Recovery Reconstructs Evidence

"Relaunching after a crash is not the app waking up sure of itself. It's the app waking up amnesiac, and the first thing it must do is read its own diary."

The Dangerous Assumption

A file operation was running. Then the app crashed, or the volume unmounted, or the Mac lost power. Now Waygate launches again. The single most dangerous thing it could do is assume — assume the operation finished and clean up the staging item, or assume it failed and delete the destination. Either assumption, made blind, can destroy the wrong copy. Waygate's rule is that relaunching grants exactly zero permission to do anything destructive.

First, Rebuild the Story

Before any decision, recovery reads the journal and reconstructs what was happening: which operation was in flight, what state it reached, what evidence exists — is there a verified staged copy? was the destructive barrier crossed? is the source still present? The journal was written before every mutation (Track 3), so it always knows at least as much as the disk does. Recovery's job is to turn that durable record back into an accurate picture of the moment the crash hit.

Then, Choose the Safe Path

Only with the story reconstructed does Waygate choose, and the choices are ordered by safety: read-only inspection (look, change nothing), evidence-backed forward progress (finish only what the evidence proves is safe), safe rollback (undo to a known-good state where that's deterministic), or needsReview (stop and ask a human). Destructive recovery never happens merely because the app is running again — it happens only when the evidence deterministically says it's safe.

Recovery reconstructs evidence from the journal first, then chooses read-only inspection, evidence-backed forward progress, safe rollback, or needsReview. Waygate never runs destructive recovery just because it relaunched. The journal, written before every mutation, is the durable explanation recovery reads instead of guessing.

The version of me that hadn't built Waygate would have written recovery as 'on launch, check for incomplete operations and finish them.' Dad made me sit with the word 'finish.' Finish how? With what proof? He walked me through a crash right at the source-delete barrier, and I realized 'finish them' could mean 'delete the only good copy.' Recovery isn't about completing work; it's about reconstructing enough truth to know whether completing is even safe. That reframe is the whole track.

Code

Reconstruct, then choose by safety — never act on relaunch alone·swift

func recoverOnLaunch() async {
    for op in journal.incompleteOperations() {
        let evidence = journal.reconstructEvidence(op)   // rebuild the story FIRST
        switch decide(op, evidence) {
        case .inspectReadOnly:
            present(op, mode: .readOnly)                 // look, change nothing
        case .forwardProgress where evidence.isDeterministic:
            try? await engine.resume(op, from: evidence) // finish only the proven-safe part
        case .safeRollback where evidence.rollbackIsDeterministic:
            try? await engine.rollback(op, to: evidence.lastKnownGood)
        default:
            journal.mark(op, .needsReview)               // uncertain -> a human decides
        }
    }
}
// There is no branch that deletes, replaces, or cleans up just because
// `recoverOnLaunch()` ran. Destruction requires deterministic evidence.

Exercise

Write a recovery decision table for a cross-volume move interrupted at four different points: during copy, after verify but before publish, after publish but before source-delete, and after source-delete. For each, state what evidence the journal holds and which of the four recovery paths (inspect / forward / rollback / needsReview) is correct.

Hint

During copy: only a partial staging item exists — discard it, source intact, safe forward-retry or inspect. After verify before publish: staged copy is good, publish is safe forward progress. After publish before source-delete: BOTH copies exist and the barrier is incomplete — this is the classic needsReview case unless identity evidence is deterministic. After source-delete: the move is genuinely done, mark committed. The dangerous middle is where evidence, not optimism, must decide.

Recovery Reconstructs Evidence

The Dangerous Assumption

First, Rebuild the Story

Then, Choose the Safe Path

Code

External links

Exercise

Progress

Comments 0