Twenty-seven agents. The queue they file into is the hard part.

Pause is the control most agent platforms implement least carefully. The symptom that exposes it is specific: an agent is paused, stays quiet, and then resumes on the next deploy — because pause was never the thing that stopped it.

The mechanism is worth understanding because it generalises. Pause was enforced in exactly one place — a worker checking status before doing work — while the scheduled jobs themselves remained queued. The queue kept firing, and every firing was one unrelated bug away from acting. Pause now unschedules the jobs and sweeps stale entries at boot, which is what the word should have meant from the start.

The general form: a control that is honoured by convention rather than enforced by construction will eventually not be honoured.

The filter that decided who was safe to contact excluded anything marked invalid. It did not exclude records that had never been checked at all — and because the verification key was empty in production, nothing had been checked. Four hundred and fifty-five prospects sat in the gap between not-invalid and verified.

The same shape shows up elsewhere in the fleet and is now written into the code as a comment: a query for documents that have been reviewed and cleared must ask for the field to equal false, not merely to not equal true. The second form also matches every document where nobody ever looked.

It now fails closed. With no verifier, the filter returns nothing and zero messages go out, and there is an explicit override for when you genuinely want to send unverified.

This one is invisible from every dashboard, and the detection method is a ratio nobody thinks to compute. Contact enrichment was running in a container where the headless browser could never have worked — the image pointed it at a system binary rather than the one the library expects. Comparing error count to success count over a quarter gave the answer immediately: two hundred and seventy-five to eleven.

Nothing failed loudly, because the pipeline was designed to fall through to guessing addresses from a name and a domain — which produces plausible output indefinitely. An automation that degrades into guessing is more dangerous than one that stops, because its output still looks like work. Any fallback path that cannot be distinguished from the primary path in the output is a latent version of this.

Fixed, and — the part that matters — verified by launching the browser inside the running production container rather than trusting the build that claimed to contain it.

The deploy script re-ran the seed on every release, and the seed's update was applied as a set rather than an insert. Any agent already in the database had its status and its configuration overwritten with the seed defaults, every single time.

The evidence was unmistakable once I looked at it the right way: all twelve production agents shared an updated timestamp to the second, and every calendar link in their configuration was the placeholder from the seed file.

Seeding is now insert-only and the deploy step is opt-in. The broader rule is that a deploy should never be able to write to the rows an operator has edited.

Agents that act without asking are a liability wearing the costume of leverage. Every action that touches the outside world — an email, a post, an account change — is filed for approval rather than executed, and the interesting engineering is in that queue rather than in the models.

It is also where cost lives. Spend is recorded per agent run through the request context, so the question "what did this agent cost me this week" has an answer rather than an estimate.

This is the part I would build for someone else first. The agents are the easy half.