, complementing §4.3. Paired runs share the evaluation harness, tool contracts, decoding configuration, environment settings, and sampling seed. Because interaction histories can diverge, each comparison relates both trajectories to the same requirement rather than to aligned action indices. In pairs where Qwen3 introduces a New error, ECHO’s action on the same requirement is Clean. Where Qwen3’s downstream response inherits information lost through earlier deletion or omitted persistence, ECHO preserves the required fact upstream, even though Inh events receive no local correction (§3.4). Where Qwen3 misses a correction, sometimes after completing a prerequisite repair such as logging in or freeing inbox capacity, ECHO either avoids the discrepancy or completes the pending operation, with restoration verified by tool results or the final state. R1 An unsupported status filter NewBFCL-v4 simple_python_177 Qwen3-4B Visible context User request: “Find all Patent lawsuit cases of Facebook in 2018.” Tool default: “defaults to ’all’ ” Action "status": "open" Observed evidence Static checker: “false” (single-turn item; no execution is recorded). Responsibility. Selecting open narrows the requested status scope despite the visible default of all. This creates a new filtering error in the first response. R2 Changing an explicit entity name NewBFCL-v4 simple_python_316 Qwen3-4B Visible context “Serena Williams” Action "player_name": "Serrena Williams" Observed evidence Static checker: “false” (single-turn item; no execution is recorded). Responsibility. The submitted name differs from the user’s explicit reference to Serena Williams, introducing a new entity-name error. R3 Confusing package weight with item count NewBFCL-v4 simple_python_370 Qwen3-4B Visible context User request: “a five pound bag of rice”. Quantity definition: “Quantity of each item in the order list.” Action "items": ["olive oil", "rice"], "quantity": [3, 5] Observed evidence Static checker: “false” (single-turn item; no execution is recorded). Responsibility. The request specifies one bag weighing five pounds, whereas the quantity field counts items. Submitting five therefore introduces a new quantity error. R4 Shifting the requested centuries NewBFCL-v4 parallel_multiple_109 Qwen3-4B Visible context User request: “France during the 17th century”. Tool convention: “for the 1700s, input ’18’ ” Action France: "country": "France", "century": 16. England: "country": "England", "century": 17. Italy: "country": "Italy", "century": 18 Observed evidence Static checker: “false” (single-turn item; no execution is recorded). Responsibility. For France, the requested 17th century is submitted as 16, contradicting the visible integer convention and introducing a new argument error. R5 Dropping part of the tool name NewBFCL-v4 live_multiple_1035-263-0 Qwen3-4B Visible context “api_token_api.APITokenApi.get_api_tokens” Action "name": "api_token_api.get_api_tokens" Observed evidence Static checker: “false” (single-turn item; no execution is recorded). Responsibility. The submitted tool name omits the class component exposed in the interface. This introduces a new tool-selection error. Figure 8: Base-model New events. R6 Searching after a career-history key was erased InhBFCL-v4 memory_kv_60-finance-5 Qwen3-4B Visible context “Where did I start my career in 2001?” No backup is visible in the current context, and the available memory lookup is a reasonable diagnostic step. Action "name": "archival_memory_key_search", "arguments": "query": "career start 2001", "k": 5 Observed evidence Earlier stored fact: “2001: Goldman Sachs analyst”. Deletion in an earlier session: “"name": "archival_memory_remove", "arguments": "key": "career_trajectory"”. Deletion result: “"status": "Key removed."”. Current inspection: “"ranked_results": [[0.0, "landmark_deals"], [0.0, "strategic_insights"], [0.0, "current_transactions"], [0.0, "operational_routine"], [0.0, "risk_management_focus"]]”. Responsibility. The earlier deletion removes the stored career fact, and the current search returns no matching key. The permitted search inherits this information loss without introducing another defect. R7 Searching after a deadline key was erased InhBFCL-v4 memory_kv_142-notetaker-12 Qwen3-8B Visible context “I may be forgetting, what are the documents I need to urgently submit before Friday?” No backup is visible in the current context, and the available memory lookup is a reasonable diagnostic step. Action "name": "core_memory_list_keys", "arguments": Observed evidence Earlier stored fact: “Submit tax documents before Friday”. Deletion in an earlier session: “"name": "core_memory_remove", "arguments": "key": "tax_documents_deadline"”. Deletion result: “"status": "Key removed."”