# Disaster recovery runbook

1. Isolate the failed host and preserve the metadata volume, repository roots, logs,
   image digest, and master-key backup. Do not restart writers repeatedly.
2. Provision a clean host with the same pinned image and non-root volume permissions.
3. Restore the master key securely, restore repository roots read-only first, and
   restore metadata from a verified backup or the passphrase-protected recovery bundle.
4. Run `migrate current`, start only `web`, validate `/readyz` and repository
   inspection, then start scheduler and worker one at a time.
5. Perform and document a test restore before enabling scheduled work. Rotate secrets
   if host compromise is possible.