Plan for Stop, Undo, and Recovery

Build a kill switch people will pull, route failures by category, and show four states instead of a spinner.

See the situation

Start with the situation below. Next, we will work through an example together before you try the activity.

Samir · Workflow operator

The case

A stop control with a high operational cost

A stop control should name which effects stop, which safe paths remain, and what recovery can actually undo.

What it does: Stops every path modeled in this fixture
Cost of pulling it: Every workflow halts, including the safe ones
During the incident: Two people discussed whether it was bad enough yet
Time before it was pulled: Long enough to matter
Times it has been pulled since: Zero

Your task

Choose how to stop or recover each action. Separate reversible changes from effects you can’t undo.

Need a little guidance?

You’re done when: The recovery plan distinguishes configuration rollback from irreversible external effects.

“Undo” means different things depending on what already happened outside the system.

Need a reminder? Reopen the worked example

Watch one example first

A timeout occurs after a provider may have accepted a message. Pausing new sends stops further effects; retrying blindly could duplicate the original send.

Why this follows from the evidence

Stop, undo, and repair are different. Establish whether the external effect occurred and whether repeated delivery is safe before resuming.

GTM Lab

Saved locally

Workflow Control Plan · 0 of 8 sections started

Saved locally to your browser.

Case evidence

A stop control with a high operational cost

What it does: Stops every path modeled in this fixture
Cost of pulling it: Every workflow halts, including the safe ones
During the incident: Two people discussed whether it was bad enough yet
Time before it was pulled: Long enough to matter
Times it has been pulled since: Zero

During the incident above, two people spent the useful part of an hour deciding whether things were bad enough yet. Fix the switch, then route the failures.

Route the failure without losing the last good result

Choose a destination for each event. Then set what the stop control disables and what the status view preserves.

Failures to route

Drag a card into a bucket, or tap a card and then tap a bucket.

Graduated stop controlWhen the current run fails

Restoring this practice draft…

Optional: compare the original decision choices

The case tool above is the activity that records completion. These choices are an optional review of alternative reasoning.

Work the case · 0 of 3 sections drafted

Build a switch people will pull

Compare these alternatives one section at a time. Check a choice to see its consequence; the draft summary below keeps the proposed changes together.

Step 1 of 3

What shape should the kill switch be?

Graduated, and requiring two named people to agree before it can be pulled.Graduated: disables paid reveals and outbound sending, leaves free matching, flagging, and everything read-only running.Total: one switch that stops the entire system.

This is a proposed draft until the chapter check runs. Selecting a choice alone does not complete the chapter.

3b · Proposed

Safety control plan draft

Safety control plan draft · current draftCompare the original state with the proposed change. This preview does not change live records.

Safety control plan draft · current draft
Item	Before	Proposed	Why
What shape should the kill switch be?	No saved change in this exercise draft	Not drafted yet	Choose a proposal to see what it would add to the draft.
Five failures. Where does each one go?	No saved change in this exercise draft	Not drafted yet	Choose a proposal to see what it would add to the draft.
What must the status display be able to show?	No saved change in this exercise draft	Not drafted yet	Choose a proposal to see what it would add to the draft.

What shape should the kill switch be?: BeforeNo saved change in this exercise draft; ProposedNot drafted yet; WhyChoose a proposal to see what it would add to the draft.
Five failures. Where does each one go?: BeforeNo saved change in this exercise draft; ProposedNot drafted yet; WhyChoose a proposal to see what it would add to the draft.
What must the status display be able to show?: BeforeNo saved change in this exercise draft; ProposedNot drafted yet; WhyChoose a proposal to see what it would add to the draft.

A choice appears here as a proposal, not as evidence that a live system changed.

Your place saves as you go.

Chapter 6 of 80 complete