The Workflow Engine · 05.06
Durable Event Delivery: Rules That Survive Restarts
Cross-workflow activations are persisted before execution, then claimed, retried, and recovered with idempotent delivery identities.
Persist first; run second
When a rule matches an event, Agentis writes a delivery record to workflow_event_deliveries before it requests the target run. The record carries the subscription, stable event identity, payload snapshot, status, retry schedule, and lease. This separates accepting an event from executing its effect, so a crash between those two moments becomes recoverable work rather than a silent missing transition.
At-least-once transport, exactly-once business effect
Workers claim deliveries with a compare-and-set lease; duplicate events converge on the same delivery identity; expired leases are reclaimed; and retries are bounded and observable. The target run receives the same idempotency identity, so recovery may re-attempt transport without creating duplicate business actions. Operators can inspect delivery status and evidence rather than guessing from a completed source run.
Continue
The SWIFT verdict engine probes the real world after a run settles instead of trusting a self-report, distinguishing accomplished from merely completed.
How a failed node recovers: deterministic rebind, capability-aware remedy, config-aware surfacing, certified structural repair, then honest escalation.