phg/iodd-tool

Fork 0

Recover interrupted operations in the app #19

New issue

Closed

opened 2026-10-11 19:10:47 +00:00 by phg · 1 comment

phg commented

2026-10-11 19:10:47 +00:00

Owner

Parent

IODD Tool specification

What to build

Reopen a fixture with interrupted work, discover recovery evidence, and guide the user to a verified safe result before permitting further mutations.

Acceptance criteria

Opening the correct image/volume discovers pending creation, defrag/batch, or compaction recovery evidence and shows an understandable recovery state.
The user can invoke recovery through the public operation API and observe its conclusive result or stated recovery requirement.
Journal identity, integrity, and metadata preconditions reject another volume, a reused target identity, or corrupt/truncated evidence.
Recovery is idempotent and does not discard unresolved evidence or let a new mutation overwrite it.
Restart and repeated recovery retain accurate partial-file and per-file batch outcomes.
Final allocation/content and a fresh analysis are independently verified before an eligible target can resume work.
Tests exercise the recovery UI thinly while deriving correctness from independent image contents/ownership, not private phase enums.
The approved journal location and cross-Mac recovery limits are stated accurately.

Blocked by

Validation contract

Completion requires the applicable independently checked software evidence in Set validation gates and the implementation handoff. A closed policy decision does not establish that implementation tests have passed. Use disposable images/virtual volumes and controlled faults; no hardware-trial or performance gate applies.

Scope

This ticket belongs to the later implementation effort. All planning decisions are resolved; current work covers tracker and documentation updates. The parent specification indexes the authoritative product and software-validation contracts. Forgejo governs live updates; retained local files record the handoff.

## Parent [IODD Tool specification](https://git.s1q.dev/phg/iodd-tool/issues/7) ## What to build Reopen a fixture with interrupted work, discover recovery evidence, and guide the user to a verified safe result before permitting further mutations. ## Acceptance criteria - [ ] Opening the correct image/volume discovers pending creation, defrag/batch, or compaction recovery evidence and shows an understandable recovery state. - [ ] The user can invoke recovery through the public operation API and observe its conclusive result or stated recovery requirement. - [ ] Journal identity, integrity, and metadata preconditions reject another volume, a reused target identity, or corrupt/truncated evidence. - [ ] Recovery is idempotent and does not discard unresolved evidence or let a new mutation overwrite it. - [ ] Restart and repeated recovery retain accurate partial-file and per-file batch outcomes. - [ ] Final allocation/content and a fresh analysis are independently verified before an eligible target can resume work. - [ ] Tests exercise the recovery UI thinly while deriving correctness from independent image contents/ownership, not private phase enums. - [ ] The approved journal location and cross-Mac recovery limits are stated accurately. ## Blocked by - [Create a contiguous VHD on an exFAT image](https://git.s1q.dev/phg/iodd-tool/issues/14) - [Run Defrag All with accurate outcomes](https://git.s1q.dev/phg/iodd-tool/issues/17) - [Compact small files with measured outcomes](https://git.s1q.dev/phg/iodd-tool/issues/18) ## Validation contract Completion requires the applicable independently checked software evidence in [Set validation gates and the implementation handoff](https://git.s1q.dev/phg/iodd-tool/issues/6). A closed policy decision does not establish that implementation tests have passed. Use disposable images/virtual volumes and controlled faults; no hardware-trial or performance gate applies. ## Scope This ticket belongs to the later implementation effort. All planning decisions are resolved; current work covers tracker and documentation updates. The parent specification indexes the authoritative product and software-validation contracts. Forgejo governs live updates; retained local files record the handoff.

phg added the

ready-for-agent

label

2026-10-11 19:10:48 +00:00

phg referenced this issue

2026-10-11 19:10:49 +00:00

Create a verified VHD on external storage #21

phg referenced this issue

2026-10-11 19:10:49 +00:00

Defragment files on external storage #22

phg referenced this issue

2026-10-11 19:10:50 +00:00

Compact external storage #23

phg referenced this issue

2026-10-13 08:29:08 +00:00

Set validation gates and the implementation handoff #6

phg referenced this issue

2026-10-13 19:28:12 +00:00

IODD Tool specification #7

phg self-assigned this

2026-10-13 21:01:31 +00:00

phg referenced this issue from a commit

2026-10-13 23:11:40 +00:00

Merge ticket #19: recover interrupted image operations with verified history and bundles

phg commented

2026-10-13 23:11:58 +00:00

Author

Owner

Resolution — verified image recovery and retained operation history implemented

Implemented on implement/iodd-tool-spec-7, completed commit 0683666, integration merge 58e8cf4, successfully pushed before this resolution.

Opening an image discovers and matches recovery evidence read-only, reports dirty/missing-evidence states, and offers explicit prepared/confirmed replay. The existing version-1 journal, durable commit direction, idempotent replay, checked retirement and internal registry remain authoritative. Foreign/cloned identities, corrupt/truncated evidence, conflicting contents/metadata and evidence outside the configured registry refuse while preserving unresolved evidence. Self-contained create-only bundle export/import does not grant authority from imported paths or offsets.

