A backup is a claim. A restore is a proof.

Somewhere in your infrastructure there is a backup job that has run green for months. You believe it protects you. What you actually have is a scheduled process that exits zero. Whether the artifact it produces can become a working system again is a separate question, and most organizations have never asked it under conditions that count.

The distinction is between a claim and a proof. A configured backup claims recovery is possible. A performed restore proves it. Between the two live all the classic failures: the credential that expired, the volume that silently stopped mounting, the schema that drifted, the restore procedure that exists only in the head of someone who left. None of these announce themselves. They wait for the one day the claim gets called.

In our clinical work the rule is written into the engagement: a backup exists only when a restore has actually been performed, so restores are rehearsed before go-live, not improvised after the first loss. The asymmetry justifies the ceremony. A missed deadline can be renegotiated. A practice's patient records, gone, cannot. When the downside is unrecoverable, the safety mechanism does not get to remain a hypothesis.

The same rule, everywhere

Once you see the claim-versus-proof gap, you find it across the whole discipline. The alert that has never fired is a claim about monitoring. The failover that has never failed over is a claim about resilience. The incident-response plan that has never been run is a claim about readiness. We ran ours as a live tabletop this month, a simulated credential leak exercised end to end, and the plan came back with corrections, which is the point: the exercise converts a document into evidence, and the corrections are the yield.

This is the operational cousin of an argument we make elsewhere about software: a test that has never run catches nothing, a property that was never checked holds nothing, and a safety mechanism that has never fired protects nothing. Configured is not the same as true. The systems we trust are the ones that have already survived a rehearsal of the bad day.