RFC-034: Durable recovery authority and outcomes

[aaltshuler]

Summary

Defines the one engine-owned protocol for classifying and resolving durable recovery state.

Key decisions:

• explicit ReadOnlyProbe, ReadWriteNoRecovery, RollForwardOnly, ExclusiveRecovery, and VerifyFinal authority modes;
• one typed RecoveryDisposition vocabulary: Clean, RollForwardRequired, NeedsCompensation, or Blocked;
• adapter-specific bounded recovery units with truthful per-authority durable outcomes;
• no recovery inside a cancelable runtime factory and no destructive public refresh;
• managed recovery is roll-forward-only; Restore, deletion, reversal, and other compensation remain offline in V1 after every serving process stops;
• one non-cloneable finalized guard retains recovery authority through runtime installation;
• one externally designated writer in V1, with no claim of distributed fencing.

This is a design document only. It changes no runtime or storage format.

Series

• RFC-035 served operation ownership: RFC-035: Served operation ownership #498
• RFC-036 atomic runtime activation and graph supervision: RFC-036: Atomic runtime activation and graph supervision #499
• Replaces the implementation direction in Make live recovery refresh atomic, cheap, and off the write path #488, which is closed.
• PR Carry a typed classification on storage failures #491 remains independent and unchanged.

Recommended review and merge order: RFC-034, RFC-035, RFC-036.

Validation

• AGENTS and docs index check
• Markdown whitespace checks
• all external references returned HTTP 200
• independent recovery, lifecycle, substrate, adversarial, and final cross-series reviews; final result: no findings

Greptile Summary

This draft RFC defines an engine-owned durable recovery protocol while explicitly leaving runtime activation and supervision to subsequent RFCs.

• Separates read-only inspection, no-recovery writable opening, roll-forward recovery, exclusive compensation, and final verification through capability-gated modes.
• Defines bounded recovery units, truthful per-authority progress reporting, and a final guard that retains recovery authority through runtime handoff.
• Restricts destructive compensation to quiesced offline recovery under the V1 single-writer topology.

Confidence Score: 5/5

The documentation-only PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
docs/rfcs/0034-durable-recovery-authority.md	Adds a draft architecture RFC defining capability-gated durable recovery, bounded recovery units, truthful outcomes, and authority-preserving handoff without changing runtime behavior.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Open durable graph authority] --> B{Recovery mode}
    B -->|ReadOnlyProbe| C[Inspect without effects]
    B -->|ReadWriteNoRecovery| D{Pending recovery unit?}
    D -->|Yes| E[Return exact non-clean disposition]
    D -->|No| F[Verify final authority]
    B -->|RollForwardOnly| G[Stream and classify bounded units]
    G --> H{Proved forward action?}
    H -->|Yes| I[Apply fixed forward action]
    H -->|Compensation required| J[Return NeedsCompensation]
    H -->|Blocked or ambiguous| K[Return Blocked]
    B -->|ExclusiveRecovery| L[Recover with offline permit]
    I --> M[Recapture durable authority]
    L --> M
    M --> N{More units?}
    N -->|Yes| G
    N -->|No| F
    F --> O[Return FinalizedRecoveryGuard]
    O --> P[Install or discard derived runtime]

Loading

_{Reviews (2): Last reviewed commit: "docs(rfc): split durable recovery author..." | Re-trigger Greptile}