loading…
09:41:03 customer loaded ✓
09:41:05 refund issued ✓
09:41:05 process crashed 💥
ticket updated ✗
Restarting the entire workflow can refund twice. Starting after the refund without durable evidence can leave the ticket wrong forever.
Persist workflow state at safe boundaries: request_received, customer_loaded, refund_completed, ticket_updated, completed. Store the idempotency key and result for every external side effect.
Resume from the last durable checkpoint. Use a compensating action only when the business operation can actually be reversed; compensation is not a database rollback.
Inject a crash after refund success in Kintsu Agent. Restart the worker, resume the ticket update, and prove the refund count remains one.
For each step, label its input, persisted state, side effect, idempotency strategy, and recovery behavior. If any cell is blank, recovery still depends on luck.