Recovery

The relay keeps an append-only log of every change event on every binding. That log is your safety net.

Find out when a file changed

rig history path/to/file.md

Lists every event for that path, newest-first:

cursor                 who                 when                  kind
─────────────────────  ──────────────────  ────────────────────  ──────
0001RWX-…              alice@example.com   2026-05-27 14:23:11   delete
0001RWA-…              you                 2026-05-26 09:01:42   edit
0001RWB-…              you                 2026-05-25 17:44:09   write
…

This is server-side path-filtered, so it's cheap even on bindings with hundreds of files.

Flags:

Flag	What
`--limit <n>`	Cap how many events to return (default: all).
`--json`	Machine-readable.

Restore a file

rig restore path/to/file.md

Pulls the last known good version of the file from the relay log and writes it locally. Hash-verifies before writing.

If the file is currently deleted (no live version), the command refuses without --as-of:

Cannot restore data/notes.md: currently deleted at version 0001RWX-….
Run `rig history data/notes.md` to find an earlier version,
then re-run with `--as-of <cursor>`.

Restore from a specific point

rig restore path/to/file.md --as-of 0001RWA-…

The cursor comes from rig history. Use this to roll back to a specific moment.

Overwriting an existing file

If the local file already exists and differs from the version you're restoring, you get a confirmation prompt:

data/notes.md exists locally and differs from the restore target.
  local:  modified 2026-05-27 14:55:01, 4.2KB
  remote: cursor 0001RWA-…, modified 2026-05-26 09:01:42, 4.0KB
Overwrite? [y/N]

To skip the prompt (e.g. in scripts):

rig restore path/to/file.md --yes

After restore

Your restored file looks like a fresh edit to the daemon. It gets synced back to the relay and to other devices on the binding.

Other collaborators see it as: "<you> wrote data/notes.md".

What's in the log

The relay records every ChangeEvent:

The path
The cursor (monotonic sequence)
The actor (device + user)
The kind (write, edit, delete)
The content hash
The timestamp

It does not record plaintext content beyond what's needed to verify restores. The relay is a coordinator, not a content store — see How collab works.

Limits

The log is per-binding, not global. Files outside your binding aren't recoverable.
Files in [local].dirs and in default excludes are not in the log (they were never synced).
Retention is currently unlimited; this may change in future relay versions.