Durability and Recovery

WOML records run truth as append-only versioned events. Context and operational views are rebuilt by folding those events.

Immutable definitions

Every run binds to the exact compiled workflow and module artifacts active at admission. Editing source affects future runs only.

Recovery

Completed steps and managed effects are not replayed. Pending work resumes from durable state. A recorded start without a definitive terminal result is ambiguous; WOML fails that work closed unless a reviewed capability can prove safe reattachment.

Durable waits

Retries, approvals, queues, schedules, workflow calls, branches, and loop progress survive restart through the same event authority. Keep the SQLite state and related object storage on persistent media.

Event history is the source of truth

WOML records versioned facts such as run admission, attempt start, step success, branch selection, approval wait, managed operation outcome, cancellation, and finalization. Context and operational views are projections folded from those facts.

An in-memory projection may be cached for speed, but deleting it does not delete run truth. This is why a restart can rebuild what has already completed.

Understand safe and unsafe replay

Recomputing context.steps.prepare from a recorded successful step is safe. Repeating a payment request whose response was lost during a crash is not automatically safe.

If WOML recorded only that an effect started, it cannot infer whether the remote system performed it. A reviewed managed operation may reattach through durable identity; otherwise WOML fails the ambiguity closed and exposes a typed interrupted failure.

Preserve recovery data

Use persistent storage for the workflow-history database, object store, and logs needed by the deployment. Back them up coherently. Starting the same workflow against a new empty database creates a new runtime authority; it does not recover the previous runs.

Editing source or modules affects future definitions. Existing waiting runs stay pinned to their admitted compiled artifacts.