Skip to content
DocumentationRecover a release
On this page

Page resources

Open Markdownllms.txtView source

Last updated

Restore, fail over, and roll back

This recipe recovers an orders release without rewriting external history or treating a backup as proof of successful restoration.

The command outputs below are illustrative end-product examples.

1. Inspect the current failure

Console
$ one inspect release:sha256:f421…
state degraded
state_provider unreachable
last_durable_checkpoint checkpoint:sha256:91d0…
latest_observation stale by 4m12s

2. Plan restore as a forward operation

Console
$ one plan --root OrdersApi            # restore from the last durable checkpoint
candidate plan:sha256:301a…
restore_target one.data.postgres#StandbyEu@1
replay_after history:cursor:8821
maximum_data_loss 0s
verification parcelhub.orders#RecoveryQualification@1

The checkpoint retains lineage, encryption context, schema revision, provider format, creation receipt, and restore compatibility.

3. Apply and resume the same operation

Console
$ one apply plan:sha256:301a…
operation operation:sha256:77e2…
state awaiting_provider_observation

$ one reconcile operation:sha256:77e2…
state verifying

Unknown provider outcomes are observed before repetition.

4. Verify before cutover

Console
$ one inspect operation:sha256:77e2…
restore receipt:sha256:5a10…
replay through history:cursor:9104
consistency checks passed
application checks passed
traffic cutover ready

Failover changes placement and authority under a new plan. It does not rename the standby as the old provider or erase the outage.

5. Roll back an application generation

Console
$ one plan --root OrdersApi            # roll back to the previous generation
$ one apply plan:sha256:…

Rollback is another governed transition. Data changes that cannot be reversed remain explicit and may require compensation or forward repair.

Executable evidence

Developer Interface owns a release-restore acceptance that rebuilds a Hello release without its prior Build output, proving restore is planned from exact evidence rather than from stale artifacts. It requires an explicitly supplied base-free distribution and current authority epoch:

Console
ONE_TEST_INPUT_RELEASE_DISTRIBUTION=/path/to/distribution \
ONE_TEST_INPUT_AUTHORITY_EPOCH=<epoch> \
  cargo test -p one-cli --test hello_release_restore \
  hello_restores_a_prior_release_without_its_build_output \
  -- --exact --nocapture

The restore, failover, and rollback outputs above remain illustrative end-product examples. Read recovery and continuity for the governing contracts.

See recovery and continuity.