Designing Systems That Recover Instead of Restart