@tickernelz/wardmote 2026.1111.0 → 2026.1112.0

package/dist/index.js

@@ -1039,7 +1039,7 @@ var init_constants = __esm({
       "pipelines:write",
       "joins:approve"
     ];
-    TOOL_APPLICATION_TYPES = ["rest_api", "mcp_http", "mcp_stdio", "paperclip_plugin", "a2a", "chat"];
+    TOOL_APPLICATION_TYPES = ["rest_api", "mcp_http", "mcp_stdio", "wardmote_plugin", "a2a", "chat"];
     TOOL_APPLICATION_STATUSES = ["draft", "active", "disabled", "archived"];
     TOOL_CONNECTION_KINDS = ["managed"];
     TOOL_CONNECTION_HEALTH_STATUSES = [
@@ -16605,17 +16605,20 @@ var init_smoke_lab = __esm({
 });
 
 // ../packages/shared/src/types/instance.ts
-var DAILY_RETENTION_PRESETS, WEEKLY_RETENTION_PRESETS, MONTHLY_RETENTION_PRESETS, DEFAULT_BACKUP_RETENTION, SPEECH_TO_TEXT_DEFAULTS, ATTACHMENT_MAX_MEGABYTES_MIN, ATTACHMENT_MAX_MEGABYTES_MAX, ATTACHMENT_ORPHAN_AFTER_DAYS_MIN, ATTACHMENT_ORPHAN_AFTER_DAYS_MAX, ATTACHMENT_CLOSED_TASK_AFTER_DAYS_MIN, ATTACHMENT_CLOSED_TASK_AFTER_DAYS_MAX, DEFAULT_ATTACHMENT_RETENTION, DEFAULT_LOCAL_RUN_LIMITS_SETTINGS, DEFAULT_MESSAGE_DELIVERY;
+var DAILY_RETENTION_PRESETS, WEEKLY_RETENTION_PRESETS, MONTHLY_RETENTION_PRESETS, BACKUP_MAX_FILES_MIN, BACKUP_MAX_FILES_MAX, DEFAULT_BACKUP_RETENTION, SPEECH_TO_TEXT_DEFAULTS, ATTACHMENT_MAX_MEGABYTES_MIN, ATTACHMENT_MAX_MEGABYTES_MAX, ATTACHMENT_ORPHAN_AFTER_DAYS_MIN, ATTACHMENT_ORPHAN_AFTER_DAYS_MAX, ATTACHMENT_CLOSED_TASK_AFTER_DAYS_MIN, ATTACHMENT_CLOSED_TASK_AFTER_DAYS_MAX, DEFAULT_ATTACHMENT_RETENTION, DEFAULT_LOCAL_RUN_LIMITS_SETTINGS, DEFAULT_MESSAGE_DELIVERY;
 var init_instance = __esm({
   "../packages/shared/src/types/instance.ts"() {
     "use strict";
     DAILY_RETENTION_PRESETS = [3, 7, 14];
     WEEKLY_RETENTION_PRESETS = [1, 2, 4];
     MONTHLY_RETENTION_PRESETS = [1, 3, 6];
+    BACKUP_MAX_FILES_MIN = 1;
+    BACKUP_MAX_FILES_MAX = 48;
     DEFAULT_BACKUP_RETENTION = {
       dailyDays: 7,
       weeklyWeeks: 4,
-      monthlyMonths: 1
+      monthlyMonths: 1,
+      maxFiles: 2
     };
     SPEECH_TO_TEXT_DEFAULTS = {
       enabled: false,
@@ -17214,7 +17217,8 @@ var init_instance2 = __esm({
     backupRetentionPolicySchema = z40.object({
       dailyDays: presetSchema(DAILY_RETENTION_PRESETS, "dailyDays").default(DEFAULT_BACKUP_RETENTION.dailyDays),
       weeklyWeeks: presetSchema(WEEKLY_RETENTION_PRESETS, "weeklyWeeks").default(DEFAULT_BACKUP_RETENTION.weeklyWeeks),
-      monthlyMonths: presetSchema(MONTHLY_RETENTION_PRESETS, "monthlyMonths").default(DEFAULT_BACKUP_RETENTION.monthlyMonths)
+      monthlyMonths: presetSchema(MONTHLY_RETENTION_PRESETS, "monthlyMonths").default(DEFAULT_BACKUP_RETENTION.monthlyMonths),
+      maxFiles: z40.number().int().min(BACKUP_MAX_FILES_MIN).max(BACKUP_MAX_FILES_MAX).nullable().default(DEFAULT_BACKUP_RETENTION.maxFiles)
     });
     speechToTextSettingsSchema = z40.object({
       enabled: z40.boolean().default(SPEECH_TO_TEXT_DEFAULTS.enabled),
@@ -20431,7 +20435,7 @@ function findWardmoteConfigKeyWarnings(config) {
   collectConfigKeyWarnings(config, wardmoteConfigSchema, "", warnings);
   return warnings;
 }
-var configMetaSchema, llmConfigSchema, databaseBackupConfigSchema, databaseConfigSchema, loggingConfigSchema, serverConfigSchema, authConfigSchema, storageLocalDiskConfigSchema, storageS3ConfigSchema, storageConfigSchema, secretsLocalEncryptedConfigSchema, secretsConfigSchema, telemetryConfigSchema, updatesConfigSchema, runLogRetentionConfigSchema, runLogsConfigSchema, wardmoteConfigSchema;
+var configMetaSchema, llmConfigSchema, databaseBackupConfigSchema, databaseConfigSchema, loggingConfigSchema, serverConfigSchema, authConfigSchema, storageLocalDiskConfigSchema, storageS3ConfigSchema, storageConfigSchema, secretsLocalEncryptedConfigSchema, secretsConfigSchema, telemetryConfigSchema, updatesConfigSchema, runLogRetentionConfigSchema, diskGuardConfigSchema, runLogsConfigSchema, wardmoteConfigSchema;
 var init_config_schema = __esm({
   "../packages/shared/src/config-schema.ts"() {
     "use strict";
@@ -20450,7 +20454,11 @@ var init_config_schema = __esm({
       enabled: z70.boolean().default(true),
       intervalMinutes: z70.number().int().min(1).max(7 * 24 * 60).default(60),
       retentionDays: z70.number().int().min(1).max(3650).default(7),
-      dir: z70.string().default("~/.wardmote/instances/default/data/backups")
+      dir: z70.string().default("~/.wardmote/instances/default/data/backups"),
+      maxFiles: z70.number().int().min(1).max(48).optional(),
+      reservePercent: z70.number().min(0).max(50).optional(),
+      reserveGb: z70.number().min(0).optional(),
+      pinnedMaxAgeDays: z70.number().int().min(0).max(3650).optional()
     }).passthrough();
     databaseConfigSchema = z70.object({
       mode: z70.enum(["embedded-postgres", "postgres"]).default("embedded-postgres"),
@@ -20530,6 +20538,19 @@ var init_config_schema = __esm({
       recentTailBytes: z70.number().int().min(0).default(5 * 1024 * 1024),
       oldTailBytes: z70.number().int().min(0).default(256 * 1024)
     }).passthrough().prefault({});
+    diskGuardConfigSchema = z70.object({
+      enabled: z70.boolean().default(true),
+      intervalMinutes: z70.number().int().min(1).max(24 * 60).default(5),
+      warnFreePercent: z70.number().min(0).max(100).default(20),
+      warnFreeGb: z70.number().min(0).default(100),
+      actionFreePercent: z70.number().min(0).max(100).default(10),
+      emergencyFreePercent: z70.number().min(0).max(100).default(5),
