robinnsc · Nov 6, 2026
@@ -14,7 +14,7 @@ First, check whether a config file is already present at the repo root.
 test -f extenddb.toml && echo "extenddb.toml already exists" || echo "extenddb.toml absent"
 ```
 
-`extenddb.toml` on its own does not block `extenddb init`. If `extenddb.toml` exists, `init` loads defaults from it and continues. The real blocker is whether the `extenddb_catalog` and `extenddb` data databases exist in PostgreSQL.
+`extenddb.toml` on its own blocks `extenddb init`: if it exists, `init` refuses with `Error: Config file "extenddb.toml" already exists. Use --overwrite to delete and regenerate it.` and exits 255. With `--overwrite`, `init` loads the PostgreSQL connection defaults from the file and continues. The other blocker is whether the `extenddb_catalog` and `extenddb` data databases exist in PostgreSQL.
 
 Second, check whether a prior deployment is present in PostgreSQL.
 

@@ -21,7 +21,7 @@ HTTP 500 on all requests under heavy load
 pool_size = 50  # default is 20
 ```
 
-If the problem persists, check for long-running queries or connection leaks with `SELECT * FROM pg_stat_activity WHERE datname = 'extenddb_data';`.
+If the problem persists, check for long-running queries or connection leaks with `SELECT * FROM pg_stat_activity WHERE datname = 'extenddb';` (the data database's default name).
 
 **Known limitation:** The HTTP status code should be 503 with a `Retry-After` header. This is tracked as technical debt.
 

@@ -173,7 +173,7 @@ jobs:
           EXTENDDB_ADMIN_PASSWORD: ${{ steps.init.outputs.admin_password }}
           EXTENDDB_TEST_PG_ADMIN_CONNECTION_STRING: postgresql://postgres:devpass@127.0.0.1:5432
           EXTENDDB_TEST_BACKUP_STORE: filesystem
-        run: devtools/run-tests --extenddb --pytest --comprehensive --parallel --filter "not import_export"
+        run: devtools/run-tests --extenddb --pytest --comprehensive --parallel
 
       # moto for the job suite's store-outage cell, the one cell that
       # exercises `spool_path` on PostgreSQL (an S3 download into the spool,
@@ -332,7 +332,7 @@ jobs:
           # A file-backed SQLite server without [backup.store] writes to the
           # defaulted root beside the database file.
           EXTENDDB_TEST_BACKUP_STORE: filesystem
-        run: devtools/run-tests --extenddb --pytest --comprehensive --parallel --filter "not import_export"
+        run: devtools/run-tests --extenddb --pytest --comprehensive --parallel
 
       - name: Run the backup store and job suites
         run: python3 -m pytest tests/test_backup_store_config.py tests/test_backup_job.py -v -rP -p no:cacheprovider

