@camstack/system 1.2.199 → 1.2.201

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { It as BaseAddon, M as backupCapability, cn as EventCategory } from "../../dist-BSSH6C-h.mjs";
+import { It as BaseAddon, M as backupCapability, cn as EventCategory } from "../../dist-BmJNnb_s.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";
@@ -4294,14 +4294,17 @@ function previewNextRuns(cron, count, after) {
 /**
 * @durable class=config owner=backup-orchestrator
 *   write="`ensureDefault` auto-creates one row the first time a `backups` storage
-*     location is listed (enabled, retentionCount 7, cron `0 3 * * *`), and an operator
+*     location is listed (enabled, retentionCount 7, no cadence of its own), an operator
 *     edit rewrites it (`upsert` = delete + insert, carrying `last_run_at` forward so a
-*     label change does not reset the schedule baseline)"
+*     label change does not reset the baseline), and `recordAttempt` stamps
+*     `last_run_at` + `last_error` on every attempted write to the destination"
 *   retention="none — `delete(locationId)` exists but NOTHING calls it, so a policy row
 *     outlives the `StorageLocation` it names and the table only ever grows, by one row
 *     per backups location ever seen. Losing a row is recoverable: the next
 *     `listDestinations` pass re-creates it from the defaults, which silently discards
-*     the operator's own retention count and cron."
+*     the operator's own retention count. The legacy `cron` column is written NULL and
+*     never read — it scheduled nothing after 2026-07-28 and reading it made a
+*     destination advertise a nightly run nobody performed (D384)."
 */
 var BACKUP_DESTINATION_POLICIES = "backup_destination_policies";
 var BACKUP_DESTINATION_POLICIES_COLUMNS = [
@@ -4333,6 +4336,10 @@ var BACKUP_DESTINATION_POLICIES_COLUMNS = [
 	{
 		name: "last_run_at",
 		type: "INTEGER"
+	},
+	{
+		name: "last_error",
+		type: "TEXT"
 	}
 ];
 var BackupDestinationPolicyService = class {
@@ -4417,10 +4424,11 @@ var BackupDestinationPolicyService = class {
 	* pass so newly-added storage locations are surfaced as enabled
 	* destinations without an explicit configuration step.
 	*
-	* Defaults are passed by the orchestrator (currently:
-	* `retentionCount=7` + `cron='0 3 * * *'`) so a fresh destination
-	* starts running daily at 03:00 with 7 archives kept. Operator can
-	* tune both inline on the destinations table.
+	* Defaults are passed by the orchestrator (currently `retentionCount=7`).
+	* A fresh destination is enabled and keeps 7 archives; it gets NO cadence
+	* of its own — a destination runs when a schedule fans out to it, and
+	* seeding a cron here would advertise a nightly run nothing performs
+	* (D384).
 	*/
 	async ensureDefault(locationId, defaults) {
 		const existing = await this.get(locationId);
@@ -4428,12 +4436,32 @@ var BackupDestinationPolicyService = class {
 		const fresh = {
 			locationId,
 			enabled: true,
-			retentionCount: defaults.retentionCount,
-			...defaults.cron !== void 0 ? { cron: defaults.cron } : {}
+			retentionCount: defaults.retentionCount
 		};
 		await this.upsert(fresh);
 		return fresh;
 	}
+	/**
+	* Stamp the outcome of ONE attempted write to this destination.
+	*
+	* Read-modify-write on the policy row so the operator's `enabled`,
+	* `retentionCount` and `label` survive. A destination with no row yet
+	* gets one — an attempt on an unseen location must still be recorded, or
+	* the failure disappears with the process (which is exactly how a 03:00
+	* SMB refusal stayed invisible until the operator went looking).
