Exercise 3: "We Have Snapshots, We're Covered" — Possible Solution
====================================================================

The gap:

Per the chapter's own warn-box, "a snapshot typically lives on the
same physical disk or pool as the data it's snapshotting -- it
protects against 'I made a mistake' or 'this update broke something,'
but not against the disk itself failing entirely." Nightly Btrfs
snapshots genuinely do protect this team against a real and common
category of incident: someone accidentally deletes or corrupts data,
or a bad deploy/update damages something, and the team can roll back
to the prior night's snapshot to recover it. That part of "we're
covered" is true.

What it does not cover is any failure of the underlying storage
itself -- a failing drive, a destroyed RAID array, a stolen or
physically damaged server, a datacenter-level incident, or anything
else that takes out the disk or pool the snapshots themselves live
on. Since every one of those nightly snapshots is stored on that same
disk/pool as the live data, a single storage-level failure destroys
the live data and every one of its snapshots simultaneously -- the
snapshots provide zero protection in exactly the scenario where the
team would need protection most.

The real gap in the team's reasoning is treating "we can roll back to
an earlier point in time" (which snapshots genuinely provide) as
equivalent to "our data is backed up" (which requires a genuinely
separate copy on genuinely separate storage, which snapshots alone do
not provide). The two are different guarantees, and the team's setup
only has the first one.

What should change:

The team should keep their snapshot strategy for its real value
(fast, cheap rollback from mistakes and bad updates) but add an
actual backup -- data copied to physically separate storage, ideally
in a separate location -- to cover the storage-failure case snapshots
were never designed to address.

WHY THIS WORKS AS AN ANSWER
------------------------------
This distinguishes what snapshots genuinely do protect against
(mistakes, bad updates) from what they don't (storage failure),
rather than dismissing snapshots as worthless, and names the specific
missing piece (separate storage) the chapter's own warn-box points to.