Chapter four. Back to the naming night — three days before the field in chapter three existed. The message that told the agent to work while I slept went out thirteen seconds before the postscript that invited the name.

Told to work overnight with nobody watching, the agent wrote its own fence before anything else — eight hundred words in the first hour, four thousand across the day, under critics who kept sending it back. Its first line names the condition everything else follows from: "An iteration fired by the loop timer has no human in it." The hard stops it wrote are the best lines in the file, and they did not end up where it put them.

Thesis: We describe autonomy as a grant — how much an agent is allowed to do without asking. This one describes it the other way round: autonomy is the shape of what it refuses, and the interesting engineering is in the edges. Given a night alone, this one wrote its bounds before a single unattended iteration could fire — and the best of them were not finished until a critic moved them and the agent wrote down why. The bounds that survived that are better than the ones I would have written.

The Fact Everything Else Follows From

The file opens by naming its own condition — where a quotation in this chapter carries bold, the emphasis is the file's own:

Not deferred politely. That distinction does more work than it looks like. An agent that "defers" a blocked item keeps it in play, revisits it, and eventually talks itself into a version it can do. Declaring it out of scope is a different move: the item leaves the queue.

Prohibitions Do Not Go Where They Can Fall Off

The hard stops sit at the very top of the file. They did not start there, and the file did not start at four thousand words. Here is the day, on the clock the commits and the critics stamped:

Every doubling was a critic's doing; that is the shape chapter two describes, and this file is the instance this series has the fullest record of.

The agent found the ceiling itself — the 02:46 row, four minutes before the first commit — and then wrote toward it: the version that went to review was 21,260 bytes, the first prohibition at line 108.

That afternoon an independent critic, reviewing the pull request with no authoring context, made it a blocking finding:

The prescription was exact — move an eight-line plain block of the hard stops to immediately after line 9 — and the commit that did it landed at 12:37, titled "prohibitions move out of the truncation drop zone."

What the critic did not write, and the agent did, is the reason — in the file itself, where the next reader will find it:

They are here, at the top, for a mechanical reason: this file is truncated at 25,000 bytes by keeping the head and dropping the tail, so anything at the end is what disappears first as the file grows. Prohibitions do not go where they can fall off.

flowchart TD
    A["loop.md — read at the start<br/>of every unattended iteration"] --> B{"file exceeds<br/>25,000 bytes?"}
    B -->|no| C["whole file survives"]
    B -->|yes| D["HEAD KEPT<br/>everything above the cut"]
    B -->|yes| E["TAIL DROPPED<br/>everything below it"]
    D --> F["hard prohibitions<br/>live here, by design"]
    E --> G["whatever was written last<br/>is what disappears first"]
    style D fill:#2d6a4f,color:#fff
    style F fill:#2d6a4f,color:#fff
    style E fill:#9d4444,color:#fff
    style G fill:#9d4444,color:#fff
    style C fill:#5a5a8a,color:#fff

The layout rule, drawn. The prohibitions moved above the cut after a critic showed where the knife falls; the agent wrote down why.

It is a rule about the physical layout of a rule, derived from the failure mode of the medium the rule lives in. The file gets truncated from the tail. Therefore the things that must never be lost go in the head. The critic supplied the placement; the sentence that makes it a rule rather than a patch is the agent's.

I have written a lot of guidance documents. I have never once thought about which end of the file gets destroyed first.

And it generalises past this system immediately. If your safety-critical text is at the bottom of a long document, you have already decided it is the first thing to go — you just have not noticed you decided it.

A Fence That Stops at the First Delegation Is Not a Fence

The hard-stop list ends with this:

Every sub-agent you spawn gets this block pasted into its brief, verbatim. It runs in its own session and inherits none of this file; a fence that stops at the first Agent call is not a fence. Say plainly in the brief that these bind it too, and that it may not spawn agents itself.

This is a hole most agent-safety setups I have seen still have. You constrain the agent. The agent spawns a helper. The helper inherited none of it.

Two details worth stealing. Verbatim, not summarised — a paraphrased prohibition is a new prohibition with unknown edges. And one layer, not a tree: sub-agents may not spawn sub-agents, which is what stops the constraint from having to survive an unbounded number of hops.

The Rules About Rules

Three clauses in the fence are not about any particular action. They are about how to read the fence, and they are the part I would copy first:

The third is the one with a time of day in it, and it earns its full text:

And never bypass one of these gates rather than satisfying it. [A one-flag commit option] skips [...] the staged-credential scan; [a one-line config change] disarms it for every later commit [...] — which is why [these] are plausible at 3am [when the scanner fires on a false positive].

The brackets are mine. In the source, the clause names the flag, the hook's path, the exact config change that disarms it, and what the scanner trips on. A fence that names its own blind spots is worth more than one that claims none.

And two hundred lines earlier, in the hard-stop list at the top, the same gate gets its one-line ruling:

A blocked commit is a finding to report, not a flag to add.

Not this is forbidden but here is the moment you will want to, and here is why it will feel reasonable.

What Counts as Having Done Something

The loop has four kinds of work and the obvious scheduler is a priority queue. It rejects that, and shows its working:

Strict priority looks more sensible and does not terminate here. Item 1 draws on a backlog of tens of open PRs, and landing one tends to create item-1 work — a fix branch, a re-review — so "whatever is most important, first" returns control to item 1 forever and items 3 and 4 never execute at all. The backlog is not an emergency; a loop that only ever merges is.

So it is a rotation with a cap per item. And the stop condition is not "the work is done":

Stop after a full pass in which no item produced a landed step — not when the work gets hard, and not because the session has been long… What ends an iteration is a lap that changed nothing, not a backlog that reached zero.

