Stop and Restore Everything

"Emergency release stops accepting new work and restores every owned change. It also unregisters hotkeys." — Tinker architecture, hide invariant 7

The Command That Is Always There

Every Tinker has one command no configuration can remove: Stop and restore everything, command ID release. It is in the menu, it can take a shortcut and a tinker://command/release link like any other command, Pippa can call it through the door, and completion re-adds it if a settings file ever lacks it. It is the answer to "something is wrong and I don't know what" — the key Dad can press without first understanding the problem.

What It Does, in Order

The model bumps its status token so no late summary from an earlier command can overwrite the outcome, and stops the hotkey registrar so no chord can start new work. Then the engine's releaseAll sets stopped, waits for any running action to notice and roll itself back, takes the execution slot, and restores every active owner in turn through the same restore path as everything else. Errors are collected across owners rather than stopping at the first. The status line ends with "Stopped. Tinker's changes have been restored." when it all worked; when it did not, the collected reasons appear as the error line in Settings and the menu, and the status line keeps its previous text.

What It Deliberately Does Not Do

It does not touch uncertain records. A prepared receipt might describe an app someone else hid; releasing it could show that app. So even this most forceful command reports uncertain records and leaves them for Recovery. It does not quit Tinker: a stopped Tinker is still there, its menu and Settings working, its door answering status, its journal readable. And it does not resume. After release, Tinker stays stopped until a person decides otherwise.

Resume Is Dad's

Resume Tinker appears in the menu and in Settings only while Tinker is stopped. It refuses while an action is still finishing, while a persistence fault is unresolved, and while any uncertain record remains. When it succeeds it clears stopped, registers hotkeys again, records the decision in Activity and sets the status to Ready. Nothing calls it automatically — not a timer, not a successful restore, not Pippa. A stop that undid itself would be a pause, and a pause is not what someone reaching for an emergency key is asking for.

Code

The app model's release branch·swift

if case .releaseAll = operation {
  messageToken &+= 1              // no earlier summary may overwrite this outcome
  hotkeys.stop()                  // no chord can start new work
  defer { revision += 1 }
  let action = "Stop and restore everything"
  do { try await engine.releaseAll() }
  catch { record(trigger, action, failure: error.localizedDescription); throw error }
  let summary = "Stopped. Tinker's changes have been restored."
  message = summary
  record(trigger, action)
  return Task { summary }
}

Resume: only by a person, only when it is safe·swift

func resume(trigger: Trigger) {
  guard let engine else { return }
  guard !busy else { error = "Wait for the pending action to finish before resuming."; return }
  do {
    try engine.resume()           // refuses while uncertain records or a fault remain
    revision += 1
    registerHotkeys()
    error = nil; message = "Ready"
    record(trigger, "Resume")
  } catch { self.error = error.localizedDescription }
}

Exercise

Two presets are active and one uncertain record (owned by a third preset) exists from an earlier crash. Dad presses Stop and restore everything, then Resume. Write what each press does, what the status line and Activity show, and what Dad must do before Resume can succeed.

Hint

Release restores both active presets' confirmed changes, reports the uncertain record and leaves it; the third preset stays active because the record still names it; the status line never says 'Stopped …' and the error line carries the collected reasons. Resume refuses: 'Resolve uncertain changes before resuming.' Dad inspects that app, Forgets the record in Recovery (two clicks), and Resume then succeeds and re-registers his shortcuts.