Govern upgrades and recovery

Control compatibility, maintenance windows and rollback decisions.

• Inventory custom modules before an upgrade.
• Test backup restoration, not only backup creation.
• Keep a decision log for production changes.