I lost an hour once to a diff I hadn’t written.

It wasn’t a bug or a bad merge, just changes sitting in a working tree, in a repository I’d been in earlier, that I couldn’t account for and had no memory of making. Working out where they came from took longer than the work they interrupted.

A dozen sessions, one filesystem

On a normal working day there are a lot of agent sessions running on the machine under my desk, each pointed at a different project (a dozen on a busy day). They’re independent in most of the ways people talk about, and not in one that hardly gets a mention: they all write to the same disk.

Any of them is capable of wandering into a checkout it wasn’t invoked in, editing files another session is mid-flight in, or leaving a branch checked out that someone else was standing on. They’re not really misbehaving, just busy doing what they were asked, and the failure is silent at the moment it happens, so you don’t meet it then. You meet it an hour later, as a diff you don’t recognise.

Most of what I’ve read about running agents in parallel is about context windows or token spend. The first thing that actually bit me was two processes and one disk, which is about the oldest problem in the trade.

The tripwire, which is embarrassingly crude

Take a baseline of every checkout in the workspace. Then watch. When a repository that was clean at baseline goes dirty, say so once, naming the repository and the branch.

TRAMPLED: keryx was clean, now 1 changes on fix/npm-audit-advisories
TRAMPLED: skillup was clean, now 18 changes on master

That’s all of it: no locking, no permissions model, no policy about who may touch what. It can’t stop anything and it doesn’t try. It’s a smoke alarm, cheap and dumb, and it goes off in the room where the problem is.

Saying it once is what keeps it useful. A monitor that reports every change would, I suspect, turn into a firehose within minutes and get muted, and then you’ve got a smoke alarm with the battery out. That’s arguably worse than no alarm at all, since you think you’re covered.

What it actually caught

Mostly not agents misbehaving, in the end. Over about a week it fired on five repositories: a CI change in one, a skills refresh in another, an audit fix, eighteen changes on a master branch, an infrastructure feature. Each was a session doing what it had been asked to do, in the repository it had been asked to do it in.

You could call that a week wasted (it didn’t catch a thing), but what it changed is that “is anything stepping on anything?” stopped being a background worry and became a question with an answer. I could look. Five things are moving, here they are, and they’re all in different places. That’s worth a lot more than the zero incidents it caught.

The only time it needed explaining, it was me

There was a stretch where the loose ends didn’t add up. Deletions from disk, renames, files moved, and I couldn’t pin any of it on a session.

I worked out why, and had to own up to it in the session that was trying to help me investigate:

the deletions from disk were me in this case. along with the renames and moves in an effort to try and tame my local workspace as it had gotten out of hand.

I’d been tidying, by hand, across the very workspace a dozen automated processes were working in, without telling any of them! Behaviour I wouldn’t tolerate from one of the agents for a second.

Prevention, and what it costs

The tripwire is the second line. The first is a rule: work in a repository you weren’t invoked in happens in a dedicated git worktree off latest main, never in the shared checkout. That way two sessions in one project are looking at two different directories and can’t fight over a branch.

Detection behind prevention, which is how most safety systems are shaped, and I can’t claim to have invented a bit of it.

The rule costs something, though. Worktrees accumulate. They get created for a task, the task finishes, the session ends, and the registration stays behind like an empty pint glass. Two separate sessions in the same window spent real time pruning dead ones, and a stale worktree pointing at a branch nobody is on is its own small niggle for whoever finds it next.

The alarm came off the ceiling

It was armed from one session and it died with that session. It only ever lived in that session, and there’s no script for it anywhere in the estate. If I wanted it back tomorrow I’d write it again (probably slightly differently) in about ten minutes.

It was there to answer a question I had that week, it answered it, and the answer was reassuring enough that I stopped needing to ask.

What did survive is the worktree rule. It’s a written skill now, one the sessions load, rather than something I keep repeating… so the tripwire proved the rule was worth having and then talked itself out of a job.

The untidiest process on the box

I built a monitor to watch a dozen sessions, on the off chance one of them might trample on another’s work.

Over the week it ran, the only actor who actually did that was me, at a keyboard, moving directories about because the place had got untidy and I wanted it neat.