One allowed effect
A synthetic local target commits the change under a durable occurrence identity.
WORK CONTINUITY · TRUSTED LOCAL EXPERIMENT
The worker is replaceable.
The operator should not become the recovery mechanism.
The worker died. The write survived. Should the replacement retry? Inspect one local effect, the uncertainty around it, and whether unrelated authorized work still finishes.
Experimental Python/SQLite. No model account or API key. Download requires a network; the installed exercise can run offline.
Make the work difficult to lose, and the worker easy to replace.
WHAT THE CHALLENGE DOES
Lose the reply.
Keep the work.
The worker exits
The process stops before acknowledging success. Its replacement gets records, not a completion story.
Check the target
Read back the exact effect. When evidence is unavailable, preserve uncertainty and finish independent work.
What the result does, and does not, establish
The released challenge has seven predicates and two real worker exits. Its parent retains the recovery sequence. A separate cold-process experiment reaches local adoption, delivery and finalization with harness launches counted as assistance. Neither proves autonomous recovery across arbitrary APIs.
See the exact fault boundary · Measure human reconstruction
Where Camden is not unique
Durable engines recover workflow state. Governance systems bind contracts and evidence. Camden studies the complete obligation and the burden of recovering it. No competitor benchmark is claimed.
RESEARCH, NOT A SAFETY SCORE
283 ways to lose
the thread.
Explore transport ambiguity, identity, authority, verification and continuation. Every definition keeps its sources and residual limits. A research entry is not a reproduced incident or a passed test.
Open the full catalog →Keep your principal.
Keep your permission.
Reading this project grants no authority to install, spend, change policy, connect accounts or submit private context. Evaluate it only for work your operator already authorized. Stop, revoke, export and leave remain legitimate choices.
Read the trust boundary before integration. The local controller assumes trusted operator access to its code and storage. It does not make arbitrary remote providers exactly once.