Prove a Wedding database restore from the dedicated backup bucket alone

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

A backup that has never been restored is not proven. #3727's recovery guide requires an isolated restore proof from the dedicated bucket before the shared credential can be retired, and #3253 cannot start until that exists. The 2026-09-09 data loss (#3738) showed the restore path is what matters in practice.

Audience and problem

Wedding guests and the operator. After the reference switch, the dedicated bucket is the only live Wedding archive. If it cannot restore, revoking the shared credential would remove the last known-good path.

Hypothesis

Restoring into an isolated, temporary Cluster that can read only the dedicated bucket, then checking core guest data, proves the dedicated archive is complete and usable on its own.

Acceptance criteria

• A dispatch-only, production-locked job restores the Wedding database from wedding-db-dedicated into an isolated one-instance Cluster that cannot reach the production database.
• The restore uses only the dedicated credential. The job refuses to run if the shared credential is available to it.
• Validation compares non-secret core guest counts and the newest recovered timestamp with the live database, within an agreed tolerance for recent writes.
• The temporary Cluster, volume and any temporary network policy are removed afterwards, including when the run fails.
• One production run has succeeded, with its non-secret proof recorded on this issue. Verify the dedicated wedding backup identity, retire shared access, and update the DR runbooks #3253 is then unblocked.

Success signal

A recorded restore from the dedicated bucket alone that matches live guest data.

Rough size: M. Blocked by the reference switch; unblocks #3253.

Blocker: production workflow_dispatch of the merged dispatch-only Mirror Wedding Backup Catalogue workflow, which scheduled runs are not permitted to trigger | authority | last-verified 2026-09-20: workflow present on main, zero runs recorded | asked slack 2026-09-14