Recovery
A Machine is a stick and a chassis. The stick carries the identity (claim, users, sign-ins, the sealed vault) and /data. Everything here puts one or both back.
Reflash in place
The hourly update does this while update automatically is on; by hand it is System → Live disk → Flash a new live disk, or pipeos flash apply. The image is downloaded and checked, the merge with the box's identity is proved before a byte is written, the boot partition is rewritten in place, and the merged identity is installed as both canonical and known-good. /data is untouched. From the dashboard it never reboots on its own; saves are fenced until you do. Back up first (Files → Backup).
Replace a stick
$ pipeos flash check $ pipeos flash fetch $ pipeos flash apply --to /dev/sdX # type the device path to confirm $ pipeos restore-work /data --onto /dev/sdX2 # /data onto the new stick, optional now $ pipeos save $ poweroff
Remove the old stick, boot from the new one. If you skipped restore-work, plug the old stick in afterwards and run pipeos restore-work /dev/<old>2. Keep the old stick until the new one has booted and saved once. The new stick is this Machine (the live disk).
Bringing back /data
pipeos restore-work SRC [--force] [--onto DEV] takes a backup drive's pipeos-backup root, its work/ directory, any directory holding a /data tree, or a device (an old stick's second partition, mounted read-only). The destination is the mounted /data, or with --onto an unmounted ext4 partition. It is additive and never deletes, so a newer repo is never erased. Runtime state, this boot's logs and caches are never restored. A /data with anything in it needs --force; the refusal names the first thing it found.
Bringing back the identity
A bundle comes from Files → Backup on an external drive (identity/pipeos.apkovl.tar.gz), from the copies a flash writes to /data/.pipeos/flash/ before touching the media, or from the weekly copies under /data/backup. Boot the generic image in the chassis, then System → Live disk → Restore identity or
$ pipeos flash restore-identity /data/.pipeos/flash/identity-<ts>.apkovl.tar.gz
The bundle is checked and staged for the next boot; reboot to apply. A passphrase-sealed bundle (.enc) is accepted. In a different chassis, type the recovery phrase under Secrets once.
Known-good
Every healthy boot promotes the saved state to known-good. If a save went wrong, pipeos rollback known-good stages the last healthy state for the next boot; pipeos snapshot ls lists older generations. If the box does not come up far enough for a shell, the stick mounts on any laptop: copy pipeos.known-good.tar.gz over pipeos.apkovl.tar.gz on the first partition and boot.
Power loss
| at any ordinary time | nothing to do. The saved state exists at every instant except inside a single rename, /data is journalled, and the RAM hot set loses at most an hour of logs. The boot report says power loss / hard reset |
| during a save | the box boots the state before the save. Save again |
| during a flash in place | the boot partition is unbootable; nothing else is lost, because the identity copies went to /data and any backup drive before the write. Generic image from another computer, boot, restore the identity as above |
during apply --to | the running Machine is untouched. Retry onto the spare |
With After Power Loss set to Power On the box comes back by itself (hardware notes). pipeos verify must pass before and after anything that touches the media, then a reboot and a green boot report.