+      ompSessionMaxIdleDays: z70.number().int().min(5).max(3650).default(7),
+      ompSessionDir: z70.string().optional(),
+      ompBlobDir: z70.string().optional(),
+      ompAgentDir: z70.string().optional(),
+      ompSessionSweep: z70.boolean().optional()
+    }).passthrough().prefault({});
     runLogsConfigSchema = z70.object({
       retention: runLogRetentionConfigSchema
     }).passthrough().prefault({});
@@ -20564,7 +20585,8 @@ var init_config_schema = __esm({
           keyFilePath: "~/.wardmote/instances/default/secrets/master.key"
         }
       }),
-      runLogs: runLogsConfigSchema.optional()
+      runLogs: runLogsConfigSchema.optional(),
+      diskGuard: diskGuardConfigSchema.optional()
     }).passthrough().superRefine((value, ctx) => {
       if (value.server.deploymentMode === "local_trusted" && value.server.exposure !== "private") {
         ctx.addIssue({
@@ -20671,7 +20693,8 @@ var init_notifications = __esm({
       "assignment",
       "review",
       "run_failed",
-      "join_request"
+      "join_request",
+      "disk_space"
     ];
   }
 });
@@ -47801,11 +47824,12 @@ var init_test_embedded_postgres = __esm({
 });
 
 // ../packages/db/src/backup-lib.ts
-import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync } from "node:fs";
-import { basename, resolve as resolve2 } from "node:path";
+import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, renameSync, rmSync, statfsSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, join as join2, resolve as resolve2 } from "node:path";
 import { createInterface as createInterface2 } from "node:readline";
 import { spawn as spawn4 } from "node:child_process";
 import { open as openFile } from "node:fs/promises";
+import { Writable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { createGunzip, createGzip } from "node:zlib";
 import postgres3 from "postgres";
@@ -47840,9 +47864,169 @@ function monthlyRetentionCutoff(nowMs, monthlyMonths) {
   const now = new Date(nowMs);
   return Date.UTC(now.getUTCFullYear(), now.getUTCMonth() - months, 1);
 }
+function readBackupDiskSpace(dir) {
+  const stats = statfsSync(dir);
+  return { freeBytes: stats.bavail * stats.bsize, totalBytes: stats.blocks * stats.bsize };
+}
+function pinnedBackupDir(backupDir) {
+  return join2(backupDir, PINNED_BACKUP_DIRNAME);
+}
+function backupIdentity(file2) {
+  const stats = statSync(file2);
+  return `${stats.size}:${stats.mtimeMs}`;
+}
+async function verifyGzipBackup(file2) {
+  if (statSync(file2).size === 0) throw new Error(`Backup ${basename(file2)} is empty`);
+  await pipeline(
+    createReadStream(file2, { highWaterMark: 1024 * 1024 }),
+    createGunzip({ chunkSize: 1024 * 1024 }),
+    new Writable({ write(_chunk, _encoding, callback) {
+      callback();
+    } })
+  );
+}
+function isArchiveCorruption(error) {
+  const code = error?.code;
+  return typeof code === "string" && code.startsWith("Z_");
+}
+async function checkBackup(file2) {
+  const stats = statSync(file2, { throwIfNoEntry: false });
+  if (!stats || stats.size === 0) return "invalid";
+  if (!file2.endsWith(".gz")) return "valid";
+  if (verifiedBackups.get(file2) === `${stats.size}:${stats.mtimeMs}`) return "valid";
+  try {
+    await verifyGzipBackup(file2);
+  } catch (error) {
+    return isArchiveCorruption(error) ? "invalid" : "unreadable";
+  }
+  verifiedBackups.set(file2, backupIdentity(file2));
+  return "valid";
+}
+function listRotationBackups(backupDir, filenamePrefix) {
+  if (!existsSync(backupDir)) return [];
+  const entries2 = [];
+  for (const name of readdirSync(backupDir)) {
+    if (!name.startsWith(`${filenamePrefix}-`) || !isBackupFilename(name)) continue;
+    const fullPath = resolve2(backupDir, name);
+    const stats = statSync(fullPath, { throwIfNoEntry: false });
+    if (!stats?.isFile()) continue;
+    entries2.push({ fullPath, sizeBytes: stats.size, mtimeMs: stats.mtimeMs });
+  }
+  return entries2.sort((a, b) => b.mtimeMs - a.mtimeMs);
+}
+function removeBackupFile(file2) {
+  rmSync(file2, { force: true });
+  verifiedBackups.delete(file2);
+}
+async function pruneToMaxFiles(backupDir, filenamePrefix, maxFiles, newestFile) {
+  let kept = 1;
+  let removed = 0;
+  const unreadable = [];
+  for (const entry of listRotationBackups(backupDir, filenamePrefix)) {
+    if (entry.fullPath === newestFile) continue;
+    const check46 = await checkBackup(entry.fullPath);
+    if (check46 === "unreadable") {
+      unreadable.push(entry.fullPath);
+      continue;
+    }
+    if (kept < maxFiles && check46 === "valid") {
+      kept += 1;
+      continue;
+    }
+    removeBackupFile(entry.fullPath);
+    removed += 1;
+  }
+  return { removed, unreadable };
+}
+function prunePinnedBackups(backupDir, maxAgeDays, nowMs = Date.now()) {
+  if (!maxAgeDays || maxAgeDays <= 0) return 0;
+  const dir = pinnedBackupDir(backupDir);
+  if (!existsSync(dir)) return 0;
+  let removed = 0;
+  for (const name of readdirSync(dir)) {
+    if (!isBackupFilename(name)) continue;
+    const fullPath = resolve2(dir, name);
+    const stats = statSync(fullPath, { throwIfNoEntry: false });
+    if (!stats?.isFile() || nowMs - stats.mtimeMs < maxAgeDays * DAY_MS) continue;
+    removeBackupFile(fullPath);
+    removed += 1;
+  }
+  return removed;
+}
+function backupReserveBytes(guard, totalBytes) {
+  return Math.max(guard.reserveBytes, Math.ceil(totalBytes * guard.reservePercent / 100));
+}
+async function ensureBackupSpace(input2) {
+  const { guard } = input2;
