Browser: two kinds of backup
.vhkey- Encrypted application key backup. It does not restore room author state or grant owner policy.
.vhauthor- Numbered encrypted author-state parts for a specific room, including the final part. The complete verified set carries sequence history, pending draft and receipts.
Keep signing and delivery idle during export. Restore the latest complete backup and stop the previous authoring device. Import targets an absent author scope; it does not merge or reset existing state. A download request is not evidence that a backup was saved elsewhere.
The synthetic Chromium journey restored a complete three-part author backup into a fresh origin, including staged-import restart, an exact pending draft and both peer receipt chains. Key-only, wrong-room, final-first and partial imports refused signing. Other browsers, separate devices and private-group recovery require their own qualification.
Native: preserve related state together
- Identity custody directory and the complete per-room author outbox.
- The separate peer-session directory, including advertisement and clock floors.
- The per-author verified replay profile and its protected local key. It is a local cache, not a portable network trust root.
- For operators: publisher sequence/mode state and activity stores.
- For validators: consensus WAL and full durable journal; the journal does not replace undecided locks and votes.
A lost or corrupt replay cache can be rebuilt into a separate unused path. Preserve the old evidence, create the fresh profile at genesis, then run activity catch-up with the original key/outbox before any bare replay. The original author sequence and pending draft remain authoritative; never recreate the outbox to repair a cache. Once anchored, bare replay refuses. Keep passing that profile to author policy operations to retain incremental progress; the separate from-genesis mode remains bounded.
After an interrupted operation
Close the uncertain owner and reopen through the supported API. Exact retained intents are reconciled before fresh work. Resume signs only a retained draft; send retries only immutable signed bytes. Never remove a pending draft to free its author sequence.
Capacity limits refuse new work while preserving accepted evidence. A corrupt authoritative intent, missing counter or changed immutable scope is a reason to inspect and recover compatible state, not to recreate it under the same identity.
When the browser cannot write
Rechecking an unchanged identity can use a read-only transaction. Writable operations require strict IndexedDB durability and reject unsupported or downgraded transactions before application writes. Existing readable state should remain available for recovery; a successful unlock is not a claim that anything was newly saved.
Private-room recovery is different—and unfinished
The planned encrypted group protocol needs atomic send and receive transitions, fresh-device rejoin and explicit history-key policy. Copying an old ratchet state onto two devices is unsafe. Public author backups must not be presented as implemented MLS recovery.
Browser recovery contract ↗ · Native/browser storage invariants ↗