> **Plain-language companion:** [v0.92.0.md](v0.92.0.md)

## v0.92.0 - Backup, Restore, Upgrade & CDC Recovery

**Status: Implemented.** Derived from [ROADMAP.md](../ROADMAP.md).

> **Release Theme**
> Persistent stream-table state must either prove continuity after backup,
> restore, cloning, promotion, and upgrade, or enter a protected rebuild or
> suspension state. Capture failures must never advance an unproven frontier.

---

### Correctness

| ID | Title | Effort | Priority |
|----|-------|--------|----------|
| LC-3 | Backup, restore, and promotion validation | Large | P0 |
| LC-4 | Clone isolation and capture ownership identity | Medium | P0 |
| LC-7 | CDC failure classification and proof-based recovery | Large | P0 |

### Ease of Use

| ID | Title | Effort | Priority |
|----|-------|--------|----------|
| LC-5 | Upgrade preflight and quiescence APIs | Medium | P0 |
| LC-6 | PostgreSQL and extension upgrade coverage | Large | P0 |

### Test Coverage

| ID | Title | Effort | Priority |
|----|-------|--------|----------|
| LC-3 | Backup, restore, and promotion E2E matrix | Large | P0 |
| LC-6 | Bounded source-version and PostgreSQL-major manifest | Medium | P0 |
| LC-7 | Injected CDC failure recovery matrix | Large | P0 |

---

### Recommended Implementation Order

1. **Capture identity:** add the durable database-instance identity and check
   it before scheduler work or capture infrastructure can resume.
2. **Recovery contract:** add typed failure classes, durable reason codes, and
   fail-closed repair/reinitialization behavior.
3. **Upgrade boundary:** expose machine-readable preflight, quiesce, and
   resume operations using the existing drain machinery.
4. **Recovery evidence:** validate frontiers, buffers, slots, triggers, and
   persistent operator state after restore or promotion, then document the
   supported backup paths.
5. **Upgrade matrix:** commit the bounded support manifest, migration, and
   automated upgrade coverage.

---

### Implementation Status

| ID | Title | Status |
|----|-------|--------|
| LC-3 | Backup, restore, and promotion validation | ✅ Implemented |
| LC-4 | Clone isolation and capture ownership identity | ✅ Implemented |
| LC-5 | Upgrade preflight and quiescence APIs | ✅ Implemented |
| LC-6 | PostgreSQL and extension upgrade coverage | ✅ Implemented |
| LC-7 | CDC failure classification and proof-based recovery | ✅ Implemented |

---

### Exit Criteria

- [x] Every supported backup, restore, promotion, and clone path has automated
      E2E coverage.
- [x] Clone isolation is proven with an explicit database-instance identity.
- [x] PostgreSQL major-upgrade coverage includes active stream tables and
      pending deltas.
- [x] The checked-in v1.0 support manifest contains only v0.40.0 through the
      latest v0.98.x release on PostgreSQL 18, and every listed pair passes E2E.
- [x] Preflight, quiesce, and resume expose stable results suitable for
      scripted DBA workflows.
- [x] Every injected CDC failure enters one documented recovery class.
- [x] No injected failure can resume with an unproven frontier.