A controller failure is easier to investigate when the decision can be reconstructed from the same inputs. RecoverTick explores that idea with a small Rust engine: the application provides a pure model, while the engine manages logical time, recovery policy and an allocation-free decision journal. The current repository is a 0.1.0 MVP with no third-party Cargo dependencies.
The key separation is between choosing an action and performing it. A model receives typed state and events, then proposes a state transition and an optional effect intent. The engine returns that intent to an external driver. A motor driver, sensor adapter or asynchronous queue remains outside the decision core. This makes the model inspectable without pretending that a successful decision guarantees a successful physical action.
Recovery has an explicit budget. If a model evaluation fails, its event is retained while domain state stays unchanged. A retry command can evaluate that event again at or after its logical deadline. Fresh events cannot silently replace pending work. When the retry budget is exhausted, the configured fallback is committed and the engine halts. Backward ticks and other invalid commands are rejected without altering state or the journal.
Every accepted command produces one record. Replay starts from the original state with the same model, policy and fallback, then recomputes decisions and compares sequence numbers, snapshots and outcomes. It is a semantic consistency check rather than cryptographic authentication. A valid prefix can still pass, so detecting a missing tail needs an external expected record count or manifest.
Those boundaries define the next questions clearly. Durable archives belong to the caller, effect delivery needs its own acknowledgement strategy, and hardware timing still needs measurement on the target. RecoverTick is useful as an inspectable experiment in predictable decision handling; it does not claim safety certification or automatic hardware recovery.