Back up the complete installation
Retain the database, exact .env and APP_KEY, private application with dependencies, sibling public_html/, durable storage, attachments, extension trust, licence state and recovery journals. An external licence configuration directory needs its own explicit backup location.
Host-managed DNS, certificates, database grants, cron, web-server settings, external storage and remote provider records require separate inventory. A local restore does not reverse remote payments, mail, registrar or hosting operations.
Create and verify a private snapshot
From the private application directory, the supplied snapshot tool supports:
php tools/platform-upgrade-backup.php --destination=/ABSOLUTE/PRIVATE/NEW-SNAPSHOT
Replace the destination with a new private path outside both application roots and every public web root. Keep the returned manifest_sha256 independently from the snapshot and store the backup as confidential data: it includes the encryption key and configuration.
Use the exact release's tools/installation-restore.php instructions with that independently retained digest to verify and restore into a new private directory. A MySQL recovery needs a separate empty target database, restricted credentials and the documented event-scheduler precautions.
Rehearse before promotion
The restore stays quarantined. Do not start its web server, queues, cron or providers automatically. Verify expected financial/customer counts, attachments, decryption, licence state and recovery evidence. Preserve APP_KEY; never generate a replacement to fix encrypted data. Promotion and licence transfer are separate reviewed actions after reconciling external activity.