Backward recovery mitigates failure by moving a process from an illegal intermediate state back to a state equivalent to its initial legal state. It treats incomplete execution as undesirable and aims to make the failed process observably equivalent to no application. section 3.3.1 section 3.3.5
The usual application-level mechanism is compensation: undo completed steps instead of repairing the failure and pushing forward. This often avoids fixing the underlying cause, but compensation can fail and require human intervention. section 3.3.5 section 3.3.6
Checkout payment
A checkout may charge a customer before a later step fails. Backward recovery compensates for the charge, aiming for the legal outcome in which the checkout never occurred. A successful checkout must charge exactly once; a failed checkout must not leave a charge. If the refund fails, operators may need to issue a refund manually. section 3.3.1 section 3.3.6
Figure 3.15 Failure mitigation
Use the failure-mitigation diagram to contrast moving backward to the initial legal state with moving forward to the final legal state. section 3.3.5
