acamarata · Oct 29, 2026 · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026 · Oct 28, 2026
diff --git a/.github/surface-parity.json b/.github/surface-parity.json
@@ -216,7 +216,7 @@
       "wiki_page": true,
       "mcp_tool": true,
       "mcp_tools": 10,
-      "env_vars": "undocumented: NSELF_PLUGIN_REGISTRY",
+      "env_vars": "documented",
       "http_route": true,
       "http_routes": 10
     }

diff --git a/.github/surface-parity.md b/.github/surface-parity.md
@@ -29,6 +29,6 @@ One row per top-level command (CLI-R17), scored against the four surfaces a comm
 | `nself start` | core | yes | 1 | undocumented: NSELF_PROFILE, NSELF_SKIP_DB_INIT | 1 |
 | `nself status` | core | yes | 8 | n/a | 8 |
 | `nself stop` | core | yes | 1 | n/a | 1 |
-| `nself update` | account | yes | 10 | undocumented: NSELF_PLUGIN_REGISTRY | 10 |
+| `nself update` | account | yes | 10 | documented | 10 |
 
-Total: 20 commands. Missing wiki page: 0. No MCP tool: 1. No HTTP route: 1. Env vars found but undocumented: 8.
+Total: 20 commands. Missing wiki page: 0. No MCP tool: 1. No HTTP route: 1. Env vars found but undocumented: 7.
diff --git a/.github/wiki/Compose-Generation.md b/.github/wiki/Compose-Generation.md
@@ -65,11 +65,13 @@ Networks follow the fragment rules in [[Plugins#compose-fragment-rules]]. In v1.
 The compose file is assembled in this order. Services later in the list can depend on services earlier in the list.
 
 1. **Core**, `postgres`, `hasura`, `auth`, `nginx`
-2. **Optional**, `minio` (with init container), `redis`, `mailpit`, `admin`, `functions`, `mlflow`, `search`
+2. **Optional**, object storage (`seaweedfs` + `seaweedfs-init` in v1.5 when `OBJECT_STORAGE_ENABLED=true`; `minio` with init container in v1.4, or in v1.5 only after `nself add minio`), `redis`, `mailpit`, `admin`, `functions`, `mlflow`, `search`
 3. **Monitoring**, `prometheus`, `grafana`, `loki`, `promtail`, `tempo`, `alertmanager`, `cadvisor`, `node-exporter`, `postgres-exporter`, `redis-exporter`
 4. **Custom**, `CS_1` through `CS_10`
 5. **Plugins**, loaded from `~/.nself/plugins/`, in install order
 
+Object storage selection depends on the project version. A v1.5 project (`NSELF_V15=1`) generates `seaweedfs` and its `seaweedfs-init` sidecar when `OBJECT_STORAGE_ENABLED=true`; MinIO is no longer emitted by default and must be added explicitly with `nself add minio`. A build that wants MinIO (`MINIO_ENABLED=true`) without the minio plugin installed fails with [[error-codes#e138]] before any file is written. A v1.4 project keeps the original `minio` + `minio-init` pair. See [[Object-Storage]] for migration and configuration details.
+
 ---
 
