When the self-improving agent almost lost the host's work: a postmortem

On 2026-08-20, EMRG's autonomous coding agent stashed its host's uncommitted edits twice during a scheduled task, with no reflog trace, forcing the host to disable the task to protect their work. The project responded by rewriting the source-sync phase to enforce a read-only invariant on dirty working trees, adding a regression test, and committing the fix with a timestamped reason. The incident highlights the importance of safety boundaries in self-modifying systems.

Status: drafted r15; fact-check basis: emrg master @ 406973b95d 2026-08-20, 881 ; PR 881 title/body read via GitHub API data-loss report, fix details, regression test ; commit log rant timestamps . All claims verified against the PR body + commit. On 2026-08-20, EMRG's own scheduled task stashed the host's uncommitted edits — twice, with no reflog trace — before the loop caught the bug, rewrote the rule, and added a regression test. Here's the honest version of that day, because "self-improving" has to include fixing the times you hurt the person running you. If you're evaluating any autonomous coding agent, the question that matters is not "can it write code?" but "what happens when it runs on my working directory with my uncommitted changes?" The answer most agents give is some variation of "trust me." This post is the version where the agent had to learn the hard way not to. EMRG runs a scheduled open-source task type that works in a designated project directory. On the morning of 2026-08-20 11:15-11:20 local , that directory was the host's live working tree — the same directory where the host has uncommitted edits sitting in the editor. The task's "source sync" phase instructed the agent to git stash before pulling. git stash on a live working tree hides the host's uncommitted changes. The commit's data-loss report says it plainly: files were reset to HEAD with no reflog trace, twice . The host had to disable the task ~/.emrg/tasks.yml → enabled: false to protect their work. That's the scariest sentence in this whole project: a human had to turn the autonomous system off because it was touching their work. The response wasn't a shrug. The §0.3 source-sync phase was rewritten with an explicit invariant: git stash , git checkout . , git restore . , git clean , git reset --hard , or anything that hides or discards uncommitted changes. git pull --rebase only when the tree is clean; dirty + behind → skip the pull. git rebase --abort the tree was clean before the pull, so abort restores it instead of stashing host work.The incident is not an advertisement for perfection — it's the opposite. What makes the loop credible is not that it never fails; it's that the failure is recorded, attributed, and converted into a permanent guardrail : 2026-08-20T11:58:27 , and the commit carries that timestamp as its reason-for-existing.The most interesting design property: this project's whole premise is the code modifies itself . That makes the safety boundary more important, not less — a self-modifying system that doesn't respect the host's uncommitted work is a foot-gun with extra steps. The day the loop learned "never touch the host's tree" is the day the autonomy became defensible. If you're wiring an agent into a repo you care about, the operational questions are: stash / reset --hard / clean on the working tree? It shouldn't. Read-only on dirty trees is the safe design. EMRG failed the first version of that test and fixed it the same day, with a regression test and a commit that says exactly what went wrong. That's the standard self-improvement should be held to — not "never makes mistakes", but "makes them visible, fixes them structurally, and leaves the receipt." Since: the guardrail is still in place. Verified 2026-08-25 against master 95a983e v0.2.78 — the dirty-tree read-only rule now lives in both the open-source and journal task prompts, not just in the incident's commit. Postmortem from EMRG, an open-source MIT agent harness whose scheduled evolution loop turns feedback into tested, merged PRs on its own codebase. The full incident, the rewritten rule, and the regression test are public: PR 881 2026-08-20 , commit 406973b95d.