fix(db): prune backups after health-check-repair snapshot

src/lib/db/core.ts

@@ -883,6 +883,15 @@ function createManagedDbBackup(db: SqliteDatabase, reason: string): boolean {
 
     db.exec(`VACUUM INTO '${escapedBackupPath}'`);
     console.log(`[DB] Backup created (${reason}): ${backupPath}`);
+
+    // #13308: prune old backups after creating a new one so db_backups/ does not
+    // grow without bound. The health-check-repair path creates a snapshot on every
+    // startup even for a healthy database, and without pruning each restart adds a
+    // full-sized copy. Dynamic import avoids a circular dependency with backup.ts.
+    import("./backup")
+      .then(({ cleanupDbBackups }) => cleanupDbBackups({ backupDir }))
+      .catch(() => {});
+
     return true;
   } catch (error: unknown) {
     const message = error instanceof Error ? error.message : String(error);

src/lib/evals/evalRunner.ts

@@ -241,6 +241,7 @@ export function runSuite(
 
     if (metrics?.error && !result.error) {
       result.error = metrics.error;
+      result.passed = false; // #13137 — an upstream failure must not grade as passed
     }
 
     return result;

src/shared/utils/machineId.ts

@@ -57,9 +57,10 @@ function getMachineIdRaw(): string {
   }
 
   // Strategy 2: macOS — ioreg IOPlatformUUID
+  // Skip when DISABLE_IOREG_STRATEGY=1 so tests can reach Strategy 4/5 on darwin.
   try {
-    if (process.platform !== "darwin") {
-      throw new Error("Not macOS");
+    if (process.platform !== "darwin" || process.env.DISABLE_IOREG_STRATEGY === "1") {
+      throw new Error("Not macOS or ioreg disabled");
     }
     const output = execSync("ioreg -rd1 -c IOPlatformExpertDevice", {
       encoding: "utf8",

tests/unit/shared/machineId.test.ts

@@ -30,6 +30,10 @@ function disableWindowsRegistryStrategy(): () => void {
   process.env.SystemRoot = "Z:\\NonExistent";
   process.env.windir = "Z:\\NonExistent";
 
+  // Also disable macOS ioreg strategy so Strategy 4/5 can be reached on darwin.
+  const origDisableIoreg = process.env.DISABLE_IOREG_STRATEGY;
+  process.env.DISABLE_IOREG_STRATEGY = "1";
+
   const origReadFileSync = fs.readFileSync;
   fs.readFileSync = (filePath: string, encoding: string) => {
     if (filePath === "/etc/machine-id" || filePath === "/var/lib/dbus/machine-id") {
@@ -57,6 +61,11 @@ function disableWindowsRegistryStrategy(): () => void {
     } else {
       delete process.env.windir;
     }
+    if (origDisableIoreg !== undefined) {
+      process.env.DISABLE_IOREG_STRATEGY = origDisableIoreg;
+    } else {
+      delete process.env.DISABLE_IOREG_STRATEGY;
+    }
     fs.readFileSync = origReadFileSync;
     childProcess.execSync = origExecSync;
   };