Operate Airlift
Failure and recovery
Recover governed invocations, projections, adapters, workflows, transfer jobs, and uncertain cutovers without duplicate effects.
| Failure | Recovery rule |
|---|---|
| Duplicate action delivery | Same key and parameters collapse; conflicting reuse is rejected |
| Projection process restart | Rehydrate from the tenant event cursor/checkpoint and reconcile concurrent writes |
| Lakebridge job failure | Record terminal adapter evidence; retry only under its classified policy |
| Bounded repair failure | Route to visible human residue; never broaden or loop indefinitely |
| Transfer interruption | Resume from a durable watermark/checkpoint and reconcile duplicates/counts |
| Temporal worker restart | Replay deterministic workflow history; activities retain stable action keys |
| Approval wait expiry | Fail closed under policy; a late signal does not manufacture approval |
| Cutover verification uncertainty | Remain executing and reconcile; do not auto-retry the external effect |
Test historical workflow replay before deploying incompatible workflow code. Query errors from authentication or Temporal outages propagate; only a typed workflow-not-found condition becomes absence.