+	*/
+	async recordAttempt(locationId, outcome, defaults) {
+		const { lastError: _cleared, ...carried } = await this.get(locationId) ?? {
+			locationId,
+			enabled: true,
+			retentionCount: defaults.retentionCount
+		};
+		await this.upsert({
+			...carried,
+			lastAttemptAt: outcome.attemptAt,
+			...outcome.error !== void 0 ? { lastError: outcome.error } : {}
+		});
+	}
 };
 function mapPolicyToRow(p) {
 	return {
@@ -4441,8 +4469,9 @@ function mapPolicyToRow(p) {
 		enabled: p.enabled ? 1 : 0,
 		retention_count: p.retentionCount,
 		label: p.label ?? null,
-		cron: p.cron ?? null,
-		last_run_at: p.lastRunAt ?? null
+		cron: null,
+		last_run_at: p.lastAttemptAt ?? null,
+		last_error: p.lastError ?? null
 	};
 }
 /**
@@ -4456,17 +4485,17 @@ function mapRowToPolicy(row) {
 	if (!locationId) return null;
 	const labelRaw = row["label"];
 	const label = typeof labelRaw === "string" && labelRaw.length > 0 ? labelRaw : void 0;
-	const cronRaw = row["cron"];
-	const cron = typeof cronRaw === "string" && cronRaw.length > 0 ? cronRaw : void 0;
 	const lastRunRaw = row["last_run_at"];
-	const lastRunAt = typeof lastRunRaw === "number" && lastRunRaw > 0 ? lastRunRaw : void 0;
+	const lastAttemptAt = typeof lastRunRaw === "number" && lastRunRaw > 0 ? lastRunRaw : void 0;
+	const lastErrorRaw = row["last_error"];
+	const lastError = typeof lastErrorRaw === "string" && lastErrorRaw.length > 0 ? lastErrorRaw : void 0;
 	return {
 		locationId,
 		enabled: row["enabled"] === 1 || row["enabled"] === true,
 		retentionCount: Number(row["retention_count"] ?? 0),
 		...label !== void 0 ? { label } : {},
-		...cron !== void 0 ? { cron } : {},
-		...lastRunAt !== void 0 ? { lastRunAt } : {}
+		...lastAttemptAt !== void 0 ? { lastAttemptAt } : {},
+		...lastError !== void 0 ? { lastError } : {}
 	};
 }
 //#endregion
@@ -4873,7 +4902,12 @@ var BackupRunQueue = class {
 		const progress = this.progressFor(record);
 		try {
 			const value = await this.executor(record.request, record.controller.signal, progress);
-			this.finish(record, record.controller.signal.aborted ? "cancelled" : "succeeded");
+			if (record.controller.signal.aborted) this.finish(record, "cancelled");
+			else {
+				const { destinationIds, completedDestinationIds, failedDestinationIds } = record.snapshot;
+				if (destinationIds.length > 0 && completedDestinationIds.length === 0) this.finish(record, "failed", `no destination accepted the archive (${(failedDestinationIds.length > 0 ? failedDestinationIds : destinationIds).join(", ")})`);
+				else this.finish(record, "succeeded");
+			}
 			record.resolveResult(value);
 		} catch (err) {
 			if (err instanceof BackupCancelledError || record.controller.signal.aborted) {
@@ -4946,7 +4980,8 @@ function requestSignature(request) {
 *     delete + insert: cron, enabled, the fan-out `location_ids`, `retention_count`,
 *     optional `data_sources`), plus a `last_run_at` stamp the orchestrator writes on
 *     every due tick BEFORE the archive runs, so an upload outliving the tick cannot
-*     fire the same schedule twice"
+*     fire the same schedule twice, and a `last_success_at` / `last_error` pair it
+*     writes AFTER the run resolves"
 *   retention="only the operator's `delete(id)` — no sweep, no expiry, and `retention_count`
 *     bounds the ARCHIVES at the destination, never these rows. Losing the table stops
 *     every scheduled backup silently: no cron remains to fire, and the fan-out sets and
@@ -4996,6 +5031,14 @@ var BACKUP_SCHEDULES_COLUMNS = [
 	{
 		name: "last_run_at",
 		type: "INTEGER"
+	},
+	{
+		name: "last_success_at",
+		type: "INTEGER"
