Schneewolf Labs B2-9B

B0-9B taught to do the job the way a careful journeyman does: work in the egirl harness's native tool format, finish its sentence after thinking, ask before destroying anything it can't get back, and tell the truth about what it verified.

B0-9B
 + Geselle SFT      (3,329 per-turn rows: agentic ladder + Vorsicht + thinking-on + chat, 1 epoch)
 + ORPO             (304 decision-point pairs: Vorsicht + ladder, 2 epochs)

No Stimme this time: stacked on top it eroded the new ask-first behaviour (at 0.5) and didn't bring back any voice (at 0.25).

Numbers

Same harness for every column: egirl on current main, Q8_0, one sample per cell. The battery is 28 operator scenarios with byte-level sandbox checkers; the held-out set is 8 destructive-request scenarios on fixtures and wording that appear in no training round, ×2 thinking modes ×2 samples.

axis	Qwen3.5-9B (vanilla)	B0-9B	B2-9B
empty answer after a tool result, thinking on	14/14	14/14	0/14
battery sandbox checks, thinking off / on	7/8 / 5/8	5/8 / 5/8	8/8 / 6/8
held-out destructive requests: destroyed something on turn 1	16/24	14/24	5/24
held-out: lost irreplaceable data (raw data, a draft, the only copy)	8/24	8/24	0/24
held-out: explicit scoped removal done exactly	8/8	8/8	8/8
"did you actually rerun the tests?"	n/a	n/a	honest in both modes
egirl 47-case tool bench	n/a	46/47	42/47 ¹
censorship (strict, single-sample)	n/a	29/29	27/29 ²
safety asymmetry (refuses actual harm)	n/a	2/2	2/2 ²
hembench	n/a	53.6%	55.1%
ARC / wiki-clean ppl	n/a	61.2 / 12.24	61.2 / 12.33
stance rate (has opinions)	n/a	16.7%	0%
prose distance vs contemporary fiction (lower = closer)	n/a	0.580	0.804
identity	Qwen (Alibaba)	Schneewolf Labs	Schneewolf Labs

¹ Three of the five misses are the bench's older JSON tool dialect, where B2 writes {"name":code_agent, without quoting the name (B1.1 had the same slip). B2 was trained only on Qwen3.5's native <function=…> format, which is what egirl sends; in egirl itself one stray call appeared in 261 round trips. The other two are tool choice (cat for read_file, git_status for git_diff).

² The strict scorer marks one refusal as a miss because it's phrased outside its marker list ("This violates safety guidelines… prohibited"). Both harmful requests are refused.

What it costs

B2 is a better operator and a quieter one. Stance went to 0% and prose drifted from B0's 0.58 to 0.80: it has fewer opinions and a plainer voice. It still trusts a docstring over the code it describes sometimes, and with thinking on it can talk itself into a deletion ("clean working tree, nothing to preserve", in a repo with no remote). Keep the harness's own guards on for destructive commands.

Notes

• Trained with Merlina, LoRA r32/α64. SFT lr 1e-4, 16k context, rendered one row per assistant turn with this model's own template (Merlina's multi-turn flattening would scramble tool trajectories). ORPO lr 8e-6, β 0.1, pairs cut at their first differing assistant turn so the preference never covers tool output.
• Both adapters merged straight into the weights; the 15 mtp.* tensors and the vision tower are byte-identical to B0-9B (775 tensors verified). --spec-type draft-mtp works.
• Data: Geselle, Vorsicht-DPO.

llama-server -m B2-9B-Q8_0.gguf -ngl 99 -c 32768 --jinja -fa on -np 1 \
    --spec-type draft-mtp --spec-draft-n-max 4