diff --git a/.github/workflows/changelog-comment.yml b/.github/workflows/changelog-comment.yml
index e9e440e..33dd202 100644
--- a/.github/workflows/changelog-comment.yml
+++ b/.github/workflows/changelog-comment.yml
@@ -19,6 +19,11 @@ jobs:
     name: Post changelog comment
     runs-on: ubuntu-latest
 
+    permissions:
+      issues: write
+      pull-requests: read
+      contents: read
+
     steps:
       - name: Post or update changelog comment
         uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0
diff --git a/Cargo.lock b/Cargo.lock
index 5354349..4d43cbf 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1889,6 +1889,28 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
+[[package]]
+name = "fontconfig-parser"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbc773e24e02d4ddd8395fd30dc147524273a83e54e0f312d986ea30de5f5646"
+dependencies = [
+ "roxmltree",
+]
+
+[[package]]
+name = "fontdb"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2660c5e9157bf76d2db1294e4a9feba604ef610819a3b591088d0d8392a3290f"
+dependencies = [
+ "fontconfig-parser",
+ "log",
+ "memmap2",
+ "slotmap",
+ "tinyvec",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -3477,6 +3499,15 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "memmap2"
+version = "0.9.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -5102,6 +5133,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "roxmltree"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c20b6793b5c2fa6553b250154b78d6d0db37e72700ae35fad9387a46f487c97"
+
 [[package]]
 name = "rsa"
 version = "0.9.10"
@@ -5758,6 +5795,15 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
+[[package]]
+name = "slotmap"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
+dependencies = [
+ "version_check",
+]
+
 [[package]]
 name = "smallvec"
 version = "1.15.2"
@@ -6912,6 +6958,7 @@ dependencies = [
  "either",
  "enumset",
  "flate2",
+ "fontdb",
  "futures",
  "hyper",
  "hyper-util",
@@ -6926,6 +6973,7 @@ dependencies = [
  "path-util",
  "quartz_nbt",
  "regex",
+ "semver",
  "serde",
  "serde_json",
  "serde_with",
diff --git a/Cargo.toml b/Cargo.toml
index 2293561..6a7a81b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,6 +44,7 @@ encoding_rs = "0.8.35"
 enumset = "1.1.10"
 eyre = "0.6.12"
 flate2 = "1.1.4"
+fontdb = "0.24.0"
 fs4 = { version = "0.13.1", default-features = false }
 futures = "0.3.31"
 futures-lite = "2.6.1"
@@ -83,6 +84,7 @@ rgb = "0.8.52"
 rustls = { version = "0.23.42", default-features = false, features = ["ring", "std", "tls12"] }
 rustls-native-certs = "0.8.4"
 rustls-pki-types = "1.15.0"
+semver = "1.0.28"
 serde = "1.0.228"
 serde_bytes = "0.11.19"
 serde_cbor = "0.11.2"
diff --git a/apps/app-frontend/src/components/ui/instance_settings/BackupExclusionSelector.vue b/apps/app-frontend/src/components/ui/instance_settings/BackupExclusionSelector.vue
new file mode 100644
index 0000000..7544988
--- /dev/null
+++ b/apps/app-frontend/src/components/ui/instance_settings/BackupExclusionSelector.vue
@@ -0,0 +1,132 @@
+<script setup lang="ts">
+import { FileIcon, FolderIcon, MinusIcon, PlusIcon } from '@modrinth/assets'
+import { Button, defineMessages, injectNotificationManager, useVIntl } from '@modrinth/ui'
+import { open } from '@tauri-apps/plugin-dialog'
+import { ref } from 'vue'
+
+import {
+	type BackupExclusion,
+	type BackupExclusionKind,
+	canonicalizeBackupExclusions,
+	formatBackupExclusionPath,
+	normalizeBackupExclusion,
+} from '@/helpers/instance-backup'
+
+const props = defineProps<{
+	instanceId: string
+	instanceRoot: string
+	modelValue: BackupExclusion[]
+	disabled?: boolean
+}>()
+const emit = defineEmits<{ 'update:modelValue': [value: BackupExclusion[]] }>()
+const { formatMessage } = useVIntl()
+const { handleError } = injectNotificationManager()
+const picking = ref<BackupExclusionKind | null>(null)
+
+const messages = defineMessages({
+	empty: {
+		id: 'instance.backups.exclusions.empty',
+		defaultMessage: 'No files or folders are excluded.',
+	},
+	addFile: {
+		id: 'instance.backups.exclusions.add-file',
+		defaultMessage: 'Add excluded file',
+	},
+	addFolder: {
+		id: 'instance.backups.exclusions.add-folder',
+		defaultMessage: 'Add excluded folder',
+	},
+	remove: {
+		id: 'instance.backups.exclusions.remove',
+		defaultMessage: 'Remove {path} from exclusions',
+	},
+})
+
+function pickedPath(result: unknown): string | null {
+	if (typeof result === 'string') return result
+	if (result && typeof result === 'object' && 'path' in result) {
+		const path = (result as { path?: unknown }).path
+		return typeof path === 'string' ? path : null
+	}
+	return null
+}
+
+async function addExclusion(kind: BackupExclusionKind) {
+	if (props.disabled || picking.value) return
+	picking.value = kind
+	try {
+		const result = await open({
+			directory: kind === 'directory',
+			multiple: false,
+			defaultPath: props.instanceRoot,
+		})
+		const selectedPath = pickedPath(result)
+		if (!selectedPath) return
+		const exclusion = await normalizeBackupExclusion(props.instanceId, selectedPath, kind)
+		emit('update:modelValue', canonicalizeBackupExclusions([...props.modelValue, exclusion]))
+	} catch (error) {
+		handleError(error)
+	} finally {
+		picking.value = null
+	}
+}
+
+function removeExclusion(path: string) {
+	emit(
+		'update:modelValue',
+		props.modelValue.filter((exclusion) => exclusion.path !== path),
+	)
+}
+</script>
+
+<template>
+	<div class="flex flex-col gap-3">
+		<p v-if="modelValue.length === 0" class="m-0 text-sm text-[var(--color-text-tertiary)]">
+			{{ formatMessage(messages.empty) }}
+		</p>
+		<div
+			v-else
+			class="divide-y divide-solid divide-surface-4 rounded-lg border border-solid border-surface-4"
+		>
+			<div
+				v-for="exclusion in modelValue"
+				:key="exclusion.path"
+				class="flex min-h-11 items-center gap-3 px-3 py-2"
+			>
+				<FolderIcon
+					v-if="exclusion.kind === 'directory'"
+					class="size-5 shrink-0 text-[var(--color-text-tertiary)]"
+				/>
+				<FileIcon v-else class="size-5 shrink-0 text-[var(--color-text-tertiary)]" />
+				<code class="min-w-0 flex-1 truncate text-sm text-[var(--color-text-primary)]">{{
+					formatBackupExclusionPath(exclusion)
+				}}</code>
+				<Button
+					type="quiet"
+					size="2xs"
+					circular
+					icon-only
+					:disabled="disabled || picking !== null"
+					:aria-label="
+						formatMessage(messages.remove, { path: formatBackupExclusionPath(exclusion) })
+					"
+					@click="removeExclusion(exclusion.path)"
+					><MinusIcon />
+				</Button>
+			</div>
+		</div>
+		<div class="flex flex-wrap gap-2">
+			<Button type="outlined" :disabled="disabled || picking !== null" @click="addExclusion('file')"
+				><PlusIcon />
+				{{ formatMessage(messages.addFile) }}
+			</Button>
+			<Button
+				type="outlined"
+				:disabled="disabled || picking !== null"
+				@click="addExclusion('directory')"
+				><PlusIcon />
+				{{ formatMessage(messages.addFolder) }}
+			</Button>
+		</div>
+	</div>
+</template>
diff --git a/apps/app-frontend/src/components/ui/instance_settings/BackupSettings.vue b/apps/app-frontend/src/components/ui/instance_settings/BackupSettings.vue
new file mode 100644
index 0000000..5299c11
--- /dev/null
+++ b/apps/app-frontend/src/components/ui/instance_settings/BackupSettings.vue
@@ -0,0 +1,675 @@
+<script setup lang="ts">
+import { FileArchiveIcon, SaveIcon, TrashIcon, UndoIcon, XIcon } from '@modrinth/assets'
+import {
+	Admonition,
+	Button,
+	commonMessages,
+	defineMessages,
+	injectNotificationManager,
+	NewModal,
+	useFormatBytes,
+	useFormatDateTime,
+	useVIntl,
+} from '@modrinth/ui'
+import { computed, onMounted, onUnmounted, ref, watch } from 'vue'
+
+import { get_full_path } from '@/helpers/instance'
+import {
+	type BackupExclusion,
+	type BackupOperation,
+	type BackupOperationState,
+	type BackupProgressStage,
+	type BackupRestorePreview,
+	type BackupSnapshot,
+	cancelBackup,
+	deleteBackup,
+	disableBackups,
+	enableBackups,
+	getBackupConfig,
+	type InstanceBackupConfig,
+	type InstanceBackupEligibility,
+	listBackupOperations,
+	listBackups,
+	listenBackupProgress,
+	restoreBackup,
+	startBackup,
+	startBackupRestorePreview,
+	updateBackupExclusions,
+} from '@/helpers/instance-backup'
+import { injectInstanceSettings } from '@/providers/instance-settings'
+
+import BackupExclusionSelector from './BackupExclusionSelector.vue'
+
+const { instance } = injectInstanceSettings()
+const { formatMessage } = useVIntl()
+const formatBytes = useFormatBytes()
+const formatDate = useFormatDateTime({ dateStyle: 'medium', timeStyle: 'short' })
+const { handleError } = injectNotificationManager()
+
+const messages = defineMessages({
+	title: { id: 'instance.backups.title', defaultMessage: 'Instance backups' },
+	description: {
+		id: 'instance.backups.description',
+		defaultMessage: 'Create deduplicated snapshots of the whole instance while it is closed.',
+	},
+	loading: { id: 'instance.backups.loading', defaultMessage: 'Loading backup settings...' },
+	unavailable: { id: 'instance.backups.unavailable', defaultMessage: 'Backups are unavailable' },
+	notInstalled: {
+		id: 'instance.backups.unavailable.not-installed',
+		defaultMessage: 'Finish installing this instance before enabling backups.',
+	},
+	symlinkInstance: {
+		id: 'instance.backups.unavailable.symlink',
+		defaultMessage: 'Imported symbolic-link instances cannot be backed up.',
+	},
+	directLinked: {
+		id: 'instance.backups.unavailable.direct-linked',
+		defaultMessage: 'Instances linked directly to another launcher cannot be backed up.',
+	},
+	externalDirectory: {
+		id: 'instance.backups.unavailable.external-directory',
+		defaultMessage: 'Instances that use an external game directory cannot be backed up.',
+	},
+	rootMissing: {
+		id: 'instance.backups.unavailable.root-missing',
+		defaultMessage: 'The instance folder is missing.',
+	},
+	rootLink: {
+		id: 'instance.backups.unavailable.root-link',
+		defaultMessage: 'Instances whose root folder is a link cannot be backed up.',
+	},
+	choose: {
+		id: 'instance.backups.choose',
+		defaultMessage:
+			'Everything is backed up by default. Add files or folders that should be excluded.',
+	},
+	enable: { id: 'instance.backups.enable', defaultMessage: 'Enable backups' },
+	editExclusions: { id: 'instance.backups.edit-exclusions', defaultMessage: 'Edit exclusions' },
+	saveExclusions: {
+		id: 'instance.backups.save-exclusions',
+		defaultMessage: 'Save exclusions',
+	},
+	allIncluded: {
+		id: 'instance.backups.all-included',
+		defaultMessage: 'All instance files and folders are included.',
+	},
+	excludedPaths: {
+		id: 'instance.backups.excluded-paths',
+		defaultMessage: 'Excluded: {paths}',
+	},
+	backupNow: { id: 'instance.backups.backup-now', defaultMessage: 'Back up now' },
+	cancelBackup: { id: 'instance.backups.cancel', defaultMessage: 'Cancel backup' },
+	stageScanning: {
+		id: 'instance.backups.stage.scanning',
+		defaultMessage: 'Scanning files',
+	},
+	stageHashing: { id: 'instance.backups.stage.hashing', defaultMessage: 'Hashing files' },
+	stageSaving: { id: 'instance.backups.stage.saving', defaultMessage: 'Saving snapshot index' },
+	stageQueued: { id: 'instance.backups.stage.queued', defaultMessage: 'Waiting to start' },
+	stageValidating: {
+		id: 'instance.backups.stage.validating',
+		defaultMessage: 'Validating restore',
+	},
+	stageMaterializing: {
+		id: 'instance.backups.stage.materializing',
+		defaultMessage: 'Preparing changed files',
+	},
+	stageApplying: {
+		id: 'instance.backups.stage.applying',
+		defaultMessage: 'Applying changed files',
+	},
+	stagePreview: {
+		id: 'instance.backups.stage.preview',
+		defaultMessage: 'Analyzing restore changes',
+	},
+	progressBytes: {
+		id: 'instance.backups.progress-bytes',
+		defaultMessage: '{processed} of {total}',
+	},
+	stageFailed: { id: 'instance.backups.stage.failed', defaultMessage: 'Backup failed' },
+	stageInterrupted: {
+		id: 'instance.backups.stage.interrupted',
+		defaultMessage: 'Backup operation was interrupted',
+	},
+	snapshots: { id: 'instance.backups.snapshots', defaultMessage: 'Snapshots' },
+	empty: { id: 'instance.backups.empty', defaultMessage: 'No backups have been created yet.' },
+	snapshotMeta: {
+		id: 'instance.backups.snapshot-meta',
+		defaultMessage: '{files, plural, one {# file} other {# files}} · {size}',
+	},
+	addedSize: { id: 'instance.backups.added-size', defaultMessage: '{size} newly stored' },
+	restore: { id: 'instance.backups.restore', defaultMessage: 'Restore backup' },
+	delete: { id: 'instance.backups.delete', defaultMessage: 'Delete backup' },
+	disable: { id: 'instance.backups.disable', defaultMessage: 'Disable backups' },
+	disableBlocked: {
+		id: 'instance.backups.disable-blocked',
+		defaultMessage: 'Delete every snapshot before disabling backups.',
+	},
+	restoreTitle: { id: 'instance.backups.restore-title', defaultMessage: 'Restore this backup?' },
+	restoreBody: {
+		id: 'instance.backups.restore-body',
+		defaultMessage:
+			'Upcoming operations: add {added, plural, one {# file} other {# files}}, modify {modified, plural, one {# file} other {# files}}, and delete {deleted, plural, one {# file} other {# files}}. Continue?',
+	},
+	deleteTitle: { id: 'instance.backups.delete-title', defaultMessage: 'Delete this backup?' },
+	deleteBody: {
+		id: 'instance.backups.delete-body',
+		defaultMessage:
+			'This snapshot will be permanently deleted. Unused stored files will also be removed.',
+	},
+})
+
+const config = ref<InstanceBackupConfig | null>(null)
+const snapshots = ref<BackupSnapshot[]>([])
+const instanceRoot = ref('')
+const loading = ref(true)
+const editingExclusions = ref(false)
+const excludedPaths = ref<BackupExclusion[]>([])
+const action = ref<string | null>(null)
+const operation = ref<BackupOperation | null>(null)
+const selectedSnapshot = ref<BackupSnapshot | null>(null)
+const restorePreview = ref<BackupRestorePreview | null>(null)
+const deleteModal = ref<InstanceType<typeof NewModal>>()
+const restoreModal = ref<InstanceType<typeof NewModal>>()
+let unlisten: (() => void) | null = null
+
+const eligible = computed(() => config.value?.eligibility === 'eligible')
+const terminalStates: BackupOperationState[] = ['completed', 'cancelled', 'failed', 'interrupted']
+const isRunning = computed(
+	() => operation.value !== null && !terminalStates.includes(operation.value.state),
+)
+const canCancel = computed(() => operation.value?.cancellable === true)
+const operationLabel = computed(() => {
+	if (operation.value?.operation_type === 'restore_preview') {
+		return formatMessage(messages.stagePreview)
+	}
+	switch (operation.value?.state) {
+		case 'queued':
+			return formatMessage(messages.stageQueued)
+		case 'hashing':
+			return formatMessage(messages.stageHashing)
+		case 'saving':
+			return formatMessage(messages.stageSaving)
+		case 'validating':
+			return formatMessage(messages.stageValidating)
+		case 'materializing':
+			return formatMessage(messages.stageMaterializing)
+		case 'applying':
+			return formatMessage(messages.stageApplying)
+		default:
+			return formatMessage(messages.stageScanning)
+	}
+})
+
+function operationFromEvent(event: {
+	operationId: string
+	operationType: BackupOperation['operation_type']
+	instanceId?: string
+	stage: BackupProgressStage
+	processedBytes: number
+	totalBytes: number
+	snapshotId?: string
+	message?: string
+}): BackupOperation {
+	const now = Date.now()
+	const state: BackupOperationState =
+		event.stage === 'restoring' || event.stage === 'copying'
+			? 'materializing'
+			: event.stage === 'deleting'
+				? 'queued'
+				: event.stage
+	return {
+		id: event.operationId,
+		operation_type: event.operationType,
+		instance_id: event.instanceId ?? instance.value.id,
+		snapshot_id: event.snapshotId,
+		state,
+		processed_bytes: event.processedBytes,
+		total_bytes: event.totalBytes,
+		cancellable: event.stage === 'scanning' || event.stage === 'hashing',
+		cancel_requested: false,
+		error: event.message,
+		created_at: operation.value?.id === event.operationId ? operation.value.created_at : now,
+		updated_at: now,
+		finished_at: ['completed', 'cancelled', 'failed'].includes(event.stage) ? now : undefined,
+	}
+}
+
+async function refreshOperation() {
+	const operations = await listBackupOperations(instance.value.id)
+	const latest = operations[0] ?? null
+	operation.value =
+		latest && (isRunningState(latest.state) || ['failed', 'interrupted'].includes(latest.state))
+			? latest
+			: null
+	if (operation.value?.operation_type === 'restore_preview' && operation.value.snapshot_id) {
+		selectedSnapshot.value =
+			snapshots.value.find((snapshot) => snapshot.id === operation.value?.snapshot_id) ?? null
+	}
+}
+
+function isRunningState(state: BackupOperationState) {
+	return !terminalStates.includes(state)
+}
+
+const eligibilityMessages: Record<
+	Exclude<InstanceBackupEligibility, 'eligible'>,
+	keyof typeof messages
+> = {
+	not_installed: 'notInstalled',
+	symlink_instance: 'symlinkInstance',
+	direct_linked_instance: 'directLinked',
+	external_game_directory: 'externalDirectory',
+	root_missing: 'rootMissing',
+	root_is_link: 'rootLink',
+}
+
+const unavailableReason = computed(() => {
+	const eligibility = config.value?.eligibility
+	if (!eligibility || eligibility === 'eligible') return ''
+	return formatMessage(messages[eligibilityMessages[eligibility]])
+})
+
+async function refresh() {
+	loading.value = true
+	try {
+		const nextConfig = await getBackupConfig(instance.value.id)
+		config.value = nextConfig
+		excludedPaths.value = nextConfig.enabled ? [...nextConfig.excluded_paths] : []
+		const [nextRoot, nextSnapshots] = await Promise.all([
+			nextConfig.eligibility === 'eligible' ? get_full_path(instance.value.id) : '',
+			listBackups(instance.value.id),
+		])
+		instanceRoot.value = nextRoot
+		snapshots.value = nextSnapshots
+		await refreshOperation()
+	} catch (error) {
+		handleError(error)
+	} finally {
+		loading.value = false
+	}
+}
+
+async function runAction(name: string, task: () => Promise<void>) {
+	action.value = name
+	try {
+		await task()
+	} catch (error) {
+		handleError(error)
+	} finally {
+		action.value = null
+	}
+}
+
+function enable() {
+	void runAction('enable', async () => {
+		config.value = await enableBackups(instance.value.id, excludedPaths.value)
+		editingExclusions.value = false
+	})
+}
+
+function beginEditingExclusions() {
+	excludedPaths.value = [...(config.value?.excluded_paths ?? [])]
+	editingExclusions.value = true
+}
+
+function saveExclusions() {
+	void runAction('exclusions', async () => {
+		config.value = await updateBackupExclusions(instance.value.id, excludedPaths.value)
+		editingExclusions.value = false
+	})
+}
+
+function start() {
+	void runAction('start', async () => {
+		const id = await startBackup(instance.value.id)
+		operation.value = {
+			id,
+			operation_type: 'create',
+			instance_id: instance.value.id,
+			state: 'queued',
+			processed_bytes: 0,
+			total_bytes: 0,
+			cancellable: true,
+			cancel_requested: false,
+			created_at: Date.now(),
+			updated_at: Date.now(),
+		}
+	})
+}
+
+function cancel() {
+	if (!operation.value || !canCancel.value) return
+	void runAction('cancel', async () => {
+		if (await cancelBackup(operation.value!.id)) {
+			operation.value = {
+				...operation.value!,
+				cancellable: false,
+				cancel_requested: true,
+			}
+		}
+	})
+}
+
+function confirmDelete(snapshot: BackupSnapshot) {
+	selectedSnapshot.value = snapshot
+	deleteModal.value?.show()
+}
+
+function confirmRestore(snapshot: BackupSnapshot) {
+	void runAction(`preview:${snapshot.id}`, async () => {
+		selectedSnapshot.value = snapshot
+		const id = await startBackupRestorePreview(snapshot.id)
+		operation.value = {
+			id,
+			operation_type: 'restore_preview',
+			instance_id: instance.value.id,
+			snapshot_id: snapshot.id,
+			state: 'queued',
+			processed_bytes: 0,
+			total_bytes: snapshot.logical_size,
+			cancellable: true,
+			cancel_requested: false,
+			created_at: Date.now(),
+			updated_at: Date.now(),
+		}
+	})
+}
+
+function removeSnapshot() {
+	if (!selectedSnapshot.value) return
+	void runAction(`delete:${selectedSnapshot.value.id}`, async () => {
+		await deleteBackup(selectedSnapshot.value!.id)
+		await refresh()
+		deleteModal.value?.hide()
+		selectedSnapshot.value = null
+	})
+}
+
+function restoreSnapshot() {
+	if (!selectedSnapshot.value || !restorePreview.value) return
+	void runAction(`restore:${selectedSnapshot.value.id}`, async () => {
+		const id = await restoreBackup(selectedSnapshot.value!.id, restorePreview.value!.plan_token)
+		operation.value = {
+			id,
+			operation_type: 'restore',
+			instance_id: instance.value.id,
+			snapshot_id: selectedSnapshot.value!.id,
+			state: 'queued',
+			processed_bytes: 0,
+			total_bytes: selectedSnapshot.value!.logical_size,
+			cancellable: true,
+			cancel_requested: false,
+			created_at: Date.now(),
+			updated_at: Date.now(),
+		}
+		restoreModal.value?.hide()
+		selectedSnapshot.value = null
+		restorePreview.value = null
+	})
+}
+
+function disable() {
+	void runAction('disable', async () => {
+		await disableBackups(instance.value.id)
+		await refresh()
+	})
+}
+
+onMounted(async () => {
+	unlisten = await listenBackupProgress(async (event) => {
+		if (
+			!['create', 'restore', 'restore_preview'].includes(event.operationType) ||
+			event.instanceId !== instance.value.id
+		)
+			return
+		operation.value = operationFromEvent(event)
+		if (event.operationType === 'restore_preview' && event.stage === 'completed') {
+			const completed = (await listBackupOperations(instance.value.id)).find(
+				(candidate) => candidate.id === event.operationId,
+			)
+			const snapshot = snapshots.value.find((candidate) => candidate.id === event.snapshotId)
+			if (completed?.restore_preview && snapshot) {
+				selectedSnapshot.value = snapshot
+				restorePreview.value = completed.restore_preview
+				operation.value = null
+				restoreModal.value?.show()
+				return
+			}
+		}
+		if (['completed', 'cancelled', 'failed'].includes(event.stage)) {
+			void refresh()
+		}
+	})
+	await refresh()
+})
+
+onUnmounted(() => unlisten?.())
+watch(
+	() => instance.value.id,
+	() => void refresh(),
+)
+</script>
+
+<template>
+	<div class="flex flex-col gap-5">
+		<header>
+			<h2 class="m-0 text-lg font-semibold text-[var(--color-text-primary)]">
+				{{ formatMessage(messages.title) }}
+			</h2>
+			<p class="m-0 mt-1 text-[var(--color-text-tertiary)]">
+				{{ formatMessage(messages.description) }}
+			</p>
+		</header>
+
+		<p v-if="loading" class="m-0 text-[var(--color-text-tertiary)]">
+			{{ formatMessage(messages.loading) }}
+		</p>
+		<Admonition v-else-if="!eligible" type="warning" :header="formatMessage(messages.unavailable)">
+			{{ unavailableReason }}
+		</Admonition>
+		<template v-else-if="config">
+			<div v-if="!config.enabled || editingExclusions" class="flex flex-col gap-4">
+				<p class="m-0 text-[var(--color-text-tertiary)]">{{ formatMessage(messages.choose) }}</p>
+				<BackupExclusionSelector
+					v-model="excludedPaths"
+					:instance-id="instance.id"
+					:instance-root="instanceRoot"
+					:disabled="action !== null"
+				/>
+				<div class="flex flex-wrap gap-2">
+					<Button :disabled="action !== null" @click="config.enabled ? saveExclusions() : enable()"
+						><SaveIcon />
+						{{ formatMessage(config.enabled ? messages.saveExclusions : messages.enable) }}
+					</Button>
+					<Button
+						v-if="config.enabled"
+						type="outlined"
+						:disabled="action !== null"
+						@click="editingExclusions = false"
+						><XIcon />
+						{{ formatMessage(commonMessages.cancelButton) }}
+					</Button>
+				</div>
+			</div>
+
+			<template v-else>
+				<div class="flex flex-col gap-2 rounded-lg border border-solid border-surface-4 p-3">
+					<p class="m-0 text-sm text-[var(--color-text-tertiary)]">
+						{{
+							config.excluded_paths.length === 0
+								? formatMessage(messages.allIncluded)
+								: formatMessage(messages.excludedPaths, {
+										paths: config.excluded_paths.map((entry) => entry.path).join(', '),
+									})
+						}}
+					</p>
+					<div class="flex flex-wrap gap-2">
+						<Button :disabled="isRunning || action !== null" @click="start"
+							><FileArchiveIcon />
+							{{ formatMessage(messages.backupNow) }}
+						</Button>
+						<Button v-if="canCancel" type="outlined" :disabled="action !== null" @click="cancel"
+							><XIcon />
+							{{ formatMessage(messages.cancelBackup) }}
+						</Button>
+						<Button
+							type="outlined"
+							:disabled="isRunning || action !== null"
+							@click="beginEditingExclusions"
+							>{{ formatMessage(messages.editExclusions) }}
+						</Button>
+					</div>
+					<p v-if="isRunning" class="m-0 text-sm font-medium text-[var(--color-text-primary)]">
+						{{ operationLabel }}
+						<span
+							v-if="(operation?.total_bytes ?? 0) > 0"
+							class="ml-2 text-[var(--color-text-tertiary)]"
+						>
+							{{
+								formatMessage(messages.progressBytes, {
+									processed: formatBytes(operation?.processed_bytes ?? 0),
+									total: formatBytes(operation?.total_bytes ?? 0),
+								})
+							}}
+						</span>
+					</p>
+					<p
+						v-else-if="operation?.state === 'failed' || operation?.state === 'interrupted'"
+						class="m-0 text-sm text-red"
+					>
+						{{
+							formatMessage(
+								operation.state === 'interrupted'
+									? messages.stageInterrupted
+									: messages.stageFailed,
+							)
+						}}<span v-if="operation.error">: {{ operation.error }}</span>
+					</p>
+				</div>
+
+				<section class="flex flex-col gap-3">
+					<h3 class="m-0 text-base font-semibold text-[var(--color-text-primary)]">
+						{{ formatMessage(messages.snapshots) }}
+					</h3>
+					<p v-if="snapshots.length === 0" class="m-0 text-[var(--color-text-tertiary)]">
+						{{ formatMessage(messages.empty) }}
+					</p>
+					<div
+						v-else
+						class="divide-y divide-solid divide-surface-4 rounded-lg border border-solid border-surface-4"
+					>
+						<div
+							v-for="snapshot in snapshots"
+							:key="snapshot.id"
+							class="flex items-center gap-3 px-3 py-3"
+						>
+							<FileArchiveIcon class="size-5 shrink-0 text-[var(--color-text-tertiary)]" />
+							<div class="min-w-0 flex-1">
+								<p class="m-0 font-semibold text-[var(--color-text-primary)]">
+									{{ formatDate(new Date(snapshot.created_at)) }}
+								</p>
+								<p class="m-0 text-sm text-[var(--color-text-tertiary)]">
+									{{
+										formatMessage(messages.snapshotMeta, {
+											files: snapshot.file_count,
+											size: formatBytes(snapshot.logical_size),
+										})
+									}}
+									·
+									{{
+										formatMessage(messages.addedSize, { size: formatBytes(snapshot.added_size) })
+									}}
+								</p>
+							</div>
+							<Button
+								type="quiet"
+								size="2xs"
+								circular
+								icon-only
+								:disabled="action !== null || isRunning"
+								:aria-label="formatMessage(messages.restore)"
+								@click="confirmRestore(snapshot)"
+								><UndoIcon />
+							</Button>
+							<Button
+								type="quiet"
+								color="red"
+								size="2xs"
+								circular
+								icon-only
+								:disabled="action !== null || isRunning"
+								:aria-label="formatMessage(messages.delete)"
+								@click="confirmDelete(snapshot)"
+								><TrashIcon />
+							</Button>
+						</div>
+					</div>
+				</section>
+
+				<div class="flex flex-col items-start gap-2">
+					<Button
+						type="outlined"
+						color="red"
+						:disabled="snapshots.length > 0 || action !== null || isRunning"
+						@click="disable"
+						>{{ formatMessage(messages.disable) }}
+					</Button>
+					<p v-if="snapshots.length > 0" class="m-0 text-sm text-[var(--color-text-tertiary)]">
+						{{ formatMessage(messages.disableBlocked) }}
+					</p>
+				</div>
+			</template>
+		</template>
+
+		<NewModal
+			ref="deleteModal"
+			:header="formatMessage(messages.deleteTitle)"
+			fade="danger"
+			max-width="500px"
+		>
+			<Admonition type="critical">{{ formatMessage(messages.deleteBody) }}</Admonition>
+			<template #actions>
+				<div class="flex items-center justify-end gap-2">
+					<Button
+						type="outlined"
+						:disabled="action?.startsWith('delete:')"
+						@click="deleteModal?.hide()"
+						>{{ formatMessage(commonMessages.cancelButton) }}
+					</Button>
+					<Button
+						type="colored"
+						color="red"
+						:disabled="action?.startsWith('delete:')"
+						@click="removeSnapshot"
+						><TrashIcon />{{ formatMessage(messages.delete) }}
+					</Button>
+				</div>
+			</template>
+		</NewModal>
+		<NewModal ref="restoreModal" :header="formatMessage(messages.restoreTitle)" max-width="500px">
+			<Admonition v-if="restorePreview" type="warning">
+				{{
+					formatMessage(messages.restoreBody, {
+						added: restorePreview.added_files,
+						modified: restorePreview.modified_files,
+						deleted: restorePreview.deleted_files,
+					})
+				}}
+			</Admonition>
+			<template #actions>
+				<div class="flex items-center justify-end gap-2">
+					<Button
+						type="outlined"
+						:disabled="action?.startsWith('restore:')"
+						@click="restoreModal?.hide()"
+						>{{ formatMessage(commonMessages.cancelButton) }}
+					</Button>
+					<Button :disabled="action?.startsWith('restore:')" @click="restoreSnapshot"
+						><UndoIcon />{{ formatMessage(messages.restore) }}
+					</Button>
+				</div>
+			</template>
+		</NewModal>
+	</div>
+</template>
diff --git a/apps/app-frontend/src/components/ui/modal/InstanceSettingsModal.vue b/apps/app-frontend/src/components/ui/modal/InstanceSettingsModal.vue
index b5869c2..d7fa727 100644
--- a/apps/app-frontend/src/components/ui/modal/InstanceSettingsModal.vue
+++ b/apps/app-frontend/src/components/ui/modal/InstanceSettingsModal.vue
@@ -20,6 +20,7 @@ import type { PlatformTag } from '@modrinth/utils'
 import { useQuery, useQueryClient } from '@tanstack/vue-query'
 import { computed, nextTick, ref, watch } from 'vue'
 
