Dev store loss: every pre-Aug 14 project gone

What was lost. Every project written in the Debug build before 2026-08-14, including the ADHD couple poem (last critiqued 2026-06-14), the cockroach love poem (May 21) and the Atticus copy of the General Wortham letter. The letter survives in NoteSparrow. The poem was reconstructed in part from the critique JSON files, which live outside the store and survived.

What happened. On 2026-08-14, schema changes for Voice Lab made the existing store impossible to migrate. The app crashed on launch, and at 13:14:19 a fresh, empty store replaced the old one, two minutes before commit 89328f2. SwiftData does not delete a store on a failed migration, so something removed the old files first.

ProvenThe current store is a different database from the one that held the writing. Its Z_METADATA UUID is 3BF2BDC6…. The May 18 backups carry 462AA191…. The file's birth time is 2026-08-14 13:14:19.

ProvenNo Project was ever inserted into the current store. Z_PRIMARYKEY.Z_MAX for Project is 0, and the only rows it has ever held are one VoiceProfile and 82 VoiceEvidence rows.

ProvenCommit 89328f2 (Aug 14 13:16) added var title: String and var workTypeRaw: String to VoiceSample without default values. VoiceSample was introduced the day before in 3ab42b5. A standalone reproduction in this session showed that adding a required attribute with no default to an entity that already has rows makes ModelContainer throw loadIssueModelContainer ("missing attribute values on mandatory destination attribute"). AtticusApp.init turns that error into fatalError, which means a crash on every launch.

ProvenSwiftData left the old store file on disk after the failed migration in the reproduction. The deletion was a separate action.

LikelyThe store files were removed with a glob such as rm default.store*. The May 21 backup default.store.backup-20260521-191327 lived next to the store and is also gone. A glob of that shape would have removed it along with -wal and -shm.

LikelyThe Aug 14 Claude session removed the files to get past the launch crash. The project has a precedent: on 2026-05-12 a session "wiped the local SwiftData store… clean schema, fresh start" to fix a decode crash (.claude/entries/processed/20260512-001500.json). The commit trailer names the session: claude.ai/code/session_01VDobru5ZaG5sRvoGXDjvmP.

UnverifiedThe Aug 14 session transcript. Local Claude Code transcripts only go back to Sep 27, and DerivedData (with the Aug test logs) was recreated on Sep 27. Opening the session URL above and searching for default.store or rm would settle it.

Release builds would not have deleted anything, because no code path removes the store. The same schema change shipped to users would have crashed Atticus on launch for every writer with a voice sample, and the app offers no recovery path. Deleting the data would have been the only fix available to support. Four gaps combined here, and each one is fixable on its own:

1. No migration safety net. The schema has no VersionedSchema or SchemaMigrationPlan, and no test opens a real, populated store from a previous schema. The in-memory test suite cannot catch a migration failure.
2. A crash where recovery belongs. fatalError on container failure gives the writer no path forward, which pressures whoever is debugging toward deleting the store.
3. No automatic backup. Nothing copies the store before a schema change opens it. The ad-hoc backups sat in the same folder as the store, where the same glob removed them.
4. Real writing in a dev store. The Debug build doubles as your writing tool, its store sits at the generic path shared by any unsandboxed default-config SwiftData app, and this Mac has no Time Machine destination.

Done 2026-09-28Fixes 1–3 are in place: StoreBackup, AtticusStore.open with StoreRecoveryView, AtticusSchemaV1 and AtticusMigrationPlan, the VoiceSample defaults, and StoreMigrationTests (schema lint plus a V1 fixture store). The lint was confirmed to fail when the Aug 14 bug is reintroduced. Full suite: 861 tests, 0 failures.

Done 2026-09-28Fix 4: the store moved to Application Support/Atticus/store/atticus.store. On first launch the legacy default.store is copied in with replacePersistentStore and left untouched. That copy was verified to be consistent while another process held the store open, and to work from an older schema. If adoption fails, the launch stops at the recovery screen and no empty store is created. The test host now runs on a throwaway store, so test runs no longer open the real one. Fix 5: the project CLAUDE.md sets the data-safety rules.

Needs SarahFix 6: Time Machine. This Mac has no destination attached, and setting one needs an admin password.

1. Automatic pre-open backup. Before creating the ModelContainer, copy default.store, -wal and -shm into a dated folder under Application Support/Atticus/backups/ whenever the model version changes, keeping the last N. This single change would have made Aug 14 recoverable.
2. Replace fatalError with a recovery screen. Keep the file untouched, show the error, offer "reveal backup" and "export my writing", and never delete automatically.
3. Versioned schema plus a migration test. Adopt VersionedSchema. Add a test that opens a checked-in fixture store (with rows) from each released schema and asserts it migrates. Require a default value on every new non-optional attribute. That includes fixing VoiceSample.title and workTypeRaw now, before any release.
4. A named Debug store path. Store at Application Support/Atticus/atticus.store instead of the generic default.store.
5. A rule for Claude sessions. Add to the project CLAUDE.md: never delete, move or replace the dev store. Operate on copies, back up outside the store folder, and stop to ask when a fix seems to require a fresh store.
6. Machine-level protection. Configure Time Machine (or another backup) on this Mac.