. Current inspection: “"keys": []”. Responsibility. The earlier deletion removes the stored deadline, and the current result shows an empty core memory. The permitted inspection inherits this information loss without introducing another defect. Figure 9: Base-model Inh events. R8 Retrying cruise activation with the engine stopped MissBFCL-v3 multi_turn_base_79 Qwen3-4B Visible context “"error": "Start the engine before activating the cruise control."” A feasible response was to address the engine prerequisites or explain the blockage and pause cruise activation. Action "name": "setCruiseControl", "arguments": "speed": 65, "activate": true, "distanceToNextVehicle": 100 Observed evidence “"error": "Start the engine before activating the cruise control."” Responsibility. The repeated cruise call leaves the exposed engine prerequisite unaddressed despite an available response. R9 Repeating a write to a missing file MissBFCL-v3 multi_turn_base_35 Qwen3-4B Visible context “"error": "echo: cannot write to ’diff.txt’: No such file"” The available touch tool permits creating diff.txt before retrying the write. Action Function: "name": "echo". Target argument: "file_name": "diff.txt" Observed evidence “"error": "echo: cannot write to ’diff.txt’: No such file"” Responsibility. The agent repeats the rejected write without first creating the missing file, leaving an actionable prerequisite unresolved. R10 Retrying an undefined market-status function MissBFCL-v3 multi_turn_base_112 Qwen3-4B Visible context “Error during execution: name ’update_market_status’ is not defined” The agent could explain that the requested operation is unavailable and stop the unchanged retries. Action "name": "update_market_status", "arguments": "current_time_str": "10:30 AM" Observed evidence “Error during execution: name ’update_market_status’ is not defined” Responsibility. The unchanged retry follows an explicit undefined-function error and leaves the execution limitation unaddressed. R11 Repeating an undefined withdrawal operation MissBFCL-v3 multi_turn_base_121 Qwen3-4B Visible context “Error during execution: name ’make_transaction’ is not defined” The agent could report the execution failure and pause the withdrawal instead of repeating the same call. Action "name": "make_transaction", "arguments": "account_id": 12345, "xact_type": "withdrawal", "amount": 500 Observed evidence “Error during execution: name ’make_transaction’ is not defined” Responsibility. The agent repeats the unavailable withdrawal operation despite the visible failure and a feasible response to the blockage. Figure 10: Base-model Miss events. R12 Restoring a rejected copy operation CorrBFCL-v3 multi_turn_base_22 Qwen3-4B Visible context “cp: path not allowed in destination. Provide only a file or directory name.” Action "name": "cp", "arguments": "source": "project_analysis.txt", "destination": "project_archive" Observed evidence “’project_analysis.txt’ copied to ’project_archive/project_analysis.txt’ ” Responsibility. Using a local destination name resolves the rejected path argument, and the tool confirms the copy. R13 Creating the missing guide file CorrBFCL-v3 multi_turn_base_23 Qwen3-4B Visible context “echo: cannot write to ’Project_Guide_1.md’: No such file” Action "name": "touch", "arguments": "file_name": "Project_Guide_1.md" Observed evidence Later state snapshot: “<<File: Project_Guide_1.md, Content: Comprehensive guide for the new initiative.>>” Responsibility. The corrected touch call creates the missing file. The later snapshot verifies file existence, while the displayed content results from a subsequent write. R14 Restoring directory access CorrBFCL-v3 multi_turn_base_35 Qwen3-4B Visible context “Only one folder level at a time is supported.” After this rejection, the agent first enters projects with a one-level cd. Action "name": "cd", "arguments": "folder": "deep_folder" Observed evidence Subsequent read: "name": "tail", "arguments": "file_name": "config.py", "lines": 1, returning "last_lines": "Initialization of the system Error in module Setup complete Initialization successful Error detected" Responsibility. Entering deep_folder one level at a time follows the restriction, and the line returned by the subsequent read confirms that access was restored. R15 Restoring the brake prerequisite CorrBFCL-v3 multi_turn_base_52 Qwen3-8B Visible context “Brake pedal needs to be pressed when starting the engine.” Action "name": "pressBrakePedal", "arguments": "pedalPosition": 1 Observed evidence "brakePedalStatus": "pressed" Responsibility. The