Bench Safety Model

Warnings are not the safety boundary

Recovery software often asks the operator to recognize a dangerous choice and then presents a warning. Lazarus moves that decision earlier. A bench profile assigns physical ports as source-only, destination-only, image storage, removable recovery media, ignored, or system-owned.

A source connected through a destination-only port is rejected. A destination connected through a source-only port is rejected. The normal workflow has no convenient override because the point is to prevent a predictable class of accident, not merely document that it happened.

Identity survives device renaming

Linux names such as /dev/sdb depend on discovery order and can change after a reconnect. Lazarus prefers physical /dev/disk/by-path identity for bench position and retains /dev/disk/by-id identity, serial information, capacity, transport, and model for cross-checking.

Interrupted-image resume requires the returning source to match the recorded identity and capacity. A familiar device name is not sufficient evidence.

Separate authority paths

Approved sources are opened with read-only operating-system flags
Source handles expose no write operation
Destination handles are separate types and require destination-only policy
Restore requires exact ERASE confirmation after the destination is identified
The graphical client is unprivileged and cannot open raw disks
System disks and mounted image storage are never marked safe to disconnect

Policy before permission

This ArcoBASIC example communicates the source-safety rule separately from the service mechanism. It returns a factual result and reason instead of a vague boolean, making both the operator and the interface aware of the exact boundary.

ArcoBASICArcoBASIC communication example: fail-closed source approval

' Evaluate source safety before asking the privileged service to open it.
FUNCTION ApproveSource(device)
    ' The running system disk is never customer source media.
    IF device.IsSystemDisk THEN
        RETURN {"Ok": FALSE, "Reason": "RUNNING SYSTEM DISK"}
    END IF

    ' Image storage must remain available and must never become a source.
    IF device.BenchRole == "IMAGE STORAGE" THEN
        RETURN {"Ok": FALSE, "Reason": "DEVICE OWNS IMAGE STORAGE"}
    END IF

    ' Unknown is not permission. An administrator must classify the port.
    IF device.BenchRole <> "SOURCE ONLY" THEN
        RETURN {"Ok": FALSE, "Reason": "SOURCE PORT NOT APPROVED"}
    END IF

    IF device.PersistentId == "" THEN
        RETURN {"Ok": FALSE, "Reason": "PERSISTENT IDENTITY MISSING"}
    END IF

    RETURN {"Ok": TRUE, "Reason": "APPROVED READ-ONLY SOURCE"}
END FUNCTION

candidate = {
    "IsSystemDisk": FALSE,
    "BenchRole": "SOURCE ONLY",
    "PersistentId": "usb-Samsung_SSD_ending-4512"
}

decision = ApproveSource(candidate)
PRINT decision.Reason

Safe disconnection is a claim

SAFE TO DISCONNECT means the service has no open operation for that device. During finalization and destination flush, Lazarus explicitly reports FLUSHING: DO NOT DISCONNECT. The UI does not infer safety from a progress bar reaching 100 percent.

Unexpected source removal leaves the incomplete marker, job journal, source identity, and verified chunk map in place. The next session can explain what survived and what must be checked before resuming.

Fail-closed as a habit, not a disk rule

The physical port roles and persistent-identity checks in the bench safety model are built for one specific hazard: overwriting the only copy of customer data. Almost no other project will have source-only USB ports or a by-path device identity to check. What is worth taking from this page is the shape of the decision-making, not the disk-specific inputs it happens to check.

This is the same instinct behind least-privilege file permissions, database roles that can read but not drop a table, and API keys scoped to one endpoint instead of an entire account. Wherever an accident would be expensive and irreversible, the fix is never a better warning message; it is making the dangerous path structurally unavailable until something specific proves it is safe.

Move the dangerous decision earlier than the point of no return. Bench roles reject a misplaced device before ApproveSource is even asked to open it, rather than relying on a warning dialog at the moment of destruction.
Prefer evidence that survives renaming over evidence that is merely convenient. Lazarus keeps by-path and by-id device identity specifically because a device name like /dev/sdb can point at a different physical drive after a reconnect; convenient names are the first thing to distrust when correctness matters.
Make the default the safe answer. ApproveSource returns Ok: FALSE for anything it does not explicitly recognize as SOURCE ONLY; an unclassified port is treated as no permission at all, not as a maybe.
Give handles narrower authority than the system as a whole has. Source handles expose no write operation and destination handles are a separate type, so the blast radius of a bug is capped by what the handle itself is even capable of doing.

LEARNING LAYER

Key terms, in plain language

You do not need a systems background to follow the work. These are the specialized terms used on this page.

Bench policy: Rules assigning physical recovery-bench ports and devices to roles such as source-only, destination-only, image storage, or ignored.
Persistent device identity: Hardware and physical-path information used to recognize a storage device across reconnects. It is safer than relying on temporary Linux names such as /dev/sdb.