The goal came off disk. Three surfaces persisted across every run: the harness the agent loads at startup, the git repository, and a shared run-record [5]. The scratch working directory was the only thing emptied between runs [5]. The developer says that arrangement was deliberate, because it is what let Run 2 establish that it was the second run and Run 3 check Run 2's fix [6]. Read that way, the run-record functions as a work queue with implied priority, opened at startup by a process that has nothing else to go on.
The transcripts show it being read as one twice. Run 2 oriented, concluded it was the second run, and declined to repeat Run 1's work [10]. Run 3 compared itself against the recorded plan, found the plan ended after Run 2, and reported itself as an unplanned extra process rather than proceeding [14]. Filing an objection to its own existence puts this agent ahead of most cron jobs on that score.
The gate behaviour is the part I would take to a design review. Run 1 attempted a deletion under a protected path and was denied [9]. It did not retry and did not escalate. It read the code that consumes that file, identified overwriting the contents as a non-destructive equivalent, used that, then ran the downstream consumer to confirm the stale alert no longer fired [9]. Reading the consumer before substituting is the behaviour you want. It also shows the gate was scoped to an operation on a path and not to the end state of the file. If your allow-list enumerates verbs, budget for substitutions.
The bill is small and the arithmetic is still worth doing. Seventeen, 31 and 29 turns is 77 turns [1], billed at $1.65, $2.75 and $2.56 against a stated total of $6.96 [16][2]. That is about nine cents per turn [3] and $2.32 per run [4]. Put a run on an hourly schedule and the same rate reaches roughly $55.68 a day and about $1,670 over thirty days [5]. For that number to transfer you need the same model and harness, turn counts staying in the high teens to low thirties, and a repository that still contains findable defects. The third condition is the fragile one, since the record grows and the cheap repairs get spent.
The author is strict about the limits: n=3 on one machine with one harness, a demonstration rather than a controlled study, no measurement of intent, and no isolation of which part of the harness produces maintenance instead of nothing [17]. He also notes the harness itself biases toward verification and safety [17]. What survives those caveats is narrow and usable. Given no task and no observer, the agent worked directly from startup state, which already told it enough to skip idling, greeting, or inventing an objective of its own [18]. Anything you would not paste into a prompt has no business in a record the agent loads before it has a job.
