I think robustness is best managed in layers

Databases have WAL -> Systems have task queues

The executor itself can fail, if the job is not lost :)