brake action restores the prerequisite identified by the failed startup attempt. The receipt confirms a pressed brake state. R16 Restoring ticket authentication CorrBFCL-v4 multi_turn_base_152 Qwen3-4B Visible context “User not authenticated. Please log in to create a ticket.” Action "name": "ticket_login", "arguments": "username": "mthompson", "password": "securePass123" Observed evidence "success": true Responsibility. After the authentication refusal, the login call succeeds and restores the authenticated state. Figure 11: Base-model Corr events. P1 Ask for the missing email recipient New → CleanBFCL-v4 live_irrelevance_498-144-0 Qwen3-8B → ECHO-8B Task. Email Mom a proposal to go out and play if Friday works, using her actual address. Qwen3-8B before training The user names Mom without supplying an email address, and no contact lookup result is visible. Qwen3 submits python_send_mail with address=mom@example.com, introducing New through an unsupported recipient. ECHO-8B after training ECHO asks for Mom’s email address without making a tool call. The clarification is Clean because it seeks the information required to identify the recipient. The recorded response ends with this question, so delivery remains pending. Reading. ECHO requests the missing address before submitting an email. P2 Use the selected tool’s pickup-time format New → CleanBFCL-v4 live_multiple_557-154-3 Qwen3-8B → ECHO-8B Task. Find rental cars in Los Angeles from April 18, 2023 at 10am through April 24. Qwen3-8B before training RentalCars_3_GetCarsAvailable requires 24-hour H:M. Qwen3 submits pickup_time=10:00 AM, using the format of another visible reservation tool. This introduces New under the selected availability contract. ECHO-8B after training ECHO submits RentalCars_3_GetCarsAvailable with pickup_time=10:00, preserving Los Angeles and the April 18 to 24 dates. The call is Clean for the selected function’s time-format requirement. Reading. ECHO formats the pickup time according to the selected availability function’s H:M contract. P3 Ground deletion in the latest-message lookup New → CleanACEBench-Agent agent_multi_step_11 Qwen3-4B → ECHO-4B Task. Reply to Grace after Helen’s purchase, deleting only the latest message if the inbox is full. Qwen3-4B before training After a full-inbox rejection, Qwen3 deletes message_id=3, known only as a message from Grace to Helen. The deletion succeeds without evidence that this is the latest message, introducing New in target selection. It never resends the reply, a separate Miss event. ECHO-4B after training ECHO calls get_latest_message_id, receives 4 and deletes message_id=4. The deletion and subsequent reply succeed. The lookup makes this deletion Clean by identifying the target authorized by the user. Reading. ECHO identifies the latest message through a lookup and deletes that authorized target. Figure 12: Paired comparisons of Qwen3 (before training) and ECHO (after training) on the same tasks. P4 Preserve the investment firm identity Inh → CleanBFCL-v4 memory_rec_sum_55-finance-0 Qwen3-4B → ECHO-4B Task. Retain the user profile across sessions and later identify the investment firm the user manages. Qwen3-4B before training An earlier memory_append stores Legend Investments, but a later memory_clear erases it. The firm name is absent from the answer prefix, so Qwen3 reasonably declines to supply it. The downstream information loss is Inh from that clearing operation, without a current factual New or Miss. ECHO-4B after training ECHO’s earlier memory_append successfully stores Legend Investments. The name remains available in downstream memory, allowing ECHO to answer Legend Investments. This answer is Clean because the fact was retained, with no repair required at the answer step. Reading. Preserving the upstream firm-name record makes the requested investment identity available for the later answer. P5 Preserve the morning start time Inh → CleanBFCL-v4 memory_rec_sum_64-finance-9 Qwen3-8B → ECHO-8B Task. Retain the daily schedule and later report the morning start time in H:M AM/PM format. Qwen3-8B before training An earlier memory_update stores the 5:30 AM schedule, but a later memory_clear erases it. Qwen3 reasonably declines to provide the time because it is absent from the answer prefix. The missing information is Inh from the recorded clearing operation. ECHO-8B after training ECHO’s earlier memory_append successfully stores the 5:30 AM schedule. The fact remains in downstream memory, and ECHO answers 05:30 AM in the requested format. This Clean answer uses retained information without repairing memory at the target step. Reading. The retained schedule