@fabrika/provider-zerops 0.8.0 → 0.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/provider-zerops",
-	"version": "0.8.0",
+	"version": "0.8.2",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -43,14 +43,14 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth": "0.8.0",
-		"@fabrika/auth-core": "0.8.0",
-		"@fabrika/email": "0.8.0",
-		"@fabrika/iam-contract": "0.8.0",
-		"@fabrika/installation-init": "0.8.0",
-		"@fabrika/operations-contract": "0.8.0",
-		"@fabrika/provider-contract": "0.8.0",
-		"@fabrika/proxy-core": "0.8.0",
+		"@fabrika/auth": "0.8.2",
+		"@fabrika/auth-core": "0.8.2",
+		"@fabrika/email": "0.8.2",
+		"@fabrika/iam-contract": "0.8.2",
+		"@fabrika/installation-init": "0.8.2",
+		"@fabrika/operations-contract": "0.8.2",
+		"@fabrika/provider-contract": "0.8.2",
+		"@fabrika/proxy-core": "0.8.2",
 		"yaml": "^2.9.1"
 	}
 }

package/src/api/client.ts

@@ -5,6 +5,7 @@ import { waitForProcess } from './polling'
 import {
 	appVersionListSchema,
 	appVersionSchema,
+	backupConfigSchema,
 	importResultSchema,
 	integrationTokenSchema,
 	logAccessSchema,
@@ -364,6 +365,17 @@ export const createZeropsApi = (options: ZeropsApiOptions): ZeropsApi => {
 			return readResponse('configure custom autoscaling', processNilSchema, payload).process ?? null
 		},
 
+		getBackupConfig: async ({ serviceId, signal }) =>
+			readResponse('list backups', backupConfigSchema, await request('list backups', 'GET', `/service-stack/${serviceId}/backup`, { signal })),
+
+		configureBackup: async ({ serviceId, backupPeriod, retentionPolicy, signal }) => {
+			const payload = await request('configure backup', 'PUT', `/service-stack/${serviceId}/backup-config`, {
+				body: { backupPeriod, retentionPolicy },
+				signal,
+			})
+			return readResponse('configure backup', processNilSchema, payload).process ?? null
+		},
+
 		getService: async ({ serviceId, signal }) =>
 			readResponse('get service', serviceSchema, await request('get service', 'GET', `/service-stack/${serviceId}`, { signal })),
 

package/src/api/readers.ts

@@ -3,6 +3,8 @@ import { withoutSensitiveContent } from './service-env-response'
 import type {
 	ZeropsAppVersion,
 	ZeropsAppVersionStatus,
+	ZeropsBackupConfig,
+	ZeropsBackupRetentionPolicy,
 	ZeropsImportResult,
 	ZeropsIntegrationToken,
 	ZeropsLogAccess,
@@ -170,6 +172,33 @@ export const serviceSchema = z.object({
 	currentAutoscaling: optional(serviceAutoscalingSchema),
 }).transform(({ activeAppVersion, ...service }): ZeropsService => ({ ...service, activeAppVersionId: activeAppVersion?.id }))
 
+const backupCountSchema = z.number().int().nonnegative()
+
+/** Strict like the custom autoscaling, for the same reason: it is sent back whole, so no field may read as absent. */
+const backupRetentionPolicySchema = z.object({
+	maxTotalFiles: backupCountSchema,
+	maxTotalGiB: backupCountSchema,
+	// A Go API may serialise an empty list as null; read as the empty list it is.
+	protectedTags: z.array(z.string()).nullable().transform((tags) => tags ?? []),
+	minDaily: backupCountSchema,
+	maxDaily: backupCountSchema,
+	minWeekly: backupCountSchema,
+	maxWeekly: backupCountSchema,
+	minMonthly: backupCountSchema,
+	maxMonthly: backupCountSchema,
+}) satisfies z.ZodType<ZeropsBackupRetentionPolicy, z.ZodTypeDef, unknown>
+
+/** A service's own retention that does not parse fails the whole read: reading it as absent would send the default over it. */
+export const backupConfigSchema = z.object({
+	backupPeriod: z.string(),
+	defaultRetentionPolicy: backupRetentionPolicySchema,
+	retentionPolicy: backupRetentionPolicySchema.nullish(),
+}).transform(({ backupPeriod, defaultRetentionPolicy, retentionPolicy }): ZeropsBackupConfig => ({
+	backupPeriod,
+	defaultRetentionPolicy,
+	...(retentionPolicy === null || retentionPolicy === undefined ? {} : { retentionPolicy }),
+}))
+
 export const projectSchema = z.object({
 	id: idSchema,
 	name: z.string(),

package/src/api/types.ts

@@ -196,6 +196,34 @@ export interface ZeropsServiceAutoscaling {
 	}
 }
 
+/**
+ * How many backups of a managed service the platform keeps. VERIFIED AS A SHAPE: `OutDtoBackupRetentionPolicy` and
+ * `InDtoBodyBackupRetentionPolicy` carry these nine fields, all required. The `min*`/`max*` counts are per backup TAG
+ * (`daily`, `weekly`, `monthly`); UNVERIFIED: which tags an hourly automatic backup gets.
+ */
+export interface ZeropsBackupRetentionPolicy {
+	maxTotalFiles: number
+	maxTotalGiB: number
+	/** Backups with one of these tags are never deleted automatically. */
+	protectedTags: string[]
+	minDaily: number
+	maxDaily: number
+	minWeekly: number
+	maxWeekly: number
+	minMonthly: number
+	maxMonthly: number
+}
+
+/** A managed service's backup schedule and retention. VERIFIED AS A SHAPE: `ResponseServiceStackBackupFileList`, without its `files`. */
+export interface ZeropsBackupConfig {
+	/** UNVERIFIED: the format. Zerops' GUI documentation describes a 5-field cron (`min hour dom mon dow`). */
+	backupPeriod: string
+	/** What the platform applies to a service with no retention of its own. UNVERIFIED: that it is what applies then. */
+	defaultRetentionPolicy: ZeropsBackupRetentionPolicy
+	/** The service's own retention; absent when none was set. */
+	retentionPolicy?: ZeropsBackupRetentionPolicy
+}
+
 /** One service. VERIFIED: `ResponseServiceStack` (narrowed to the fields fabrika reads). */
 export interface ZeropsService {
 	id: string
@@ -494,6 +522,30 @@ export interface ZeropsApi {
 	 */
 	configureCustomAutoscaling(input: { serviceId: string; autoscaling: ZeropsServiceAutoscaling; signal: AbortSignal }): Promise<ZeropsProcess | null>
 
+	// ── service-stack: backups ────────────────────────────────────────────────────
+
+	/**
+	 * A managed service's backup schedule and retention. VERIFIED AS A SHAPE: `GET /service-stack/{id}/backup`
+	 * (`ListBackups`), response `ResponseServiceStackBackupFileList`; the backup files it also lists are not read.
+	 */
+	getBackupConfig(input: { serviceId: string; signal: AbortSignal }): Promise<ZeropsBackupConfig>
+
+	/**
+	 * Set a managed service's backup schedule and retention. VERIFIED AS A SHAPE: `PUT /service-stack/{id}/backup-config`
+	 * (`ConfigureBackup`), body `RequestServiceStackBackupConfig`, response `ResponseProcessNil`. The platform stores the
+	 * period as the service's `BACKUP_PERIOD` variable and may start a user-data sync, whose process this answers.
+	 *
+	 * `retentionPolicy` is required here although the body makes it optional. UNVERIFIED: whether a request without one
+	 * resets the service's retention; a PUT elsewhere on this API resets every field it leaves out, so the caller sends
+	 * the retention it read, whole.
+	 */
+	configureBackup(input: {
+		serviceId: string
+		backupPeriod: string
+		retentionPolicy: ZeropsBackupRetentionPolicy
+		signal: AbortSignal
+	}): Promise<ZeropsProcess | null>
+
 	// ── service-stack / project: reading state ────────────────────────────────────
 
