A working drawing set

Five plates that carry the whole design.

Each plate is one sheet from a working set. Move between them, then break a dependency to see which record still stands.

Data protection

Recovery chain

A backup is a claim. A restore is evidence. Each stage crosses a failure boundary, keeps its own credentials, and leaves a dated record.

Select a dependency to see what still holds when it breaks.

Plate 04, Recovery chainA backup is a claim. A restore is evidence. Each stage crosses a failure boundary, keeps its own credentials, and leaves a dated record. A vertical stack of five filing tabs that shows the recovery chain from live application data through native export, encrypted repository, off-site copy, and canary restore, ending with a proven stamp. Each tab lists the invariant fields of an evidence record: what the stage holds, where its credential lives, and what verifies the transition to the next tab. The stack is marked example record synthetic. A left rule shows elapsed-time positions between stages. Margin notes name why each stage exists.PLATE 04Data protectionRecovery chainREV 2026-07EARLIERLATERt1t2t3t4t501LIVE APPLICATION DATAHOLDS the working state a person or service depends on todayCREDENTIAL the application runtime identityVERIFIED BY reachability of the service that owns the data↓ application-consistent export, ordered by dependency02NATIVE EXPORTHOLDS a portable file the application can reloadCREDENTIAL the export tool identity, distinct from the runtimeVERIFIED BY file size, row count, or manifest matches expectation↓ write to an encrypted repository with versioned snapshots03ENCRYPTED REPOSITORYHOLDS deduplicated, versioned snapshots and a freshness heartbeatCREDENTIAL the backup tool identity, held separately from application secretsVERIFIED BY the last snapshot is fresh and its checksum is intact↓ ship a copy to a separate failure domain04OFF-SITE OR OFFLINE COPYHOLDS an independent copy that survives a local disasterCREDENTIAL the off-site identity, unable to reach the primaryVERIFIED BY the copy list matches the origin and cannot be silently deleted↓ restore a canary somewhere other than the source05PROVEN RESTOREHOLDS a dated record of a real restore on a clean targetCREDENTIAL a canary identity that never touches productionVERIFIED BY checksum match and a smoke test the application definesPROVEN, DATEDFIELD ANNOTATIONSON LIVE DATAThe application owns this.Every step below survivesit.ON EXPORTThe application must bequiet, not writing, whenthe export runs.ON REPOSITORYThe repository credentialis not the applicationcredential.ON OFF-SITEThe copy is worth what itcan be restored from, notwhat it holds.ON PROVENA restore record on aclean target is the onlyproof that stands.A RESTORE RECORD LOOKS LIKE THISEXAMPLE RECORD, SYNTHETICdate=YYYY-MM-DD source=SVC HOST target=CANARY HOST bytes=NNN GiBchecksum=match elapsed=HH:MM:SS note=free-text field the operator fills inReal records replace the placeholders. Values that would identify the lab stay out of public evidence.

Plate 04, Data protection

Recovery chain

A backup is a claim. A restore is evidence. Each stage crosses a failure boundary, keeps its own credentials, and leaves a dated record.

  1. LIVE APPLICATION DATA

    The application owns this. Every step below has to survive it.

  2. NATIVE EXPORT

    A portable file the application can reload. The export runs with the application quiet.

  3. ENCRYPTED REPOSITORY

    Versioned snapshots with a freshness heartbeat. The backup credential is not the application credential.

  4. OFF-SITE OR OFFLINE COPY

    An independent copy that survives a local disaster. The off-site identity cannot reach the primary.

  5. PROVEN RESTORE

    A dated record on a clean canary target. Checksum match plus a smoke test the application defines.

  1. 05-storage-backup
  • ● verified or healthy
  • ▲ degraded or needs attention
  • ■ failed dependency

Plate 04

Recovery chain

Scroll or drag to move across the drawing. Pinch to zoom on touch devices.