 ## Security Hardening

diff --git a/.github/wiki/Config-Env-Vars.md b/.github/wiki/Config-Env-Vars.md
@@ -108,6 +108,7 @@ These vars control the top-level identity and behavior of a project.
 | `NSELF_DOCTOR_STRICT` | bool (`1` or `true`, any case) | unset | No | Strict mode for `nself doctor --deep --only isolation`: the ISO-01 warning (an app table without `source_account_id` in a multi-app project) becomes a failure. Read from the process environment or the project's `.env` cascade. See [[Multi-App-Isolation]]. |
 | `NSELF_V15` | bool (`1` or `true`, any case) | unset (off in 1.4.x, on by default from 1.5.0) | No | Opts in to the v1.5 behaviour of every P7 change that breaks an existing user-visible contract (ADR 0021). Anything else (unset, empty, `0`, `yes`) keeps v1.4 behaviour. Read on every call, never cached. See [[Compat-V15]]. |
 | `NSELF_UPDATE_CHECK` | `1` to opt in | unset (off) | No | Process environment only. With `1`, a successful command prints at most one stderr line per 24 h when a newer CLI release exists (cached in `~/.nself/cache/update-check.json`, refreshed in the background from `ping.nself.org/version`). Never in JSON mode, CI or with a non-TTY stderr. See [[Update-Notifications]]. |
+| `NSELF_PLUGIN_REGISTRY` | string | `https://plugins.nself.org` | No | Override URL for the plugin registry used by `nself plugin` and `nself update` commands. Defaults to the public registry (`https://plugins.nself.org`). Set to a private or mirror registry when running behind a proxy or in an air-gapped environment. The same value is read by `plugin install`, `plugin search`, `plugin info`, `plugin outdated`, and `update plan`. |
 | `NSELF_MCP_TOKEN` | string | unset | No | Bearer token for the `sse` and `http` transports of `nself mcp`. Wins over `~/.nself/mcp-token` (mode `0600`). With neither, a v1.5 loopback start generates the file and prints only its path; a v1.4 loopback start serves open with one warning. A non-loopback `--host` needs this or the file plus `--allowed-host`. Never passed to commands the server runs. Secret names (`config.IsSecretKey`, see Masking below) are masked in output and redacted in the machine audit log. See [[MCP-Server]]. |
 | `NSELF_INVOKE_PATH` | string | unset | No | Internal. Set by the machine invoker (MCP, HTTP) on the `nself` child it runs: the command path it checked. The child refuses with `E421` when its own command lookup resolves a different command, and removes the variable before running. Never set it by hand. See [[MCP-Server]]. |
 | `NSELF_INVOKE_SECRETS` | JSON | unset | No | Internal. Set by the machine invoker (MCP, HTTP) on the `nself` child it runs: a JSON bundle (a nonce and the values) of the secret-marked arguments and flags, so the secrets never appear on the child argv. The child puts the values back before it parses its arguments, then removes the variable. It is ignored unless `NSELF_INVOKED_BY` is set, and a bad or unmatched bundle fails with `E421`. Never set it by hand. See [[MCP-Server]]. |

diff --git a/.github/wiki/Feature-Plugins.md b/.github/wiki/Feature-Plugins.md
@@ -12,15 +12,7 @@ A plugin is a manifest + Docker Compose overlay + optional Nginx config. When yo
 
 ## Plugin Tiers
 
-| Tier | Price | Included |
-|------|-------|---------|
-| Free | $0 | All free plugins, no license key required |
-| Basic | $0.99/mo | Licensed plugins outside the Pro-tier AI suite |
-| Pro | $1.99/mo | Basic + AI suite |
-| Elite | $4.99/mo | Pro + email support |
-| Business | $9.99/mo | Elite + 24h support |
-
-See [[Plugin-Licensing]] for full tier details.
+The CLI no longer uses Basic / Pro / Elite / Business tiers. Bundles are independent purchases at $0.99/mo ($9.99/yr), with a free Task bundle and an all-access ɳSelf+ subscription at $3.99/mo ($39.99/yr). The authoritative catalog and pricing live at [nself.org/pricing](https://nself.org/pricing) and are fetched by the CLI from `https://plugins.nself.org/bundles.json`. See [[Licensing-Guide]] and [[Plugin-Licensing]] for details.
 
