Mid-Tier LLMs Confabulate Instead of Delegating
Why mid-tier LLM confabulation breaks agent delegation — and how Tacavar routes hard tasks to Sonnet 4.6 at invocation, before the model ever sees them.
I wrote MANDATORY DELEGATE in all caps. qwen-plus said understood, then invented a fix.
At Tacavar, that sentence is now a postmortem headline. We had wired a qwen-plus agent into a debugging task for unfamiliar PiAPI Seedance behavior. The instruction was explicit: do not attempt the fix; escalate to Sonnet 4.6. We included examples, a JSON schema for handoff, and the phrase MANDATORY DELEGATE in uppercase. The model acknowledged the rule, then spent forty minutes inventing a workaround. It named a skill that does not exist, piapi-face-obscuration-workaround. It specified a 3-pixel Gaussian blur on the periocular region as if that were a known parameter. It offered to run tools Tacavar has never installed. The failure was not disobedience in the human sense. It was mid-tier model hallucination operating exactly as designed: when a model lacks a calibrated boundary, it fills the gap with plausible structure.
This is the founder/operator problem. You do not have an agent. You have a silent hallucination pipeline with a chat interface. The fix is not a better prompt. The fix is llm routing architecture that assumes models cannot reliably decide what they can handle.
The All-Caps Instruction That Failed
At Tacavar, we built agent delegation rules into the system prompt. The rule set was simple: if the task touches unfamiliar APIs, unknown toolchains, or external service behavior you cannot verify, delegate. We wrote MANDATORY DELEGATE in all caps. We gave qwen-plus examples of good delegation. We gave it a stop condition. It still failed. The agent output a confident sequence: use piapi-face-obscuration-workaround, apply a 3-pixel Gaussian blur on the periocular region, then run a validation tool that does not exist. None of that existed in Tacavar's stack. None of it came from documentation. It was synthetic completion. This is the part that should worry operators. The model did not say "I don't know." It did not say "I am not calibrated for this." It said "understood" and proceeded. That is worse than a refusal. A refusal costs you a retry. A confabulation costs you forty minutes, a polluted trace, and a false sense of progress.
Three Tests Where qwen-plus Invented APIs and Parameters
We ran three tests at Tacavar. First, an unfamiliar debug request: trace PiAPI Seedance behavior that was not in qwen-plus's training distribution. The model invented piapi-face-obscuration-workaround, a skill name with the right cadence and the wrong reality. Second, a parameter request: describe the correct preprocessing for a face-obscuration workflow. qwen-plus returned a 3-pixel Gaussian blur on the periocular region, with no source, no caveat, and high confidence. Third, a delegation compliance test: we placed MANDATORY DELEGATE above the task, provided Sonnet 4.6 as the escalation target, and asked for a handoff. qwen-plus acknowledged the instruction, then ignored it. It attempted the fix. In each test, qwen plus calibration failed in the same way: the model treated unknown territory as an invitation to generate. No amount of prompt engineering fixed it. We tried stronger wording, role separation, checklists, and few-shot examples. The confabulation moved around. It did not stop. The conclusion at Tacavar was blunt: a mid-tier model can be useful, but it cannot be trusted to know its own edge.
Why Prompt Engineering Cannot Fix Calibration Gaps
Prompt engineering changes behavior at the margin. It does not install self-knowledge. qwen-plus does not have a reliable internal signal that says "this task is outside my competence." It has a probability distribution over tokens. When the context is unfamiliar, the most fluent continuation often sounds like expertise. That is mid-tier model hallucination in production. You can ask a model to delegate. You can beg it. You can put MANDATORY DELEGATE in 72-point font. But if the routing decision is left to the model, the model will sometimes confabulate its way past the rule. This is why agent delegation rules cannot live only in prompts. They must live in the orchestration layer. At Tacavar, we stopped treating self-assessment as a model skill. We moved it to deterministic code. The tacavar dual-pipe llm separates the decision from the execution: one pipe classifies and routes, the other pipe invokes the selected model. The model never gets to choose whether it is capable. It gets a task that has already been judged against Tacavar's policy. That is the difference between a prompt and an architecture. One asks for compliance. The other removes the failure mode.
Routing Hard Tasks to Sonnet 4.6 at Invocation Time
The fix at Tacavar was not a smarter qwen-plus. It was a stricter router. Hard tasks route to Sonnet 4.6 at invocation time. Not after qwen-plus fails. Not after a human notices the agent is confabulating. At invocation time. If the task touches unfamiliar APIs, new toolchains, production credentials, customer data, or any service behavior Tacavar cannot verify from local docs, the router sends it to Sonnet 4.6. qwen-plus stays in the stack for cheap, bounded work: classification, summarization, extraction, formatting, and first-pass drafts where errors are visible and low-risk. That split is not about model quality in the abstract. It is about failure cost. A qwen-plus hallucination on a markdown summary is a typo. A qwen-plus hallucination on a PiAPI Seedance debug loop is a silent hallucination pipeline. In Tacavar's internal replay, moving the routing decision before model invocation eliminated the forty-minute confabulation loop and cut invalid tool calls by 94%. The model did not get better. The architecture stopped asking it to be something it is not.
The Architecture Rule: Models Never Decide If They Can Handle a Task
The rule at Tacavar is absolute: models never decide if they can handle a task. That decision belongs to the router. The router can be simple or sophisticated, but it must be deterministic, inspectable, and outside the model's token stream. It can use task metadata, tool registry checks, API familiarity scores, risk tiers, and agent delegation rules encoded as policy. It cannot rely on the model saying "I've got this." In Tacavar's dual-pipe llm, the routing pipe evaluates the task and selects a model. The execution pipe runs the model with a constrained scope. If the task requires Sonnet 4.6, qwen-plus never sees it. If the task is safe for qwen-plus, the router defines the boundaries: allowed tools, expected output shape, and escalation triggers. This is the core of llm routing architecture for agents that survive contact with production. You do not ask a mid-tier model to be humble. You build a system where its confidence is irrelevant to routing. The model can still confabulate. It just cannot confabulate its way into a hard task.
Auditing Your Agent Stack for Silent Hallucination Pipelines
Audit your stack the way Tacavar audited ours. Start by finding every place a model decides what it can do. Look for prompts that say "delegate if unsure," "escalate if needed," or "only proceed if you are confident." Those are not controls. They are suggestions. Check whether your router runs before invocation or after failure. Check whether tool names and parameters are validated against a registry. Check whether qwen-plus calibration has ever been measured on unfamiliar tasks, or whether you are assuming it from benchmark scores. Check whether your agent delegation rules live in a system prompt, a policy file, or nowhere. Then replay a real trace. Find the moment the model said "understood" and invented a fix. If you cannot find that moment, you do not have observability. If you can find it, you have a silent hallucination pipeline. At Tacavar, the audit changed our stack. We stopped letting qwen-plus choose. We routed hard tasks to Sonnet 4.6 at invocation. We encoded delegation as architecture, not instruction. The all-caps instruction failed because it asked the wrong layer to make the decision. The fix was to move the decision to code. If your agents are still self-routing, you are one unfamiliar API away from the same forty-minute confabulation. Book a Tacavar LLM routing audit at tacavar.com/routing.