When a long-running agent dies mid-flight, a fresh worker must not restart from step 1 (wasted tokens) nor blind-retry a step that already half-committed a side effect (duplicate wire / invoice / email). This kernel replays the run's append-only journal and computes the recovery plan: skip what committed, retry what's safe, compensate an in-flight side effect with no idempotency key — and where to resume.
Honest scope. EcoCloud ships no durable-execution runtime — Temporal and Durable Objects were declined. This is the deterministic planner over the append-only journal you already write (task_events): it decides where to resume and what to retry vs. roll back; your runtime re-instantiates the worker and replays. The safety rule that matters: an in-flight, side-effecting step with no idempotency key is routed to compensate (roll back first) — never blind-retried — because the platform can't prove the external effect didn't already land. Composes with the trajectory verifier (check the journal first), the reversal kernel (perform the compensations), and idempotency keys (make the retries safe). Source: flowdesk-recovery-kernel.js.