Module recover 

Recovery: what a restart is allowed to CLAIM about the projections.

The projections are written by [apply_event] inside the very transaction that appends the events, so a committed log and its projections cannot disagree by construction. Recovery exists for the cases where something outside that transaction went wrong — a restore that brought back a log without its projections, storage corruption, a hand-edited row — and its job is to say which of those it can rule out, honestly, rather than to assert more than it checked.

A checkpoint cannot be restored, and that is the schema’s decision

The contract schema forbids it, twice, with ENABLE ALWAYS triggers that no privilege and no session_replication_role can step around:

• <table>_born_initial — a row must be born in its INITIAL state at version 1. A checkpoint’s rows are at whatever state they reached, so loading them raises.
• <table>_no_truncate — the statement-level partner of the delete guard, there precisely to stop a TRUNCATE-then-reinsert walk-around.

So a checkpoint is a VERIFICATION artifact, not a recovery shortcut: it proves what the projections hashed to at one sequence, and the only way to rebuild them is to replay the log from the beginning through the same apply_event that wrote them. This is a narrower job than the plan first assumed, and the narrowing is load-bearing — the guards are what make a projection row unforgeable by anything but the log, and buying a faster restart with a hole in them would be a bad trade.

What each verdict is worth

Verdict::Verified is the strong one and needs a checkpoint AT the watermark, which a clean shutdown produces by taking one last snapshot. After a crash the newest checkpoint is behind the watermark and there is no way to reconstruct the expected hash without replaying, so recovery returns Verdict::Unverified and says so instead of implying a check it did not run. That is not a degraded kernel — the tail is still transactionally coupled to its events — it is an honest statement about what was proved.

Structs

RebuildReport

The result of an operator-directed rebuild into a scratch database.

RecoveryReport

What a restart found, and what it is entitled to claim.

Enums

Verdict

What recovery was able to prove.