# Service failure test plan
Use synthetic data, separate credentials and harmless actions.

Cases:
1. Duplicate and out-of-order webhook delivery.
2. Worker stops after durable intake.
3. Worker stops after an external effect but before local success is recorded.
4. Customer correction or human takeover during a pending reply.
5. Source deletion, permission change and failed paginated sync.
6. Credential revocation and connector expiry.
7. Model rate limit, outage and unapproved fallback attempt.
8. Tool timeout with unknown outcome.
9. Attachment redirect to an unapproved destination.
10. Synthetic secret under an unexpected response field.

For each: initial state, injected fault, expected effects, actual downstream state, recovery, owner and evidence.