Backup and Restore Service · View 16 of 26 · 5 · Runtime
Decisions
- The search is a nine-way bisection: restore 8 evenly spaced points, run the owner's invariant, and keep the interval where it turns from clean to dirty. 35 days is about 3 million seconds, and nine-way search needs 7 rounds to reach one second.
- The invariant is a query the owner supplies, such as totals reconciling or no orphaned rows. Without one the platform can restore any second, but it cannot say which second is clean.
- Search restores use the rehearsal slots and pause the Tier 2 rotation while they run. Tier 1 daily rehearsals keep running.
Numbers
- Round cost depends on replay distance. Inside the 7-day hourly window, a round on a 1 TB store takes about 25 minutes, so the whole search is about 3 hours. With only daily bases, rounds take about an hour.
- 8 parallel restores is the rehearsal-slot budget in the NFRs, not a coincidence.
Assumptions
- The corruption is monotonic: once the invariant fails, it keeps failing. A corruption that was repaired and then happened again needs a person reading the round results, and the evidence record keeps every round for that reason.
