Inventory rebuildable and personal state

Imagine your Mac dies tonight. A Brewfile can rebuild packages. Git can restore committed source. That covers less of your machine than you think: neither restores uncommitted work, application databases, credentials, device settings, or license records.

Recovery planning starts with knowing which kind of state each thing is. Not backing up — inventorying. The backup strategy falls out of the inventory, not the other way around.

Three columns

Create an inventory with three columns: rebuild, restore, and recreate manually. Put every important workstation item in exactly one column.

• Rebuild: regenerated from a declaration. Homebrew packages, cloned repositories, language runtimes pinned in version files.
• Restore: unique data that must come from a backup. Local database contents, uncommitted branches, app data, documents.
• Recreate manually: things that should never be in a backup file. Credentials you re-issue, licenses you re-download from the vendor, permissions you re-grant.

A concrete starting point:

| Item                        | Column            | Source of truth        |
| --------------------------- | ----------------- | ---------------------- |
| CLI tools and apps          | rebuild           | Brewfile in setup repo |
| Project code (pushed)       | rebuild           | GitHub remotes         |
| Postgres dev databases      | restore           | nightly pg_dump        |
| ~/.ssh keys                 | recreate manually | generate new, re-add   |
| API tokens                  | recreate manually | issue new per service  |

The “exactly one column” rule is what makes the exercise honest. An item you cannot place is an item you do not understand yet — which is precisely what this inventory exists to surface.

Audit the gaps

Uncommitted work is the sneakiest restore item. Find it before you need to:

find ~/dev -maxdepth 1 -type d -exec sh -c 'cd "$1" && [ -n "$(git status --porcelain 2>/dev/null)" ] && echo "$1"' _ {} \;

Any directory that prints has state existing only on this machine.

Two boundaries keep the inventory sane. Exclude caches and downloaded dependencies unless recovery time justifies them — node_modules and ~/Library/Caches are rebuildable noise that bloats any backup. And protect credentials separately from the machine they unlock: a backup containing your SSH keys, restored onto a compromised or shared machine, turns one lost laptop into a wider incident.

The realistic failure: assuming everything is column one, wiping the Mac, and discovering the local databases and .env files were column two. The inventory costs an hour. That discovery costs the data.