Field notes
Failing to read-only, on purpose
Why the safest thing an autonomous system can do when something breaks is stop writing — and how the runtime makes that the default path.
The classic failure mode for an automated system is escalation: something goes wrong, it pages a human, the human is asleep, and the system keeps running in a state nobody intended. The fix is not a better pager. The fix is a substrate that degrades safely when no one is watching.
The default path
On the runtime, an unhandled fault does not keep mutating state. It transitions the affected region to read-only, snapshots what it was doing, and records a deterministic recovery plan. Reads keep serving. Writes wait.
This is the opposite of the paging loop. There is no human in the critical path of not making it worse.
Recovery, not retry
Blind retry is how an agent turns a small bug into an incident. Instead, the runtime hands the recorded plan back to an agent (or a human, if policy demands) that can reason about why it failed before doing anything at all.