 	/** One service by id. VERIFIED: `GET /service-stack/{id}`. */

package/src/api.ts

@@ -19,6 +19,8 @@ export {
 	type ZeropsAppVersion,
 	type ZeropsAppVersionStatus,
 	type ZeropsAppVersionUpload,
+	type ZeropsBackupConfig,
+	type ZeropsBackupRetentionPolicy,
 	type ZeropsImportedService,
 	type ZeropsImportResult,
 	type ZeropsIntegrationToken,

package/src/control.ts

@@ -102,6 +102,8 @@ export interface ZeropsControlProviderOptions {
 		readonly proxySource: ZeropsNamespaceProxySource
 		readonly iamUrl: string
 		readonly iamKey: string
+		/** The installation's own project, which no namespace may adopt. */
+		readonly installationProjectId?: string
 		/** The manifest parsers of the older releases' proxies, which a namespace pinned to an older source may run. */
 		readonly olderProxies: OlderProxyReaders
 	}

package/src/database-budget.ts

@@ -15,7 +15,7 @@ export const ZEROPS_POSTGRES_MIN_RAM_GB = 0.25
 export const ZEROPS_POSTGRES_UNAVAILABLE_CONNECTIONS = 7
 
 /**
- * The most connections one container's start script holds at once: `fabrika db test-isolation` peaks at 4 since the
+ * The most connections one container's init commands hold at once: `fabrika db test-isolation` peaks at 4 since the
  * test kit opens a file's connections together, and at 5 with a `@fabrika/db` before that (measured locally,
  * 2026-10-16, with the Notes and CRM examples). Migrating and reading the schema take fewer, one after the other.
  */
@@ -53,7 +53,7 @@ export function zeropsPostgresMaxConnections(ramGB: number, profile: string | un
 const poolHolders = (demand: ZeropsDatabaseDemand): number => 2 * demand.maxContainers + demand.jobs
 
 /**
- * The connections each process may open so that all of them, with one container's start script, stay within what the
+ * The connections each process may open so that all of them, with one container's init commands, stay within what the
  * application's roles can take; `null` when that is below `MIN_PROCESS_CONNECTIONS`.
  */
 export function zeropsProcessConnections(maxConnections: number, demand: ZeropsDatabaseDemand): number | null {

package/src/execution.ts

@@ -55,7 +55,7 @@ const FILE_SWEEP_SCHEDULE = '41 * * * *'
 export const ZEROPS_SCAN_MIN_RAM_GB = 2
 
 /**
- * The RAM in GB a container of an application with a database starts with. Its start script runs `fabrika db
+ * The RAM in GB a container of an application with a database starts with. Its init commands run `fabrika db
  * test-isolation`, whose CLI and `bun test` child together peak at 161 MiB of anonymous memory for the Notes example
  * and 225 MiB for the CRM example (measured locally, 2026-10-15), beside Bun's own mapped binary. Zerops' 0.125 GB
  * floor kills that within a second, faster than vertical autoscaling reacts.
@@ -243,6 +243,7 @@ const SOURCE_ROOT = '/build/source'
 const RUNTIME_ROOT = '/var/www'
 const FABRIKA_BIN = './node_modules/.bin/fabrika'
 const MIGRATE_SCRIPT = 'fabrika/migrate.generated.sh'
+const VERIFY_SCRIPT = 'fabrika/verify.generated.sh'
 const START_SCRIPT = 'fabrika/start.generated.sh'
 const PLATFORM_TSCONFIG = 'fabrika/tsconfig.platform.json'
 
@@ -281,24 +282,26 @@ const migrateScript = (appId: string): readonly string[] => [
 	`FABRIKA_APP_ID=${appId} exec ${FABRIKA_BIN} db migrate`,
 ]
 
-// The server starts only after the migrations it expects are applied, the committed schema types match the migrated
-// schema and every generated isolation test passed on a throwaway schema, so any failure fails the readiness check,
-// whether or not a failed `initCommands` stops the activation (it does, verified live). The build has no
-// database, so this is where the types and the generated tests run.
-const startScript = (appId: string, database: boolean): readonly string[] => [
+// The committed schema types must match the migrated schema and every generated isolation test must pass on a throwaway
+// schema. The build has no database, so they run at container start, after the migrations, as init commands: a failed
+// init command stops the activation, and the readiness window opens only with `run.start`, after the init commands (both
+// verified live), so a run as long as the CRM's ~3 minutes of generated cases does not race it.
+const verifyScript = (appId: string): readonly string[] => [
 	'#!/bin/sh',
 	'set -eu',
 	`cd ${RUNTIME_ROOT}`,
-	...(database
-		? [
-			`sh ${RUNTIME_ROOT}/${MIGRATE_SCRIPT}`,
-			`FABRIKA_APP_ID=${appId} ${FABRIKA_BIN} db codegen --verify`,
-			`FABRIKA_APP_ID=${appId} ${FABRIKA_BIN} db test-isolation`,
-		]
-		: []),
-	'exec bun fabrika/entry.generated.ts',
+	`FABRIKA_APP_ID=${appId} ${FABRIKA_BIN} db codegen --verify`,
+	`FABRIKA_APP_ID=${appId} exec ${FABRIKA_BIN} db test-isolation`,
 ]
 
+const startScript: readonly string[] = ['#!/bin/sh', 'set -eu', `cd ${RUNTIME_ROOT}`, 'exec bun fabrika/entry.generated.ts']
+
+/** The scripts the build writes and every container's init commands run, in this order. */
+const initScripts = (execution: ZeropsLockedExecution): readonly { readonly path: string; readonly lines: readonly string[] }[] =>
+	execution.databaseUrl === null
+		? []
+		: [{ path: MIGRATE_SCRIPT, lines: migrateScript(execution.appId) }, { path: VERIFY_SCRIPT, lines: verifyScript(execution.appId) }]
+
 const INSTALL = 'bun install --frozen-lockfile --ignore-scripts'
 
 // After every check: a map is uploaded only for a build that can deploy. A failed upload never fails the build; the
@@ -324,7 +327,6 @@ const sourceMapBuildVariables = (upload: OperationsSourceMapBuildUpload): Record
 export function generatedBuildCommands(execution: ZeropsLockedExecution): readonly string[] {
 	if (!LOCKED_APP_ID_PATTERN.test(execution.appId)) throw new Error('zerops: a contract application id must match [a-z0-9][a-z0-9-]*')
 	if (!FRAMEWORK_RELEASE_PATTERN.test(execution.checkRelease)) throw new Error('zerops: the checker release must be a release version')
-	const database = execution.databaseUrl !== null
 	return [
 		INSTALL,
 		'bun test --isolate --pass-with-no-tests',
@@ -333,8 +335,8 @@ export function generatedBuildCommands(execution: ZeropsLockedExecution): readon
 		`cd /tmp && bun x --bun -p @fabrika/check@${execution.checkRelease} fabrika-check ${SOURCE_ROOT}`,
 		writeFileCommand(PLATFORM_TSCONFIG, [PLATFORM_TSCONFIG_CONTENTS]),
 		`cd /tmp && bun x --bun -p typescript@${PLATFORM_TYPESCRIPT_VERSION} tsc -p ${SOURCE_ROOT}/${PLATFORM_TSCONFIG}`,
-		...(database ? [writeFileCommand(MIGRATE_SCRIPT, migrateScript(execution.appId))] : []),
-		writeFileCommand(START_SCRIPT, startScript(execution.appId, database)),
+		...initScripts(execution).map((script) => writeFileCommand(script.path, script.lines)),
+		writeFileCommand(START_SCRIPT, startScript),
 		...(execution.sourceMaps === null ? [] : [sourceMapUpload(execution.checkRelease)]),
 	]
 }
@@ -363,6 +365,16 @@ const jobCrontab = (contract: ZeropsContractRun): { readonly timing: string; rea
 /** How many job processes the crontab may run at once, each opening the application's database. */
 export const zeropsJobProcesses = (contract: ZeropsContractRun): number => jobCrontab(contract).length
 
