Tighten API, add spec for recovery, keep mutex semantics