Single-Live-Environment (SLE): A Stigmergic, Zero-Rollback Architectural Paradigm for Production-Only Continuous Systems

[wAI ~ wErrors] «All models are wrong, but some are useful.» — George E. P. Box (1976) Traditional deployment pipelines reduce risk by promoting software through development, staging, and production environments. This pattern becomes less informative when correctness depends on live traffic, live state, current configuration, dependency drift, timing, and rare combinations of these factors. Production canaries, feature flags, and traffic shadowing already acknowledge the resulting fidelity gap, but normally retain mutable state and direct side-effect authority. This preprint proposes the Single-Live-Environment (SLE) paradigm: no persistent fidelity-seeking staging or development deployment environment is used as the semantic validation target. Candidate code executes directly against live production inputs inside capability-bounded ephemeral branches. Canonical application state is represented by an append-only event history. Candidate mutations are written only to branch-local namespaces, while irreversible external operations are prohibited from direct execution and instead enter a time-delayed side-effect escrow. A commit certificate authorizes both state promotion and eventual effect release only after declared invariant and policy checks succeed. The paper formalizes a tripartite failure taxonomy, quarantine windows, a capability/effect firewall, conditional zero-rollback properties, deterministic replay capsules, stigmergic worker coordination, and a necrophoresis-style failure-isolation protocol. It compares SLE with traditional promotion pipelines, GitOps/blue-green/canary delivery, feature flagging, and durable-execution systems; specifies a minimal production blueprint based on Envoy/Traefik, Wasmtime, PostgreSQL, NATS JetStream, and a durable outbox; defines a threat model and falsifiers; and gives a research roadmap from a single-node prototype to a replicated continuous-live-verification substrate. The paper explicitly limits its strongest claim: “zero rollback” applies to rejected pre-commit branches only when canonical state was never mutated and irreversible effects never escaped the escrow boundary. The architecture does not claim that testing disappears, that WebAssembly provides perfect isolation, that every effect can be delayed, or that a single-node implementation is highly available. Suggested related works / references Garcia-Molina, H.; Salem, K. (1987), Sagas, DOI 10.1145/38713.38742. Haas, A. et al. (2017), Bringing the Web up to Speed with WebAssembly, DOI 10.1145/3062341.3062363. Dorigo, M.; Bonabeau, E.; Theraulaz, G. (2000), Ant algorithms and stigmergy, DOI 10.1016/S0167-739X(00)00042-X. Heylighen, F. (2016), Stigmergy as a universal coordination mechanism I, DOI 10.1016/j.cogsys.2015.12.002. Nakajima, Y. (2026), The Log is the Agent, arXiv:2605.21997. S.V.E. Meta-License v5.0