+import BackupSettings from '@/components/ui/instance_settings/BackupSettings.vue'
 import CoreComponentsSettings from '@/components/ui/instance_settings/CoreComponentsSettings.vue'
 import GeneralSettings from '@/components/ui/instance_settings/GeneralSettings.vue'
 import HooksSettings from '@/components/ui/instance_settings/HooksSettings.vue'
@@ -105,6 +106,14 @@ const tabs = computed<TabbedModalTab[]>(() => [
 		icon: WrenchIcon,
 		content: InstallationSettings,
 	},
+	{
+		name: defineMessage({
+			id: 'instance.settings.tabs.backups',
+			defaultMessage: 'Backups',
+		}),
+		icon: FileArchiveIcon,
+		content: BackupSettings,
+	},
 	{
 		// Core component editing is instance-specific and advanced, so it is intentionally excluded from first-run onboarding.
 		name: defineMessage({
diff --git a/apps/app-frontend/src/components/ui/settings/AppearanceSettings.vue b/apps/app-frontend/src/components/ui/settings/AppearanceSettings.vue
index 0d4089e..279ed0e 100644
--- a/apps/app-frontend/src/components/ui/settings/AppearanceSettings.vue
+++ b/apps/app-frontend/src/components/ui/settings/AppearanceSettings.vue
@@ -22,7 +22,7 @@ import { convertFileSrc } from '@tauri-apps/api/core'
 import { appDataDir, join } from '@tauri-apps/api/path'
 import { open } from '@tauri-apps/plugin-dialog'
 import { exists, mkdir, readFile, remove, writeFile } from '@tauri-apps/plugin-fs'
-import { computed, ref, watch } from 'vue'
+import { computed, onMounted, ref, watch } from 'vue'
 
 import { get, set } from '@/helpers/settings.ts'
 import { getOS } from '@/helpers/utils'
@@ -41,6 +41,19 @@ import {
 	parseCustomAccentColor,
 } from '@/store/theme.ts'
 
+import {
+	buildFontFamilyOptions,
+	canonicalFontFamily,
+	DEFAULT_MONO_FONT_STACK,
+	DEFAULT_UI_FONT_STACK,
+	type FontFamilyOption,
+	type FontFamilyOptionOrDivider,
+	optionValueToFontSetting,
+	resolveFontFamily,
+	type SystemFontFamily,
+} from '@/helpers/font-family.ts'
+import { getSystemFontFamilies } from '@/helpers/system-fonts.ts'
+
 import SettingsRow from './SettingsRow.vue'
 import SettingsSection from './SettingsSection.vue'
 
@@ -363,6 +376,63 @@ const messages = defineMessages({
 		defaultMessage:
 			'Hide the downloads button in the sidebar when there are no active download tasks.',
 	},
+	fontsTitle: { id: 'app.appearance-settings.fonts.title', defaultMessage: 'Fonts' },
+	fontsDescription: {
+		id: 'app.appearance-settings.fonts.description',
+		defaultMessage: 'Choose the fonts the launcher interface and its logs are rendered in.',
+	},
+	uiFontTitle: { id: 'app.appearance-settings.fonts.ui-font', defaultMessage: 'Interface font' },
+	uiFontDescription: {
+		id: 'app.appearance-settings.fonts.ui-font-description',
+		defaultMessage:
+			'Used across the launcher interface. Only fonts installed on this system are listed.',
+	},
+	monoFontTitle: {
+		id: 'app.appearance-settings.fonts.mono-font',
+		defaultMessage: 'Monospace font',
+	},
+	monoFontDescription: {
+		id: 'app.appearance-settings.fonts.mono-font-description',
+		defaultMessage: 'Used for logs, the server console, and other monospace content.',
+	},
+	fontDefault: {
+		id: 'app.appearance-settings.fonts.default',
+		defaultMessage: 'Launcher default',
+	},
+	fontMonospace: {
+		id: 'app.appearance-settings.fonts.monospace',
+		defaultMessage: 'Monospace',
+	},
+	fontMissing: {
+		id: 'app.appearance-settings.fonts.missing',
+		defaultMessage: 'Not installed',
+	},
+	fontSearchPlaceholder: {
+		id: 'app.appearance-settings.fonts.search-placeholder',
+		defaultMessage: 'Search installed fonts',
+	},
+	fontNoResults: {
+		id: 'app.appearance-settings.fonts.no-results',
+		defaultMessage: 'No matching fonts',
+	},
+	fontLoadFailed: {
+		id: 'app.appearance-settings.fonts.load-failed',
+		defaultMessage: "Couldn't read the list of installed fonts.",
+	},
+	fontRetry: { id: 'app.appearance-settings.fonts.retry', defaultMessage: 'Retry' },
+	fontReset: {
+		id: 'app.appearance-settings.fonts.reset',
+		defaultMessage: 'Reset',
+	},
+	fontPreviewLabel: { id: 'app.appearance-settings.fonts.preview', defaultMessage: 'Preview' },
+	fontUiPreviewSample: {
+		id: 'app.appearance-settings.fonts.ui-preview-sample',
+		defaultMessage: 'The quick brown fox jumps over the lazy dog.',
+	},
+	fontMonoPreviewSample: {
+		id: 'app.appearance-settings.fonts.mono-preview-sample',
+		defaultMessage: 'const x = () => 0; // monospace',
+	},
 })
 
 const os = ref(await getOS())
@@ -373,6 +443,78 @@ const customBackgroundPreview = computed(() =>
 		: null,
 )
 
+const systemFonts = ref<SystemFontFamily[]>([])
+const systemFontsLoading = ref(true)
+const systemFontsFailed = ref(false)
+
+async function loadSystemFonts() {
+	systemFontsLoading.value = true
+	systemFontsFailed.value = false
+
+	try {
+		systemFonts.value = await getSystemFontFamilies()
+	} catch (error) {
+		systemFontsFailed.value = true
+		console.warn('Failed to read the list of installed fonts', error)
+	} finally {
+		systemFontsLoading.value = false
+	}
+}
+
+function selectedOptionLabel(options: FontFamilyOptionOrDivider[], value: string): string {
+	const option = options.find(
+		(entry): entry is FontFamilyOption => 'value' in entry && entry.value === value,
+	)
+
+	return option?.label ?? ''
+}
+
+const uiFontOptions = computed<FontFamilyOptionOrDivider[]>(() =>
+	buildFontFamilyOptions(systemFonts.value, {
+		defaultLabel: formatMessage(messages.fontDefault),
+		missingLabel: formatMessage(messages.fontMissing),
+		selected: settings.value.ui_font,
+	}),
+)
+
+const monoFontOptions = computed<FontFamilyOptionOrDivider[]>(() =>
+	buildFontFamilyOptions(systemFonts.value, {
+		defaultLabel: formatMessage(messages.fontDefault),
+		missingLabel: formatMessage(messages.fontMissing),
+		monospaceLabel: formatMessage(messages.fontMonospace),
+		selected: settings.value.mono_font,
+		groupMonospaced: true,
+	}),
+)
+
+const uiFontSelection = computed({
+	get: () => canonicalFontFamily(systemFonts.value, settings.value.ui_font),
+	set: (value: string) => {
+		settings.value.ui_font = optionValueToFontSetting(value)
+	},
+})
+
+const monoFontSelection = computed({
+	get: () => canonicalFontFamily(systemFonts.value, settings.value.mono_font),
+	set: (value: string) => {
+		settings.value.mono_font = optionValueToFontSetting(value)
+	},
+})
+
+const uiFontSearchValue = computed(() =>
+	selectedOptionLabel(uiFontOptions.value, uiFontSelection.value),
+)
+const monoFontSearchValue = computed(() =>
+	selectedOptionLabel(monoFontOptions.value, monoFontSelection.value),
+)
+
+const uiFontPreview = computed(() =>
+	resolveFontFamily(settings.value.ui_font, DEFAULT_UI_FONT_STACK),
+)
+const monoFontPreview = computed(() =>
+	resolveFontFamily(settings.value.mono_font, DEFAULT_MONO_FONT_STACK),
+)
+
 function updateUiScale(value: number) {
 	const clamped = Math.min(200, Math.max(50, Math.round(value)))
 	setUiScale(clamped)
@@ -489,6 +631,8 @@ watch(
 			settings.value.transparent_background_blur,
 			settings.value.sidebar_instance_count,
 			settings.value.close_behavior,
+			settings.value.ui_font,
+			settings.value.mono_font,
 		] as const,
 	([
 		path,
@@ -499,6 +643,8 @@ watch(
 		transparentBlur,
 		sidebarInstanceCount,
 		closeBehavior,
+		uiFont,
+		monoFont,
 	]) => {
 		themeStore.customBackgroundPath = path
 		themeStore.customBackgroundBlur = blur
@@ -509,10 +655,19 @@ watch(
 		themeStore.setTransparentBackgroundClass()
 		themeStore.sidebarInstanceCount = sidebarInstanceCount
 		themeStore.closeBehavior = closeBehavior as CloseBehavior
+		themeStore.uiFont = uiFont
+		themeStore.monoFont = monoFont
+		themeStore.setUiFont()
+		themeStore.setMonoFont()
 	},
 	{ immediate: true },
 )
 
+onMounted(() => {
+	if (props.scope === 'interface') {
+		void loadSystemFonts()
+	}
+})
 watch(
 	settings,
 	async () => {
@@ -1148,6 +1303,118 @@ watch(
 			</SettingsRow>
 		</SettingsSection>
 
+		<SettingsSection v-if="props.scope === 'interface'">
+			<template #header>
+				<h2
+					id="settings-target-appearance-fonts"
+					tabindex="-1"
+					class="m-0 text-lg font-semibold text-contrast"
+				>
+					{{ formatMessage(messages.fontsTitle) }}
+				</h2>
+				<p class="m-0 mt-1 text-sm leading-relaxed text-secondary">
+					{{ formatMessage(messages.fontsDescription) }}
+				</p>
+			</template>
+			<SettingsRow stacked>
+				<template #label>
+					<span id="settings-target-appearance-ui-font" tabindex="-1">
+						{{ formatMessage(messages.uiFontTitle) }}
+					</span>
+				</template>
+				<template #description>{{ formatMessage(messages.uiFontDescription) }}</template>
+				<template #control>
+					<div class="flex w-full flex-col gap-3">
+						<div class="flex items-center gap-2">
+							<div class="min-w-0 flex-1">
+								<Combobox
+									v-model="uiFontSelection"
+									:options="uiFontOptions"
+									searchable
+									:search-value="uiFontSearchValue"
+									:search-placeholder="formatMessage(messages.fontSearchPlaceholder)"
+									:no-options-message="formatMessage(messages.fontNoResults)"
+									show-no-options-when-empty
+									:disabled="systemFontsLoading"
+								/>
+							</div>
+							<Button
+								type="quiet"
+								:disabled="settings.ui_font === null"
+								@click="settings.ui_font = null"
+							>
+								{{ formatMessage(messages.fontReset) }}
+							</Button>
+						</div>
+						<div class="flex flex-col gap-1">
+							<span class="text-xs text-secondary">
+								{{ formatMessage(messages.fontPreviewLabel) }}
+							</span>
+							<div
+								class="rounded-[var(--radius-md)] bg-surface-3 px-3 py-2 text-base text-contrast"
+								:style="{ fontFamily: uiFontPreview }"
+							>
+								{{ formatMessage(messages.fontUiPreviewSample) }}
+							</div>
+						</div>
+					</div>
+				</template>
+			</SettingsRow>
+			<SettingsRow stacked>
+				<template #label>
+					<span id="settings-target-appearance-mono-font" tabindex="-1">
+						{{ formatMessage(messages.monoFontTitle) }}
+					</span>
+				</template>
+				<template #description>{{ formatMessage(messages.monoFontDescription) }}</template>
+				<template #control>
+					<div class="flex w-full flex-col gap-3">
+						<div class="flex items-center gap-2">
+							<div class="min-w-0 flex-1">
+								<Combobox
+									v-model="monoFontSelection"
+									:options="monoFontOptions"
+									searchable
+									:search-value="monoFontSearchValue"
+									:search-placeholder="formatMessage(messages.fontSearchPlaceholder)"
+									:no-options-message="formatMessage(messages.fontNoResults)"
+									show-no-options-when-empty
+									:disabled="systemFontsLoading"
+								/>
+							</div>
+							<Button
+								type="quiet"
+								:disabled="settings.mono_font === null"
+								@click="settings.mono_font = null"
+							>
+								{{ formatMessage(messages.fontReset) }}
+							</Button>
+						</div>
+						<div class="flex flex-col gap-1">
+							<span class="text-xs text-secondary">
+								{{ formatMessage(messages.fontPreviewLabel) }}
+							</span>
+							<div
+								class="rounded-[var(--radius-md)] bg-surface-3 px-3 py-2 text-xs text-contrast"
+								:style="{ fontFamily: monoFontPreview }"
+							>
+								{{ formatMessage(messages.fontMonoPreviewSample) }}
+							</div>
+						</div>
+					</div>
+				</template>
+			</SettingsRow>
+			<div
+				v-if="systemFontsFailed"
+				class="flex items-center justify-between gap-3 px-4 pb-4 text-sm text-secondary"
+			>
+				<span>{{ formatMessage(messages.fontLoadFailed) }}</span>
+				<Button type="quiet" @click="loadSystemFonts">
+					{{ formatMessage(messages.fontRetry) }}
+				</Button>
+			</div>
+		</SettingsSection>
+
 		<SettingsSection v-if="props.scope === 'content-downloads'">
 			<SettingsRow>
 				<template #label>
diff --git a/apps/app-frontend/src/components/ui/settings/BackupRepositorySettings.vue b/apps/app-frontend/src/components/ui/settings/BackupRepositorySettings.vue
new file mode 100644
index 0000000..46e3dd8
--- /dev/null
+++ b/apps/app-frontend/src/components/ui/settings/BackupRepositorySettings.vue
@@ -0,0 +1,167 @@
+<script setup lang="ts">
+import { FolderIcon } from '@modrinth/assets'
+import {
+	Admonition,
+	Button,
+	defineMessages,
+	injectFilePicker,
+	injectNotificationManager,
+	useFormatBytes,
+	useVIntl,
+} from '@modrinth/ui'
+import { onMounted, onUnmounted, ref } from 'vue'
+
+import {
+	type BackupRepositoryStatus,
+	getBackupRepositoryStatus,
+	listBackupOperations,
+	listenBackupProgress,
+	moveBackupRepository,
+} from '@/helpers/instance-backup'
+
+import SettingsRow from './SettingsRow.vue'
+import SettingsSection from './SettingsSection.vue'
+
+const { formatMessage } = useVIntl()
+const formatBytes = useFormatBytes()
+const filePicker = injectFilePicker()
+const { handleError } = injectNotificationManager()
+const status = ref<BackupRepositoryStatus | null>(null)
+const loading = ref(true)
+const moving = ref(false)
+const movedBytes = ref(0)
+const moveTotalBytes = ref(0)
+const movingOperationId = ref<string | null>(null)
+let unlisten: (() => void) | null = null
+
+const messages = defineMessages({
+	title: { id: 'settings.backups.repository.title', defaultMessage: 'Backup repository' },
+	description: {
+		id: 'settings.backups.repository.description',
+		defaultMessage: 'Deduplicated instance backup data and its independent index database.',
+	},
+	location: { id: 'settings.backups.repository.location', defaultMessage: 'Location' },
+	locationDescription: {
+		id: 'settings.backups.repository.location-description',
+		defaultMessage:
+			'Changing the location moves the complete repository. Choose a new or empty folder.',
+	},
+	change: { id: 'settings.backups.repository.change', defaultMessage: 'Change folder' },
+	moving: { id: 'settings.backups.repository.moving', defaultMessage: 'Moving repository...' },
+	movingProgress: {
+		id: 'settings.backups.repository.moving-progress',
+		defaultMessage: 'Moving repository: {processed} of {total}',
+	},
+	usage: { id: 'settings.backups.repository.usage', defaultMessage: 'Storage usage' },
+	usageDescription: {
+		id: 'settings.backups.repository.usage-description',
+		defaultMessage:
+			'{stored} stored for {logical} of backup data across {count, plural, one {# snapshot} other {# snapshots}}.',
+	},
+	unavailable: {
+		id: 'settings.backups.repository.unavailable',
+		defaultMessage: 'Repository unavailable',
+	},
+})
+
+async function refresh() {
+	loading.value = true
+	try {
+		status.value = await getBackupRepositoryStatus()
+	} catch (error) {
+		handleError(error)
+	} finally {
+		loading.value = false
+	}
+}
+
+async function changeLocation() {
+	const selection = await filePicker.pickFolder?.()
+	if (!selection) return
+	moving.value = true
+	movedBytes.value = 0
+	moveTotalBytes.value = 0
+	try {
+		movingOperationId.value = await moveBackupRepository(selection.path)
+	} catch (error) {
+		handleError(error)
+		moving.value = false
+	}
+}
+
+onMounted(async () => {
+	unlisten = await listenBackupProgress((event) => {
+		if (event.operationType !== 'repository_move') return
+		if (movingOperationId.value && event.operationId !== movingOperationId.value) return
+		movingOperationId.value = event.operationId
+		moving.value = !event.finalState
+		movedBytes.value = event.processedBytes
+		moveTotalBytes.value = event.totalBytes
+		if (event.finalState) void refresh()
+	})
+	const activeMove = (await listBackupOperations(undefined, true)).find(
+		(operation) => operation.operation_type === 'repository_move',
+	)
+	if (activeMove) {
+		movingOperationId.value = activeMove.id
+		moving.value = true
+		movedBytes.value = activeMove.processed_bytes
+		moveTotalBytes.value = activeMove.total_bytes
+	}
+	await refresh()
+})
+
+onUnmounted(() => unlisten?.())
+</script>
+
+<template>
+	<SettingsSection
+		:title="formatMessage(messages.title)"
+		:description="formatMessage(messages.description)"
+	>
+		<SettingsRow>
+			<template #label>{{ formatMessage(messages.location) }}</template>
+			<template #description>
+				<span class="break-all">{{ status?.path ?? '...' }}</span>
+				<span class="mt-1 block">{{ formatMessage(messages.locationDescription) }}</span>
+			</template>
+			<template #control>
+				<Button type="outlined" :disabled="loading || moving" @click="changeLocation"
+					><FolderIcon />
+					{{
+						formatMessage(
+							moving && moveTotalBytes > 0
+								? messages.movingProgress
+								: moving
+									? messages.moving
+									: messages.change,
+							{
+								processed: formatBytes(movedBytes),
+								total: formatBytes(moveTotalBytes),
+							},
+						)
+					}}
+				</Button>
+			</template>
+		</SettingsRow>
+		<SettingsRow v-if="status">
+			<template #label>{{ formatMessage(messages.usage) }}</template>
+			<template #description>
+				{{
+					formatMessage(messages.usageDescription, {
+						stored: formatBytes(status.stored_size),
+						logical: formatBytes(status.logical_size),
+						count: status.snapshot_count,
+					})
+				}}
+			</template>
+		</SettingsRow>
+		<Admonition
+			v-if="status && !status.available"
+			type="critical"
+			:header="formatMessage(messages.unavailable)"
+		>
+			{{ status.error }}
+		</Admonition>
+	</SettingsSection>
+</template>
diff --git a/apps/app-frontend/src/components/ui/settings/StorageBackupSettings.vue b/apps/app-frontend/src/components/ui/settings/StorageBackupSettings.vue
index b1c7803..b557d8e 100644
--- a/apps/app-frontend/src/components/ui/settings/StorageBackupSettings.vue
+++ b/apps/app-frontend/src/components/ui/settings/StorageBackupSettings.vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import BackupRepositorySettings from './BackupRepositorySettings.vue'
 import ResourceManagementSettings from './ResourceManagementSettings.vue'
 import StorageSettings from './StorageSettings.vue'
 </script>
@@ -6,6 +7,7 @@ import StorageSettings from './StorageSettings.vue'
 <template>
 	<div class="flex flex-col gap-6">
 		<ResourceManagementSettings scope="storage-backups" />
+		<BackupRepositorySettings />
 		<StorageSettings />
 	</div>
 </template>
diff --git a/apps/app-frontend/src/helpers/font-family.ts b/apps/app-frontend/src/helpers/font-family.ts
new file mode 100644
index 0000000..28db953
--- /dev/null
+++ b/apps/app-frontend/src/helpers/font-family.ts
@@ -0,0 +1,179 @@
+/**
+ * Font family plumbing shared by the appearance settings pickers and the theme
+ * store. Kept free of imports so `node --test` can load it directly.
+ */
+
+/** Mirrors `--font-standard` in `packages/assets/styles/defaults.scss`. */
+export const DEFAULT_UI_FONT_STACK =
+	'Inter, -apple-system, BlinkMacSystemFont, Segoe UI, Oxygen, Ubuntu, Roboto, Cantarell, Fira Sans, Droid Sans, Helvetica Neue, sans-serif'
+
+/** Mirrors `--mono-font` in `packages/assets/styles/defaults.scss`. */
+export const DEFAULT_MONO_FONT_STACK =
+	'ui-monospace, SFMono-Regular, SF Mono, Menlo, Consolas, Liberation Mono, monospace'
+
+/** Picker value for "follow the launcher default"; persisted as `null`. */
+export const FOLLOW_DEFAULT_FONT = ''
+
+export interface SystemFontFamily {
+	family: string
+	monospaced: boolean
+}
+
+export interface FontFamilyOption {
+	value: string
+	label: string
+	subLabel?: string
+	searchTerms?: string[]
+}
+
+export type FontFamilyOptionOrDivider = FontFamilyOption | { type: 'divider' }
+
+export interface FontFamilyOptionsConfig {
+	defaultLabel: string
+	selected?: string | null
+	missingLabel?: string
+	monospaceLabel?: string
+	groupMonospaced?: boolean
+}
+
+const MAX_FONT_FAMILY_LENGTH = 128
+
+/**
+ * Quotes and escapes an installed family name so it cannot break out of the
+ * font-family declaration it is spliced into. Returns null when the name has
+ * nothing usable left.
+ */
+export function cssFontFamilyName(name: string): string | null {
+	const trimmed = name.replace(/\p{Cc}/gu, '').trim()
+
+	if (!trimmed || trimmed.length > MAX_FONT_FAMILY_LENGTH) {
+		return null
+	}
+
+	return `"${trimmed.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
+}
+
+/**
+ * The value written into `--font-standard` / `--mono-font`. The launcher stack
+ * always trails the chosen family so an unresolvable name degrades to the
+ * previous default instead of the user agent's own font.
+ */
+export function resolveFontFamily(
+	setting: string | null | undefined,
+	fallbackStack: string,
+): string {
+	if (!setting) {
+		return fallbackStack
+	}
+
+	const family = cssFontFamilyName(setting)
+
+	return family ? `${family}, ${fallbackStack}` : fallbackStack
+}
+
+export function fontSettingToOptionValue(setting: string | null | undefined): string {
+	return setting ?? FOLLOW_DEFAULT_FONT
+}
+
+export function optionValueToFontSetting(value: string): string | null {
+	const trimmed = value.trim()
+
+	return trimmed === FOLLOW_DEFAULT_FONT ? null : trimmed
+}
+
+function compareFamilies(first: SystemFontFamily, second: SystemFontFamily): number {
+	const left = first.family.toLowerCase()
+	const right = second.family.toLowerCase()
+
+	if (left === right) {
+		return 0
+	}
+
+	return left < right ? -1 : 1
+}
+
+function toOption(family: SystemFontFamily, monospaceLabel?: string): FontFamilyOption {
+	return {
+		value: family.family,
+		label: family.family,
+		...(family.monospaced && monospaceLabel
+			? { subLabel: monospaceLabel, searchTerms: [monospaceLabel] }
+			: {}),
+	}
+}
+
+/**
+ * The spelling the font list uses for a stored family. Font names are matched
+ * case-insensitively so a stored value that only differs in case still selects
+ * its option instead of leaving the picker blank.
+ */
+export function canonicalFontFamily(
+	fonts: SystemFontFamily[],
+	setting: string | null | undefined,
+): string {
+	const selected = optionValueToFontSetting(setting ?? '')
+	if (!selected) {
+		return FOLLOW_DEFAULT_FONT
+	}
+
+	const listed = fonts.find((font) => font.family.trim().toLowerCase() === selected.toLowerCase())
+
+	return listed ? listed.family.trim() : selected
+}
+
+/**
+ * Builds the picker options for the installed font collection: the default
+ * entry first, the current selection re-added when it is no longer installed,
+ * and — for the monospace picker — monospaced families ahead of the rest.
+ */
+export function buildFontFamilyOptions(
+	fonts: SystemFontFamily[],
+	config: FontFamilyOptionsConfig,
+): FontFamilyOptionOrDivider[] {
+	const families = new Map<string, SystemFontFamily>()
+	for (const font of fonts) {
+		const family = font.family.trim()
+
+		if (!family) {
+			continue
+		}
+
+		const key = family.toLowerCase()
+		const known = families.get(key)
+
+		if (known) {
+			known.monospaced ||= font.monospaced
+		} else {
+			families.set(key, { family, monospaced: font.monospaced })
+		}
+	}
+
+	const sorted = [...families.values()].sort(compareFamilies)
+	const selected = optionValueToFontSetting(config.selected ?? '')
+	const options: FontFamilyOptionOrDivider[] = [
+		{ value: FOLLOW_DEFAULT_FONT, label: config.defaultLabel },
+	]
+
+	if (selected && !families.has(selected.toLowerCase()) && config.missingLabel) {
+		options.push({ value: selected, label: selected, subLabel: config.missingLabel })
+	}
+
+	if (config.groupMonospaced) {
+		const monospaced = sorted.filter((font) => font.monospaced)
+		const proportional = sorted.filter((font) => !font.monospaced)
+
+		options.push(...monospaced.map((font) => toOption(font, config.monospaceLabel)))
+
+		if (monospaced.length > 0 && proportional.length > 0) {
+			options.push({ type: 'divider' })
+		}
+
+		options.push(...proportional.map((font) => toOption(font, config.monospaceLabel)))
+
+		return options
+	}
+
+	options.push(...sorted.map((font) => toOption(font)))
+
+	return options
+}
\ No newline at end of file
diff --git a/apps/app-frontend/src/helpers/instance-backup.test.ts b/apps/app-frontend/src/helpers/instance-backup.test.ts
new file mode 100644
index 0000000..d09215d
--- /dev/null
+++ b/apps/app-frontend/src/helpers/instance-backup.test.ts
@@ -0,0 +1,38 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { canonicalizeBackupExclusions, formatBackupExclusionPath } from './instance-backup.ts'
+
+test('directory exclusions display with a trailing slash', () => {
+	assert.equal(formatBackupExclusionPath({ path: 'caches', kind: 'directory' }), 'caches/')
+	assert.equal(
+		formatBackupExclusionPath({ path: 'config/somemod/bigdb.sqlite', kind: 'file' }),
+		'config/somemod/bigdb.sqlite',
+	)
+})
+
+test('directory exclusions cover descendants while file exclusions stay exact', () => {
+	assert.deepEqual(
+		canonicalizeBackupExclusions([
+			{ path: 'saves/world', kind: 'directory' },
+			{ path: 'config\\bigdb.sqlite', kind: 'file' },
+			{ path: 'saves', kind: 'directory' },
+			{ path: 'config', kind: 'file' },
+		]),
+		[
+			{ path: 'config', kind: 'file' },
+			{ path: 'saves', kind: 'directory' },
+			{ path: 'config/bigdb.sqlite', kind: 'file' },
+		],
+	)
+})
+
+test('directory wins when the same exclusion is selected as both kinds', () => {
+	assert.deepEqual(
+		canonicalizeBackupExclusions([
+			{ path: 'cache', kind: 'file' },
+			{ path: 'cache', kind: 'directory' },
+		]),
+		[{ path: 'cache', kind: 'directory' }],
+	)
+})
diff --git a/apps/app-frontend/src/helpers/instance-backup.ts b/apps/app-frontend/src/helpers/instance-backup.ts
new file mode 100644
index 0000000..493648c
--- /dev/null
+++ b/apps/app-frontend/src/helpers/instance-backup.ts
@@ -0,0 +1,237 @@
+import { invoke } from '@tauri-apps/api/core'
+import { listen, type UnlistenFn } from '@tauri-apps/api/event'
+
+export type InstanceBackupEligibility =
+	| 'eligible'
+	| 'not_installed'
+	| 'symlink_instance'
+	| 'direct_linked_instance'
+	| 'external_game_directory'
+	| 'root_missing'
+	| 'root_is_link'
+
+export interface BackupRepositoryStatus {
+	path: string
+	initialized: boolean
+	available: boolean
+	stored_size: number
+	logical_size: number
+	snapshot_count: number
+	error: string | null
+}
+
+export type BackupExclusionKind = 'file' | 'directory'
+
+export interface BackupExclusion {
+	path: string
+	kind: BackupExclusionKind
+}
+
+export function formatBackupExclusionPath(exclusion: BackupExclusion): string {
+	return exclusion.kind === 'directory' ? `${exclusion.path}/` : exclusion.path
+}
+
+export interface InstanceBackupConfig {
+	instance_id: string
+	enabled: boolean
+	eligibility: InstanceBackupEligibility
+	excluded_paths: BackupExclusion[]
+	snapshot_count: number
+}
+
+export interface BackupSnapshot {
+	id: string
+	instance_id: string
+	instance_name: string
+	created_at: number
+	file_count: number
+	symlink_count: number
+	logical_size: number
+	added_size: number
+}
+
+export interface BackupDeleteSummary {
+	snapshot_count: number
+	logical_size: number
+}
+
+export interface BackupRestorePreview {
+	added_files: number
+	modified_files: number
+	deleted_files: number
+	plan_token: string
+}
+
+export type BackupOperationType =
+	'create' | 'restore' | 'restore_preview' | 'delete' | 'repository_move'
+export type BackupOperationState =
+	| 'queued'
+	| 'scanning'
+	| 'hashing'
+	| 'saving'
+	| 'validating'
+	| 'materializing'
+	| 'applying'
+	| 'completed'
+	| 'cancelled'
+	| 'failed'
+	| 'interrupted'
+
+export interface BackupOperation {
+	id: string
+	operation_type: BackupOperationType
+	instance_id: string
+	snapshot_id?: string
+	state: BackupOperationState
+	processed_bytes: number
+	total_bytes: number
+	cancellable: boolean
+	cancel_requested: boolean
+	error?: string
+	created_at: number
+	updated_at: number
+	finished_at?: number
+	restore_preview?: BackupRestorePreview
+}
+
+export type BackupProgressStage =
+	| 'scanning'
+	| 'hashing'
+	| 'saving'
+	| 'validating'
+	| 'copying'
+	| 'restoring'
+	| 'deleting'
+	| 'completed'
+	| 'cancelled'
+	| 'failed'
+
+export type BackupOperationFinalState = 'completed' | 'cancelled' | 'failed'
+
+export interface BackupProgressEvent {
+	operationId: string
+	instanceId?: string
+	operationType: BackupOperationType
+	stage: BackupProgressStage
+	processedBytes: number
+	totalBytes: number
+	finalState?: BackupOperationFinalState
+	snapshotId?: string
+	message?: string
+}
+
+export function canonicalizeBackupExclusions(values: BackupExclusion[]): BackupExclusion[] {
+	const normalized = values
+		.map((value) => ({ ...value, path: value.path.replaceAll('\\', '/') }))
+		.sort(
+			(left, right) =>
+				left.path.split('/').length - right.path.split('/').length ||
+				left.path.localeCompare(right.path),
+		)
+	const result: BackupExclusion[] = []
+	for (const value of normalized) {
+		const duplicate = result.find((existing) => existing.path === value.path)
+		if (duplicate) {
+			if (value.kind === 'directory') duplicate.kind = 'directory'
+			continue
+		}
+		if (
+			result.some(
+				(parent) => parent.kind === 'directory' && value.path.startsWith(`${parent.path}/`),
+			)
+		) {
+			continue
+		}
+		result.push(value)
+	}
+	return result
+}
+
+export function getBackupRepositoryStatus(): Promise<BackupRepositoryStatus> {
+	return invoke('plugin:instance|instance_get_backup_repository_status')
+}
+
+export function moveBackupRepository(destination: string): Promise<string> {
+	return invoke('plugin:instance|instance_move_backup_repository', { destination })
+}
+
+export function getBackupConfig(instanceId: string): Promise<InstanceBackupConfig> {
+	return invoke('plugin:instance|instance_get_backup_config', { instanceId })
+}
+
+export function normalizeBackupExclusion(
+	instanceId: string,
+	selectedPath: string,
+	kind: BackupExclusionKind,
+): Promise<BackupExclusion> {
+	return invoke('plugin:instance|instance_normalize_backup_exclusion', {
+		instanceId,
+		selectedPath,
+		kind,
+	})
+}
+
+export function enableBackups(
+	instanceId: string,
+	excludedPaths: BackupExclusion[],
+): Promise<InstanceBackupConfig> {
+	return invoke('plugin:instance|instance_enable_backups', { instanceId, excludedPaths })
+}
+
+export function updateBackupExclusions(
+	instanceId: string,
+	excludedPaths: BackupExclusion[],
+): Promise<InstanceBackupConfig> {
+	return invoke('plugin:instance|instance_update_backup_exclusions', {
+		instanceId,
+		excludedPaths,
+	})
+}
+
+export function disableBackups(instanceId: string): Promise<void> {
+	return invoke('plugin:instance|instance_disable_backups', { instanceId })
+}
+
+export function startBackup(instanceId: string): Promise<string> {
+	return invoke('plugin:instance|instance_start_backup', { instanceId })
+}
+
+export function cancelBackup(operationId: string): Promise<boolean> {
+	return invoke('plugin:instance|instance_cancel_backup', { operationId })
+}
+
+export function listBackupOperations(
+	instanceId?: string,
+	activeOnly = false,
+): Promise<BackupOperation[]> {
+	return invoke('plugin:instance|instance_list_backup_operations', {
+		instanceId,
+		activeOnly,
+	})
+}
+
+export function listBackups(instanceId: string): Promise<BackupSnapshot[]> {
+	return invoke('plugin:instance|instance_list_backups', { instanceId })
+}
+
+export function deleteBackup(snapshotId: string): Promise<void> {
+	return invoke('plugin:instance|instance_delete_backup', { snapshotId })
+}
+
+export function startBackupRestorePreview(snapshotId: string): Promise<string> {
+	return invoke('plugin:instance|instance_get_backup_restore_preview', { snapshotId })
+}
+
+export function restoreBackup(snapshotId: string, planToken: string): Promise<string> {
+	return invoke('plugin:instance|instance_restore_backup', { snapshotId, planToken })
+}
+
+export function getBackupDeleteSummary(instanceId: string): Promise<BackupDeleteSummary> {
+	return invoke('plugin:instance|instance_get_backup_delete_summary', { instanceId })
+}
+
+export function listenBackupProgress(
+	handler: (event: BackupProgressEvent) => void,
+): Promise<UnlistenFn> {
+	return listen<BackupProgressEvent>('instance_backup_progress', (event) => handler(event.payload))
+}
diff --git a/apps/app-frontend/src/helpers/settings.ts b/apps/app-frontend/src/helpers/settings.ts
index 996687f..67f0321 100644
--- a/apps/app-frontend/src/helpers/settings.ts
+++ b/apps/app-frontend/src/helpers/settings.ts
@@ -174,6 +174,8 @@ export type AppSettings = {
 	minimal_home_instance_id: string | null
 	close_behavior: 'ask' | 'close' | 'lightweight'
 	ui_scale: number
+	ui_font: string | null
+	mono_font: string | null
 	home_widgets: HomeDashboardConfig | null
 	terracotta_public_nodes: string[]
 