+  const statfs = guard.statfs ?? readBackupDiskSpace;
+  const existing = listRotationBackups(input2.backupDir, input2.filenamePrefix);
+  const lastSize = existing.find((entry) => entry.sizeBytes > 0)?.sizeBytes ?? 0;
+  const space = statfs(input2.targetDir);
+  const requiredBytes = Math.ceil(lastSize * (guard.headroomFactor ?? DEFAULT_BACKUP_HEADROOM_FACTOR)) + backupReserveBytes(guard, space.totalBytes);
+  if (space.freeBytes >= requiredBytes) return 0;
+  if (input2.rotate) {
+    const invalid = [];
+    const valid = [];
+    for (const entry of existing) {
+      const check46 = await checkBackup(entry.fullPath);
+      if (check46 === "valid") valid.push(entry);
+      else if (check46 === "invalid") invalid.push(entry);
+    }
+    const chosen = [];
+    let reclaimed = 0;
+    for (const entry of [...invalid, ...valid.slice(1).reverse()]) {
+      if (space.freeBytes + reclaimed >= requiredBytes) break;
+      chosen.push(entry);
+      reclaimed += entry.sizeBytes;
+    }
+    if (space.freeBytes + reclaimed >= requiredBytes) {
+      for (const entry of chosen) removeBackupFile(entry.fullPath);
+      return chosen.length;
+    }
+    writeFileSync(
+      join2(input2.backupDir, DATABASE_BACKUP_SKIPPED_MARKER),
+      JSON.stringify({
+        skippedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        freeBytes: space.freeBytes,
+        requiredBytes,
+        totalBytes: space.totalBytes
+      })
+    );
+  }
+  throw new DatabaseBackupSkippedError(input2.backupDir, space.freeBytes, requiredBytes);
+}
 function isBackupFilename(name) {
   return name.endsWith(".sql") || name.endsWith(".sql.gz");
 }
+function partialBackupPath(finalPath) {
+  return `${finalPath}.${process.pid}.partial`;
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function removeAbandonedPartialBackups(backupDir, nowMs = Date.now()) {
+  if (!existsSync(backupDir)) return 0;
+  let removed = 0;
+  for (const name of readdirSync(backupDir)) {
+    const match = PARTIAL_BACKUP_PATTERN.exec(name);
+    if (!match || !isBackupFilename(name.slice(0, match.index))) continue;
+    const fullPath = resolve2(backupDir, name);
+    const pid = Number(match[1]);
+    const ownerGone = pid === process.pid ? !activePartialBackupFiles.has(fullPath) : !isProcessAlive(pid);
+    if (!ownerGone) {
+      const mtimeMs = statSync(fullPath, { throwIfNoEntry: false })?.mtimeMs;
+      if (mtimeMs === void 0 || nowMs - mtimeMs < ABANDONED_PARTIAL_BACKUP_AGE_MS) continue;
+    }
+    rmSync(fullPath, { force: true });
+    removed += 1;
+  }
+  return removed;
+}
 function adoptRetiredBackupFilenames(backupDir) {
   if (!existsSync(backupDir)) return 0;
   let renamed = 0;
@@ -48203,12 +48387,50 @@ async function runDatabaseBackup(opts) {
     sqlClosed = true;
     await sql72.end();
   };
-  mkdirSync(opts.backupDir, { recursive: true });
+  const targetDir = opts.pinned ? pinnedBackupDir(opts.backupDir) : opts.backupDir;
+  mkdirSync(targetDir, { recursive: true });
   if (filenamePrefix === DATABASE_BACKUP_FILENAME_PREFIX) adoptRetiredBackupFilenames(opts.backupDir);
   const checkpointSuffix = opts.verifyBeforePrune ? `-${randomUUID3()}` : "";
-  const sqlFile = resolve2(opts.backupDir, `${filenamePrefix}-${timestamp171()}${checkpointSuffix}.sql`);
-  const backupFile = `${sqlFile}.gz`;
+  removeAbandonedPartialBackups(targetDir);
+  let freedForSpace = 0;
+  if (opts.spaceGuard) {
+    try {
+      freedForSpace = await ensureBackupSpace({
+        backupDir: opts.backupDir,
+        targetDir,
+        filenamePrefix,
+        guard: opts.spaceGuard,
+        rotate: !opts.pinned
+      });
+    } catch (error) {
+      await closeSql();
+      throw error;
+    }
+  }
+  const finalSqlFile = resolve2(targetDir, `${filenamePrefix}-${timestamp171()}${checkpointSuffix}.sql`);
+  const backupFile = `${finalSqlFile}.gz`;
+  const sqlFile = partialBackupPath(finalSqlFile);
+  const partialBackupFile = partialBackupPath(backupFile);
+  activePartialBackupFiles.add(sqlFile);
+  activePartialBackupFiles.add(partialBackupFile);
   const writer = createBufferedTextFileWriter(sqlFile);
+  const finalizeBackup = async () => {
+    await verifyGzipBackup(partialBackupFile);
+    renameSync(partialBackupFile, backupFile);
+    verifiedBackups.set(backupFile, backupIdentity(backupFile));
+    const sizeBytes = statSync(backupFile).size;
+    await opts.verifyBeforePrune?.(backupFile);
+    if (opts.pinned) return { backupFile, sizeBytes, prunedCount: freedForSpace };
+    const rotated = retention.maxFiles && retention.maxFiles > 0 ? await pruneToMaxFiles(opts.backupDir, filenamePrefix, retention.maxFiles, backupFile) : { removed: pruneOldBackups(opts.backupDir, retention, filenamePrefix), unreadable: [] };
+    const prunedCount = freedForSpace + rotated.removed + prunePinnedBackups(opts.backupDir, opts.pinnedMaxAgeDays);
+    rmSync(join2(opts.backupDir, DATABASE_BACKUP_SKIPPED_MARKER), { force: true });
+    return {
+      backupFile,
+      sizeBytes,
+      prunedCount,
+      ...rotated.unreadable.length > 0 ? { unreadableBackups: rotated.unreadable } : {}
+    };
+  };
   try {
     if (backupEngine === "pg_dump" || backupEngine === "auto" && canUsePgDump) {
       await sql72`SELECT 1`;
@@ -48217,14 +48439,14 @@ async function runDatabaseBackup(opts) {
         await closeSql();
         await runPgDumpBackup({
           connectionString: opts.connectionString,
-          backupFile,
+          backupFile: partialBackupFile,
