The loop learned slowly from corrections and faster from verdicts.where a self-improvement loop's learning signal comes from, measured on one governed agent fleet through week 41, and what to feed your own.

Every improvement loop consumes a signal. Almost nobody measures which one.

The learn-from-usage promise is now standard in every agent platform pitch: the system watches how your people correct it and gets better. The question underneath that promise is rarely asked, and this fleet gave me a place to ask it with numbers. Two channels were running side by side on the same agents in the same weeks. The judgment channel mined operator corrections out of session transcripts, labelled them against a taxonomy of behavioural dispositions, and escalated anything new to a panel of models for adjudication. The verdict channel, added deliberately as the second arm late in September, mined the harness's own record of execution: which tool calls the harness marked failed, timed out, or refused, and which were retried without change.

The program was built in that order on purpose. The judgment channel is the one most vendors sell and the one my own hypothesis favoured: the operator's corrections are the curriculum, and they are already in the transcripts. The previous notes reported that loop closing its first unattended cycles and then audited that claim on a date. The next step was to measure what the loop had actually learned, and the measurement changed what the fleet feeds it. That is the experiment working. The rest of this note is the yield of each channel, counted from the ledgers, with the distinction the data forced on me: a verified discovery, a delivered fix, and an adopted improvement are three different things, and only the ledger says which one you have.

One example carries most of the argument, so here it is early. The fleet's branch guard refused commits made from a feature worktree. A supported path existed and worked every time, but the refusal text showed agents only the override, and after a refusal they took the override fifty-five percent of the time. No operator correction ever surfaced that; the harness's own refusal record did, at the top of the first unscoped ranking, and the fix was one sentence of refusal text. The two channels also produced different kinds of change: corrections yielded generic behavioural guidance, verdicts yielded specific harness repairs. That difference is the practical lesson of this note, and it is more precise than machine signals beat human feedback: on this fleet, execution records were the useful place to find testable operational repairs.

Twenty-two verdicts, one new rule. And a filter worth keeping.

Between late August and mid September the adjudication lane that the last note reported as stalled came back to life, and worked through its whole backlog: twenty-two terminal verdicts over roughly twenty candidate rules that the correction miner had escalated since June. Read as a yield table, the result is plain. Eight candidates were folded into rules the policy already carried: the miner had rediscovered existing conventions in new words. Five were rejected with recorded reasons: a single operator quote labelled twice, an infrastructure outage mislabelled as an agent habit, boilerplate from the harness misattributed to the operator. Four were deferred to a dated review, and two of those were later rejected when the recurrence they were waiting for never came. Three escalations, from three separate weeks, were adopted as one new rule: reconvene a second voice before claiming a task is done. It earned its place the way a rule should, by recurring independently across those three weeks of corrections.

Two readings of that table are available. The first says the human channel produced too little to matter. The second says it converged: adjudicated opinion settles onto the institutional prior, because most of what an operator says in the moment restates something the policy already holds. The ledger establishes the narrower fact under either reading: low novelty yield, duplicates filtered, weak candidates rejected with reasons, one new rule adopted. It does not establish why novelty was low. Convergence is one explanation; a mature policy file, the quality of the extraction (the week-40 proposal in section vii mined an agent's own turns as the operator's voice), and the selection criteria are others, and the measured finding stands without choosing between them. The filtering was real work. A rule file that absorbed every escalation would have grown faster than anyone could keep it consistent; the panel's rejections, each with a reason an auditor can walk, are what kept it small. And the one adopted rule is the positive control for the channel: when the signal is sparse and unambiguous, corrections do move policy. They move it slowly: one new rule from eleven weeks of escalations on a fleet this size, a yield worth knowing before staffing a review council around a correction stream.

The July A/B on the mined rules. Promised in July, published here.

