Ten agents, one large repository, a scan you started before lunch. Six hours later you come back to a dead terminal. The machine went away, or the connection did, and it does not much matter which. You type the same command again, and this time it finishes in forty minutes, with the morning’s findings still in the report. Nothing about the agents made that possible. They remember nothing between runs and never did. What survived the crash was a file that was being written while the work happened, and a restart that reads it back is a different kind of engineering from a restart that begins again.

Marks on the trunks, not in memory

A crew is sent out to measure a patch of forest before anyone decides what to do with it. The boss splits the ground into blocks and notes who took which. A cruiser walks their block, measures each tree — species, diameter, height — and leaves a stripe of blue on every trunk already counted. Each measurement goes on the sheet at the moment it is taken, and nothing on the sheet gets rewritten afterwards.

Rain closes the day at three. The next morning nobody reconstructs yesterday afternoon out of what people think they remember. The sheets say which blocks are closed. The marks say which trees are done, so a cruiser who wanders back into counted ground adds nothing, because a tree measured twice is not new information. And the line they were not allowed to cross yesterday is still the line today: coming back does not widen what anyone may do.

A fleet ledger is the sheet and the mark together. The manager hands each worker a task and appends that assignment; then every tool call, every result, every decision, every checkpoint lands in an append-only log as it happens. The resume command reads the log forward and rebuilds the execution from it, rather than reassembling state from what anyone believes was going on. While the run is alive, the same log is how you know who is holding what.

The rerun pays only for the missing files

Watch this land on a real job. A vulnerability scan starts with fast detectors sweeping the code for candidates. Models then investigate the candidates one by one, triage grades what they find by severity, and a revalidation pass goes back over the survivors to throw out false positives. Split a monorepo across ten workers and that is hours of paid model time.

One worker exhausts its quota halfway through the investigation and the pipeline stops. You restore the quota and run the same command. Records and state are idempotent, so the workers skip the files already analysed and take only the ones still missing, then revalidate the findings before export. That single property changes what you are willing to begin. On a job this long, starting over is not an irritation; it is the reason you never launch it in the first place.

Two smaller decisions ride along. The work can fan out into microVMs with limited egress, because scanning a repository you do not trust from the host that holds your credentials is how a scan becomes an incident. And each batch carries a short description of the repository, enough to sharpen the signal — an exhaustive project file does the opposite and buries it.

Resuming a run is not regaining trust

The tempting misreading is that a ledger makes resumption a shortcut: the run was cleared yesterday, so let it carry on today. The runtime does not work that way and should not. On resume it applies the permission posture, the repository rules and the sandbox again, before every action, exactly as on the first pass. The log is a record of what happened. It never becomes a statement of what is allowed.

What the log does buy, besides recovery, is an account. Weeks later it is the only place that says which worker touched which module and why the patch on that one file looks like that. It is the same discipline as a loop that keeps its work on disk as it goes, described in The Loop Is the Product, scaled up to a group that has to agree with itself about the past. Ten agents with a ledger are a fleet you can govern. Ten without one are ten processes running.