Recovery domains: an organizing principle for recoverable operating systems