Operations

Audience: Studio operators and administrators

Studio separates ordinary content administration from infrastructure and database lifecycle work. An administrator account alone does not grant access to every recovery operation, and changing a site mode never changes D1 by itself.

Operational controls

• STUDIO_SITE_MODE selects the application’s broad availability boundary.
• Maintenance & Recovery is a separately enabled, exact-IP and token-protected surface for backups, restores, lifecycle operations, access recovery, and destructive work.
• The Studio database and Edge database have independent lifecycle state and independent backup artifacts.
• Studio never changes Worker environment gates, site mode, or Edge integration mode automatically after an operation.

Safe default

Keep a healthy installation in operational mode and keep the operations surface disabled when it is not needed. Before planned schema or destructive work, retain an independently reviewed backup, switch to the required mode, perform one bounded workflow, verify the result, and explicitly return to the normal configuration.

For Edge maintenance, stop public Edge writes before touching the Edge database. STUDIO_SITE_MODE=maintenance blocks Studio APIs but cannot stop a separately deployed Edge Worker.