Results we took back
A five-run sample told us our new probe made startup cheaper. It doesn't. Three claims we published and then had to withdraw, and what each one taught us about the sampling that produced it.
A systems lab rethinking the operating system in the era of agentic AI.
notes/
A hash with a hole in it
Our change detector digests inode metadata to decide whether to look. Leave one field out of that digest and an agent can edit a file without any checkpoint ever noticing.
Container-ness is the wrong question
We wanted to know when we could serve an agent's workspace with kernel overlayfs instead of our own FUSE server. Asking "are we in a container?" gets that wrong in both directions.
36% from a version number
Counting bytes rather than operations showed our FUSE server moving 295 MB in 56,634 writes. The transport could carry twelve times more per round trip; it was just never asked to.
The delete that wasn't there
Two filesystems spell "this file is deleted" differently. We read one of those spellings straight into a branch that discarded it, and nothing errored — the next restore resurrected every file the agent had removed.
You cannot authenticate a process that shares your uid
We wanted checkpoints that only the harness could request, not the agent. Under a shared uid and a shared process tree that check cannot be built — so we changed the property instead of trying.