The problem

Tuesday, 14:20. A developer runs a cleanup script against the wrong database and deletes 3 million invoices from a 2 TB PostgreSQL. The replicas delete them too, a few milliseconds later.

The team has a nightly pg_dump. Nobody has restored it in a year. The first try takes 9 hours and fails at 80% on a full disk. The second try works, and the invoices created since 2 a.m. are gone.

The board now asks for numbers: how much data can the company lose, how long a restore takes, and proof that it works.