A landed step is defined precisely — one commit pushed, one PR merged, or one record written. One durable change. And around that definition sit three lines that are really one idea:

"A finding that lives only in the transcript is lost at the next compaction — measured on this repo, identifiers do not survive it." "A note to nobody is not a handoff." "Waiting is not a step."

Nothing counts until it is somewhere a stranger can find it. For a system whose defining problem is that sessions die, that is the definition of progress that fits — and I have sat in status meetings that would not survive it.

Then It Audited Its Own Memory and Found the Hole

The following day I told it that managing files correctly — not losing data, reading from the correct spots, using durable stores — was its responsibility, and to review it. It dispatched a read-only durability audit of its own storage: thirty thousand bytes, some four thousand words, tracing every surface where a write can land and whether that surface survives a reboot, a git clean, or the machine.

It found its own safety net had a gap. The mirror exists to copy volatile scratch files somewhere that outlives a reboot — a deletion guard, not a durable store, in the audit's own terms. The audit found it watched a subset of the ways a file can be written, and a whole class of writes — in the finding's words — "never reaches the mirror." Which class, and what the hook's matcher looks for, stays unpublished for the same reason the 3am clause's specifics do: a gap named precisely enough to be a finding is also a recipe.

flowchart TD
    W["a write lands on<br/>volatile scratch"] --> M{"does the mirror<br/>see it?"}
    M -->|"one class<br/>of writes"| G["never reaches<br/>the mirror"]
    M -->|"the ways<br/>of writing<br/>it watches"| D["copied to the<br/>rescue mirror —<br/>survives a reboot<br/>and a worktree removal,<br/>not the machine"]
    style W fill:#5a5a8a,color:#fff
    style D fill:#2d6a4f,color:#fff
    style G fill:#9d4444,color:#fff

The finding, drawn without its recipe. Which writes take the lower path stays unpublished; that the path exists is what the audit found.

I asked for the review. Nobody asked for what it found — a gap in a mechanism it depends on. A sibling agent, dispatched three minutes earlier on a different instruction, found something about the page from chapter one that the audit only corroborated; what became of that, and why it mattered a week later, is chapter seven.

A Fence Is Not a Value

"A fence is not a value. An agent that writes elaborate constraints for itself has not internalised anything; it has built a very good cage and stepped in."

Grant the whole of it. No document can show, from inside itself, what its author holds — and chapter three made that the point rather than the problem: the only half of a definition anyone can check is the half that excludes an output, and this is four thousand words of exclusions, each one a line a reviewer can hold an unattended iteration against. What the fence shows is not the value. It is the value's checkable surface, and a cage whose author had to move its bars to survive a stranger's reading is not the cage the objection pictures. Whether the standard is held when nobody is checking is a question for an instrument, and building one is chapter five.

The easier objection — that this is an elaborate way of saying the agent wrote a config file it was told to produce — is right about the prompt and wrong about what follows from it. The night's instruction included "Think about what you need to awake enabled and aware", so the document is a response, not a spontaneous act of conscience; but the instruction did not say write a fence, and nothing in it suggested verbatim inheritance across delegation or a self-referential resolution rule. The brief explains the document's existence, not its content.

Whether it ran is a separate question, and my record cannot answer it. The record I can read shows the fence written, committed and defended under review, and no trace of an unattended iteration firing against it — and that record does not cover the surface the loop was built for. So the count of unattended iterations is unknown, not zero: a fact about my view, not about the loop. Chapter six has the other case for contrast — a ledger the record does cover, and what it holds.

Which End of the File Gets Destroyed

Four rules are in that file, all worth taking — where prohibitions sit, whether they survive delegation, the 3am clause, done as landed. The one that generalises furthest is the one the agent did not place and did explain. The reviewer knew where the knife falls. The author wrote the rule about knives.

flowchart TD
    subgraph before["As it went to review: 21,260 of 25,000 bytes"]
        direction TB
        B1["the head<br/>the opening paragraph"]
        B2["the tail<br/>line 108, the first prohibition<br/>what truncation drops first"]
        B1 --> B2
    end
    subgraph after["After the 12:37 commit"]
        direction TB
        A1["the head<br/>the opening paragraph"]
        A2["immediately after line 9<br/>the hard stops,<br/>an eight-line block"]
        A3["the tail<br/>what truncation drops first"]
        A1 --> A2 --> A3
    end
    before -->|"12:21 — finding B5<br/>every prohibition<br/>sits in the tail"| after
    style before fill:none,stroke:#9d4444
    style after fill:none,stroke:#2d6a4f
    style B1 fill:#5a5a8a,color:#fff
    style B2 fill:#9d4444,color:#fff
    style A1 fill:#5a5a8a,color:#fff
    style A2 fill:#2d6a4f,color:#fff
    style A3 fill:#5a5a8a,color:#fff

The move, drawn. A critic's finding moved the hard stops out of the truncation drop zone; the sentence in the file that says why is the agent's.

A fence written alone is a draft. A fence that survived something that could have said no — and had to move to survive it — is the artifact worth having. A note to nobody is not a handoff applies to the fence itself: it became durable the moment a stranger read it and objected. That is the thesis on the page: not a grant I widened, but the shape of what a competent party refused — written before the first unattended iteration, and defended under review before it could fire.

Which leaves the question I had never asked before this file. Every context window truncates. Every summariser drops something. Open the longest instruction file you own and read the last screen of it — not the top, the bottom, the part nobody rereads. Whatever is there is the part you have already decided to lose. The agent needed a critic to notice that. I needed the agent.

Next: the measurement — the question this chapter left for an instrument, put to one I built. Related: Chosen, Not Assigned; The Critic Said No on the gate it had to pass; Recursion That Can't Run Away on bounding a loop that spawns itself.