the boundary is the unit of work

The decision that shaped everything else was to give each autonomous worker its own system container rather than a process inside a shared host. A process boundary is cheap, and it is also porous. A crew of workers that can see each other's files, share a network namespace, and inherit the same privileges is not a crew; it is a thread pool with a personality. If the unit of work can damage the unit beside it, no amount of scheduling discipline rescues the design.

The tension is that a sealed box is also a box you cannot debug. The first workers ran with generous defaults, because generous defaults are how a thing gets working at all. Hardening arrived as a separate pass, once the pipeline was proven, and it cost availability: every restriction is a new way for a legitimate action to fail.

The pass itself was mechanical and boring on purpose. A deny-by-default call list allowing roughly two hundred operations. A mandatory access-control profile that keeps the worker away from the kernel's own surfaces. Capabilities dropped, so that the box is not privileged by construction. Per-worker ceilings on processor, memory, disk and process count, so that a runaway worker starves itself and not its neighbours.

The proof is not that the profile exists. The proof is that a worker still does its job underneath it, and that the profile is applied by the same provisioning path that creates the worker, rather than by an operator remembering a second command.

What this proves: isolation was treated as a product requirement rather than a deployment detail, and strictness was added after the work was proven, which is the only order in which strictness survives.