           connectTimeout
         });
         dumped = true;
       } catch (error) {
-        if (existsSync(backupFile)) {
+        if (existsSync(partialBackupFile)) {
           try {
-            unlinkSync(backupFile);
+            unlinkSync(partialBackupFile);
           } catch {
           }
         }
@@ -48237,10 +48459,7 @@ async function runDatabaseBackup(opts) {
       }
       if (dumped) {
         await writer.abort();
-        const sizeBytes2 = statSync(backupFile).size;
-        await opts.verifyBeforePrune?.(backupFile);
-        const prunedCount2 = pruneOldBackups(opts.backupDir, retention, filenamePrefix);
-        return { backupFile, sizeBytes: sizeBytes2, prunedCount: prunedCount2 };
+        return await finalizeBackup();
       }
     }
     await sql72`SELECT 1`;
@@ -48620,33 +48839,24 @@ async function runDatabaseBackup(opts) {
     emit2("");
     await writer.close();
     const sqlReadStream = createReadStream(sqlFile);
-    const gzWriteStream = createWriteStream(backupFile);
+    const gzWriteStream = createWriteStream(partialBackupFile);
     await pipeline(sqlReadStream, createGzip(), gzWriteStream);
     unlinkSync(sqlFile);
-    const sizeBytes = statSync(backupFile).size;
-    await opts.verifyBeforePrune?.(backupFile);
-    const prunedCount = pruneOldBackups(opts.backupDir, retention, filenamePrefix);
-    return {
-      backupFile,
-      sizeBytes,
-      prunedCount
-    };
+    return await finalizeBackup();
   } catch (error) {
     await writer.abort();
-    if (existsSync(backupFile)) {
-      try {
-        unlinkSync(backupFile);
-      } catch {
-      }
-    }
-    if (existsSync(sqlFile)) {
-      try {
-        unlinkSync(sqlFile);
-      } catch {
+    for (const file2 of [backupFile, partialBackupFile, sqlFile]) {
+      if (existsSync(file2)) {
+        try {
+          unlinkSync(file2);
+        } catch {
+        }
       }
     }
     throw error;
   } finally {
+    activePartialBackupFiles.delete(sqlFile);
+    activePartialBackupFiles.delete(partialBackupFile);
     await closeSql();
   }
 }
@@ -48683,9 +48893,10 @@ async function runDatabaseRestore(opts) {
 function formatDatabaseBackupResult(result) {
   const size = formatBackupSize(result.sizeBytes);
   const pruned = result.prunedCount > 0 ? `; pruned ${result.prunedCount} old backup(s)` : "";
-  return `${result.backupFile} (${size}${pruned})`;
+  const unreadable = result.unreadableBackups?.length ? `; kept ${result.unreadableBackups.length} unreadable backup(s)` : "";
+  return `${result.backupFile} (${size}${pruned}${unreadable})`;
 }
-var DEFAULT_BACKUP_WRITE_BUFFER_BYTES, BACKUP_DATA_CURSOR_ROWS, BACKUP_CLI_STDERR_BYTES, BACKUP_BREAKPOINT_DETECT_BYTES, STATEMENT_BREAKPOINT, DATABASE_BACKUP_FILENAME_PREFIX, RETIRED_BACKUP_FILENAME_PREFIX;
+var DEFAULT_BACKUP_WRITE_BUFFER_BYTES, BACKUP_DATA_CURSOR_ROWS, BACKUP_CLI_STDERR_BYTES, BACKUP_BREAKPOINT_DETECT_BYTES, STATEMENT_BREAKPOINT, DATABASE_BACKUP_FILENAME_PREFIX, PINNED_BACKUP_DIRNAME, DATABASE_BACKUP_SKIPPED_MARKER, DEFAULT_BACKUP_HEADROOM_FACTOR, DAY_MS, DatabaseBackupSkippedError, verifiedBackups, RETIRED_BACKUP_FILENAME_PREFIX, PARTIAL_BACKUP_PATTERN, ABANDONED_PARTIAL_BACKUP_AGE_MS, activePartialBackupFiles;
 var init_backup_lib = __esm({
   "../packages/db/src/backup-lib.ts"() {
     "use strict";
@@ -48695,7 +48906,30 @@ var init_backup_lib = __esm({
     BACKUP_BREAKPOINT_DETECT_BYTES = 64 * 1024;
     STATEMENT_BREAKPOINT = "-- paperclip statement breakpoint 69f6f3f1-42fd-46a6-bf17-d1d85f8f3900";
     DATABASE_BACKUP_FILENAME_PREFIX = "wardmote";
+    PINNED_BACKUP_DIRNAME = "pinned";
+    DATABASE_BACKUP_SKIPPED_MARKER = "backup-skipped.json";
+    DEFAULT_BACKUP_HEADROOM_FACTOR = 1.5;
+    DAY_MS = 24 * 60 * 60 * 1e3;
+    DatabaseBackupSkippedError = class extends Error {
+      constructor(backupDir, freeBytes, requiredBytes) {
+        super(
+          `Database backup skipped: ${formatBackupSize(freeBytes)} free on the backup volume, ${formatBackupSize(requiredBytes)} required (last backup x${DEFAULT_BACKUP_HEADROOM_FACTOR} plus reserve).`
+        );
+        this.backupDir = backupDir;
+        this.freeBytes = freeBytes;
+        this.requiredBytes = requiredBytes;
+        this.name = "DatabaseBackupSkippedError";
+      }
+      backupDir;
+      freeBytes;
+      requiredBytes;
+      code = "database_backup_skipped_low_disk";
+    };
+    verifiedBackups = /* @__PURE__ */ new Map();
     RETIRED_BACKUP_FILENAME_PREFIX = "paperclip";
+    PARTIAL_BACKUP_PATTERN = /\.(\d+)\.partial$/;
+    ABANDONED_PARTIAL_BACKUP_AGE_MS = 24 * 60 * 60 * 1e3;
+    activePartialBackupFiles = /* @__PURE__ */ new Set();
   }
 });
 
@@ -48746,10 +48980,13 @@ var src_exports = {};
 __export(src_exports, {
   ADAPTER_AUTH_SESSION_ACTIVE_STATES: () => ADAPTER_AUTH_SESSION_ACTIVE_STATES,
   DATABASE_BACKUP_FILENAME_PREFIX: () => DATABASE_BACKUP_FILENAME_PREFIX,
+  DATABASE_BACKUP_SKIPPED_MARKER: () => DATABASE_BACKUP_SKIPPED_MARKER,
+  DatabaseBackupSkippedError: () => DatabaseBackupSkippedError,
   EMBEDDED_POSTGRES_DATABASE: () => EMBEDDED_POSTGRES_DATABASE,
   EMBEDDED_POSTGRES_PASSWORD: () => EMBEDDED_POSTGRES_PASSWORD,
   EMBEDDED_POSTGRES_TEST_TIMEOUT_MS: () => EMBEDDED_POSTGRES_TEST_TIMEOUT_MS,
   EMBEDDED_POSTGRES_USER: () => EMBEDDED_POSTGRES_USER,
+  PINNED_BACKUP_DIRNAME: () => PINNED_BACKUP_DIRNAME,
   accountingRuntimeBaselines: () => accountingRuntimeBaselines,
   activityLog: () => activityLog,