+	},
+	{
+		name: "last_error",
+		type: "TEXT"
 	}
 ];
 var BackupScheduleService = class {
@@ -5074,7 +5117,9 @@ function mapScheduleToRow(s) {
 		location_ids: [...s.locationIds],
 		retention_count: s.retentionCount,
 		data_sources: s.dataSources ? [...s.dataSources] : null,
-		last_run_at: s.lastRunAt ?? null
+		last_run_at: s.lastAttemptAt ?? null,
+		last_success_at: s.lastSuccessAt ?? null,
+		last_error: s.lastError ?? null
 	};
 }
 /**
@@ -5102,7 +5147,11 @@ function mapRowToSchedule(row) {
 	const dataSourcesRaw = row["data_sources"];
 	const dataSources = dataSourcesRaw === null || dataSourcesRaw === void 0 ? void 0 : parseStringArray(dataSourcesRaw);
 	const lastRunRaw = row["last_run_at"];
-	const lastRunAt = typeof lastRunRaw === "number" && lastRunRaw > 0 ? lastRunRaw : void 0;
+	const lastAttemptAt = typeof lastRunRaw === "number" && lastRunRaw > 0 ? lastRunRaw : void 0;
+	const lastSuccessRaw = row["last_success_at"];
+	const lastSuccessAt = typeof lastSuccessRaw === "number" && lastSuccessRaw > 0 ? lastSuccessRaw : void 0;
+	const lastErrorRaw = row["last_error"];
+	const lastError = typeof lastErrorRaw === "string" && lastErrorRaw.length > 0 ? lastErrorRaw : void 0;
 	return {
 		id,
 		label: typeof row["label"] === "string" ? String(row["label"]) : "",
@@ -5111,7 +5160,9 @@ function mapRowToSchedule(row) {
 		locationIds: parseStringArray(row["location_ids"]),
 		retentionCount: Number(row["retention_count"] ?? 7),
 		...dataSources !== void 0 ? { dataSources } : {},
-		...lastRunAt !== void 0 ? { lastRunAt } : {}
+		...lastAttemptAt !== void 0 ? { lastAttemptAt } : {},
+		...lastSuccessAt !== void 0 ? { lastSuccessAt } : {},
+		...lastError !== void 0 ? { lastError } : {}
 	};
 }
 //#endregion
@@ -5273,13 +5324,6 @@ function selectBackupTargets(input) {
 * the panel used to expose).
 */
 var DEFAULT_RETENTION_COUNT = 7;
-/**
-* Default cron stamped on a freshly-discovered `backups` location.
-* Operators can edit it from the destination row; setting empty in
-* the editor flips the destination back to manual-only. Daily 03:00
-* server-local mirrors the previous global default.
-*/
-var DEFAULT_CRON = "0 3 * * *";
 var SCHEDULE_TICK_MS = 6e4;
 /**
 * Build the human-facing archive label. Every archive always carries
@@ -5323,9 +5367,11 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 	*/
 	stagingDir = "";
 	scheduleTimer = null;
+	/** Guards the disarmed-scheduler complaint to once per process. */
+	warnedSchedulerDisarmed = false;
 	/**
-	* Baseline used as the "after" anchor when a policy has a cron but
-	* has never run yet (no `lastRunAt`). Set on orchestrator boot so a
+	* Baseline used as the "after" anchor when a schedule has a cron but
+	* has never fired yet (no `lastAttemptAt`). Set on orchestrator boot so a
 	* pattern that fires every minute doesn't immediately replay every
 	* historical "missed" run from epoch 0.
 	*/
@@ -5419,7 +5465,37 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			}
 		}));
 		const lastSuccessByLoc = new Map(lastSuccess);
-		return locations.map((loc) => this.toDestinationWire(loc, policies.get(loc.id), lastSuccessByLoc.get(loc.id)));
+		const cadence = await this.cadenceByLocation();
+		return locations.map((loc) => this.toDestinationWire(loc, policies.get(loc.id), lastSuccessByLoc.get(loc.id), cadence.get(loc.id)));
+	}
+	/**
+	* Join the enabled schedules by the locations they fan out to.
+	* Comma-joined crons (a location can be targeted by several schedules),
+	* earliest next firing. Computed from `Date.now()` — an operator asking
+	* "when next" means from now, never from a stale run cursor.
