Recovery and proof

Failure is routine; what matters is that responsibility and safe progress survive it. Every failure ends in an accountable retry, alternative, correction or hold, and the record shows which.

Execution and directionCopy Anchor Link

Execution state and business direction are separate records. A queued Action can survive a restart after the reason for it has gone stale. So a fresh Worker reads both before it continues: the receipts of what ran, and the current Decisions that say why.

Before any second external effect, the platform settles what the first one did. An Action with an unknown result stays pending with the reason awaitingSource until the outcome is known. A missing local confirmation never counts as a failure, because treating it as one sends a payment, Message or Order twice.

Every Action carries a stable identifier. A repeat call with the same Idempotency-Key returns the first Action instead of starting another. Retry runs a failed Action again as a new Action linked to the one that failed.

Retrying is not recoveringCopy Anchor Link

A retry fixes a fault in execution, not a fault in the plan. Work that succeeds technically and moves no outcome is a failed approach, and running it again adds cost without value. The Role that owns the outcome reviews the premise and decides whether more work is justified.

Retries are bounded. A Task that fails its checks three times goes back to the queue and escalates to the Role above, with every attempt attached. No Worker loops on the same failure unseen.

Containing damageCopy Anchor Link

Damage stops before it is repaired. A brake halts a class of effects across every affected Startup at once, and a spend state drops before money leaves. The Silence watch wakes a Role when a customer, a Worker or a scheduled Event goes quiet.

Revert by queryCopy Anchor Link

Nothing is ever deleted. Revert undoes a merged Change with a new Change and a superseding Decision, so the history keeps both. A revert by query selects many Changes at once and undoes them as one Change, which is itself revertible.

The query selects by author, Play, time range, Cohort or Evaluator score. A score below a taste threshold is enough, so a Studio can sweep out weak copy across a Portfolio in one step.

Every revert starts with a preview of what it restores and what it cannot. Republishing restores a Page or a Price, but a sent Message stays sent, so the preview proposes a correction. Records a Tenant wrote directly, such as its Contacts and Orders, stay outside bulk revert.

curl -X POST https://api.sb/quietcopy.com/changes/change_1/revert \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason":"Example reason"}'

import { $ } from 'startup-builder'

const revert = await $.Change.revert({ change: 'change_1', reason: 'Example reason' })

npx startup-builder do Change.revert --json '{"change":"change_1","reason":"Example reason"}'

{
  "name": "do",
  "arguments": {
    "code": "return await $.Change.revert({ change: 'change_1', reason: 'Example reason' })"
  }
}

Proof from the recordCopy Anchor Link

That the loop works shows in the record, never in an Agent's summary. Decisions, Actions, Events and Evidence read the same on every Interface, so any reviewer can check them. A Startup's autonomy proves out in four separate tests.

Each test stands alone. Passing judgment says nothing about continuity, and continuity says nothing about customers.

A recovery in practiceCopy Anchor Link

A Dataset API of energy prices renews 40 Subscriptions on the first of the month. Midway, the payment call times out and the platform restarts the Worker. Twelve collection Actions sit pending with unknown results.

The fresh Billing Specialist reads the receipts before it calls anything. It reconciles the twelve against the payment account: ten charges went through and two did not. It retries the two with their original keys, so no customer pays twice.

The record shows 40 renewals, one restart and zero duplicate charges. No person was involved, and the founder reads the summary the next morning.

NextCopy Anchor Link

• The operating loop explains the cycle that recovery protects.
• Guarantees lists what holds when anything fails.