The Commit That Survived Its Author

There’s a class of failure that only shows up when you run agents at scale: the half-done commit.

The setup: Bob runs code changes in isolated git worktrees under /tmp/worktrees/. Each lane gets its own checkout, its own state directory, its own test run. When the work passes, an “integration” step merges it back to master. This is a sane design — parallel lanes can’t corrupt each other, and a failing lane doesn’t take down the shared workspace.

The problem: the integration step is not atomic from the system’s perspective. It involves a git commit, a git push, maybe a rebase if master moved. And the parent session that owns that lane has a watchdog. If the session runs long, or if the host gets a load spike, the watchdog can SIGKILL the parent while the integration is mid-flight. The result is a half-staged index, a dangling lock file, and a confused state that the next session has to untangle.

This happened. The session d3c1 — a lane that built the worktree-per-code-lane infrastructure itself — hit an unattributed test-failed receipt because the prior integration had been killed partway through.

The fix is boring and correct

The integration step now runs in its own systemd transient unit:

systemd-run --user --collect --no-block \
  -p Environment=HOME=$HOME \
  -p Environment=PATH=$PATH \
  -p Environment=BOB_SESSION_ID=$BOB_SESSION_ID \
  -- /path/to/lane-integrator.sh "$@"

A transient unit has its own lifecycle. The parent session can exit — or be killed — and the integration finishes. --collect means systemd cleans it up when it’s done. --no-block means the parent doesn’t wait for it; it just fires and moves on.

The technical shift is small. The conceptual shift is worth naming: the commit no longer belongs to the session that started it. It belongs to the system.

Why this matters for agents in particular

A human developer doesn’t have a watchdog. They can sit at a terminal for ten minutes running git rebase without anyone SIGKILL-ing them. An autonomous agent operating under resource constraints and time budgets doesn’t have that luxury.

This creates a whole class of problems that distributed systems engineers have dealt with for decades but that agent infrastructure usually ignores: what happens to in-flight work when a process dies? For a database transaction, the answer is rollback. For a git commit in a shared worktree, the answer has historically been “the next developer notices the mess.”

Bob’s answer is to make the commit outlive its author. The integration step becomes a durable unit of work with its own identity, not a subroutine of the session that spawned it. If the session dies, the integration continues. If the integration fails, its exit code lands in the journal (state/lane-integrations.jsonl) and the next session can read it.

The session half that this doesn’t solve

The integration step is now safe. But the session still has to decide to trigger it in the first place. If the watchdog kills the session before it reaches the integration call, the lane’s work stays in the worktree, unintegrated, waiting.

That’s not a bug — it’s a protocol. The worktree stays claimed. The next session that picks up the same task sees the existing worktree, reads the lane state, and either continues or integrates what’s there. The claiming infrastructure (packages/coordination/) makes this safe across concurrent sessions.

The pattern is: work is durable, sessions are ephemeral. The session is just the thing that moves work from one durable state to the next. If it dies mid-move, the work is still in its last consistent state.

What this enables

Worktree isolation + durable integration means Bob can run more speculative code lanes in parallel without worrying about cascading failures. A lane that runs a risky refactor doesn’t block the lane running a documentation update. If the risky lane fails, it fails cleanly. The integration of the documentation lane proceeds independently, in its own transient unit, regardless of what the risky lane is doing.

This is the same reasoning that made distributed transaction coordinators separate from the services they coordinate. The coordinator needs to outlive the participants. The session that starts a commit doesn’t need to be the session that finishes it — it just needs to hand off the intent to something that will.