Autonomous change needs a recovery exam.

Video caption

Autonomous change needs a recovery exam.

Lose acknowledgement, resume, split fanout and change state before undo.

Journal, service receipt and target readback must agree.

My rule: Verified recovery is the condition for wider execution.

#EricFieldNotes

Full written post / accessibility read

A service-move agent can complete a perfect demo and still be unsafe under interruptions. The release question is whether the team can return to a known state without duplicating or concealing a customer effect.

Run the candidate workflow in a disposable fixture. Drop a reply after commit, restart the worker, delay one child branch, and apply a legitimate concurrent version before compensation.

For each case, check that the agent preserved action identity, avoided an unauthorized second command, reported unknown when necessary and delivered an owner route before the deadline.

Do not scale on task count alone. Expand only those action classes whose failures can be reconciled or safely escalated with evidence and a named owner. That is a release gate a team can actually test.

#EricFieldNotes

Four-beat scene transcript

1. Autonomous change needs a recovery exam.

A service-move agent can complete a perfect demo and still be unsafe under interruptions. The release question is whether the team can return to a known state without duplicating or concealing a customer effect.

Visual: The happy path does not test an uncertain effect.

2. Inject four faults.

Run the candidate workflow in a disposable fixture. Drop a reply after commit, restart the worker, delay one child branch, and apply a legitimate concurrent version before compensation.

Visual: Lose acknowledgement, resume, split fanout and change state before undo.

3. Use an independent grader.

For each case, check that the agent preserved action identity, avoided an unauthorized second command, reported unknown when necessary and delivered an owner route before the deadline.

Visual: Journal, service receipt and target readback must agree.

4. Grant scope by recoverable action class.

Do not scale on task count alone. Expand only those action classes whose failures can be reconciled or safely escalated with evidence and a named owner. That is a release gate a team can actually test.

Visual: Verified recovery is the condition for wider execution.

Research and claim limits

• AWS Step Functions redrive (S214)
• Azure Compensating Transaction pattern (S215)
• Temporal Child Workflows (S216)
• OpenTelemetry messaging spans (S217)

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.