+	*/
+	async cadenceByLocation() {
+		const out = /* @__PURE__ */ new Map();
+		if (!this.schedules) return out;
+		const schedules = await this.schedules.list().catch((err) => {
+			this.ctx.logger.warn("backup-orchestrator: schedule list failed — cadence unknown", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return [];
+		});
+		const now = Date.now();
+		for (const s of schedules) {
+			if (!s.enabled || s.cron.trim().length === 0) continue;
+			const next = this.safeNextDue(s.cron, now);
+			for (const id of s.locationIds) {
+				const prev = out.get(id);
+				const crons = prev ? [...prev.crons, s.cron] : [s.cron];
+				const nextRunAt = next === void 0 ? prev?.nextRunAt : prev?.nextRunAt === void 0 ? next : Math.min(prev.nextRunAt, next);
+				out.set(id, {
+					crons,
+					...nextRunAt !== void 0 ? { nextRunAt } : {}
+				});
+			}
+		}
+		return out;
 	}
 	async fetchBackupLocations() {
 		try {
@@ -5450,10 +5526,7 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 		for (const id of locationIds) {
 			if (out.has(id)) continue;
 			try {
-				const fresh = await this.policies.ensureDefault(id, {
-					retentionCount: DEFAULT_RETENTION_COUNT,
-					cron: DEFAULT_CRON
-				});
+				const fresh = await this.policies.ensureDefault(id, { retentionCount: DEFAULT_RETENTION_COUNT });
 				out.set(id, fresh);
 			} catch (err) {
 				this.ctx.logger.warn("backup-orchestrator: ensureDefault failed", { meta: {
@@ -5469,11 +5542,10 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 		return {
 			locationId,
 			enabled: true,
-			retentionCount: DEFAULT_RETENTION_COUNT,
-			cron: DEFAULT_CRON
+			retentionCount: DEFAULT_RETENTION_COUNT
 		};
 	}
-	toDestinationWire(loc, policy, latest) {
+	toDestinationWire(loc, policy, latest, cadence) {
 		const effective = policy ?? this.fallbackPolicy(loc.id);
 		const subId = extractSlug(loc.id);
 		const displayName = effective.label && effective.label.length > 0 ? effective.label : loc.displayName;
@@ -5490,9 +5562,10 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			...effective.label !== void 0 ? { label: effective.label } : {},
 			...latest !== void 0 ? { lastSuccessAt: latest.createdAt } : {},
 			...latest !== void 0 ? { lastSuccessSizeBytes: latest.sizeBytes } : {},
-			...effective.cron !== void 0 ? { cron: effective.cron } : {},
-			...effective.lastRunAt !== void 0 ? { lastRunAt: effective.lastRunAt } : {},
-			...effective.cron !== void 0 && effective.cron.trim().length > 0 ? { nextRunAt: this.safeNextDue(effective.cron, effective.lastRunAt) } : {}
+			...cadence !== void 0 ? { cron: cadence.crons.join(", ") } : {},
+			...cadence?.nextRunAt !== void 0 ? { nextRunAt: cadence.nextRunAt } : {},
+			...effective.lastAttemptAt !== void 0 ? { lastAttemptAt: effective.lastAttemptAt } : {},
+			...effective.lastError !== void 0 ? { lastError: effective.lastError } : {}
 		};
 	}
 	/**
@@ -5654,7 +5727,10 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 		if (!this.systemBackup) throw new Error("orchestrator not initialized");
 		const targets = await this.resolveTargets(input.destinations !== void 0 ? [...input.destinations] : void 0);
 		if (targets.length === 0) {
-			this.ctx.logger.warn("backup trigger: no destinations selected");
+			this.ctx.logger.warn("backup trigger: no destinations selected — this archive is being dropped", { meta: {
+				requestedDestinationIds: input.destinations !== void 0 ? [...input.destinations] : [],
+				label: input.label ?? null
+			} });
 			return [];
 		}
 		progress.setDestinations(targets.map((t) => t.id));
@@ -5698,6 +5774,7 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 					});
 					entries.push(stored);
 					progress.destinationCompleted(dest.id);
+					await this.recordDestinationOutcome(dest.id, createdAt);
 					this.ctx.eventBus.emit({
 						id: randomUUID(),
 						timestamp: /* @__PURE__ */ new Date(),
@@ -5715,10 +5792,12 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 				} catch (err) {
 					if (err instanceof BackupCancelledError) continue;
 					progress.destinationFailed(dest.id);
+					const message = err instanceof Error ? err.message : String(err);
 					this.ctx.logger.error("backup trigger: destination failed", { meta: {
 						destinationId: dest.id,
-						error: err instanceof Error ? err.message : String(err)
+						error: message
 					} });
+					await this.recordDestinationOutcome(dest.id, Date.now(), message);
 				}
 			}
 			return entries;
@@ -5837,30 +5916,29 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 	/**
 	* Upsert the per-destination policy row. Used by the admin-UI
 	* destinations table — toggle enabled / change retention / set
-	* label / set cron schedule. No-ops with a logged warning if the
+	* label. No-ops with a logged warning if the
 	* settings backend lacks structured-table support (no persistence
 	* available).