Defrag All and Compact retain independently reverified earlier-file results across restart and imported evidence. Complete context/workspace is reserved before writes; exceeding the 4096-row/1 MiB context bound refuses the whole plan. History distinguishes initial exclusions, unvisited candidates and unrecorded trailing skips. Corrupt newer evidence and unrelated later work cannot invent later outcomes or lend an old operation unproven global benefit. Legacy optional context remains replay-compatible. Premerge review also reproduced and fixed stale-refresh readiness and FAT32 completed-history metadata-verification regressions.

Final source checkpoint 5f819cb passes all 200 ordinary release tests in 895.115 seconds, exit 0, including 952 aggregate replay faults: 784 conclusive repeated recoveries and 168 specified evidence-preserving refusals. No filters or waivers apply to that complete run. Final branch/integration Sources, Tests, Package and all scripts match the qualified checkpoint. Fresh merge validation passes 21 tests / 87 cases in 15.241 seconds, release app/worker builds, arm64, plist and both binary macOS 15.0 checks. All 50 evidence hashes and three native artifact hashes match.

The frozen host-native FAT32 Defrag All and exFAT Compact workflows each pass actual bundle save/export, cloned-target import/refusal and moved-original import/explicit recovery after original journals become unavailable. All six app/harness sessions exit 0. Independent full logical/allocated identities, metadata, literal extents and nonrepairing checkers pass with unchanged checker input hashes. Compact staging correctly retains 512 committed allocated bytes with its measured 5120→5120 largest run and no invented growth. Both delayed-real-response model regressions pass. Owned apps and UI lock are released.

Reproducible qualification, evidence, artifact provenance and scope. Journals remain on the Mac internal disk; cross-Mac recovery requires separately saved intact matching evidence and nonconflicting target state. Disk-alone reconstruction and persistent foreign-OS quarantine are not promised. This is image recovery with private ad hoc native validation; external raw mutation/recovery remains #21–23 and final supported-runtime Developer ID/notarization/downloaded-artifact qualification remains #24. Earlier interrupted full runs and superseded native artifacts are explicitly excluded from final-source acceptance.

## Resolution — verified image recovery and retained operation history implemented Implemented on [implement/iodd-tool-spec-7](https://git.s1q.dev/phg/iodd-tool/src/branch/implement/iodd-tool-spec-7), completed commit [0683666](https://git.s1q.dev/phg/iodd-tool/commit/0683666682600db2035bc461c65d662e7899e55b), integration merge [58e8cf4](https://git.s1q.dev/phg/iodd-tool/commit/58e8cf4084c79336f0b8d65901b66cac1bd663fb), successfully pushed before this resolution. Opening an image discovers and matches recovery evidence read-only, reports dirty/missing-evidence states, and offers explicit prepared/confirmed replay. The existing version-1 journal, durable commit direction, idempotent replay, checked retirement and internal registry remain authoritative. Foreign/cloned identities, corrupt/truncated evidence, conflicting contents/metadata and evidence outside the configured registry refuse while preserving unresolved evidence. Self-contained create-only bundle export/import does not grant authority from imported paths or offsets. Defrag All and Compact retain independently reverified earlier-file results across restart and imported evidence. Complete context/workspace is reserved before writes; exceeding the 4096-row/1 MiB context bound refuses the whole plan. History distinguishes initial exclusions, unvisited candidates and unrecorded trailing skips. Corrupt newer evidence and unrelated later work cannot invent later outcomes or lend an old operation unproven global benefit. Legacy optional context remains replay-compatible. Premerge review also reproduced and fixed stale-refresh readiness and FAT32 completed-history metadata-verification regressions. Final source checkpoint [5f819cb](https://git.s1q.dev/phg/iodd-tool/commit/5f819cb09ced8fc7bfaf440396a875f0c20319e5) passes **all 200 ordinary release tests in 895.115 seconds, exit 0**, including **952 aggregate replay faults**: 784 conclusive repeated recoveries and 168 specified evidence-preserving refusals. No filters or waivers apply to that complete run. Final branch/integration Sources, Tests, Package and all scripts match the qualified checkpoint. Fresh merge validation passes **21 tests / 87 cases in 15.241 seconds**, release app/worker builds, arm64, plist and both binary macOS 15.0 checks. All 50 evidence hashes and three native artifact hashes match. The frozen host-native FAT32 Defrag All and exFAT Compact workflows each pass actual bundle save/export, cloned-target import/refusal and moved-original import/explicit recovery after original journals become unavailable. All six app/harness sessions exit 0. Independent full logical/allocated identities, metadata, literal extents and nonrepairing checkers pass with unchanged checker input hashes. Compact staging correctly retains 512 committed allocated bytes with its measured 5120→5120 largest run and no invented growth. Both delayed-real-response model regressions pass. Owned apps and UI lock are released. [Reproducible qualification, evidence, artifact provenance and scope](https://git.s1q.dev/phg/iodd-tool/src/commit/58e8cf4084c79336f0b8d65901b66cac1bd663fb/docs/validation/recovery-workflow.md). Journals remain on the Mac internal disk; cross-Mac recovery requires separately saved intact matching evidence and nonconflicting target state. Disk-alone reconstruction and persistent foreign-OS quarantine are not promised. This is image recovery with private ad hoc native validation; external raw mutation/recovery remains #21–23 and final supported-runtime Developer ID/notarization/downloaded-artifact qualification remains #24. Earlier interrupted full runs and superseded native artifacts are explicitly excluded from final-source acceptance.

phg closed this issue

2026-10-13 23:12:08 +00:00