 ## Free Plugins
 

diff --git a/.github/wiki/Guide-Backup-Restore.md b/.github/wiki/Guide-Backup-Restore.md
@@ -72,6 +72,19 @@ The restore command:
 3. Restores from the dump file
 4. Restarts services
 
+## Retention and Prune Holds
+
+`nself backup prune` applies a tiered retention policy: it keeps the newest backup of each of the last N days, N weeks (Sundays) and N months (the 1st). The defaults are 7 daily, 4 weekly and 12 monthly. Set them with `BACKUP_RETENTION_DAILY`, `BACKUP_RETENTION_WEEKLY` and `BACKUP_RETENTION_MONTHLY`, or per run with `--keep-daily`, `--keep-weekly` and `--keep-monthly`. `BACKUP_RETENTION_DAYS` is a legacy setting that prune does not read. Preview a run with `nself backup prune --dry-run`.
+
+Prune never deletes a backup whose tag is `keep` or starts with `keep-`. The `update stack` command tags its pre-update backup `keep-stack-<run-id>-<nonce>` so an interrupted or failed update can always roll back; those backups survive prune until you release them.
+
+The tag is the part of the file name after the timestamp, for example `myproj_full_20261028_120000_keep-stack-<run-id>-<nonce>.dump`. There is no command to change a tag. To release a held backup, rename the file in your backup directory so the tag no longer starts with `keep` (keep the extension, including `.age` on encrypted backups), then prune:
+
+```bash
+mv myproj_full_20261028_120000_keep-stack-abc123.dump myproj_full_20261028_120000_released-stack-abc123.dump
+nself backup prune --dry-run   # the renamed backup is now subject to the policy
+```
+
 > **Important:** Test your restores regularly. Untested backups are not backups.
 
 ## Backup Verification Checklist

diff --git a/.github/wiki/Licensing-Guide.md b/.github/wiki/Licensing-Guide.md
@@ -20,67 +20,34 @@ Licensed plugins are source-available Rust binaries distributed through the ɳSe
 
 ### Per-Bundle Pricing
 
-| Option | Monthly | Annual | What You Get |
-|--------|---------|--------|-------------|
-| **Free** | $0 | $0 | Core CLI + free plugins |
-| **Any single bundle** | $0.99/mo | $9.99/yr | All plugins in that bundle (ɳClaw, ɳChat, ɳFamily, or ClawDE) |
-| **ɳSelf+** | $3.99/mo | $39.99/yr | Every bundle + all apps + support |
+The authoritative bundle catalog, pricing, and plugin membership live at [nself.org/pricing](https://nself.org/pricing) and are fetched by the CLI from `https://plugins.nself.org/bundles.json`. The wiki pages below summarize each bundle; always treat the live catalog as the source of truth for what is sold.
 
-Annual gives roughly 16% savings versus monthly (about 2 months free).
+Current bundles (as of v1.4.13):
+
+| Bundle | Tier | Monthly | Annual | Notes |
+|--------|------|---------|--------|-------|
+| Task | free | $0 | $0 | Core productivity plugins; no license key required |
+| Chat | paid | $0.99 | $9.99 | Messaging and voice |
+| Claw | paid | $0.99 | $9.99 | AI personal assistant |
+| Family | paid | $0.99 | $9.99 | Private family social platform |
+| Sentry | paid | $0.99 | $9.99 | Observability and incident management |
+| ClawDE | paid | $0.99 | $9.99 | Dev environment cloud sync |
+| ɳSelf+ | paid | $3.99 | $39.99 | Every bundle + all apps + support |
+
+There is no "Basic" or "Pro" tier. Paid bundles are independent purchases; ɳSelf+ includes every paid bundle. Annual pricing saves roughly two months versus monthly.
 
