Metadata backup and restore runbook

Backup

Confirm docker compose ps shows exactly one scheduler and one worker.
For an online SQLite backup, run a host-side SQLite .backup against the mounted metadata.db; do not copy only the main file while WAL writers run.
For a filesystem copy, stop web, scheduler, and worker first, then retain metadata.db, metadata.db-wal, and metadata.db-shm together.
Encrypt and test the backup outside the appliance. Never place a database dump in the repository or OCI image.

Stop all runtime roles and preserve the failed metadata volume unchanged.
Restore the complete SQLite backup into the metadata volume with the service user ownership (UID 10001 in the supplied Compose deployment).
Run docker compose run --rm migrate current; only start the stack when it reports the expected revision. Validate /readyz and a read-only API request after startup.