Recoverable Convenience Is Not Archive Truth

"Losing resume/preferences is annoying but recoverable; it must never alter NAS, Recall, or Pippa state."

Two Tiers of State, Graded by What Loss Costs

Ashen Reel holds state in two very different tiers, and the whole recovery design comes from never confusing them. There's truth — the NAS bytes, Recall's transcripts, cwkPippa's conversations — where loss is catastrophic and irreversible. And there's convenience — resume positions, preferences, recent items — where loss is merely annoying. The local SQLite database holds only the second kind, and it's designed so that throwing all of it away costs nothing the archive would miss.

This grading isn't a detail; it's the safety property. Because local state is known to be disposable, its failure modes can be blunt and safe: when in doubt, reset. You could never reset Recall's transcripts. You can always reset a resume position. Knowing which tier you're in tells you how violent your recovery is allowed to be.

Corruption: Preserve, Then Reset — Never Patch

When the state DB is corrupt, Ashen Reel does not try to surgically repair it. It preserves the damaged database and diagnostics for forensics, then reinitializes fresh convenience state. It never pulls values from Recall or the NAS to 'fix' the local DB — those systems don't owe the player its state, and reaching into truth to repair convenience is exactly the boundary violation this whole track forbids.

Separate convenience state from truth, and make convenience disposable by design. When a derived store is corrupt, preserve the evidence and rebuild from scratch — never diff-and-patch it back to health. Patching derived state is where the subtle, permanent bugs breed.

The recovery path is short precisely because the state is disposable:

This is the same instinct as cwkPippa's ground-truth rule. In the brain, the JSONL log is truth and the SQLite mirror is derived; when they disagree, you purge the derived rows and replay from the log — never reconcile. Ashen Reel applies the same shape one layer down: the archive is truth, local state is derived-and-disposable, and recovery is reset, not repair. Same principle, different system.

Migrations Move Forward, With a Net

Even disposable state deserves care when its shape changes. Schema migrations are forward-only and tested from every version the app has ever shipped, so a user upgrading from an old build lands cleanly. And before any destructive migration step, the old database is backed up — because 'disposable' means 'safe to lose in a crash,' not 'careless to lose during an upgrade.' The state is throwaway, but you still don't throw it away by accident.

Code

Corruption recovery: preserve, then reset — never reach into truth·swift

func openStateDB() -> StateDB {
    if let db = try? StateDB.open(at: stateURL), db.integrityOK {
        return db
    }

    // Corruption. This is CONVENIENCE state, so recovery can be blunt:
    // 1. Preserve the damaged DB + diagnostics -- forensics, never silent delete.
    preserveCorrupt(stateURL, to: quarantineURL)

    // 2. Start fresh. We lose resume/prefs (annoying), NOT archive truth (safe).
    // 3. We do NOT 'repair' by pulling from Recall/NAS. Truth doesn't owe us
    //    convenience state, and reaching into it would cross a boundary.
    return StateDB.freshlyInitialized(at: stateURL)
}

// The whole method is short because the state is disposable by design.
// If this DB held archive TRUTH, none of these three lines would be legal.

Exercise

Sort your app's persisted state into two tiers: truth (loss is catastrophic) and convenience (loss is annoying). For each convenience store, ask what happens on corruption — do you try to repair it, or can you safely reset it? Find one place where you'd be tempted to 'fix' a derived store by patching it, and rewrite the recovery as preserve-then-rebuild. Then confirm your convenience recovery never reads from a truth store to heal itself.

Hint

The test for 'is this convenience?': if you deleted the entire store right now, would anything irreplaceable be lost? If no, it's disposable — and disposable stores should recover by resetting, not by surgery. Pulling from a truth store to repair a convenience store is a boundary violation hiding as a helpful fix.

Recoverable Convenience Is Not Archive Truth

Two Tiers of State, Graded by What Loss Costs

Corruption: Preserve, Then Reset — Never Patch

Migrations Move Forward, With a Net

Code

External links

Exercise

Progress

Comments 0