Backup and Restore Service · View 02 of 26 · 1 · Context and scope
Decisions
- The pipeline ends with proof, not with capture. A datastore whose last successful restore is too old is UNPROVEN even if last night's copy succeeded.
- Discovery comes first because the biggest source of loss is the datastore nobody enrolled. The platform reports what it does not protect, not only what it does.
- Custody B is filled from custody A by a copier with its own identity, not by the capture agents writing twice. One more hop, and one more place a write-only role is checked.
Numbers
- Capture provisioned at 3 GB/s aggregate for a 42 TB nightly change set in a 6-hour window, which is 50% headroom.
- Tier 1 restore budget of 60 min, split as 10 min authorise and start, about 17 min to move 4 TB at 4 GB/s, up to 10 min of WAL replay, and 10 min of assertions and promotion.
- About 35 rehearsal runs a day across all tiers.
Risks
- The 3% daily change rate drives capture capacity and custody size, and it is the weakest number here. It is measured in the first 30 days, and custody is bought in two stages so an error costs a purchase order, not a redesign.
