Every rollback I have ever trusted, I trusted for exactly one reason: I could run it in under a minute. Deploy, watch, revert, go back to bed. The undo lived next door to the thing it undid, and neither one had time to drift away from the world they both ran in. That was never discipline on my part. That was a very short lever arm doing my thinking for me.
Long-running workflows confiscate the lever. Maxim Fateev has spent fourteen years building systems that at least make the absence visible, starting with Amazon's Simple Workflow Service in 2012, which existed for a reason every ops person will recognize in their spine: Amazon had shredded its monolith into services and then noticed that business state now lived nowhere in particular. Queues have lovely runtime properties. Queues also have zero memory of what a process was FOR. He and Samar Abbas went on to co-create Cadence at Uber, then founded Temporal in 2019. Fateev is CTO now, having done the CEO thing and swung back to the technical seat, which I read as evidence of taste.
The category is durable execution, and the guarantee is stated precisely, which is why people keep hearing it as bigger than it is. Your program resumes, even years later. Whatever that program already reached out and rearranged outside itself was never covered.
Temporal's documentation does not squirm about this. Sagas are the standard way to walk a multi-step process backwards, each step married to an opposite you wrote yourself, and the saga documentation hands you the division of labor without decoration:
"You implement each step as a local transaction with a corresponding compensation transaction."
You. A platform that can faithfully replay your program for a year could plausibly have made a run at deriving the inverse of each step, and it doesn't, and it's right not to, because the inverse was never in the code to begin with. Forward is a function. Backwards is a judgment call about the world, and that judgment lives in some engineer's head or in nobody's at all. The docs go on to say the rest out loud: intermediate states sit there in plain view while you're mid-rollback, some operations have no meaningful compensation whatsoever, and a compensation you never bothered to register leaves that step's effects in place permanently.
Take step 4 and step 7 out of the abstract. Sure, you can reverse a debit. What you cannot reverse is that the money landed somewhere, sat there for a week, was visible to the recipient the whole time, and got spent. The notification that cheerfully told them it had arrived doesn't un-send either. The world read your half-finished saga and made decisions based on it, and the world does not roll back.
Now the part that genuinely got under my skin. Temporal reconstructs a live workflow by re-running your orchestration code against a recorded log of what already happened. Completed steps hand back their stored results instead of firing again, which means the code has to ask for things in the same order it asked the first time. Reorder them and reconstruction fails flat. So you don't edit that code, you bracket it: wrap the new behavior in a named patch, let the old executions keep walking their old branch, and retire the marker only after they've drained.
Scheduling a compensating step is one of those ordered requests.
Which turns the branch that decides to unwind into a versioned artifact with an ongoing maintenance bill attached. A refund path written in March, inside a workflow still open in November, is reachable only if somebody kept its patch alive through every single deploy in between. Nothing looks broken while that quietly stops being true. And the undo has never executed, not once, so the log protects it not at all. It runs fresh, in November, against November: today's credentials, today's vendor API, a record that eleven other systems have edited since spring. Fateev has been blunt about where determinism runs out, noting that external I/O "is not deterministic by definition" (SE Radio, 2023), and blunter still about changing something mid-flight: with a process running for months, you "cannot just make it absolutely seamless" (DevTools.fm, 2025).
In issue #39 I argued that mechanically flawless execution proves the click landed, not that the action should ever have counted. This is the floor underneath that. Agents will spin up long-lived processes casually and by the thousand, and success rate is the cheap number, the one that fits on a slide. The number that eventually bites is the half-life of your undo, and whether the engineer who wrote it is still keeping its patch alive.
-
Idempotency is not in the protocol: The July 28 Model Context Protocol release makes tool calls easier to route and lets a call pause mid-flight to ask for confirmation, but NSA's security guidance notes that idempotency isn't enforced by MCP itself, which leaves "did this side effect already happen?" entirely to whoever wrote the tool.
-
Late handoffs inherit worse problems: A randomized experiment covering 647 workers and 680,676 customer-service chats found that human intervention rescued technical escalations far better than emotional ones, which Dartmouth's write-up frames as a timing problem — by the time a person arrives, the recoverable version of the case may be gone.
-
A reversal that arrives too late: Nineteen Medicare Advantage organizations overturned 95% of appealed skilled-nursing denials, but only 18% of denials were ever appealed, and HHS OIG concluded that the initial review process was the thing worth examining — a formally available undo that most people never reach.
-
Seventeen thousand events, one week late: Reconstructing this month's agent-driven intrusion took Hugging Face an analysis of more than 17,000 recorded events, a useful reminder that a complete log is not the same thing as knowing, in time, that anything needs undoing.