A closed gate carries a reason; a paused breaker carries a cause. Nothing stalls with a null reason field.
Operational resilience
Autonomous fleets fail quietly.
A fleet of coding agents that runs itself has no one to page. When it breaks, there is no exception and no complaint — only a feed that stops moving. Resilience is the work of making the quiet visible: every stall gets a surfaced cause, every retry is bounded, and recovery does not wait for a human to notice that nothing is happening.
The control loop
Why the symptom is always “it looks stalled”
A card travels a loop — deliver, gate, review, integrate, accept — and a separate deploy makes it live. Beneath the loop sit the control plane that connects the orchestrator to the execution host, and the substrate of processes, tooling, accounts, and the operating system. A fault at any station produces the same silence, so the symptom tells you almost nothing. Finding the station is the diagnosis.
Acceptance and supervision run as an always-on platform service. The session observes; it does not carry the loop.
The same aspect blocking round after round routes to a human, instead of re-coding a card whose scope can never fit.
“Delivered” is recomputed from what is actually deployed. A host-side fix owes a deploy before it counts.
Failure families
Different faults, one silence
Six causally distinct faults arrived under the same observation over two weeks. Grouped by mechanism, they fall into a handful of families — and each has a matching discipline.
The control plane on a laptop
The orchestrator ran on a roaming machine that slept. Every sleep or reboot tore the tunnel and stalled both planes, once for eleven hours — hidden by an unguarded call that died in silence.
The loop that died with the terminal
The logic that accepts and requeues cards was tied to an ephemeral session and died nightly. The runner was healthy; work simply piled up because nothing was moving it.
A single reader, no watchdog
One wedged reviewer starved the whole review queue. Separately, an open-ended card retried forever, because “implement all recommendations” can never fit one delivery.
One account, whole-fleet outage
Every agent shared one provider account. Its usage limit failed every card at once, and because failures escalate, a limit became an escalation storm — then the breaker paused with an empty reason.
Delivered, but not live
A fix was merged yet absent in production, because the host still ran an old binary. Integration is not deployment; a green card over a stale deploy is a lie the board must stop telling.
Flakes that were real bugs
Six “environmental” test failures were six genuine platform defects on one operating system — path limits, a held file handle, a torn atomic write, a gate that never opened. “Flaky” was a hypothesis, not a diagnosis.
The discipline
Making the quiet visible
An autonomous fleet is not reliable because it never fails. It fails constantly, in mundane ways. It is reliable because it refuses to fail quietly.
No silent state
Every closed gate and paused breaker carries a human-readable reason, surfaced on the board. A null rejection field is a bug, not a state.
No restart without proven silence
Fifteen minutes of no claims and no live workers before a plane restarts — so a normal quiet spell is never mistaken for death and never kills in-flight work.
Bounded retry, then a person
Automatic retries are capped and escalate. The same aspect blocking N rounds is a scoping problem for a human, not a coding problem to repeat.
No shared single point
A shared account or single-reader queue is a fleet-wide fault line. Detect account limits, pause on quota, auto-resume at reset; give every reader a reclaim path.