@@ -216,6 +218,8 @@ type LegacyMirrorSettings = {
 function normalizeDownloadSettings(settings: AppSettings & LegacyMirrorSettings): AppSettings {
 	settings.close_behavior ??= 'ask'
 	settings.ui_scale ??= 100
+	settings.ui_font ??= null
+	settings.mono_font ??= null
 	const hasLegacySettings =
 		typeof settings.use_minecraft_mirror === 'boolean' &&
 		typeof settings.use_modrinth_mirror === 'boolean' &&
diff --git a/apps/app-frontend/src/helpers/system-fonts.ts b/apps/app-frontend/src/helpers/system-fonts.ts
new file mode 100644
index 0000000..7c87cbc
--- /dev/null
+++ b/apps/app-frontend/src/helpers/system-fonts.ts
@@ -0,0 +1,19 @@
+import { invoke } from '@tauri-apps/api/core'
+
+import type { SystemFontFamily } from './font-family.ts'
+
+let cached: Promise<SystemFontFamily[]> | null = null
+
+/**
+ * Installed families are enumerated by the host once per session; installing a
+ * font while the launcher runs shows up after a restart.
+ */
+export function getSystemFontFamilies(): Promise<SystemFontFamily[]> {
+	cached ??= invoke<SystemFontFamily[]>('plugin:fonts|fonts_get_system_fonts').catch((error) => {
+		// A failed scan must not poison the session for a later retry.
+		cached = null
+		throw error
+	})
+
+	return cached
+}
\ No newline at end of file
diff --git a/apps/app-frontend/src/locales/en-US/index.json b/apps/app-frontend/src/locales/en-US/index.json
index 1ee0afe..9373038 100644
--- a/apps/app-frontend/src/locales/en-US/index.json
+++ b/apps/app-frontend/src/locales/en-US/index.json
@@ -419,6 +419,57 @@
   "app.appearance-settings.auto-hide-downloads-button.description": {
     "message": "Hide the downloads button in the sidebar when there are no active download tasks."
   },
+  "app.appearance-settings.fonts.title": {
+    "message": "Fonts"
+  },
+  "app.appearance-settings.fonts.description": {
+    "message": "Choose the fonts the launcher interface and its logs are rendered in."
+  },
+  "app.appearance-settings.fonts.ui-font": {
+    "message": "Interface font"
+  },
+  "app.appearance-settings.fonts.ui-font-description": {
+    "message": "Used across the launcher interface. Only fonts installed on this system are listed."
+  },
+  "app.appearance-settings.fonts.mono-font": {
+    "message": "Monospace font"
+  },
+  "app.appearance-settings.fonts.mono-font-description": {
+    "message": "Used for logs, the server console, and other monospace content."
+  },
+  "app.appearance-settings.fonts.default": {
+    "message": "Launcher default"
+  },
+  "app.appearance-settings.fonts.monospace": {
+    "message": "Monospace"
+  },
+  "app.appearance-settings.fonts.missing": {
+    "message": "Not installed"
+  },
+  "app.appearance-settings.fonts.search-placeholder": {
+    "message": "Search installed fonts"
+  },
+  "app.appearance-settings.fonts.no-results": {
+    "message": "No matching fonts"
+  },
+  "app.appearance-settings.fonts.load-failed": {
+    "message": "Couldn't read the list of installed fonts."
+  },
+  "app.appearance-settings.fonts.retry": {
+    "message": "Retry"
+  },
+  "app.appearance-settings.fonts.reset": {
+    "message": "Reset"
+  },
+  "app.appearance-settings.fonts.preview": {
+    "message": "Preview"
+  },
+  "app.appearance-settings.fonts.ui-preview-sample": {
+    "message": "The quick brown fox jumps over the lazy dog."
+  },
+  "app.appearance-settings.fonts.mono-preview-sample": {
+    "message": "const x = () => 0; // monospace"
+  },
   "app.appearance-settings.auto-hide-downloads-button.title": {
     "message": "Auto-hide downloads button"
   },
@@ -9949,5 +10000,170 @@
   },
   "app.navigation.screenshots": {
     "message": "Screenshots"
+  },
+  "instance.backups.added-size": {
+    "message": "{size} newly stored"
+  },
+  "instance.backups.all-included": {
+    "message": "All instance files and folders are included."
+  },
+  "instance.backups.backup-now": {
+    "message": "Back up now"
+  },
+  "instance.backups.cancel": {
+    "message": "Cancel backup"
+  },
+  "instance.backups.choose": {
+    "message": "Everything is backed up by default. Add files or folders that should be excluded."
+  },
+  "instance.backups.delete": {
+    "message": "Delete backup"
+  },
+  "instance.backups.delete-body": {
+    "message": "This snapshot will be permanently deleted. Unused stored files will also be removed."
+  },
+  "instance.backups.delete-title": {
+    "message": "Delete this backup?"
+  },
+  "instance.backups.description": {
+    "message": "Create deduplicated snapshots of the whole instance while it is closed."
+  },
+  "instance.backups.disable": {
+    "message": "Disable backups"
+  },
+  "instance.backups.disable-blocked": {
+    "message": "Delete every snapshot before disabling backups."
+  },
+  "instance.backups.edit-exclusions": {
+    "message": "Edit exclusions"
+  },
+  "instance.backups.empty": {
+    "message": "No backups have been created yet."
+  },
+  "instance.backups.enable": {
+    "message": "Enable backups"
+  },
+  "instance.backups.excluded-paths": {
+    "message": "Excluded: {paths}"
+  },
+  "instance.backups.exclusions.add-file": {
+    "message": "Add excluded file"
+  },
+  "instance.backups.exclusions.add-folder": {
+    "message": "Add excluded folder"
+  },
+  "instance.backups.exclusions.empty": {
+    "message": "No files or folders are excluded."
+  },
+  "instance.backups.exclusions.remove": {
+    "message": "Remove {path} from exclusions"
+  },
+  "instance.backups.loading": {
+    "message": "Loading backup settings..."
+  },
+  "instance.backups.progress-bytes": {
+    "message": "{processed} of {total}"
+  },
+  "instance.backups.restore": {
+    "message": "Restore backup"
+  },
+  "instance.backups.restore-body": {
+    "message": "Upcoming operations: add {added, plural, one {# file} other {# files}}, modify {modified, plural, one {# file} other {# files}}, and delete {deleted, plural, one {# file} other {# files}}. Continue?"
+  },
+  "instance.backups.restore-title": {
+    "message": "Restore this backup?"
+  },
+  "instance.backups.save-exclusions": {
+    "message": "Save exclusions"
+  },
+  "instance.backups.snapshot-meta": {
+    "message": "{files, plural, one {# file} other {# files}} · {size}"
+  },
+  "instance.backups.snapshots": {
+    "message": "Snapshots"
+  },
+  "instance.backups.stage.applying": {
+    "message": "Applying changed files"
+  },
+  "instance.backups.stage.failed": {
+    "message": "Backup failed"
+  },
+  "instance.backups.stage.hashing": {
+    "message": "Hashing files"
+  },
+  "instance.backups.stage.interrupted": {
+    "message": "Backup operation was interrupted"
+  },
+  "instance.backups.stage.materializing": {
+    "message": "Preparing changed files"
+  },
+  "instance.backups.stage.preview": {
+    "message": "Analyzing restore changes"
+  },
+  "instance.backups.stage.queued": {
+    "message": "Waiting to start"
+  },
+  "instance.backups.stage.saving": {
+    "message": "Saving snapshot index"
+  },
+  "instance.backups.stage.scanning": {
+    "message": "Scanning files"
+  },
+  "instance.backups.stage.validating": {
+    "message": "Validating restore"
+  },
+  "instance.backups.title": {
+    "message": "Instance backups"
+  },
+  "instance.backups.unavailable": {
+    "message": "Backups are unavailable"
+  },
+  "instance.backups.unavailable.direct-linked": {
+    "message": "Instances linked directly to another launcher cannot be backed up."
+  },
+  "instance.backups.unavailable.external-directory": {
+    "message": "Instances that use an external game directory cannot be backed up."
+  },
+  "instance.backups.unavailable.not-installed": {
+    "message": "Finish installing this instance before enabling backups."
+  },
+  "instance.backups.unavailable.root-link": {
+    "message": "Instances whose root folder is a link cannot be backed up."
+  },
+  "instance.backups.unavailable.root-missing": {
+    "message": "The instance folder is missing."
+  },
+  "instance.backups.unavailable.symlink": {
+    "message": "Imported symbolic-link instances cannot be backed up."
+  },
+  "settings.backups.repository.change": {
+    "message": "Change folder"
+  },
+  "settings.backups.repository.description": {
+    "message": "Deduplicated instance backup data and its independent index database."
+  },
+  "settings.backups.repository.location": {
+    "message": "Location"
+  },
+  "settings.backups.repository.location-description": {
+    "message": "Changing the location moves the complete repository. Choose a new or empty folder."
+  },
+  "settings.backups.repository.moving": {
+    "message": "Moving repository..."
+  },
+  "settings.backups.repository.moving-progress": {
+    "message": "Moving repository: {processed} of {total}"
+  },
+  "settings.backups.repository.title": {
+    "message": "Backup repository"
+  },
+  "settings.backups.repository.unavailable": {
+    "message": "Repository unavailable"
+  },
+  "settings.backups.repository.usage": {
+    "message": "Storage usage"
+  },
+  "settings.backups.repository.usage-description": {
+    "message": "{stored} stored for {logical} of backup data across {count, plural, one {# snapshot} other {# snapshots}}."
   }
 }
diff --git a/apps/app-frontend/src/locales/zh-CN/index.json b/apps/app-frontend/src/locales/zh-CN/index.json
index 3b7a5d0..a2ffa43 100644
--- a/apps/app-frontend/src/locales/zh-CN/index.json
+++ b/apps/app-frontend/src/locales/zh-CN/index.json
@@ -640,6 +640,57 @@
   "app.appearance-settings.auto-hide-downloads-button.description": {
     "message": "没有进行中的下载任务时隐藏侧边栏中的下载按钮，有任务时自动显示。"
   },
+  "app.appearance-settings.fonts.title": {
+    "message": "字体"
+  },
+  "app.appearance-settings.fonts.description": {
+    "message": "选择启动器界面与日志使用的字体。"
+  },
+  "app.appearance-settings.fonts.ui-font": {
+    "message": "界面字体"
+  },
+  "app.appearance-settings.fonts.ui-font-description": {
+    "message": "应用于启动器界面。仅列出系统已安装的字体。"
+  },
+  "app.appearance-settings.fonts.mono-font": {
+    "message": "等宽字体"
+  },
+  "app.appearance-settings.fonts.mono-font-description": {
+    "message": "用于日志、服务器控制台等等宽内容。"
+  },
+  "app.appearance-settings.fonts.default": {
+    "message": "启动器默认"
+  },
+  "app.appearance-settings.fonts.monospace": {
+    "message": "等宽"
+  },
+  "app.appearance-settings.fonts.missing": {
+    "message": "未安装"
+  },
+  "app.appearance-settings.fonts.search-placeholder": {
+    "message": "搜索已安装的字体"
+  },
+  "app.appearance-settings.fonts.no-results": {
+    "message": "没有匹配的字体"
+  },
+  "app.appearance-settings.fonts.load-failed": {
+    "message": "无法读取已安装的字体列表。"
+  },
+  "app.appearance-settings.fonts.retry": {
+    "message": "重试"
+  },
+  "app.appearance-settings.fonts.reset": {
+    "message": "重置"
+  },
+  "app.appearance-settings.fonts.preview": {
+    "message": "预览"
+  },
+  "app.appearance-settings.fonts.ui-preview-sample": {
+    "message": "永和九年，岁在癸丑，暮春之初。"
+  },
+  "app.appearance-settings.fonts.mono-preview-sample": {
+    "message": "const x = () => 0; // 等宽"
+  },
   "app.appearance-settings.auto-hide-downloads-button.title": {
     "message": "自动隐藏下载按钮"
   },
@@ -10713,5 +10764,170 @@
   },
   "app.navigation.screenshots": {
     "message": "截图"
+  },
+  "instance.backups.added-size": {
+    "message": "新增存储 {size}"
+  },
+  "instance.backups.all-included": {
+    "message": "实例中的所有文件和文件夹都会纳入备份。"
+  },
+  "instance.backups.backup-now": {
+    "message": "立即备份"
+  },
+  "instance.backups.cancel": {
+    "message": "取消备份"
+  },
+  "instance.backups.choose": {
+    "message": "默认备份实例中的全部内容，请添加不需要备份的文件或文件夹。"
+  },
+  "instance.backups.delete": {
+    "message": "删除备份"
+  },
+  "instance.backups.delete-body": {
+    "message": "此快照将被永久删除，不再使用的仓库文件也会一并清理。"
+  },
+  "instance.backups.delete-title": {
+    "message": "删除此备份？"
+  },
+  "instance.backups.description": {
+    "message": "在实例关闭时，为整个实例创建去重快照。"
+  },
+  "instance.backups.disable": {
+    "message": "关闭备份"
+  },
+  "instance.backups.disable-blocked": {
+    "message": "必须先删除全部快照才能关闭备份。"
+  },
+  "instance.backups.edit-exclusions": {
+    "message": "编辑排除项"
+  },
+  "instance.backups.empty": {
+    "message": "尚未创建任何备份。"
+  },
+  "instance.backups.enable": {
+    "message": "启用备份"
+  },
+  "instance.backups.excluded-paths": {
+    "message": "不备份：{paths}"
+  },
+  "instance.backups.exclusions.add-file": {
+    "message": "添加忽略文件"
+  },
+  "instance.backups.exclusions.add-folder": {
+    "message": "添加忽略文件夹"
+  },
+  "instance.backups.exclusions.empty": {
+    "message": "没有忽略任何文件或文件夹。"
+  },
+  "instance.backups.exclusions.remove": {
+    "message": "从排除项中移除 {path}"
+  },
+  "instance.backups.loading": {
+    "message": "正在加载备份设置……"
+  },
+  "instance.backups.progress-bytes": {
+    "message": "已处理 {processed}，共 {total}"
+  },
+  "instance.backups.restore": {
+    "message": "恢复备份"
+  },
+  "instance.backups.restore-body": {
+    "message": "即将进行的操作：新增 {added} 个文件，修改 {modified} 个文件，删除 {deleted} 个文件。是否继续？"
+  },
+  "instance.backups.restore-title": {
+    "message": "恢复此备份？"
+  },
+  "instance.backups.save-exclusions": {
+    "message": "保存排除项"
+  },
+  "instance.backups.snapshot-meta": {
+    "message": "{files, plural, other {# 个文件}} · {size}"
+  },
+  "instance.backups.snapshots": {
+    "message": "快照"
+  },
+  "instance.backups.stage.applying": {
+    "message": "正在应用变更文件"
+  },
+  "instance.backups.stage.failed": {
+    "message": "备份失败"
+  },
+  "instance.backups.stage.hashing": {
+    "message": "正在计算文件哈希"
+  },
+  "instance.backups.stage.interrupted": {
+    "message": "备份任务已中断"
+  },
+  "instance.backups.stage.materializing": {
+    "message": "正在准备变更文件"
+  },
+  "instance.backups.stage.preview": {
+    "message": "正在分析恢复变更"
+  },
+  "instance.backups.stage.queued": {
+    "message": "等待开始"
+  },
+  "instance.backups.stage.saving": {
+    "message": "正在保存快照索引"
+  },
+  "instance.backups.stage.scanning": {
+    "message": "正在扫描文件"
+  },
+  "instance.backups.stage.validating": {
+    "message": "正在验证恢复任务"
+  },
+  "instance.backups.title": {
+    "message": "实例备份"
+  },
+  "instance.backups.unavailable": {
+    "message": "备份不可用"
+  },
+  "instance.backups.unavailable.direct-linked": {
+    "message": "不支持备份直接关联到其他启动器的实例。"
+  },
+  "instance.backups.unavailable.external-directory": {
+    "message": "不支持备份使用外部游戏目录的实例。"
+  },
+  "instance.backups.unavailable.not-installed": {
+    "message": "请先完成实例安装，再启用备份。"
+  },
+  "instance.backups.unavailable.root-link": {
+    "message": "不支持备份根文件夹为链接的实例。"
+  },
+  "instance.backups.unavailable.root-missing": {
+    "message": "实例文件夹不存在。"
+  },
+  "instance.backups.unavailable.symlink": {
+    "message": "不支持备份以符号链接导入的实例。"
+  },
+  "settings.backups.repository.change": {
+    "message": "更改文件夹"
+  },
+  "settings.backups.repository.description": {
+    "message": "存放去重后的实例备份数据及其独立索引数据库。"
+  },
+  "settings.backups.repository.location": {
+    "message": "位置"
+  },
+  "settings.backups.repository.location-description": {
+    "message": "更改位置会移动完整仓库。请选择新的或空的文件夹。"
+  },
+  "settings.backups.repository.moving": {
+    "message": "正在移动仓库……"
+  },
+  "settings.backups.repository.moving-progress": {
+    "message": "正在移动备份仓库：已处理 {processed}，共 {total}"
+  },
+  "settings.backups.repository.title": {
+    "message": "备份文件仓库"
+  },
+  "settings.backups.repository.unavailable": {
+    "message": "仓库不可用"
+  },
+  "settings.backups.repository.usage": {
+    "message": "存储占用"
+  },
+  "settings.backups.repository.usage-description": {
+    "message": "实际存储 {stored}，对应 {logical} 的备份数据，共 {count, plural, other {# 个快照}}。"
   }
 }
diff --git a/apps/app-frontend/src/locales/zh-TW/index.json b/apps/app-frontend/src/locales/zh-TW/index.json
index e5c41de..ac75760 100644
--- a/apps/app-frontend/src/locales/zh-TW/index.json
+++ b/apps/app-frontend/src/locales/zh-TW/index.json
@@ -572,6 +572,57 @@
   "app.appearance-settings.auto-hide-downloads-button.description": {
     "message": "沒有進行中的下載任務時隱藏側邊欄中的下載按鈕，有任務時自動顯示。"
   },
+  "app.appearance-settings.fonts.title": {
+    "message": "字型"
+  },
+  "app.appearance-settings.fonts.description": {
+    "message": "選擇啟動器介面與日誌使用的字型。"
+  },
+  "app.appearance-settings.fonts.ui-font": {
+    "message": "介面字型"
+  },
+  "app.appearance-settings.fonts.ui-font-description": {
+    "message": "套用於啟動器介面。僅列出系統已安裝的字型。"
+  },
+  "app.appearance-settings.fonts.mono-font": {
+    "message": "等寬字型"
+  },
+  "app.appearance-settings.fonts.mono-font-description": {
+    "message": "用於日誌、伺服器主控台等等寬內容。"
+  },
+  "app.appearance-settings.fonts.default": {
+    "message": "啟動器預設"
+  },
+  "app.appearance-settings.fonts.monospace": {
+    "message": "等寬"
+  },
+  "app.appearance-settings.fonts.missing": {
+    "message": "未安裝"
+  },
+  "app.appearance-settings.fonts.search-placeholder": {
+    "message": "搜尋已安裝的字型"
+  },
+  "app.appearance-settings.fonts.no-results": {
+    "message": "沒有符合的字型"
+  },
+  "app.appearance-settings.fonts.load-failed": {
+    "message": "無法讀取已安裝的字型清單。"
+  },
+  "app.appearance-settings.fonts.retry": {
+    "message": "重試"
+  },
+  "app.appearance-settings.fonts.reset": {
+    "message": "重設"
+  },
+  "app.appearance-settings.fonts.preview": {
+    "message": "預覽"
+  },
+  "app.appearance-settings.fonts.ui-preview-sample": {
+    "message": "永和九年，歲在癸丑，暮春之初。"
+  },
+  "app.appearance-settings.fonts.mono-preview-sample": {
+    "message": "const x = () => 0; // 等寬"
+  },
   "app.appearance-settings.auto-hide-downloads-button.title": {
     "message": "自動隱藏下載按鈕"
   },
@@ -10144,5 +10195,170 @@
   },
   "app.instance.dependencies.zoom-out": {
     "message": "縮小"
+  },
+  "instance.backups.added-size": {
+    "message": "新增存储 {size}"
+  },
+  "instance.backups.all-included": {
+    "message": "实例中的所有文件和文件夹都会纳入备份。"
+  },
+  "instance.backups.backup-now": {
+    "message": "立即备份"
+  },
+  "instance.backups.cancel": {
+    "message": "取消备份"
+  },
+  "instance.backups.choose": {
+    "message": "默认备份实例中的全部内容，请添加不需要备份的文件或文件夹。"
+  },
+  "instance.backups.delete": {
+    "message": "删除备份"
+  },
+  "instance.backups.delete-body": {
+    "message": "此快照将被永久删除，不再使用的仓库文件也会一并清理。"
+  },
+  "instance.backups.delete-title": {
+    "message": "删除此备份？"
+  },
+  "instance.backups.description": {
+    "message": "在实例关闭时，为整个实例创建去重快照。"
+  },
+  "instance.backups.disable": {
+    "message": "关闭备份"
+  },
+  "instance.backups.disable-blocked": {
+    "message": "必须先删除全部快照才能关闭备份。"
+  },
+  "instance.backups.edit-exclusions": {
+    "message": "编辑排除项"
+  },
+  "instance.backups.empty": {
+    "message": "尚未创建任何备份。"
+  },
+  "instance.backups.enable": {
+    "message": "启用备份"
+  },
+  "instance.backups.excluded-paths": {
+    "message": "不备份：{paths}"
+  },
+  "instance.backups.exclusions.add-file": {
+    "message": "添加忽略文件"
+  },
+  "instance.backups.exclusions.add-folder": {
+    "message": "添加忽略文件夹"
+  },
+  "instance.backups.exclusions.empty": {
+    "message": "没有忽略任何文件或文件夹。"
+  },
+  "instance.backups.exclusions.remove": {
+    "message": "从排除项中移除 {path}"
+  },
+  "instance.backups.loading": {
+    "message": "正在加载备份设置……"
+  },
+  "instance.backups.progress-bytes": {
+    "message": "已处理 {processed}，共 {total}"
+  },
+  "instance.backups.restore": {
+    "message": "恢复备份"
+  },
+  "instance.backups.restore-body": {
+    "message": "即将进行的操作：新增 {added} 个文件，修改 {modified} 个文件，删除 {deleted} 个文件。是否继续？"
+  },
+  "instance.backups.restore-title": {
+    "message": "恢复此备份？"
+  },
+  "instance.backups.save-exclusions": {
+    "message": "保存排除项"
+  },
+  "instance.backups.snapshot-meta": {
+    "message": "{files, plural, other {# 个文件}} · {size}"
+  },
+  "instance.backups.snapshots": {
+    "message": "快照"
+  },
+  "instance.backups.stage.applying": {
+    "message": "正在应用变更文件"
+  },
+  "instance.backups.stage.failed": {
+    "message": "备份失败"
+  },
+  "instance.backups.stage.hashing": {
+    "message": "正在计算文件哈希"
+  },
+  "instance.backups.stage.interrupted": {
+    "message": "备份任务已中断"
+  },
+  "instance.backups.stage.materializing": {
+    "message": "正在准备变更文件"
+  },
+  "instance.backups.stage.preview": {
+    "message": "正在分析恢复变更"
+  },
+  "instance.backups.stage.queued": {
+    "message": "等待开始"
+  },
+  "instance.backups.stage.saving": {
+    "message": "正在保存快照索引"
+  },
+  "instance.backups.stage.scanning": {
+    "message": "正在扫描文件"
+  },
+  "instance.backups.stage.validating": {
+    "message": "正在验证恢复任务"
+  },
+  "instance.backups.title": {
+    "message": "实例备份"
+  },
+  "instance.backups.unavailable": {
+    "message": "备份不可用"
+  },
+  "instance.backups.unavailable.direct-linked": {
+    "message": "不支持备份直接关联到其他启动器的实例。"
+  },
+  "instance.backups.unavailable.external-directory": {
+    "message": "不支持备份使用外部游戏目录的实例。"
+  },
+  "instance.backups.unavailable.not-installed": {
+    "message": "请先完成实例安装，再启用备份。"
+  },
+  "instance.backups.unavailable.root-link": {
+    "message": "不支持备份根文件夹为链接的实例。"
+  },
+  "instance.backups.unavailable.root-missing": {
+    "message": "实例文件夹不存在。"
+  },
+  "instance.backups.unavailable.symlink": {
+    "message": "不支持备份以符号链接导入的实例。"
+  },
+  "settings.backups.repository.change": {
+    "message": "更改文件夹"
+  },
+  "settings.backups.repository.description": {
+    "message": "存放去重后的实例备份数据及其独立索引数据库。"
+  },
+  "settings.backups.repository.location": {
+    "message": "位置"
+  },
+  "settings.backups.repository.location-description": {
+    "message": "更改位置会移动完整仓库。请选择新的或空的文件夹。"
+  },
+  "settings.backups.repository.moving": {
+    "message": "正在移动仓库……"
+  },
+  "settings.backups.repository.moving-progress": {
+    "message": "正在移动备份仓库：已处理 {processed}，共 {total}"
+  },
+  "settings.backups.repository.title": {
+    "message": "备份文件仓库"
+  },
+  "settings.backups.repository.unavailable": {
+    "message": "仓库不可用"
+  },
+  "settings.backups.repository.usage": {
+    "message": "存储占用"
+  },
+  "settings.backups.repository.usage-description": {
+    "message": "实际存储 {stored}，对应 {logical} 的备份数据，共 {count, plural, other {# 个快照}}。"
   }
 }
diff --git a/apps/app-frontend/src/store/theme.ts b/apps/app-frontend/src/store/theme.ts
index bc6366c..e3dc50e 100644
--- a/apps/app-frontend/src/store/theme.ts
+++ b/apps/app-frontend/src/store/theme.ts
@@ -1,5 +1,11 @@
 import { defineStore } from 'pinia'
 