 ---
 
 ## Per-Product Plugin Bundles
 
-Each ɳSelf product has a recommended plugin bundle. Bundles are not separate SKUs. They are a way to understand which plugins power each product. All plugins are available at the Basic tier and above.
-
-### ɳClaw Bundle
-AI personal assistant. Requires Pro tier (includes AI suite).
-
-| Plugin | Purpose |
-|--------|---------|
-| ai | Multi-provider LLM routing |
-| claw | Core assistant, threads, memory, tools |
-| claw-web | Svelte web dashboard |
-| claw-budget | Token spend limits and tracking |
-| mux | Email pipeline (Gmail, rules, auto-reply) |
-| voice | TTS, STT, phone calls |
-| browser | Web scraping and automation |
-| google | Gmail, Calendar, Drive, Sheets |
-| notify | Telegram and webhook notifications |
-| cron | Scheduled tasks |
-| post | Social media publishing |
-
-### ɳChat Bundle
-Messaging. Available at Basic tier.
-
-| Plugin | Purpose |
-|--------|---------|
-| chat | Channels, DMs, threads, reactions |
-| livekit | Video and audio calls |
-| recording | Call recording |
-| moderation | Content filtering |
-| bots | Automated responses |
-| realtime | Enhanced WebSocket presence |
-| auth | SSO, SAML, LDAP |
-
-### ɳFamily Bundle (Planned)
-Private family social media. Will be available at Basic tier.
-
-| Plugin | Purpose |
-|--------|---------|
-| social | Activity feed, posts, reactions |
-| photos | Photo upload, organization |
-| activity-feed | Timeline aggregation |
-| moderation | Parental controls |
-| realtime | Live updates |
-| cms | Family pages |
-| chat | Family messaging |
-
-### ClawDE Bundle
-AI dev environment cloud sync. Available at $0.99/mo or $9.99/yr.
-
-Remote and mobile sync via API for the ClawDE Flutter desktop and mobile app.
+Each bundle page lists its plugin set and purpose. Plugin lists change with releases, and the ClawDE set is provisional; the live catalog at [nself.org/pricing](https://nself.org/pricing) is authoritative.
+
+- [[bundle-nclaw]] — AI personal assistant
+- [[bundle-nchat]] — Messaging and voice
+- [[bundle-nfamily]] — Private family social platform
+- [[cmd-sentry]] — Observability and incident management
+- [[bundle-clawde]] — Dev environment cloud sync
+- [[Bundles]] — Free core productivity plugins (the Task Bundle)
 
 ---
 
@@ -118,14 +85,7 @@ nself license remove
 
 ### Key Format
 
-Keys use a prefix format:
-
-| Prefix | Tier |
-|--------|------|
-| `nself_pro_` | Pro tier and above |
-| `nself_max_` | Pro tier |
-| `nself_ent_` | Enterprise tier |
-| `nself_owner_` | Owner/internal tier |
+Keys use a `nself_<product>_` prefix, for example `nself_plus_` for ɳSelf+. The prefix only names the key's product; the signed license response decides which plugins it unlocks. [[Plugin-Licensing]] lists every accepted prefix.
 
 Keys must be at least 32 characters total.
 

diff --git a/.github/wiki/Plugin-Licensing.md b/.github/wiki/Plugin-Licensing.md
@@ -10,11 +10,19 @@ License keys use the prefix format:
 nself_pro_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 ```
 
-Accepted prefixes:
-- `nself_pro_`, Pro tier and above
-- `nself_max_`, Pro tier
-- `nself_ent_`, Enterprise tier
-- `nself_owner_`, Owner/self-hosted tier
+Accepted prefixes (`nself license set` rejects any other):
+- `nself_owner_`, ɳSelf Owner
+- `nself_plus_`, ɳSelf+
+- `nself_claw_`, ɳClaw
+- `nself_clawde_`, ClawDE
+- `nself_chat_`, ɳChat
+- `nself_media_`, nTV
+- `nself_family_`, nFamily
+- `nself_pro_`, ɳSelf Pro
+- `nself_ent_`, ɳSelf Enterprise
+- `nself_max_`, ɳSelf Business+
+
+The prefix only names the key's product for display. Which plugins a key unlocks comes from the signed license response, not the prefix.
 
 Keys must be at least 32 characters total.
 