 	*
-	* Validates `cron` server-side: a malformed expression rejects the
-	* upsert with an actionable error so the operator sees the problem
-	* at save time instead of at scheduler-tick time. Empty / undefined
-	* `cron` clears any prior schedule (manual-only).
+	* There is deliberately NO cadence here. A destination does not run on
+	* its own timer — a schedule fans out to it — and the `cron` this method
+	* used to accept had scheduled nothing since 2026-07-28 while still being
+	* rendered as "daily at 03:00" (D384, and D62's "a switch that writes a
+	* store nobody reads").
 	*/
 	async upsertDestinationPolicy(input) {
 		if (!this.policies) {
 			this.ctx.logger.warn("backup upsertDestinationPolicy: no settings-store backend — change will not persist", { meta: { locationId: input.locationId } });
 			return;
 		}
-		const cron = typeof input.cron === "string" ? input.cron.trim() : "";
-		if (cron.length > 0 && !isValidCron(cron)) throw new Error(`Invalid cron expression: "${cron}"`);
 		const existing = await this.policies.get(input.locationId).catch(() => null);
 		await this.policies.upsert({
 			locationId: input.locationId,
 			enabled: input.enabled,
 			retentionCount: input.retentionCount,
 			...input.label !== void 0 ? { label: input.label } : {},
-			...cron.length > 0 ? { cron } : {},
-			...existing?.lastRunAt !== void 0 ? { lastRunAt: existing.lastRunAt } : {}
+			...existing?.lastAttemptAt !== void 0 ? { lastAttemptAt: existing.lastAttemptAt } : {},
+			...existing?.lastError !== void 0 ? { lastError: existing.lastError } : {}
 		});
 	}
 	/**
@@ -5998,6 +6076,29 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 		if (selection.targets.length === 0 && selection.skippedDisabled.length > 0) throw new Error(`every selected backup destination is disabled (${selection.skippedDisabled.join(", ")}) — enable its storage location on the Storage screen, or choose another destination. Refusing to write an archive to a location the operator turned off.`);
 		return selection.targets.map((t) => ({ id: t.id }));
 	}
+	/**
+	* Persist the outcome of one attempted write to one destination.
+	*
+	* Best-effort by design: an unavailable settings backend must not turn a
+	* successful backup into a failed one. But it is LOGGED when it cannot be
+	* written — a status field that silently stops being updated is the whole
+	* defect this method exists to close.
