We present Bristlecone, a programming language for robust software systems. Bristlecone applications have two components: a high-level organization specification that describes how the application's conceptual operations interact and a low-level operational specification that describes the sequence of instructions that comprise an individual conceptual operation. Bristlecone uses the high-level organization specification to recover the software system from an error to a consistent state and to reason how to safely continue the software system's execution after the error. We have implemented a compiler and runtime for Bristlecone. We have evaluated this implementation on three benchmark applications: a Web crawler, a Web server, and a multiroom chat server. We developed both a Bristlecone version and a Java version of each benchmark application. We used injected failures to evaluate the robustness of each version of the application. We found that the Bristlecone versions of the benchmark applications more successfully survived the injected failures. The Bristlecone compiler contains a static analysis that operates on the organization specification to generate a set of diagrams that graphically present the task interactions in the application. We have used the analysis to help understand the high-level structure of three Bristlecone applications: a game server, a Web server, and a chat server.