Module backup 

Standalone gwbk backup actions (07-02, BKUP-01) — the Phase 4 client methods surfaced on ANY profiled gateway (not just rigs).

Pure orchestration: the wire shipped in 04-04 (the streamed download through download_to_file, the raw octet-stream restore POST with four explicit-false scope params) — this layer owns only the default output naming (the project-export .part rename pattern: stream to a fallback name, rename to the Content-Disposition basename when the gateway sends one) and the usage-class file pre-checks the rig restore established (a nonexistent/empty/directory --file refuses exit 2 BEFORE any network work).

The 8th --yes-guarded destructive verb lives at the CLI seam (backup restore, main.rs — guard BEFORE resolution, the sessions-terminate shape); the actions here stay unguarded (caller-owns-guard). The post-restore restart-block window is a README truth, not output data (Pitfall 6).

Structs

BackupDownloadResult

ign backup download output model — all keys always.

BackupRestoreResult

ign backup restore output model — the flat success shape.

Functions

backup_download

ign backup download — stream the gwbk to disk. Default naming rides the project-export .part pattern: stream to <stem>-backup.gwbk.part, rename to the disposition basename (or the fallback) once the metadata arrives; a failed download leaves no half-written impostor.

backup_restore

ign backup restore — thin orchestration over the 04-04 trait method: usage-class file pre-checks (the rig restore shape: exists + regular + non-empty, exit 2 BEFORE any network work), then the raw octet-stream POST. The 2xx is ACCEPTANCE; the gateway restarts after answering (README-documented).