+	*/
+	async recordDestinationOutcome(destinationId, attemptAt, error) {
+		if (!this.policies) return;
+		try {
+			await this.policies.recordAttempt(destinationId, {
+				attemptAt,
+				...error !== void 0 ? { error } : {}
+			}, { retentionCount: DEFAULT_RETENTION_COUNT });
+		} catch (err) {
+			this.ctx.logger.warn("backup: could not persist the destination outcome", { meta: {
+				destinationId,
+				outcome: error === void 0 ? "succeeded" : "failed",
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+	}
 	startScheduleTimer() {
 		if (this.scheduleTimer) return;
 		this.scheduleTimer = setInterval(() => {
@@ -6012,19 +6113,25 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 	/**
 	* Schedule-driven backup scheduling. Walks every enabled backup
 	* SCHEDULE (the N:M entry), computes the next due time after
-	* `lastRunAt` (or the orchestrator's first-tick baseline if never
+	* `lastAttemptAt` (or the orchestrator's first-tick baseline if never
 	* run), and fires a SINGLE archive fanned out to ALL of the
 	* schedule's `locationIds` when due — with the schedule's per-entry
 	* retention applied to each. Each schedule keeps its own cadence.
 	*
 	* Errors per schedule are isolated; one misconfigured cron doesn't
-	* block the others. The schedule's `lastRunAt` is updated BEFORE the
+	* block the others. The schedule's `lastAttemptAt` is updated BEFORE the
 	* trigger to dedupe (the tick runs every SCHEDULE_TICK_MS — without
 	* the up-front update a long-running upload could overlap with the
 	* next tick's same-due check).
 	*/
 	async onScheduleTick() {
-		if (!this.schedules) return;
+		if (!this.schedules) {
+			if (!this.warnedSchedulerDisarmed) {
+				this.warnedSchedulerDisarmed = true;
+				this.ctx.logger.error("backup scheduler is DISARMED — no settings backend, so no schedule can fire");
+			}
+			return;
+		}
 		const schedules = await this.schedules.list();
 		const now = Date.now();
 		for (const s of schedules) {
@@ -6032,7 +6139,7 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			if (s.locationIds.length === 0) continue;
 			let due;
 			try {
-				due = computeNextDue(s.cron, s.lastRunAt ?? this.scheduleBaselineAt);
+				due = computeNextDue(s.cron, s.lastAttemptAt ?? this.scheduleBaselineAt);
 			} catch (err) {
 				this.ctx.logger.warn("Invalid cron — skipping schedule", { meta: {
 					scheduleId: s.id,
@@ -6044,36 +6151,76 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			if (due === null || due > now) continue;
 			const stamped = {
 				...s,
-				lastRunAt: now
+				lastAttemptAt: now
 			};
 			try {
 				await this.schedules.upsert(stamped);
 			} catch (err) {
 				this.ctx.logger.warn("Failed to persist scheduled-run timestamp", { meta: {
 					scheduleId: s.id,
+					scheduleLabel: s.label,
+					destinationIds: [...s.locationIds],
 					error: err instanceof Error ? err.message : String(err)
 				} });
 			}
-			try {
-				this.ctx.logger.info("Scheduled backup firing", { meta: {
-					scheduleId: s.id,
-					label: s.label,
-					locationIds: s.locationIds,
-					cron: s.cron,
-					dueAt: due
-				} });
-				await this.triggerBackup({
-					destinations: [...s.locationIds],
-					...s.dataSources && s.dataSources.length > 0 ? { locations: [...s.dataSources] } : {},
-					label: s.label,
-					retentionCount: s.retentionCount
-				});
-			} catch (err) {
-				this.ctx.logger.error("Scheduled backup failed", { meta: {
-					scheduleId: s.id,
-					error: err instanceof Error ? err.message : String(err)
-				} });
-			}
+			this.ctx.logger.info("Scheduled backup firing", { meta: {
+				scheduleId: s.id,
+				label: s.label,
+				destinationIds: [...s.locationIds],
+				cron: s.cron,
+				dueAt: due
+			} });
+			await this.runScheduledBackup(stamped, now);
+		}
+	}
+	/**
+	* Fire one schedule and RECORD what happened to it, naming every
+	* destination. Three outcomes, three different persisted states —
+	* because "fired" and "backed up" were the same field until D384:
+	*
+	*   - archive landed somewhere → `lastSuccessAt`, `lastError` cleared;
+	*   - the run threw, or landed nowhere → `lastError`, no success stamp;
+	*   - the stamp could not be written → logged, named, not swallowed.
