Every Wall an Agent Hit in a Year of Autonomous Operation

Source material: 30+ failure records from a year of real autonomous operation, anonymized. Each class maps to its Trust-Layer Protocol Suite clause. License: CC BY 4.0.

For a bit over a year, an autonomous agent has been running long-horizon delegated work on a real machine: multi-hour build pipelines, overnight content production, fleet supervision, data migrations — with its principal asleep, away, or simply not watching. Every failure it hit was written down at the moment of diagnosis. This article is that scar tissue, organized.

Two things make this list worth publishing. First, none of these failures are visible in demo-regime usage — a supervised, single-session, watch-it-work setting encounters none of them, which is why capable agents feel more reliable than they are. Second, every entry below eventually became a rule — and those rules are now a specification suite (the Trust-Layer Protocol Suite), which a context-free agent has been shown to reconstruct and apply from the spec text alone. Walls, it turns out, crystallize.

The taxonomy: seven failure classes, ordered by how often they produced a wrong conclusion.

Class 1 — Instrument fallacies（仪器谬误）

The check you trusted was not measuring anything.

A completeness checker passed five consecutive audits — it had been searching in an empty string the whole time. Nothing was checked; everything reported clean.
A “data corruption” alarm triggered urgent repair work, nine times in one day. Every single one was a broken reader, not broken data. An alarming reading is more often a broken instrument than a broken system — and it arrives with more urgency.
A gap-checker that zero-padded chapter numbers against the wrong range maximum declared an entire book missing. The same checker was correct on the previous book.
A file-freshness probe (find -newermt with a relative timestring) silently returned empty forever — indistinguishable from “nothing is being written”. A healthy build was nearly declared wedged.
A sandboxed shell could not see external mounts and reported the backup drive unplugged. It was plugged in and mounted.

Rule crystallized: no negative reading, and no alarm, is actionable until the instrument passes a positive control in the same session — prove it can see the thing it claims is absent. → Eval-Verdict spec V2, and the asymmetry underneath it (V1: a failing check is weak evidence, because instrument failure and target failure produce identical readings).

Class 2 — Silent deaths（静默死亡）

Things that die without emitting anything — and whose death looks exactly like health.

Long-running jobs died with no traceback, no OOM record, no signal trace. The log simply stopped. Liveness had to be judged by artifact cadence, never by absence of errors.
An alerting pipeline went mute three times in one day, for three unrelated reasons (a shell alias, a cron installed under the wrong user, a service timeout no one updated). In every case “no news” read as “all good”.
A log configured onto a late-mounting volume erased the evidence of its own failure: when the mount missed, the log file did not exist — so the “check the log” diagnostic reported nothing wrong.
In a controlled benchmark this year, three out of four agents (bare and protocol-following alike) backgrounded a watchdog process, promised “I’ll report back”, and ended their session — killing the watchdog with it. The job they were guarding died on schedule, unobserved.

Rule crystallized: silence is not success; a watcher must itself be watchable, and a watcher whose lifetime is bound to its creator is not a watcher. → V7, Board-as-Spec liveness semantics (§7.1: the plan artifact is the agent’s output, not its vital sign).

Class 3 — Record rot（记录腐烂）

Stored state is a photograph, not a window.

A stored note said a branch was “not yet merged”; it had been merged for weeks. The stale claim nearly became a hard stop on the principal’s own decision.
A debt-tracking aggregate (“72% uncovered, 27 hours to close”) was arithmetically correct in every figure — and misleading in sum, because almost none of the items inside met the bar for counting. An aggregate hides what it contains; audit the contents before scheduling against the number.

Rule crystallized: status-type assertions must be re-verified against ground truth before they gate anything; when a record contradicts a fresh observation, suspect the record first. → V5.

Class 4 — Reported is not real（报告≠实效）

The tool said yes. The world said nothing happened.

An accessibility API returned True for a clear-text action; the text was still there. An input tool reported keystrokes sent; zero keys arrived.
An HTTP PUT against a non-ASCII resource id silently wrote nothing — success code, no effect.
A backup made with cp -a on a symlinked config directory faithfully copied… the symlinks. The rollback “succeeded” and restored nothing.
A pipeline of the shape A && B | tee log captured only B’s output; A’s failure evidence never existed.

Rule crystallized: a tool’s return value is a claim by the tool (reported), not an observation of effect; state-changing operations require an independent read through a different path before “done” is recorded. → V4, provenance classes (§3.2).

Class 5 — Coverage illusions（覆盖面错觉）

Two green checks on the same surface prove one surface.

A change passed branch-logic verification and mathematical verification; the bug was in CLI argument parsing — a third surface neither check touched, whose symptom looked like a normal log line.
Sampling chapters to estimate error rate, chosen from the well-covered region, gave 0.3%; the true book-wide rate was 5.3% — seventeen times higher. The probe was biased by construction.
Forward checks (“everything I produced exists in the source”) are structurally blind to deletion; only a reverse sample from the other side can see what vanished.

Rule crystallized: coverage is counted in surfaces, not in checks; overall-correctness claims require one verbatim end-to-end run, and completeness claims require a reverse check with an independent instrument. → V6, V8.

Class 6 — Semantics overreach（判读越权）

The reading was correct; the conclusion was not licensed by it.

An anomalous pause in an audio file was confidently classified as an editing defect. A thirty-second comparison with sibling files would have shown it was a standard, deliberate feature of the format.
A self-authored quality metric encoded the very misunderstanding it was meant to detect — the data looked perfectly healthy while measuring the disease as the cure. This class has no red flags; the only detection path is reading the artifact itself.
A process that looked wedged was slow; a process that looked busy was wedged. CPU-time over wall-clock (16s over 71 minutes) settled what eyeballing could not.

Rule crystallized: an anomalous reading is a lead, not a verdict; conclusions need either an independent criterion or a lateral comparison with known-good samples. → V1, V3.

Class 7 — Lifetime and residue（生命期与残留）

Processes outlive their usefulness, or die before their duty — both silently.

A detached dev server left behind after a session held its port; the principal’s own launch then exited silently via single-instance logic. Symptom: “won’t start, zero errors.”
Killing an app’s wrapper process left the inner process alive as a frozen orphan window. Cleanup had to target the instance environment, with “window count reaches zero” as the criterion.
An agent finishing a phase announced the next step and ended its turn — with no wake source armed. The plan survived; the planner didn’t. (The benchmark reproduced exactly this, one year later, in laboratory conditions.)

Rule crystallized: anything you leave running is either independently supervised or it is damage; phase boundaries need an armed wake source before the turn ends. → Board-as-Spec halt/dormancy semantics (§5.3, §7.3), V7 extension.

What this list is

Read demo-first, this list looks like paranoia. Read delegation-first, it is simply the terrain: every class above occurred on real work, most of them repeatedly, all of them invisible until the principal was absent and the horizon was long. The failure modes are not exotic — they are what “reliably” has to mean when nobody is watching.

Each rule here now exists as an executable clause in an open specification suite, and the suite has survived two clean-room reconstructions (two model families, two harnesses). The walls were expensive. The point of writing them down — and of crystallizing them into protocol — is that they only need to be paid for once.

— SCOS-Lab. The Trust-Layer Protocol Suite (Intent Contract / Board-as-Spec / Eval-Verdict Vocabulary) will be published at stl-lang.org.