# US04-04 — Recover or Roll Back Interrupted Renames

Epic: [E04](../E04-guarded-renaming.md)

As an operator, I want safe recovery choices after interruption so partially renamed
albums never trigger blind retries or data loss.

## Acceptance criteria

- Recovery derives action from journal plus current source/destination evidence.
- Resume and rollback revalidate recorded hashes and refuse changed paths.
- Ambiguous states block unrelated mutations and explain manual recovery precisely.
- Recovery and rollback are idempotent across repeated restarts.

## Automated tests

- Fault injection terminates the process at every persisted rename transition.
- Tests cover resume, rollback, changed paths, unexpected destinations, and repeated
  restart with no overwrite or asset loss.

## Dependencies

- US04-03