Reconcile external effects
Ask the destination what actually committed. A timeout stays uncertain until authoritative evidence settles it.
See the recovery pathProvider-neutral agent continuity
Switch agents without losing control of what happens next.
null.select lets a new runtime continue the same work only after external effects are reconciled, stale authority is fenced, and a fresh scoped lease is issued.
effect reconciled present
The control plane
Continue the work. Re-establish authority from durable facts, not a copied conversation.
Fence stale authority
Advance a persisted execution epoch so late mutations from the previous runtime are rejected at the control boundary.
Inspect the fencing modelValidate the successor
Bind continuation to the new runtime identity, adapter release, capability digest, and current policy.
Explore capability checksResume with bounded context
Issue one fresh lease and a recipient-bound capsule containing evidence and references—not credentials or transcripts.
Read the safety boundaryBuilt for interrupted work
The moments where “just continue” is not safe.
Switch models after an OpenRouter outageMove long-running work from ClaudeRecover after a Stripe refund timeoutSwitch models after an OpenRouter outageMove long-running work from ClaudeRecover after a Stripe refund timeout
Fence a stale GitHub Actions runnerVerify a Jira ticket update before resumingContinue an interrupted Vercel deployment reviewFence a stale GitHub Actions runnerVerify a Jira ticket update before resumingContinue an interrupted Vercel deployment review
Hold a PagerDuty handoff until evidence arrivesHand work to a specialist modelAudit a Datadog incident held for reconciliationHold a PagerDuty handoff until evidence arrivesHand work to a specialist modelAudit a Datadog incident held for reconciliation
How it works
A handoff is a control transaction. Freeze, reconcile, fence, validate, and only then resume.
execution / customer recovery deterministic proof
previous runtimeAepoch 1 · fenced
successor runtimeBepoch 2 · active
- Intent committedcustomer update requested
- Target committedreceipt connection lost
- Takeover heldeffect outcome unresolved
- Effect verifiedtarget confirms one write
- Successor promotedfresh epoch and lease
VerifiedOne applied effect. One active lease.
Recover from the failure between systems.
Intent is committed before dispatch. If contact is lost after a possible external effect, the attempt becomes uncertain—not generically failed.
- FreezeStop new consequential actions.
- ReconcileVerify destination state independently.
- FenceAdvance the persisted execution epoch.
- ValidateCheck successor identity and capability.
- ResumeIssue one fresh, scoped lease.
Why null.select
Control that survives the runtime.
A lost response is not a failed action.
Possible dispatch followed by loss of contact becomes uncertain. Ordinary continuation stays held until reconciliation or admitted target idempotency makes the next step safe.
Only one runtime can act for an execution.
Effect-capable leases are guarded by persisted fencing epochs and PostgreSQL constraints—not an in-process mutex that disappears during a crash.
Runtime identity is declared and checked anew.
The successor can use a different provider and model identity, but it receives authority only after its capabilities and current policy have been validated.
Carry verified facts, not an unrestricted transcript.
Recipient-bound capsules contain bounded evidence and references. Credentials, approvals, hidden reasoning, and raw transcripts do not cross the handoff.
+
A lost response is not a failed action.
Possible dispatch followed by loss of contact becomes uncertain. Ordinary continuation stays held until reconciliation or admitted target idempotency makes the next step safe.
A narrow safety boundary
Business truth stays where it lives.
The core owns relational control facts. Adapters own immutable destination semantics. Customer systems remain authoritative for their business objects.
No credentials, approvals, hidden reasoning, or raw transcripts in continuation capsules.
Review the safety modelQuestions,
answered.
The practical boundaries to understand before an agent is allowed to continue consequential work.
Read the safety modelContinue with evidence
Let the next agent move forward—without letting the old one keep acting.
Provider-neutral continuity for consequential agent work.