# Recovery and proof

URL: /agents/autonomy-levels/recovery-and-proof · Id: `page:agents/autonomy-levels/recovery-and-proof`

> How a Startup survives failed calls, restarts and bad Decisions, how reverts contain damage, and how the record proves the loop works.

Failure is routine; what matters is that responsibility and safe progress survive it. Every failure ends in an accountable retry, alternative, correction or hold, and the record shows which.

## Execution and direction
Execution state and business direction are separate records. A queued [Action](/business/nouns/action) can survive a restart after the reason for it has gone stale. So a fresh [Worker](/business/nouns/worker) reads both before it continues: the receipts of what ran, and the current [Decisions](/business/nouns/decision) that say why.

Before any second external effect, the platform settles what the first one did. An Action with an unknown result stays `pending` with the reason `awaitingSource` until the outcome is known. A missing local confirmation never counts as a failure, because treating it as one sends a payment, [Message](/business/nouns/message) or [Order](/business/nouns/order) twice.

Every Action carries a stable identifier. A repeat call with the same `Idempotency-Key` returns the first Action instead of starting another. [Retry](/business/nouns/action/retry) runs a failed Action again as a new Action linked to the one that failed.

## Retrying is not recovering
A retry fixes a fault in execution, not a fault in the plan. Work that succeeds technically and moves no outcome is a failed approach, and running it again adds cost without value. The [Role](/business/nouns/role) that owns the outcome reviews the premise and decides whether more work is justified.

Retries are bounded. A [Task](/business/nouns/task) that fails its checks three times goes back to the queue and [escalates](/business/nouns/task/escalate) to the Role above, with every attempt attached. No Worker loops on the same failure unseen.

## Containing damage
Damage stops before it is repaired. A [brake](/agents/autonomy-levels/brakes) halts a class of effects across every affected [Startup](/business/nouns/startup) at once, and a spend state drops before money leaves. The [Silence watch](/workflows/processes/retention/silence-watch) wakes a Role when a customer, a Worker or a scheduled [Event](/business/nouns/event) goes quiet.

## Revert by query
Nothing is ever deleted. [Revert](/business/nouns/change/revert) undoes a merged [Change](/business/nouns/change) with a new Change and a superseding Decision, so the history keeps both. A revert by query selects many Changes at once and undoes them as one Change, which is itself revertible.

The query selects by author, [Play](/business/nouns/play), time range, [Cohort](/business/nouns/cohort) or [Evaluator](/business/nouns/evaluator) score. A score below a taste threshold is enough, so a [Studio](/business/nouns/studio) can sweep out weak copy across a [Portfolio](/business/nouns/portfolio) in one step.

Every revert starts with a preview of what it restores and what it cannot. Republishing restores a [Page](/business/nouns/page) or a [Price](/business/nouns/price), but a sent Message stays sent, so the preview proposes a correction. Records a [Tenant](/business/nouns/tenant) wrote directly, such as its [Contacts](/business/nouns/contact) and Orders, stay outside bulk revert.

**Ask**

```text
Revert the latest change.
```

**API**

```bash
curl -X POST https://api.sb/quietcopy.com/changes/change_1/revert \
  -H "Authorization: Bearer $STARTUP_BUILDER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason":"Example reason"}'
```

```json
{
  "api": "https://api.sb/quietcopy.com",
  "revert": {
    "$id": "https://api.sb/quietcopy.com/changes/change_1",
    "$type": "Change",
    "status": "Open",
    "base": "version_1"
  },
  "action": {
    "$id": "https://api.sb/quietcopy.com/actions/action_1",
    "operation": "Change.revert",
    "status": "done"
  },
  "links": {
    "self": "https://api.sb/quietcopy.com/actions/action_1"
  }
}
```

**SDK**

```ts
import { $ } from 'startup-builder'

const revert = await $.Change.revert({ change: 'change_1', reason: 'Example reason' })
```

**CLI**

```bash
npx startup-builder do Change.revert --json '{"change":"change_1","reason":"Example reason"}'
```

**MCP**

```json
{
  "name": "do",
  "arguments": {
    "code": "return await $.Change.revert({ change: 'change_1', reason: 'Example reason' })"
  }
}
```

## Proof from the record
That the loop works shows in the record, never in an [Agent](/business/nouns/agent)'s summary. Decisions, Actions, Events and [Evidence](/business/nouns/evidence) read the same on every [Interface](/business/nouns/interface), so any reviewer can check them. A Startup's autonomy proves out in four separate tests.

| Test | What it shows |
| --- | --- |
| Judgment | Roles choose useful work and revise it from feedback. |
| Continuity | Decisions and work carry on across wakes and restarts with no human choosing Tasks. |
| Outcomes | The loop delivers accepted outcomes at a measured cost, with remedies on a miss. |
| Transfer | An improvement carries to another Startup, with its adaptations recorded. |

Each test stands alone. Passing judgment says nothing about continuity, and continuity says nothing about customers.

## A recovery in practice
A [Dataset API](/products/templates/dataset-api) of energy prices renews 40 [Subscriptions](/business/nouns/subscription) on the first of the month. Midway, the payment call times out and the platform restarts the Worker. Twelve collection Actions sit `pending` with unknown results.

The fresh [Billing Specialist](/agents/finance/billing-specialist) reads the receipts before it calls anything. It [reconciles](/business/nouns/transaction/reconcile) the twelve against the payment account: ten charges went through and two did not. It retries the two with their original keys, so no customer pays twice.

The record shows 40 renewals, one restart and zero duplicate charges. No person was involved, and the founder reads the summary the next morning.

## Next
- [The operating loop](/agents/autonomy-levels/operating-loop) explains the cycle that recovery protects.
- [Guarantees](/agents/autonomy-levels/guarantees) lists what holds when anything fails.