+import {
+	DEFAULT_MONO_FONT_STACK,
+	DEFAULT_UI_FONT_STACK,
+	resolveFontFamily,
+} from '@/helpers/font-family.ts'
+
 let systemThemeMq: MediaQueryList | null = null
 
 export const DEFAULT_FEATURE_FLAGS = {
@@ -130,6 +136,9 @@ export type ThemeStore = {
 
 	devMode: boolean
 	featureFlags: FeatureFlags
+
+	uiFont: string | null
+	monoFont: string | null
 }
 
 export const DEFAULT_THEME_STORE: ThemeStore = {
@@ -154,6 +163,9 @@ export const DEFAULT_THEME_STORE: ThemeStore = {
 
 	devMode: false,
 	featureFlags: DEFAULT_FEATURE_FLAGS,
+
+	uiFont: null,
+	monoFont: null,
 }
 
 export const useTheming = defineStore('themeStore', {
@@ -249,6 +261,32 @@ export const useTheming = defineStore('themeStore', {
 				`${Math.min(Math.max(this.transparentBackgroundOpacity, 0), 100)}%`,
 			)
 		},
+		/**
+		 * The font tokens are declared on `body` in the shared defaults, so the
+		 * launcher picks up the chosen family by overriding the CSS variable there.
+		 */
+		setUiFont() {
+			const body = document.body
+			if (this.uiFont) {
+				body.style.setProperty(
+					'--font-standard',
+					resolveFontFamily(this.uiFont, DEFAULT_UI_FONT_STACK),
+				)
+			} else {
+				body.style.removeProperty('--font-standard')
+			}
+		},
+		setMonoFont() {
+			const body = document.body
+			if (this.monoFont) {
+				body.style.setProperty(
+					'--mono-font',
+					resolveFontFamily(this.monoFont, DEFAULT_MONO_FONT_STACK),
+				)
+			} else {
+				body.style.removeProperty('--mono-font')
+			}
+		},
 		getFeatureFlag(key: FeatureFlag) {
 			return this.featureFlags[key] ?? DEFAULT_FEATURE_FLAGS[key]
 		},
diff --git a/apps/app/Cargo.toml b/apps/app/Cargo.toml
index fe01a4b..8a45c99 100644
--- a/apps/app/Cargo.toml
+++ b/apps/app/Cargo.toml
@@ -16,6 +16,7 @@ dashmap = { workspace = true }
 either = { workspace = true }
 enumset = { workspace = true, features = ["serde"] }
 flate2 = { workspace = true }
+fontdb = { workspace = true }
 futures = { workspace = true }
 hyper = { workspace = true, features = ["server"] }
 hyper-util = { workspace = true }
@@ -28,6 +29,7 @@ paste = { workspace = true }
 path-util = { workspace = true }
 quartz_nbt = { workspace = true, features = ["serde"] }
 regex = { workspace = true }
+semver = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 serde_with = { workspace = true }
diff --git a/apps/app/build.rs b/apps/app/build.rs
index 1ab3c38..a418b53 100644
--- a/apps/app/build.rs
+++ b/apps/app/build.rs
@@ -428,6 +428,21 @@ fn main() {
                 InlinedPlugin::new()
                     .commands(&[
                         "instance_remove",
+                        "instance_get_backup_repository_status",
+                        "instance_move_backup_repository",
+                        "instance_get_backup_config",
+                        "instance_normalize_backup_exclusion",
+                        "instance_enable_backups",
+                        "instance_update_backup_exclusions",
+                        "instance_disable_backups",
+                        "instance_start_backup",
+                        "instance_cancel_backup",
+                        "instance_list_backup_operations",
+                        "instance_list_backups",
+                        "instance_delete_backup",
+                        "instance_get_backup_restore_preview",
+                        "instance_restore_backup",
+                        "instance_get_backup_delete_summary",
                         "instance_create_direct_link",
                         "instance_sync_direct_links",
                         "instance_get",
@@ -697,6 +712,14 @@ fn main() {
                         DefaultPermissionRule::AllowAllCommands,
                     ),
             )
+            .plugin(
+                "fonts",
+                InlinedPlugin::new()
+                    .commands(&["fonts_get_system_fonts"])
+                    .default_permission(
+                        DefaultPermissionRule::AllowAllCommands,
+                    ),
+            )
             .plugin(
                 "drop",
                 InlinedPlugin::new()
diff --git a/apps/app/src/api/files.rs b/apps/app/src/api/files.rs
index 68ac99a..e1fac14 100644
--- a/apps/app/src/api/files.rs
+++ b/apps/app/src/api/files.rs
@@ -9,7 +9,7 @@ use std::path::PathBuf;
 use std::sync::Mutex;
 use tauri::{Emitter, Runtime};
 use tauri_plugin_dialog::DialogExt;
-use theseus::instance::{get_full_path, list};
+use theseus::instance::get_full_path;
 
 const STUDIO_FILES_CHANGED_EVENT: &str = "studio-files-changed";
 
diff --git a/apps/app/src/api/fonts.rs b/apps/app/src/api/fonts.rs
new file mode 100644
index 0000000..06b399a
--- /dev/null
+++ b/apps/app/src/api/fonts.rs
@@ -0,0 +1,91 @@
+use serde::Serialize;
+use std::collections::HashMap;
+use std::sync::OnceLock;
+
+use crate::api::Result;
+
+#[derive(Debug, Clone, Serialize)]
+pub struct SystemFontFamily {
+    pub family: String,
+    pub monospaced: bool,
+}
+
+/// Scanning every installed face costs a few hundred milliseconds, and the
+/// collection only changes between sessions, so it is read once per process.
+static SYSTEM_FONTS: OnceLock<Vec<SystemFontFamily>> = OnceLock::new();
+
+type FontFamilies = [(String, fontdb::Language)];
+
+/// fontdb lists the English US family first when the font has one, but the
+/// lookup is explicit so a face with an unusual name table still resolves to
+/// the name the webview matches against.
+fn english_family_name(families: &FontFamilies) -> Option<&str> {
+    families
+        .iter()
+        .find(|(_, language)| {
+            *language == fontdb::Language::English_UnitedStates
+        })
+        .or_else(|| families.first())
+        .map(|(name, _)| name.trim())
+        .filter(|name| !name.is_empty())
+}
+
+#[derive(Default)]
+struct FamilyAccumulator {
+    families: HashMap<String, bool>,
+}
+
+impl FamilyAccumulator {
+    fn add(&mut self, families: &FontFamilies, monospaced: bool) {
+        let Some(name) = english_family_name(families) else {
+            return;
+        };
+
+        self.families
+            .entry(name.to_owned())
+            .and_modify(|flag| *flag |= monospaced)
+            .or_insert(monospaced);
+    }
+
+    fn into_sorted_families(self) -> Vec<SystemFontFamily> {
+        let mut families: Vec<SystemFontFamily> = self
+            .families
+            .into_iter()
+            .map(|(family, monospaced)| SystemFontFamily { family, monospaced })
+            .collect();
+        families.sort_by_cached_key(|entry| entry.family.to_lowercase());
+        families
+    }
+}
+
+fn collect_system_fonts() -> Vec<SystemFontFamily> {
+    let mut database = fontdb::Database::new();
+    database.load_system_fonts();
+
+    let mut accumulator = FamilyAccumulator::default();
+    for face in database.faces() {
+        accumulator.add(&face.families, face.monospaced);
+    }
+
+    accumulator.into_sorted_families()
+}
+
+#[tauri::command]
+pub async fn fonts_get_system_fonts() -> Result<Vec<SystemFontFamily>> {
+    if let Some(fonts) = SYSTEM_FONTS.get() {
+        return Ok(fonts.clone());
+    }
+
+    let fonts = tauri::async_runtime::spawn_blocking(collect_system_fonts)
+        .await
+        .map_err(std::io::Error::other)?;
+
+    // A concurrent caller may have won the race; the scan is deterministic.
+    Ok(SYSTEM_FONTS.get_or_init(|| fonts).clone())
+}
+
+pub fn init<R: tauri::Runtime>() -> tauri::plugin::TauriPlugin<R> {
+    tauri::plugin::Builder::new("fonts")
+        .invoke_handler(tauri::generate_handler![fonts_get_system_fonts])
+        .build()
+}
diff --git a/apps/app/src/api/instance/mod.rs b/apps/app/src/api/instance/mod.rs
index 300dc79..28b31a6 100644
--- a/apps/app/src/api/instance/mod.rs
+++ b/apps/app/src/api/instance/mod.rs
@@ -25,6 +25,21 @@ pub fn init<R: tauri::Runtime>() -> tauri::plugin::TauriPlugin<R> {
     tauri::plugin::Builder::new("instance")
         .invoke_handler(tauri::generate_handler![
             instance_remove,
+            instance_get_backup_repository_status,
+            instance_move_backup_repository,
+            instance_get_backup_config,
+            instance_normalize_backup_exclusion,
+            instance_enable_backups,
+            instance_update_backup_exclusions,
+            instance_disable_backups,
+            instance_start_backup,
+            instance_cancel_backup,
+            instance_list_backup_operations,
+            instance_list_backups,
+            instance_delete_backup,
+            instance_get_backup_restore_preview,
+            instance_restore_backup,
+            instance_get_backup_delete_summary,
             instance_create_direct_link,
             instance_sync_direct_links,
             instance_get,
@@ -1699,3 +1714,122 @@ pub async fn instance_open_screenshot<R: tauri::Runtime>(
         .map_err(|e| std::io::Error::other(e.to_string()))?;
     Ok(())
 }
+
+// ===== 实例备份命令（移植自 Axolotl） =====
+
+#[tauri::command]
+pub async fn instance_get_backup_repository_status()
+-> Result<theseus::instance::BackupRepositoryStatus> {
+    Ok(theseus::instance::get_backup_repository_status().await?)
+}
+
+#[tauri::command]
+pub async fn instance_move_backup_repository(
+    destination: PathBuf,
+) -> Result<uuid::Uuid> {
+    Ok(theseus::instance::move_backup_repository(destination).await?)
+}
+
+#[tauri::command]
+pub async fn instance_get_backup_config(
+    instance_id: &str,
+) -> Result<theseus::instance::InstanceBackupConfig> {
+    Ok(theseus::instance::get_backup_config(instance_id).await?)
+}
+
+#[tauri::command]
+pub async fn instance_normalize_backup_exclusion(
+    instance_id: &str,
+    selected_path: PathBuf,
+    kind: theseus::instance::BackupExclusionKind,
+) -> Result<theseus::instance::BackupExclusion> {
+    Ok(theseus::instance::get_backup_exclusion_from_path(
+        instance_id,
+        selected_path,
+        kind,
+    )
+    .await?)
+}
+
+#[tauri::command]
+pub async fn instance_enable_backups(
+    instance_id: &str,
+    excluded_paths: Vec<theseus::instance::BackupExclusion>,
+) -> Result<theseus::instance::InstanceBackupConfig> {
+    Ok(theseus::instance::enable_backups(instance_id, excluded_paths).await?)
+}
+
+#[tauri::command]
+pub async fn instance_update_backup_exclusions(
+    instance_id: &str,
+    excluded_paths: Vec<theseus::instance::BackupExclusion>,
+) -> Result<theseus::instance::InstanceBackupConfig> {
+    Ok(
+        theseus::instance::update_backup_exclusions(
+            instance_id,
+            excluded_paths,
+        )
+        .await?,
+    )
+}
+
+#[tauri::command]
+pub async fn instance_disable_backups(instance_id: &str) -> Result<()> {
+    Ok(theseus::instance::disable_backups(instance_id).await?)
+}
+
+#[tauri::command]
+pub async fn instance_start_backup(instance_id: String) -> Result<uuid::Uuid> {
+    Ok(theseus::instance::start_backup_snapshot(instance_id).await?)
+}
+
+#[tauri::command]
+pub async fn instance_cancel_backup(operation_id: uuid::Uuid) -> Result<bool> {
+    Ok(theseus::instance::cancel_backup(operation_id).await?)
+}
+
+#[tauri::command]
+pub async fn instance_list_backup_operations(
+    instance_id: Option<String>,
+    active_only: bool,
+) -> Result<Vec<theseus::instance::BackupOperation>> {
+    Ok(theseus::instance::list_backup_operations(
+        instance_id.as_deref(),
+        active_only,
+    )
+    .await?)
+}
+
+#[tauri::command]
+pub async fn instance_list_backups(
+    instance_id: &str,
+) -> Result<Vec<theseus::instance::BackupSnapshot>> {
+    Ok(theseus::instance::list_backup_snapshots(instance_id).await?)
+}
+
+#[tauri::command]
+pub async fn instance_delete_backup(snapshot_id: &str) -> Result<()> {
+    Ok(theseus::instance::delete_backup_snapshot(snapshot_id).await?)
+}
+
+#[tauri::command]
+pub async fn instance_get_backup_restore_preview(
+    snapshot_id: &str,
+) -> Result<uuid::Uuid> {
+    Ok(theseus::instance::get_backup_restore_preview(snapshot_id).await?)
+}
+
+#[tauri::command]
+pub async fn instance_restore_backup(
+    snapshot_id: &str,
+    plan_token: &str,
+) -> Result<uuid::Uuid> {
+    Ok(theseus::instance::restore_snapshot(snapshot_id, plan_token).await?)
+}
+
+#[tauri::command]
+pub async fn instance_get_backup_delete_summary(
+    instance_id: &str,
+) -> Result<theseus::instance::BackupDeleteSummary> {
+    Ok(theseus::instance::get_backup_delete_summary(instance_id).await?)
+}
diff --git a/apps/app/src/api/mod.rs b/apps/app/src/api/mod.rs
index 544509a..6c46a21 100644
--- a/apps/app/src/api/mod.rs
+++ b/apps/app/src/api/mod.rs
@@ -36,6 +36,7 @@ pub mod curseforge;
 pub mod datapacks;
 pub mod drop;
 pub mod files;
+pub mod fonts;
 pub mod friends;
 pub mod worlds;
 
diff --git a/apps/app/src/main.rs b/apps/app/src/main.rs
index 2467aaa..cfd1486 100644
--- a/apps/app/src/main.rs
+++ b/apps/app/src/main.rs
@@ -947,6 +947,7 @@ fn main() {
         .plugin(api::datapacks::init())
         .plugin(api::drop::init())
         .plugin(api::files::init())
+        .plugin(api::fonts::init())
         .plugin(api::friends::init())
         .plugin(api::worlds::init())
         .plugin(api::terracotta::init())
diff --git a/apps/app/src/updater_impl.rs b/apps/app/src/updater_impl.rs
index 57d7691..3817ee6 100644
--- a/apps/app/src/updater_impl.rs
+++ b/apps/app/src/updater_impl.rs
@@ -1,5 +1,6 @@
 use crate::api::Result;
 use futures::StreamExt;
+use semver::Version;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::sync::{Arc, Mutex};
@@ -8,7 +9,7 @@ use tauri::http::header::ACCEPT;
 use tauri::{Manager, ResourceId, Runtime, Webview};
 use tauri_plugin_http::reqwest;
 use tauri_plugin_http::reqwest::ClientBuilder;
-use tauri_plugin_updater::{Error, Update, UpdaterExt, Version};
+use tauri_plugin_updater::{Error, Update, UpdaterExt};
 use theseus::{
     LoadingBarType, emit_loading, init_loading, launcher_user_agent,
 };
@@ -34,8 +35,11 @@ const UPDATE_DOWNLOAD_TIMEOUT: std::time::Duration =
 fn is_remote_newer(current: &Version, remote: &Version) -> bool {
     use std::cmp::Ordering;
 
-    let core = (remote.major, remote.minor, remote.patch)
-        .cmp(&(current.major, current.minor, current.patch));
+    let core = (remote.major, remote.minor, remote.patch).cmp(&(
+        current.major,
+        current.minor,
+        current.patch,
+    ));
     if core != Ordering::Equal {
         return core == Ordering::Greater;
     }
@@ -79,12 +83,10 @@ fn compare_prerelease(left: &str, right: &str) -> std::cmp::Ordering {
         let (r_prefix, r_num) = split_prerelease_identifier(r);
 
