Architecture Review: Map Four Failure Domains Before Agent Steps Land on a Free Server

Here is an event order that ends with a duplicate deployment. A worker claims step s1 , applies the patch, and the substrate disappears before the acknowledgement is written. The scheduler sees an open intent, no heartbeat, and no result, so it re-queues s1 on a fresh worker. The fresh worker applies the same patch again, and both attempts report success to different observers.

Nothing in that story is exotic: no network partition required, no Byzantine node, no exotic clock. It only requires that the place where a step runs and the place where the record of that step lives are allowed to fail independently. The common implementation fails to preserve one invariant: every step has at most one observable effect, and every effect has a durable intent that precedes it.

This is an architecture review of the substrate that keeps tempting teams to skip that invariant.…