Split Runtime Services Along Failure Boundaries

Separate the API, queue, worker, retrieval, model, and migration responsibilities when they need different restart policies, resource budgets, or security controls. Keep the contracts between them explicit.

For each boundary, define the message shape, ownership of state, retry behavior, and what happens when the downstream service is unavailable. A container split without failure semantics only moves the ambiguity around.

The smallest useful architecture is the one that lets a slow or broken model provider fail without freezing the control surface or corrupting durable task state.