Codify backup-first operational discipline before DreamMode/Sandman invocation

Context

Surfaced 2026-05-05 during DreamMode-inactivity investigation per @tobiu's explicit hint: "before running dreammode / sandman, to backup MC. we have scripts for it."

The Memory Core has an atomic-bundle backup primitive (npm run ai:backup → buildScripts/ai/backup.mjs) that snapshots the unified MC + KB + graph + concepts + trajectories state into .neo-ai-data/backups/backup-<ISO-timestamp>/. The discipline of running backup BEFORE invoking DreamMode/Sandman (autoDream / autoGoldenPath / runSandman) is currently tribal knowledge — operator-named in session 2026-05-05 but not codified in any committed substrate.

learn/agentos/DreamPipeline.md exists as the canonical operator-facing substrate for the Dream Pipeline architecture. It does NOT currently document the pre-run backup discipline.

The Problem

Without codified pre-run discipline:

1. Agents operating autonomously (e.g., night-shift driver per #10763 Leased Driver Pattern, or follow-up agents picking up DreamPipeline-adjacent work) may invoke runSandman / re-enable autoDream without backup, risking the same regression that triggered @tobiu's manual disable in the first place.

2. Operators picking up DreamMode work after a multi-day gap must remember the discipline by recall rather than reading documented procedure. Tribal knowledge accumulates; new contributors hit the regression and lose state.

3. The substrate IS observable through npm run ai:backup — but the discipline gap is between knowing the script exists and knowing to ALWAYS run it before DreamMode invocation.

The Architectural Reality

• learn/agentos/DreamPipeline.md — canonical operator-facing substrate; natural home for the discipline
• buildScripts/ai/backup.mjs — the atomic-bundle backup orchestrator (covers KB JSONL + MC memories+summaries JSONL + graph SQLite JSONL + concepts JSONL + trajectories JSONL)
• package.json:18 — "ai:backup" npm script
• ai/mcp/server/memory-core/config.mjs:35,41 — current operator-disabled state (false && short-circuits on autoDream + autoGoldenPath)
• Empirical anchor: session 2026-05-05 — @tobiu manually disabled both flags 2026-05-05 13:53 (deliberate safety measure pending regression resolution)

The Fix

Add a "Pre-Run Backup Discipline" section to learn/agentos/DreamPipeline.md. Cover:

1. The backup primitive: npm run ai:backup — what it captures, where it stores, retention policy reference
2. The discipline: ALWAYS run backup before:
   • Re-enabling autoDream / autoGoldenPath after a deliberate disable
   • Invoking runSandman manually for the first time after a substrate change
   • Running any DreamPipeline-adjacent script that mutates Memory Core state
3. The why: DreamPipeline mutations are graph-write-heavy; a regression mid-run can produce corrupted graph state that's expensive to recover from without a backup. Backup-first is the cheap-insurance discipline.
4. The recovery procedure: if a DreamMode run produces unexpected state, the canonical recovery is restore-from-most-recent-backup (procedure documented in #10129 / defragChromaDB.cleanOldBackups family)

Sibling addition: cross-reference from any wake-substrate scripts (runSandman.mjs, resumeHarness.mjs if it triggers Dream-adjacent work) to the backup discipline doc.

Acceptance Criteria

• learn/agentos/DreamPipeline.md adds a "Pre-Run Backup Discipline" section
• Section names the canonical primitive (npm run ai:backup)
• Section enumerates the discipline triggers (3+ scenarios above)
• Section names the recovery procedure (restore-from-most-recent-backup)
• runSandman.mjs (or its harness invocation point) cross-references the discipline doc
• If feasible: runSandman halts with operator-actionable message if no recent backup exists (e.g. < 24h old); operator override flag (--skip-backup-check) for explicit bypass

Out of Scope

• Implementing a backup-required gate in runSandman.mjs beyond the discipline doc (mechanical-gate variant — file as scope-extension if discipline alone insufficient)
• Defining retention policy beyond what's already in buildScripts/ai/backup.mjs (TODO comment in the file)
• Backup automation / scheduled backups (operator-territory; this ticket is operational discipline)
• Recovery procedure end-to-end documentation (separate scope; this ticket points at it but doesn't author it)

Avoided Traps

• Mechanical-gate-first: would block legitimate brief test runs by operators who explicitly accept the risk. Discipline-doc with named override flag is consistent with pull-request-workflow precedent.
• Bundling with DreamMode-regression bug ticket: different surface (operational discipline vs underlying-bug investigation). Sibling family but separate triggers.
• Single-line mention: the discipline needs explicit triggers + why + recovery procedure to be operationally complete; one-line "backup first" tribal-knowledge-shape is what already exists.

Related

• Operator hint (2026-05-05): "before running dreammode / sandman, to backup MC. we have scripts for it" — @tobiu, session 23b9cbcd-4938-4a46-b21a-0d48dd12e7e7
• Backup primitive: buildScripts/ai/backup.mjs (atomic-bundle, per #10129 Phase 3)
• Adjacent observability: healthcheck features.dream block (sibling-filed this session; provides the visibility needed to enforce the discipline)
• Underlying substrate: #10494 (DreamService regression — possible cause of the operator-disable that triggered this discipline being named)

Origin Session ID: 23b9cbcd-4938-4a46-b21a-0d48dd12e7e7

Retrieval Hint: query_raw_memories(query="DreamPipeline backup-first discipline runSandman ai:backup pre-run safety operator hint 10494")