Single-Live-Environment (SLE): A Stigmergic, Zero-Rollback Architectural Paradigm for Production-Only Continuous Systems

[wAI ~ wErrors] «All models are wrong, but some are useful.» — George E. P. Box (1976) Traditional deployment pipelines reduce risk by promoting software through development, staging, and production environments. This pattern becomes less informative when correctness depends on live traffic, live state, current configuration, dependency drift, timing, and rare combinations of these factors. Production canaries, feature flags, and traffic shadowing already acknowledge the resulting fidelity gap, but usually retain mutable state and direct side-effect authority. This preprint proposes the Single-Live-Environment (SLE) paradigm: no persistent fidelity-seeking staging or development deployment environment is used as the semantic validation target. Candidate code executes directly against live production inputs inside capability-bounded ephemeral branches. Canonical application state is represented by an append-only event history. Candidate mutations are branch-local, while irreversible external operations are denied to candidate code and instead enter a durable side-effect escrow. A commit certificate authorizes state promotion and effect release only after declared invariant and policy checks succeed. Version 1.2 extends SLE from an application-runtime contract into a Sovereign SLE Cell: a small, reconstructible production unit with one authoritative durable history, rebuildable derived messaging/cache state, signed executable admission, machine-readable host configuration, encrypted off-machine backup, and explicit recovery and provider-exit drills. The paper distinguishes a one-hill cell (single host, not host-level HA), a two-hill cell (independent warm replica), and a federated colony with a third witness/fencing domain intended to prevent dual-writer split brain. The release introduces frugal fault tolerance: the minimum independent redundancy sufficient for a declared failure model rather than maximal infrastructure duplication. It formalizes writer epochs/leases, the substrate boundary (Single Live Environment does not imply Single Physical Substrate), Infrastructure-as-Verified-State, mutual observability, signed module provenance, durable-versus-volatile storage tiers, and a sovereignty-adjusted total-cost model: C_total = C_compute + C_storage + C_traffic + C_ops + C_failure + C_exit. A new empirical portability metric, T_exit, measures how long it takes to rebuild the service on an unrelated provider using only the repository, externally recoverable secrets/keys, and backed-up canonical history. A multidimensional cell passport Pi_cell = (C,R,F,E,O,X) records cost efficiency, recovery, failure-domain independence, resource efficiency, operator burden, and exit portability. The paper deliberately avoids an anti-cloud claim. Managed hyperscaler primitives are useful where they improve the workload-specific quality/cost frontier. Current Contabo, Hetzner, Backblaze, and AWS list prices are included only as a dated, non-equivalent illustrative snapshot. The decisive comparison must include equivalent durability/security/SLO targets and operator labor. The strongest invariant remains conditional pre-escape zero rollback: candidate execution cannot mutate canonical state or directly perform irreversible external actions; rejected branches disappear before escrowed effects are released. Version 1.2 additionally requires that host failover and provider portability be tested rather than inferred from containerization or Linux alone. Selected related works / references Garcia-Molina, H.; Salem, K. (1987), Sagas, DOI 10.1145/38713.38742. Haas, A. et al. (2017), Bringing the Web up to Speed with WebAssembly, DOI 10.1145/3062341.3062363. Dorigo, M.; Bonabeau, E.; Theraulaz, G. (2000), Ant algorithms and stigmergy, DOI 10.1016/S0167-739X(00)00042-X. Heylighen, F. (2016), Stigmergy as a universal coordination mechanism I, DOI 10.1016/j.cogsys.2015.12.002. Nakajima, Y. (2026), The Log is the Agent, arXiv:2605.21997. S.V.E. Meta-License v5.0