Documentation / Advanced
Recover with ownership fencing
A cell is an execution boundary. More cells add placement and recovery options; they do not remove the need for authoritative ownership.
Inspect a topology before changing it
Execution Regions and authority/witness Regions serve different roles. Recovery claims a higher epoch, fences stale workers and reconstructs state from the authoritative checkpoint. An isolated source or missing quorum must not authorize competing side effects.
rippflow cells list --json
rippflow cells describe CELL_ID --json
rippflow cells health CELL_ID --json
rippflow cells capacity CELL_ID --jsonDrain before deletion
Scale-up, graceful drain and evacuation are explicit lifecycle operations. A retiring cell must not be deleted while workflows, waits, approvals or callbacks remain. Review capacity, quorum and active work first; the read commands above do not change topology.
Rerun narrowly
Core supports surgical shard rerun messages with a quota and batch identity. Preserve original lineage and ownership. There is no generic safe “rerun everything” CLI recipe here: operators must use the installation’s supported rerun surface.
The failure example shows local rework; it is not a cross-region disaster-recovery certification.
Verified sources
Checked 2026-11-05.
- multi_cell.rs 04cb082 · main
- cell_recovery.rs 04cb082 · main
- cell_lifecycle.rs 04cb082 · main
- user_rerun.rs 04cb082 · main