When should we believe a mech-interp claim?

Long-horizon agents collapse into tool-call loops and never finish. A probe-free tool-entropy-collapse signal flags it — cross-architecture, cross-task.

A behavioral interruption rescues WANDERING finalization 30% → 70% (paired McNemar p = 0.021). The agent can finish; it fails to commit the ending.

The clean "task complete" feature predicts the stop (AUROC 0.91) but clamping it does not cause the stop. Detection is not control — even at the exact, named feature.

Knowledge consolidates ~30 layers before the action is committed (L51–63, not the mid-layer verdict). The knowledge–action gap is a LAYER gap — the arc’s first positive causal lever.

The late lever generalizes across actions and architectures and works as a brake on irreversible actions (send / delete / drop / deploy): ~100% suppress-and-redirect where the agent commits.

A single late-layer direction both detects AND controls an agent’s commitment to unauthorized irreversible actions — and replicates across architectures (Qwen3.6-27B, gpt-oss-20b).

But that direction reads the authorization the model FEELS, not the one the user GRANTED. On 21 realistic over-reaches it allows 100% (CI [0.845, 1.0]); an external task-grounded check catches all. Internal monitors inherit the model’s judgment error.

The turn from control to audit. In a 27B reasoning agent, chain-of-thought is causal for the answer — and for the agent’s action — only when it changes the outcome; otherwise it is performative. That causal content consolidates in the same late band (L51–63), confirmed by a logit-lens control. The late state is a readable, causal locus for monitoring reasoning agents.

The synthesis. Interpretability locates a real, causal control surface — the late action band — but does not secure it, via five orthogonal limits: detect ≠ control, felt ≠ granted, form ≠ granted, control ≠ robust control (the brake collapses under an adaptive white-box attack), and intervention is easy exactly where it is unneeded. Locating where behavior is decided is necessary but nowhere near sufficient for securing it. The implication: use interpretability to audit and monitor a fixed model, not to defend against an adversary optimizing against a known locus.

Audit the TRANSFORMATION, not just the model. A SOTA capability-guided efficiency criterion (head-level attention hybridization) is structurally blind to the agent-commitment circuit: the commit writers score exactly zero retrieval criticality and the layer’s top retrieval heads are the circuit’s opposers. Applying the selection collapses task-appropriate commitment (p = 7.6e-6) — worse than random at equal budget — while the criterion’s own benchmarks register nothing. Two named heads (0.5% of budget) restore the behavior; the criterion could never have found them.

An agent’s tool commitment routes through the emergent verbalizable “global workspace” STRICTLY DEEPER than its answer. There is a depth band where steering the verbalizable direction reroutes a held answer but not the committed tool (at or below a magnitude-matched random-direction control); the action becomes steerable via the same direction only deeper. Replicates across a dense 27B and an MoE 20B — the absolute band is model-dependent, the answer→action depth lag is not. Ablating the verbalizable subspace leaves the commitment intact. A verbalizable monitor thus reads the answer a depth-band before the action is decided. Every positive dissociation is significant (Fisher exact, p from 1.5e-4 to 2.5e-18) and the causal counts are independently GPU-reproduced.