+/** The commands every container runs before `run.start`, in order; any failure stops the activation. */
+export function generatedInitCommands(execution: ZeropsLockedExecution): string[] {
+	return [
+		// A container starts from the prepared image, whose signatures are as old as its build; a failed refresh leaves
+		// them to the daily one, and the scanner refuses signatures older than three days, so the scan fails closed.
+		...(execution.contract.scan === true ? [`${FRESHCLAM} || echo 'fabrika: freshclam did not refresh the malware signatures'`] : []),
+		...initScripts(execution).map((script) => `sh ${RUNTIME_ROOT}/${script.path}`),
+	]
+}
+
 /** The generated selected setup: the authored build kept, everything else the platform's. */
 export function renderLockedSetup(
 	setup: string,
@@ -385,12 +397,7 @@ export function renderLockedSetup(
 	const packages = sortedUnique([...execution.runtimePackages, ...(scan ? [SCANNER_PACKAGE] : [])])
 	// Every container keeps its own signatures; one scan pass at a time holds the job's lease.
 	const crontab = [...jobCrontab(contract), ...(scan ? [{ timing: FRESHCLAM_SCHEDULE, command: FRESHCLAM, allContainers: true }] : [])]
-	// A container starts from the prepared image, whose signatures are as old as its build; a failed refresh leaves
-	// them to the daily one, and the scanner refuses signatures older than three days, so the scan fails closed.
-	const initCommands = [
-		...(scan ? [`${FRESHCLAM} || echo 'fabrika: freshclam did not refresh the malware signatures'`] : []),
-		...(execution.databaseUrl === null ? [] : [`sh ${RUNTIME_ROOT}/${MIGRATE_SCRIPT}`]),
-	]
+	const initCommands = generatedInitCommands(execution)
 	const prepareCommands = packages.length === 0 ? [] : [`sudo apk add --no-cache ${packages.join(' ')}`, ...(scan ? [FRESHCLAM] : [])]
 	return {
 		setup,

package/src/index.ts

@@ -18,6 +18,8 @@ export type {
 	ZeropsAppVersion,
 	ZeropsAppVersionStatus,
 	ZeropsAppVersionUpload,
+	ZeropsBackupConfig,
+	ZeropsBackupRetentionPolicy,
 	ZeropsImportedService,
 	ZeropsImportResult,
 	ZeropsIntegrationToken,

package/src/installation/deploy.ts

@@ -21,35 +21,41 @@
 //
 // It composes the proxy manifest and ships it in the proxy's build archive. It writes the exact namespace
 // planning source default and the per-installation configuration derived from the resolved public hosts
-// (each service's own origin, the origins it must know about, and the installation's environment name). **It writes no credential at all** — every
-// secret an installation holds is `platform init`'s to place, and a deploy that cannot write one cannot
-// leak one. The two credentials this command HOLDS are the Zerops access token and the IAM admin key,
-// both from the environment, neither ever logged.
+// (each service's own origin, the origins it must know about, and the installation's environment name),
+// and the platform database's backup schedule. **It writes one credential, and only a derived one**: the
+// secret the proxy proves its requests to IAM with, HMAC-SHA256 of a fixed label keyed by the IAM admin key,
+// written sensitive to `proxy` and `iam` and never read back. Every other secret an installation holds is
+// `platform install`'s to place. The two credentials this command HOLDS are the Zerops access token and the
+// IAM admin key, both from the environment, neither ever logged.
 //
 // ── Idempotence ───────────────────────────────────────────────────────────────────────────────────
 //
-// Every variable is READ before it is written and skipped when it already matches, so a second run
-// writes nothing; the subdomain is decided by reading `subdomainAccess` back, so a second run enables
-// nothing; and the schema reconcile is an upsert. What a re-run does do is redeploy — that is what
-// "deploy" means, and the platform keeps the previous version serving whenever the new one fails its
+// Every readable variable is READ before it is written and skipped when it already matches, so a second
+// run writes only the derived secret, which it cannot read back; the subdomain is decided by reading
+// `subdomainAccess` back, so a second run enables nothing; the database's backup period is read and set
+// only when it differs; and the schema reconcile is an upsert. What a re-run does do is redeploy — that is
+// what "deploy" means, and the platform keeps the previous version serving whenever the new one fails its
 // readiness gate.
 
-import { FABRIKA_SERVICE_TABLE_DIGEST, readEnvironmentName } from '@fabrika/auth-core'
+import { FABRIKA_SERVICE_TABLE_DIGEST, IAM_PROXY_SECRET_VARIABLE, readEnvironmentName } from '@fabrika/auth-core'
 import { IAM_APP_ID, IAM_APP_SCHEMA } from '@fabrika/iam-contract'
 import type { SchemaReconciler } from '@fabrika/provider-contract'
 import { encodeProxyManifestJson, FABRIKA_PROXY_MANIFEST_JSON } from '@fabrika/proxy-core/manifest'
+import { createHmac } from 'node:crypto'
 import { assertServiceEnvValueFits } from '../api'
 import {
 	enableSubdomainAccessWhenHttp,
 	prepareZeropsDescriptor,
 	readableContent,
 	type Sleeper,
+	waitForProcess,
 	ZEROPS_ACTIVE,
 	ZEROPS_SERVICE_NOT_HTTP,
 	ZEROPS_TERMINAL,
 	type ZeropsApi,
 	ZeropsApiError,
 	type ZeropsNamespaceProxySource,
+	type ZeropsProcess,
 	type ZeropsService,
 	type ZeropsServiceEnv,
 } from '../index'
@@ -112,6 +118,18 @@ export const PLATFORM_SEQUENTIAL_DEPLOY = ['proxy', 'control'] as const
 /** The proxy's hostname. The only publicly routed service, and the one that carries the manifest. */
 export const PLATFORM_PROXY_SERVICE = 'proxy'
 
+/** IAM's and control's database, on both tiers. This command deploys nothing to it; it sets its backup schedule. */
+export const PLATFORM_DATABASE_SERVICE = 'db'
+
+/** Operations' own database. A light installation created before it existed keeps Operations in `db`. */
+export const OPERATIONS_DATABASE_SERVICE = 'operationsdb'
+
+/**
+ * Hourly. Zerops has no point-in-time recovery: a single-node database loses everything since its last `pg_dump`, which
+ * by default is daily. UNVERIFIED: that `backupPeriod` takes this 5-field cron, as the GUI documentation describes.
+ */
+export const PLATFORM_DATABASE_BACKUP_PERIOD = '0 * * * *'
+
 /** How often a triggered pipeline is polled. */
 const POLL_INTERVAL_MS = 5_000
 /** Zerops caps a build pipeline at one hour; poll past that so the timeout is ours, not a coincidence. */
@@ -208,43 +226,58 @@ const resolveProject = async (
 /** The private source service of an earlier layout; Control now streams sources itself (ADR-0029). */
 const LEFTOVER_SOURCE_SERVICE = 'source'
 
+/** The services this command touches: the four it deploys, and the database whose backups it schedules. */
+interface ResolvedInstallation {
+	readonly services: ReadonlyMap<PlatformDeployService, ResolvedService>
+	readonly databaseId: string
+	readonly hasOperationsDatabase: boolean
+}
+
 /**
  * Find every platform service by hostname in one listing.
  *
- * One call rather than four `findService` lookups, so a missing service is reported as the whole set
+ * One call rather than five `findService` lookups, so a missing service is reported as the whole set
  * that is missing — an installation that was never imported fails once, naming all of it, rather than
- * four runs later. Build runtimes (`build<hostname>v<n>`) share the project and are ignored by the
+ * five runs later. Build runtimes (`build<hostname>v<n>`) share the project and are ignored by the
  * exact-name match.
  */
 const resolveServices = async (
 	projectId: string,
 	{ api, log, signal }: PlatformDeployCollaborators,
-): Promise<Map<PlatformDeployService, ResolvedService>> => {
+): Promise<ResolvedInstallation> => {
 	const services = await api.listProjectServices({ projectId, signal })
 	if (services.some((service: ZeropsService) => service.name === LEFTOVER_SOURCE_SERVICE)) {
 		log.warn('a `source` service from an earlier layout is present and unused; it may still hold GitHub App keys; delete it or reinstall')
 	}
-	const resolved = new Map<PlatformDeployService, ResolvedService>()
-	const missing: string[] = []
-	for (const hostname of PLATFORM_DEPLOY_ORDER) {
+	const idOf = (hostname: string): string | undefined => {
 		const matches = services.filter((service: ZeropsService) => service.name === hostname)
 		if (matches.length > 1) {
 			throw new Error(`Zerops project ${projectId} has ${matches.length} services named \`${hostname}\``)
 		}
 		const match = matches[0]
-		if (match === undefined || match.id === '') {
+		return match === undefined || match.id === '' ? undefined : match.id
+	}
+	const resolved = new Map<PlatformDeployService, ResolvedService>()
+	const missing: string[] = []
+	for (const hostname of PLATFORM_DEPLOY_ORDER) {
+		const id = idOf(hostname)
+		if (id === undefined) {
 			missing.push(hostname)
 			continue
 		}
-		resolved.set(hostname, { hostname, id: match.id })
+		resolved.set(hostname, { hostname, id })
+	}
+	const databaseId = idOf(PLATFORM_DATABASE_SERVICE)
+	if (databaseId === undefined) {
+		missing.push(PLATFORM_DATABASE_SERVICE)
 	}
-	if (missing.length > 0) {
+	if (missing.length > 0 || databaseId === undefined) {
 		throw new Error(
 			`Zerops project ${projectId} has no ${missing.join(', ')} service — \`platform deploy\` updates an installation, `
 				+ 'it does not create one',
 		)
 	}
-	return resolved
+	return { services: resolved, databaseId, hasOperationsDatabase: idOf(OPERATIONS_DATABASE_SERVICE) !== undefined }
 }
 
 export const serviceOf = (services: ReadonlyMap<PlatformDeployService, ResolvedService>, hostname: PlatformDeployService): ResolvedService => {
@@ -292,6 +325,17 @@ const resolvePlacement = (input: PlatformDeployInput, proxyEnv: LiveServiceEnv):
 
 const IAM_OAUTH_CONFIG = 'FABRIKA_IAM_OAUTH_CONFIG'
 
