How can it be fragile if there are "such good recovery features"?

Just restore unsaved changes when you launch the same image again. That's robust not fragile.

https://drcuis.github.io/TheCuisBook/The-Change-Log.html