Playbooks

Choose a recovery mechanism

A step can fail part-way and must be recovered: compensate, keep a standby, recompute from lineage, restore a checkpoint, or both? Four questions decided by reversibility, the recovery-time target and whether the result can be recomputed.

Make a repeat harmless

Recovery will redo work, so an effect may land twice: use an operation that absorbs repeats, store progress with the effect, commit through the sink, or deduplicate at the receiver? Four questions, cheapest first.