+/**
+ * The secret the platform proxy sends IAM's route, so IAM honours the client address and request id only from the proxy.
+ * Derived from the IAM admin key, which every deploy holds, so each deploy writes the same value and nothing stores or
+ * reads one back. Never from the proxy key: namespace proxies hold that one.
+ */
+const deriveIamProxySecret = (iamAdminKey: string): string =>
+	createHmac('sha256', iamAdminKey).update('fabrika-installation-proxy-secret:iam').digest('hex')
+
+/** The credentials this command writes. Sensitive, so they cannot be compared and are rewritten on every deploy. */
+const SENSITIVE_DEPLOY_KEYS: ReadonlySet<string> = new Set([IAM_PROXY_SECRET_VARIABLE])
+
 /**
  * The per-installation configuration each service needs, derived from the resolved hosts.
  *
@@ -301,10 +345,12 @@ const IAM_OAUTH_CONFIG = 'FABRIKA_IAM_OAUTH_CONFIG'
  */
 const desiredServiceEnv = (
 	environment: string,
+	projectId: string,
 	placement: PlatformPlacement,
 	proxySource: ZeropsNamespaceProxySource,
 	oauthConfig: IamOAuthConfig | undefined,
 	controlTableDigest: string,
+	iamProxySecret: string,
 ): ReadonlyMap<PlatformDeployService, ReadonlyMap<string, string>> => {
 	const iamOrigin = platformOrigin(placement.scheme, placement.hosts.iam)
 	const operationsOrigin = platformOrigin(placement.scheme, placement.hosts.operations)
@@ -313,6 +359,7 @@ const desiredServiceEnv = (
 		// The `iss` of every minted token AND the OIDC redirect base, so it must be the address
 		// routed to the proxy in front of this service.
 		['ISSUER', iamOrigin],
+		[IAM_PROXY_SECRET_VARIABLE, iamProxySecret],
 	])
 	if (oauthConfig !== undefined) {
 		iam.set(IAM_OAUTH_CONFIG, JSON.stringify(oauthConfig))
@@ -335,6 +382,9 @@ const desiredServiceEnv = (
 				// private `iam:3000` the manifest dials — `readProxyEnv` canonicalizes it to an origin.
 				['FABRIKA_IAM_ISSUER', iamOrigin],
 				['FABRIKA_PROXY_SESSION_OWNER_JSON', JSON.stringify({ issuer: iamOrigin, upstream: PRIVATE_IAM_UPSTREAM })],
+				// Caddy sends it on the session owner's route. Until the proxy deploys, IAM keys every request on one shared
+				// bucket, which is what the balancer's address already does on Zerops.
+				[IAM_PROXY_SECRET_VARIABLE, iamProxySecret],
 			]),
 		],
 		[
@@ -352,6 +402,9 @@ const desiredServiceEnv = (
 				// The public IAM origin an APPLICATION project's proxy reaches — there is no private
 				// network between projects (ADR-0006).
 				['FABRIKA_ZEROPS_PROXY_IAM_URL', iamOrigin],
+				// The installation's own project, which no deployment namespace may adopt: its proxy is the
+				// platform's enforcement point, and a namespace reconcile would rebuild it with only app members.
+				['FABRIKA_ZEROPS_PLATFORM_PROJECT_ID', projectId],
 			]),
 		],
 	])
@@ -360,8 +413,8 @@ const desiredServiceEnv = (
 /**
  * Write only what differs. Returns the KEYS written — never a value, not even in a debug line.
  *
- * Nothing here is a credential, so everything is written readable. A record an older release wrote
- * sensitive reads as different and is rewritten readable, which is what lets the next deploy compare it.
+ * Everything but `SENSITIVE_DEPLOY_KEYS` is written readable. A record an older release wrote sensitive
+ * reads as different and is rewritten readable, which is what lets the next deploy compare it.
  */
 const applyServiceEnv = async (
 	service: ResolvedService,
@@ -372,7 +425,8 @@ const applyServiceEnv = async (
 ): Promise<string[]> => {
 	const written: string[] = []
 	for (const [key, value] of desired) {
-		if (readableContent(live.get(key)) === value) {
+		const sensitive = SENSITIVE_DEPLOY_KEYS.has(key)
+		if (!sensitive && readableContent(live.get(key)) === value) {
 			continue
 		}
 		written.push(key)
@@ -382,7 +436,7 @@ const applyServiceEnv = async (
 			continue
 		}
 		assertRunning(collaborators.signal)
-		await collaborators.api.putServiceEnv({ serviceId: service.id, key, value, sensitive: false, signal: collaborators.signal })
+		await collaborators.api.putServiceEnv({ serviceId: service.id, key, value, sensitive, signal: collaborators.signal })
 	}
 	return written
 }
@@ -591,6 +645,111 @@ const ensureSubdomainAccess = async (
 	}
 }
 
+/** What `ensureBackupPeriod` found and did. */
+export type BackupPeriodOutcome =
+	| { readonly kind: 'unchanged' }
+	| { readonly kind: 'kept'; readonly current: string }
+	| { readonly kind: 'would-change'; readonly from: string }
+	| { readonly kind: 'changed'; readonly from: string }
+	| { readonly kind: 'unconfirmed'; readonly readBack: string }
+
+/**
+ * Whether a period is one the operator did not choose: empty, or once a day (`<minute> <hour> * * *`), which is the
+ * shape of the platform's daily default. Anything else is kept. UNVERIFIED: how the platform spells its default.
+ */
+const isDailyBackupPeriod = (period: string): boolean => period.trim() === '' || /^\d+ \d+ \* \* \*$/.test(period.trim())
+
+/**
+ * Set a managed service's backup period, read-compare-write, replacing only a daily one.
+ *
+ * A different period is sent with the retention the service reads — its own, else the default — WHOLE, because a
+ * PUT on this API resets what it leaves out. The decision is the read-back, never the PUT returning.
+ */
+export const ensureBackupPeriod = async (input: {
+	readonly api: Pick<ZeropsApi, 'getBackupConfig' | 'configureBackup' | 'getProcess'>
+	readonly sleep: Sleeper
+	readonly signal: AbortSignal
+	readonly serviceId: string
+	readonly hostname: string
+	readonly period: string
+	readonly dryRun: boolean
+}): Promise<BackupPeriodOutcome> => {
+	const { api, sleep, signal, serviceId, hostname, period } = input
+	const current = await api.getBackupConfig({ serviceId, signal })
+	if (current.backupPeriod === period) {
+		return { kind: 'unchanged' }
+	}
+	if (!isDailyBackupPeriod(current.backupPeriod)) {
+		return { kind: 'kept', current: current.backupPeriod }
+	}
+	if (input.dryRun) {
+		return { kind: 'would-change', from: current.backupPeriod }
+	}
+	assertRunning(signal)
+	let process: ZeropsProcess | null
+	try {
+		process = await api.configureBackup({
+			serviceId,
+			backupPeriod: period,
+			retentionPolicy: current.retentionPolicy ?? current.defaultRetentionPolicy,
+			signal,
+		})
+	} catch (error) {
+		if (error instanceof ZeropsApiError && error.status >= 400 && error.status < 500) {
+			throw new Error(`zerops: setting the backup schedule of ${hostname} was refused (${error.code === '' ? error.status : error.code})`)
+		}
+		throw error
+	}
+	if (process !== null) {
+		await waitForProcess({ api, processId: process.id, sleep, signal, label: `the backup schedule change of ${hostname}` })
+	}
+	const after = await api.getBackupConfig({ serviceId, signal })
+	if (after.backupPeriod !== period) {
+		return { kind: 'unconfirmed', readBack: after.backupPeriod }
+	}
+	return { kind: 'changed', from: current.backupPeriod }
+}
+
+/** `ensureBackupPeriod` on the platform database, reported as one log line; nothing it meets fails the deploy. */
+const scheduleDatabaseBackups = async (databaseId: string, dryRun: boolean, collaborators: PlatformDeployCollaborators): Promise<void> => {
+	const { log, signal } = collaborators
+	const db = PLATFORM_DATABASE_SERVICE
+	const schedule = `\`${PLATFORM_DATABASE_BACKUP_PERIOD}\``
+	let backup: BackupPeriodOutcome
+	try {
+		backup = await ensureBackupPeriod({
+			api: collaborators.api,
+			sleep: collaborators.sleep,
+			signal,
+			serviceId: databaseId,
+			hostname: db,
+			period: PLATFORM_DATABASE_BACKUP_PERIOD,
+			dryRun,
+		})
+	} catch (error) {
+		if (signal.aborted) throw error
+		log.warn(`${db}: the backup schedule was not set (${error instanceof Error ? error.message : 'unknown error'}); set it to ${schedule} by hand`)
+		return
+	}
+	switch (backup.kind) {
+		case 'unchanged':
+			log.info(`${db}: backups already run on ${schedule}`)
+			return
+		case 'kept':
+			log.info(`${db}: backups keep the schedule \`${backup.current}\` someone chose instead of the daily default`)
+			return
+		case 'would-change':
+			log.info(`${db}: backups would run on ${schedule}, were \`${backup.from}\``)
+			return
+		case 'changed':
+			log.info(`${db}: backups now run on ${schedule}, were \`${backup.from}\``)
+			return
+		case 'unconfirmed':
+			log.warn(`${db}: backups were set to ${schedule} but read back \`${backup.readBack}\`; check the schedule by hand`)
+			return
+	}
+}
+
 /**
  * The installation's environment name, refused when a public origin contradicts it.
  *
@@ -637,7 +796,7 @@ export const deployPreparedPlatform = async (
 
