As for docs, I prefer not to put these "sensitive" things there. I don't want our users to run commands by copy/pasting. This required some debugging before I ran those commands. One has to actually figure which migrations to run by inspecting the code.

The question now is if/how this can be prevented in the future
For starters it might be a good idea to add this info to the documentation for the Matomo app?

• Run MySQL command UPDATE option SET option_value = "4.2.0" WHERE option_name = "version_core";
• sudo -E -u www-data -- /app/code/console core:update

Works now. This is document upstream in https://matomo.org/faq/how-to-update/faq_179/

mysql> describe brute_force_log;
+--------------------+-------------+------+-----+---------+----------------+
| Field              | Type        | Null | Key | Default | Extra          |
+--------------------+-------------+------+-----+---------+----------------+
| id_brute_force_log | bigint      | NO   | PRI | NULL    | auto_increment |
| ip_address         | varchar(60) | YES  | MUL | NULL    |                |
| attempted_at       | datetime    | NO   |     | NULL    |                |
+--------------------+-------------+------+-----+---------+----------------+
3 rows in set (0.04 sec)

Or is there a way to clone an older version of the app to another server?

I think there may be ways to install older versions of apps using the Cloudron CLI, but having never actually used it I couldn't tell you how.

Or is there a way to clone an older version of the app to another server?

/app/code#  sudo -E -u www-data -- /app/code/console core:update --yes

Everything is already up to date.

I'll try to revert to an older backup or set up a clone from an older backup

1. Revert to old backup
2. Create a Clone from old backup to a new location
3. Try to update the clone. Is it reproducible?

sudo -E -u www-data -- /app/code/console core:update --yes

If you need to be up and running quickly, maybe consider restoring the app to the backup before the update.