Self-Calibrating Interruption of Agent Doom Loops via Risk-Controlled E-processes

Language-model agents run in harness loops that call an API-served policy and execute tools, so every iteration is billed. Much of that cost buys nothing: agents fall into *doom loops*, spending long after success has become improbable. Turn caps, token budgets and repetition heuristics kill salvageable episodes, per-step judges add a model call per step, and activation probes need internals that an API does not expose. The target is undefined: the conditional success probability is a zero-drift martingale, so no rule can wait for it to decline. Because a controller inspects every step, fixed-sample calibration is either invalid, realizing a $14.80\%$ false-kill rate at a nominal $5\%$, or crippled by a horizon union bound that cuts cost by only $7.38\%$. Least recognized, an interruption policy censors its own labels: the episodes it kills are exactly those whose uninterrupted outcomes identify its risk. We present Circe, which defines a doom loop as a *value-stall* (low salvage probability with vanishing information yield per dollar) and certifies it with a test supermartingale over a log-derived stall indicator, bounding by $\alpha$ the probability of ever halting a salvageable trajectory under adaptive inspection, with no horizon penalty and asymptotically optimal delay. Its central mechanism is *randomized reprieve*: a firing certificate halts with probability $1-ϵ$ and otherwise releases the episode to natural termination with known propensity $ϵ$, restoring identification and yielding a doubly robust salvage-loss estimator with a time-uniform confidence sequence and $\tilde{O}(K^{2/3})$ self-calibration regret over $K$ deployment rounds. On software-engineering, terminal and web-navigation suites and a near-saturated tool-calling control with `glm-5.2`, Circe cuts cost $36.35\%$ at a $0.38$ pp pass@1 difference and $0.52\%$ false kills, using $34$ log-derived features and no model internals, extra calls, or GPUs. Under a mid-stream model and difficulty shift every tested baseline breaches its risk constraint by up to $0.088$ unnoticed, while scheduled reprieve caps violation at $0.015$ and flags it within two rounds at $2.4\%$ exploration spend.