---
name: durable-recovery
description: Provision a fresh PostgreSQL-backed CitusIO store explicitly and verify same-broker recovery without confusing provisioning, backup or cross-version migration.
---

# Provision and recover durable state

Core and higher include durable configurations. Inspect the installed
`/etc/nginz-iot/iotd.toml` store fields: production durability requires PostgreSQL
and the selected durable ACK policy. `admin.journal` holds admin commands, not a
local production broker store. Record actual schema, committed frontier,
checkpoint, generation and writer term privately.

Resolve DSN/audit-key references with the intended private environment/secret
mechanism. Check PostgreSQL ownership, reachability and durability settings;
never put credentials in arguments/reports.

Use [container setup](../container-setup/SKILL.md) to prepare private inputs and
run direct native validation with your chosen tools. For an existing deployment,
keep its database and saved identity/frontiers and use normal recovery; never
repeat provisioning to obtain status. For a fresh selected database only:

```sh
nginz-iotd --config /etc/nginz-iot/iotd.toml --test-config
nginz-iotd --config /etc/nginz-iot/iotd.toml --provision-store
```

Record completion. Startup/recovery validate and reuse the existing store;
do not provision again. Unknown ownership or incompatible schema blocks it.

For backup, quiesce traffic/effects and record broker/store/bridge frontiers.
Preserve config, image/adapter identities and private secret references. Use
PostgreSQL backup tooling in an authorized provider context, verify archive
readability, then restore into an isolated database. A usable backup needs
matching-broker recovery of recorded state/frontiers and intended delivery.
Include pending bridge intents and terminal-effect reconciliation.

Preserve the same store for restart/crash recovery. Replace local rings after
old processes exit; recover with matching binaries/configs. Verify fresh
readiness, retained bytes/deletions/expiry, the broker's own sessions, offline
delivery and ACK retirement. Check application receipts and final queue depths.

Same-broker recovery does not prove foreign-state import, cross-version upgrade
or device power-loss behavior. Record/store/ring compatibility needs explicit
evidence. Read [migration-cutover](../migration-cutover/SKILL.md) for replacement.