Write the workstation recovery runbook

This is where the course’s pieces become one document: the runbook you would follow on a replacement Mac, under time pressure, with your main machine gone.

Write the runbook in the order a replacement Mac needs it: secure the account, update macOS, install Apple tools, restore setup files, install packages, retrieve credentials, restore data, then verify projects. The order encodes dependencies — Homebrew needs the Command Line Tools, your setup repo clone needs Git, project verification needs everything above it. A runbook in the wrong order strands you mid-recovery.

# Workstation recovery — last rehearsed 2026-08-03 (2h 40m)

1. Sign in to Apple Account, enable FileVault, set firmware basics
2. Update macOS: System Settings > General > Software Update
3. `xcode-select --install`, verify `xcrun --find clang`
4. Clone setup repo, run dotfiles installer (stops on conflict)
5. `brew bundle install --file ~/setup/Brewfile`
6. Recreate credentials: new SSH keys → add to GitHub; re-issue API tokens
7. Restore data: databases from dumps, ~/dev uncommitted work from backup
8. Verify: sample project clones, installs, tests green

Make each step checkable

Add expected output for each verification and a stopping condition when something differs. Compare these two versions of step 3:

BAD:  3. Install the command line tools
GOOD: 3. `xcode-select --install`; then `xcode-select --print-path`
      must print /Library/Developer/CommandLineTools.
      If it errors: STOP, fix selection before Homebrew.

The second is executable by a stressed brain at 11pm. That is the reader you are writing for.

Rehearse, then keep it alive

An untested runbook is a guess with formatting. Time a rehearsal in a clean context — the fresh account from the previous lesson — and update the plan with every missing dependency the rehearsal exposes. Write the measured time at the top: knowing recovery takes three hours changes how you plan a broken-laptop day.

Then schedule maintenance. Review the Brewfile and permissions after major upgrades, because both drift: packages accumulate, and macOS updates reset or change permission behavior.

The failure mode is the runbook written once, rehearsed never, and trusted anyway — it fails exactly when you need it, which is the one moment you cannot debug it calmly. A reproducible workstation is maintained evidence, not a setup script written once.