   adapterAuthSessions: () => adapterAuthSessions,
@@ -48977,6 +49214,7 @@ __export(src_exports, {
   modelCooldowns: () => modelCooldowns,
   nativeRunFinalizations: () => nativeRunFinalizations,
   nativeRunResults: () => nativeRunResults,
+  pinnedBackupDir: () => pinnedBackupDir,
   pipelineAutomationExecutions: () => pipelineAutomationExecutions,
   pipelineCaseBlockers: () => pipelineCaseBlockers,
   pipelineCaseDocuments: () => pipelineCaseDocuments,
@@ -49010,6 +49248,7 @@ __export(src_exports, {
   projects: () => projects,
   providerBillingSnapshots: () => providerBillingSnapshots,
   providerTraceRecords: () => providerTraceRecords,
+  readBackupDiskSpace: () => readBackupDiskSpace,
   reconcileDatabaseWork: () => reconcileDatabaseWork,
   reconcilePendingMigrationHistory: () => reconcilePendingMigrationHistory,
   remoteAgentProfiles: () => remoteAgentProfiles,
@@ -49067,6 +49306,7 @@ __export(src_exports, {
   userSecretDeclarations: () => userSecretDeclarations,
   userSecretDefinitions: () => userSecretDefinitions,
   userSidebarPreferences: () => userSidebarPreferences,
+  verifyGzipBackup: () => verifyGzipBackup,
   webPushSubscriptions: () => webPushSubscriptions,
   withDedicatedDbConnection: () => withDedicatedDbConnection,
   workAssessments: () => workAssessments,
@@ -49651,7 +49891,7 @@ var init_client2 = __esm({
 
 // ../packages/shared/src/telemetry/state.ts
 import { randomUUID as randomUUID4, randomBytes as randomBytes5 } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
 import path15 from "node:path";
 function loadOrCreateState(stateDir, version) {
   const filePath = path15.join(stateDir, "state.json");
@@ -49672,7 +49912,7 @@ function loadOrCreateState(stateDir, version) {
     firstSeenVersion: version
   };
   mkdirSync2(stateDir, { recursive: true });
-  writeFileSync(filePath, JSON.stringify(state, null, 2) + "\n", "utf-8");
+  writeFileSync2(filePath, JSON.stringify(state, null, 2) + "\n", "utf-8");
   return state;
 }
 var init_state = __esm({
@@ -60932,6 +61172,13 @@ function normalizeRetentionDays(value, fallback) {
   }
   return candidate;
 }
+function normalizeMaxFiles(value, fallback) {
+  const candidate = value ?? fallback;
+  if (!Number.isInteger(candidate) || candidate < 0 || candidate > 48) {
+    throw new Error(`Invalid max files '${String(candidate)}'. Use an integer from 0 to 48.`);
+  }
+  return candidate;
+}
 function resolveBackupDir(raw) {
   return path29.resolve(expandHomePrefix(raw.trim()));
 }
@@ -60948,19 +61195,28 @@ async function dbBackupCommand(opts) {
     opts.retentionDays,
     config?.database.backup.retentionDays ?? 30
   );
+  const maxFiles = normalizeMaxFiles(opts.maxFiles, config?.database.backup.maxFiles ?? 2);
   const filenamePrefix = opts.filenamePrefix?.trim() || DATABASE_BACKUP_FILENAME_PREFIX;
+  const pinned = opts.pin === true;
+  const retentionLabel = pinned ? "pinned (outside rotation)" : maxFiles > 0 ? `newest ${maxFiles} verified backup(s)` : `${retentionDays} day(s), tiered`;
   p10.log.message(pc7.dim(`Config: ${configPath}`));
   p10.log.message(pc7.dim(`Connection source: ${connection.source}`));
-  p10.log.message(pc7.dim(`Backup dir: ${backupDir}`));
-  p10.log.message(pc7.dim(`Retention: ${retentionDays} day(s)`));
+  p10.log.message(pc7.dim(`Backup dir: ${pinned ? pinnedBackupDir(backupDir) : backupDir}`));
+  p10.log.message(pc7.dim(`Retention: ${retentionLabel}`));
   const spinner4 = p10.spinner();
   spinner4.start("Creating database backup...");
   try {
     const result = await runDatabaseBackup({
       connectionString: connection.value,
       backupDir,
-      retention: { dailyDays: retentionDays, weeklyWeeks: 4, monthlyMonths: 1 },
-      filenamePrefix
+      retention: { dailyDays: retentionDays, weeklyWeeks: 4, monthlyMonths: 1, maxFiles: maxFiles > 0 ? maxFiles : null },
+      filenamePrefix,
+      pinned,
+      pinnedMaxAgeDays: config?.database.backup.pinnedMaxAgeDays ?? 30,
+      spaceGuard: {
+        reservePercent: config?.database.backup.reservePercent ?? 5,
+        reserveBytes: Math.round((config?.database.backup.reserveGb ?? 10) * 1024 ** 3)
+      }
     });
     spinner4.stop(`Backup saved: ${formatDatabaseBackupResult(result)}`);
     if (opts.json) {
@@ -60972,6 +61228,8 @@ async function dbBackupCommand(opts) {
             prunedCount: result.prunedCount,
             backupDir,
             retentionDays,
+            maxFiles,
+            pinned,
             connectionSource: connection.source
           },
           null,
@@ -60996,7 +61254,7 @@ var init_db_backup = __esm({
 });
 
 // src/services/instance-drain.ts
-function isProcessAlive(pid) {
+function isProcessAlive2(pid) {
   try {
     process.kill(pid, 0);
     return true;
@@ -61011,7 +61269,7 @@ function resolveConfiguredInstanceApiBase(instanceId) {
 }
 function resolveInstanceEndpoint(instanceId, deps = {}) {
   const runtime = (deps.readRuntime ?? readRuntimeInfo)(instanceId);
-  const alive = deps.isProcessAlive ?? isProcessAlive;
+  const alive = deps.isProcessAlive ?? isProcessAlive2;
   if (runtime && alive(runtime.pid)) {
     return { apiBase: buildLocalAppUrl(runtime.host, runtime.port), source: "runtime-info", pid: runtime.pid };
   }
@@ -61224,7 +61482,7 @@ async function withHotRestartLock(instanceId, callback, options = {}) {
   const token = `${process.pid}:${Date.now()}:${Math.random().toString(16).slice(2)}`;
   const deadline = Date.now() + (options.timeoutMs ?? 12e4);
