opschain admin database restore

Included from Basic tier

Restores an admin database backup zip into an EMPTY embedded (SQLite) store. The archive is verified against its embedded manifest before anything lands: the database snapshot is extracted beside its destination, its SHA-256 and size are checked, and only then is it moved into place; the blob count is reconciled after extraction. A tampered or truncated archive never becomes the store.

Empty-store-only is the posture: an existing store file or a non-empty blob root is refused by name, never overwritten — the operator moves the old store aside explicitly. Stop the server first; after the restore, the next boot's reconciliation handles in-flight state honestly (leases that died with the backup fail fast as runner_lost, retriable).

On a PostgreSQL store this verb refuses: restore there is the DBA's pg_restore into an empty database, followed by opschain admin database verify-restore.

Flags

None beyond the globals — the verb takes the backup file as its argument and resolves the store from the home's config.yaml.

Exit codes

Code	Meaning
0	Store and blobs restored, manifest verified.
1	The store already exists / the blob root is not empty, verification failed, the store is PostgreSQL, or extraction failed.

Named errors

• the store <path> already exists — restore only unpacks into an empty store; stop the server and move the existing store (and its -wal/-shm sidecars) aside first — exit 1.
• backup verification failed: the database snapshot does not match its manifest entry — exit 1.

Examples

opschain admin database restore nightly.zip

See also

• opschain docs cli/admin-database-backup — producing the zip.
• opschain docs cli/admin-database-verify-restore — the PostgreSQL restore's verification.