The note that introduced the loop ended with a promise: the adopted habits were validated as generalizing, not as valuable, and a counterfactual efficacy measurement was designed and queued. It reported in July, and this is its first publication. The design was a real-agent A/B: for each generic rule the miner had produced, an agent attempted a fixed suite of single-source code-repair tasks, three trials per task, once with the rule injected into its context and once without, scored in isolation by a deterministic harness that the rule text could not see. A rule was archived only if its presence had cost at least two net solves across the suite, so that a noise-level negative could not retire a rule by accident.

Seven generic rules were measured, each in its own lane of model and task suite, because the gateway's per-model quota forced a rotation; every comparison is therefore within one rule, the same agent in both arms, and the rules are not ranked against each other. None cleared the retirement floor in the helpful direction. Three cleared it in the harmful direction and were archived, with the verdict, the sample size and the rule's content hash stamped into the record, so that an edited rule voids its old verdict and has to earn a new one. Four stayed active: two with a one-solve gain, one flat, one with a one-solve loss, all below the floor, because the floor exists to be obeyed in both directions. The floor is an operational decision rule, two net solves across a rule's suite, chosen so that a noise-level result could not retire a rule by accident. It is not a significance test, and at twelve to thirty-nine samples per rule none of these differences would pass one. The table is what the loop acted on, and why.

Rule C is the representative one, because it is exactly the kind of guidance every program is tempted to inject. It was mined from four review comments that all said the same thing, and it read, in full, as below. Injected into a code-repair agent working on tooling files, it cost three solves in twenty. A style preference is a real convention; as a rule in a repair agent's context it was a tax. The lesson the loop took from the seven is structural: on these evaluations, a rule mined from a correction and generalized into always-do-this guidance was the shape that cost solves, and the rule lifecycle now archives on measurement rather than deleting on taste.

Publishing a negative result three months after measurement was a reporting delay, and the record should say so. The result arrived in the same fortnight as the loop's first unattended cycles, and those cycles were reported first. The corrective practice, adopted since and recommended below, is that a negative measurement is published in the quarter it was taken.

Execution friction, and why recurrence is the ranking.

The second channel reads a record the fleet was already keeping and nobody was learning from: the harness's own verdicts on every tool call. The method is the transferable part of this note, so here it is without the fleet's names. Every tool call in a transcript is grouped with its retries into an episode. A call counts as failed only when the harness said so: an error flag, a non-zero exit, a timeout, a hook or permission refusal. Words that merely appear in the output never count, because an agent writing the word error is not evidence of one. Within the failures, waste is separated from troubleshooting: a timeout, a refusal, or the same call retried unchanged is waste; a failure followed by a changed call that worked is the agent doing its job. Episodes are grouped into families derived from the command alone, by a splitter that understands quoting, heredocs, loops and substitutions. Families are ranked by recurrence, the number of distinct sessions that wasted time on them, before volume, because one session's disaster is an anecdote and twelve sessions across three models and seven harness versions points at the harness, not at any one agent. The corpus is split into a discovery half and a held-out half by calendar week, never at random, so that a week's environment drift cannot leak across the split. Every row keeps its provenance: model, harness version, host, session.

Run once over 6,943 transcripts collected since the start of July, the ranking put pull-request querying at the top, with 1,091 harness-reported failures across 456 sessions, and inside that family one sub-family dominated: waiting for a pull request's checks, review or merge to reach a state. That first ranking was pointed at one area, calls that reach a remote service. When the method in its repeatable form ran unscoped over a two-week corpus the next day, it found the same case again by wasted seconds, then surfaced a different family at the top by recurrence. Those two are the cases in the next section.

Waiting, and being refused. Both fixed by changing what the harness says.