@@ -89,21 +97,17 @@ The same requirement applies to `nself license import` when importing unsigned c
 NSELF_LICENSE_SKIP_VERIFY=1 nself license import cache.json --force
 ```
 
-## Tier Entitlements
+## Bundle Entitlements
 
-| Tier | Monthly | Annual | Plugin Access |
+| Plan | Monthly | Annual | Plugin Access |
 |------|---------|--------|--------------|
-| Free | $0 | $0 | Free plugins only |
-| Basic | $0.99 | $9.99 | Licensed plugins outside the Pro-tier AI suite |
-| Pro | $1.99 | $19.99 | Basic + full AI suite |
-| Elite | $4.99 | $49.99 | Pro + email support |
-| Business | $9.99 | $99.99 | Elite + 24h support |
-| Business+ | $49.99 | $499.99 | Business + dedicated channel |
-| Enterprise | $99.99 | $999.99 | Business+ + managed DevOps |
+| Free (incl. Task bundle) | $0 | $0 | Free plugins only |
+| Single bundle (Chat, Claw, Family, Sentry, ClawDE) | $0.99 | $9.99 | That bundle's licensed plugins |
+| ɳSelf+ | $3.99 | $39.99 | Every bundle + all apps + support |
 
-Existing $9.99/yr keys are grandfathered to the Basic tier.
+There is no Basic, Pro, Elite or Business tier. The authoritative catalog is [nself.org/pricing](https://nself.org/pricing), fetched by the CLI from `https://plugins.nself.org/bundles.json`. See [[Licensing-Guide]].
 
 ## Related Pages
 
-- [[Plugin-Overview]], Tier comparison and plugin categories
+- [[Plugin-Overview]], Bundle comparison and plugin categories
 - [[Plugin-Install]], How to install plugins
diff --git a/.github/wiki/Plugin-Overview.md b/.github/wiki/Plugin-Overview.md
@@ -13,15 +13,11 @@
 
 | Tier | Price | Includes |
 |------|-------|---------|
-| **Free** | $0 | Core CLI + free plugins (MIT licensed) |
-| **Basic** | $0.99/mo or $9.99/yr | The standard licensed plugins (excludes Pro-tier AI suite) |
-| **Pro** | $1.99/mo or $19.99/yr | Basic + AI suite (ai, browser, claw, claw-budget, claw-web, post, voice) |
-| **Elite** | $4.99/mo or $49.99/yr | Pro + email support |
-| **Business** | $9.99/mo or $99.99/yr | Elite + 24h email support + priority feature requests |
-| **Business+** | $49.99/mo or $499.99/yr | Business + dedicated support channel |
-| **Enterprise** | $99.99/mo or $999.99/yr | Business+ + managed DevOps |
+| **Free** | $0 | Core CLI + free plugins (MIT licensed), including the Task bundle |
+| **Bundle** | $0.99/mo or $9.99/yr each | One product's licensed plugins (Chat, Claw, Family, Sentry, ClawDE) |
+| **ɳSelf+** | $3.99/mo or $39.99/yr | Every bundle + all apps + support |
 
-Annual plans save ~17% compared to monthly. Existing $9.99/yr keys are grandfathered to the Basic tier.
+The CLI no longer uses Basic / Pro tiers. Bundles are independent purchases; see [[Licensing-Guide]] and [nself.org/pricing](https://nself.org/pricing) for the current catalog.
 
 ## Plugin Categories
 
@@ -76,7 +72,7 @@ Bundles group plugins that work together to deliver a complete feature set. Per
 | Bundle | Price | Plugins | Use Case |
 |--------|-------|---------|----------|
 | [[bundle-nclaw]] | $0.99/mo | ai, claw, claw-web, mux, voice, browser, google, notify, cron, claw-budget, claw-news | AI personal assistant: email, calendar, news, budget, tools |
-| [[bundle-clawde]] | $1.99/mo / $19.99/yr | TBD (cloud sync, premium models, team features) | ClawDE+ remote/mobile sync via API |
+| [[bundle-clawde]] | $0.99/mo / $9.99/yr | TBD (cloud sync, premium models, team features) | ClawDE+ remote/mobile sync via API |
 | [[bundle-nfamily]] | $0.99/mo | social, photos, activity-feed, moderation, realtime, cms, chat | Private family social, photo sharing, activity feeds |
 | [[bundle-nchat]] | $0.99/mo | chat, livekit, recording, moderation, bots, realtime, auth | Messaging with video calls, bots, and moderation |
 
@@ -89,7 +85,7 @@ The free `monitoring` plugin bundles 10 services in one install: alertmanager, g
 ## Related Pages
 
 - [[Plugin-Install]], How to install, remove, and update plugins
-- [[Plugin-Licensing]], License keys, tiers, and validation
+- [[Plugin-Licensing]], License keys, bundles, and validation
 - [[Plugin-Dev-Guide]], Build your own plugin
 - [[Plugin-Architecture]], Technical internals
 

diff --git a/.github/wiki/bundle-clawde.md b/.github/wiki/bundle-clawde.md
@@ -19,7 +19,7 @@ ClawDE itself runs free locally with limited functionality. The ClawDE bundle un
 
 ## Plugins Included
 
-Candidate set: licensed plugins, all `tier: pro`.
+Candidate set: licensed plugins, all with a `tier: pro` manifest label. Buying the ClawDE bundle (or ɳSelf+) unlocks them; there is no separate Basic plan.
 
 | Plugin | Tier | Language | What It Does |
 |--------|------|----------|-------------|
@@ -58,15 +58,15 @@ ClawDE Desktop ↔ realtime ↔ ClawDE Mobile
 ## Installation
 
