Back up a consistent installation
Retain the database, private application configuration, original APP_KEY, private storage/uploads, trusted extension metadata/files, licence preparation directory and exact release/package inventory. SMTP/provider credentials and the hosting vault are encrypted under that application key; a database alone is insufficient recovery material. Keep backups outside public web roots with restricted access.
Take a verified backup before enabling an extension migration, signed application replacement or irreversible provider lifecycle policy. An acknowledgement checkbox records your decision; it does not create or validate a usable backup for you.
Rehearse restoration
Use the release's documented backup/restore tools and a separate isolated hostname/database. Restore private/public sibling layout, permissions and the same key. Keep outbound mail/provider writes and production scheduling controlled so the restored copy cannot charge, provision or send as the original. A restored copy does not authorise a duplicate licensed installation; follow the genuine transfer/recovery process.
Check authentication/MFA, stored encrypted data, invoice/PDF reads, old provider markers, licence identity and a dry-run of operational health. Record the actual restoration evidence. Do not describe root/host recovery as accepted merely because a local database import succeeded.
Integrity checks
php artisan emaila:doctor --integrity checks declared installed extension hashes without executing their code. Signed distributions also validate their required runtime inventory. Changed files require restoring the exact reviewed source; editing the hash inventory or disabling verification is not a repair. A valid signature establishes origin/integrity, not that privileged code is safe.
Uncertain provider state
A filesystem/database rollback does not undo external payments, registrar purchases, sent mail or deleted hosting accounts. Preserve submission markers and reconcile actual external state before resuming workers. Never restore an old database and automatically replay every pending irreversible action.