The cloud decides; the edge executes

A hybrid platform becomes difficult long before it becomes large. The difficulty is not the number of machines. It is deciding which machine is allowed to be right.

RS Platform keeps media storage and filesystem-owning services at home because moving those bytes through the cloud would be expensive, slow, and operationally dishonest. But keeping work at the edge creates a subtle risk: the edge can start making decisions simply because it is closest to the problem.

Proximity is not authority

The home appliances execute a reviewed desired state and report what happened. They do not elect a new truth when the cloud is unavailable. They retain a last-known-good configuration for continuity, but that cache does not become authority.

The distinction sounds academic until a failure:

1. A node becomes unreachable.
2. An observer reports corroborating evidence.
3. The control plane advances a durable, fenced evacuation.
4. The edge applies the new generation.
5. Every participant acknowledges the same result.

Without that sequence, two helpful machines can both decide to recover the same storage-owning workload. Helpfulness becomes corruption.

The edge should still be resilient

Central authority does not mean every home service stops when the WAN drops. Local DNS can continue. Existing workloads can keep running. Media traffic can stay local. The edge simply loses permission to invent a new global state.

This is the useful separation:

Continue executing what was safely decided; stop before making a different decision alone.

A transferable rule

Whenever a system spans failure domains, list every place that can mutate durable state. If the answer is “whichever component notices first,” there is already an accidental consensus protocol—just without the parts that make consensus safe.

Choosing one authority is less magical. It is also much easier to recover.