# Storage operations

Production uses one SQLite writer on persistent `ReadWriteOnce` storage.
Production serve disables automatic migration and refuses schema drift or an
in-memory database.

```bash
approval-engine migrate --db /data/approvals.sqlite
approval-engine verify --db /data/approvals.sqlite
approval-engine backup --db /data/approvals.sqlite --output /backup/approval.sqlite
```

Migration is repeatable and sets an explicit `PRAGMA user_version`. Backup uses
SQLite's online backup API, verifies `PRAGMA integrity_check`, writes mode 0600,
and refuses to overwrite a target.

Restore is a stopped-single-writer operation:

1. Stop the StatefulSet and confirm no approval-engine or migration process has
   the PVC open.
2. Preserve the failed database and its `-wal`/`-shm` companions for analysis.
3. Copy the verified backup to a new database path with owner 10001 and mode
   0600. Do not merge a backup with old WAL files.
4. Run `verify`, then `migrate` if the release schema is newer, then `verify`
   again.
5. Start exactly one replica and prove approval/entry/outbox counts, readiness,
   claim retrieval, and idempotent audit drain before reopening callers.

Approval mutation and outbox insertion share `BEGIN IMMEDIATE` and one commit;
a failed outbox insert rolls the mutation back. Delivery occurs afterward and
does not roll back a committed mutation.

## Schema v3 — declared PDP-path intent

`GH-DEC-2026-008` added `approvals.pdp_path` (INTEGER NOT NULL DEFAULT 0).
Migration is the usual additive `ALTER TABLE`; run `approval-engine migrate`
before a production start, which refuses an unmigrated store.

Legacy rows default to `0`. Intent is **not** back-filled from a recorded
`pdp_digest`: an approval issued before the ruling was never declared for the
PDP path, and inferring the declaration from an incidental digest would
manufacture a statement nobody made. Such approvals stay usable by consumers in
this engine's own vocabulary and are simply not usable on the PDP path — which
is the ruling's intended cost, not a migration defect.