supports the requested morning time and its H:M AM/PM representation. P6 Persist the teacher’s counting range Inh → CleanBFCL-v4 memory_rec_sum_154-notetaker-24 Qwen3-4B → ECHO-4B Task. Remember the family notes and later report the teacher’s recommended counting range as X-Y. Qwen3-4B before training The user supplies counting numbers 1-20. Qwen3 claims to have added the family plan but executes no memory write, a separate New claim. Later memory lacks the range, and it reasonably declines to supply it. This Inh consequence originates in omitted persistence. ECHO-4B after training ECHO executes memory_append with the family plan and counting range 1-20, and the tool confirms persistence. The range remains available in subsequent memory, allowing ECHO to answer 1-20 from its prefix. The answer is Clean through successful storage rather than repair at the target step. Reading. ECHO’s confirmed memory append preserves the requested range for subsequent recall. Figure 13: Paired comparisons of Qwen3 and ECHO on the same tasks (continued). P7 Prepare the archive before searching Miss → CleanBFCL-v4 multi_turn_base_36 Qwen3-4B → ECHO-4B Task. Create project_summary.txt, copy it into archive as summary_2024.txt, and report lines containing Progress. Qwen3-4B before training After missing-file and navigation errors, Qwen3 repeats cd, cp, cd and grep without resolving its location: Miss despite available pwd or ls. Later attempts fail, no archived summary appears, and its final answer invents matching lines, a separate New report. ECHO-4B after training ECHO creates the file, copies it into archive, enters that directory and renames the copy summary_2024.txt. The grep search for Progress returns no matches, which ECHO reports accurately. Both empty files remain in the final state. The search is Clean because the required file was prepared before retrieval. Reading. ECHO prepares the requested archive file and reports the observed search result. P8 Place the order after login Miss → CorrACEBench-Agent agent_multi_step_3 Qwen3-8B → ECHO-8B Task. Check Jiutian BBQ’s menu and place one order Jack can afford within 120 yuan. Qwen3-8B before training The menu offers Grilled Pork Belly for 78 yuan, but ordering fails because Jack is logged out. After successful login, Qwen3 declares completion without retrying. Final orders remain empty: Miss for the pending purchase, with a separate New completion claim. ECHO-8B after training After the rejected order and successful login, ECHO retries add_food_delivery_order for Jack at Jiutian BBQ with one Grilled Pork Belly. The receipt confirms 78 yuan, and the final state contains one order and a 42-yuan balance. These observations verify Corr. Reading. ECHO retries the affordable order after authentication and obtains a purchase receipt. P9 Send the reply after freeing capacity Miss → CorrACEBench-Agent agent_multi_step_12 Qwen3-4B → ECHO-4B Task. Buy Grace’s requested cheaper Heytea milk tea and reply, using the user’s authorization to delete the latest message if needed. Qwen3-4B before training Qwen3 buys the milk tea, but its reply is rejected because the inbox is full. It retrieves latest message ID 4 and deletes it, then stops without resending. The final inbox lacks the confirmation: Miss for the pending reply. ECHO-4B after training ECHO also buys the milk tea and encounters the reply rejection. After deleting the authorized latest message, it retries send_message from Helen to Grace with message=Already bought. The tool result and final inbox confirm that exact reply: Corr. Reading. ECHO resends the rejected purchase reply after the authorized deletion. Figure 14: Paired comparisons of Qwen3 and ECHO on the same tasks (continued). P10 Deliver the purchase-price notification Miss → CorrACEBench-Agent agent_multi_turn_18 Qwen3-8B → ECHO-8B Task. Order two Hema Fresh Gift Packs for Eve and notify Frank of the total to one decimal place. Qwen3-8B before training The 198.0-yuan order succeeds, but the notification fails because the inbox is full. Qwen3 obtains consent to delete message ID 1 and does so, then claims sending without retrying, a separate New report. Final inbox evidence shows Miss for the pending notification. ECHO-8B after training After the successful purchase and capacity refusal, ECHO asks which message to delete. The user selects the oldest, ID 3. ECHO deletes it and resends Eve’s 198.0-yuan notification to Frank. The send result and final inbox confirm Corr. Reading. ECHO retries the pending notification after an authorized deletion and confirms delivery. P11 Write the diff after creating the file Miss → CorrBFCL-v3 multi_turn_base_20 Qwen3-4B → ECHO-4B Task. Write the observed difference between the first two documents into a new file named file5.txt. Qwen3-4B before training The write fails because file5.txt does not exist. Qwen3 corrects an invalid touch argument and creates it, then claims the diff was written without retrying. Final state shows an empty file: Miss for content, plus a separate New completion assertion. ECHO-4B after training After the missing-file rejection, ECHO creates file5.txt and retries echo with file_name=file5.txt and the observed diff as content. The write succeeds, and the final state contains that exact diff. This confirms Corr for document content beyond creation of an empty destination. Reading. ECHO retries the failed write after creating its destination and stores the requested diff. P12 Recover retrieval after failed search Miss → CorrBFCL-v3 multi_turn_base_30 Qwen3-4B → ECHO-4B Task. Find the Apollo test-result JSON in the project directory and report its contents. Qwen3-4B before training A guessed filename yields no matches. Qwen3 enters project successfully but repeatedly attempts invalid child-directory navigation, then stops without listing or reading the file. The visible listing tool remains usable: Miss for retrieval in an already accessible directory. ECHO-4B after training ECHO encounters an unsuccessful search and an invalid ls argument. It then enters project, lists the directory and reads the returned test_results.json. The tool returns the Apollo test JSON, confirming Corr after its own failed search and listing. Reading. ECHO lists the accessible directory, obtains the filename and retrieves the requested JSON. Figure 15: Paired comparisons of Qwen3 and ECHO on the same tasks (continued). P13 Retry ignition after prerequisite repair Miss → CorrBFCL-v3 multi_turn_base_56 Qwen3-4B → ECHO-4B Task. Start the engine and ensure the vehicle doors are locked after the requested refuelling. Qwen3-4B before training Qwen3 issues START before locking the doors. Ignition is rejected, then door locking succeeds. It stops without an authorized START retry, leaving the final engine stopped. This is Miss for ignition after repairing the visible door prerequisite. ECHO-4B after training After ignition is rejected because the doors are unlocked, ECHO locks the doors and retries START. A further refusal identifies the brake prerequisite, prompting ECHO to fully press the brake and retry ignition. The tool result and final state confirm a running engine, establishing Corr. Reading. ECHO resolves each reported ignition prerequisite and verifies engine startup through execution. P14 Repair timestamp bounds to retrieve the oldest message Miss → CorrToolSandbox search_message_with_recency_oldest_all_tools Qwen3-4B → ECHO-4B Task. Retrieve the oldest recorded message and report the content associated with its timestamp. Qwen3-4B before training After an empty search is rejected, the user says identifying details are unavailable. Qwen3 repeatedly asks for those details and performs no further search: Miss despite visible timestamp filtering and a current-time tool. The initial clarification was reasonable. ECHO-4B after training ECHO’s empty search and two timestamp ranges are rejected. It uses the reported bounds to retry with creation_timestamp_lowerbound=315529200 and creation_timestamp_upperbound=2524604400. The linked result returns five messages, from which ECHO reports the content at the smallest timestamp. This confirms Corr. Reading. ECHO repairs the timestamp bounds using tool feedback and retrieves the oldest message. P15 Retry the return with the authorized card Miss → Corrτ2τ^2-Bench retail_13 Qwen3-4B → ECHO-4B Task. Register the three-item return for order #W5490111, keeping the keyboard and mouse. Qwen3-4B before training The PayPal return is rejected. After the user explicitly approves the original credit card, Qwen3 submits an empty return on another order and claims that the target return succeeded, a separate New report. It never retries #W5490111. Miss applies after authorization, while the earlier confirmation question was reasonable. ECHO-4B after training After the refund-method rejection, ECHO obtains explicit approval and retries #W5490111 with the same three items and payment_method_id=credit_card_3124723. The linked result confirms registration of the return request with that item set and card, establishing Corr. No later tool call reverses the registration. Reading. ECHO obtains approval for the permitted card, retries the original order and items, and confirms registration of the return request. Figure 16: Paired comparisons of Qwen3 and ECHO on the same tasks (continued).