The restore drill runs monthly, unattended

Everyone snapshots. Almost nobody restores until the day it matters: which is the day you find out whether the backup you trusted actually boots.

So the drill runs monthly, unattended. A cron fires an agent that copies the production container from its latest snapshot into a scratch container: POST /copy with source_snapshot: and then actually checks: the app answers on its URL, the database opens, the newest record is from this week, not March. Pass or fail, a notification lands on your phone with the verdict, and the scratch copy is deleted either way.

The restore path gets exercised twelve times a year by a process that can't skip it because it's busy.