Avoiding stale automation commands
How command expiry, reconciliation, leases, and state machines prevent an old action from executing at the wrong time.
Every command needs a deadline
An offer may be valid for seconds, while a contextual message may remain useful for a few minutes. Delivery, completion, and cancellation always require a fresh external-state check. Store an execute-before timestamp that reflects the action's real business lifetime.
Expired actions move to a terminal state and are not silently retried.
Use a state machine
Queued, leased, executing, reconciling, succeeded, failed, expired, cancelled, and unknown states make recovery explicit. Unknown is important when the external side may have succeeded but the confirmation response was lost.
A reconciliation worker checks the external state before deciding whether a retry is safe.
Fence old executors
After failover, the new device receives a higher executor generation and a new fencing token. Results from the previous generation are rejected even if the old device comes back online.
This is how the system prevents two devices from acting as Active at the same time.