Disaster recovery runbook

Isolate the failed host and preserve the metadata volume, repository roots, logs, image digest, and master-key backup. Do not restart writers repeatedly.
Provision a clean host with the same pinned image and non-root volume permissions.
Restore the master key securely, restore repository roots read-only first, and restore metadata from a verified backup or the passphrase-protected recovery bundle.
Run migrate current, start only web, validate /readyz and repository inspection, then start scheduler and worker one at a time.
Perform and document a test restore before enabling scheduled work. Rotate secrets if host compromise is possible.