fix(config-backup): probe a custom folder before the retention fallback reads it, test that Save omits a displayed-only retention

docs/api-reference.md

@@ -1158,7 +1158,7 @@ Timestamped snapshots of the files that hold what a user has customized (`src/co
 
 Tracked files (a fixed list, relative to the data dir): `settings.json`, `clis.json`, `custom-model-hosts.json`, `webhook.json`, `intents.json`, `linked-cases.json`, `remote-hosts.json`, `remote-cases.json`, `docker-hosts.json`, `docker-cases.json`, `webviews.json`, `push-keys.json`, `users.json`, `.env`. Session state (`state.json`, which also holds cron jobs and respawn presets), logs, the hook secret and caches are not.
 
-Settings (synced, in `settings.json`): `configBackupEnabled` (absent = on), `configBackupDir` (absolute path, `~` expanded; empty = `<data dir>/backups/config`), `configBackupKeepCount` (2–500, default 20), `configBackupKeepDays` (0–3650, default 30; `0` = no age limit). Retention only ever deletes snapshot folders Codeman made there, and never the newest one. Each snapshot is a `0700` folder named `cfg-YYYYMMDD-HHMMSS` (server local time; `-2`, `-3`… on a same-second collision) holding the tracked files under their own names plus a `manifest.json` (`id`, `createdAt`, `reason` of `startup`/`auto`/`manual`/`pre-restore`, `appVersion`, the change-check `hash`, an `origin` id, the `keepCount` and `keepDays` in force, and a SHA-256 and size per file), all `0600`. A snapshot is never dated earlier than the instance's newest one, so a clock that read ahead once does not make every later pass write a copy. All four routes answer `503 OPERATION_FAILED` when a custom folder does not respond, and diff and restore answer `409` for a symlinked or group/world-accessible backup as well as a checksum mismatch. Only folders with that name and a valid manifest are listed, restored or pruned. Full guide: `docs/wiki/Config-Backups.md`.
+Settings (synced, in `settings.json`): `configBackupEnabled` (absent = on), `configBackupDir` (absolute path, `~` expanded; empty = `<data dir>/backups/config`), `configBackupKeepCount` (2–500, default 20), `configBackupKeepDays` (0–3650, default 30; `0` = no age limit). A key absent from `settings.json` means the retention the newest backup in the folder recorded, and the default only when none did. Retention only ever deletes snapshot folders Codeman made there, and never the newest one. Each snapshot is a `0700` folder named `cfg-YYYYMMDD-HHMMSS` (server local time; `-2`, `-3`… on a same-second collision) holding the tracked files under their own names plus a `manifest.json` (`id`, `createdAt`, `reason` of `startup`/`auto`/`manual`/`pre-restore`, `appVersion`, the change-check `hash`, an `origin` id, the `keepCount` and `keepDays` in force, and a SHA-256 and size per file), all `0600`. A snapshot is never dated earlier than the instance's newest one, so a clock that read ahead once does not make every later pass write a copy. All four routes answer `503 OPERATION_FAILED` when a custom folder does not respond, and diff and restore answer `409` for a symlinked or group/world-accessible backup as well as a checksum mismatch. Only folders with that name and a valid manifest are listed, restored or pruned. Full guide: `docs/wiki/Config-Backups.md`.
 
 | Method | Path                                 | Body | Notes                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | ------ | ------------------------------------ | ---- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

docs/wiki/Config-Backups.md

@@ -139,9 +139,9 @@ Only the tracked names are ever written, whatever a manifest lists.
 
 Restoring `settings.json` keeps the four backup settings (on or off, folder, how many, how many
 days) at their current values, so a restore from before a folder change does not point the list
-at the old folder and hide the `pre-restore` copy it just made. The exception is a live
-`settings.json` that has none of the four (a reset file): the restore then keeps the backup's own
-how-many and how-many-days, so the next pass does not fall back to 20 copies and 30 days. The
+at the old folder and hide the `pre-restore` copy it just made. The exception is the two
+retention values: where the live `settings.json` lacks one (a reset file), the restore keeps the
+backup's own, key by key, so the next pass does not fall back to 20 copies and 30 days. The
 `pre-restore` copy records the retention in force too.
 
 Settings are re-read on the next request, so reload the page. `.env` and `push-keys.json` are

docs/wiki/Settings-Reference.md

@@ -193,7 +193,8 @@ mode, the **Users** administration entry is injected here.
 The **Config backups** group controls timestamped copies of your configuration files: an
 on/off switch (on by default), the backup folder (default `~/.codeman/backups/config`), how
 many backups to keep (2 to 500, default 20) and how many days to keep them (0 to 3650, default
-30; 0 means no age limit), plus **Back up now** and a list with **Restore**. These are
+30; 0 means no age limit). A value that is not saved in `settings.json` (a reset file) is whatever
+the newest backup in that folder recorded, and the default only when none did, plus **Back up now** and a list with **Restore**. These are
 server-side settings, read fresh. Details, naming and restore behaviour are on
 [Config Backups](Config-Backups).
 

docs/wiki/Troubleshooting.md

@@ -147,6 +147,10 @@ it again and save before looking for the list; until then the list shows the def
 After a reinstall of the data directory the old backups are unlisted because the instance has a
 new id; see [Config Backups](Config-Backups) for how to make them visible again.
 
+A backup is never dated earlier than the newest one, so if the clock was once set to a far
+future date, every later backup keeps that date. Delete the future-dated backup folder to
+return to normal dating.
+
 Without the UI: the backups are plain folders in `~/.codeman/backups/config/`
 (`cfg-YYYYMMDD-HHMMSS`); copy the file you need back over the one in `~/.codeman/`.