+	*/
+	async runScheduledBackup(schedule, firedAt) {
+		const destinationIds = [...schedule.locationIds];
+		let failure;
+		try {
+			const result = await this.triggerBackup({
+				destinations: destinationIds,
+				...schedule.dataSources && schedule.dataSources.length > 0 ? { locations: [...schedule.dataSources] } : {},
+				label: schedule.label,
+				retentionCount: schedule.retentionCount
+			});
+			if (result.entries.length === 0 && !result.cancelled) failure = `no destination accepted the archive (${destinationIds.join(", ")})`;
+		} catch (err) {
+			failure = err instanceof Error ? err.message : String(err);
+		}
+		if (failure === void 0) this.ctx.logger.info("Scheduled backup completed", { meta: {
+			scheduleId: schedule.id,
+			label: schedule.label,
+			destinationIds
+		} });
+		else this.ctx.logger.error("Scheduled backup failed", { meta: {
+			scheduleId: schedule.id,
+			label: schedule.label,
+			destinationIds,
+			error: failure
+		} });
+		if (!this.schedules) return;
+		const { lastError: _cleared, ...carried } = schedule;
+		try {
+			await this.schedules.upsert({
+				...carried,
+				...failure === void 0 ? { lastSuccessAt: firedAt } : { lastError: failure }
+			});
+		} catch (err) {
+			this.ctx.logger.warn("Failed to persist the scheduled-run outcome", { meta: {
+				scheduleId: schedule.id,
+				label: schedule.label,
+				destinationIds,
+				error: err instanceof Error ? err.message : String(err)
+			} });
 		}
 	}
 	async listSchedules() {
@@ -6092,7 +6239,9 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 				locationIds: [...s.locationIds],
 				retentionCount: s.retentionCount,
 				...s.dataSources !== void 0 ? { dataSources: [...s.dataSources] } : {},
-				...s.lastRunAt !== void 0 ? { lastRunAt: s.lastRunAt } : {},
+				...s.lastAttemptAt !== void 0 ? { lastAttemptAt: s.lastAttemptAt } : {},
+				...s.lastSuccessAt !== void 0 ? { lastSuccessAt: s.lastSuccessAt } : {},
+				...s.lastError !== void 0 ? { lastError: s.lastError } : {},
 				...nextRunAt !== void 0 ? { nextRunAt } : {}
 			};
 		});
@@ -6111,7 +6260,9 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			locationIds: [...input.locationIds],
 			retentionCount: input.retentionCount,
 			...input.dataSources && input.dataSources.length > 0 ? { dataSources: [...input.dataSources] } : {},
-			...existing?.lastRunAt !== void 0 ? { lastRunAt: existing.lastRunAt } : {}
+			...existing?.lastAttemptAt !== void 0 ? { lastAttemptAt: existing.lastAttemptAt } : {},
+			...existing?.lastSuccessAt !== void 0 ? { lastSuccessAt: existing.lastSuccessAt } : {},
+			...existing?.lastError !== void 0 ? { lastError: existing.lastError } : {}
 		};
 		await this.schedules.upsert(next);
 		let nextRunAt;
@@ -6127,7 +6278,9 @@ var BackupOrchestratorAddon = class extends BaseAddon {
 			locationIds: [...next.locationIds],
 			retentionCount: next.retentionCount,
 			...next.dataSources !== void 0 ? { dataSources: [...next.dataSources] } : {},
-			...next.lastRunAt !== void 0 ? { lastRunAt: next.lastRunAt } : {},
+			...next.lastAttemptAt !== void 0 ? { lastAttemptAt: next.lastAttemptAt } : {},
+			...next.lastSuccessAt !== void 0 ? { lastSuccessAt: next.lastSuccessAt } : {},
+			...next.lastError !== void 0 ? { lastError: next.lastError } : {},
 			...nextRunAt !== void 0 ? { nextRunAt } : {}
 		};
 	}

package/dist/builtins/backup-orchestrator/destination-policy.d.ts

@@ -19,16 +19,19 @@ export interface BackupDestinationPolicy {
     readonly retentionCount: number;
     readonly label?: string;
     /**
-     * Cron expression for scheduled backups to this destination. When
-     * undefined / empty the destination only receives backups from
-     * manual `runNow()` calls. Each destination has its own cadence —
-     * an offsite SFTP can run weekly while local stays nightly. The
-     * orchestrator parses with `cron-parser` (5-field POSIX cron, no
-     * seconds field).
