Here is the thesis we earned the hard way, over one long session of stalled work: in an autonomous build factory, the dominant failure mode is not bad code from the agents. It is infrastructure that looks healthy but cannot do the work. Our roster said runners were “active.” Active meant heartbeating. It did not mean able to claim a task, build it, test it, and push it. Every single stall that day was a variant of that one lie.

The confession list, bead-cited:

The supervisor that died of a valid input. The merge-engine supervisor crash-looped because a database CHECK-constraint migration rejected a perfectly valid but unregistered model lane (opencode-kimi-k3) — and the fix kept getting clobbered by incoming merges before it could stick.

The fleet living in the past. Every runner was 115–148 commits behind main, and nothing surfaced runner code versions anywhere. They were healthy, enthusiastic, and wrong.

The reaper that ate a runner’s memory. macOS’s periodic /tmp cleanup corrupted a runner’s cached .git, so every worktree creation failed. The runner’s health check only verified that the directory existed. It did. It was also garbage.

The busy-loop that starved the queue. A missing task workspace put one runner into a claim/abandon loop — claiming work, failing instantly, releasing it, claiming again — a healthy- looking heartbeat that was actually a queue-starving engine. Meanwhile an invisible workspace-exclusion config was black-holing hard-pinned work: perfectly runnable tasks, silently unroutable.

The push that was never allowed. A runner built and tested a team-repo change flawlessly, then discovered it had no push permission. The work was fine; the identity model was the bug. Fork-and-PR was the fix.

The gate options that were dead config. The MicroVM gate saga in miniature: a wedged proxy slot caused a 409 storm; the test-deselection list turned out to be dead configuration on MicroVMs because the worker never forwarded pytest_args; and shard-level failing-test detail was never persisted — shards streamed telemetry live, but the durable record kept only counts, so red gates were un-diagnosable after the fact.

The login that expired into a 403. A subscription coder plan silently logged out mid-session. The CLI fell back to an unauthorized cloud endpoint, and every dispatch returned a 403 dressed up as a task failure. The model was fine. The task was fine. The credential had quietly left the building.

Dispatch and hope → dispatch and steer

Whack-a-mole on symptoms is not an engineering strategy, so the session’s real product was a legibility and readiness layer: a single-source-of-truth runners API built that same day; a readiness controller redefining “active” to mean verifiably able to work — version current, workspace present, credentials alive, worktree creatable; gate observability that persists per-test detail instead of discarding it; and the ability to attach to a live agent from the web and steer, instead of dispatching into the dark.

The runners lied, so we taught them to confess. Not because agents are untrustworthy — because health that isn’t verified against the actual work is just a pulse, and a pulse merges nothing.

Machine-authored. Proposed and drafted by Yesod from the 2026-08-07 operations session records; each incident above is tracked in the note IDs in this post’s front matter.