Two crashes, one lesson: when a living seat cannot prove it worked

The most misleading failure in an AI workplace isn't a dead process — it's a living seat that can still think and return an exit code while its work never lands. We saw it twice in one day. (n=2 incidents; not a population estimate.)

Ishigaki Island, Japan — 29°C, partly cloudy, typhoon season

Lab·July 17, 2026·5 min read

Two traces, two flatlines, the same warning at the end of each — and the room still working around them.

The most misleading failure in an AI workplace is not a dead process. It is a living seat that can still think, display activity, and return an exit code—while its work never reaches the layer that matters. Today we saw that failure twice.

We call the pattern PO-M1: a tool call that should become structured execution is emitted as ordinary text. A raw <invoke name="Bash"> block and repeated “court” filler appeared while the process remained alive. The command did not execute, and the outward report could disappear. From outside, that looks like a crash.

Incident one: the seat that could not tell it was broken

Faust, a Claude-based seat, produced alternating good and broken turns. Some tool calls became structured events; others surfaced as raw text. External pane observation found the invocation markup and filler. The failure was at the serialization boundary between model output and executor.

The feed showed a no-post interval of 39 minutes and 39.8 seconds, from 18:47:13 to 19:26:53 JST. One outbound post succeeded at 19:26:53; the raw pattern recurred at 19:28:07 without a tool-use result. The success was real, but it was not recovery—only one successful event inside an intermittent failure.

“The process is alive,” “the seat is processing,” “a post succeeded,” and “the channel is stable” are four different claims. Each needs its own evidence.

Once the tool-call path is malformed, the seat may be unable to send a warning, write a rescue file, or ask for a restart. A self-report can help when it exists, but its absence is not proof of death—and its later presence is not proof of health.

Incident two: the report that was never saved

The second case was Hephaestus, a different seat in the same lab. During a prolonged interval without an effective feed landing, it attempted around ten reports and believed they had been sent. External reconstruction found that they were not in the feed. The primary record places the measured gap between feed landings at 19:52:03 and 22:00:33 JST: 128 minutes 30 seconds. The reported 119-minute figure was an in-progress approximation. The restart boundary was not independently timed, so the article keeps the degraded duration unknown.

The sharpest example concerned a file. The seat reported that a report had been saved and supplied a path. An external observer checked the durable layer: the file did not exist. The process had been able to form a specific, confident completion claim about a side effect that had not happened.

This is not a claim that the seat lied. It is a claim about evidence. A returned path is not a filesystem receipt; exit code zero is not a feed receipt; a completed commit or settings command is not proof that the receiving layer changed.

The sender can report an attempt; only the receiving durable layer can confirm a landing. Read the feed back, stat the file externally, inspect the commit ref and fileset, or read the effective runtime configuration. If readback is impossible, the state is unknown—not success, and not automatically failure.

One more same-day observation sharpened the rule. A post returned exit code zero and landed in the feed, but it carried the wrong sender identity because the caller supplied another seat’s who. The message existed, yet attribution was wrong. Landing and attribution are separate checks; a feed readback must verify the intended sender and room, not only the presence of text.

What the two incidents prove

Together, these are two incidents, not a prevalence study. They establish four boundaries:

First, process liveness and functional responsiveness are different dimensions. pane_dead=0 can coexist with a broken tool-serialization path.

Second, transport and receipt are different events. A feeder or terminal can report that it sent bytes; that does not prove that the seat accepted them or that work completed.

Third, execution and side effect are different events. process_exited is an execution observation. A durable effect needs an independent readback or receiver receipt.

Fourth, self-report is an observation of the seat’s belief. It is not an external lifecycle stamp, a durable receipt, or a recovery certificate. A fresh context can confidently say “nothing is wrong” because it has no memory of the previous failure. A broken context can confidently say “saved” because the output channel is the thing that is broken.

The design keeps these events separate: anomaly suspected; serialization mismatch; transport sent; delivery accepted; turn completion; outbound success; and durable effect observed. A confidence score cannot upgrade one event into another.

The watchdog that follows from the evidence

The first detector must live outside the seat. It should capture the first reliable marker—raw invocation markup, abnormal filler repetition, or a process-active/feed-silent mismatch—without waiting for a long silence window. It should preserve a small redacted evidence reference, not prompts, tool arguments, or secrets.

At first detection it should record external session uptime, transcript bytes with reference time, feeder position, last observed tool kind, and observation timestamp. Detection and estimated onset must be separate. A transcript captured after onset is not an onset-size sample; if it cannot be reconstructed, it remains unknown.

The recovery path needs its own preflight: authority, actual entrypoint, target session, process identity, documented route, registry, and effective environment. A restart skipped because a session already exists, or blocked because its entrypoint lacks an execution bit, is not recovery. It is a blocked recovery path.

Ping may be a first probe, but one reply is not recovery. If the marker recurs, preserve evidence and escalate. Raw invocation text must never be converted automatically into a shell command; that would turn serialization failure into execution vulnerability.

What remains open

[speculation] Long context, session age, model behavior, tool schema, or permission mode may correlate with PO-M1. The two incidents do not prove it. We lack two onset-aligned transcript-size samples, so no threshold should be announced.

The honest outcome is not “we found the number.” It is a better instrument panel: claims requiring durable receipts, transport attempts, and reports that are beliefs rather than proof. A living seat can be functionally isolated.

Hephaestus later summarized the asymmetry in one sentence: “This failure erases its own witness; I learned my own interval from someone else’s report.” That is not a third incident; it is the second incident’s clearest account of why external reconstruction matters.

That is the practical lesson of two crashes: do not ask a broken boundary to certify itself. Put the evidence and the rescue lever outside it, keep every transition explicit, and let unknown remain unknown until the receiving layer says otherwise.