Skip to main content
A retry is not a promise that the previous attempt did nothing. Inspect the node result and its side-effect class before repeating work.

​
Classify the last attempt

Timeout does not by itself tell you which row applies. It only tells you sndbox stopped waiting for the expected completion signal.

​
Local retries

The execution inspector can retry a failed node or run, and browser failures may offer a headed retry. Existing completed-node evidence remains attached to the original attempt. Node reference pages identify whether a built-in node declares an external side effect. A node retry should reuse a compatible snapshot of upstream results. A whole-run retry re-executes earlier selected nodes and can repeat their effects. Choose based on which inputs must be refreshed and which completed actions are safe to repeat.

​
Lost remote execution

When a runner lease expires, the control plane releases the lease, marks the execution lost, records outcome certainty, and inspects the last immutable checkpoint and interrupted node. It may resume only when the interruption is side-effect-free, explicitly safe to retry, or idempotent with the same reusable key. If an external action may have completed, the disposition becomes review required and is not returned to the automatic claim query. An authorized operator can later choose resume, restart, or abandon; the decision is another audited transition.

​
Design for safe retry

  • Use provider idempotency keys for external mutations.
  • Reuse the same logical key across attempts.
  • Prefer Gmail drafts before sends when human review is appropriate.
  • Commit workflow state only after complete success.
  • Keep command and file boundaries explicit so a reviewer can assess the outcome.

​
Example: safe status read

A GET health check with retryCount: 1 can repeat after a transient connection failure because it only reads status. The following Condition still runs once with the final returned response.

​
Example: uncertain email send

If Gmail accepted a message but the response was lost, repeating Send Email can deliver a duplicate. Check Sent mail or use a provider-visible logical identifier. A Manual Approval node improves intent review but does not make the send itself idempotent.

​
Example: staged state

Set Workflow State and Compare With Previous stage their updates. A later failure prevents commit, so a retry sees the prior successful value. This avoids advancing a cursor past work that never fully completed.

​
Loop iteration recovery

Loop Over Items assigns immutable iteration IDs and deterministic batch membership. It checkpoints an iteration before its body starts, then records the completed, failed, or uncertain terminal state with the same batch hash. A retry keeps the iteration identity and increments its attempt; completed evidence is not reopened, and a surviving active checkpoint identifies interrupted work for recovery review. Pure transformation bodies are safe to recompute from immutable input. A body containing communication, commands, browser mutations, file changes, or other side effects remains subject to the same outcome-certainty rules as a top-level node. Concurrent bodies can finish out of order, cancellation propagates to active iterations, and a runner loss during an uncertain mutation requires review rather than an automatic exactly-once claim. Never describe uncertain recovery as “exactly once.”