Protection status
One strict yes or no to "could this database be restored right now?"
Protected means you could restore this database right now, to within minutes of now. Rowsafe checks it continuously, and it's strict on purpose.
$ rowsafe status app
app is PROTECTED.
Last backup: 7.2h ago
Last WAL archived: 41s ago
Recoverable from: Sun, 14 Sep 2026 01:00:12 UTC
Last passing drill: 3d agoThe conditions
Protected only when all hold:
| Condition | Why |
|---|---|
The database is active | Archiving has been proven to reach your bucket. |
| The agent reported the archiving status in the last 10 minutes, without an error | Unknown counts as failing. |
| No archiving failure in the last 15 minutes | Recent changes might not be in the bucket. |
| A backup finished in the last 26 hours | Restores would replay a very long log. |
| The latest Proof (restore test) passed, less than 8 days ago | Only a restore test proves the backups restore. |
Otherwise it lists every reason:
app is NOT PROTECTED:
- WAL archiving failed at 2026-09-24T09:12:03Z (within the last 15m0s)
- no passing restore drill in the last 8 daysFor scripts and AI agents
rowsafe status NAME exits with:
| Exit code | Meaning |
|---|---|
0 | Protected |
3 | Not protected |
1 | Error (for example not logged in, or the database doesn't exist) |
Gate a risky step on it:
rowsafe status app && ./migrate.sh--json gives every detail, including the start of the recovery window. AI agents use the safety_check MCP tool (Guard).
Fleet health
rowsafe status with no name checks everything (offline agents, stale backups, failing archiving, failed Proof, pending restarts...) and suggests the next command for each problem. Exits 0 when nothing is critical or a warning, 3 otherwise.
2 hosts, 3 databases (3 active): 0 critical, 0 warning(s). All good: every active database has recent backups, WAL archiving works and drills pass.