@@ -151,7 +151,7 @@ cargo clippy --all-targets -- -D warnings
 ```
 
 This creates:
-- Databases (`extenddb_catalog`, `extenddb_data`)
+- Databases (`extenddb_catalog` and `extenddb` on PostgreSQL; `extenddb_catalog` and `extenddb_data` on MongoDB)
 - Admin user credentials (printed to stdout — save the password!)
 - Self-signed TLS certificate at `~/.extenddb/tls/cert.pem`
 - Config file `extenddb.toml`
@@ -395,6 +395,7 @@ Expression parsing lives in `crates/core/src/expression/`. This is pure sync Rus
 | Admin Guide | `docs/manuals/05-admin-guide.md`                  | Server lifecycle, configuration, IAM   |
 | Security Model | `docs/manuals/10-security-model.md`               | Threat model, auth, authz              |
 | Deployment Guide | `docs/manuals/11-deployment-guide.md`             | Self-hosted, multi-cloud, air-gapped   |
+| Backup and Restore | `docs/manuals/14-backup-and-restore.md`           | Backup strategy, drills, recovery      |
 | Differences from DynamoDB | `docs/differences-from-dynamodb.md`               | Behavioral differences                 |
 | Troubleshooting | `docs/troubleshooting.md`                         | Common errors and solutions            |
 | Storage Component Design | `docs/design/04-component-storage.md`             | Storage trait design                   |
@@ -404,7 +405,7 @@ Expression parsing lives in `crates/core/src/expression/`. This is pure sync Rus
 | Local MongoDB Setup | `docs/local-mongodb-setup.md`                     | MongoDB installation and config        |
 | Cassandra Setup | `docs/cassandra-setup.md`                         | Cassandra install, config, and deployment (experimental) |
 | Testing Design | `docs/design/09-testing.md`                       | Test strategy and infrastructure       |
-| Extending Storage | `12-backend-plugin-architecture.md` | Guide to implementing storage backends |
+| Extending Storage | `docs/manuals/12-extending-extenddb-storage.md` | Guide to implementing storage backends |
 
 Build PDFs:
 

@@ -259,6 +259,7 @@ docs/
 | [Admin Guide](docs/manuals/05-admin-guide.md) | Server lifecycle, configuration, IAM management |
 | [Security Model](docs/manuals/10-security-model.md) | Threat model, authentication, authorization |
 | [Deployment Guide](docs/manuals/11-deployment-guide.md) | Self-hosted, multi-cloud, air-gapped deployments |
+| [Backup and Restore](docs/manuals/14-backup-and-restore.md) | Backup strategy, recovery figures, restore drill, catalog-loss recovery |
 | [Differences from DynamoDB](docs/differences-from-dynamodb.md) | Behavioral differences and unsupported operations |
 | [Troubleshooting](docs/troubleshooting.md) | Common errors and solutions |
 

@@ -21,11 +21,11 @@ pub struct InitArgs {
     #[arg(long)]
     backend: Option<String>,
 
-    /// Data database name (default: extenddb)
+    /// Data database name (default: the catalog's name without its `_catalog` suffix)
     #[arg(long)]
     data_db: Option<String>,
 
-    /// Catalog database name (default: <data-db>_catalog)
+    /// Catalog database name (default: extenddb_catalog, or the config file's)
     #[arg(long)]
     catalog_db: Option<String>,
 

@@ -1,6 +1,6 @@
 # ADR-0019: Logical backup and restore for Cassandra
 
-**Status:** Accepted
+**Status:** Superseded in part by [the backup and restore design](../design/15-backup-restore.md) (section 10)
 **Date:** 2026-08-03
 
 ## Context

@@ -22,6 +22,8 @@ ADRs are *records*, not proposals. If you are still soliciting input, write an
 3. Open a PR. Discussion happens inline.
 4. On merge, the ADR is Accepted. Subsequent decisions that override it should
    create a new ADR and update the original's Status to "Superseded by ADR-NNNN".
+   A decision that a later design document replaces in part updates its Status
+   to "Superseded in part by [document]", and that document states which parts.
 
 ADRs are never edited after acceptance except to update Status. To change a
 decision, write a new ADR.
@@ -45,7 +47,7 @@ decision, write a new ADR.
 | [0016](0016-cassandra-index-table-primary-key-structure.md) | Cassandra: index table primary-key structure | Accepted |
 | [0017](0017-cassandra-transaction-implementation.md) | Cassandra: TransactWriteItems / TransactGetItems implementation | Accepted |
 | [0018](0018-cassandra-stream-implementation.md) | Cassandra: DynamoDB Streams implementation | Accepted |
-| [0019](0019-cassandra-logical-backup-restore.md) | Cassandra: logical backup and restore | Accepted |
+| [0019](0019-cassandra-logical-backup-restore.md) | Cassandra: logical backup and restore | Superseded in part by [the backup and restore design](../design/15-backup-restore.md) (section 10) |
 | [0020](0020-cassandra-occ-update-item.md) | Cassandra: optimistic concurrency control for UpdateItem and PutItem | Accepted |
 | [0021](0021-cassandra-lwt-delete-atomicity-gap.md) | Cassandra: LWT delete atomicity gap and required worker/saga pattern | Accepted |
 | [0022](0022-trust-policy-deny-over-allow.md) | Role trust-policy evaluation follows IAM Deny-over-Allow order | Accepted |

@@ -89,6 +89,8 @@
      "docs/local-postgres-setup.md"),
     (18, "event-ticketing-demo", "Event Ticketing Platform Demo", "getting-started",
      "docs/manuals/13-event-ticketing-demo.md"),
+    (19, "backup-and-restore", "Backup and Restore", "usage",
+     "docs/manuals/14-backup-and-restore.md"),
 ]