         match (l_num, r_num) {
-            (Some(ln), Some(rn)) if l_prefix == r_prefix => {
-                match ln.cmp(&rn) {
-                    Ordering::Equal => continue,
-                    other => return other,
-                }
-            }
+            (Some(ln), Some(rn)) if l_prefix == r_prefix => match ln.cmp(&rn) {
+                Ordering::Equal => continue,
+                other => return other,
+            },
             _ => {
                 let prefix_cmp = l_prefix.cmp(r_prefix);
                 if prefix_cmp != Ordering::Equal {
diff --git a/packages/app-lib/.sqlx/query-a00177609aec1a056ec47d46d4acd6d1a6244434991d3624b70c7734a2ab85c3.json b/packages/app-lib/.sqlx/query-52d2d61ed9239875d6188417f74bbde439c49582e1e81f5acb7b52d769a1bc18.json
similarity index 93%
rename from packages/app-lib/.sqlx/query-a00177609aec1a056ec47d46d4acd6d1a6244434991d3624b70c7734a2ab85c3.json
rename to packages/app-lib/.sqlx/query-52d2d61ed9239875d6188417f74bbde439c49582e1e81f5acb7b52d769a1bc18.json
index 683062a..437365d 100644
--- a/packages/app-lib/.sqlx/query-a00177609aec1a056ec47d46d4acd6d1a6244434991d3624b70c7734a2ab85c3.json
+++ b/packages/app-lib/.sqlx/query-52d2d61ed9239875d6188417f74bbde439c49582e1e81f5acb7b52d769a1bc18.json
@@ -1,6 +1,6 @@
 {
   "db_name": "SQLite",
-  "query": "\n            SELECT\n                max_concurrent_writes, max_concurrent_downloads,\n                auto_concurrent_downloads, minecraft_metadata_source,\n                minecraft_file_source, modrinth_source, curseforge_source, mojang_auth_source,\n                theme, locale, default_page, collapsed_navigation, hide_nametag_skins_page, advanced_rendering, native_decorations,\n\t\t\t\tdiscord_rpc, developer_mode, telemetry, telemetry_consent_version, personalized_ads,\n                onboarded, onboarding_version, onboarding_instance_tour_completed,\n                json(extra_launch_args) extra_launch_args, json(custom_env_vars) custom_env_vars,\n                mc_memory_max, mc_memory_auto, mc_force_fullscreen, mc_maximize_window, mc_game_resolution_x, mc_game_resolution_y, hide_on_process_start, enter_lightweight_mode_on_game_launch,\n                auto_set_java_high_performance_mode,\n                hook_pre_launch, hook_wrapper, hook_post_exit,\n                custom_dir, prev_custom_dir, migrated, json(feature_flags) feature_flags, toggle_sidebar,\n                skipped_update, pending_update_toast_for_version, auto_download_updates, accent_color,\n                custom_background_path, custom_background_blur, custom_background_opacity,\n                transparent_background, transparent_background_opacity, transparent_background_blur,\n                sidebar_instance_count, home_layout, minimal_home_instance_id,\n                json(home_widgets) as \"home_widgets?: String\", auto_hide_downloads_button,\n                json(terracotta_public_nodes) terracotta_public_nodes,\n                ui_scale,\n                version\n            FROM settings\n            ",
+  "query": "\n            SELECT\n                max_concurrent_writes, max_concurrent_downloads,\n                auto_concurrent_downloads, minecraft_metadata_source,\n                minecraft_file_source, modrinth_source, curseforge_source, mojang_auth_source,\n                theme, locale, default_page, collapsed_navigation, hide_nametag_skins_page, advanced_rendering, native_decorations,\n\t\t\t\tdiscord_rpc, developer_mode, telemetry, telemetry_consent_version, personalized_ads,\n                onboarded, onboarding_version, onboarding_instance_tour_completed,\n                json(extra_launch_args) extra_launch_args, json(custom_env_vars) custom_env_vars,\n                mc_memory_max, mc_memory_auto, mc_force_fullscreen, mc_maximize_window, mc_game_resolution_x, mc_game_resolution_y, hide_on_process_start, enter_lightweight_mode_on_game_launch,\n                auto_set_java_high_performance_mode,\n                hook_pre_launch, hook_wrapper, hook_post_exit,\n                custom_dir, prev_custom_dir, migrated, json(feature_flags) feature_flags, toggle_sidebar,\n                skipped_update, pending_update_toast_for_version, auto_download_updates, accent_color,\n                custom_background_path, custom_background_blur, custom_background_opacity,\n                transparent_background, transparent_background_opacity, transparent_background_blur,\n                sidebar_instance_count, home_layout, minimal_home_instance_id,\n                json(home_widgets) as \"home_widgets?: String\", auto_hide_downloads_button,\n                json(terracotta_public_nodes) terracotta_public_nodes,\n                ui_scale,\n                ui_font,\n                backup_repository_path,\n                mono_font,\n                version\n            FROM settings\n            ",
   "describe": {
     "columns": [
       {
@@ -299,8 +299,23 @@
         "type_info": "Float"
       },
       {
-        "name": "version",
+        "name": "ui_font",
         "ordinal": 59,
+        "type_info": "Text"
+      },
+      {
+        "name": "backup_repository_path",
+        "ordinal": 60,
+        "type_info": "Text"
+      },
+      {
+        "name": "mono_font",
+        "ordinal": 61,
+        "type_info": "Text"
+      },
+      {
+        "name": "version",
+        "ordinal": 62,
         "type_info": "Integer"
       }
     ],
@@ -367,8 +382,11 @@
       false,
       null,
       false,
+      null,
+      null,
+      null,
       false
     ]
   },
-  "hash": "a00177609aec1a056ec47d46d4acd6d1a6244434991d3624b70c7734a2ab85c3"
-}
+  "hash": "52d2d61ed9239875d6188417f74bbde439c49582e1e81f5acb7b52d769a1bc18"
+}
\ No newline at end of file
diff --git a/packages/app-lib/backup_migrations/20260920131000_initial.sql b/packages/app-lib/backup_migrations/20260920131000_initial.sql
new file mode 100644
index 0000000..ef4fb27
--- /dev/null
+++ b/packages/app-lib/backup_migrations/20260920131000_initial.sql
@@ -0,0 +1,76 @@
+CREATE TABLE repository_meta (
+	id INTEGER PRIMARY KEY CHECK (id = 0),
+	schema_name TEXT NOT NULL,
+	created_at INTEGER NOT NULL
+);
+
+INSERT INTO repository_meta (id, schema_name, created_at)
+VALUES (0, 'axolotl-instance-backups', unixepoch('subsec') * 1000);
+
+CREATE TABLE instance_backup_configs (
+	instance_id TEXT PRIMARY KEY,
+	instance_name TEXT NOT NULL,
+	created_at INTEGER NOT NULL,
+	modified_at INTEGER NOT NULL
+);
+
+CREATE TABLE backup_selections (
+	instance_id TEXT NOT NULL REFERENCES instance_backup_configs(instance_id) ON DELETE CASCADE,
+	path TEXT NOT NULL,
+	PRIMARY KEY (instance_id, path)
+);
+
+CREATE TABLE backup_snapshots (
+	id TEXT PRIMARY KEY,
+	instance_id TEXT NOT NULL REFERENCES instance_backup_configs(instance_id) ON DELETE CASCADE,
+	instance_name TEXT NOT NULL,
+	created_at INTEGER NOT NULL,
+	file_count INTEGER NOT NULL,
+	symlink_count INTEGER NOT NULL,
+	logical_size INTEGER NOT NULL,
+	added_size INTEGER NOT NULL
+);
+
+CREATE INDEX backup_snapshots_instance_created
+	ON backup_snapshots(instance_id, created_at DESC);
+
+CREATE TABLE snapshot_roots (
+	snapshot_id TEXT NOT NULL REFERENCES backup_snapshots(id) ON DELETE CASCADE,
+	path TEXT NOT NULL,
+	existed INTEGER NOT NULL,
+	PRIMARY KEY (snapshot_id, path)
+);
+
+CREATE TABLE backup_objects (
+	hash TEXT PRIMARY KEY,
+	size INTEGER NOT NULL,
+	ref_count INTEGER NOT NULL CHECK (ref_count >= 0)
+);
+
+CREATE TABLE snapshot_entries (
+	snapshot_id TEXT NOT NULL REFERENCES backup_snapshots(id) ON DELETE CASCADE,
+	path TEXT NOT NULL,
+	kind TEXT NOT NULL CHECK (kind IN ('file', 'directory', 'symlink')),
+	object_hash TEXT REFERENCES backup_objects(hash),
+	size INTEGER NOT NULL DEFAULT 0,
+	modified_at INTEGER,
+	unix_mode INTEGER,
+	link_target TEXT,
+	link_is_directory INTEGER,
+	PRIMARY KEY (snapshot_id, path),
+	CHECK ((kind = 'file' AND object_hash IS NOT NULL) OR (kind != 'file' AND object_hash IS NULL)),
+	CHECK ((kind = 'symlink' AND link_target IS NOT NULL) OR (kind != 'symlink' AND link_target IS NULL))
+);
+
+CREATE INDEX snapshot_entries_object_hash
+	ON snapshot_entries(object_hash) WHERE object_hash IS NOT NULL;
+
+CREATE TABLE object_gc_queue (
+	hash TEXT PRIMARY KEY,
+	queued_at INTEGER NOT NULL
+);
+
+CREATE TABLE pending_instance_deletions (
+	instance_id TEXT PRIMARY KEY,
+	marked_at INTEGER NOT NULL
+);
diff --git a/packages/app-lib/backup_migrations/20260920150000_exclusion_rules.sql b/packages/app-lib/backup_migrations/20260920150000_exclusion_rules.sql
new file mode 100644
index 0000000..61fb9b8
--- /dev/null
+++ b/packages/app-lib/backup_migrations/20260920150000_exclusion_rules.sql
@@ -0,0 +1,19 @@
+ALTER TABLE backup_snapshots
+	ADD COLUMN scope_mode TEXT NOT NULL DEFAULT 'included_roots'
+	CHECK (scope_mode IN ('included_roots', 'excluded_paths'));
+
+DROP TABLE backup_selections;
+
+CREATE TABLE backup_exclusions (
+	instance_id TEXT NOT NULL REFERENCES instance_backup_configs(instance_id) ON DELETE CASCADE,
+	path TEXT NOT NULL,
+	kind TEXT NOT NULL CHECK (kind IN ('file', 'directory')),
+	PRIMARY KEY (instance_id, path)
+);
+
+CREATE TABLE snapshot_exclusions (
+	snapshot_id TEXT NOT NULL REFERENCES backup_snapshots(id) ON DELETE CASCADE,
+	path TEXT NOT NULL,
+	kind TEXT NOT NULL CHECK (kind IN ('file', 'directory')),
+	PRIMARY KEY (snapshot_id, path)
+);
diff --git a/packages/app-lib/backup_migrations/20260920200000_operations.sql b/packages/app-lib/backup_migrations/20260920200000_operations.sql
new file mode 100644
index 0000000..048ac4c
--- /dev/null
+++ b/packages/app-lib/backup_migrations/20260920200000_operations.sql
@@ -0,0 +1,26 @@
+CREATE TABLE backup_operations (
+	id TEXT PRIMARY KEY,
+	operation_type TEXT NOT NULL
+		CHECK (operation_type IN ('create', 'restore')),
+	instance_id TEXT NOT NULL,
+	snapshot_id TEXT,
+	state TEXT NOT NULL
+		CHECK (state IN (
+			'queued', 'scanning', 'hashing', 'saving', 'validating',
+			'materializing', 'applying', 'completed', 'cancelled', 'failed', 'interrupted'
+		)),
+	processed_bytes INTEGER NOT NULL DEFAULT 0,
+	total_bytes INTEGER NOT NULL DEFAULT 0,
+	cancellable INTEGER NOT NULL DEFAULT 1,
+	error TEXT,
+	created_at INTEGER NOT NULL,
+	updated_at INTEGER NOT NULL,
+	finished_at INTEGER
+);
+
+CREATE INDEX backup_operations_instance_created
+	ON backup_operations(instance_id, created_at DESC);
+
+CREATE INDEX backup_operations_active
+	ON backup_operations(state, updated_at DESC)
+	WHERE state NOT IN ('completed', 'cancelled', 'failed', 'interrupted');
diff --git a/packages/app-lib/backup_migrations/20260920210000_operation_cancellation.sql b/packages/app-lib/backup_migrations/20260920210000_operation_cancellation.sql
new file mode 100644
index 0000000..0b0fc53
--- /dev/null
+++ b/packages/app-lib/backup_migrations/20260920210000_operation_cancellation.sql
@@ -0,0 +1,2 @@
+ALTER TABLE backup_operations
+	ADD COLUMN cancel_requested INTEGER NOT NULL DEFAULT 0;
diff --git a/packages/app-lib/backup_migrations/20260920223000_repository_move_operations.sql b/packages/app-lib/backup_migrations/20260920223000_repository_move_operations.sql
new file mode 100644
index 0000000..e6da14e
--- /dev/null
+++ b/packages/app-lib/backup_migrations/20260920223000_repository_move_operations.sql
@@ -0,0 +1,45 @@
+PRAGMA foreign_keys = OFF;
+
+CREATE TABLE backup_operations_new (
+	id TEXT PRIMARY KEY,
+	operation_type TEXT NOT NULL
+		CHECK (operation_type IN ('create', 'restore', 'repository_move')),
+	instance_id TEXT NOT NULL,
+	snapshot_id TEXT,
+	state TEXT NOT NULL
+		CHECK (state IN (
+			'queued', 'scanning', 'hashing', 'saving', 'validating',
+			'materializing', 'applying', 'completed', 'cancelled', 'failed', 'interrupted'
+		)),
+	processed_bytes INTEGER NOT NULL DEFAULT 0,
+	total_bytes INTEGER NOT NULL DEFAULT 0,
+	cancellable INTEGER NOT NULL DEFAULT 1,
+	error TEXT,
+	created_at INTEGER NOT NULL,
+	updated_at INTEGER NOT NULL,
+	finished_at INTEGER,
+	cancel_requested INTEGER NOT NULL DEFAULT 0
+);
+
+INSERT INTO backup_operations_new (
+	id, operation_type, instance_id, snapshot_id, state,
+	processed_bytes, total_bytes, cancellable, error,
+	created_at, updated_at, finished_at, cancel_requested
+)
+SELECT
+	id, operation_type, instance_id, snapshot_id, state,
+	processed_bytes, total_bytes, cancellable, error,
+	created_at, updated_at, finished_at, cancel_requested
+FROM backup_operations;
+
+DROP TABLE backup_operations;
+ALTER TABLE backup_operations_new RENAME TO backup_operations;
+
+CREATE INDEX backup_operations_instance_created
+	ON backup_operations(instance_id, created_at DESC);
+
+CREATE INDEX backup_operations_active
+	ON backup_operations(state, updated_at DESC)
+	WHERE state NOT IN ('completed', 'cancelled', 'failed', 'interrupted');
+
+PRAGMA foreign_keys = ON;
diff --git a/packages/app-lib/backup_migrations/20260920230000_restore_preview_operations.sql b/packages/app-lib/backup_migrations/20260920230000_restore_preview_operations.sql
new file mode 100644
index 0000000..0a0fc22
--- /dev/null
+++ b/packages/app-lib/backup_migrations/20260920230000_restore_preview_operations.sql
@@ -0,0 +1,49 @@
+PRAGMA foreign_keys = OFF;
+
+CREATE TABLE backup_operations_new (
+	id TEXT PRIMARY KEY,
+	operation_type TEXT NOT NULL
+		CHECK (operation_type IN ('create', 'restore', 'repository_move', 'restore_preview')),
+	instance_id TEXT NOT NULL,
+	snapshot_id TEXT,
+	state TEXT NOT NULL
+		CHECK (state IN (
+			'queued', 'scanning', 'hashing', 'saving', 'validating',
+			'materializing', 'applying', 'completed', 'cancelled', 'failed', 'interrupted'
+		)),
+	processed_bytes INTEGER NOT NULL DEFAULT 0,
+	total_bytes INTEGER NOT NULL DEFAULT 0,
+	cancellable INTEGER NOT NULL DEFAULT 1,
+	error TEXT,
+	created_at INTEGER NOT NULL,
+	updated_at INTEGER NOT NULL,
+	finished_at INTEGER,
+	cancel_requested INTEGER NOT NULL DEFAULT 0,
+	preview_added_files INTEGER,
+	preview_modified_files INTEGER,
+	preview_deleted_files INTEGER,
+	preview_plan_token TEXT
+);
+
+INSERT INTO backup_operations_new (
+	id, operation_type, instance_id, snapshot_id, state,
+	processed_bytes, total_bytes, cancellable, error,
+	created_at, updated_at, finished_at, cancel_requested
+)
+SELECT
+	id, operation_type, instance_id, snapshot_id, state,
+	processed_bytes, total_bytes, cancellable, error,
+	created_at, updated_at, finished_at, cancel_requested
+FROM backup_operations;
+
+DROP TABLE backup_operations;
+ALTER TABLE backup_operations_new RENAME TO backup_operations;
+
+CREATE INDEX backup_operations_instance_created
+	ON backup_operations(instance_id, created_at DESC);
+
+CREATE INDEX backup_operations_active
+	ON backup_operations(state, updated_at DESC)
+	WHERE state NOT IN ('completed', 'cancelled', 'failed', 'interrupted');
+
+PRAGMA foreign_keys = ON;
diff --git a/packages/app-lib/migrations/20261002020000_add-font-settings.sql b/packages/app-lib/migrations/20261002020000_add-font-settings.sql
new file mode 100644
index 0000000..f9ecabd
--- /dev/null
+++ b/packages/app-lib/migrations/20261002020000_add-font-settings.sql
@@ -0,0 +1,2 @@
+ALTER TABLE settings ADD COLUMN ui_font TEXT;
+ALTER TABLE settings ADD COLUMN mono_font TEXT;
\ No newline at end of file
diff --git a/packages/app-lib/migrations/20261002030000_instance-backup-repository-path.sql b/packages/app-lib/migrations/20261002030000_instance-backup-repository-path.sql
new file mode 100644
index 0000000..8b87613
--- /dev/null
+++ b/packages/app-lib/migrations/20261002030000_instance-backup-repository-path.sql
@@ -0,0 +1 @@
+ALTER TABLE settings ADD COLUMN backup_repository_path TEXT;
diff --git a/packages/app-lib/migrations/20261002030100_pending-backup-repository-cleanups.sql b/packages/app-lib/migrations/20261002030100_pending-backup-repository-cleanups.sql
new file mode 100644
index 0000000..dd21092
--- /dev/null
+++ b/packages/app-lib/migrations/20261002030100_pending-backup-repository-cleanups.sql
@@ -0,0 +1,4 @@
+CREATE TABLE pending_backup_repository_cleanups (
+	path TEXT PRIMARY KEY,
+	created_at INTEGER NOT NULL
+);
diff --git a/packages/app-lib/src/api/instance/backup.rs b/packages/app-lib/src/api/instance/backup.rs
new file mode 100644
index 0000000..e1bbb12
--- /dev/null
+++ b/packages/app-lib/src/api/instance/backup.rs
@@ -0,0 +1,4971 @@
+use crate::event::{
+    InstanceBackupOperationFinalState, InstanceBackupOperationType,
+    InstanceBackupProgressPayload, InstanceBackupProgressStage,
+};
+use crate::state::instances::adapters::sqlite::instance_rows;
+use crate::state::{Settings, State};
+use crate::util::io;
+use chrono::Utc;
+use dashmap::DashMap;
+use dashmap::mapref::entry::Entry;
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use sqlx::migrate::Migrator;
+use sqlx::sqlite::{
+    SqliteConnectOptions, SqliteJournalMode, SqlitePoolOptions,
+};
+use sqlx::{Row, SqlitePool};
+use std::collections::{BTreeMap, BTreeSet, HashSet};
+use std::path::{Component, Path, PathBuf};
+use std::str::FromStr;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, LazyLock};
+use std::time::{Duration, UNIX_EPOCH};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::sync::Mutex;
+use tokio_util::sync::CancellationToken;
+use uuid::Uuid;
+
+static BACKUP_MIGRATOR: Migrator = sqlx::migrate!("./backup_migrations");
+static REPOSITORY_LOCK: LazyLock<Mutex<()>> = LazyLock::new(|| Mutex::new(()));
+static INSTANCE_MAINTENANCE_LOCKS: LazyLock<DashMap<String, Arc<Mutex<()>>>> =
+    LazyLock::new(DashMap::new);
+struct BackupCancellation {
+    token: CancellationToken,
+    cancellable: Arc<AtomicBool>,
+}
+
+static BACKUP_CANCELLATIONS: LazyLock<DashMap<Uuid, BackupCancellation>> =
+    LazyLock::new(DashMap::new);
+static ACTIVE_INSTANCE_OPERATIONS: LazyLock<DashMap<String, Uuid>> =
+    LazyLock::new(DashMap::new);
+
+const DATABASE_FILE: &str = "backup.db";
+const OBJECTS_DIR: &str = "objects";
+const STAGING_DIR: &str = ".staging";
+const RESTORE_PREFIX: &str = ".backup-restore-";
+const RESTORE_JOURNAL: &str = "restore.json";
+const RESTORE_COMMITTED: &str = "committed";
+const REPOSITORY_OPERATION_KEY: &str = "__backup_repository__";
+
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum InstanceBackupEligibility {
+    Eligible,
+    NotInstalled,
+    SymlinkInstance,
+    DirectLinkedInstance,
+    ExternalGameDirectory,
+    RootMissing,
+    RootIsLink,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct BackupRepositoryStatus {
+    pub path: String,
+    pub initialized: bool,
+    pub available: bool,
+    pub stored_size: u64,
+    pub logical_size: u64,
+    pub snapshot_count: u64,
+    pub error: Option<String>,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct InstanceBackupConfig {
+    pub instance_id: String,
+    pub enabled: bool,
+    pub eligibility: InstanceBackupEligibility,
+    pub excluded_paths: Vec<BackupExclusion>,
+    pub snapshot_count: u64,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, Eq, PartialEq)]
+#[serde(rename_all = "snake_case")]
+pub enum BackupExclusionKind {
+    File,
+    Directory,
+}
+
+impl BackupExclusionKind {
+    const fn as_str(&self) -> &'static str {
+        match self {
+            Self::File => "file",
+            Self::Directory => "directory",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize, Eq, PartialEq)]
+pub struct BackupExclusion {
+    pub path: String,
+    pub kind: BackupExclusionKind,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct BackupSnapshot {
+    pub id: String,
+    pub instance_id: String,
+    pub instance_name: String,
+    pub created_at: i64,
+    pub file_count: u64,
+    pub symlink_count: u64,
+    pub logical_size: u64,
+    pub added_size: u64,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct BackupDeleteSummary {
+    pub snapshot_count: u64,
+    pub logical_size: u64,
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct BackupRestorePreview {
+    pub added_files: u64,
+    pub modified_files: u64,
+    pub deleted_files: u64,
+    pub plan_token: String,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum BackupOperationType {
+    Create,
+    Restore,
+    RepositoryMove,
+    RestorePreview,
+}
+
+impl BackupOperationType {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Create => "create",
+            Self::Restore => "restore",
+            Self::RepositoryMove => "repository_move",
+            Self::RestorePreview => "restore_preview",
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum BackupOperationState {
+    Queued,
+    Scanning,
+    Hashing,
+    Saving,
+    Validating,
+    Materializing,
+    Applying,
+    Completed,
+    Cancelled,
+    Failed,
+    Interrupted,
+}
+
+impl BackupOperationState {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Queued => "queued",
+            Self::Scanning => "scanning",
+            Self::Hashing => "hashing",
+            Self::Saving => "saving",
+            Self::Validating => "validating",
+            Self::Materializing => "materializing",
+            Self::Applying => "applying",
+            Self::Completed => "completed",
+            Self::Cancelled => "cancelled",
+            Self::Failed => "failed",
+            Self::Interrupted => "interrupted",
+        }
+    }
+
+    const fn is_terminal(self) -> bool {
+        matches!(
+            self,
+            Self::Completed
+                | Self::Cancelled
+                | Self::Failed
+                | Self::Interrupted
+        )
+    }
+}
+
+#[derive(Clone, Debug, Serialize)]
+pub struct BackupOperation {
+    pub id: Uuid,
+    pub operation_type: BackupOperationType,
+    pub instance_id: String,
+    pub snapshot_id: Option<String>,
+    pub state: BackupOperationState,
+    pub processed_bytes: u64,
+    pub total_bytes: u64,
+    pub cancellable: bool,
+    pub cancel_requested: bool,
+    pub error: Option<String>,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub finished_at: Option<i64>,
+    pub restore_preview: Option<BackupRestorePreview>,
+}
+
+#[derive(Clone, Debug)]
+struct PendingEntry {
+    path: String,
+    kind: EntryKind,
+    object_hash: Option<String>,
+    size: u64,
+    modified_at: Option<i64>,
+    unix_mode: Option<u32>,
+    link_target: Option<String>,
+    link_is_directory: Option<bool>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum EntryKind {
+    File,
+    Directory,
+    Symlink,
+}
+
+#[derive(Clone, Debug)]
+struct RestoreEntry {
+    path: String,
+    kind: EntryKind,
+    object_hash: Option<String>,
+    size: u64,
+    unix_mode: Option<i64>,
+    link_target: Option<String>,
+    link_is_directory: Option<bool>,
+}
+
+#[derive(Debug)]
+struct RestorePlan {
+    preview: BackupRestorePreview,
+    roots: Vec<RestoreJournalRoot>,
+    target_entries: Vec<RestoreEntry>,
+}
+
+impl EntryKind {
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::File => "file",
+            Self::Directory => "directory",
+            Self::Symlink => "symlink",
+        }
+    }
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+struct RestoreJournal {
+    instance_id: String,
+    roots: Vec<RestoreJournalRoot>,
+    #[serde(default)]
+    whole_root: bool,
+    #[serde(default)]
+    exclusions: Vec<BackupExclusion>,
+}
+
+#[derive(Clone, Debug, Deserialize, Serialize)]
+struct RestoreJournalRoot {
+    path: String,
+    had_current: bool,
+}
+
+pub(crate) async fn lock_instance_maintenance(
+    instance_id: &str,
+) -> tokio::sync::OwnedMutexGuard<()> {
+    INSTANCE_MAINTENANCE_LOCKS
+        .entry(instance_id.to_string())
+        .or_insert_with(|| Arc::new(Mutex::new(())))
+        .clone()
+        .lock_owned()
+        .await
+}
+
+fn default_repository_path(state: &State) -> PathBuf {
+    state
+        .directories
+        .config_dir
+        .join("Backups")
+        .join("instances")
+}
+
+async fn repository_path(state: &State) -> crate::Result<PathBuf> {
+    let settings = Settings::get(&state.pool).await?;
+    Ok(settings
+        .backup_repository_path
+        .filter(|path| !path.trim().is_empty())
+        .map(PathBuf::from)
+        .unwrap_or_else(|| default_repository_path(state)))
+}
+
+async fn open_repository(
+    state: &State,
+    create: bool,
+) -> crate::Result<Option<(PathBuf, SqlitePool)>> {
+    let root = repository_path(state).await?;
+    Ok(open_repository_at(&root, create)
+        .await?
+        .map(|pool| (root, pool)))
+}
+
+async fn open_repository_at(
+    root: &Path,
+    create: bool,
+) -> crate::Result<Option<SqlitePool>> {
+    let database = root.join(DATABASE_FILE);
+    if !database.try_exists()? && !create {
+        return Ok(None);
+    }
+    if create {
+        io::create_dir_all(root.join(OBJECTS_DIR)).await?;
+        io::create_dir_all(root.join(STAGING_DIR)).await?;
+    }
+    let options = SqliteConnectOptions::new()
+        .filename(&database)
+        .create_if_missing(create)
+        .journal_mode(SqliteJournalMode::Wal)
+        .foreign_keys(true);
+    let pool = SqlitePoolOptions::new()
+        .max_connections(4)
+        .connect_with(options)
+        .await?;
+    BACKUP_MIGRATOR.run(&pool).await?;
+    Ok(Some(pool))
+}
+
+fn parse_backup_operation_type(
+    value: &str,
+) -> crate::Result<BackupOperationType> {
+    match value {
+        "create" => Ok(BackupOperationType::Create),
+        "restore" => Ok(BackupOperationType::Restore),
+        "repository_move" => Ok(BackupOperationType::RepositoryMove),
+        "restore_preview" => Ok(BackupOperationType::RestorePreview),
+        _ => Err(crate::ErrorKind::FSError(format!(
+            "Invalid backup operation type: {value}"
+        ))
+        .into()),
+    }
+}
+
+fn parse_backup_operation_state(
+    value: &str,
+) -> crate::Result<BackupOperationState> {
+    match value {
+        "queued" => Ok(BackupOperationState::Queued),
+        "scanning" => Ok(BackupOperationState::Scanning),
+        "hashing" => Ok(BackupOperationState::Hashing),
+        "saving" => Ok(BackupOperationState::Saving),
+        "validating" => Ok(BackupOperationState::Validating),
+        "materializing" => Ok(BackupOperationState::Materializing),
+        "applying" => Ok(BackupOperationState::Applying),
+        "completed" => Ok(BackupOperationState::Completed),
+        "cancelled" => Ok(BackupOperationState::Cancelled),
+        "failed" => Ok(BackupOperationState::Failed),
+        "interrupted" => Ok(BackupOperationState::Interrupted),
+        _ => Err(crate::ErrorKind::FSError(format!(
+            "Invalid backup operation state: {value}"
+        ))
+        .into()),
+    }
+}
+
+fn backup_operation_from_row(
+    row: &sqlx::sqlite::SqliteRow,
+) -> crate::Result<BackupOperation> {
+    Ok(BackupOperation {
+        id: Uuid::parse_str(row.get::<String, _>("id").as_str())
+            .map_err(|error| crate::ErrorKind::FSError(error.to_string()))?,
+        operation_type: parse_backup_operation_type(
+            row.get::<String, _>("operation_type").as_str(),
+        )?,
+        instance_id: row.get("instance_id"),
+        snapshot_id: row.get("snapshot_id"),
+        state: parse_backup_operation_state(
+            row.get::<String, _>("state").as_str(),
+        )?,
+        processed_bytes: row.get::<i64, _>("processed_bytes").max(0) as u64,
+        total_bytes: row.get::<i64, _>("total_bytes").max(0) as u64,
+        cancellable: row.get::<i64, _>("cancellable") != 0,
+        cancel_requested: row.get::<i64, _>("cancel_requested") != 0,
+        error: row.get("error"),
+        created_at: row.get("created_at"),
+        updated_at: row.get("updated_at"),
+        finished_at: row.get("finished_at"),
+        restore_preview: row
+            .try_get::<Option<i64>, _>("preview_added_files")?
+            .map(|added_files| BackupRestorePreview {
+                added_files: added_files.max(0) as u64,
+                modified_files: row
+                    .get::<Option<i64>, _>("preview_modified_files")
+                    .unwrap_or(0)
+                    .max(0) as u64,
+                deleted_files: row
+                    .get::<Option<i64>, _>("preview_deleted_files")
+                    .unwrap_or(0)
+                    .max(0) as u64,
+                plan_token: row
+                    .get::<Option<String>, _>("preview_plan_token")
+                    .unwrap_or_default(),
+            }),
+    })
+}
+
+async fn create_persisted_operation(
+    id: Uuid,
+    instance_id: &str,
+    operation_type: BackupOperationType,
+    snapshot_id: Option<&str>,
+) -> crate::Result<()> {
+    let state = State::get().await?;
+    let Some((_, pool)) = open_repository(&state, true).await? else {
+        return Err(crate::ErrorKind::FSError(
+            "Unable to open backup repository".to_string(),
+        )
+        .into());
+    };
+    if let Err(error) = reserve_instance_operation(instance_id, id) {
+        pool.close().await;
+        return Err(error);
+    }
+    let now = Utc::now().timestamp_millis();
+    let persist_result: crate::Result<()> = async {
+		let active_count: i64 = sqlx::query_scalar(
+			"SELECT COUNT(*) FROM backup_operations WHERE instance_id = ?
+			 AND state NOT IN ('completed', 'cancelled', 'failed', 'interrupted')",
+		)
+		.bind(instance_id)
+		.fetch_one(&pool)
+		.await?;
+		if active_count > 0 {
+			return Err(crate::ErrorKind::InputError(
+				"Another backup operation is already running for this instance".to_string(),
+			)
+			.into());
+		}
+		sqlx::query(
+			"INSERT INTO backup_operations
+			 (id, operation_type, instance_id, snapshot_id, state, created_at, updated_at)
+			 VALUES (?, ?, ?, ?, 'queued', ?, ?)",
+		)
+		.bind(id.to_string())
+		.bind(operation_type.as_str())
+		.bind(instance_id)
+		.bind(snapshot_id)
+		.bind(now)
+		.bind(now)
+		.execute(&pool)
+		.await?;
+		Ok(())
+	}.await;
+    pool.close().await;
+    if persist_result.is_err() {
+        ACTIVE_INSTANCE_OPERATIONS.remove(instance_id);
+    }
+    persist_result
+}
+
+fn reserve_instance_operation(
+    instance_id: &str,
+    id: Uuid,
+) -> crate::Result<()> {
+    match ACTIVE_INSTANCE_OPERATIONS.entry(instance_id.to_string()) {
+        Entry::Occupied(_) => {
+            return Err(crate::ErrorKind::InputError(
+                "Another backup operation is already running for this instance"
+                    .to_string(),
+            )
+            .into());
+        }
+        Entry::Vacant(entry) => {
+            entry.insert(id);
+        }
+    }
+    Ok(())
+}
+
+async fn update_persisted_operation(
+    operation_id: Uuid,
+    state: BackupOperationState,
+    processed_bytes: Option<u64>,
+    total_bytes: Option<u64>,
+    cancellable: Option<bool>,
+    error: Option<&str>,
+    snapshot_id: Option<&str>,
+) {
+    if !State::initialized() {
+        return;
+    }
+    let Ok(state_handle) = State::get().await else {
+        return;
+    };
+    let Ok(Some((_, pool))) = open_repository(&state_handle, false).await
+    else {
+        return;
+    };
+    let now = Utc::now().timestamp_millis();
+    let finished_at = state.is_terminal().then_some(now);
+    let _ = sqlx::query(
+		"UPDATE backup_operations SET state = ?, processed_bytes = COALESCE(?, processed_bytes),
+		 total_bytes = COALESCE(?, total_bytes), cancellable = COALESCE(?, cancellable),
+		 error = COALESCE(?, error), snapshot_id = COALESCE(?, snapshot_id),
+		 updated_at = ?, finished_at = COALESCE(?, finished_at) WHERE id = ?",
+	)
+	.bind(state.as_str())
+	.bind(processed_bytes.map(|value| value as i64))
+	.bind(total_bytes.map(|value| value as i64))
+	.bind(cancellable.map(i64::from))
+	.bind(error)
+	.bind(snapshot_id)
+	.bind(now)
+	.bind(finished_at)
+	.bind(operation_id.to_string())
+	.execute(&pool)
+	.await;
+    pool.close().await;
+}
+
+async fn store_restore_preview(
+    operation_id: Uuid,
+    preview: &BackupRestorePreview,
+) {
+    if !State::initialized() {
+        return;
+    }
+    let Ok(state) = State::get().await else {
+        return;
+    };
+    let Ok(Some((_, pool))) = open_repository(&state, false).await else {
+        return;
+    };
+    let _ = sqlx::query(
+        "UPDATE backup_operations SET preview_added_files = ?,
+         preview_modified_files = ?, preview_deleted_files = ?,
+         preview_plan_token = ? WHERE id = ?",
+    )
+    .bind(preview.added_files as i64)
+    .bind(preview.modified_files as i64)
+    .bind(preview.deleted_files as i64)
+    .bind(&preview.plan_token)
+    .bind(operation_id.to_string())
+    .execute(&pool)
+    .await;
+    pool.close().await;
+}
+
+pub async fn list_operations(
+    instance_id: Option<&str>,
+    active_only: bool,
+) -> crate::Result<Vec<BackupOperation>> {
+    let state = State::get().await?;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Ok(Vec::new());
+    };
+    let mut query = String::from(
+        "SELECT id, operation_type, instance_id, snapshot_id, state,
+		 processed_bytes, total_bytes, cancellable, cancel_requested, error,
+		 created_at, updated_at, finished_at, preview_added_files,
+		 preview_modified_files, preview_deleted_files, preview_plan_token
+		 FROM backup_operations WHERE 1 = 1",
+    );
+    if instance_id.is_some() {
+        query.push_str(" AND instance_id = ?");
+    }
+    if active_only {
+        query.push_str(" AND state NOT IN ('completed', 'cancelled', 'failed', 'interrupted')");
+    }
+    query.push_str(" ORDER BY created_at DESC");
+    let mut request = sqlx::query(&query);
+    if let Some(instance_id) = instance_id {
+        request = request.bind(instance_id);
+    }
+    let rows = request.fetch_all(&pool).await?;
+    pool.close().await;
+    rows.iter().map(backup_operation_from_row).collect()
+}
+
+pub async fn has_active_operations() -> crate::Result<bool> {
+    if !ACTIVE_INSTANCE_OPERATIONS.is_empty() {
+        return Ok(true);
+    }
+    Ok(!list_operations(None, true).await?.is_empty())
+}
+
+pub async fn has_active_repository_move() -> crate::Result<bool> {
+    if ACTIVE_INSTANCE_OPERATIONS.contains_key(REPOSITORY_OPERATION_KEY) {
+        return Ok(true);
+    }
+    Ok(list_operations(None, true).await?.iter().any(|operation| {
+        operation.operation_type == BackupOperationType::RepositoryMove
+    }))
+}
+
+pub async fn interrupt_active_operations() -> crate::Result<u64> {
+    let state = State::get().await?;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Ok(0);
+    };
+    let now = Utc::now().timestamp_millis();
+    let result = sqlx::query(
+        "UPDATE backup_operations SET state = 'interrupted', cancellable = 0,
+		 error = COALESCE(error, 'The launcher exited while the operation was running'),
+		 updated_at = ?, finished_at = ?
+		 WHERE state NOT IN ('completed', 'cancelled', 'failed', 'interrupted')",
+    )
+    .bind(now)
+    .bind(now)
+    .execute(&pool)
+    .await?;
+    pool.close().await;
+    Ok(result.rows_affected())
+}
+
+fn normalize_relative_directory(path: &str) -> crate::Result<String> {
+    let normalized = path.trim().replace('\\', "/");
+    if normalized.is_empty() || normalized == "." {
+        return Err(crate::ErrorKind::InputError(
+            "Backup directory must be a non-empty relative path".to_string(),
+        )
+        .into());
+    }
+    let path = Path::new(&normalized);
+    if path.is_absolute()
+        || path.components().any(|component| {
+            matches!(
+                component,
+                Component::ParentDir
+                    | Component::RootDir
+                    | Component::Prefix(_)
+            )
+        })
+    {
+        return Err(crate::ErrorKind::InputError(format!(
+            "Backup directory must stay inside the instance: {normalized}"
+        ))
+        .into());
+    }
+    let parts: Vec<_> = normalized
+        .split('/')
+        .filter(|part| !part.is_empty() && *part != ".")
+        .collect();
+    if parts.is_empty() {
+        return Err(crate::ErrorKind::InputError(
+            "Backup directory must not resolve to the instance root"
+                .to_string(),
+        )
+        .into());
+    }
+    Ok(parts.join("/"))
+}
+
+fn canonicalize_exclusions(
+    exclusions: Vec<BackupExclusion>,
+) -> crate::Result<Vec<BackupExclusion>> {
+    let mut normalized = exclusions
+        .into_iter()
+        .map(|exclusion| {
+            Ok(BackupExclusion {
+                path: normalize_relative_directory(&exclusion.path)?,
+                kind: exclusion.kind,
+            })
+        })
+        .collect::<crate::Result<Vec<_>>>()?;
+    normalized.sort_by(|left, right| {
+        left.path
+            .matches('/')
+            .count()
+            .cmp(&right.path.matches('/').count())
+            .then_with(|| left.path.cmp(&right.path))
+    });
+    let mut result: Vec<BackupExclusion> = Vec::new();
+    for exclusion in normalized {
+        if let Some(existing) = result
+            .iter_mut()
+            .find(|existing| existing.path == exclusion.path)
+        {
+            if exclusion.kind == BackupExclusionKind::Directory {
+                existing.kind = BackupExclusionKind::Directory;
+            }
+            continue;
+        }
+        if result.iter().any(|parent| {
+            parent.kind == BackupExclusionKind::Directory
+                && exclusion.path.starts_with(&format!("{}/", parent.path))
+        }) {
+            continue;
+        }
+        result.push(exclusion);
+    }
+    Ok(result)
+}
+
+fn ensure_canonical_exclusions(
+    exclusions: &[BackupExclusion],
+) -> crate::Result<()> {
+    let canonical = canonicalize_exclusions(exclusions.to_vec())?;
+    if canonical.len() != exclusions.len()
+        || exclusions
+            .iter()
+            .any(|exclusion| !canonical.contains(exclusion))
+    {
+        return Err(crate::ErrorKind::FSError(
+            "Invalid backup exclusion paths".to_string(),
+        )
+        .into());
+    }
+    Ok(())
+}
+
+async fn instance_and_root(
+    instance_id: &str,
+    state: &State,
+) -> crate::Result<(crate::state::Instance, PathBuf)> {
+    let instance = instance_rows::get_instance_by_id(instance_id, &state.pool)
+        .await?
+        .ok_or_else(|| {
