Files

zhukang 1cb9a42c7b fix: enforce recovery retention and fail-closed restore semantics

- prune expired recovery items on load/save and reject expired restores at worker boundary
- add restoreExpired and restoreConflict protocol/application error mapping
- disable expired restore actions in History and reload persisted state after restore failures
- add recovery expiry/conflict coverage plus sync protocol, architecture, state-machine, and recovery contract docs
- wire AtlasAppTests into the shared Xcode scheme and add app-layer regression coverage for expired restore reload behavior

Refs: ATL-221 ATL-222 ATL-223 ATL-224 ATL-225, vibe-kanban SID-9

2026-03-13 14:38:50 +08:00

1.2 KiB

Raw Blame History

Error Codes

Principles

Use stable machine-readable codes.
Map each code to a user-facing title, body, and next step.
Separate recoverable conditions from fatal conditions.

Registry

permission_denied
permission_limited
admin_required
path_protected
path_not_found
action_not_allowed
helper_unavailable
execution_unavailable
worker_crashed
protocol_mismatch
partial_failure
task_cancelled
restore_expired
restore_conflict
idempotency_conflict

Mapping Rules

Use inline presentation for row-level issues.
Use banners for limited access and incomplete results.
Use sheets for permission and destructive confirmation flows.
Use result pages for partial success, cancellation, and recovery outcomes.

Recovery Semantics

restore_expired — the recovery retention window has closed; the item must no longer be restorable and should disappear from active recovery state on the next refresh.
restore_conflict — the original destination already exists; the restore request must fail closed without moving the trashed source.

Format

User-visible format recommendation: ATLAS-<DOMAIN>-<NUMBER>
Example: ATLAS-EXEC-004

1.2 KiB Raw Blame History

Error Codes

Principles

Registry

Mapping Rules

Recovery Semantics

Format

1.2 KiB

Raw Blame History