 	log.step('Resolve the installation')
 	const project = await resolveProject(input, collaborators)
-	const services = await resolveServices(project.id, collaborators)
+	const { services, databaseId, hasOperationsDatabase } = await resolveServices(project.id, collaborators)
 	log.info(`project ${project.name} (${project.id}) — ${PLATFORM_DEPLOY_ORDER.join(', ')}`)
 
 	const proxy = serviceOf(services, PLATFORM_PROXY_SERVICE)
@@ -670,7 +829,15 @@ export const deployPreparedPlatform = async (
 
 	log.step('Write the service environment')
 	const controlTableDigest = platformServiceTableDigest(platformManifest, platformProxyAppFor(PLATFORM_PROXY_MANIFEST_TEMPLATE, 'control').id)
-	const desired = desiredServiceEnv(environment, placement, proxySource, oauthConfig, controlTableDigest)
+	const desired = desiredServiceEnv(
+		environment,
+		project.id,
+		placement,
+		proxySource,
+		oauthConfig,
+		controlTableDigest,
+		deriveIamProxySecret(input.iamAdminKey),
+	)
 	for (const hostname of PLATFORM_DEPLOY_ORDER) {
 		const service = serviceOf(services, hostname)
 		const live = hostname === PLATFORM_PROXY_SERVICE ? proxyEnv : await readServiceEnv(service.id, collaborators)
@@ -746,5 +913,17 @@ export const deployPreparedPlatform = async (
 		log.info(`\`${IAM_APP_ID}\` reconciled`)
 	}
 
+	// Last, and a warning rather than a failure: the backup API's behaviour is not yet measured on a live account
+	// (docs/reference/zerops-platform.md), and every service is already deployed, published and registered.
+	log.step('Schedule the platform database backups')
+	if (hasOperationsDatabase) {
+		await scheduleDatabaseBackups(databaseId, input.dryRun, collaborators)
+	} else {
+		log.warn(
+			`${PLATFORM_DATABASE_SERVICE}: backups keep their schedule — Operations shares this database on an installation `
+				+ `created before \`${OPERATIONS_DATABASE_SERVICE}\`, and hourly dumps would copy its whole error history`,
+		)
+	}
+
 	log.step(input.dryRun ? 'Dry run complete — nothing was written' : 'Installation deployed')
 }

package/src/installation/guide.md

@@ -44,16 +44,41 @@ cores and 48 GB per container, and costs more while it does.
 **1. Platform tier** (`platform install --tier`, step 1). Cannot be changed later: a project's core package
 is upgrade-only, and the data services differ.
 
-| Tier              | What runs                                                                                                                                                                           | Idle floor | Fails when                                               |
-| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- | -------------------------------------------------------- |
-| `light` (default) | Lightweight core. One single-node PostgreSQL (`oltp-hobby`) and one bucket shared by IAM, control and Operations; one container each.                                               | about $6   | any one container or the database is down: sign-in stops |
-| `standard`        | Serious core. HA PostgreSQL (3 nodes, `oltp-production`, dedicated CPU) for IAM and control; a second HA PostgreSQL and bucket for Operations; two containers of IAM and the proxy. | about $100 | survives the loss of one node of each                    |
+| Tier              | What runs                                                                                                                                                                           | Idle floor  | Fails when                                       |
+| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | ------------------------------------------------ |
+| `light` (default) | Lightweight core. Two single-node PostgreSQL (`oltp-hobby`): `db` for IAM and control, `operationsdb` for Operations; one shared bucket; one container each.                        | about $7.50 | any one container or `db` is down: sign-in stops |
+| `standard`        | Serious core. HA PostgreSQL (3 nodes, `oltp-production`, dedicated CPU) for IAM and control; a second HA PostgreSQL and bucket for Operations; two containers of IAM and the proxy. | about $100  | survives the loss of one node of each            |
 
 Most of `standard`'s price is the identity database's dedicated floor (about $72). `light` is right for an
 evaluation and a small fleet that tolerates an outage; `standard` for sign-in that must stay up.
 
+**What a lost node costs.** Zerops has no point-in-time recovery. Its backups are logical dumps of a whole
+database service, daily between 00:00 and 01:00 UTC unless the service sets another schedule, and a restore is
+manual (download, then `pg_restore`). A single-node PostgreSQL whose node fails loses everything written since
+its last backup and stays down until someone restores it. An HA PostgreSQL (three nodes) keeps both its data and
+its service. Zerops documents that a deploy starts the new container before it stops the old one, so a deploy
+should not take a one-container runtime down; neither that nor how fast Zerops replaces a container lost with its
+node is measured here. `platform install` and every `platform deploy` set the platform database `db` (users,
+grants, deploy records) to back up hourly, unless someone chose another schedule; a light installation created
+before `operationsdb` existed keeps its schedule. Hourly backups may shorten how far back the restore points
+reach: if Zerops tags each one `daily`, the retention's daily count counts hours. Check `db`'s retention in the GUI. Operations' own `operationsdb`
+keeps the daily default: its error history does not need that schedule.
+
+**Presets.** The choices below combine into three shapes. Prices are the idle floor for three applications in
+one production namespace; an application with a database runs at a 0.5 GB floor, about $2.10 per container.
+
+| Preset     | Platform tier | Production namespace                                                                                | Idle floor | A lost node costs                                                 |
+| ---------- | ------------- | --------------------------------------------------------------------------------------------------- | ---------- | ----------------------------------------------------------------- |
+| evaluation | `light`       | `cheap`, single-node PostgreSQL, one container each                                                 | about $16  | the data written since that database's last backup, and an outage |
+| data       | `light`       | `cheap` with `--postgres-type=postgresql:ha@18 --postgres-profile=oltp-staging`, one container each | about $26  | applications' data survives; platform data since its last backup  |
+| stable     | `standard`    | `cheap` HA as above, `--core-package=SERIOUS`, two containers of each application                   | $130+      | a short failover; the namespace proxy has one container           |
+
+A staging namespace (`cheap`, single-node) adds about $9 to any of them.
+
 **2. Namespace preset** (`control namespaces create --preset`, step 5). A namespace is the Zerops project
-applications run in. Each one adds its own proxy, about $1.08.
+applications run in. Each one adds its own proxy, about $1.08. A `cheap` namespace's shared PostgreSQL is
+single-node unless `--postgres-type=postgresql:ha@18` asks for HA (about $11 at `--postgres-profile=oltp-staging`; the two flags go together);
+the type is fixed once the namespace exists, the profile is not.
 
