# Workflow: disaster recovery drill with instant restore

## Goal
Prove you can recover to a point in time, and learn the exact clicks, before a real incident.

## Steps
1. Pick a drill timestamp in the recent past, inside your history window.
2. Use Time Travel Assist to open a read-only connection at that timestamp. Run the queries that define "correct": row counts on critical tables, the specific records the drill scenario "lost".
3. Instant-restore the root branch to that timestamp (Console, CLI, or API). Remember: only root branches support instant restore.
4. Neon renames the original to `[branch]_old_head_[timestamp]` and keeps it. The restored data is on a new branch that becomes a root branch.
5. Verify against the restored branch with the same queries from step 2.
6. Repoint a staging app at the restored branch and smoke-test.
7. Delete the drill branches (restored + old_head backup) to stop their storage cost.

## Ordering constraints
- Verify the timestamp with Time Travel Assist before restoring; restoring to the wrong moment costs a second restore cycle.
- Keep the `_old_head_` backup until verification passes; it is your undo.

## Traps
- Child branches cannot be instant-restored: run the drill on the branch you would actually restore in production.
- A timestamp older than the history window silently cannot be reached; check the window first (Free: 6h, Launch: up to 7d, Scale: up to 30d).
- After a real restore, every app pointing at the old branch name needs its connection string updated.

## Verify
The drill completes inside your recovery time objective, and the runbook now has the exact commands, not guesses.