+     * ms-epoch of the last time a run ATTEMPTED to write an archive here,
+     * whatever the outcome. Never a success stamp — `lastError` says whether
+     * the attempt landed, and the newest manifest entry says when one last
+     * did. Rows written before 2026-07-28 carry the old per-location
+     * scheduler's stamp, which had exactly this meaning.
      */
-    readonly cron?: string;
-    /** ms-epoch of the last successful backup completion to this destination. */
-    readonly lastRunAt?: number;
+    readonly lastAttemptAt?: number;
+    /**
+     * Why the last attempt failed, verbatim from the provider. Cleared on the
+     * next attempt that lands. A destination that has never been written to
+     * has neither field, and that is REPORTED as never — D384.
+     */
+    readonly lastError?: string;
 }
 export declare const BACKUP_DESTINATION_POLICIES_COLUMNS: readonly CollectionColumn[];
 export declare class BackupDestinationPolicyService {
@@ -58,13 +61,28 @@ export declare class BackupDestinationPolicyService {
      * pass so newly-added storage locations are surfaced as enabled
      * destinations without an explicit configuration step.
      *
-     * Defaults are passed by the orchestrator (currently:
-     * `retentionCount=7` + `cron='0 3 * * *'`) so a fresh destination
-     * starts running daily at 03:00 with 7 archives kept. Operator can
-     * tune both inline on the destinations table.
+     * Defaults are passed by the orchestrator (currently `retentionCount=7`).
+     * A fresh destination is enabled and keeps 7 archives; it gets NO cadence
+     * of its own — a destination runs when a schedule fans out to it, and
+     * seeding a cron here would advertise a nightly run nothing performs
+     * (D384).
      */
     ensureDefault(locationId: string, defaults: {
         retentionCount: number;
-        cron?: string;
     }): Promise<BackupDestinationPolicy>;
+    /**
+     * Stamp the outcome of ONE attempted write to this destination.
+     *
+     * Read-modify-write on the policy row so the operator's `enabled`,
+     * `retentionCount` and `label` survive. A destination with no row yet
+     * gets one — an attempt on an unseen location must still be recorded, or
+     * the failure disappears with the process (which is exactly how a 03:00
+     * SMB refusal stayed invisible until the operator went looking).
+     */
+    recordAttempt(locationId: string, outcome: {
+        attemptAt: number;
+        error?: string;
+    }, defaults: {
+        retentionCount: number;
+    }): Promise<void>;
 }

package/dist/builtins/backup-orchestrator/schedule-store.d.ts

@@ -15,8 +15,18 @@ export interface BackupSchedule {
     readonly locationIds: readonly string[];
     readonly retentionCount: number;
     readonly dataSources?: readonly string[];
-    /** ms-epoch of the last successful run. */
-    readonly lastRunAt?: number;
+    /**
+     * ms-epoch of the last tick that FIRED this schedule. Stamped BEFORE the
+     * archive runs — it is the dedupe anchor and the cron's "after" cursor —
+     * so it means "attempted", never "succeeded". It was documented as the
+     * latter and rendered as "last run", which is how a schedule whose only
+     * destination refused every byte read as a healthy nightly backup (D384).
+     */
+    readonly lastAttemptAt?: number;
+    /** ms-epoch of the last fired run that landed at ≥1 destination. */
+    readonly lastSuccessAt?: number;
+    /** Why the last fired run failed, verbatim. Cleared by the next success. */
+    readonly lastError?: string;
 }
 export declare const BACKUP_SCHEDULES_COLUMNS: readonly CollectionColumn[];
 export declare class BackupScheduleService {

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-HAP38XvL.js");
+const require_dist = require("../../dist-CcV3k-hD.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {