Backup and Restore Service · View 14 of 26 · 5 · Runtime
Decisions
- Authorisation checks both the requester and the target: the requester's team owns the datastore, and the target environment's classification is at least as strict as the source. A restore into the wrong place fails at key unwrap, not on someone reading a policy.
- The lock extension (step 6) comes before any read. Without it, a copy on its last retained day can expire halfway through the restore that needed it.
- The restore identity can unwrap keys only for classifications its target is cleared for. The key service is where environment separation is enforced in cryptography, not in configuration.
Numbers
- Request to first bytes moving: p95 of 10 minutes, including authorisation.
- The completion estimate is recalculated every 30 s from observed throughput and remaining replay. If it passes the tier RTO, the restore is escalated while it is still running.
Omitted
- Partial restore (one table) follows the same path into a scratch instance, then pg_dump of the named objects. The extra hop is kept so partial restores exercise the full restore too.
