5 · Recovery

Three tiers, least to most drastic. All were exercised end-to-end during v1.0.0 validation, including a full host-side restore after whole-library DR.

5.1 A cartridge’s data (evicted or damaged locally)

If the cart still exists locally (an evicted stub), its panel offers Import <generation> — an in-place re-import, byte-identical (§4.4).

5.2 A single cartridge into another library (Phase A)

Offsite → Catalog browses the bucket by System → Library serial → Cart label → Generation. Pick a generation → Import into [library ▾]. The cart is extracted, adopted through the target library’s MAP the same way a mint is, slot-assigned, and registered — label preserved. If that label already exists in the target library the import refuses rather than renaming; in real DR the target is empty, so no collision.

5.3 Whole library, one click (Phase B — disaster recovery)

Scenario: the appliance (or the library) is gone; the bucket survives.

1. On the replacement appliance: install, first-run, system storage, and a free pool for the recovered library (§1–§2). Add the same S3 remote and let the catalog load (Refresh bucket catalog re-reads the bucket from scratch if needed).
2. The catalog groups carts under their original library serial and shows Recover library on any library not present locally. Click it, pick the pool, confirm.
3. The appliance reads the library’s topology.json from the bucket, recreates the library — same model, geometry, and serial — runs the activation window, then queues an import of every cart’s newest generation (Jobs shows them with trigger recover). Result: the library and all its exported carts are back, labels intact.

Validated result: the recovered cart’s on-disk data was checksum-identical to the original, and the IBM i restored the saves on it with matching object counts.

Host-side afterwards:

• The library serial is preserved, so the host’s existing MLB device description re-attaches on vary off/on.
• The drives are new identities (recovery deliberately never reuses device serials), so expect new tape-unit resources under the library — re-point/allocate the drive resources, then WRKMLBSTS as usual.
• Only exported carts come back. Scratch media that never had a bucket copy is gone — mint fresh scratch and initialize it (§2.4, §3.3).

5.4 If a recovery is interrupted

The per-cart imports are ordinary retryable jobs: if the recover window fails or the box restarts mid-import, fix the condition (the runbook’s boot/§1 and Apply guidance), then Jobs → Retry the recover-triggered imports. Interrupted transfers resume from the chunk ledger.

5.5 What to practice

Run the DR flow before you need it. The whole Phase B loop — export a cart, delete a test library, recover it, restore on the host — takes under half an hour on a lab box and touches every moving part: bucket layout, catalog, topology, activation, import, and the host re-attach.