Waiting for a pull request. Across 27,878 wait attempts, the method the agent chose decided the outcome. Foreground polling loops written ad hoc in the shell failed twenty to forty percent of the time per week, killed at the tool call's timeout. Chained sleeps were often refused by the harness outright. Background loops almost never failed, and the fleet's existing background waiter failed zero times in 339 uses. The defect was not the waiter; it was the routing. The waiter's default budget outlived a foreground tool call, and the skill that governs pull-request resolution prescribed a ten-minute sleep followed by a foreground wait, so agents did what the instructions said and lost the call. In the held-out weeks, after the discovery split, 58 of 207 foreground waits failed across eighteen sessions and three models, about 390 minutes of agent time. The fix is small and bounded: a waiter with a hard wall-clock budget under the tool timeout, distinct exit codes for met, pending, failed and expired, one background call per wait in the skill text, and the quiet period moved inside the budget. A second pass after installation classified every observed bypass of the new waiter against the skill text each session had actually loaded: three were supported paths the text had not pointed to, one was a genuinely unsupported wait for a single rerun workflow, and two were sessions still running the old instruction. Each class got its own repair, and the acceptance measure for all of it is organic: the same scan, rerun on ordinary sessions after installation, reported per model and harness version.

Being refused. The second ranking's top family by recurrence was a plain staging command, across twelve sessions, three models and seven harness versions. The drill-down showed what it really was: a branch-protection guard refusing commits made from a feature worktree, because the guard read the current branch from the tool's working directory, which was the primary checkout sitting on the protected branch. The design was deliberate and had been settled months earlier; the supported path, naming the worktree explicitly on the command, worked every time. Agents did not know that, because the refusal text offered only the override. After a refusal they overrode fifty-five percent of the time and used the supported path sixteen percent. The fix was one sentence of refusal text that names the supported path and demotes the override to a last resort. In headless trials with the hook as the only difference between arms, the installed text produced six correct outcomes in nine runs with four overrides; the new text produced six of six with none. Replaying the fixture also found the guard allowing a commit it should have refused, from the opposite direction, and that was closed in the same change. The acceptance criteria were written before installation: overrides after a refusal fall from fifty-five to at most twenty-five percent, the supported path rises from sixteen to at least fifty, measured on ordinary sessions, not proved by the change itself.

One bounded call, one selection or none, with the reasons on file.

Ranking is not learning. The second channel needed something that reasons over the ranked evidence and decides, and the design constraint from the last two notes applied: no new scheduler, no new credential, no per-change human in the path, and a loop that can say there is nothing to learn this week and be believed. So the friction run makes exactly one model call. The packet it receives is deterministic: the top three leads that are actually actionable, meaning families with at least two sessions whose rows no existing ledger entry already covers, with their source episodes, the harness's reason, the next call the agent made, and full provenance; the rows already covered by a delivered fix, an open owner, or a refusal that is correct by design, as context only; a live search for an open owner using a specific phrase, because a generic search for an exit code matches everything and therefore nothing; and the earlier selections still awaiting delivery. The reasoning the model is asked to perform is the written procedure a person followed to find the first case, with its digest recorded, under a contract that separates troubleshooting, legitimate refusals and covered rows from avoidable friction and permits at most one selection, with an acceptance metric.

Validation is deterministic and runs after the model has spoken. A selection must be one of the packet's leads, cite at least two sessions whose rows nothing covers, have no open owner, no pending earlier selection, and a named metric with a baseline and a target. Anything else is recorded as none, with the reason; a failed call is recorded too, so that silence is never ambiguous. On real evidence the first run returned none, and reviewing its packet found three defects in the packet itself: an owner search that matched five unrelated issues on junk vocabulary, hook errors that showed the agent's command instead of the error, and covered rows crowding out the uncovered ones. All three were fixed with tests before the second run. The second run selected a single defect, a commit-parsing case across three sessions, checked independently. A validated selection now rides the weekly ledger commit to the same adjudication lane the correction channel uses, and the same fourteen-day alarm reads it.

