Runbook — recovery model by scenario

Extracted from the master document on 2026-09-04. The §N numbering is kept so cross-references are not broken.

Part XII — Recovery model

Scenario	What is used	Tested?
A service becomes corrupted	Layer 2 (selective borg extract)	✅ validated (§45)
The SSD dies	Layer 1 (vzdump from R2) + Layer 2 for data	✅ validated (§46)
The whole physical node is lost	R2 — the only copy outside the node	✅ validated (§48)
The Nextcloud HDD dies	AIO’s native backup (via Borg/R2)	✗ not tested (§47)

SSD FAILURE                     NEXTCLOUD HDD FAILURE
New SSD                         New HDD
   ↓                               ↓
install Proxmox                 filesystem + mount (§12)
   ↓                               ↓
restore VMs from backup         restore AIO/data from its backup
   ↓                               ↓
reconnect storage               validate DB / app / data
   ↓
restore granular data
   ↓
validate services

CORRUPTION OF A SERVICE
corrupt service → selective borg extract → restore config/DB/persistence
   → bring up an ISOLATED instance → validate → only then promote

---