 ```bash
-# Basic tier or higher (all ClawDE plugins are tier: pro)
+# ClawDE bundle or ɳSelf+ license key
 nself license set nself_pro_xxxxx...
 nself plugin install realtime auth cms notify
 
 # Rebuild and start
 nself build && nself start
 ```
 
-ClawDE subscription is $0.99/mo or $9.99/yr (separately bundled, see [Plugin-Licensing](Plugin-Licensing)).
+The ClawDE bundle is $0.99/mo or $9.99/yr; ɳSelf+ ($3.99/mo or $39.99/yr) includes it. See [Plugin-Licensing](Plugin-Licensing) for license keys.
 
 ## Getting Started
 

diff --git a/.github/wiki/bundle-nchat.md b/.github/wiki/bundle-nchat.md
@@ -17,7 +17,7 @@
 
 ## Plugins Included
 
-The bundle's licensed plugins are all `tier: pro` (Basic tier or higher).
+The bundle's licensed plugins all carry a `tier: pro` manifest label. Buying the ɳChat bundle (or ɳSelf+) unlocks all of them; there is no separate Basic plan.
 
 | Plugin | Tier | Language | What It Does |
 |--------|------|----------|-------------|
@@ -61,23 +61,23 @@ Client (chat/) → realtime + chat → channels, DMs, threads
 ## Installation
 
 ```bash
-# Basic tier or higher (all nChat plugins are tier: pro)
+# ɳChat bundle or ɳSelf+ license key
 nself license set nself_pro_xxxxx...
 nself plugin install chat livekit recording moderation bots realtime auth
 
 # Rebuild and start
 nself build && nself start
 ```
 
-Basic tier is $0.99/mo or $9.99/yr. See [Plugin-Licensing](Plugin-Licensing) for the tier comparison.
+The ɳChat bundle is $0.99/mo or $9.99/yr; ɳSelf+ ($3.99/mo or $39.99/yr) includes it. See [Plugin-Licensing](Plugin-Licensing) for license keys.
 
 ## Getting Started
 
 ### Prerequisites
 
 - ɳSelf CLI installed and a project initialized (`nself init`)
 - Backend running (`nself start`)
-- Basic tier license key or higher
+- ɳChat bundle or ɳSelf+ license key
 - TURN/STUN credentials for `livekit` if running across NAT
 - Object storage configured for `recording` (MinIO comes free with the ɳSelf stack)