Restored content must be confirmed, not silently overlaid
Aliases: restore confirmation · silent overwrite · draft conflict
What it is
After an interruption there are often two worlds: the one just rescued locally, and the one already updated on the server or another device. Recovery needs confirmation means showing the difference and letting someone keep one side or merge, rather than quietly covering one with the other. Silent overwrite is among the costliest losses in collaboration and multi-device use, because it looks like a successful open. This entry is not about whether content is persisted, and not about how to speak when it is entirely gone.
Why it happens
The first act after restart is to keep typing. If restore writes back silently before they start, it may be right; if they have already typed into a blank, or the other end has already submitted an update, silent write-back kills one side with no trace. Confirmation turns “there is recoverable content” into a visible choice: timestamps, which end, a diff summary. The choice happens before the main document is written. Auto-picking “newer” fails under clock drift and partial saves; auto-picking “longer” drops a shorter but correct submit.
Where it stops holding
When there is only one copy and the current document is genuinely empty, restoring without interrupting is fine, but still follow with “your last draft was restored” and an undo. Encrypted documents that cannot show a plaintext diff before confirmation should at least show time and source so someone can decide whether to load. When autosave is very frequent and both sides match word for word, confirmation has no object; do not pop a ritual dialog.
Applying it
- When recoverable content disagrees with what is currently open, show the difference before writing; do not overwrite the in-progress buffer by default.
- In the diff, name both ends’ times and sources (this device / server / another device), and offer keep current, replace with recovered, or open a comparison.
- If the person has already started typing on a blank page, park the recovered draft as pending confirmation rather than inserting at the caret.
- Verify with two deliberately different drafts, then open after a simulated crash. If one draft vanishes with no choice step, that is silent overwrite.