System Restore, Recovery and Observability

What is it?

This roadmap is the OS safety net: restore points and rollback, the Restore UI (rstrui.cpl), a first-boot setup wizard, an event log, a crash report viewer, an F8 recovery environment, factory reset, startup repair and disk cleanup. None of its ten sections has shipped. Several lower layers it builds on already run, notably the on-disk event log, crash reports and a degraded-boot recovery screen.

How does it work?

Today. These pieces ship, owned by other roadmaps:

Event log on disk. The kernel log keeps a 1,000-entry ring and klog_disk.c flushes it as JSON Lines to events.jsonl, one object per line with ts, lvl, sub, cpu, pid, tid, msg and dropped, rotating old files into LZ4 archives (klog_disk.c). The folder is X:\Logs\ on the BlackBox partition, or C:\Impossible\System\Logs\ without one (klog.h). The log levels are Debug, Info, Warn, Error and Fatal (0 to 4). See System Logging.
Crash records. A panic writes X:\Crash\last-panic.txt (panic.c), and Windows Error Reporting style reports go to X:\Crash\WER\ (wer.c). On the next boot the splash shows "system shut down unexpectedly" with the report path (boot_desktop.c). No minidump (.dmp) writer exists yet; see Crash Dump Generation.
Degraded-boot screen. When boot fails in Phase 2 or 3, boot_recovery_show() offers Retry, Console (which today halts to the serial log) and Power off (boot_recovery.h).
Primitives for repair. GPT recovery partition types, gpt_sync_backup() and gpt_crc32() (gpt.h), and uefi_reset() with cold, warm and shutdown modes (uefi_runtime.h).

Registry backup is not available. RegSaveKey() and RegRestoreKey() are declared but return ERROR_NOT_SUPPORTED after the privilege check (registry.c). Restore points and rollback depend on them.

Planned design.

Event log. Security events and a type field added to the existing events.jsonl stream, and an Event Viewer; the viewer itself moved to the Event Viewer roadmap.
Restore points. restore_create() zips system files and a Registry backup with a manifest, evicting the oldest past a limit, and restore_rollback() verifies SHA-256 before extracting and restoring hives, then reboots.
rstrui.cpl. A timeline of restore points with Create, Restore and Delete.
First-boot wizard. Six pages (time zone, keyboard, user account, wallpaper, updates), triggered by HKLM\SYSTEM\FirstBoot.
Crash report viewer. A boot-time prompt and a tabbed report window with Export.
F8 recovery environment. A menu drawn on the boot framebuffer (UEFI has no VGA text mode) with a 15-command recovery shell; the menu itself is owned by Boot Splash and F8 Recovery.
Factory reset, startup repair and disk cleanup. A typed "YES" guard; GPT, boot entry, kernel hash and hive repair; six cleanup categories with a size preview and a weekly task.

What are its interfaces?

Interface	Status
`klog()`, `klog_get_ring()`, `events.jsonl`	Shipped
`last-panic.txt`, `X:\Crash\WER\` reports, unexpected-shutdown notice	Shipped
`boot_recovery_show()`	Shipped (console option pending)
`RegSaveKey()`, `RegRestoreKey()`	Declared, return `ERROR_NOT_SUPPORTED`
`kevent_log()`, `restore_create()`, `restore_list()`, `restore_rollback()`	Planned
`rstrui.cpl`, first-boot wizard, recovery shell, cleanup	Planned

How do I use it?

After a crash, reboot and read the notice on the splash, then open X:\Crash\last-panic.txt or the newest report under X:\Crash\WER\. The event history is in events.jsonl in the log folder above. The degraded-boot screen appears on its own when boot fails; press R, C or P.

What is not implemented yet?

Event Log
Restore Point Creation and System Rollback, which need Registry hive save and restore from the Registry roadmap and the ZIP API
rstrui.cpl
First-Boot Setup Wizard
Crash Dump Viewer
F8 Recovery Environment
Factory Reset, Startup Repair and Disk Cleanup

How does it compare with Windows 11 and Linux?

Windows 11 has System Restore on Volume Shadow Copy, the graphical Windows Recovery Environment with Startup Repair and Reset this PC, an XML event log and minidump-based error reports. Linux has journald or syslog, GRUB recovery mode, kdump and apport, and snapshots only through Btrfs, ZFS or snapper. Impossible OS already records events, panics and crash reports on a dedicated BlackBox partition; the plan adds ZIP-based restore points checked by SHA-256 before extraction, and startup repair that also verifies the kernel image's hash.