Diagnosing a Runaway Autonomous Loop

A team sets up a self-paced /loop with the prompt: "keep the release/next branch's CI green — if anything fails, diagnose it and push a fix." They leave it running overnight in auto permission mode.

1. Identify two distinct mechanisms described in this subject that bound how much this loop can cost or run away, even with no human watching it overnight.
2. Describe a plausible failure mode where the loop technically "succeeds" at every iteration (CI goes green) but produces a bad outcome by morning. What about the loop's design allowed this?
3. Propose one concrete change to the setup that would have caught the problem in part 2 without requiring a human to babysit it live.