Start autonomous Belgium and North Sea RC

scripts/README.md

@@ -1938,3 +1938,41 @@ docker exec geointel python /app/scripts/probe_mdk_bathymetry.py
 
 This performs only `GetCapabilities`, keeps strict TLS verification enabled
 and returns exit code `2` for an honest non-ready source.
+# Release backup and restore proof
+
+The release-candidate safety path is host-operated against the running
+all-in-one container:
+
+```bash
+bash scripts/backup_release_state.sh \
+  --container geointel \
+  --output-root /mnt/user/appdata/geointel/backups \
+  --storage-path /mnt/user/appdata/geointel/storage \
+  --models-path /mnt/user/appdata/geointel/models \
+  --inventory-mode sha256
+```
+
+The backup is written atomically and contains a PostgreSQL custom-format dump,
+archive listing, Alembic/PostGIS metadata, critical table counts, optional
+storage/model inventories and SHA-256 checksums. An empty or known-default
+database password leaves the release gate failed. For an emergency backup
+before rotating that password, add `--allow-insecure-password`; the manifest
+still records the insecure state.
+
+Verify without changing any database:
+
+```bash
+bash scripts/verify_release_backup.sh \
+  --backup-dir /mnt/user/appdata/geointel/backups/<release-id>
+```
+
+Prove restoration only in a generated temporary database:
+
+```bash
+bash scripts/restore_release_backup_smoke.sh \
+  --backup-dir /mnt/user/appdata/geointel/backups/<release-id> \
+  --confirm-isolated-restore
+```
+
+The restore smoke rejects the production database name, compares PostGIS,
+Alembic and retained table counts, and removes its temporary database.