# Recovery needs model tests

Principle `recovery-needs-model-tests`. Test sequences of failures and recoveries against explicit invariants.

Also searched as: model-based testing, precondition, postcondition, shrinking, fault injection.

A stateful property compares generated commands with real behavior. Deterministic initial state makes failures reproducible and shrinkable. Check the model by injecting a defect.

> Both function calls must be deterministic.

Source: [Q17](/bibliography#q17); [B11](/bibliography#b11-property-based-testing), [B4](/bibliography#b4-release-it), [B15](/bibliography#b15-software-engineering-at-google).

## Failure it prevents

A vacuous or happy-path suite misses corruption across retries, cancellation, and restart.

## Our Effect 4.0.5 reading

Arbitrary.checkEffect and @effect/vitest run properties. TestClock and Deferred control Effect time and coordination. Author the command model; test persistent backends separately.

Source: `packages/effect/src/Arbitrary.ts`, `packages/effect/src/testing/TestClock.ts`, `packages/effect/src/Deferred.ts`.

## How to check

Plant a known transition bug. Require the property to fail and yield a replayable, valid counterexample. This is our proposed verification, not a quoted procedure.

Continue with [Checkpoints follow the promised commit](/principles/checkpoints-follow-commits), [Circuit breakers have state](/principles/circuit-breakers-have-state).

Connect this to [the existing rat-stack guidance](https://ratstack.sh/lore/property-based-testing).

Use [the durability skill](/skills/durability) for the full review. Return to [the durability index](/principles/durability).

## Skills
- [Durability starts with a recovery record](/principles/durability)

## Sources
- Nygard, Michael T. *Release It!: Design and Deploy Production-Ready Software*. Pragmatic Bookshelf, 2007. [Link](https://archive.org/details/releaseitdesignd0000nyga). ([b4-release-it](/bibliography#b4-release-it))
- Hebert, Fred. *Property-Based Testing with PropEr, Erlang, and Elixir*. Pragmatic Bookshelf, 2019. [Link](https://pragprog.com/titles/fhproper/property-based-testing-with-proper-erlang-and-elixir/). ([b11-property-based-testing](/bibliography#b11-property-based-testing))
- Winters, Titus; Manshreck, Tom; Wright, Hyrum, editors. *Software Engineering at Google: Lessons Learned from Programming Over Time*. O’Reilly, 2020. [Link](https://abseil.io/resources/swe-book). ([b15-software-engineering-at-google](/bibliography#b15-software-engineering-at-google))

## References
- [Effect contributors. Effect 4.0.5. Arbitrary.ts](https://github.com/Effect-TS/effect/blob/7f524e25cfb49a71ac39b0f44278d08d40dda5de/packages/effect/src/Arbitrary.ts). Pinned source for our Effect mapping, not a claim from the book.
- [Effect contributors. Effect 4.0.5. testing/TestClock.ts](https://github.com/Effect-TS/effect/blob/7f524e25cfb49a71ac39b0f44278d08d40dda5de/packages/effect/src/testing/TestClock.ts). Pinned source for our Effect mapping, not a claim from the book.
- [Effect contributors. Effect 4.0.5. Deferred.ts](https://github.com/Effect-TS/effect/blob/7f524e25cfb49a71ac39b0f44278d08d40dda5de/packages/effect/src/Deferred.ts). Pinned source for our Effect mapping, not a claim from the book.