   const pollMs = options.pollMs ?? 100;
-  const isProcessAlive3 = options.isProcessAlive ?? ((pid) => {
+  const isProcessAlive4 = options.isProcessAlive ?? ((pid) => {
     try {
       process.kill(pid, 0);
       return true;
@@ -61243,7 +61501,7 @@ async function withHotRestartLock(instanceId, callback, options = {}) {
       try {
         const existingToken = (await fs28.readFile(lockPath, "utf8")).trim();
         const ownerPid = Number.parseInt(existingToken.split(":", 1)[0] ?? "", 10);
-        if (Number.isInteger(ownerPid) && ownerPid > 0 && !isProcessAlive3(ownerPid)) {
+        if (Number.isInteger(ownerPid) && ownerPid > 0 && !isProcessAlive4(ownerPid)) {
           if ((await fs28.readFile(lockPath, "utf8")).trim() === existingToken) {
             await fs28.rm(lockPath, { force: true });
             continue;
@@ -61326,7 +61584,7 @@ async function startManagedService(input2 = {}) {
   return { status: await detection.manager.status(), health };
 }
 async function resolveInstanceLiveness(input2) {
-  const alive = input2.isProcessAlive ?? isProcessAlive;
+  const alive = input2.isProcessAlive ?? isProcessAlive2;
   const runtime = (input2.readRuntime ?? readRuntimeInfo)(input2.instanceId);
   if (runtime && alive(runtime.pid)) {
     return { running: true, detail: `server pid ${runtime.pid} is listening on ${runtime.host}:${runtime.port}` };
@@ -61672,7 +61930,7 @@ async function updateCommand(options, overrides = {}) {
       const confirmed = await (overrides.confirm ?? defaultConfirm)(`Update from ${manifest.repo}@${manifest.ref} and execute build scripts from commit ${targetSha.slice(0, 12)}?`);
       if (!confirmed) throw new Error("Git update cancelled. Re-run with --yes to confirm executing build scripts from the updated commit.");
     }
-    if (options.backup !== false) await runPreUpdateBackup(options, overrides.backup ?? (() => dbBackupCommand({})), overrides.hasInstanceData);
+    if (options.backup !== false) await runPreUpdateBackup(options, overrides.backup ?? (() => dbBackupCommand({ pin: true })), overrides.hasInstanceData);
     const installed2 = await withInstallStoreLock(async () => {
       assertManagedShimWritable(paths);
       const payload = await installGitPayload(manifest.repo, targetSha, runCommand2, paths);
@@ -61755,7 +62013,7 @@ async function updateCommand(options, overrides = {}) {
     return;
   }
   await assertReleaseSetPublished(targetVersion, runCommand2);
-  if (options.backup !== false) await runPreUpdateBackup(options, overrides.backup ?? (() => dbBackupCommand({})), overrides.hasInstanceData);
+  if (options.backup !== false) await runPreUpdateBackup(options, overrides.backup ?? (() => dbBackupCommand({ pin: true })), overrides.hasInstanceData);
   const installed = await withInstallStoreLock(async () => {
     assertManagedShimWritable(paths);
     const payload = await installNpmPayload(targetVersion, runCommand2, paths);
@@ -62219,7 +62477,7 @@ function writeRegistryLockOwner(lockPath, owner) {
     fs31.renameSync(temporaryPath, ownerPath);
   }
 }
-function isProcessAlive2(pid) {
+function isProcessAlive3(pid) {
   try {
     process.kill(pid, 0);
     return true;
@@ -62283,7 +62541,7 @@ function removeStaleRegistryLock(lockPath) {
     const ageMs = Date.now() - fs31.statSync(lockPath).mtimeMs;
     if (ageMs <= WORKTREE_PORT_REGISTRY_LOCK_STALE_MS) return false;
     const owner = readRegistryLockOwner(lockPath);
-    if (owner && isProcessAlive2(owner.pid)) {
+    if (owner && isProcessAlive3(owner.pid)) {
       if (probeRegistryLockOwner(owner)) return false;
       const currentIdentity = readProcessIdentity(owner.pid);
       if (owner.processIdentity === currentIdentity) return false;
@@ -63244,10 +63502,10 @@ import {
   readFileSync as readFileSync4,
   readlinkSync,
   renameSync as renameSync2,
-  rmSync,
+  rmSync as rmSync2,
   statSync as statSync3,
   symlinkSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "node:fs";
 import os10 from "node:os";
 import path37 from "node:path";
@@ -63637,7 +63895,7 @@ function copyDirectoryContents(sourceDir, targetDir) {
       continue;
     }
     if (entry.isSymbolicLink()) {
-      rmSync(targetPath, { recursive: true, force: true });
+      rmSync2(targetPath, { recursive: true, force: true });
       symlinkSync(readlinkSync(sourcePath), targetPath);
       copied = true;
       continue;
@@ -63897,7 +64155,7 @@ function copySeededSecretsKey(input2) {
   const allowProcessEnvFallback = isCurrentSourceConfigPath(input2.sourceConfigPath);
   const sourceInlineMasterKey = nonEmpty2(input2.sourceEnvEntries.WARDMOTE_SECRETS_MASTER_KEY) ?? (allowProcessEnvFallback ? nonEmpty2(process.env.WARDMOTE_SECRETS_MASTER_KEY) : null);
   if (sourceInlineMasterKey) {
-    writeFileSync2(input2.targetKeyFilePath, sourceInlineMasterKey, {
+    writeFileSync3(input2.targetKeyFilePath, sourceInlineMasterKey, {
       encoding: "utf8",
       mode: 384
     });
@@ -63973,7 +64231,7 @@ async function ensureEmbeddedPostgres(dataDir, preferredPort, options = {}) {
     }
   }
   if (existsSync4(postmasterPidFile)) {
-    rmSync(postmasterPidFile, { force: true });
+    rmSync2(postmasterPidFile, { force: true });
   }
   try {
     await instance.start();
@@ -64466,7 +64724,7 @@ function resolveSeedInstanceId(configPath) {
 function writeWorktreeSeedManifest(filePath, manifest) {
   mkdirSync3(path37.dirname(filePath), { recursive: true });
   const temporaryPath = `${filePath}.${process.pid}.${randomUUID6()}.tmp`;
