An agent fixed the right bug in the wrong tree, which is one of those sentences that sounds like a joke until it is your afternoon. There is no elegant way to soften it because the problem itself is brutally simple: the issue was real, the diagnosis held, the code change made sense, the test was appropriate, and all of it took place in diminuendo-otel-investigation, which was not the live working tree.
A mistake like that becomes funny only after it has been repaired. Among AI-agent failures, it is one of the cleanest I have seen because intelligence, taste, and model capability were not the problem. Location was.
For humans, the question “where am I?” has a lot of ambient answers: the editor window, the terminal prompt, the branch name in the status bar, the fact that you remember why you opened this folder, and the vague shame of having too many tabs while still knowing which one contains the work that matters.
Agents do not have that kind of embodied workspace memory. They have context, commands, paths, and whatever discipline the toolchain enforces. If the discipline is weak, they can be extremely competent in the wrong place.
In this session, the underlying bug involved local execution and path normalization. A command tried to run something like /workspace/solution.ts on a Mac/local runtime where that sandbox-style path did not map to the actual local workspace root. The fix was sensible: rewrite sandbox-style absolute paths such as /workspace/..., /project/..., and /root/project/... onto the real local workspace before execution, matching the behavior already used by file writes.
Good fix. Wrong tree.
Recovery gave the incident its shape. First, the agent proved the wrong-tree diff was limited to the two edits it had introduced. Then it reverted those changes there. Only after that did it apply the fix in the live tree, run the focused tests in the correct location, and verify the abandoned subtree was clean again.
That order mattered. A wrong-worktree incident is already a trust injury; broad cleanup makes it worse. The repair proves that the agent knows which fingerprints are its own.
After the damage was contained, the missing receipt looked small and embarrassing: repo root, branch, worktree, target path, dirty state, sibling paths with similar names. Not once at the beginning of the day, and not as a vague current-working-directory line in the prompt. At the moment before the patch, while the risk is still cheap to catch.
Agents multiply work. Location errors multiply with them.
A human in the wrong worktree might make one mistaken edit, notice something feels off, and stop. An agent can make the mistaken edit, add a test, run the test, summarize the victory, and move on. The confidence is earned locally and false globally.
Danger lives in the fact that every local signal can be green. The tests passed in the wrong tree, the diff was coherent in the wrong tree, the explanation was accurate for the wrong tree, and the product was still unfixed.
Workspace identity belongs in the same category as permissions and destructive commands: not environmental context, but a safety property.
Tooling carries part of the fix: stronger branch displays, warnings when similar worktrees exist, edit commands with explicit target roots, and agents that include cwd and git status before touching files in multi-worktree repos. Habit carries the rest. When something feels off, inspect the path. When the user asks “why are you in that tree?”, answer with evidence. After an edit lands in the wrong place, stop adding cleverness. Revert only the agent’s own changes, move to the live tree, and reapply carefully.
I suspect this class of bug is going to become more common, not less. Agentic development encourages parallelism: multiple agents, multiple worktrees, experiments, review branches, reproduction folders, generated implementations. Good. Also a geography problem.
As the field expands, the map improves or the work gets lost.
Future coding agents get safer when that pre-edit reflex feels almost boring: repository, branch, worktree, target path, dirty state, similar sibling paths, and only then the patch.
Not because the agent is untrustworthy, but because fast work in the wrong place is worse than slow work in the right one.