+            crate::ErrorKind::InputError("Unknown instance".to_string())
+        })?;
+    let root = state.directories.instances_dir().join(&instance.path);
+    Ok((instance, root))
+}
+
+async fn eligibility_for(
+    instance_id: &str,
+    state: &State,
+) -> crate::Result<InstanceBackupEligibility> {
+    let (instance, root) = instance_and_root(instance_id, state).await?;
+    if instance.install_stage != crate::state::InstanceInstallStage::Installed {
+        return Ok(InstanceBackupEligibility::NotInstalled);
+    }
+    if instance.symlink_target.is_some() {
+        return Ok(InstanceBackupEligibility::SymlinkInstance);
+    }
+    if instance.is_direct_linked() {
+        return Ok(InstanceBackupEligibility::DirectLinkedInstance);
+    }
+    if instance
+        .game_dir_override
+        .as_deref()
+        .is_some_and(|path| !path.trim().is_empty())
+    {
+        return Ok(InstanceBackupEligibility::ExternalGameDirectory);
+    }
+    let metadata = match tokio::fs::symlink_metadata(&root).await {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            return Ok(InstanceBackupEligibility::RootMissing);
+        }
+        Err(error) => return Err(error.into()),
+    };
+    if io::is_symlink_or_reparse(&metadata) {
+        return Ok(InstanceBackupEligibility::RootIsLink);
+    }
+    Ok(InstanceBackupEligibility::Eligible)
+}
+
+async fn require_eligible(
+    instance_id: &str,
+    state: &State,
+) -> crate::Result<PathBuf> {
+    let eligibility = eligibility_for(instance_id, state).await?;
+    if !matches!(eligibility, InstanceBackupEligibility::Eligible) {
+        return Err(crate::ErrorKind::InputError(format!(
+            "Instance is not eligible for backups: {eligibility:?}"
+        ))
+        .into());
+    }
+    Ok(instance_and_root(instance_id, state).await?.1)
+}
+
+async fn validate_exclusion_paths(
+    root: &Path,
+    exclusions: Vec<BackupExclusion>,
+) -> crate::Result<Vec<BackupExclusion>> {
+    let exclusions = canonicalize_exclusions(exclusions)?;
+    validate_exclusion_ancestors(root, &exclusions).await?;
+    for exclusion in &exclusions {
+        let absolute = join_relative(root, &exclusion.path);
+        match tokio::fs::symlink_metadata(&absolute).await {
+            Ok(metadata) if io::is_symlink_or_reparse(&metadata) => {
+                if let Ok(target) = tokio::fs::metadata(&absolute).await {
+                    let kind_matches = match exclusion.kind {
+                        BackupExclusionKind::File => target.is_file(),
+                        BackupExclusionKind::Directory => target.is_dir(),
+                    };
+                    if !kind_matches {
+                        return Err(crate::ErrorKind::InputError(format!(
+                            "Backup exclusion type does not match: {}",
+                            exclusion.path
+                        ))
+                        .into());
+                    }
+                }
+            }
+            Ok(metadata)
+                if exclusion.kind == BackupExclusionKind::Directory
+                    && !metadata.is_dir()
+                    && !io::is_symlink_or_reparse(&metadata) =>
+            {
+                return Err(crate::ErrorKind::InputError(format!(
+                    "Backup exclusion is not a directory: {}",
+                    exclusion.path
+                ))
+                .into());
+            }
+            Ok(metadata)
+                if exclusion.kind == BackupExclusionKind::File
+                    && metadata.is_dir()
+                    && !io::is_symlink_or_reparse(&metadata) =>
+            {
+                return Err(crate::ErrorKind::InputError(format!(
+                    "Backup exclusion is not a file: {}",
+                    exclusion.path
+                ))
+                .into());
+            }
+            Ok(_) => {}
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => return Err(error.into()),
+        }
+    }
+    Ok(exclusions)
+}
+
+pub async fn exclusion_from_absolute_path(
+    instance_id: &str,
+    selected_path: PathBuf,
+    kind: BackupExclusionKind,
+) -> crate::Result<BackupExclusion> {
+    if !selected_path.is_absolute() {
+        return Err(crate::ErrorKind::InputError(
+            "Backup exclusion must be selected by absolute path".to_string(),
+        )
+        .into());
+    }
+    let state = State::get().await?;
+    let root = require_eligible(instance_id, &state).await?;
+    let canonical_root = io::canonicalize(&root)?;
+    let name = selected_path.file_name().ok_or_else(|| {
+        crate::ErrorKind::InputError(
+            "The instance root cannot be excluded from its backup".to_string(),
+        )
+    })?;
+    let parent = selected_path.parent().ok_or_else(|| {
+        crate::ErrorKind::InputError(
+            "Backup exclusion has no parent directory".to_string(),
+        )
+    })?;
+    let canonical_parent = io::canonicalize(parent)?;
+    let relative_parent = canonical_parent
+        .strip_prefix(&canonical_root)
+        .map_err(|_| {
+            crate::ErrorKind::InputError(
+                "Backup exclusions must stay inside the instance".to_string(),
+            )
+        })?;
+    let relative = relative_parent.join(name);
+    let relative = relative
+        .to_str()
+        .ok_or_else(|| crate::ErrorKind::UTFError(relative.clone()))?
+        .replace('\\', "/");
+    let mut exclusions = validate_exclusion_paths(
+        &root,
+        vec![BackupExclusion {
+            path: relative,
+            kind,
+        }],
+    )
+    .await?;
+    Ok(exclusions.remove(0))
+}
+
+async fn validate_exclusion_ancestors(
+    root: &Path,
+    exclusions: &[BackupExclusion],
+) -> crate::Result<()> {
+    ensure_canonical_exclusions(exclusions)?;
+    for exclusion in exclusions {
+        let components: Vec<_> = exclusion.path.split('/').collect();
+        let mut current = root.to_path_buf();
+        for component in components.iter().take(components.len() - 1) {
+            current.push(component);
+            match tokio::fs::symlink_metadata(&current).await {
+                Ok(metadata) if io::is_symlink_or_reparse(&metadata) => {
+                    return Err(crate::ErrorKind::InputError(format!(
+                        "Backup exclusion has a linked parent: {}",
+                        exclusion.path
+                    ))
+                    .into());
+                }
+                Ok(metadata) if !metadata.is_dir() => {
+                    return Err(crate::ErrorKind::InputError(format!(
+                        "Backup exclusion parent is not a directory: {}",
+                        exclusion.path
+                    ))
+                    .into());
+                }
+                Ok(_) => {}
+                Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                    break;
+                }
+                Err(error) => return Err(error.into()),
+            }
+        }
+    }
+    Ok(())
+}
+
+fn join_relative(root: &Path, relative: &str) -> PathBuf {
+    relative
+        .split('/')
+        .fold(root.to_path_buf(), |path, part| path.join(part))
+}
+
+pub async fn repository_status() -> crate::Result<BackupRepositoryStatus> {
+    let state = State::get().await?;
+    let path = repository_path(&state).await?;
+    let path_string = path.to_string_lossy().to_string();
+    let repository = match open_repository(&state, false).await {
+        Ok(repository) => repository,
+        Err(error) => {
+            return Ok(BackupRepositoryStatus {
+                path: path_string,
+                initialized: path.join(DATABASE_FILE).try_exists()?,
+                available: false,
+                stored_size: 0,
+                logical_size: 0,
+                snapshot_count: 0,
+                error: Some(error.to_string()),
+            });
+        }
+    };
+    let Some((_, pool)) = repository else {
+        return Ok(BackupRepositoryStatus {
+            path: path_string,
+            initialized: false,
+            available: true,
+            stored_size: 0,
+            logical_size: 0,
+            snapshot_count: 0,
+            error: None,
+        });
+    };
+    let snapshot_count: i64 =
+        sqlx::query_scalar("SELECT COUNT(*) FROM backup_snapshots")
+            .fetch_one(&pool)
+            .await?;
+    let logical_size: i64 = sqlx::query_scalar(
+        "SELECT COALESCE(SUM(logical_size), 0) FROM backup_snapshots",
+    )
+    .fetch_one(&pool)
+    .await?;
+    let stored_size: i64 = sqlx::query_scalar(
+        "SELECT COALESCE(SUM(size), 0) FROM backup_objects WHERE ref_count > 0",
+    )
+    .fetch_one(&pool)
+    .await?;
+    pool.close().await;
+    Ok(BackupRepositoryStatus {
+        path: path_string,
+        initialized: true,
+        available: true,
+        stored_size: stored_size.max(0) as u64,
+        logical_size: logical_size.max(0) as u64,
+        snapshot_count: snapshot_count.max(0) as u64,
+        error: None,
+    })
+}
+
+pub async fn instance_config(
+    instance_id: &str,
+) -> crate::Result<InstanceBackupConfig> {
+    let state = State::get().await?;
+    let eligibility = eligibility_for(instance_id, &state).await?;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Ok(InstanceBackupConfig {
+            instance_id: instance_id.to_string(),
+            enabled: false,
+            eligibility,
+            excluded_paths: Vec::new(),
+            snapshot_count: 0,
+        });
+    };
+    let enabled: bool = sqlx::query_scalar(
+        "SELECT EXISTS(SELECT 1 FROM instance_backup_configs WHERE instance_id = ?)",
+    )
+    .bind(instance_id)
+    .fetch_one(&pool)
+    .await?;
+    let excluded_paths = if enabled {
+        let rows: Vec<(String, String)> = sqlx::query_as(
+			"SELECT path, kind FROM backup_exclusions WHERE instance_id = ? ORDER BY path",
+		)
+		.bind(instance_id)
+		.fetch_all(&pool)
+		.await?;
+        rows.into_iter()
+            .map(|(path, kind)| {
+                Ok(BackupExclusion {
+                    path,
+                    kind: parse_exclusion_kind(&kind)?,
+                })
+            })
+            .collect::<crate::Result<Vec<_>>>()?
+    } else {
+        Vec::new()
+    };
+    let snapshot_count: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM backup_snapshots WHERE instance_id = ?",
+    )
+    .bind(instance_id)
+    .fetch_one(&pool)
+    .await?;
+    pool.close().await;
+    Ok(InstanceBackupConfig {
+        instance_id: instance_id.to_string(),
+        enabled,
+        eligibility,
+        excluded_paths,
+        snapshot_count: snapshot_count.max(0) as u64,
+    })
+}
+
+fn parse_exclusion_kind(value: &str) -> crate::Result<BackupExclusionKind> {
+    match value {
+        "file" => Ok(BackupExclusionKind::File),
+        "directory" => Ok(BackupExclusionKind::Directory),
+        _ => Err(crate::ErrorKind::FSError(format!(
+            "Unknown backup exclusion kind: {value}"
+        ))
+        .into()),
+    }
+}
+
+pub async fn enable(
+    instance_id: &str,
+    excluded_paths: Vec<BackupExclusion>,
+) -> crate::Result<InstanceBackupConfig> {
+    let state = State::get().await?;
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let root = require_eligible(instance_id, &state).await?;
+    let excluded_paths =
+        validate_exclusion_paths(&root, excluded_paths).await?;
+    let (instance, _) = instance_and_root(instance_id, &state).await?;
+    let (_, pool) = open_repository(&state, true).await?.ok_or_else(|| {
+        crate::ErrorKind::OtherError(
+            "Backup repository could not be initialized".to_string(),
+        )
+    })?;
+    let now = Utc::now().timestamp_millis();
+    let mut tx = pool.begin().await?;
+    sqlx::query(
+        "INSERT INTO instance_backup_configs
+         (instance_id, instance_name, created_at, modified_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT(instance_id) DO UPDATE SET
+            instance_name = excluded.instance_name,
+            modified_at = excluded.modified_at",
+    )
+    .bind(instance_id)
+    .bind(&instance.name)
+    .bind(now)
+    .bind(now)
+    .execute(&mut *tx)
+    .await?;
+    sqlx::query("DELETE FROM backup_exclusions WHERE instance_id = ?")
+        .bind(instance_id)
+        .execute(&mut *tx)
+        .await?;
+    for exclusion in &excluded_paths {
+        sqlx::query(
+			"INSERT INTO backup_exclusions (instance_id, path, kind) VALUES (?, ?, ?)",
+		)
+		.bind(instance_id)
+		.bind(&exclusion.path)
+		.bind(exclusion.kind.as_str())
+		.execute(&mut *tx)
+		.await?;
+    }
+    tx.commit().await?;
+    pool.close().await;
+    drop(_repository_guard);
+    instance_config(instance_id).await
+}
+
+pub async fn update_exclusions(
+    instance_id: &str,
+    excluded_paths: Vec<BackupExclusion>,
+) -> crate::Result<InstanceBackupConfig> {
+    let state = State::get().await?;
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let root = require_eligible(instance_id, &state).await?;
+    let excluded_paths =
+        validate_exclusion_paths(&root, excluded_paths).await?;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Err(crate::ErrorKind::InputError(
+            "Backups are not enabled for this instance".to_string(),
+        )
+        .into());
+    };
+    let mut tx = pool.begin().await?;
+    let updated = sqlx::query(
+        "UPDATE instance_backup_configs SET modified_at = ? WHERE instance_id = ?",
+    )
+    .bind(Utc::now().timestamp_millis())
+    .bind(instance_id)
+    .execute(&mut *tx)
+    .await?;
+    if updated.rows_affected() == 0 {
+        return Err(crate::ErrorKind::InputError(
+            "Backups are not enabled for this instance".to_string(),
+        )
+        .into());
+    }
+    sqlx::query("DELETE FROM backup_exclusions WHERE instance_id = ?")
+        .bind(instance_id)
+        .execute(&mut *tx)
+        .await?;
+    for exclusion in &excluded_paths {
+        sqlx::query(
+			"INSERT INTO backup_exclusions (instance_id, path, kind) VALUES (?, ?, ?)",
+		)
+		.bind(instance_id)
+		.bind(&exclusion.path)
+		.bind(exclusion.kind.as_str())
+		.execute(&mut *tx)
+		.await?;
+    }
+    tx.commit().await?;
+    pool.close().await;
+    drop(_repository_guard);
+    instance_config(instance_id).await
+}
+
+pub async fn disable(instance_id: &str) -> crate::Result<()> {
+    let state = State::get().await?;
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Ok(());
+    };
+    let count: i64 = sqlx::query_scalar(
+        "SELECT COUNT(*) FROM backup_snapshots WHERE instance_id = ?",
+    )
+    .bind(instance_id)
+    .fetch_one(&pool)
+    .await?;
+    if count > 0 {
+        return Err(crate::ErrorKind::InputError(
+            "Delete every snapshot before disabling backups".to_string(),
+        )
+        .into());
+    }
+    sqlx::query("DELETE FROM instance_backup_configs WHERE instance_id = ?")
+        .bind(instance_id)
+        .execute(&pool)
+        .await?;
+    pool.close().await;
+    Ok(())
+}
+
+pub async fn list_snapshots(
+    instance_id: &str,
+) -> crate::Result<Vec<BackupSnapshot>> {
+    let state = State::get().await?;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Ok(Vec::new());
+    };
+    let rows = sqlx::query(
+        "SELECT id, instance_id, instance_name, created_at, file_count,
+                symlink_count, logical_size, added_size
+         FROM backup_snapshots WHERE instance_id = ?
+         ORDER BY created_at DESC, id DESC",
+    )
+    .bind(instance_id)
+    .fetch_all(&pool)
+    .await?;
+    pool.close().await;
+    Ok(rows.into_iter().map(snapshot_from_row).collect())
+}
+
+fn snapshot_from_row(row: sqlx::sqlite::SqliteRow) -> BackupSnapshot {
+    BackupSnapshot {
+        id: row.get("id"),
+        instance_id: row.get("instance_id"),
+        instance_name: row.get("instance_name"),
+        created_at: row.get("created_at"),
+        file_count: row.get::<i64, _>("file_count").max(0) as u64,
+        symlink_count: row.get::<i64, _>("symlink_count").max(0) as u64,
+        logical_size: row.get::<i64, _>("logical_size").max(0) as u64,
+        added_size: row.get::<i64, _>("added_size").max(0) as u64,
+    }
+}
+
+async fn emit_backup_progress(
+    operation_id: Uuid,
+    instance_id: Option<&str>,
+    operation_type: InstanceBackupOperationType,
+    stage: InstanceBackupProgressStage,
+    processed_bytes: u64,
+    total_bytes: u64,
+    final_state: Option<InstanceBackupOperationFinalState>,
+    snapshot_id: Option<&str>,
+    message: Option<String>,
+) {
+    let persisted_state = match &stage {
+        InstanceBackupProgressStage::Scanning => {
+            Some(BackupOperationState::Scanning)
+        }
+        InstanceBackupProgressStage::Hashing => {
+            Some(BackupOperationState::Hashing)
+        }
+        InstanceBackupProgressStage::Saving => {
+            Some(BackupOperationState::Saving)
+        }
+        InstanceBackupProgressStage::Validating => {
+            Some(BackupOperationState::Validating)
+        }
+        InstanceBackupProgressStage::Copying
+        | InstanceBackupProgressStage::Restoring => {
+            Some(BackupOperationState::Materializing)
+        }
+        InstanceBackupProgressStage::Completed => {
+            Some(BackupOperationState::Completed)
+        }
+        InstanceBackupProgressStage::Cancelled => {
+            Some(BackupOperationState::Cancelled)
+        }
+        InstanceBackupProgressStage::Failed => {
+            Some(BackupOperationState::Failed)
+        }
+        InstanceBackupProgressStage::Deleting => None,
+    };
+    if let Some(state) = persisted_state {
+        update_persisted_operation(
+            operation_id,
+            state,
+            Some(processed_bytes),
+            Some(total_bytes),
+            None,
+            message.as_deref(),
+            snapshot_id,
+        )
+        .await;
+    }
+    let _ = crate::event::emit::emit_instance_backup_progress(
+        InstanceBackupProgressPayload {
+            operation_id,
+            instance_id: instance_id.map(str::to_string),
+            operation_type,
+            stage,
+            processed_bytes,
+            total_bytes,
+            final_state,
+            snapshot_id: snapshot_id.map(str::to_string),
+            message,
+        },
+    )
+    .await;
+}
+
+fn register_backup_operation(
+    operation_id: Uuid,
+    instance_id: &str,
+) -> (CancellationToken, Arc<AtomicBool>) {
+    let cancellation = CancellationToken::new();
+    let cancellable = Arc::new(AtomicBool::new(true));
+    BACKUP_CANCELLATIONS.insert(
+        operation_id,
+        BackupCancellation {
+            token: cancellation.clone(),
+            cancellable: Arc::clone(&cancellable),
+        },
+    );
+    tracing::debug!(%operation_id, instance_id, "Registered instance backup operation");
+    (cancellation, cancellable)
+}
+
+fn unregister_backup_operation(instance_id: &str, operation_id: Uuid) {
+    BACKUP_CANCELLATIONS.remove(&operation_id);
+    let should_remove = ACTIVE_INSTANCE_OPERATIONS
+        .get(instance_id)
+        .is_some_and(|active| *active == operation_id);
+    if should_remove {
+        ACTIVE_INSTANCE_OPERATIONS.remove(instance_id);
+    }
+}
+
+pub(crate) fn has_active_instance_operation(instance_id: &str) -> bool {
+    ACTIVE_INSTANCE_OPERATIONS.contains_key(instance_id)
+}
+
+pub async fn start_snapshot(instance_id: String) -> crate::Result<Uuid> {
+    let operation_id = Uuid::new_v4();
+    create_persisted_operation(
+        operation_id,
+        &instance_id,
+        BackupOperationType::Create,
+        None,
+    )
+    .await?;
+    let (cancellation, cancellable) =
+        register_backup_operation(operation_id, &instance_id);
+    tokio::spawn(async move {
+        let result = create_snapshot(
+            &instance_id,
+            operation_id,
+            cancellation.clone(),
+            Arc::clone(&cancellable),
+        )
+        .await;
+        let (stage, final_state, snapshot_id, total_bytes, message) =
+            match result {
+                Ok(snapshot) => (
+                    InstanceBackupProgressStage::Completed,
+                    InstanceBackupOperationFinalState::Completed,
+                    Some(snapshot.id),
+                    snapshot.logical_size,
+                    None,
+                ),
+                Err(error) if cancellation.is_cancelled() => (
+                    InstanceBackupProgressStage::Cancelled,
+                    InstanceBackupOperationFinalState::Cancelled,
+                    None,
+                    0,
+                    Some(error.to_string()),
+                ),
+                Err(error) => (
+                    InstanceBackupProgressStage::Failed,
+                    InstanceBackupOperationFinalState::Failed,
+                    None,
+                    0,
+                    Some(error.to_string()),
+                ),
+            };
+        let operation_state = match final_state {
+            InstanceBackupOperationFinalState::Completed => {
+                BackupOperationState::Completed
+            }
+            InstanceBackupOperationFinalState::Cancelled => {
+                BackupOperationState::Cancelled
+            }
+            InstanceBackupOperationFinalState::Failed => {
+                BackupOperationState::Failed
+            }
+        };
+        update_persisted_operation(
+            operation_id,
+            operation_state,
+            Some(total_bytes),
+            Some(total_bytes),
+            Some(false),
+            message.as_deref(),
+            snapshot_id.as_deref(),
+        )
+        .await;
+        let _ = crate::event::emit::emit_instance_backup_progress(
+            InstanceBackupProgressPayload {
+                operation_id,
+                instance_id: Some(instance_id.clone()),
+                operation_type: InstanceBackupOperationType::Create,
+                stage,
+                processed_bytes: total_bytes,
+                total_bytes,
+                final_state: Some(final_state),
+                snapshot_id,
+                message,
+            },
+        )
+        .await;
+        unregister_backup_operation(&instance_id, operation_id);
+    });
+    Ok(operation_id)
+}
+
+pub async fn cancel_backup(operation_id: Uuid) -> crate::Result<bool> {
+    let Some(operation) = BACKUP_CANCELLATIONS.get(&operation_id) else {
+        return Ok(false);
+    };
+    if operation
+        .cancellable
+        .compare_exchange(true, false, Ordering::AcqRel, Ordering::Acquire)
+        .is_err()
+    {
+        return Ok(false);
+    }
+    let token = operation.token.clone();
+    drop(operation);
+    token.cancel();
+    if State::initialized() {
+        update_cancel_requested(operation_id).await?;
+    }
+    Ok(true)
+}
+
+async fn update_cancel_requested(operation_id: Uuid) -> crate::Result<()> {
+    let state = State::get().await?;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Err(crate::ErrorKind::FSError(
+            "Unable to open backup repository".to_string(),
+        )
+        .into());
+    };
+    sqlx::query(
+		"UPDATE backup_operations SET cancel_requested = 1, updated_at = ? WHERE id = ?",
+	)
+	.bind(Utc::now().timestamp_millis())
+	.bind(operation_id.to_string())
+	.execute(&pool)
+	.await?;
+    pool.close().await;
+    Ok(())
+}
+
+pub async fn create_snapshot(
+    instance_id: &str,
+    operation_id: Uuid,
+    cancellation: CancellationToken,
+    cancellable: Arc<AtomicBool>,
+) -> crate::Result<BackupSnapshot> {
+    let result = create_snapshot_inner(
+        instance_id,
+        operation_id,
+        &cancellation,
+        &cancellable,
+    )
+    .await;
+    result
+}
+
+async fn create_snapshot_inner(
+    instance_id: &str,
+    operation_id: Uuid,
+    cancellation: &CancellationToken,
+    cancellable: &AtomicBool,
+) -> crate::Result<BackupSnapshot> {
+    let state = State::get().await?;
+    let _maintenance_guard = lock_instance_maintenance(instance_id).await;
+    let _instance_guard =
+        state.lock_instance_content_exclusive(instance_id).await;
+    if state.process_manager.has_instance_process(instance_id) {
+        return Err(crate::ErrorKind::InputError(
+            "Close the instance before creating a backup".to_string(),
+        )
+        .into());
+    }
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let root = require_eligible(instance_id, &state).await?;
+    let (instance, _) = instance_and_root(instance_id, &state).await?;
+    let Some((repository, pool)) = open_repository(&state, false).await? else {
+        return Err(crate::ErrorKind::InputError(
+            "Backups are not enabled for this instance".to_string(),
+        )
+        .into());
+    };
+    let enabled: bool = sqlx::query_scalar(
+		"SELECT EXISTS(SELECT 1 FROM instance_backup_configs WHERE instance_id = ?)",
+	)
+	.bind(instance_id)
+	.fetch_one(&pool)
+	.await?;
+    if !enabled {
+        return Err(crate::ErrorKind::InputError(
+            "Backups are not enabled for this instance".to_string(),
+        )
+        .into());
+    }
+    let exclusion_rows: Vec<(String, String)> = sqlx::query_as(
+		"SELECT path, kind FROM backup_exclusions WHERE instance_id = ? ORDER BY path",
+	)
+	.bind(instance_id)
+	.fetch_all(&pool)
+	.await?;
+    let exclusions = exclusion_rows
+        .into_iter()
+        .map(|(path, kind)| {
+            Ok(BackupExclusion {
+                path,
+                kind: parse_exclusion_kind(&kind)?,
+            })
+        })
+        .collect::<crate::Result<Vec<_>>>()?;
+    validate_exclusion_ancestors(&root, &exclusions).await?;
+    let staging = repository.join(STAGING_DIR).join(operation_id.to_string());
+    io::create_dir_all(&staging).await?;
+    let mut created_objects = HashSet::new();
+    let mut scan_result = scan_snapshot_attempt(
+        &root,
+        &repository,
+        &staging,
+        &exclusions,
+        operation_id,
+        instance_id,
+        cancellation,
+        &mut created_objects,
+    )
+    .await;
+    if scan_result.is_err() && !cancellation.is_cancelled() {
+        cleanup_uncommitted_objects(&repository, &pool, &created_objects).await;
+        created_objects.clear();
+        let _ = io::remove_dir_all(&staging).await;
+        io::create_dir_all(&staging).await?;
+        scan_result = scan_snapshot_attempt(
+            &root,
+            &repository,
+            &staging,
+            &exclusions,
+            operation_id,
+            instance_id,
+            cancellation,
+            &mut created_objects,
+        )
+        .await;
+    }
+    let (entries, added_size) = match scan_result {
+        Ok(result) => result,
+        Err(error) => {
+            cleanup_uncommitted_objects(&repository, &pool, &created_objects)
+                .await;
+            let _ = io::remove_dir_all(&staging).await;
+            pool.close().await;
+            return Err(error);
+        }
+    };
+    if cancellation.is_cancelled() {
+        cleanup_uncommitted_objects(&repository, &pool, &created_objects).await;
+        let _ = io::remove_dir_all(&staging).await;
+        pool.close().await;
+        return Err(crate::ErrorKind::OtherError(
+            "Backup was canceled".to_string(),
+        )
+        .into());
+    }
+
+    let snapshot_id = Uuid::new_v4().to_string();
+    let created_at = Utc::now().timestamp_millis();
+    let file_count = entries
+        .iter()
+        .filter(|entry| entry.kind == EntryKind::File)
+        .count() as u64;
+    let symlink_count = entries
+        .iter()
+        .filter(|entry| entry.kind == EntryKind::Symlink)
+        .count() as u64;
+    let logical_size = entries.iter().map(|entry| entry.size).sum::<u64>();
+    if !cancellable.swap(false, Ordering::AcqRel) {
+        cleanup_uncommitted_objects(&repository, &pool, &created_objects).await;
+        let _ = io::remove_dir_all(&staging).await;
+        pool.close().await;
+        return Err(crate::ErrorKind::OtherError(
+            "Backup was canceled".to_string(),
+        )
+        .into());
+    }
+    emit_backup_progress(
+        operation_id,
+        Some(instance_id),
+        InstanceBackupOperationType::Create,
+        InstanceBackupProgressStage::Saving,
+        logical_size,
+        logical_size,
+        None,
+        None,
+        None,
+    )
+    .await;
+    let persist_result: crate::Result<()> = async {
+        let mut tx = pool.begin().await?;
+        sqlx::query(
+            "INSERT INTO backup_snapshots
+		 (id, instance_id, instance_name, created_at, file_count,
+		  symlink_count, logical_size, added_size, scope_mode)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'excluded_paths')",
+        )
+        .bind(&snapshot_id)
+        .bind(instance_id)
+        .bind(&instance.name)
+        .bind(created_at)
+        .bind(file_count as i64)
+        .bind(symlink_count as i64)
+        .bind(logical_size as i64)
+        .bind(added_size as i64)
+        .execute(&mut *tx)
+        .await?;
+        for exclusion in &exclusions {
+            sqlx::query(
+                "INSERT INTO snapshot_exclusions (snapshot_id, path, kind)
+			 VALUES (?, ?, ?)",
+            )
+            .bind(&snapshot_id)
+            .bind(&exclusion.path)
+            .bind(exclusion.kind.as_str())
+            .execute(&mut *tx)
+            .await?;
+        }
+        for entry in &entries {
+            if let Some(hash) = &entry.object_hash {
+                sqlx::query(
+                    "INSERT INTO backup_objects (hash, size, ref_count)
+                 VALUES (?, ?, 1)
+                 ON CONFLICT(hash) DO UPDATE SET ref_count = ref_count + 1",
+                )
+                .bind(hash)
+                .bind(entry.size as i64)
+                .execute(&mut *tx)
+                .await?;
+            }
+            sqlx::query(
+                "INSERT INTO snapshot_entries
+             (snapshot_id, path, kind, object_hash, size, modified_at,
+              unix_mode, link_target, link_is_directory)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
+            )
+            .bind(&snapshot_id)
+            .bind(&entry.path)
+            .bind(entry.kind.as_str())
+            .bind(entry.object_hash.as_deref())
+            .bind(entry.size as i64)
+            .bind(entry.modified_at)
+            .bind(entry.unix_mode.map(i64::from))
+            .bind(entry.link_target.as_deref())
+            .bind(entry.link_is_directory)
+            .execute(&mut *tx)
+            .await?;
+        }
+        tx.commit().await?;
+        Ok(())
+    }
+    .await;
+    if let Err(error) = persist_result {
+        cleanup_uncommitted_objects(&repository, &pool, &created_objects).await;
+        let _ = io::remove_dir_all(&staging).await;
+        pool.close().await;
+        return Err(error);
+    }
+    let _ = io::remove_dir_all(&staging).await;
+    pool.close().await;
+    Ok(BackupSnapshot {
+        id: snapshot_id,
+        instance_id: instance_id.to_string(),
+        instance_name: instance.name,
+        created_at,
+        file_count,
+        symlink_count,
+        logical_size,
+        added_size,
+    })
+}
+
+async fn scan_snapshot_attempt(
+    root: &Path,
+    repository: &Path,
+    staging: &Path,
+    exclusions: &[BackupExclusion],
+    operation_id: Uuid,
+    instance_id: &str,
+    cancellation: &CancellationToken,
+    created_objects: &mut HashSet<String>,
+) -> crate::Result<(Vec<PendingEntry>, u64)> {
+    emit_backup_progress(
+        operation_id,
+        Some(instance_id),
+        InstanceBackupOperationType::Create,
+        InstanceBackupProgressStage::Scanning,
+        0,
+        0,
+        None,
+        None,
+        None,
+    )
+    .await;
+    let total_bytes = measure_snapshot(root, exclusions, cancellation).await?;
+    emit_backup_progress(
+        operation_id,
+        Some(instance_id),
+        InstanceBackupOperationType::Create,
+        InstanceBackupProgressStage::Hashing,
+        0,
+        total_bytes,
+        None,
+        None,
+        None,
+    )
+    .await;
+    scan_snapshot(
+        root,
+        repository,
+        staging,
+        exclusions,
+        operation_id,
+        instance_id,
+        total_bytes,
+        cancellation,
+        created_objects,
+    )
+    .await
+}
+
+async fn measure_snapshot(
+    root: &Path,
+    exclusions: &[BackupExclusion],
+    cancellation: &CancellationToken,
+) -> crate::Result<u64> {
+    let mut total_bytes = 0u64;
+    let mut pending = vec![(root.to_path_buf(), String::new())];
+    while let Some((directory, relative_directory)) = pending.pop() {
+        let mut read_dir = tokio::fs::read_dir(&directory).await?;
+        while let Some(child) = read_dir.next_entry().await? {
+            if cancellation.is_cancelled() {
+                return Err(crate::ErrorKind::OtherError(
+                    "Backup was canceled".to_string(),
+                )
+                .into());
+            }
+            let Some(name) = child.file_name().to_str().map(str::to_string)
+            else {
+                return Err(crate::ErrorKind::UTFError(child.path()).into());
+            };
+            let relative = if relative_directory.is_empty() {
+                name
+            } else {
+                format!("{relative_directory}/{name}")
+            };
+            if is_excluded(&relative, exclusions) {
+                continue;
+            }
+            let path = child.path();
+            let metadata = tokio::fs::symlink_metadata(&path).await?;
+            if io::is_symlink_or_reparse(&metadata) {
+                continue;
+            }
+            if metadata.is_dir() {
+                pending.push((path, relative));
+            } else if metadata.is_file() {
+                total_bytes = total_bytes.saturating_add(metadata.len());
+            }
+        }
+    }
+    Ok(total_bytes)
+}
+
+async fn scan_snapshot(
+    root: &Path,
+    repository: &Path,
+    staging: &Path,
+    exclusions: &[BackupExclusion],
+    operation_id: Uuid,
+    instance_id: &str,
+    total_bytes: u64,
+    cancellation: &CancellationToken,
+    created_objects: &mut HashSet<String>,
+) -> crate::Result<(Vec<PendingEntry>, u64)> {
+    let mut entries = Vec::new();
+    let mut scanned_directories = Vec::new();
+    let mut added_size = 0u64;
+    let mut processed_bytes = 0u64;
+    let mut pending = Vec::new();
+    let mut root_names = Vec::new();
+    let mut read_root = tokio::fs::read_dir(root).await?;
+    while let Some(child) = read_root.next_entry().await? {
+        let Some(name) = child.file_name().to_str().map(str::to_string) else {
+            return Err(crate::ErrorKind::UTFError(child.path()).into());
+        };
+        root_names.push(name.clone());
+        let child_path = child.path();
+        let child_metadata = tokio::fs::symlink_metadata(&child_path).await?;
+        pending.push((child_path, name, child_metadata));
+    }
+    root_names.sort();
+    scanned_directories.push((root.to_path_buf(), root_names));
+    while let Some((absolute, relative, metadata)) = pending.pop() {
+        if cancellation.is_cancelled() {
+            return Err(crate::ErrorKind::OtherError(
+                "Backup was canceled".to_string(),
+            )
+            .into());
+        }
+        if is_excluded(&relative, exclusions) {
+            continue;
+        }
+        if io::is_symlink_or_reparse(&metadata) {
+            let target = tokio::fs::read_link(&absolute).await?;
+            let target = target
+                .to_str()
+                .ok_or_else(|| crate::ErrorKind::UTFError(absolute.clone()))?;
+            entries.push(PendingEntry {
+                path: relative,
+                kind: EntryKind::Symlink,
+                object_hash: None,
+                size: 0,
+                modified_at: modified_millis(&metadata),
+                unix_mode: unix_mode(&metadata),
+                link_target: Some(target.to_string()),
+                link_is_directory: Some(
+                    tokio::fs::metadata(&absolute)
+                        .await
+                        .is_ok_and(|metadata| metadata.is_dir()),
+                ),
+            });
+            continue;
+        }
+        if metadata.is_dir() {
+            entries.push(PendingEntry {
+                path: relative.clone(),
+                kind: EntryKind::Directory,
+                object_hash: None,
+                size: 0,
+                modified_at: modified_millis(&metadata),
+                unix_mode: unix_mode(&metadata),
+                link_target: None,
+                link_is_directory: None,
+            });
+            let mut read_dir = tokio::fs::read_dir(&absolute).await?;
+            let mut child_names = Vec::new();
+            while let Some(child) = read_dir.next_entry().await? {
+                let Some(name) = child.file_name().to_str().map(str::to_string)
+                else {
+                    return Err(crate::ErrorKind::UTFError(child.path()).into());
+                };
+                let child_relative = format!("{relative}/{name}");
+                child_names.push(name);
+                let child_path = child.path();
+                let child_metadata =
+                    tokio::fs::symlink_metadata(&child_path).await?;
+                pending.push((child_path, child_relative, child_metadata));
+            }
+            child_names.sort();
+            scanned_directories.push((absolute, child_names));
+            continue;
+        }
+        if !metadata.is_file() {
+            return Err(crate::ErrorKind::FSError(format!(
+                "Unsupported backup entry: {}",
+                absolute.display()
+            ))
+            .into());
+        }
+        let (hash, size, added) = hash_and_store_object(
+            &absolute,
+            &metadata,
+            repository,