-  writeFileSync2(temporaryPath, `${JSON.stringify(manifest, null, 2)}
+  writeFileSync3(temporaryPath, `${JSON.stringify(manifest, null, 2)}
 `, { mode: 384 });
   renameSync2(temporaryPath, filePath);
 }
@@ -64514,8 +64772,8 @@ function markWorktreeSeedPending(input2) {
       ...input2.diagnosticMessage ? { message: input2.diagnosticMessage.slice(0, WORKTREE_SEED_DIAGNOSTIC_MESSAGE_LIMIT) } : {}
     }]
   });
-  rmSync(markers.complete, { force: true });
-  rmSync(markers.pending, { force: true });
+  rmSync2(markers.complete, { force: true });
+  rmSync2(markers.pending, { force: true });
 }
 function updateWorktreeSeedManifest(input2) {
   const markers = resolveWorktreeSeedMarkerPaths(input2.configPath);
@@ -64899,14 +65157,14 @@ async function runWorktreeInit(opts) {
     );
   }
   if (opts.force) {
-    rmSync(paths.configPath, { force: true });
-    rmSync(paths.envPath, { force: true });
+    rmSync2(paths.configPath, { force: true });
+    rmSync2(paths.envPath, { force: true });
     const seedMarkers = resolveWorktreeSeedMarkerPaths(paths.configPath);
-    rmSync(seedMarkers.manifest, { force: true });
-    rmSync(seedMarkers.pending, { force: true });
-    rmSync(seedMarkers.complete, { force: true });
-    rmSync(seedMarkers.empty, { force: true });
-    rmSync(paths.instanceRoot, { recursive: true, force: true });
+    rmSync2(seedMarkers.manifest, { force: true });
+    rmSync2(seedMarkers.pending, { force: true });
+    rmSync2(seedMarkers.complete, { force: true });
+    rmSync2(seedMarkers.empty, { force: true });
+    rmSync2(paths.instanceRoot, { recursive: true, force: true });
   }
   const { serverPort, databasePort, targetConfig } = await withWorktreePortRegistryLock(
     paths.homeDir,
@@ -64934,7 +65192,7 @@ async function runWorktreeInit(opts) {
       try {
         if (opts.empty) {
           mkdirSync3(paths.repoConfigDir, { recursive: true });
-          writeFileSync2(resolveWorktreeSeedMarkerPaths(paths.configPath).empty, "Explicitly empty instance; automatic database copying is disabled.\n", { mode: 384 });
+          writeFileSync3(resolveWorktreeSeedMarkerPaths(paths.configPath).empty, "Explicitly empty instance; automatic database copying is disabled.\n", { mode: 384 });
         }
         writeConfig(selectedConfig, paths.configPath);
         writeWorktreePortRegistry(paths.homeDir, [
@@ -64942,8 +65200,8 @@ async function runWorktreeInit(opts) {
           paths.configPath
         ]);
       } catch (error) {
-        rmSync(paths.configPath, { force: true });
-        if (opts.empty) rmSync(resolveWorktreeSeedMarkerPaths(paths.configPath).empty, { force: true });
+        rmSync2(paths.configPath, { force: true });
+        if (opts.empty) rmSync2(resolveWorktreeSeedMarkerPaths(paths.configPath).empty, { force: true });
         throw error;
       }
       return {
@@ -65345,7 +65603,7 @@ async function worktreeCleanupCommand(nameArg, opts) {
   if (existsSync4(targetPath)) {
     const spinner4 = p14.spinner();
     spinner4.start(`Removing worktree directory ${targetPath}...`);
-    rmSync(targetPath, { recursive: true, force: true });
+    rmSync2(targetPath, { recursive: true, force: true });
     spinner4.stop(`Removed worktree directory ${targetPath}.`);
   }
   if (localBranchExists(sourceCwd, name)) {
@@ -65366,7 +65624,7 @@ async function worktreeCleanupCommand(nameArg, opts) {
   if (existsSync4(instanceRoot)) {
     const spinner4 = p14.spinner();
     spinner4.start(`Removing instance data at ${instanceRoot}...`);
-    rmSync(instanceRoot, { recursive: true, force: true });
+    rmSync2(instanceRoot, { recursive: true, force: true });
     spinner4.stop(`Removed instance data at ${instanceRoot}.`);
   }
   p14.outro(pc10.green("Cleanup complete."));
@@ -66382,7 +66640,7 @@ async function runWorktreeReseed(opts) {
       expectedCompanyId: nonEmpty2(process.env.WARDMOTE_SEED_EXPECTED_COMPANY_ID) ?? void 0,
       seedDatabase: seedWorktreeDatabase
     });
-    rmSync(markers.empty, { force: true });
+    rmSync2(markers.empty, { force: true });
     spinner4.stop(`Reseeded ${targetEndpoint.label} (${seedMode}).`);
     p14.log.message(pc10.dim(`Source: ${source.configPath}`));
     p14.log.message(pc10.dim(`Target: ${targetEndpoint.configPath}`));
@@ -79356,9 +79614,9 @@ function registerAccessCommands(program2) {
       }
     })
   );
-  const join2 = program2.command("join").description("Join request operations");
+  const join3 = program2.command("join").description("Join request operations");
   addCommonClientOptions(
-    join2.command("list").description("List join requests").option("-C, --company-id <id>", "Company ID").option("--status <status>", "Filter by status (pending_approval, approved, rejected; pending alias accepted)").option("--request-type <type>", "Filter by request type").action(async (opts) => {
+    join3.command("list").description("List join requests").option("-C, --company-id <id>", "Company ID").option("--status <status>", "Filter by status (pending_approval, approved, rejected; pending alias accepted)").option("--request-type <type>", "Filter by request type").action(async (opts) => {
       try {
         const ctx = resolveCommandContext(opts, { requireCompany: true });
         const params = new URLSearchParams();
@@ -79373,10 +79631,10 @@ function registerAccessCommands(program2) {
     }),
     { includeCompany: false }
   );
-  addJoinAction(join2, "approve");
-  addJoinAction(join2, "reject");
