Preserve First: Recovery Design for Local Creative Data
The most dangerous button in a creative tool is not "delete." It is the recovery dialog that appears when something is already wrong: "We couldn't load your project — start fresh?" One click, and the file that failed to parse at 23:40 is gone at 23:41, together with the chapter it contained. The tool was trying to help. Local-first software cannot afford that. There is no server copy, no support…
Local-first software can't afford to lose users' projects in the event of an error. When a creative tool like WorldScript Studio encounters a problem while trying to load a project, it presents users with a recovery dialog. This dialog is crucial because there's no server backup, support ticket, or account trash bin to restore the project from. The promise of local-first software is preservation, and destruction must be granted narrow and earned authority.
In WorldScript Studio, this rule is implemented through several key design principles. First, the tool refuses to save any corrupted or unsupported project files. It classifies files as either malformed, future, supported older, unsupported older, or generation contradictions. If a file falls into any category other than a clean current state, the app fails closed with a typed refusal. This refusal is a loud, user-visible message explaining why the save failed, allowing users to continue working without data loss.
Second, destruction only occurs with earned authority. When the app fails to start up, it offers limited recovery options. Quarantine is only available for corrupt projects on the filesystem backend, reset is only an option for storage-level failures on IndexedDB, and safe open is only possible for unsupported versions or migration gaps. The design ensures that destructive failures never escalate to quarantine or reset, maintaining a narrow set of recoverable failure kinds.
Third, when quarantine is necessary, it simply moves the project directory to a separate quarantined-projects area, making it recoverable, inspectable, and reversible. This process is protected by a project lock, a random per-creation token, and a window-specific token to prevent data from being resurrected after deletion. These mechanisms ensure that users' data is truly preserved and that destruction requires legitimate authorization.
Finally, there's a user-owned escape hatch that provides a full-library backup outside of the app's stores. This backup is a ZIP file containing an encrypted vault.bin, which is protected by a user-defined passphrase. The encryption and passphrase ensure that the backup remains secure, even if the app, account, or vendor disappear. This final layer of protection gives users full control over their data, ensuring that preservation also means respecting legitimate destruction.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