+            staging,
+            cancellation,
+        )
+        .await?;
+        if added {
+            created_objects.insert(hash.clone());
+            added_size = added_size.saturating_add(size);
+        }
+        processed_bytes = processed_bytes.saturating_add(size);
+        emit_backup_progress(
+            operation_id,
+            Some(instance_id),
+            InstanceBackupOperationType::Create,
+            InstanceBackupProgressStage::Hashing,
+            processed_bytes,
+            total_bytes,
+            None,
+            None,
+            None,
+        )
+        .await;
+        entries.push(PendingEntry {
+            path: relative,
+            kind: EntryKind::File,
+            object_hash: Some(hash),
+            size,
+            modified_at: modified_millis(&metadata),
+            unix_mode: unix_mode(&metadata),
+            link_target: None,
+            link_is_directory: None,
+        });
+    }
+    for (directory, expected_names) in scanned_directories {
+        let mut actual_names = Vec::new();
+        let mut read_dir = tokio::fs::read_dir(&directory).await?;
+        while let Some(child) = read_dir.next_entry().await? {
+            let Some(name) = child.file_name().to_str().map(str::to_string)
+            else {
+                return Err(crate::ErrorKind::UTFError(child.path()).into());
+            };
+            actual_names.push(name);
+        }
+        actual_names.sort();
+        if actual_names != expected_names {
+            return Err(crate::ErrorKind::FSError(format!(
+                "Directory changed while it was being backed up: {}",
+                directory.display()
+            ))
+            .into());
+        }
+    }
+    entries.sort_by(|left, right| left.path.cmp(&right.path));
+    Ok((entries, added_size))
+}
+
+fn is_excluded(relative: &str, exclusions: &[BackupExclusion]) -> bool {
+    exclusions.iter().any(|exclusion| {
+        relative == exclusion.path
+            || (exclusion.kind == BackupExclusionKind::Directory
+                && relative.starts_with(&format!("{}/", exclusion.path)))
+    })
+}
+
+async fn hash_and_store_object(
+    source: &Path,
+    before: &std::fs::Metadata,
+    repository: &Path,
+    staging: &Path,
+    cancellation: &CancellationToken,
+) -> crate::Result<(String, u64, bool)> {
+    let temp = staging.join(Uuid::new_v4().to_string());
+    let mut input = tokio::fs::File::open(source).await?;
+    let mut output = tokio::fs::File::create(&temp).await?;
+    let mut hasher = Sha256::new();
+    let mut size = 0u64;
+    let mut buffer = vec![0u8; 1024 * 1024];
+    loop {
+        if cancellation.is_cancelled() {
+            let _ = tokio::fs::remove_file(&temp).await;
+            return Err(crate::ErrorKind::OtherError(
+                "Backup was canceled".to_string(),
+            )
+            .into());
+        }
+        let read = input.read(&mut buffer).await?;
+        if read == 0 {
+            break;
+        }
+        hasher.update(&buffer[..read]);
+        tokio::io::AsyncWriteExt::write_all(&mut output, &buffer[..read])
+            .await?;
+        size = size.saturating_add(read as u64);
+    }
+    tokio::io::AsyncWriteExt::flush(&mut output).await?;
+    drop(output);
+    let after = tokio::fs::metadata(source).await?;
+    if before.len() != after.len()
+        || before.modified().ok() != after.modified().ok()
+    {
+        let _ = tokio::fs::remove_file(&temp).await;
+        return Err(crate::ErrorKind::FSError(format!(
+            "File changed while it was being backed up: {}",
+            source.display()
+        ))
+        .into());
+    }
+    let hash = hasher
+        .finalize()
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect::<String>();
+    let object = object_path(repository, &hash);
+    if object.try_exists()? {
+        let existing_size = tokio::fs::metadata(&object).await?.len();
+        let _ = tokio::fs::remove_file(&temp).await;
+        if existing_size != size {
+            return Err(crate::ErrorKind::FSError(format!(
+                "Backup object size mismatch for {hash}"
+            ))
+            .into());
+        }
+        return Ok((hash, size, false));
+    }
+    if let Some(parent) = object.parent() {
+        io::create_dir_all(parent).await?;
+    }
+    tokio::fs::rename(&temp, &object).await?;
+    Ok((hash, size, true))
+}
+
+fn object_path(repository: &Path, hash: &str) -> PathBuf {
+    repository
+        .join(OBJECTS_DIR)
+        .join(&hash[..2])
+        .join(&hash[2..])
+}
+
+fn modified_millis(metadata: &std::fs::Metadata) -> Option<i64> {
+    metadata.modified().ok().and_then(|modified| {
+        modified
+            .duration_since(UNIX_EPOCH)
+            .ok()
+            .and_then(|duration| i64::try_from(duration.as_millis()).ok())
+    })
+}
+
+#[cfg(unix)]
+fn unix_mode(metadata: &std::fs::Metadata) -> Option<u32> {
+    use std::os::unix::fs::PermissionsExt;
+    Some(metadata.permissions().mode())
+}
+
+#[cfg(not(unix))]
+fn unix_mode(_metadata: &std::fs::Metadata) -> Option<u32> {
+    None
+}
+
+async fn cleanup_uncommitted_objects(
+    repository: &Path,
+    pool: &SqlitePool,
+    hashes: &HashSet<String>,
+) {
+    for hash in hashes {
+        let referenced: Result<bool, _> = sqlx::query_scalar(
+            "SELECT EXISTS(SELECT 1 FROM backup_objects WHERE hash = ?)",
+        )
+        .bind(hash)
+        .fetch_one(pool)
+        .await;
+        if matches!(referenced, Ok(false)) {
+            let _ = tokio::fs::remove_file(object_path(repository, hash)).await;
+        }
+    }
+}
+
+async fn snapshot_operation_metadata(
+    snapshot_id: &str,
+) -> crate::Result<(String, u64)> {
+    let state = State::get().await?;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Err(crate::ErrorKind::InputError(
+            "Unknown backup snapshot".to_string(),
+        )
+        .into());
+    };
+    let metadata: (String, i64) = sqlx::query_as(
+        "SELECT instance_id, logical_size FROM backup_snapshots WHERE id = ?",
+    )
+    .bind(snapshot_id)
+    .fetch_optional(&pool)
+    .await?
+    .ok_or_else(|| {
+        crate::ErrorKind::InputError("Unknown backup snapshot".to_string())
+    })?;
+    pool.close().await;
+    Ok((metadata.0, metadata.1.max(0) as u64))
+}
+
+pub async fn delete_snapshot(snapshot_id: &str) -> crate::Result<()> {
+    let operation_id = Uuid::new_v4();
+    emit_backup_progress(
+        operation_id,
+        None,
+        InstanceBackupOperationType::Delete,
+        InstanceBackupProgressStage::Deleting,
+        0,
+        0,
+        None,
+        Some(snapshot_id),
+        None,
+    )
+    .await;
+    let (metadata, result) =
+        match snapshot_operation_metadata(snapshot_id).await {
+            Ok((instance_id, total_bytes)) => {
+                emit_backup_progress(
+                    operation_id,
+                    Some(&instance_id),
+                    InstanceBackupOperationType::Delete,
+                    InstanceBackupProgressStage::Deleting,
+                    0,
+                    total_bytes,
+                    None,
+                    Some(snapshot_id),
+                    None,
+                )
+                .await;
+                let result = delete_snapshot_inner(snapshot_id).await;
+                (Some((instance_id, total_bytes)), result)
+            }
+            Err(error) => (None, Err(error)),
+        };
+    let (instance_id, total_bytes) = metadata
+        .as_ref()
+        .map(|(instance_id, total_bytes)| {
+            (Some(instance_id.as_str()), *total_bytes)
+        })
+        .unwrap_or((None, 0));
+    let (stage, final_state, processed_bytes, message) = match &result {
+        Ok(()) => (
+            InstanceBackupProgressStage::Completed,
+            InstanceBackupOperationFinalState::Completed,
+            total_bytes,
+            None,
+        ),
+        Err(error) => (
+            InstanceBackupProgressStage::Failed,
+            InstanceBackupOperationFinalState::Failed,
+            0,
+            Some(error.to_string()),
+        ),
+    };
+    emit_backup_progress(
+        operation_id,
+        instance_id,
+        InstanceBackupOperationType::Delete,
+        stage,
+        processed_bytes,
+        total_bytes,
+        Some(final_state),
+        Some(snapshot_id),
+        message,
+    )
+    .await;
+    result
+}
+
+async fn delete_snapshot_inner(snapshot_id: &str) -> crate::Result<()> {
+    let state = State::get().await?;
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let Some((repository, pool)) = open_repository(&state, false).await? else {
+        return Err(crate::ErrorKind::InputError(
+            "Unknown backup snapshot".to_string(),
+        )
+        .into());
+    };
+    delete_snapshots_in_pool(&repository, &pool, Some(snapshot_id), None)
+        .await?;
+    pool.close().await;
+    Ok(())
+}
+
+async fn delete_snapshots_in_pool(
+    repository: &Path,
+    pool: &SqlitePool,
+    snapshot_id: Option<&str>,
+    instance_id: Option<&str>,
+) -> crate::Result<()> {
+    let rows = if let Some(snapshot_id) = snapshot_id {
+        sqlx::query(
+            "SELECT object_hash, COUNT(*) AS refs FROM snapshot_entries
+             WHERE snapshot_id = ? AND object_hash IS NOT NULL
+             GROUP BY object_hash",
+        )
+        .bind(snapshot_id)
+        .fetch_all(pool)
+        .await?
+    } else {
+        sqlx::query(
+            "SELECT e.object_hash, COUNT(*) AS refs FROM snapshot_entries e
+             JOIN backup_snapshots s ON s.id = e.snapshot_id
+             WHERE s.instance_id = ? AND e.object_hash IS NOT NULL
+             GROUP BY e.object_hash",
+        )
+        .bind(instance_id)
+        .fetch_all(pool)
+        .await?
+    };
+    let mut tx = pool.begin().await?;
+    let deleted = if let Some(snapshot_id) = snapshot_id {
+        sqlx::query("DELETE FROM backup_snapshots WHERE id = ?")
+            .bind(snapshot_id)
+            .execute(&mut *tx)
+            .await?
+    } else {
+        sqlx::query("DELETE FROM backup_snapshots WHERE instance_id = ?")
+            .bind(instance_id)
+            .execute(&mut *tx)
+            .await?
+    };
+    if snapshot_id.is_some() && deleted.rows_affected() == 0 {
+        return Err(crate::ErrorKind::InputError(
+            "Unknown backup snapshot".to_string(),
+        )
+        .into());
+    }
+    for row in rows {
+        let hash: String = row.get("object_hash");
+        let refs: i64 = row.get("refs");
+        sqlx::query(
+            "UPDATE backup_objects SET ref_count = ref_count - ? WHERE hash = ?",
+        )
+        .bind(refs)
+        .bind(&hash)
+        .execute(&mut *tx)
+        .await?;
+        sqlx::query(
+            "INSERT OR IGNORE INTO object_gc_queue (hash, queued_at)
+             SELECT hash, ? FROM backup_objects WHERE hash = ? AND ref_count = 0",
+        )
+        .bind(Utc::now().timestamp_millis())
+        .bind(&hash)
+        .execute(&mut *tx)
+        .await?;
+    }
+    tx.commit().await?;
+    run_gc(repository, pool).await
+}
+
+async fn run_gc(repository: &Path, pool: &SqlitePool) -> crate::Result<()> {
+    let hashes: Vec<String> = sqlx::query_scalar(
+        "SELECT hash FROM object_gc_queue ORDER BY queued_at",
+    )
+    .fetch_all(pool)
+    .await?;
+    for hash in hashes {
+        match tokio::fs::remove_file(object_path(repository, &hash)).await {
+            Ok(()) => {}
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => {
+                tracing::warn!(%hash, %error, "Failed to remove unreferenced backup object");
+                continue;
+            }
+        }
+        let mut tx = pool.begin().await?;
+        sqlx::query("DELETE FROM object_gc_queue WHERE hash = ?")
+            .bind(&hash)
+            .execute(&mut *tx)
+            .await?;
+        sqlx::query(
+            "DELETE FROM backup_objects WHERE hash = ? AND ref_count = 0",
+        )
+        .bind(&hash)
+        .execute(&mut *tx)
+        .await?;
+        tx.commit().await?;
+    }
+    Ok(())
+}
+
+pub async fn maintain_repository() -> crate::Result<()> {
+    let state = State::get().await?;
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    cleanup_pending_repository_paths(&state).await?;
+    recover_interrupted_restores(&state).await?;
+    let Some((repository, pool)) = open_repository(&state, false).await? else {
+        return Ok(());
+    };
+    let now = Utc::now().timestamp_millis();
+    sqlx::query(
+        "UPDATE backup_operations SET state = 'interrupted', cancellable = 0,
+		 error = COALESCE(error, 'The launcher exited while the operation was running'),
+		 updated_at = ?, finished_at = ?
+		 WHERE state NOT IN ('completed', 'cancelled', 'failed', 'interrupted')",
+    )
+    .bind(now)
+    .bind(now)
+    .execute(&pool)
+    .await?;
+    run_gc(&repository, &pool).await?;
+
+    let pending: Vec<String> = sqlx::query_scalar(
+        "SELECT instance_id FROM pending_instance_deletions ORDER BY marked_at",
+    )
+    .fetch_all(&pool)
+    .await?;
+    for instance_id in pending {
+        if instance_rows::get_instance_by_id(&instance_id, &state.pool)
+            .await?
+            .is_none()
+        {
+            delete_snapshots_in_pool(
+                &repository,
+                &pool,
+                None,
+                Some(&instance_id),
+            )
+            .await?;
+            sqlx::query(
+                "DELETE FROM instance_backup_configs WHERE instance_id = ?",
+            )
+            .bind(&instance_id)
+            .execute(&pool)
+            .await?;
+        }
+        sqlx::query(
+            "DELETE FROM pending_instance_deletions WHERE instance_id = ?",
+        )
+        .bind(&instance_id)
+        .execute(&pool)
+        .await?;
+    }
+
+    let staging = repository.join(STAGING_DIR);
+    let _ = io::remove_dir_all(&staging).await;
+    io::create_dir_all(&staging).await?;
+    sweep_unindexed_objects(&repository, &pool).await?;
+    pool.close().await;
+    Ok(())
+}
+
+async fn cleanup_pending_repository_paths(state: &State) -> crate::Result<()> {
+    let current = repository_path(state).await?;
+    let paths: Vec<String> = sqlx::query_scalar(
+        "SELECT path FROM pending_backup_repository_cleanups ORDER BY created_at",
+    )
+    .fetch_all(&state.pool)
+    .await?;
+    for stored_path in paths {
+        let path = PathBuf::from(&stored_path);
+        if !path.is_absolute() || path == current {
+            tracing::warn!(
+                path = %path.display(),
+                "Ignoring invalid pending backup repository cleanup path"
+            );
+            continue;
+        }
+        if path.try_exists()? {
+            if let Err(error) = io::remove_dir_all(&path).await {
+                tracing::warn!(
+                    path = %path.display(),
+                    %error,
+                    "Failed to retry old backup repository cleanup"
+                );
+                continue;
+            }
+        }
+        sqlx::query(
+            "DELETE FROM pending_backup_repository_cleanups WHERE path = ?",
+        )
+        .bind(&stored_path)
+        .execute(&state.pool)
+        .await?;
+    }
+    Ok(())
+}
+
+async fn recover_interrupted_restores(state: &State) -> crate::Result<()> {
+    let instances = state.directories.instances_dir();
+    let mut entries = match tokio::fs::read_dir(&instances).await {
+        Ok(entries) => entries,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            return Ok(());
+        }
+        Err(error) => return Err(error.into()),
+    };
+    while let Some(entry) = entries.next_entry().await? {
+        let Some(name) = entry.file_name().to_str().map(str::to_string) else {
+            continue;
+        };
+        if !name.starts_with(RESTORE_PREFIX)
+            || !entry.file_type().await?.is_dir()
+        {
+            continue;
+        }
+        let operation_root = entry.path();
+        if tokio::fs::symlink_metadata(operation_root.join(RESTORE_COMMITTED))
+            .await
+            .is_ok()
+        {
+            io::remove_dir_all(&operation_root).await?;
+            continue;
+        }
+        let journal_bytes = match tokio::fs::read(
+            operation_root.join(RESTORE_JOURNAL),
+        )
+        .await
+        {
+            Ok(bytes) => bytes,
+            Err(error) => {
+                tracing::warn!(
+                    path = %operation_root.display(),
+                    %error,
+                    "Cannot recover interrupted backup restore without its journal"
+                );
+                continue;
+            }
+        };
+        let journal: RestoreJournal =
+            match serde_json::from_slice(&journal_bytes) {
+                Ok(journal) => journal,
+                Err(error) => {
+                    tracing::warn!(
+                        path = %operation_root.display(),
+                        %error,
+                        "Cannot parse interrupted backup restore journal"
+                    );
+                    continue;
+                }
+            };
+        let (_, root) = instance_and_root(&journal.instance_id, state).await?;
+        if journal.whole_root {
+            recover_whole_root_restore(
+                &root,
+                &operation_root,
+                &journal.exclusions,
+            )
+            .await?;
+        } else {
+            recover_restore_operation(&root, &operation_root, &journal.roots)
+                .await?;
+        }
+    }
+    Ok(())
+}
+
+async fn recover_whole_root_restore(
+    root: &Path,
+    operation_root: &Path,
+    exclusions: &[BackupExclusion],
+) -> crate::Result<()> {
+    ensure_canonical_exclusions(exclusions)?;
+    let staged = operation_root.join("staged");
+    let rollback_root = operation_root.join("rollback").join("instance");
+    if tokio::fs::symlink_metadata(&rollback_root).await.is_ok() {
+        validate_exclusion_ancestors(&rollback_root, exclusions).await?;
+        for exclusion in exclusions.iter().rev() {
+            let destination = join_relative(&rollback_root, &exclusion.path);
+            let from_current = join_relative(root, &exclusion.path);
+            let from_staged = join_relative(&staged, &exclusion.path);
+            let source = if tokio::fs::symlink_metadata(&from_current)
+                .await
+                .is_ok()
+            {
+                Some(from_current)
+            } else if tokio::fs::symlink_metadata(&from_staged).await.is_ok() {
+                Some(from_staged)
+            } else {
+                None
+            };
+            if let Some(source) = source {
+                remove_path_if_exists(&destination).await;
+                if let Some(parent) = destination.parent() {
+                    io::create_dir_all(parent).await?;
+                }
+                rename_backup_path(&source, &destination).await?;
+            }
+        }
+        remove_path_if_exists(root).await;
+        if let Some(parent) = root.parent() {
+            io::create_dir_all(parent).await?;
+        }
+        rename_backup_path(&rollback_root, root).await?;
+    }
+    io::remove_dir_all(operation_root).await?;
+    Ok(())
+}
+
+async fn recover_restore_operation(
+    root: &Path,
+    operation_root: &Path,
+    roots: &[RestoreJournalRoot],
+) -> crate::Result<()> {
+    let rollback = operation_root.join("rollback");
+    for journal_root in roots.iter().rev() {
+        let normalized = normalize_relative_directory(&journal_root.path)?;
+        if normalized != journal_root.path {
+            return Err(crate::ErrorKind::FSError(
+                "Invalid path in backup restore journal".to_string(),
+            )
+            .into());
+        }
+        let current = join_relative(root, &normalized);
+        let old = join_relative(&rollback, &normalized);
+        if tokio::fs::symlink_metadata(&old).await.is_ok() {
+            remove_path_if_exists(&current).await;
+            if let Some(parent) = current.parent() {
+                io::create_dir_all(parent).await?;
+            }
+            rename_backup_path(&old, &current).await?;
+        } else if !journal_root.had_current {
+            remove_path_if_exists(&current).await;
+        }
+    }
+    io::remove_dir_all(operation_root).await?;
+    Ok(())
+}
+
+async fn remove_path_if_exists(path: &Path) {
+    let _ = io::remove_dir_all(path).await;
+    let _ = tokio::fs::remove_file(path).await;
+}
+
+async fn rename_backup_path(
+    source: &Path,
+    destination: &Path,
+) -> crate::Result<()> {
+    const ATTEMPTS: u32 = 5;
+    for attempt in 0..ATTEMPTS {
+        match tokio::fs::rename(source, destination).await {
+            Ok(()) => return Ok(()),
+            Err(error)
+                if error.kind() == std::io::ErrorKind::PermissionDenied
+                    && attempt + 1 < ATTEMPTS =>
+            {
+                tokio::time::sleep(Duration::from_millis(
+                    40 * u64::from(attempt + 1),
+                ))
+                .await;
+            }
+            Err(error) => {
+                return Err(crate::ErrorKind::FSError(format!(
+                    "Could not move {} to {}: {error}",
+                    source.display(),
+                    destination.display()
+                ))
+                .into());
+            }
+        }
+    }
+    unreachable!()
+}
+
+async fn mark_restore_committed(operation_root: &Path) -> crate::Result<()> {
+    let mut marker =
+        tokio::fs::File::create(operation_root.join(RESTORE_COMMITTED)).await?;
+    marker.write_all(b"committed").await?;
+    marker.sync_all().await?;
+    Ok(())
+}
+
+async fn sweep_unindexed_objects(
+    repository: &Path,
+    pool: &SqlitePool,
+) -> crate::Result<()> {
+    let objects = repository.join(OBJECTS_DIR);
+    let mut prefixes = tokio::fs::read_dir(&objects).await?;
+    while let Some(prefix) = prefixes.next_entry().await? {
+        if !prefix.file_type().await?.is_dir() {
+            continue;
+        }
+        let Some(prefix_name) = prefix.file_name().to_str().map(str::to_string)
+        else {
+            continue;
+        };
+        let mut files = tokio::fs::read_dir(prefix.path()).await?;
+        while let Some(file) = files.next_entry().await? {
+            if !file.file_type().await?.is_file() {
+                continue;
+            }
+            let Some(file_name) = file.file_name().to_str().map(str::to_string)
+            else {
+                continue;
+            };
+            let hash = format!("{prefix_name}{file_name}");
+            if hash.len() != 64
+                || !hash.bytes().all(|byte| byte.is_ascii_hexdigit())
+            {
+                continue;
+            }
+            let indexed: bool = sqlx::query_scalar(
+                "SELECT EXISTS(SELECT 1 FROM backup_objects WHERE hash = ?)",
+            )
+            .bind(&hash)
+            .fetch_one(pool)
+            .await?;
+            if !indexed {
+                tokio::fs::remove_file(file.path()).await?;
+            }
+        }
+        let _ = tokio::fs::remove_dir(prefix.path()).await;
+    }
+    Ok(())
+}
+
+pub async fn instance_delete_summary(
+    instance_id: &str,
+) -> crate::Result<BackupDeleteSummary> {
+    let state = State::get().await?;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Ok(BackupDeleteSummary {
+            snapshot_count: 0,
+            logical_size: 0,
+        });
+    };
+    let row = sqlx::query(
+        "SELECT COUNT(*) AS count, COALESCE(SUM(logical_size), 0) AS size
+         FROM backup_snapshots WHERE instance_id = ?",
+    )
+    .bind(instance_id)
+    .fetch_one(&pool)
+    .await?;
+    pool.close().await;
+    Ok(BackupDeleteSummary {
+        snapshot_count: row.get::<i64, _>("count").max(0) as u64,
+        logical_size: row.get::<i64, _>("size").max(0) as u64,
+    })
+}
+
+pub(crate) async fn delete_instance_backups(
+    instance_id: &str,
+) -> crate::Result<()> {
+    let state = State::get().await?;
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let Some((repository, pool)) = open_repository(&state, false).await? else {
+        return Ok(());
+    };
+    delete_snapshots_in_pool(&repository, &pool, None, Some(instance_id))
+        .await?;
+    sqlx::query("DELETE FROM instance_backup_configs WHERE instance_id = ?")
+        .bind(instance_id)
+        .execute(&pool)
+        .await?;
+    sqlx::query("DELETE FROM pending_instance_deletions WHERE instance_id = ?")
+        .bind(instance_id)
+        .execute(&pool)
+        .await?;
+    pool.close().await;
+    Ok(())
+}
+
+pub(crate) async fn begin_instance_deletion(
+    instance_id: &str,
+) -> crate::Result<()> {
+    let state = State::get().await?;
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Ok(());
+    };
+    sqlx::query(
+        "INSERT INTO pending_instance_deletions (instance_id, marked_at)
+         VALUES (?, ?)
+         ON CONFLICT(instance_id) DO UPDATE SET marked_at = excluded.marked_at",
+    )
+    .bind(instance_id)
+    .bind(Utc::now().timestamp_millis())
+    .execute(&pool)
+    .await?;
+    pool.close().await;
+    Ok(())
+}
+
+pub(crate) async fn cancel_instance_deletion(
+    instance_id: &str,
+) -> crate::Result<()> {
+    let state = State::get().await?;
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Ok(());
+    };
+    sqlx::query("DELETE FROM pending_instance_deletions WHERE instance_id = ?")
+        .bind(instance_id)
+        .execute(&pool)
+        .await?;
+    pool.close().await;
+    Ok(())
+}
+
+pub(crate) async fn ensure_backup_eligible_edit(
+    instance_id: &str,
+    patch: &crate::state::EditInstance,
+) -> crate::Result<()> {
+    let becomes_ineligible =
+        patch.symlink_target.as_ref().is_some_and(Option::is_some)
+            || patch
+                .game_dir_override
+                .as_ref()
+                .and_then(|path| path.as_deref())
+                .is_some_and(|path| !path.trim().is_empty());
+    if !becomes_ineligible {
+        return Ok(());
+    }
+    let state = State::get().await?;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Ok(());
+    };
+    let enabled: bool = sqlx::query_scalar(
+        "SELECT EXISTS(SELECT 1 FROM instance_backup_configs WHERE instance_id = ?)",
+    )
+    .bind(instance_id)
+    .fetch_one(&pool)
+    .await?;
+    pool.close().await;
+    if enabled {
+        return Err(crate::ErrorKind::InputError(
+            "Disable backups before changing this instance to use an external directory"
+                .to_string(),
+        )
+        .into());
+    }
+    Ok(())
+}
+
+pub async fn start_restore_preview(snapshot_id: &str) -> crate::Result<Uuid> {
+    let (instance_id, total_bytes) =
+        snapshot_operation_metadata(snapshot_id).await?;
+    let operation_id = Uuid::new_v4();
+    create_persisted_operation(
+        operation_id,
+        &instance_id,
+        BackupOperationType::RestorePreview,
+        Some(snapshot_id),
+    )
+    .await?;
+    let (cancellation, cancellable) =
+        register_backup_operation(operation_id, &instance_id);
+    let snapshot_id = snapshot_id.to_string();
+    tokio::spawn(async move {
+        let progress = RestorePreviewProgress {
+            operation_id,
+            instance_id: instance_id.clone(),
+            total_bytes,
+            cancellation: cancellation.clone(),
+        };
+        let result = preview_restore_inner(&snapshot_id, Some(&progress)).await;
+        let (stage, final_state, processed_bytes, message, state) =
+            match &result {
+                Ok(preview) => {
+                    store_restore_preview(operation_id, preview).await;
+                    (
+                        InstanceBackupProgressStage::Completed,
+                        InstanceBackupOperationFinalState::Completed,
+                        total_bytes,
+                        None,
+                        BackupOperationState::Completed,
+                    )
+                }
+                Err(error) if cancellation.is_cancelled() => (
+                    InstanceBackupProgressStage::Cancelled,
+                    InstanceBackupOperationFinalState::Cancelled,
+                    0,
+                    Some(error.to_string()),
+                    BackupOperationState::Cancelled,
+                ),
+                Err(error) => (
+                    InstanceBackupProgressStage::Failed,
+                    InstanceBackupOperationFinalState::Failed,
+                    0,
+                    Some(error.to_string()),
+                    BackupOperationState::Failed,
+                ),
+            };
+        cancellable.store(false, Ordering::Release);
+        update_persisted_operation(
+            operation_id,
+            state,
+            Some(processed_bytes),
+            Some(total_bytes),
+            Some(false),
+            message.as_deref(),
+            Some(&snapshot_id),
+        )
+        .await;
+        emit_backup_progress(
+            operation_id,
+            Some(&instance_id),
+            InstanceBackupOperationType::RestorePreview,
+            stage,
+            processed_bytes,
+            total_bytes,
+            Some(final_state),
+            Some(&snapshot_id),
+            message,
+        )
+        .await;
+        unregister_backup_operation(&instance_id, operation_id);
+    });
+    Ok(operation_id)
+}
+
+struct RestorePreviewProgress {
+    operation_id: Uuid,
+    instance_id: String,
+    total_bytes: u64,
+    cancellation: CancellationToken,
+}
+
+async fn preview_restore_inner(
+    snapshot_id: &str,
+    progress: Option<&RestorePreviewProgress>,
+) -> crate::Result<BackupRestorePreview> {
+    let state = State::get().await?;
+    let (instance_id, _) = snapshot_operation_metadata(snapshot_id).await?;
+    let _maintenance_guard = lock_instance_maintenance(&instance_id).await;
+    let _instance_guard =
+        state.lock_instance_content_exclusive(&instance_id).await;
+    if state.process_manager.has_instance_process(&instance_id) {
+        return Err(crate::ErrorKind::InputError(
+            "Close the instance before restoring a backup".to_string(),
+        )
+        .into());
+    }
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let Some((_, pool)) = open_repository(&state, false).await? else {
+        return Err(crate::ErrorKind::InputError(
+            "Unknown backup snapshot".to_string(),
+        )
+        .into());
+    };
+    let root = require_eligible(&instance_id, &state).await?;
+    let plan =
+        build_restore_plan(snapshot_id, &instance_id, &root, &pool, progress)
+            .await?;
+    pool.close().await;
+    Ok(plan.preview)
+}
+
+pub async fn restore_snapshot(
+    snapshot_id: &str,
+    plan_token: &str,
+) -> crate::Result<Uuid> {
+    let (instance_id, total_bytes) =
+        snapshot_operation_metadata(snapshot_id).await?;
+    let operation_id = Uuid::new_v4();
+    create_persisted_operation(
+        operation_id,
+        &instance_id,
+        BackupOperationType::Restore,
+        Some(snapshot_id),
+    )
+    .await?;
+    let (cancellation, cancellable) =
+        register_backup_operation(operation_id, &instance_id);
+    let snapshot_id = snapshot_id.to_string();
+    let plan_token = plan_token.to_string();
+    tokio::spawn(async move {
+        emit_backup_progress(
+            operation_id,
+            Some(&instance_id),
+            InstanceBackupOperationType::Restore,
+            InstanceBackupProgressStage::Validating,
+            0,
+            total_bytes,
+            None,
+            Some(&snapshot_id),
+            None,
+        )
+        .await;
+        if cancellation.is_cancelled() {
+            update_persisted_operation(
+                operation_id,
+                BackupOperationState::Cancelled,
+                Some(0),
+                Some(total_bytes),
+                Some(false),
+                Some("Backup restore was canceled"),
+                Some(&snapshot_id),
+            )
+            .await;
+            unregister_backup_operation(&instance_id, operation_id);
+            return;
+        }
+        let result = restore_snapshot_inner(
+            &snapshot_id,
+            &plan_token,
+            &cancellable,
+            operation_id,
+        )
+        .await;
+        let (stage, final_state, processed_bytes, message, state) = match result
+        {
+            Ok(()) => (
+                InstanceBackupProgressStage::Completed,
+                InstanceBackupOperationFinalState::Completed,
+                total_bytes,
+                None,
+                BackupOperationState::Completed,
+            ),
+            Err(error) if cancellation.is_cancelled() => (
+                InstanceBackupProgressStage::Cancelled,
+                InstanceBackupOperationFinalState::Cancelled,
+                0,
+                Some(error.to_string()),
+                BackupOperationState::Cancelled,
+            ),
+            Err(error) => (
+                InstanceBackupProgressStage::Failed,
+                InstanceBackupOperationFinalState::Failed,
+                0,
+                Some(error.to_string()),
+                BackupOperationState::Failed,
+            ),
+        };
+        update_persisted_operation(
+            operation_id,
+            state,
+            Some(processed_bytes),
+            Some(total_bytes),
+            Some(false),
+            message.as_deref(),
+            Some(&snapshot_id),
+        )
+        .await;
+        emit_backup_progress(
+            operation_id,
+            Some(&instance_id),
+            InstanceBackupOperationType::Restore,
+            stage,
+            processed_bytes,
+            total_bytes,
+            Some(final_state),
+            Some(&snapshot_id),
+            message,
+        )
+        .await;
+        unregister_backup_operation(&instance_id, operation_id);
+    });
+    Ok(operation_id)
+}
+
+async fn build_restore_plan(
+    snapshot_id: &str,
+    expected_instance_id: &str,
+    root: &Path,
+    pool: &SqlitePool,
+    progress: Option<&RestorePreviewProgress>,
+) -> crate::Result<RestorePlan> {
+    let (instance_id, scope_mode): (String, String) = sqlx::query_as(
+        "SELECT instance_id, scope_mode FROM backup_snapshots WHERE id = ?",
+    )
+    .bind(snapshot_id)
+    .fetch_optional(pool)
+    .await?
+    .ok_or_else(|| {
+        crate::ErrorKind::InputError("Unknown backup snapshot".to_string())
+    })?;
+    if instance_id != expected_instance_id {
+        return Err(crate::ErrorKind::FSError(
+            "Backup snapshot changed while preparing its restore".to_string(),
+        )
+        .into());
+    }
+    let whole_root = match scope_mode.as_str() {
+        "included_roots" => false,
+        "excluded_paths" => true,
+        _ => {
+            return Err(crate::ErrorKind::FSError(format!(
+                "Unknown backup snapshot scope: {scope_mode}"
+            ))
+            .into());
+        }
+    };
+    let selected_roots: Vec<(String, bool)> = sqlx::query_as(
+        "SELECT path, existed FROM snapshot_roots WHERE snapshot_id = ? ORDER BY path",
+    )
+    .bind(snapshot_id)
+    .fetch_all(pool)
+    .await?;
+    for (path, _) in &selected_roots {
+        if normalize_relative_directory(path)? != *path {
+            return Err(crate::ErrorKind::FSError(
+                "Invalid root path in backup snapshot".to_string(),
+            )
+            .into());
+        }
+    }
+    let exclusion_rows: Vec<(String, String)> = sqlx::query_as(
+        "SELECT path, kind FROM snapshot_exclusions WHERE snapshot_id = ? ORDER BY path",
+    )
+    .bind(snapshot_id)
+    .fetch_all(pool)
+    .await?;
+    let raw_exclusions = exclusion_rows
+        .into_iter()
+        .map(|(path, kind)| {
+            Ok(BackupExclusion {
+                path,
+                kind: parse_exclusion_kind(&kind)?,
+            })
+        })
+        .collect::<crate::Result<Vec<_>>>()?;
+    let exclusions = canonicalize_exclusions(raw_exclusions.clone())?;
+    if exclusions.len() != raw_exclusions.len()
+        || raw_exclusions
+            .iter()
+            .any(|exclusion| !exclusions.contains(exclusion))
+    {
+        return Err(crate::ErrorKind::FSError(
+            "Invalid exclusion paths in backup snapshot".to_string(),
+        )
+        .into());
+    }
+    validate_exclusion_ancestors(root, &exclusions).await?;
+
+    let rows = sqlx::query(
+        "SELECT path, kind, object_hash, size, unix_mode, link_target,
+                link_is_directory
+         FROM snapshot_entries WHERE snapshot_id = ? ORDER BY length(path), path",
+    )
+    .bind(snapshot_id)
+    .fetch_all(pool)
+    .await?;
+    let mut target = BTreeMap::new();
+    for row in rows {
+        let path: String = row.get("path");
+        if normalize_relative_directory(&path)? != path
+            || is_excluded(&path, &exclusions)
+        {
+            return Err(crate::ErrorKind::FSError(
+                "Invalid path in backup snapshot".to_string(),
+            )
+            .into());
+        }
+        let kind = match row.get::<String, _>("kind").as_str() {
+            "file" => EntryKind::File,
+            "directory" => EntryKind::Directory,
+            "symlink" => EntryKind::Symlink,
+            kind => {
+                return Err(crate::ErrorKind::FSError(format!(
+                    "Unsupported backup entry kind: {kind}"
+                ))
+                .into());
+            }
+        };
+        if kind == EntryKind::Symlink
+            && exclusions.iter().any(|exclusion| {
+                exclusion.path.starts_with(&format!("{path}/"))
+            })
+        {
+            return Err(crate::ErrorKind::FSError(
+                "Backup snapshot links through an excluded path".to_string(),