+  addJoinAction(join3, "approve");
+  addJoinAction(join3, "reject");
   addCommonClientOptions(
-    join2.command("claim-key").description("Claim an agent API key for an approved join request").argument("<requestId>", "Join request ID").requiredOption("--claim-secret <secret>", "Claim secret").action(async (requestId, opts) => {
+    join3.command("claim-key").description("Claim an agent API key for an approved join request").argument("<requestId>", "Join request ID").requiredOption("--claim-secret <secret>", "Claim secret").action(async (requestId, opts) => {
       try {
         const ctx = resolveCommandContext(opts);
         printOutput(await ctx.api.post(apiPath`/api/join-requests/${requestId}/claim-api-key`, { claimSecret: opts.claimSecret }), { json: ctx.json });
@@ -80564,6 +80822,20 @@ function readIfExists(filePath) {
     throw error;
   }
 }
+function rewriteLegacyStoreMarker(markerPath) {
+  let contents;
+  try {
+    const stat3 = fs37.lstatSync(markerPath);
+    const getuid = process.getuid;
+    if (!stat3.isFile() || stat3.nlink > 1 || typeof getuid === "function" && stat3.uid !== getuid()) return false;
+    contents = fs37.readFileSync(markerPath, "utf8");
+  } catch {
+    return false;
+  }
+  if (contents !== LEGACY_STORE_MARKER) return false;
+  writeFileAtomic(markerPath, MANAGED_STORE_MARKER, 384);
+  return true;
+}
 function isLegacyShim(file2) {
   const contents = readIfExists(file2);
   return contents !== null && isManagedShimContents(contents, LEGACY_SHIM_MARKER);
@@ -80607,9 +80879,13 @@ async function migrateHomeCommand(options = {}, overrides = {}) {
   const unrecognizedShims = [legacyShim, shim].filter((file2) => !legacyShims.includes(file2) && readIfExists(file2)?.includes(`# ${LEGACY_SHIM_MARKER}
 `));
   const rcFiles = [".bashrc", ".zshrc"].map((name) => path50.join(deps.userHomeDir, name)).filter((file2) => readIfExists(file2)?.includes(LEGACY_PATH_BLOCK_START));
-  const storeHome = home === "absent" ? source : target;
+  const storeHome = target;
   const markerPath = path50.join(home === "move" ? source : storeHome, "cli", ".managed-install");
-  const legacyStore = readIfExists(markerPath) === LEGACY_STORE_MARKER;
+  const storeMarker = readIfExists(markerPath);
+  const legacyStore = storeMarker === LEGACY_STORE_MARKER;
+  if (storeMarker !== null && !legacyStore && storeMarker !== MANAGED_STORE_MARKER) {
+    throw new Error(`Refusing to migrate: unrecognized install store marker ${markerPath}.`);
+  }
   const steps = [
     home === "move" ? `move ${source} to ${target} and link ${source} -> ${target}` : null,
     ...definitions.map((definition) => `replace ${path50.basename(definition.from)}${fs37.existsSync(`${definition.from}.d`) ? " and its drop-in directory" : ""} with ${path50.basename(definition.to)}`),
@@ -80682,6 +80958,9 @@ async function migrateHomeCommand(options = {}, overrides = {}) {
   if (definitions.length > 0) deps.log("Start the service with `wardmote service start`.");
 }
 
+// src/index.ts
+init_install_store();
+
 // src/commands/migrate-names.ts
 init_src2();
 init_db_backup();
@@ -81058,6 +81337,9 @@ program.hook("preAction", async (_thisCommand, actionCommand) => {
     assertTestDriveDatabaseIsolation(options.config);
   }
   initTelemetryFromConfigFile(options.config);
+  if (["install", "update", "uninstall"].includes(actionCommand.name())) {
+    rewriteLegacyStoreMarker(resolveInstallStorePaths().markerPath);
+  }
 });
 registerTestDriveCommand(program);
 registerRuntimeCommands(program);
@@ -81070,7 +81352,7 @@ program.command("channels").description("Show the release channels and which one
   await channelsCommand(opts);
 });
 program.command("configure").description("Update configuration sections").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("-s, --section <section>", "Section to configure (llm, database, logging, server, storage, secrets)").action(configure);
-program.command("db:backup").description("Create a one-off database backup using current config").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("--dir <path>", "Backup output directory (overrides config)").option("--retention-days <days>", "Retention window used for pruning", (value) => Number(value)).option("--filename-prefix <prefix>", "Backup filename prefix", "paperclip").option("--json", "Print backup metadata as JSON").action(async (opts) => {
+program.command("db:backup").description("Create a one-off database backup using current config").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).option("--dir <path>", "Backup output directory (overrides config)").option("--max-files <count>", "Keep this many newest verified backups (0 = tiered retention by --retention-days)", (value) => Number(value)).option("--retention-days <days>", "Daily window for tiered retention when --max-files is 0", (value) => Number(value)).option("--pin", "Write a pinned backup under <dir>/pinned, outside rotation (release and rollback dumps)").option("--filename-prefix <prefix>", "Backup filename prefix (default: wardmote)").option("--json", "Print backup metadata as JSON").action(async (opts) => {
   await dbBackupCommand(opts);
 });
 program.command("allowed-hostname").description("Allow a hostname for authenticated/private mode access").argument("<host>", "Hostname to allow (for example dotta-macbook-pro)").option("-c, --config <path>", "Path to config file").option("-d, --data-dir <path>", DATA_DIR_OPTION_HELP).action(addAllowedHostname);