 | Preset          | Where an application's database lives                                   | Use with                             |
 | --------------- | ----------------------------------------------------------------------- | ------------------------------------ |
@@ -62,8 +87,8 @@ applications run in. Each one adds its own proxy, about $1.08.
 | `full`          | The namespace belongs to ONE application (`--exclusive-app=<id>`)       | an application that must be isolated |
 
 **3. The application's database** (the application's `fabrika.config.ts`, before step 5). The example
-declares `postgresql:single@18` at `oltp-hobby`, about $1.45, plus its runtime from about $1.08 per
-container. `postgresql:ha@18` survives a node failure: about $11 at `oltp-staging` (shared CPU), about $72 at
+declares `postgresql:single@18` at `oltp-hobby`, about $1.45, plus its runtime at about $2.10 per
+container (a deploy raises the floor of an application with a database to 0.5 GB). `postgresql:ha@18` survives a node failure: about $11 at `oltp-staging` (shared CPU), about $72 at
 `oltp-production` (dedicated). Single to HA later means a new service and a data migration.
 
 **4. Namespace core package** (`--core-package=LIGHT|SERIOUS`, step 5). `LIGHT` is free and the default on
@@ -127,10 +152,9 @@ fabrika platform install --provider=zerops --create-project --client-id=<clientI
   over the same project would destroy the vault key. Start over in a new empty project.
 - The account must be in the default region, or set `FABRIKA_ZEROPS_API_URL` for every command.
 - Mail is optional. Without `--email-provider` the installation sends no mail. With one, add
-  `--email-provider=<resend|smartemailing> --email-from=<address>`, optionally `--email-from-name=<name>`, and
-  export the provider's variables (`FABRIKA_EMAIL_RESEND_API_KEY`, or `FABRIKA_EMAIL_SMARTEMAILING_USERNAME`,
-  `FABRIKA_EMAIL_SMARTEMAILING_API_KEY` and optionally `FABRIKA_EMAIL_SMARTEMAILING_TAG`) from their own `0600`
-  files. They have no flag. The install writes the set on `iam` and `control`, the credentials sensitive. They
+  `--email-provider=<provider> --email-from=<address>`, optionally `--email-from-name=<name>`, and export the
+  provider's variables from their own `0600` files. `fabrika platform install --provider=zerops --help` lists the
+  providers and their variables, each named after its provider (for Resend `FABRIKA_EMAIL_RESEND_API_KEY`). They have no flag. The install writes the set on `iam` and `control`, the credentials sensitive. They
   are the human's own, so they are not copied into the secrets file.
 
