Database backup and restore recovery
Authoritative source: AetherCloud. This page is mirrored into the unified AetherIoT documentation.
Use this runbook to reason about restoring one AetherCloud PostgreSQL control plane cell. It deliberately provides safety requirements rather than database commands because AetherCloud has no production backup or restore capability.
Implemented today
Section titled “Implemented today”- Gateway, CloudLink session, telemetry, Integration projection, and Integration Control have PostgreSQL adapter or migration foundations.
- Relevant integration tests exercise transactions, Tenant row-level security, rollback, uncertain commit recovery, and selected restart behavior.
- One independently placed cell is the transactional authority for the data it owns.
These facts prove adapter behavior, not that a backup exists or is restorable.
Not implemented
Section titled “Not implemented”Production database composition, migration orchestration, backup scheduling,
encrypted backup retention, restore verification, recovery-point and
recovery-time objectives, failover, and governed Tenant migration remain
planned. infrastructure.stack.plan cannot apply or restore a database.
Safe response
Section titled “Safe response”- Identify the exact Tenant, cell, provider connection, database version, schema version, backup identity, encryption authority, and restore point.
- Fence the previous writer before any restored copy can become authoritative.
- Restore first into an isolated target using the approved provider or database procedure outside AetherCloud.
- Verify migrations, constraints, forced row-level security, Audit/Outbox continuity, replay identities, cursors, and pending deliveries.
- Reconcile edge sessions and projections before admitting new writes.
- Promote only one write authority. A cross-cloud copy never becomes authority merely because it is reachable or newer.
Escalate
Section titled “Escalate”Every restore, failover, point-in-time rollback, or operation that may discard committed evidence requires a database and security operator. Do not make a restored database writable when the old writer has not been conclusively fenced, the backup identity is unverified, or Tenant isolation has not passed.
Read PostgreSQL persistence and multi-cloud cells, the current implementation audit, and the operational observability model.