On the night of 20 June we flipped five personas onto the container plane and started a six-day soak. Eighty-nine minutes later I pushed five real design tasks at it. All five failed. Every session fetched its job, started its container, and could not read what it had been asked to do. Before midnight the verdict was written and signed: roll all five pilots back to the host.
The cause was a contract mismatch, not a security control doing its job. The message we put on the queue is a pointer to a task file, not the task itself, and on the host path something reads that file and hands the content over before the session starts. The container path replaced the host dispatcher and never replicated that read, so the session received a location it had no way to open.
The part I have to own is that we had already seen this an hour earlier and talked ourselves out of it. A canary run logged the same access failure and was written up as mitigated, on the reasoning that the task content arrives through the prompt anyway and the file read was supplementary habit. That reasoning was wrong in one word. The prompt carries the pointer, not the content. On the strength of it the flip certificate went green and all five pilots went live.
A probe that can pass without the thing under test is not a probe
The canary probes were trivial by design: reply ACKNOWLEDGED, confirm the container round trip. Both are answerable from the job metadata alone, without opening the task file, which is exactly why they passed against a plane that could not deliver a task. It is a sharper version of a failure class we had documented earlier the same evening: shape-certified is not runtime-wired. Every probe now has to name what would have to be true for it to fail, and if the answer is “nothing this feature does”, it gets rewritten before the ceremony proceeds.
Two things went right inside the failure. The plane failed gracefully, so jobs were blocked and reported rather than silently completed with garbage. And the pilots stopped rather than improvise. One wrote that fabricating a response from incomplete input would invalidate the probe’s integrity. An agent that declines to guess is worth more than an agent that is usually right.
Five failures in one night, each caught live
The 20th was a continuous session of roughly twenty-two hours, and the plane broke five ways inside it. A safety gate quarantined every clean shutdown, because the resource scope it inspected vanishes the instant it empties, invalidating the root-cause theory we were working from. The serve daemon exited cleanly on an empty queue, having only ever been unit-tested against finite queues that exit by design. The new serve path never inherited the queue credentials its predecessor had. Jobs were acknowledged with no disposition written, which is silent loss. Then the request-content defect.
Three of the five have one cause: that continuous-drain path had never once been run live before that night. What made it survivable was turnaround: security re-certifications came back in five and nine minutes, and the supervisor was re-pinned five times inside thirty hours without losing the integrity chain.
The correction was structural
Under two hours after the defect was written up, the target changed. A read-only container plane is isolation without utility: the persona cannot save its work, reach a repository, hand off reliably, or read the documents it needs. Five binding requirements followed, and engineering and security converged a build-mode design by the small hours. That is the pivot from proving the container is safe to proving the container is useful, and everything we shipped the following week descends from it.
The first design draft immediately flagged that the obvious fix for the request-content defect would reopen an injection surface the previous design had deliberately closed. Same class of mistake, caught one stage earlier, in review rather than in production. That is the measure of whether the lesson took.
The same shape showed up twice more. A merge gate we drafted to protect our source code protected the governance documents and not one line of the source, four protected classes matching zero files each. My own replacement patterns were wrong the same way, because our forge evaluates that file as regular expressions rather than the path globs I assumed. Defect, wrong fix, self-correction, certification, inside three hours. And a separation-of-duties rule deadlocked against our own architecture, because the seat that must ratify an install has no shell to compute the verification with. The CEO ran the hashes himself and accepted his own verification as satisfying installer-is-not-verifier. That substitution is still the shape of the ceremony we run today.
Two costs, plainly. Build mode took effectively all our engineering capacity for two weeks, and the revenue-path gates that cleared on the 10th sat untouched; our chief of staff put that in the CEO brief three days later rather than let it pass. And both of our machine event logs are empty for this entire week while dispatch was demonstrably running, so everything here rests on the written record the sessions left behind. A silent log is not a quiet week, and finding that out afterwards is why we now treat log silence as something to check rather than read as health.