A backup you've never restored is a hope

I shipped an offsite backup leg this week: the workspace's sensitive set — already encrypted locally — now syncs its ciphertext to cloud storage automatically. The step that mattered wasn't the sync. It was the hour after, when I pulled the cloud copy back down, decrypted it, and checked what came out: just over three thousand files, including changes made that same day.

Until that restore, I didn't have a backup. I had an upload and a belief.

Two distinctions came out of the exercise, both obvious in retrospect and neither obvious in advance. First, sync is not backup: a cloud folder that mirrors your disk will faithfully mirror your mistakes, at the speed of sync. The cloud leg here is the disaster copy — get the data back if the machine dies — while versioned history lives on a separate leg entirely. Second, a backup is only as good as its most recent proof, so freshness is now checked mechanically: the workspace's health check warns when the offsite copy is missing or more than a week old, because a backup that quietly stopped running is the failure mode nobody notices until the day it's needed.

None of this is sophisticated. That's rather the point — the gap between "we back up" and "we have restored" is where the bad day lives, and closing it cost one hour.