A gate on agent self-modification rejected 383 proposals, and 211 of them fixed their trigger while breaking something else.

The self-healing harness frames self-modification as admission control: the agent proposes changes to its own operating instructions in an external workspace, and an external runtime gate decides what persists. Candidate rules get provisional authority during evaluation and cross-episode authority only after measured improvement on the triggering failure with no regression beyond a fixed margin on protected cases. Across 16 matched runs on AppWorld, Terminal-Bench and tau²-Bench, 55% of replay-decided proposals helped one case and hurt another. That ratio is the argument for the gate. (arXiv 2609.24130)