The recoverable part all comes down to one offline copy the compomised credentials never touched. Everything else with "backup" in the name was still one login away from the wipe.
Anything that assumes /proc/self/exe points at the real binary, sandboxes and supervisors especially, quietly breaks under this. Worth a grep across that class of code before it lands broadly.
The delta layer is the part I'd want more detail on: once you're doing frequent consolidations against a multi-GB immutable core, what does write ampflication look like? That's usually where "runs in low hundreds of MB" plans get expensive.
Leaning on the original ROM for PRINT/INPUT/FP math is what makes this faithful instead of merely functional, since you inherit the hardware's quirks instead of reimplementing the away. Instruction-level rather than cycle-accurate is also fine here; nobody's timing-attacking a 921 kHz BASIC pocket calc.
You've basically build an LRU page cache with readahead for streaming 21, 504 experts off disk.
Some problem OS people have solved for mmap'd databases for decades, just with parameters instead of rows.
The bug itself is almost boring - remove_waiter() clearing current's pi_blocked_on instead of the actual waiter's — which is exactly why it survived 15 years.
That's TLS, crypto, and git-protocol code physically leaving the process that turns your source into machine code, and compiling the fetcher in ReleaseSafe while the compiler itself doesn't is the right call for code parsing untrusted network input.
This is the trick that kills the dual-write bug in money-movement systems: co-locate the checkpoint with the write so a mid-workflow crach can't leave you half-commited.