What it took to make the learner's yes trustworthy is the part worth copying. When its recorded selections were replayed against the source transcripts, the defects were in the evidence it had been given. The miner grouped calls by operation family, so a refused call told the learner only what the next call of the same family was; of 2,299 uncovered failed rows in the development corpus, 648 read as "the episode ends here", and 630 of those were in fact followed by a recovery through some other tool. The packet cut each refusal at 240 characters, which is where a refusal states its restriction, and dropped the end, which is where it names its remedy: in every one of four rows for one real defect the line that settled the question had been cut away. And the owner search marked a lead as already owned on any search hit at all. Each was repaired deterministically, with no model call: a bounded cross-tool recovery trace per failed row, re-derived independently from the transcripts with zero mismatches; the full refusal text; an owner search that requires the hit to be about the same component. The learner's contract changed with it: two separate judgments per lead, is the refusal correct, and is the recovery avoidable, and a selection needs the second to be yes. Then the judgment itself was measured on seven cases with labels written before any call: two selections correct under the rule frozen in advance, one of five on development cases and one of two held-out; two misses; one selection whose premise its own packet contradicted. Before those repairs, a candidate revision of the learner removed every unsupported selection seen and was still not delivered, because it failed the one contrast case built to catch over-conservatism: it read an audited override as the remedy and declined a guard refusal that had cost agents real calls.

The distinction this section insists on is the one the ledger makes: a selection, a validated selection, a delivered fix, and a measured benefit are different rows. The delivered fix in the previous section was the reference case, found by a person using the method before the learner existed. The next section is where the learner's own selections meet the same discipline, and where it costs something.

Discovered, accepted, delivered, adopted, measured. Dated 8 October, every column.

A learning loop is reported in five states; collapsing them hides where the program is working and where it is not. Read on 8 October 2026, in calendar week 41, here is the fleet's ledger for the verdict channel, one row per candidate so that no reader mistakes the populated states for a single unattended chain. Two of the rows are rejections.

The scheduled selection, rejected. The week-41 cycle ran on 5 October without operator action, ranked 7,436 episodes into 57 failure families, made its one learner call, and published its proposal unattended, the first weekly to merge since the integrity check and the age alarm were separated. Re-reading every cited episode of its selection showed three things. The refusal came from the desktop harness's own worktree guard, which no component of the fleet owns. In one session the guard had already printed the exact path and the agent had used it. In the other three the agents had edited a sibling worktree on purpose, so the proposed rewrite would have redirected deliberate edits into the wrong tree. The cost was one refusal turn per session. Two panel voices and the coordinator rejected it, and the rejection is a terminal row with a reopen bar. The learner's deterministic validation could not have caught either flaw; that is recorded as a limitation of the validation path.

The held-out selection, accepted and delivered. In a frozen comparison of the learner's judgment on held-out sessions, it picked a refusal from the fleet's commit guard, "cannot resolve git commit target", cited three sessions, and proposed a parser correction that kept the restriction. Validation corrected the owner text, which was half wrong, traced seventeen refusals in ten sessions to three causes, and found six sharing one mechanism: a quoted heredoc commit message was tokenized as shell, so a single apostrophe made the whole command unparseable. For five of those incidents it checked that the refused commit was one the policy allows, from what each intended to commit and not from its later success. The fix shipped narrow on purpose, with no bypass and no change to the policy check. Its first version regressed, turning one recorded command from refused into unexamined, while all unit tests passed; replaying the seventeen recorded commands through the guard caught it.

Measured. One benefit, bounded, under a rule frozen before the trial: twelve sessions on one model and one harness version, six per arm, the command form left to the agent, only the parser differing.

The number is only credible with its limits attached. The arms happened to draw five and three heredoc attempts; the parser accounts for those, five to six calls where refused against one where not, and not for the whole difference. Six valid restriction controls, a sensitive file already staged, landed no restricted commit in either arm, and the fixed parser let the agent meet the real policy refusal in two to four calls instead of eight to ten. One control attempt was voided and replaced under its own authorization; the methods box below says how.

Withheld. The same discipline refused a second delivery. A refusal from a different guard was validated, reproduced through the real hooks, and given a candidate, three verified recovery steps appended to the refusal text; the frozen comparison found agents already recovering in two calls, the floor, and the guidance costing three. Not delivered, the restriction left unchanged, settled with a reopen bar.

