Write the intent before the effect

A run that changes the world should record what it is about to do before it does it. If the process stops midway, that record is the only thing that tells recovery whether the action half happened or never started, which decides whether to finish, undo or escalate.

Flush first

Append the intent and flush it to disk before the effect runs. An intent still in memory is lost in exactly the crash you are guarding against.

Give every intent an outcome slot

Each intent carries a unique id and a place for its result. After the effect, mark the outcome. Recovery looks for intents with no outcome and checks the real world before acting on them.

def begin(log, action):
    rec = {"id": new_id(), "action": action, "outcome": None}
    log.append_flush(rec)
    return rec

Make replay safe

A recovered intent may be run again, so the effect must be keyed on the intent id and skipped when it is already applied.