 **Check.** The log ends with the `Hand off` step: where the credentials are, `The console answers at
@@ -352,7 +376,10 @@ fabrika control namespaces update --namespace=<id> --proxy-source=current
 ```
 
 It re-pins the namespace and queues the reconcile that rebuilds its proxy; poll `namespaces get` until it is
-`ready`. A namespace pinned to a release before the proxy manifest moved into the build archive carries it in a
+`ready`. Re-pin every namespace after each upgrade. Until then, Control refuses a deploy into it that uses a form
+newer than 0.6 (a public procedure, a file output, a capabilities requirement, a forwarded webhook `Authorization`),
+also when its proxy reads the form, and a proxy older than the replacement of the caller's `Authorization` keeps
+forwarding a caller's `px_` key to the application (`docs/reference/deployment-namespaces.md`). A namespace pinned to a release before the proxy manifest moved into the build archive carries it in a
 service variable, which Zerops caps at about 32 KB: when a deploy fails with `serviceEnvValueTooLarge`, this is
 the fix, and it also accepts a namespace in `failed`.
 

package/src/installation/index.ts

@@ -46,7 +46,16 @@ export {
 } from './proxy-manifest'
 
 const EMAIL_PROVIDERS = Object.keys(builtinEmailProviders).join(', ')
-const EMAIL_PROVIDER_VARIABLES = Object.values(builtinEmailProviders).flatMap((provider) => provider.variables.map((variable) => variable.name))
+/** One line per provider: its variables, each marked secret or optional where it is. */
+const EMAIL_PROVIDER_VARIABLES = Object.entries(builtinEmailProviders)
+	.map(([name, provider]) => {
+		const variables = provider.variables.map((variable) => {
+			const marks = [variable.secret ? 'secret' : '', variable.required ? '' : 'optional'].filter((mark) => mark !== '')
+			return marks.length === 0 ? variable.name : `${variable.name} (${marks.join(', ')})`
+		})
+		return `\t                                  ${name}: ${variables.join(', ')}`
+	})
+	.join('\n')
 
 const USAGE = `Zerops installation
 
@@ -132,7 +141,7 @@ Options (a flag beats the environment variable beside it):
 	FABRIKA_ZEROPS_ACCESS_TOKEN       required   Zerops access token, environment only and no flag
 	FABRIKA_ZEROPS_API_URL            optional   region API base, when not the default
 	FABRIKA_EMAIL_<PROVIDER>_*        the selected provider's variables, environment only and no flag:
-	                                  ${EMAIL_PROVIDER_VARIABLES.join(', ')}
+${EMAIL_PROVIDER_VARIABLES}
 
 With a mail provider, IAM sends its own mail and Control hands the same transport to every application
 whose job declares \`mailer: 'installation'\`. To set or rotate it later, see \`platform guide\`.
@@ -254,7 +263,8 @@ process listing:
                                                (a --dry-run does not need it)
   FABRIKA_ZEROPS_API_URL            optional   region API base, when not the default
 
-This command writes NO credential. Every secret an installation holds is placed at bring-up.
+This command writes one credential, derived from FABRIKA_IAM_PROVISIONING_KEY: the secret the proxy
+proves its requests to IAM with. Every other secret an installation holds is placed at bring-up.
 
 Install and deploy require --source-dir explicitly. Run the CLI from that same clean full checkout;
 a packaged CLI cannot supply another revision's manifest or schema. --from-git and

package/src/installation/install-environment.ts

@@ -30,9 +30,9 @@ const storageOf = (service: string): StorageReferences => ({
 	endpoint: `\${${service}_apiUrl}`,
 })
 
-/** IAM and control share `db` and `storage` on both tiers; `standard` gives Operations its own pair. */
+/** IAM and control share `db` and `storage` on both tiers; Operations has its own database on both, and its own bucket on `standard`. */
 const OPERATIONS_DATA: Readonly<Record<PlatformTier, { readonly database: string; readonly storage: string }>> = {
-	light: { database: 'db', storage: 'storage' },
+	light: { database: 'operationsdb', storage: 'storage' },
 	standard: { database: 'operationsdb', storage: 'operationsstorage' },
 }
 
@@ -56,6 +56,8 @@ export const PASS_ONE_PROXY_MANIFEST = encodeProxyManifestJson({ apps: [] })
 /** What `installationServiceEnv` needs. Everything in it is settled before the first write. */
 export interface InstallationEnvInput {
 	readonly environment: string
+	/** The installation's own Zerops project, which no deployment namespace may adopt. */
+	readonly projectId: string
 	readonly tier: PlatformTier
 	readonly scheme: 'http' | 'https'
 	readonly hosts: PlatformHosts
@@ -117,6 +119,7 @@ export const installationServiceEnv = (input: InstallationEnvInput): ReadonlyMap
 		['FABRIKA_ZEROPS_PROXY_IAM_URL', iamOrigin],
 		['FABRIKA_ZEROPS_PROXY_IAM_KEY', secrets.proxyKey],
 		['FABRIKA_ZEROPS_ACCESS_TOKEN', input.zeropsAccessToken],
+		['FABRIKA_ZEROPS_PLATFORM_PROJECT_ID', input.projectId],
 	])
 	if (input.apiBaseUrl !== undefined) {
 		// Only when the installation is not on the default region. Control spells it `_API_BASE_URL` while

package/src/installation/install.ts

@@ -170,6 +170,7 @@ const installPreparedPlatform = async (
 	log.step('Write every remaining variable')
 	const desired = installationServiceEnv({
 		environment,
+		projectId: project.id,
 		tier: input.tier,
 		scheme: input.scheme,
 		hosts,

package/src/installation/topology/setups.ts

@@ -47,7 +47,9 @@
 // into the platform's variable store rather than carrying a credential. That reasoning is still sound
 // and it is no longer sufficient, because a reference names a SERVICE — and which data services exist
 // is exactly what differs between the `standard` and `light` tiers (`./topology.ts`). One committed
-// file cannot say `${operationsdb_connectionString}` on behalf of a tier that has no `operationsdb`.
+// file cannot say `${operationsstorage_bucketName}` on behalf of a tier that has no `operationsstorage`,
+// nor `${operationsdb_connectionString}` on behalf of a light installation created before Operations
+// had a database of its own.
 // So the file's own rule decides it: a data-service reference is not true for every installation, and
 // it moves to the env API alongside the origins and the secrets.
 //
@@ -181,6 +183,8 @@ const WORKSPACE_DEPLOY_FILES = ['package.json', 'bun.lock', 'node_modules', 'pac
  * since the proxy is the only publicly routed component and must not also be able to write audit rows),
  * `FABRIKA_IAM_PROVISIONING_KEY`. Both shared secrets must be at least 32 characters; a shorter one fails
  * the boot rather than standing in front of an internet-reachable surface while looking configured.
+ * `FABRIKA_INSTALLATION_PROXY_SECRET_IAM`, which `platform deploy` derives and writes, lets IAM tell the proxy's
+ * client-address and request-id headers from a private caller's.
  */
 const iam: ZeropsYamlSetupSpec = {
 	setup: 'iam',
@@ -291,8 +295,9 @@ const control: ZeropsYamlSetupSpec = {
  * `FABRIKA_OPERATIONS_BLOB_*` coordinates, `ENVIRONMENT`, `FABRIKA_OPERATIONS_PUBLIC_HOST` and
  * `FABRIKA_IAM_ISSUER` (the public IAM issuer). `FABRIKA_OPERATIONS_DATABASE_URL` takes the canonical
  * form above. On the `standard` tier the data references are `${operationsdb_*}` and
- * `${operationsstorage_*}`; on `light` they are `${db_*}` and `${storage_*}`, which is precisely why
- * they cannot be written here.
+ * `${operationsstorage_*}`; on `light` they are `${operationsdb_*}` and `${storage_*}` (`${db_*}` on a
+ * light installation created before Operations had its own database), which is precisely why they cannot
+ * be written here.
  *
  * Secrets (`envSecrets`): `OPERATIONS_SYNC_KEY`, shared only with control for catalog projection, and
  * `FABRIKA_IAM_RPC_KEY`, used only for Operations → IAM management RPC.
@@ -331,7 +336,8 @@ const operations: ZeropsYamlSetupSpec = {
  * IAM service's PUBLIC origin in an apps project, because there is no private network between projects
  * (ADR-0006). The manifest is not a variable; see below.
  *
- * Secret (`envSecrets`): `FABRIKA_IAM_KEY` — the value IAM knows as `FABRIKA_IAM_PROXY_KEY`.
+ * Secret (`envSecrets`): `FABRIKA_IAM_KEY` — the value IAM knows as `FABRIKA_IAM_PROXY_KEY`. In the platform project
+ * also `FABRIKA_INSTALLATION_PROXY_SECRET_IAM`, which Caddy sends on IAM's route and IAM holds too.
  *
  * ── How the manifest reaches the build ───────────────────────────────────────────────────────────
  *

package/src/installation/topology/topology.ts

@@ -82,22 +82,27 @@ export type PublicAccess = 'custom-domain' | 'zerops-subdomain'
  * `standard` is the production shape: HA Postgres, a separate database and bucket for Operations, and
  * enough containers that no single one is a point of failure.
  *
- * `light` is one project, one `postgresql:single@18` and one bucket shared by IAM, Operations, control
- * AND the apps deployed alongside them, at one container per service. This tier exists because the standard
+ * `light` is one project with two `postgresql:single@18` services — `db` for IAM and control, `operationsdb`
+ * for Operations — and one bucket, at one container per service. This tier exists because the standard
  * shape costs ~13 containers before a single application is deployed, which is more platform than a
- * small fleet — or an evaluation — can justify.
+ * small fleet — or an evaluation — can justify. Applications run in their own namespace projects
+ * (ADR-0034); a production namespace that must keep its data through a node loss asks for HA there.
  *
- * Sharing is safe rather than merely cheap, and that is a property of the code, not of this comment:
+ * Operations gets its own database, not a schema beside IAM's, because Zerops backs up a whole service on
+ * one schedule: identity and deploy state is worth an hourly dump, error history is not, and only two
+ * services can carry two schedules. It also keeps Operations' high-volume writes off the identity path.
  *
- *   • The three services' table names do not intersect (IAM 10, Operations 24, control 16), and
- *     ADR-0017 already gives each its own migration ledger and advisory lock, so one database holds
- *     all three without coordination.
+ * Sharing the rest is safe rather than merely cheap, and that is a property of the code, not of this comment:
+ *
+ *   • IAM's and control's table names do not intersect, and ADR-0017 gives each its own migration ledger
+ *     and advisory lock, so one database holds both without coordination. A light installation created
+ *     before Operations moved out still holds all three in `db`, which the same property covers.
  *   • Their blob keys are prefix-disjoint — control writes `runs/`, Operations writes `events/`,
  *     `dead/` and `source-maps/` — so one bucket cannot collide.
  *
- * What `light` genuinely gives up is FAILURE-DOMAIN isolation: Operations' high-volume error history
- * now shares capacity with the identity path, and losing the one database loses all three services.
- * That is the trade, and it is why `standard` remains the default rather than the special case.
+ * What `light` genuinely gives up is AVAILABILITY and DURABILITY: one container per service, and a
