Backup, Restore, and Rollback
Wayland Core keeps state you would not want to lose: sessions, memory, credentials metadata, schedules, and the durable records behind Goals. From v0.12.26 it can back all of that up, verify the archive, restore it, and roll back an operation that went wrong.
The pieces
Section titled “The pieces”- Backup archive. A full capture of engine state.
- Verify. Check an archive before you rely on it, rather than at the moment you need it.
- Restore. Put a verified archive back.
- Write-ahead journal. The undo store that makes rollback possible.
Live SQLite is captured consistently
Section titled “Live SQLite is captured consistently”Core’s state lives in SQLite, and a running engine is writing to it. Copying a live SQLite file naively gives you a snapshot that may be torn across a write.
Live SQLite is captured consistently into the journal undo store instead. The archive holds a coherent point in time, not a smear of one.
Rollback-able migrations
Section titled “Rollback-able migrations”A scoped operation journal records three things for an operation:
- Its declared scope.
- Its absent-set, meaning what was not there before it ran.
- An exact reverse-apply.
The absent-set is the part that is easy to skip and expensive to omit. Undoing an operation means removing what it created as well as restoring what it changed, and you can only do that if you recorded what was missing beforehand.
The result is that migrate is rollback-able. A schema migration is no longer a decision you cannot walk back.
What is refused, and when
Section titled “What is refused, and when”Refusals happen before the first write, not halfway through one. A restore that cannot complete should not leave you worse off than a restore that never started.
| Archive | Behaviour |
|---|---|
| Newer schema than this Core | Refused |
| Older schema | Covered |
| Truncated | Covered |
| Unrestorable paths | Refused before the first write |
A dead owner’s restore
Section titled “A dead owner’s restore”If the process that owned a restore dies, that restore is recovered before occupancy and before a new journal is opened. A half-finished restore is resolved first, so a fresh attempt does not layer itself on top of an unresolved one.
Related
Section titled “Related”- Sessions for what session state contains.
- Memory System for memory state and your controls over it.
- Bring your history with you for importing from another agent CLI.