For Divvent’s own team. It is generated from the operations document in our repository, which is the one to edit. If you use Divvent, the help centre is for you.
3b. A customer's restore, and when one needs an operator
Customers back up and restore from the portal (Settings → Backups, docs/BACKUPS.md). The portal writes a row; backups.yml's pass does the work in the company's own account, with the company's own credential opened as a deploy opens it:
divvent backups --env staging --runner <run id>A restore goes requested → staging → staged → approved → promoting → promoted, or discarding → discarded, or failed, each step a restore.* audit row naming the runner:
- Staged. A backup is loaded into
<database>---restore-copyand compared with the live database table by table (byid, else as whole rows); a Time Travel moment is counted in place from the application's_divvent_audit. The preview — counts and table names, and the copy's content digest — is what the owner approves. - Promoted. The runner refuses a target deployed since the stage, a deploy in progress, and a copy whose content digest moved; then takes a bookmark of the live database (
undo_bookmarkon the row), loads the copy over every table but_divvent_metaand_divvent_audit— or rewinds in place and writes back the audit rows since — writes the ledger back as it was, adds arestore-<id>row to the application's audit, and removes the copy. Any failure after the bookmark puts the database back to it before the restore is failed.
When a person is needed, and what to do:
| The row says | What happened | What to do |
|---|---|---|
failed, "the runner promoting this restore stopped answering…" | a runner died mid-promote (a cancelled job, a lost runner); the control plane never retries a promote | open the company's database in its Cloudflare account, compare it with the undo_bookmark on the row; if it is half-loaded, restore the bookmark (POST /d1/database/<id>/time_travel/restore?bookmark=<undo>) — the same call divvent deploy --rollback --restore makes — and tell the customer to stage it again |
failed, "holds N rows, more than a self-service restore compares" | a table over RESTORE_ROW_LIMIT (200,000) | restore by hand from the catalogued key: divvent snapshot restore's machinery, with the customer's written approval, recorded on the account |
failed, "(DeployError …)" or "(Error)" | something below us refused: the message is not recorded, because a database's error can quote a value | read the job's log for the step; nothing of the database is in it either |
a ---restore-copy left in an account | a runner died mid-stage | the next stage or discard removes it — once its own ledger says it is that target's copy, never by name alone |