The nightly backup stops the database for four seconds

Snapshots capture the disk, not RAM. A database with dirty pages in memory snapshots fine and restores to a state it never quite finished writing. So the 02:00 backup doesn't start with the snapshot. It starts with a stop.

The cron entry runs three requests. POST /api/v1/daemon/programs/{postgres}/stop halts the process through supervisor, and Postgres closes its files cleanly on the way down. POST /api/v1/containers/{id}/snapshots with {"alias": "nightly-2026-09-02", "expiry": 30} marks the quiet disk. POST .../programs/{postgres}/start brings it back. Four seconds end to end, and the snapshot is copy-on-write, so the disk is never copied at all.

Thirty days later the snapshot deletes itself. Nobody rotates anything. Restore is one PUT, and the database that comes back is the one that was on disk, not the one that was in flight.

A backup of a running database is a guess. A backup of a stopped one is a fact.