My agents kept overwriting each other, so I gave them claims

I run several agent sessions in parallel, each in its own project, all on the same machine. For a while I believed that was safe because every session had its own repo. It wasn't. Sessions reach outside their home tree more often than you think, a memory file here, a shared config there, a quick fix in a sibling project because the finding happened to surface elsewhere.

The collisions-five of them when I sat down and audited the record-all had the same shape. The second session was never blind. It saw the signs of the first one working, a fresh claim in a status file, a half-written directory, and it proceeded anyway. Claims existed then; each project noted them its own way, in its own status file, and nothing read them back.

I want to be clear that this is not a model being careless. Under context pressure, an agent treats another agent's presence as noise. Politeness is not a mechanism, so it doesn't survive.

Also worth telling: my staging rule failed the same week, broken again 67 minutes after I recorded it, by a session that had never lived the incident. That story owns its own piece, because the fix turned out to be nothing like better prose.

The claim protocol

So the claim went from a courtesy to a protocol. Not a new idea, a standardized one: one format, one place, one mechanical refusal, instead of five projects each writing notes nobody was bound to honour.

Before any session writes outside its own tree, it takes a claim, a small JSON file named after the target, holding who, when, and what for. The whole file is five fields:

{
  "target": "shared-config",
  "holder": "session-a41",
  "purpose": "align the lint rule with the new preset",
  "taken_at": "2026-08-14T21:02:11Z",
  "heartbeat_at": "2026-08-14T21:09:40Z"
}

The protocol around it is four verbs. Take before the first foreign write, renew the heartbeat every writing turn, release at the end, and if another session already holds the claim and its heartbeat is fresh, the answer is REFUSED, and REFUSED is an answer, not an obstacle. The refused session queues a handover note instead, and the work happens later, in order.

                 foreign write wanted
                        │
                        ▼
                   take <target> ── held, heartbeat fresh? ──yes──▶ REFUSED
                        │                                               │
                   no, or stale                                    queue a handover,
                        │                                          the work runs later
                        ▼
                claim written, read back
                        │
                        ▼
        beat every writing turn ──▶ release at the end

Verifying the guard

The part I did not expect to matter, and it mattered most, was verifying the guard itself. Early on, the