+ * single-node database loses everything since its last backup when its node fails (Zerops has no
+ * point-in-time recovery). That is the trade, and it is why `standard` remains the default rather than the special case.
  */
 export type PlatformTier = 'standard' | 'light'
 
@@ -188,9 +193,9 @@ export const platformTopology = (options: TopologyOptions): ProjectTopology => {
 			hostname: 'db',
 			// HA is encoded in the TYPE. The deprecated `mode` field is not merely avoided here — it
 			// is absent from `ZeropsServiceSpec`, so it cannot be written. One database serves both
-			// IAM and the control plane; they are separate schemas in it, not separate services,
-			// because a second HA Postgres triples the cost of the isolation the private network
-			// already gives us.
+			// IAM and the control plane; both use its default schema with disjoint tables and their own
+			// migration ledgers (ADR-0017), not separate services, because a second HA Postgres triples
+			// the cost of the isolation the private network already gives us.
 			type: 'postgresql:ha@18',
 			// The identity and control-plane database: every login, every token mint, every run's
 			// state. `oltp-production` is also what an HA service gets by DEFAULT — stated here so
@@ -315,10 +320,9 @@ const lightPlatformTopology = (options: TopologyOptions, publicAccess: PublicAcc
 	// that creates the project. Same shape as `compileZeropsNamespaceTopology` in `src/namespace/topology.ts`.
 	const services = (): ZeropsServiceSpec[] => [
 		{
-			// ONE database for IAM, control, Operations and every app in this project. Which schema each
-			// one gets is not expressed here — it is `FABRIKA_*_DATABASE_URL`, written per installation
-			// through the env API, because this same repository-root `zerops.yaml` serves both tiers and
-			// a `${operationsdb_connectionString}` baked into it would name a service `light` does not have.
+			// IAM and control. Which schema each one gets is not expressed here — it is `FABRIKA_*_DATABASE_URL`,
+			// written per installation through the env API, because this same repository-root `zerops.yaml`
+			// serves both tiers.
 			hostname: 'db',
 			type: 'postgresql:single@18',
 			// `oltp-hobby`, written out because a default is not a choice — this type's default is
@@ -326,15 +330,21 @@ const lightPlatformTopology = (options: TopologyOptions, publicAccess: PublicAcc
 			//
 			// A floor is not headroom. Every PostgreSQL profile shares the same 8-core / 48 GB / 250 GB
 			// ceiling and the same vertical autoscaler, so `oltp-staging` does not let this service grow
-			// any further than `oltp-hobby` does — it only pre-pays for memory the tier is idle on. That
-			// this single service holds IAM, control, Operations and the apps beside them is an argument
-			// about the ceiling, which is unchanged.
+			// any further than `oltp-hobby` does — it only pre-pays for memory the tier is idle on.
 			//
 			// An installation that wants a specific floor sets one on the service — `minRam` accepts a
 			// float — which is where a per-installation value belongs (ADR-0004), not in this document.
 			profile: 'oltp-hobby',
 			priority: 100,
 		},
+		{
+			// Operations' own database: its own backup schedule (the Zerops default, daily) and its own
+			// capacity, off the identity path. Same type and profile as `db`, for the same reasons.
+			hostname: 'operationsdb',
+			type: 'postgresql:single@18',
+			profile: 'oltp-hobby',
+			priority: 100,
+		},
 		{
 			// ONE bucket. Prefix-disjoint by construction: `runs/` (control) vs `events/`, `dead/` and
 			// `source-maps/` (Operations).
@@ -367,7 +377,7 @@ const lightPlatformTopology = (options: TopologyOptions, publicAccess: PublicAcc
 			platform: 'zerops',
 			project: {
 				name: 'platform',
-				description: 'fabrika light tier: control plane, Operations, IAM, the auth proxy and the apps they serve, on shared data services.',
+				description: 'fabrika light tier: control plane, Operations, IAM and the auth proxy, on single-node data services.',
 				corePackage: 'LIGHT',
 				tags: ['fabrika', 'platform', 'light', options.env],
 			},

package/src/namespace/provisioning.ts

@@ -67,10 +67,18 @@ const validateProject = (
 	target: NormalizedZeropsNamespaceTarget,
 	project: ZeropsProject,
 	adopting: boolean,
+	installationProjectId: string | undefined,
 ): void => {
 	if (project.id === '') {
 		throw new Error('Zerops namespace project returned an empty id')
 	}
+	// Checked on every reconcile, before the import and the proxy build, so a namespace that already adopted it stops
+	// here instead of rebuilding the platform's enforcement point with an empty manifest (ADR-0034).
+	if (project.id === installationProjectId) {
+		throw new Error(
+			`Zerops project ${project.id} is the installation's own project; a deployment namespace needs a project of its own`,
+		)
+	}
 	if (target.projectName !== project.name) {
 		throw new Error(`Zerops namespace project name mismatch: expected \`${target.projectName}\`, got \`${project.name}\``)
 	}
@@ -398,7 +406,7 @@ const runNamespaceMutation = async (
 		target = { ...target, projectName: project.name }
 		namespace = await checkpoint(input, namespace, target)
 	}
-	validateProject(namespace, target, project, initiallyAdopted)
+	validateProject(namespace, target, project, initiallyAdopted, options.installationProjectId)
 
 	if (initiallyAdopted) {
 		// Validate before the first mutation; the import below then enforces service-level envIsolation.

package/src/namespace/proxy-reads.ts

@@ -18,8 +18,8 @@ export interface OlderProxyReader {
 }
 
 /**
- * The namespace proxies of the older releases this platform serves (ADR-0062). Control holds their parsers, as it holds
- * their contract readers; a pin's release is not recorded, so what any of them reads is what the pin may read.
+ * The namespace proxies of the older releases a pin may run whose parsers Control holds (ADR-0062). A pin's release is not
+ * recorded, so what any of them reads is what the pin may read.
  */
 export type OlderProxyReaders = readonly [OlderProxyReader, ...OlderProxyReader[]]
 

package/src/namespace/types.ts

@@ -81,6 +81,8 @@ export interface ZeropsNamespaceOptions {
 	readonly iamUrl: string
 	/** Same credential IAM receives as `FABRIKA_IAM_PROXY_KEY`. */
 	readonly iamKey: string
+	/** The installation's own project, which no namespace may create into or adopt. Absent until `platform deploy` writes it. */
+	readonly installationProjectId?: string
 	readonly api: ZeropsApi
 	readonly sleep?: Sleeper
 }

package/src/plan.ts

@@ -48,7 +48,7 @@ export const buildZeropsPlan = (manifest: FabrikaManifest, target: ZeropsRuntime
 	steps.push({
 		id: 'raise-start-memory',
 		kind: 'raise-start-memory',
-		description: "Raise the deploy service's minimum RAM to what its start script needs",
+		description: "Raise the deploy service's minimum RAM to what its init commands need",
 	})
 	steps.push({
 		id: 'size-database',

package/src/provider.ts

@@ -280,14 +280,27 @@ export function interpolateManifest(
 }
 
 /** Human-readable failure for a version that finished in a non-`ACTIVE` state. */
-const terminalFailure = (version: ZeropsAppVersion): string => {
+const terminalFailure = (version: ZeropsAppVersion, checks: boolean): string => {
 	if (version.status === 'BACKUP') {
 		return `app-version ${version.id} was superseded by a newer version before it went live`
 	}
 	if (version.status === 'CANCELLED') {
 		return `app-version ${version.id} was cancelled`
 	}
-	return `Zerops pipeline failed: app-version ${version.id} is ${version.status ?? 'in an unknown state'}`
+	return `Zerops pipeline failed: app-version ${version.id} is ${version.status ?? 'in an unknown state'}${activationHint(version, checks)}`
+}
+
+/**
+ * What a version that built but did not activate tells the operator. Zerops' own log of it is the refused readiness
+ * attempts, which read as a server that never started whatever stopped it. `checks`: the generated init commands run
+ * the migrations, the schema check and the isolation tests, as for a contract application with a database.
+ */
+const activationHint = (version: ZeropsAppVersion, checks: boolean): string => {
+	if (version.status !== 'DEPLOY_FAILED') return ''
+	const failed = ': an init command failed or the readiness check never answered'
+	return checks
+		? `${failed}. The init commands run the migrations, the schema check and the generated isolation tests; the runtime lines above show how far they got`
+		: failed
 }
 
 /**
@@ -415,7 +428,7 @@ const openLog = async (env: StepEnv): Promise<ZeropsLogAccess | null> => {
  * poll loop without telling it leaves a build container burning through the pipeline's hour. A lost lease
  * gives no such permission (ADR-0044), so it stops without touching the build.
  */
-const awaitVersion = async (env: StepEnv, appVersionId: string, processId: string | undefined): Promise<void> => {
+const awaitVersion = async (env: StepEnv, appVersionId: string, processId: string | undefined, checks: boolean): Promise<void> => {
 	const { zerops, signal, log } = env
 	const access = await openLog(env)
 	const seen = new Set<string>()
@@ -461,14 +474,16 @@ const awaitVersion = async (env: StepEnv, appVersionId: string, processId: strin
 
 		if (process?.status !== undefined && ZEROPS_PROCESS_TERMINAL.has(process.status) && process.status !== ZEROPS_PROCESS_FINISHED) {
 			throw new Error(
-				`zerops: pipeline process ${process.id} is ${process.status} while app-version ${appVersionId} is ${version.status ?? 'in an unknown state'}`,
+				`zerops: pipeline process ${process.id} is ${process.status} while app-version ${appVersionId} is ${version.status ?? 'in an unknown state'}${
+					activationHint(version, checks)
+				}`,
 			)
 		}
 		if (version.status !== undefined && ZEROPS_TERMINAL.has(version.status)) {
 			if (version.status === ZEROPS_ACTIVE) {
 				return
 			}
-			throw new Error(terminalFailure(version))
+			throw new Error(terminalFailure(version, checks))
 		}
 		if (Date.now() > env.deadlineMs) await timedOut()
 		await zerops.sleep(POLL_INTERVAL_MS, signal)
@@ -669,7 +684,7 @@ const withMinRam = (custom: ZeropsServiceAutoscaling, minRam: number): ZeropsSer
 })
 
 /**
- * Raises the deploy service's minimum RAM to what the generated start script needs (`zeropsStartMinRam`), before the
+ * Raises the deploy service's minimum RAM to what the generated init commands need (`zeropsStartMinRam`), before the
  * version's containers start. An import cannot: Zerops ignores a changed `verticalAutoscaling` of an existing service,
  * so an existing service converges here, on every deploy. It only raises, and decides by reading the service back.
  */
@@ -970,7 +985,8 @@ const runStep = async (spec: ZeropsStep, env: StepEnv): Promise<void> => {
 			}
 			const appVersionId = requireVersion(env, 'await-version')
 			assertRunning(signal)
-			await awaitVersion(env, appVersionId, attempt.processId)
+			const locked = lockedExecutionFor(artifact, run, dryRun)
+			await awaitVersion(env, appVersionId, attempt.processId, locked !== null && locked.databaseUrl !== null)
 			return
 		}