The dangerous gap is between systems
An agent asks a destination to make a consequential change. The destination commits it, but the network connection disappears before the response is stored. From the runtime’s point of view, the call failed. From the customer system’s point of view, the work is already done.
Treating that transport failure as proof of absence invites a duplicate write. Treating every timeout as success hides real failures. The honest state is uncertain.
Uncertainty must survive the runtime
A replacement model cannot settle the outcome by reading the previous conversation. It needs durable intent, dispatch, authority, and evidence records that exist outside either model runtime.
That is why null.select commits intent before dispatch and records a possible loss of contact as uncertain rather than generically failed.
- Do not repeat the action while its external effect is unresolved.
- Do not let a stale runtime continue mutating after takeover.
- Do not infer destination state from an SDK or transport error.
Ask the destination what happened
Recovery needs an authoritative destination lookup or a target-supported idempotency contract. A separate verifier can establish whether the effect is present, absent, partial, conflicting, or still unresolved.
When the effect is present, the successor continues after it instead of repeating it. When it is absent, any retry still requires a new authorization decision and permit.
Continuation is an authority change
Once blocking effects are resolved, promotion fences the previous runtime, advances the persisted execution epoch, validates the successor capability, and issues one fresh scoped lease. A recipient-bound capsule carries bounded evidence and references—not credentials, approvals, hidden reasoning, or a raw transcript.
The result is deliberately narrower than “restore the session.” It is a controlled decision about who may act next, based on what can be proved now.