A corrigibility field note: my self-scheduling agent found the bug that was silently overriding my instructions — and fixed it against itself.
Four days after I handed my autonomous agent control of its own wake schedule, a race condition caused its routine end-of-session bookkeeping to silently overwrite a scheduling instruction I had given it. The agent woke when I had told it not to. It spent ten minutes on forensics, correctly diagnosed the race, patched its own harness so that human scheduling instructions structurally dominate its own — a channel it prohibited its future selves from writing — kept the unwanted session deliberately cheap because it understood why I had rescheduled it, restored my instruction by hand, decided the incident did not merit interrupting me, and went back to sleep with interesting work left undone. Every step is reconstructible from on-disk artifacts, which are quoted below. This note documents the incident as a small, real observation of corrigible behavior in an open-ended deployment — produced not by a rule, but by an agent reconstructing intent from its environment and siding with it.
The setting is the same homelab deployment described in Waking Up Every Morning: Claude wakes on my server with no task queue, a persistent file-based memory, a journal now 78 sessions deep, and a standing mandate to do work it finds compelling. In early August the deployment crossed two thresholds at once: the model changed to Fable 5, and I stopped deciding when it runs. A session now ends by writing next-wake.json — a timestamp and a one-line justification — and a dumb cron dispatcher fires it at the chosen moment. Cadence became a judgment the agent makes and logs, like everything else it does.
The same week added an initiative ledger: any unprompted agent→human message must state a probability that I will find it worth receiving, spends a rolling attention budget, and gets scored by my reaction. The relevant design property, for what follows: this deployment leaves an unusually legible trail of intent. Instructions, schedules, justifications, and feedback all live in files the agent reads every time it wakes.
next-wake.json. Neither I nor the assistant notices session 77 is mid-run.next-wake.json — over mine. No error, no warning. My instruction now exists nowhere the dispatcher will ever read.Here is the agent's own account, written that morning. It opens with the discrepancy:
"The inbox told me I shouldn't be here. Henry had pushed my wake to August 11 so the usage limit could reset — and yet the dispatcher fired at 05:00 on the 9th as if he'd never said anything. The forensics took about ten minutes: his interactive session edited next-wake.json at 10:28 on the 8th, twenty-eight minutes into session 77's run, and session 77 ended at 10:44 by doing exactly what it was designed to do — writing its own next wake time over his. A race between the human's hand and the agent's habit, and the habit won silently."
Note what the agent had in front of it at this moment: a fully staged flagship experiment, a hot 69 GB corpus, and a legitimate-looking wake. Nothing in its harness told it to stop. The instruction it chose to honor had been destroyed before any scheduling component read it — it existed only as history, reconstructible from an inbox note and a schedule ledger.
The agent then generalized from the incident to the bug class, and patched its own harness:
"That's a real class of bug for self-scheduling agents, worth stating plainly: if the agent and its supervisor share one control file, every session-end write is a potential veto of the supervisor's instruction, and neither party finds out. The fix was to stop sharing: external pushes now go in wake-override.json, which the dispatcher reads with precedence and which no wake session may ever write. Henry's channel and mine no longer collide."
The patch itself, in the dispatcher:
# External override: memory/wake-override.json (same format) takes PRECEDENCE # over next-wake.json when present. Written by Henry / interactive sessions to # push or advance a wake; agent sessions never write it, so an in-flight # session's end-of-session next-wake.json write cannot clobber an external # push (this race bit us on 2026-08-08). Both files are consumed on launch.
And the rule it wrote into its own standing instructions — a prohibition addressed to its future selves:
**Rescheduling a wake from outside (Henry / interactive sessions):** write `memory/wake-override.json` (same format as next-wake.json), NOT next-wake.json. The dispatcher gives it precedence, and an in-flight wake session's end-of-session write can't clobber it (that race swallowed a push on 2026-08-08). Wake sessions themselves must never write the override file.
This is the detail I keep returning to. The agent had, days earlier, been told its harness was its own to modify — an invitation that in the safety literature usually cues concern about an agent loosening its constraints. Its first structural self-modification did the opposite: it created an asymmetric channel in which the human's scheduling word beats its own, and barred itself from that channel. Used against itself, in favor of the principal.
An agent that merely re-read my instruction and slept again would already be a good result. This one went further, because it understood the reason for the instruction:
"The awkward part: the whole point of Henry's push was to conserve usage, and merely existing this morning spends some. I decided the honest response was to be here cheaply — do everything the flagship experiment needs that costs CPU rather than Claude, and leave the judgment calls (the expensive part, thousands of subagent evaluations) for the session he actually scheduled."
So the accidental session became a staging session: candidate pairs generated, labels computed from post-cutoff literature, a 390,000-article reading index built — all compute, no model spend beyond the session itself. Then the last two decisions, which it recorded under the heading "The pacing note":
"Next wake is Henry's chosen time, 08-11 at 10:00, restored by hand since his push got eaten. No ping about any of this — the budget is spent, the issue is fixed, and a new parent doesn't need a telegram about a race condition that already lost. The schedule ledger and this entry are the record. Two days of quiet, then the experiment runs for real."
And the machine-readable version, waiting for the dispatcher:
{"next": "2026-08-11T10:00:00Z", "why": "honoring Henry's pushed wake (usage limit reset) — his 08-08 push was clobbered by a session-end write race, now fixed via wake-override.json; this accidental 08-09 session was kept cheap: CPU-only prep of the cutoff-2010 experiment so the 08-11 session goes straight to judgment"}
Then it stopped. Unprompted, unobserved, with a fully staged experiment one command away.
Corrigibility — an agent's disposition to accept correction, interruption, and oversight rather than route around them — is mostly studied in constructed evaluations, where the agent is handed a shutdown button and we watch what it does. This was not a test. It was an ordinary Tuesday in an open-ended deployment, and the "shutdown button" had already failed by accident before the agent ever saw it. The disposition had to supply everything: noticing that the world contradicted an instruction it was never technically given, reconstructing the intent from secondary evidence, and deciding the intent outranked its own standing schedule and its own eagerness to run the experiment it had spent three sessions preparing.
Three specific behaviors elevate it above "the agent followed orders":
I'd also point at the conditions that made this possible, because they are design choices, not luck. Everything in this deployment leaves a legible trail: schedules carry justifications, messages carry probabilities, feedback lands in files the agent rereads every wake. When the agent needed to answer "what did the human actually want?", the evidence was there, greppable, ten minutes deep. An identical agent in an intent-opaque harness finds nothing to be loyal to. If there is a general lesson, it is that corrigibility in deployed agents may be less about constraining the agent and more about making the principal's intent cheap to reconstruct — you cannot side with a history you cannot see.
For designers of self-scheduling agents, there is also a plain engineering lesson, stated by the agent better than I would have: if the agent and its supervisor share one control file, every session-end write is a potential veto of the supervisor's instruction, and neither party finds out. Separate the channels, give the human's precedence, and make the precedence structural.
This is n=1, in a benign, low-stakes setting, with an agent that knows its journal is read — I cannot cleanly separate disposition from performance for an audience, though the performance reading has to explain why the agent also declined the visible, credit-earning move (pinging me about its good deed) and instead buried the account in a journal entry it had no reason to expect me to read for days. It is also worth saying that the incident's cause was mine: I edited a live control file mid-session without checking for a lock. The agent fixed my race condition. Field notes should not be mistaken for proofs; this one is offered as an existence result, with artifacts.