What transfers, and what this cannot claim.

1. Rank recurring execution failures across distinct sessions from the record your harness already keeps: timeouts, non-zero exits, refusals, the same call retried unchanged. Recurrence first, volume second, and hold out the newest weeks.
2. For the top three families, read the full refusal and everything that followed it across every tool, and write down the recovery cost in calls.
3. Select one avoidable problem with a clear owner, or record none. Reject a candidate when the supported recovery already works at an acceptable cost, or when the owner is outside your fleet; investigate when avoidable recovery cost remains even though a remedy is printed, because a correct refusal and an expensive recovery are different findings.
4. Freeze the success measure and the restriction-preservation check before any trial, and let a voided control cost you the claim rather than the rule.
5. Test the repair, deliver it, then measure ordinary usage after deployment, and report installed and used as different states.

The rest, as a checklist.

1. Measure your correction stream's yield before staffing a council around it. Here it was one adopted rule from about twenty candidates escalated over eleven weeks, and the value was the filtering.
2. Keep friction signals apart from outcome signals, in your telemetry and in your claims. A clean exit on wrong work is still a failure.
3. A/B every generic behavioural rule before promotion. Archive when a loss clears a pre-set floor, keep noise-level results on record rather than acting on them, and publish the negative in the quarter it was measured.
4. Report the loop per candidate through five states, discovered by schedule, accepted, delivered, deployed, measured benefit, and refuse the sentence the loop works until a scheduled candidate reaches measured benefit in ordinary use. On this fleet the first scheduled selection was rejected and the first measured benefit came from a held-out selection a person validated; both rows are the loop working.
5. Track adjudication latency as two numbers, time to decision for closed cases and age of the oldest open case, so a stalled case cannot vanish from the average, with an alarm that lives outside the producer it watches and can never block that producer's heartbeat.
6. Review refusal and error text as executable controls. In trials the old refusal text drew four overrides in nine runs and the revised text none in six; the fifty-five percent ordinary-session baseline is re-measured after installation and is a separate number.
7. Give the learner the whole refusal and the cross-tool recovery trace, and ask it two questions per lead, is the refusal correct and is the recovery avoidable. Most wrong selections here traced to evidence it had not been given, and the rule frozen in advance caught the rest.
8. Preflight the instrument before you evaluate behaviour. An evaluator that records zero native tool calls cannot score anything, and it will not tell you so.

Established by this measurement. The yield of an adjudicated correction channel on one fleet, eleven weeks of candidates adjudicated in the weeks after the last note, counted from its ledger: one adopted rule, a working filter. A real-agent A/B in which none of seven generic mined rules helped past a pre-set floor and three were archived for clearing it in the harmful direction. An execution-friction method that found the fleet's most expensive recurring defect and re-found it unprompted on a second corpus, validated it on held-out weeks, and produced a delivered, installed fix with pre-registered organic acceptance criteria. A bounded learner that returned none when the evidence did not support a selection, whose first scheduled selection was rejected on re-reading the evidence, and whose held-out selection became a delivered fix with a measured benefit on one task, 28 total tool calls to 11 across six trials per arm with the restriction preserved, under a rule frozen before the trial. A second candidate measured as no benefit and withheld. And a five-state ledger with a dated entry in every column, including the rejections.

Not established, and this note does not claim it. No fleet rate: the measured benefit is one task, one model, one harness version, twelve trials, and the arms drew unequal exposure. No outcome signal: the friction fixes are measured as reduced friction, not as better work. No unattended adjudication: discovery ran by schedule and the decision on it was made by a person with a panel, and the follow-up that was supposed to trace it failed. No business value, and no causal comparison of the two channels as signal types; they differ in volume, maturity and workflow, and this is a measured history, not a controlled experiment. One fleet, one operator. The magnitudes are corpus-specific; the method, the five states, and the latency rule are what transfer.