# Backup, upgrade and recovery rehearsal

**Unrun procedure template.** Adapt to the selected release, database and storage. No successful restore or migration is claimed.

## Inventory

Record the application image/digest, database/backend, uploaded-file storage, retrieval stores, connection configuration and secret-management dependencies. The default local data volume is not a complete backup of external databases/object stores or startup environment secrets.

## Create a consistent backup

Choose the database's supported consistent backup method. For a simple SQLite deployment, schedule maintenance, stop application writes, capture the database and associated files consistently, then restore service. Record timestamp, backup location, access controls and operator. Preserve required secret material through approved protected storage rather than a public archive.

## New disposable restore target

1. Use new target storage and a separate test endpoint; never overwrite the source volume.
2. Isolate provider/tool connections so the copy cannot accidentally operate on production resources.
3. Restore the compatible backup using the chosen backend's documented method.
4. Check login, a synthetic saved chat, an attachment and the intended ordinary-user access policy.
5. Record actual outcomes and errors. Do not call an archive usable merely because copying succeeded.

## Upgrade rehearsal

Record the candidate pinned version, relevant release notes and compatibility requirements. Apply the change to the disposable copy; inspect startup/migration behavior and repeat the workflow and access checks. Plan rollback using a pre-upgrade compatible backup: an older image may not understand a newer database schema. No blanket claim that every migration is reversible or irreversible is made.

## Sign-off record

| Field | To record |
| --- | --- |
| Operator/date | Actual rehearsal owner and date |
| Source and target | Distinct storage/database identifiers |
| Source/candidate versions | Tags, digests and architectures |
| Restore outcome | not_run until observed |
| Login/chat/file/access outcomes | Separate observed results and evidence |
| Recovery outcome | not_run until observed |
| Remaining issues | Specific failure and owner |
| Real update decision | Proceed only after your required checks are satisfied |

Never fix a configuration problem by deleting the original data volume. Do not include full environment dumps or unredacted credentials in support records.