The mesh ships: lose any two, lose nothing
Recilic 0.3.0 is out: your encrypted shards now spread across the Macs you own, in five languages. Getting there meant finding out that the mesh had been running at five-sixths strength for two days — and that every backup in between had reported success.
Eight machines, and then six
The test mesh is eight nodes: this MacBook, a Mac mini, and six small machines that had been sitting idle in the house. A backup splits each chunk into 4+2 shards and hands them to six different nodes, so any two can vanish and the data is still whole.
On 12 August, at the same second, every one of those small nodes stopped advertising itself:
thread 'mDNS_daemon' panicked: index out of bounds:
the len is 278 but the index is 278
One malformed packet from something on the network — a printer, a TV, who knows — walked into a parsing bug in the discovery library and took out that thread on every node simultaneously. Not the process. Just the thread that answers "I'm here."
So each node kept accepting connections. Each one kept reporting itself healthy to its own supervisor. And each one became invisible to the app that decides where shards go, because that decision is made from what it can discover. Five of six destinations quietly dropped out of every backup for two days, and every one of those backups finished and said success.
The part that should be embarrassing
It is worth being precise about why nobody noticed. Not because the signal was subtle: because there was no signal. The app had everything it needed to know — it had just been told six nodes yesterday and five today, and it had no opinion about that.
A backup product's whole job is to be believed later. "Finished" is the easiest thing in the world to report and the least worth trusting.
The sibling bug, burning a core
While the small nodes were silent, the storage node on the Mac mini was pinned at 97% CPU — for five days, thirty-five hours of it inside the kernel, doing no work at all. That machine has forty-four network interfaces: a few real ones, plus twenty accumulated VPN tunnels and Apple's peer-to-peer interfaces. The discovery library bound a socket to every single one — thirty-seven of them on the multicast port, against three on a Linux box — and one of those sockets was enough to spin its polling loop forever.
Both faults were fixed upstream in versions we hadn't taken. Moving to the current release needed no code changes and dropped that machine from thirty-seven sockets to four, and from 97% CPU to nothing.
What shipped instead of a shrug
Upgrading a dependency fixes the specific accident. It does nothing about the design fault, which was that nothing was watching. Three things went in:
Nodes now say goodbye. A storage node that is stopped or restarted withdraws its advertisement before exiting. Measured from the Mac: the node disappears from discovery in 1.3 seconds instead of lingering in a cache for up to an hour. A node that is killed outright — power cut, crash — obviously cannot say anything, which is why there is also:
The Mac asks before it plans. Every destination is checked directly, in parallel, before a backup commits to a placement. A cached discovery record is no longer taken as proof that a machine is still there. This mattered more than expected: before it, a node that had gone away didn't just get skipped — it failed the entire backup, because shards were still being addressed to a socket that no longer existed. Turning a machine off used to break the next backup.
And it now reports consequences, not events. When a backup reaches fewer nodes than the one before it, Recilic says so — and says what it cost:
"A node is offline" would not have helped anyone. Whether your data is still safe is a different question, and it has an exact answer: six shards across five machines means one of them holds two, so losing that one leaves you at exactly the restore threshold with no margin. That is the sentence worth printing. When a node is merely swapped for another and the tolerance is unchanged, it says so without crying degradation.
The bug in the fix
The first version of that warning never fired. A node was stopped, the backup correctly excluded it and moved its shards elsewhere, and the summary said nothing at all.
The generation repository hands back its list newest-first, and the code took the end of that list as "the previous backup" — the oldest one, from before this mesh existed, whose single node is a subset of today's. So the check dutifully compared the present against the beginning of time and found nothing wrong. Every unit test passed, because they tested the comparison rather than the choice of what to compare against.
A wrong answer that looks exactly like a right one. Choosing the predecessor now belongs to the repository, which is the only thing that knows its own commit order, and the test that covers it was checked by reinstating the bug to watch it fail — which is the only reason to believe a test at all.
What is still true
Both fixes happen before takeoff. A machine that was genuinely there when the backup started and disappears at 60% — a lid closing, a power strip switched off — still fails that generation instead of finishing with five shards and telling you so. The data is fine; the code is stricter than the mathematics. That one is written down as issue 16 and is next.
0.3.0
Alongside the mesh: identical content is now stored once, so a second backup of unchanged files transfers nothing and an interrupted backup resumes from what already landed. The interface is in English, Traditional Chinese, Simplified Chinese, Japanese and Korean. And the app is now on sale across the European Union, which took a trader-status review of its own.
Sharp eyes will have noticed the screenshot: six of the eight nodes are not Macs. They are Raspberry Pi 5s and Intel N100-class mini PCs, running a storage-only daemon written in Rust that grew alongside the app — it stores ciphertext, answers possession challenges, and does nothing else. It has been carrying this mesh at home since the day it was merged; we are still working out the right way to release it. Nothing in 0.3.0 depends on it — the app is complete on its own.
Restore drills still run the whole path end to end — read, decode, decrypt, verify — because a backup you have never restored is a hypothesis.