Write the workstation recovery runbook

This is where the course’s pieces become one document: the runbook you would follow on a replacement Mac, under time pressure, with your main machine gone.

Write the runbook in the order a replacement Mac needs it: secure the account, update macOS, install Apple tools, restore setup files, install packages, retrieve credentials, restore data, then verify projects. The order encodes dependencies. Homebrew needs the Command Line Tools. Your setup repo clone needs Git. Project verification needs everything above it. A runbook in the wrong order strands you mid-recovery.

# Workstation recovery: last rehearsed 2026-08-03 (2h 40m)

1. Sign in to Apple Account, enable FileVault, set firmware basics
2. Update macOS: System Settings > General > Software Update
3. `xcode-select --install`, verify `xcrun --find clang`
4. Clone setup repo, run dotfiles installer (stops on conflict)
5. `brew bundle install --file ~/setup/Brewfile`
6. Recreate credentials: new SSH keys → add to GitHub; re-issue API tokens
7. Restore data: databases from dumps, ~/dev uncommitted work from backup
8. Verify: sample project clones, installs, tests green

Make each step checkable

Add expected output for each verification and a stopping condition when something differs. Compare these two versions of step 3:

BAD:  3. Install the command line tools
GOOD: 3. `xcode-select --install`; then `xcode-select --print-path`
      must print /Library/Developer/CommandLineTools.
      If it errors: STOP, fix selection before Homebrew.

The second is executable by a stressed brain at 11pm. That is the reader you are writing for.

Rehearse, then keep it alive

An untested runbook is a guess with formatting. Time a rehearsal in a clean context, the fresh account from the previous lesson, and update the plan with every missing dependency the rehearsal exposes. Write the measured time at the top. Knowing recovery takes three hours changes how you plan a broken-laptop day.

Then schedule maintenance. Review the Brewfile and permissions after major upgrades, because both drift. Packages accumulate, and macOS updates reset or change permission behavior.

The failure mode is the runbook written once, rehearsed never, and trusted anyway. It fails exactly when you need it, which is the one moment you cannot debug it calmly. A reproducible workstation is maintained evidence, not a setup script written once.