# Recovery needs model tests

> For agents: start with the [agent guide](https://ratstack.sh/llms.txt). Every page is Markdown by default; add `Accept: text/html` for HTML.

Free workshop: [Build Agent Loops That Never Stop Shipping](/tokenmaxx#interested).

A stateful property compares generated commands with real behavior. Deterministic initial state makes failures reproducible and shrinkable. Check the model by injecting a [defect](/lore/effect-basics).

> Both function calls must be deterministic.

Source: [Q17](/lore/durability-bibliography#q17); [B11](/lore/durability-bibliography#b11-property-based-testing), [B4](/lore/durability-bibliography#b4-release-it), [B15](/lore/durability-bibliography#b15-software-engineering-at-google).

## Failure it prevents

A vacuous or happy-path suite misses corruption across retries, cancellation, and restart.

## Our Effect 4.0.0 reading

`Arbitrary.checkEffect` and @[effect](/lore/effect-basics)/vitest run properties. `TestClock` and `Deferred` control `Effect` time and coordination. Author the command model; test persistent backends separately.

Source: `packages/effect/src/Arbitrary.ts`, `packages/effect/src/testing/TestClock.ts`, `packages/effect/src/Deferred.ts`.

## How to check

Plant a known transition bug. Require the property to fail and yield a replayable, valid counterexample. This check is our proposal. The books do not prescribe it.

Continue with [Checkpoints follow the promised commit](/lore/checkpoints-follow-commits), [Circuit breakers have state](/lore/circuit-breakers-have-state).

Connect this to [property-based testing](/lore/property-based-testing) and [model-based testing](/lore/model-based-testing).

Use [the durability skill](/skills/durability) for the full review. Return to [the durability index](/lore/durability).

## Sources

1. [Hebert, Fred. Property-Based Testing with PropEr, Erlang, and Elixir. Pragmatic Bookshelf, 2019.](https://pragprog.com/titles/fhproper/property-based-testing-with-proper-erlang-and-elixir/)
   Pragmatic Bookshelf. Chapter 7 Shrinking; Laying Out Stateful Properties; Testing Parallel Executions; Initial State for the State Machine; Adjusting the Model. Use the actual breaker’s threshold semantics. Accessed 2026-10-23.

2. [Nygard, Michael T. Release It!: Design and Deploy Production-Ready Software. Pragmatic Bookshelf, 2007.](https://archive.org/details/releaseitdesignd0000nyga)
   Pragmatic Bookshelf. §4.4 Unbounded Result Sets; Chapter 5 Stability Patterns: §5.1 Timeouts, §5.2 Circuit Breaker, §5.3 Bulkheads, §5.4 Steady State, §5.5 Fail Fast, §5.6 Handshaking, §5.7 Test Harness, §5.8 Decoupling Middleware. Accessed 2026-10-23.

3. [Winters, Titus; Manshreck, Tom; Wright, Hyrum, editors. Software Engineering at Google: Lessons Learned from Programming Over Time. O’Reilly, 2020.](https://abseil.io/resources/swe-book)
   O’Reilly. Chapter 15 Deprecation: Deprecation Tooling and Preventing Backsliding; CI Is Alerting (hermetic and flaky tests). Accessed 2026-10-23.

4. [Effect contributors. Effect 4.0.0. Arbitrary.ts](https://github.com/Effect-TS/effect/blob/67ba4e46a11ccda0b6761578bfd22c04ae00167d/packages/effect/src/Arbitrary.ts)
   Effect-TS. Pinned source for our Effect mapping, not a claim from the book. Accessed 2026-10-23.

5. [Effect contributors. Effect 4.0.0. testing/TestClock.ts](https://github.com/Effect-TS/effect/blob/67ba4e46a11ccda0b6761578bfd22c04ae00167d/packages/effect/src/testing/TestClock.ts)
   Effect-TS. Pinned source for our Effect mapping, not a claim from the book. Accessed 2026-10-23.

6. [Effect contributors. Effect 4.0.0. Deferred.ts](https://github.com/Effect-TS/effect/blob/67ba4e46a11ccda0b6761578bfd22c04ae00167d/packages/effect/src/Deferred.ts)
   Effect-TS. Pinned source for our Effect mapping, not a claim from the book. Accessed 2026-10-23.

## Linked from

- Agent guide → An Effect stack so pure (aspirational) Kit Langton will blush. → [Read page](https://ratstack.sh/llms.txt)

- Change log → What changed in the files served here, newest first. → [Read page](https://ratstack.sh/log)

- durability → Keep a rat-stack app standing when a provider, pool, or dependency slows down or a worker dies. Use at any I/O boundary, connection pool, provider call, shared waiter, fan-out, flag, gate, or work that can outlive a request, or when asked "what happens when this is slow", "add a timeout", "make this durable", or "what survives a crash". → [Read page](https://ratstack.sh/skills/durability)

- Durability starts with a recovery record → A reading order for storage, replay, worker ownership, overload, and recovery tests. → [Read page](https://ratstack.sh/lore/durability)

- Full agent guide → An Effect stack so pure (aspirational) Kit Langton will blush. → [Read page](https://ratstack.sh/llms-full.txt)

- Model-based testing → Describe what a system should do as a small model, generate action sequences, and check the real system against the model. → [Read page](https://ratstack.sh/lore/model-based-testing)

- Pure cores reduce timeline coupling → Move deterministic rules out of time-dependent actions and shared mutable state. → [Read page](https://ratstack.sh/lore/pure-cores-reduce-timelines)

- Rat Stack lore | rat-stack → Short, source-grounded notes on the ideas and decisions behind rat-stack. → [Read page](https://ratstack.sh/lore)

- Shared schemas need a transition period → Keep old and new representations usable while consumers migrate. → [Read page](https://ratstack.sh/lore/schema-changes-need-a-transition)

- Source change history (log.md) → The generated change log as Markdown. → [Read page](https://ratstack.sh/log.md)