Operations and recovery

Data ownership

D1 is configured with delete: false. Removing the resource from Alchemy or removing the application must not be treated as a database deletion workflow. Preserve both the database and the stage-specific Alchemy state.

Accepted history and immutable snapshots are authoritative. Projections and R2 shadow artifacts are rebuildable views; they must not be promoted over verified history merely because they are newer.

Migrations

Migrations in packages/storage-d1/migrations are forward-only:

1. Back up durable deployment state and production data.
2. Deploy and verify the migration in staging.
3. Review the production Alchemy plan.
4. Deploy the production stage explicitly.
5. Verify health, bounded administrative reads, queue delivery, and history audit.

Never edit or delete an applied migration. Correct a production schema with a new forward migration.

Upgrade and rollback

An upgrade must preserve decoding and behavior for retained historical snapshots and events. Keep old snapshot decryption keys installed while those snapshots exist.

Rollback means deploying Worker code compatible with the already-applied schema, or shipping a corrective forward migration. It does not mean rewriting migration history or resetting D1.

Queue and workflow recovery

Workflow dispatch retries before messages reach the dead-letter Queue. Inspect and classify dead-letter entries without logging payload secrets. Durable work uses leases, stable idempotency identities, and fenced completion; an expired lease can be retried, but a stale worker cannot record a later outcome.

Do not retry ambiguous provider checkout creation as a fresh command. Use checkout recovery against the retained provider creation identity so uncertain outcomes cannot create a second charge path.

History verification

Use the authenticated, bounded history-audit surface to verify retained history and projections. An incomplete checkpoint or mismatched projection is an operational finding, not permission to replace authoritative facts with a projection.

Destructive operations

alchemy destroy --stage <stage> removes managed runtime resources and is deliberately absent from automated scripts. Confirm the exact stage, preserve D1 and Alchemy state, and review every retained resource before running it.