Failed recovery has to name what is gone
Aliases: recovery failure · loss scope · last saved
What it is
When the recoverable layer is corrupt, a draft is half-written, or the OS has cleared local storage, the content will not come back. Naming the loss means saying which passage is gone and from when there is no record, not a sentence that only says “recovery failed.” People need that map to decide what to retype and whom to ask. This entry starts after coming back is already impossible. It is not about whether a successful restore needs confirmation.
Why it happens
When loss is invisible, people fill from all of memory: they retype what already sits on the server, or they miss the few sentences that actually vanished. Scope turns the invisible into a boundary: time of last successful save, approximate words or fields that never reached persistence, which attachments never went up. The boundary gives redo a starting point and stops people guessing on a blank page whether it is “actually still there.” When scope is unknown, say unknown, and point at what can still be checked (the submitted version, a copy in mail). Do not write unknown as “nothing was lost” or “everything is gone.”
Where it stops holding
When security forbids describing the content itself, structure can still be described: which fields, roughly when, whether attachments were included. When some fields restore and some fail, say so separately; do not stay silent on the failed piece because one piece came back. On repeated failure, do not reuse the same empty sentence; the second time should escalate to “still cannot restore; last known scope was….”
Applying it
- On a failed recovery surface, write the time of the last successful point, the objects or fields that could not be restored, and what to do (which parts to refill, where to look for what was already submitted).
- If the amount that never persisted can be estimated, write the estimate (“roughly the last two minutes of input”) and mark it as an estimate.
- Offer an entry into the last known version so people do not start from zero.
- Verify by deliberately destroying the local draft, opening the document, and asking “what did you lose.” If they can only repeat “it failed” and cannot point at a time or a field, scope was not named.