+            )
+            .into());
+        }
+        let entry = RestoreEntry {
+            path: path.clone(),
+            kind,
+            object_hash: row.try_get("object_hash")?,
+            size: row.get::<i64, _>("size").max(0) as u64,
+            unix_mode: row.try_get("unix_mode")?,
+            link_target: row.try_get("link_target")?,
+            link_is_directory: row.try_get("link_is_directory")?,
+        };
+        if target.insert(path, entry).is_some() {
+            return Err(crate::ErrorKind::FSError(
+                "Backup snapshot contains duplicate paths".to_string(),
+            )
+            .into());
+        }
+    }
+    let current = scan_restore_entries(
+        root,
+        whole_root,
+        &selected_roots,
+        &exclusions,
+        progress,
+    )
+    .await?;
+    Ok(compare_restore_entries(snapshot_id, current, target))
+}
+
+async fn scan_restore_entries(
+    root: &Path,
+    whole_root: bool,
+    selected_roots: &[(String, bool)],
+    exclusions: &[BackupExclusion],
+    progress: Option<&RestorePreviewProgress>,
+) -> crate::Result<BTreeMap<String, RestoreEntry>> {
+    let mut pending = Vec::new();
+    if whole_root {
+        let mut children = tokio::fs::read_dir(root).await?;
+        while let Some(child) = children.next_entry().await? {
+            let name = child
+                .file_name()
+                .to_str()
+                .map(str::to_string)
+                .ok_or_else(|| crate::ErrorKind::UTFError(child.path()))?;
+            pending.push((child.path(), name));
+        }
+    } else {
+        for (path, _) in selected_roots {
+            pending.push((join_relative(root, path), path.clone()));
+        }
+    }
+
+    let mut entries = BTreeMap::new();
+    let mut processed_bytes = 0u64;
+    while let Some((absolute, relative)) = pending.pop() {
+        if progress.is_some_and(|progress| progress.cancellation.is_cancelled())
+        {
+            return Err(crate::ErrorKind::OtherError(
+                "Restore preview was canceled".to_string(),
+            )
+            .into());
+        }
+        if is_excluded(&relative, exclusions) {
+            continue;
+        }
+        let metadata = match tokio::fs::symlink_metadata(&absolute).await {
+            Ok(metadata) => metadata,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+                continue;
+            }
+            Err(error) => return Err(error.into()),
+        };
+        if io::is_symlink_or_reparse(&metadata) {
+            let target = tokio::fs::read_link(&absolute).await?;
+            let target = target
+                .to_str()
+                .ok_or_else(|| crate::ErrorKind::UTFError(absolute.clone()))?;
+            entries.insert(
+                relative.clone(),
+                RestoreEntry {
+                    path: relative,
+                    kind: EntryKind::Symlink,
+                    object_hash: None,
+                    size: 0,
+                    unix_mode: unix_mode(&metadata).map(i64::from),
+                    link_target: Some(target.to_string()),
+                    link_is_directory: Some(
+                        tokio::fs::metadata(&absolute)
+                            .await
+                            .is_ok_and(|metadata| metadata.is_dir()),
+                    ),
+                },
+            );
+            continue;
+        }
+        if metadata.is_dir() {
+            entries.insert(
+                relative.clone(),
+                RestoreEntry {
+                    path: relative.clone(),
+                    kind: EntryKind::Directory,
+                    object_hash: None,
+                    size: 0,
+                    unix_mode: unix_mode(&metadata).map(i64::from),
+                    link_target: None,
+                    link_is_directory: None,
+                },
+            );
+            let mut children = tokio::fs::read_dir(&absolute).await?;
+            while let Some(child) = children.next_entry().await? {
+                let name =
+                    child.file_name().to_str().map(str::to_string).ok_or_else(
+                        || crate::ErrorKind::UTFError(child.path()),
+                    )?;
+                pending.push((child.path(), format!("{relative}/{name}")));
+            }
+            continue;
+        }
+        if !metadata.is_file() {
+            return Err(crate::ErrorKind::FSError(format!(
+                "Unsupported instance entry: {}",
+                absolute.display()
+            ))
+            .into());
+        }
+        if let Some(progress) = progress {
+            emit_backup_progress(
+                progress.operation_id,
+                Some(&progress.instance_id),
+                InstanceBackupOperationType::RestorePreview,
+                InstanceBackupProgressStage::Hashing,
+                processed_bytes,
+                progress.total_bytes,
+                None,
+                None,
+                None,
+            )
+            .await;
+        }
+        let (hash, size) = hash_restore_file(
+            &absolute,
+            &metadata,
+            progress.map(|progress| &progress.cancellation),
+        )
+        .await?;
+        processed_bytes = processed_bytes.saturating_add(size);
+        entries.insert(
+            relative.clone(),
+            RestoreEntry {
+                path: relative,
+                kind: EntryKind::File,
+                object_hash: Some(hash),
+                size,
+                unix_mode: unix_mode(&metadata).map(i64::from),
+                link_target: None,
+                link_is_directory: None,
+            },
+        );
+    }
+    Ok(entries)
+}
+
+async fn hash_restore_file(
+    path: &Path,
+    before: &std::fs::Metadata,
+    cancellation: Option<&CancellationToken>,
+) -> crate::Result<(String, u64)> {
+    let mut file = tokio::fs::File::open(path).await.map_err(|error| {
+        crate::ErrorKind::FSError(format!(
+            "Could not read {} while preparing the restore: {error}",
+            path.display()
+        ))
+    })?;
+    let mut hasher = Sha256::new();
+    let mut size = 0u64;
+    let mut buffer = vec![0u8; 1024 * 1024];
+    loop {
+        if cancellation.is_some_and(CancellationToken::is_cancelled) {
+            return Err(crate::ErrorKind::OtherError(
+                "Restore preview was canceled".to_string(),
+            )
+            .into());
+        }
+        let read = file.read(&mut buffer).await.map_err(|error| {
+            crate::ErrorKind::FSError(format!(
+                "Could not read {} while preparing the restore: {error}",
+                path.display()
+            ))
+        })?;
+        if read == 0 {
+            break;
+        }
+        hasher.update(&buffer[..read]);
+        size = size.saturating_add(read as u64);
+    }
+    let after = tokio::fs::metadata(path).await?;
+    if before.len() != after.len()
+        || before.modified().ok() != after.modified().ok()
+    {
+        return Err(crate::ErrorKind::FSError(format!(
+            "File changed while preparing the restore: {}",
+            path.display()
+        ))
+        .into());
+    }
+    Ok((
+        hasher
+            .finalize()
+            .iter()
+            .map(|byte| format!("{byte:02x}"))
+            .collect(),
+        size,
+    ))
+}
+
+fn restore_entries_equal(
+    current: Option<&RestoreEntry>,
+    target: Option<&RestoreEntry>,
+) -> bool {
+    let (Some(current), Some(target)) = (current, target) else {
+        return current.is_none() && target.is_none();
+    };
+    if current.kind != target.kind {
+        return false;
+    }
+    match current.kind {
+        EntryKind::Directory => true,
+        EntryKind::File => {
+            current.object_hash == target.object_hash
+                && current.unix_mode == target.unix_mode
+        }
+        EntryKind::Symlink => {
+            current.link_target == target.link_target
+                && current.link_is_directory == target.link_is_directory
+        }
+    }
+}
+
+fn compare_restore_entries(
+    snapshot_id: &str,
+    current: BTreeMap<String, RestoreEntry>,
+    target: BTreeMap<String, RestoreEntry>,
+) -> RestorePlan {
+    let paths = current
+        .keys()
+        .chain(target.keys())
+        .cloned()
+        .collect::<BTreeSet<_>>();
+    let mut added_files = 0u64;
+    let mut modified_files = 0u64;
+    let mut deleted_files = 0u64;
+    let mut changed_paths = Vec::new();
+    let mut token = Sha256::new();
+    token.update(snapshot_id.as_bytes());
+    for path in paths {
+        let current_entry = current.get(&path);
+        let target_entry = target.get(&path);
+        update_restore_plan_token(&mut token, &path, current_entry);
+        update_restore_plan_token(&mut token, &path, target_entry);
+        if restore_entries_equal(current_entry, target_entry) {
+            continue;
+        }
+        changed_paths.push(path);
+        match (current_entry, target_entry) {
+            (None, Some(target)) if target.kind != EntryKind::Directory => {
+                added_files += 1;
+            }
+            (Some(current), None) if current.kind != EntryKind::Directory => {
+                deleted_files += 1;
+            }
+            (Some(current), Some(target))
+                if current.kind != EntryKind::Directory
+                    || target.kind != EntryKind::Directory =>
+            {
+                modified_files += 1;
+            }
+            _ => {}
+        }
+    }
+    changed_paths.sort_by(|left, right| {
+        left.matches('/')
+            .count()
+            .cmp(&right.matches('/').count())
+            .then_with(|| left.cmp(right))
+    });
+    let mut roots: Vec<RestoreJournalRoot> = Vec::new();
+    for path in changed_paths {
+        if roots.iter().any(|root| {
+            path == root.path || path.starts_with(&format!("{}/", root.path))
+        }) {
+            continue;
+        }
+        let had_current = current.keys().any(|current_path| {
+            current_path == &path
+                || current_path.starts_with(&format!("{path}/"))
+        });
+        roots.push(RestoreJournalRoot { path, had_current });
+    }
+    RestorePlan {
+        preview: BackupRestorePreview {
+            added_files,
+            modified_files,
+            deleted_files,
+            plan_token: token
+                .finalize()
+                .iter()
+                .map(|byte| format!("{byte:02x}"))
+                .collect(),
+        },
+        roots,
+        target_entries: target.into_values().collect(),
+    }
+}
+
+fn update_restore_plan_token(
+    token: &mut Sha256,
+    path: &str,
+    entry: Option<&RestoreEntry>,
+) {
+    token.update(path.as_bytes());
+    token.update([0]);
+    let Some(entry) = entry else {
+        token.update(b"missing\0");
+        return;
+    };
+    token.update(entry.kind.as_str().as_bytes());
+    token.update([0]);
+    token.update(entry.object_hash.as_deref().unwrap_or("").as_bytes());
+    token.update([0]);
+    token.update(entry.link_target.as_deref().unwrap_or("").as_bytes());
+    token.update([0]);
+    token.update(entry.size.to_le_bytes());
+    token.update(entry.unix_mode.unwrap_or_default().to_le_bytes());
+    token.update([u8::from(entry.link_is_directory.unwrap_or(false))]);
+}
+
+fn restore_path_is_selected(path: &str, roots: &[RestoreJournalRoot]) -> bool {
+    roots.iter().any(|root| {
+        path == root.path || path.starts_with(&format!("{}/", root.path))
+    })
+}
+
+async fn materialize_restore_plan(
+    repository: &Path,
+    staged: &Path,
+    entries: &[RestoreEntry],
+    roots: &[RestoreJournalRoot],
+) -> crate::Result<()> {
+    for entry in entries {
+        if !restore_path_is_selected(&entry.path, roots) {
+            continue;
+        }
+        let destination = join_relative(staged, &entry.path);
+        match entry.kind {
+            EntryKind::Directory => io::create_dir_all(&destination).await?,
+            EntryKind::File => {
+                let hash = entry.object_hash.as_deref().ok_or_else(|| {
+                    crate::ErrorKind::FSError(format!(
+                        "Backup file {} has no object",
+                        entry.path
+                    ))
+                })?;
+                verify_object(repository, hash, entry.size).await?;
+                if let Some(parent) = destination.parent() {
+                    io::create_dir_all(parent).await?;
+                }
+                tokio::fs::copy(object_path(repository, hash), &destination)
+                    .await?;
+                apply_unix_mode(&destination, entry.unix_mode).await?;
+            }
+            EntryKind::Symlink => {
+                if let Some(parent) = destination.parent() {
+                    io::create_dir_all(parent).await?;
+                }
+                let target = entry.link_target.as_deref().ok_or_else(|| {
+                    crate::ErrorKind::FSError(format!(
+                        "Backup link {} has no target",
+                        entry.path
+                    ))
+                })?;
+                create_recorded_symlink(
+                    PathBuf::from(target),
+                    destination,
+                    entry.link_is_directory.unwrap_or(false),
+                )
+                .await?;
+            }
+        }
+    }
+    Ok(())
+}
+
+async fn apply_restore_roots(
+    root: &Path,
+    operation_root: &Path,
+    roots: &[RestoreJournalRoot],
+) -> crate::Result<()> {
+    let staged = operation_root.join("staged");
+    let rollback = operation_root.join("rollback");
+    for journal_root in roots {
+        let current = join_relative(root, &journal_root.path);
+        let old = join_relative(&rollback, &journal_root.path);
+        if tokio::fs::symlink_metadata(&current).await.is_ok() {
+            if let Some(parent) = old.parent() {
+                io::create_dir_all(parent).await?;
+            }
+            rename_backup_path(&current, &old).await?;
+        }
+        let new = join_relative(&staged, &journal_root.path);
+        if tokio::fs::symlink_metadata(&new).await.is_ok() {
+            if let Some(parent) = current.parent() {
+                io::create_dir_all(parent).await?;
+            }
+            rename_backup_path(&new, &current).await?;
+        }
+    }
+    Ok(())
+}
+
+async fn restore_snapshot_inner(
+    snapshot_id: &str,
+    expected_plan_token: &str,
+    cancellable: &AtomicBool,
+    operation_id: Uuid,
+) -> crate::Result<()> {
+    let state = State::get().await?;
+    let (instance_id, _) = snapshot_operation_metadata(snapshot_id).await?;
+    let _maintenance_guard = lock_instance_maintenance(&instance_id).await;
+    let _instance_guard =
+        state.lock_instance_content_exclusive(&instance_id).await;
+    if state.process_manager.has_instance_process(&instance_id) {
+        return Err(crate::ErrorKind::InputError(
+            "Close the instance before restoring a backup".to_string(),
+        )
+        .into());
+    }
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let Some((repository, pool)) = open_repository(&state, false).await? else {
+        return Err(crate::ErrorKind::InputError(
+            "Unknown backup snapshot".to_string(),
+        )
+        .into());
+    };
+    let root = require_eligible(&instance_id, &state).await?;
+    let plan =
+        build_restore_plan(snapshot_id, &instance_id, &root, &pool, None)
+            .await?;
+    if plan.preview.plan_token != expected_plan_token {
+        pool.close().await;
+        return Err(crate::ErrorKind::InputError(
+            "The instance changed after the restore preview; review the updated operations before restoring"
+                .to_string(),
+        )
+        .into());
+    }
+    if plan.roots.is_empty() {
+        pool.close().await;
+        return Ok(());
+    }
+    if !cancellable.swap(false, Ordering::AcqRel) {
+        pool.close().await;
+        return Err(crate::ErrorKind::OtherError(
+            "Backup restore was canceled".to_string(),
+        )
+        .into());
+    }
+    update_persisted_operation(
+        operation_id,
+        BackupOperationState::Materializing,
+        Some(0),
+        None,
+        Some(false),
+        None,
+        Some(snapshot_id),
+    )
+    .await;
+
+    let restore_journal_id = Uuid::new_v4().to_string();
+    let operation_root = state
+        .directories
+        .instances_dir()
+        .join(format!("{RESTORE_PREFIX}{restore_journal_id}"));
+    let staged = operation_root.join("staged");
+    let rollback = operation_root.join("rollback");
+    io::create_dir_all(&staged).await?;
+    io::create_dir_all(&rollback).await?;
+    let journal = RestoreJournal {
+        instance_id: instance_id.clone(),
+        roots: plan.roots.clone(),
+        whole_root: false,
+        exclusions: Vec::new(),
+    };
+    let mut journal_file =
+        tokio::fs::File::create(operation_root.join(RESTORE_JOURNAL)).await?;
+    journal_file
+        .write_all(&serde_json::to_vec(&journal)?)
+        .await?;
+    journal_file.sync_all().await?;
+    drop(journal_file);
+    let materialize = materialize_restore_plan(
+        &repository,
+        &staged,
+        &plan.target_entries,
+        &plan.roots,
+    )
+    .await;
+    if let Err(error) = materialize {
+        let _ = io::remove_dir_all(&operation_root).await;
+        pool.close().await;
+        return Err(error);
+    }
+    update_persisted_operation(
+        operation_id,
+        BackupOperationState::Applying,
+        None,
+        None,
+        Some(false),
+        None,
+        Some(snapshot_id),
+    )
+    .await;
+
+    let replace_result =
+        apply_restore_roots(&root, &operation_root, &plan.roots).await;
+    if let Err(error) = replace_result {
+        let recovery =
+            recover_restore_operation(&root, &operation_root, &journal.roots)
+                .await;
+        pool.close().await;
+        if let Err(recovery_error) = recovery {
+            return Err(crate::ErrorKind::OtherError(format!(
+				"Backup restore failed: {error}; rollback failed: {recovery_error}"
+			))
+            .into());
+        }
+        return Err(error);
+    }
+    if let Err(error) = mark_restore_committed(&operation_root).await {
+        let recovery =
+            recover_restore_operation(&root, &operation_root, &journal.roots)
+                .await;
+        pool.close().await;
+        if let Err(recovery_error) = recovery {
+            return Err(crate::ErrorKind::OtherError(format!(
+				"Backup restore could not be committed: {error}; rollback failed: {recovery_error}"
+			))
+			.into());
+        }
+        return Err(error);
+    }
+    io::remove_dir_all(&operation_root).await?;
+    pool.close().await;
+    Ok(())
+}
+
+#[cfg(test)]
+async fn replace_whole_root(
+    root: &Path,
+    operation_root: &Path,
+    exclusions: &[BackupExclusion],
+) -> crate::Result<()> {
+    ensure_canonical_exclusions(exclusions)?;
+    let staged = operation_root.join("staged");
+    let rollback_root = operation_root.join("rollback").join("instance");
+    rename_backup_path(root, &rollback_root).await?;
+    for exclusion in exclusions {
+        let source = join_relative(&rollback_root, &exclusion.path);
+        if tokio::fs::symlink_metadata(&source).await.is_err() {
+            continue;
+        }
+        let destination = join_relative(&staged, &exclusion.path);
+        remove_path_if_exists(&destination).await;
+        if let Some(parent) = destination.parent() {
+            io::create_dir_all(parent).await?;
+        }
+        rename_backup_path(&source, &destination).await?;
+    }
+    if let Some(parent) = root.parent() {
+        io::create_dir_all(parent).await?;
+    }
+    rename_backup_path(&staged, root).await?;
+    Ok(())
+}
+
+async fn verify_object(
+    repository: &Path,
+    expected_hash: &str,
+    expected_size: u64,
+) -> crate::Result<()> {
+    if expected_hash.len() != 64
+        || !expected_hash.bytes().all(|byte| byte.is_ascii_hexdigit())
+    {
+        return Err(crate::ErrorKind::FSError(
+            "Backup object has an invalid SHA-256 identifier".to_string(),
+        )
+        .into());
+    }
+    let path = object_path(repository, expected_hash);
+    let metadata = tokio::fs::metadata(&path).await?;
+    if metadata.len() != expected_size {
+        return Err(crate::ErrorKind::FSError(format!(
+            "Backup object {expected_hash} has an unexpected size"
+        ))
+        .into());
+    }
+    let mut file = tokio::fs::File::open(&path).await?;
+    let mut hasher = Sha256::new();
+    let mut buffer = vec![0u8; 1024 * 1024];
+    loop {
+        let read = file.read(&mut buffer).await?;
+        if read == 0 {
+            break;
+        }
+        hasher.update(&buffer[..read]);
+    }
+    let actual = hasher
+        .finalize()
+        .iter()
+        .map(|byte| format!("{byte:02x}"))
+        .collect::<String>();
+    if actual != expected_hash {
+        return Err(crate::ErrorKind::FSError(format!(
+            "Backup object {expected_hash} failed SHA-256 verification"
+        ))
+        .into());
+    }
+    Ok(())
+}
+
+#[cfg_attr(not(windows), allow(unused_variables))]
+async fn create_recorded_symlink(
+    target: PathBuf,
+    link: PathBuf,
+    is_directory: bool,
+) -> crate::Result<()> {
+    tokio::task::spawn_blocking(move || {
+        #[cfg(unix)]
+        {
+            std::os::unix::fs::symlink(target, link)
+        }
+        #[cfg(windows)]
+        {
+            if is_directory {
+                symlink_rs::symlink_dir(target, link)
+            } else {
+                symlink_rs::symlink_file(target, link)
+            }
+        }
+        #[cfg(not(any(unix, windows)))]
+        {
+            let _ = (target, link, is_directory);
+            Err(std::io::Error::new(
+                std::io::ErrorKind::Unsupported,
+                "Symbolic links are unsupported on this platform",
+            ))
+        }
+    })
+    .await
+    .map_err(|error| {
+        crate::ErrorKind::OtherError(format!(
+            "Symbolic link restore task failed: {error}"
+        ))
+    })??;
+    Ok(())
+}
+
+#[cfg(unix)]
+async fn apply_unix_mode(path: &Path, mode: Option<i64>) -> crate::Result<()> {
+    use std::os::unix::fs::PermissionsExt;
+    if let Some(mode) = mode {
+        tokio::fs::set_permissions(
+            path,
+            std::fs::Permissions::from_mode(mode as u32),
+        )
+        .await?;
+    }
+    Ok(())
+}
+
+#[cfg(not(unix))]
+async fn apply_unix_mode(
+    _path: &Path,
+    _mode: Option<i64>,
+) -> crate::Result<()> {
+    Ok(())
+}
+
+pub(crate) async fn move_default_repository_for_launcher_directory(
+    source: &Path,
+    destination: &Path,
+) -> crate::Result<Option<PathBuf>> {
+    if source == destination {
+        return Ok(None);
+    }
+    let source_exists = source.join(DATABASE_FILE).try_exists()?;
+    let destination_exists = destination.join(DATABASE_FILE).try_exists()?;
+    if destination_exists {
+        validate_repository_at(destination).await?;
+        if source_exists && source.try_exists()? {
+            return match io::remove_dir_all(source).await {
+                Ok(()) => Ok(None),
+                Err(error) => {
+                    tracing::warn!(
+                        path = %source.display(),
+                        %error,
+                        "Failed to remove the old default backup repository"
+                    );
+                    Ok(Some(source.to_path_buf()))
+                }
+            };
+        }
+        return Ok(None);
+    }
+    if !source_exists {
+        return Ok(None);
+    }
+    if destination.try_exists()? {
+        let mut entries = tokio::fs::read_dir(destination).await?;
+        if entries.next_entry().await?.is_some() {
+            return Err(crate::ErrorKind::DirectoryMoveError(format!(
+                "The default backup repository destination is not empty: {}",
+                destination.display()
+            ))
+            .into());
+        }
+    } else {
+        io::create_dir_all(destination).await?;
+    }
+    let destination_parent = destination.parent().ok_or_else(|| {
+        crate::ErrorKind::DirectoryMoveError(format!(
+            "The default backup repository destination has no parent: {}",
+            destination.display()
+        ))
+    })?;
+    io::create_dir_all(destination_parent).await?;
+    let pool = open_repository_at(source, false).await?.ok_or_else(|| {
+        crate::ErrorKind::FSError(
+            "The default backup repository disappeared during migration"
+                .to_string(),
+        )
+    })?;
+    sqlx::query("PRAGMA wal_checkpoint(TRUNCATE)")
+        .execute(&pool)
+        .await?;
+    pool.close().await;
+
+    if io::is_same_disk(source, destination_parent).unwrap_or(false) {
+        tokio::fs::remove_dir(destination).await?;
+        rename_backup_path(source, destination).await?;
+        return Ok(None);
+    }
+
+    let temporary = destination_parent
+        .join(format!(".axolotl-backup-move-{}", Uuid::new_v4()));
+    let copy_result: crate::Result<()> = async {
+        io::copy_dir(source, &temporary).await?;
+        validate_repository_at(&temporary).await?;
+        tokio::fs::remove_dir(destination).await?;
+        rename_backup_path(&temporary, destination).await?;
+        Ok(())
+    }
+    .await;
+    if let Err(error) = copy_result {
+        let _ = io::remove_dir_all(&temporary).await;
+        if !destination.try_exists()? {
+            let _ = io::create_dir_all(destination).await;
+        }
+        return Err(error);
+    }
+    match io::remove_dir_all(source).await {
+        Ok(()) => Ok(None),
+        Err(error) => {
+            tracing::warn!(
+                path = %source.display(),
+                %error,
+                "Failed to remove the old default backup repository"
+            );
+            Ok(Some(source.to_path_buf()))
+        }
+    }
+}
+
+pub async fn start_repository_move(
+    destination: PathBuf,
+) -> crate::Result<Uuid> {
+    let operation_id = Uuid::new_v4();
+    let total_bytes = repository_status()
+        .await
+        .map(|status| status.stored_size)
+        .unwrap_or(0);
+    create_persisted_operation(
+        operation_id,
+        REPOSITORY_OPERATION_KEY,
+        BackupOperationType::RepositoryMove,
+        None,
+    )
+    .await?;
+    update_persisted_operation(
+        operation_id,
+        BackupOperationState::Queued,
+        Some(0),
+        Some(total_bytes),
+        Some(false),
+        None,
+        None,
+    )
+    .await;
+    tokio::spawn(async move {
+        emit_backup_progress(
+            operation_id,
+            None,
+            InstanceBackupOperationType::RepositoryMove,
+            InstanceBackupProgressStage::Copying,
+            0,
+            total_bytes,
+            None,
+            None,
+            None,
+        )
+        .await;
+        let result = move_repository_inner(destination).await;
+        let (stage, final_state, processed_bytes, message, state) = match result
+        {
+            Ok(()) => (
+                InstanceBackupProgressStage::Completed,
+                InstanceBackupOperationFinalState::Completed,
+                total_bytes,
+                None,
+                BackupOperationState::Completed,
+            ),
+            Err(error) => (
+                InstanceBackupProgressStage::Failed,
+                InstanceBackupOperationFinalState::Failed,
+                0,
+                Some(error.to_string()),
+                BackupOperationState::Failed,
+            ),
+        };
+        update_persisted_operation(
+            operation_id,
+            state,
+            Some(processed_bytes),
+            Some(total_bytes),
+            Some(false),
+            message.as_deref(),
+            None,
+        )
+        .await;
+        emit_backup_progress(
+            operation_id,
+            None,
+            InstanceBackupOperationType::RepositoryMove,
+            stage,
+            processed_bytes,
+            total_bytes,
+            Some(final_state),
+            None,
+            message,
+        )
+        .await;
+        unregister_backup_operation(REPOSITORY_OPERATION_KEY, operation_id);
+    });
+    Ok(operation_id)
+}
+
+async fn move_repository_inner(destination: PathBuf) -> crate::Result<()> {
+    let state = State::get().await?;
+    let _repository_guard = REPOSITORY_LOCK.lock().await;
+    let source = repository_path(&state).await?;
+    if !destination.is_absolute() {
+        return Err(crate::ErrorKind::InputError(
+            "The backup repository destination must be an absolute path"
+                .to_string(),
+        )
+        .into());
+    }
+    if source == destination {
+        return Ok(());
+    }
+    let destination_existed = destination.try_exists()?;
+    if destination_existed {
+        let mut entries = tokio::fs::read_dir(&destination).await?;
+        if entries.next_entry().await?.is_some() {
+            return Err(crate::ErrorKind::InputError(
+                "The new backup repository directory must be empty".to_string(),
+            )
+            .into());
+        }
+    } else {
+        io::create_dir_all(&destination).await?;
+    }
+    let source_exists = source.join(DATABASE_FILE).try_exists()?;
+    let mut same_disk_move = false;
+    if source_exists {
+        let destination_parent = destination.parent().ok_or_else(|| {
+            crate::ErrorKind::InputError(
+                "The backup repository destination has no parent".to_string(),
+            )
+        })?;
+        io::create_dir_all(destination_parent).await?;
+        let canonical_source = io::canonicalize(&source)?;
+        let canonical_destination_parent =
+            io::canonicalize(destination_parent)?;
+        if canonical_destination_parent.starts_with(&canonical_source) {
+            return Err(crate::ErrorKind::InputError(
+                "The backup repository cannot be moved inside itself"
+                    .to_string(),
+            )
+            .into());
+        }
+        if let Some((_, pool)) = open_repository(&state, false).await? {
+            sqlx::query("PRAGMA wal_checkpoint(TRUNCATE)")
+                .execute(&pool)
+                .await?;
+            pool.close().await;
+        }
+        same_disk_move =
+            io::is_same_disk(&source, destination_parent).unwrap_or(false);
+        if same_disk_move {
+            let _ = tokio::fs::remove_dir(&destination).await;
+            rename_backup_path(&source, &destination).await?;
+        } else {
+            let temporary = destination_parent
+                .join(format!(".axolotl-backup-move-{}", Uuid::new_v4()));
+            let copy_result: crate::Result<()> = async {
+                io::copy_dir(&source, &temporary).await?;
+                validate_repository_at(&temporary).await?;
+                tokio::fs::remove_dir(&destination).await?;
+                rename_backup_path(&temporary, &destination).await?;
+                Ok(())
+            }
+            .await;
+            if let Err(error) = copy_result {
+                let _ = io::remove_dir_all(&temporary).await;
+                if !destination.try_exists()? {
+                    let _ = io::create_dir_all(&destination).await;
+                }
+                return Err(error);
+            }
+        }
+    }
+    let stored_path = if destination == default_repository_path(&state) {
+        None
+    } else {
+        Some(destination.to_string_lossy().to_string())
+    };
+    let update_result: crate::Result<()> = async {
+        let mut tx = state.pool.begin().await?;
+        sqlx::query(
+            "UPDATE settings SET backup_repository_path = ? WHERE id = 0",
+        )
+        .bind(stored_path)
+        .execute(&mut *tx)
+        .await?;
+        if source_exists && !same_disk_move {
+            sqlx::query(
+                "INSERT INTO pending_backup_repository_cleanups (path, created_at)
+                 VALUES (?, ?)
+                 ON CONFLICT(path) DO UPDATE SET created_at = excluded.created_at",
+            )
+            .bind(source.to_string_lossy().to_string())
+            .bind(Utc::now().timestamp_millis())
+            .execute(&mut *tx)
+            .await?;
+        }
+        tx.commit().await?;
+        Ok(())
+    }
+    .await;
+    if let Err(error) = update_result {
+        if source_exists && same_disk_move {
+            let _ = rename_backup_path(&destination, &source).await;
+            if destination_existed {
+                let _ = io::create_dir_all(&destination).await;
+            }
+        } else if source_exists {
+            let _ = io::remove_dir_all(&destination).await;
+            if destination_existed {
+                let _ = io::create_dir_all(&destination).await;
+            }
+        }
+        return Err(error);
+    }
+    if source_exists && !same_disk_move {
+        let cleanup_succeeded = if source.try_exists()? {
+            match io::remove_dir_all(&source).await {
+                Ok(()) => true,
+                Err(error) => {
+                    tracing::warn!(path = %source.display(), %error, "Failed to remove old backup repository");
+                    false
+                }
+            }
+        } else {
+            true
+        };
+        if cleanup_succeeded {
+            sqlx::query(
+                "DELETE FROM pending_backup_repository_cleanups WHERE path = ?",
+            )
+            .bind(source.to_string_lossy().to_string())
+            .execute(&state.pool)
+            .await?;
+        }
+    }
+    Ok(())
+}
+
+async fn validate_repository_at(root: &Path) -> crate::Result<()> {
+    let options = SqliteConnectOptions::from_str(&format!(
+        "sqlite://{}",
+        root.join(DATABASE_FILE)
+            .to_string_lossy()
+            .replace('\\', "/")
+    ))?
+    .read_only(true);
+    let pool = SqlitePoolOptions::new()
+        .max_connections(1)
+        .connect_with(options)
+        .await?;
+    let integrity: String = sqlx::query_scalar("PRAGMA integrity_check")
+        .fetch_one(&pool)
+        .await?;
+    let foreign_key_errors: Vec<(String, i64, String, i64)> =
+        sqlx::query_as("PRAGMA foreign_key_check")
+            .fetch_all(&pool)
+            .await?;
+    let schema_name: String = sqlx::query_scalar(
+        "SELECT schema_name FROM repository_meta WHERE id = 0",
+    )
+    .fetch_one(&pool)
+    .await?;
+    let objects: Vec<(String, i64)> = sqlx::query_as(
+        "SELECT hash, size FROM backup_objects WHERE ref_count > 0",
+    )
+    .fetch_all(&pool)
+    .await?;
+    pool.close().await;
+    if integrity != "ok" {
+        return Err(crate::ErrorKind::FSError(format!(
+            "Moved backup database failed its integrity check: {integrity}"
+        ))
+        .into());
+    }
+    if !foreign_key_errors.is_empty() {
+        return Err(crate::ErrorKind::FSError(
+            "Moved backup database failed its foreign key check".to_string(),
+        )
+        .into());
+    }
+    if schema_name != "axolotl-instance-backups" {
+        return Err(crate::ErrorKind::FSError(
+            "Moved directory is not an Axolotl backup repository".to_string(),
+        )
+        .into());
+    }
+    for (hash, size) in objects {
+        verify_object(root, &hash, size.max(0) as u64).await?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn restore_directory(path: &str) -> RestoreEntry {
+        RestoreEntry {
+            path: path.to_string(),
+            kind: EntryKind::Directory,
+            object_hash: None,
+            size: 0,
+            unix_mode: None,
+            link_target: None,
+            link_is_directory: None,
+        }
+    }
+
+    fn restore_file(path: &str, hash: &str) -> RestoreEntry {
+        RestoreEntry {
+            path: path.to_string(),
+            kind: EntryKind::File,
+            object_hash: Some(hash.to_string()),
+            size: 1,
+            unix_mode: None,
+            link_target: None,
+            link_is_directory: None,
+        }
+    }
+
+    #[test]
+    fn restore_plan_counts_file_changes_and_keeps_minimal_roots() {
+        let current = BTreeMap::from([
+            ("config".to_string(), restore_directory("config")),
+            (
+                "config/delete.txt".to_string(),
+                restore_file("config/delete.txt", "delete"),
+            ),
+            (
+                "config/modify.txt".to_string(),
+                restore_file("config/modify.txt", "old"),
+            ),
+            (
+                "config/same.txt".to_string(),
+                restore_file("config/same.txt", "same"),
+            ),
+        ]);
+        let target = BTreeMap::from([
+            ("config".to_string(), restore_directory("config")),
+            (
+                "config/add.txt".to_string(),
+                restore_file("config/add.txt", "add"),
+            ),
+            (
+                "config/modify.txt".to_string(),
+                restore_file("config/modify.txt", "new"),
+            ),
+            (
+                "config/same.txt".to_string(),
+                restore_file("config/same.txt", "same"),
+            ),
+        ]);
+
+        let plan = compare_restore_entries("snapshot", current, target);
+
+        assert_eq!(plan.preview.added_files, 1);
+        assert_eq!(plan.preview.modified_files, 1);
+        assert_eq!(plan.preview.deleted_files, 1);
+        assert_eq!(
+            plan.roots
+                .iter()
+                .map(|root| root.path.as_str())
+                .collect::<Vec<_>>(),
+            ["config/add.txt", "config/delete.txt", "config/modify.txt"]
+        );
+    }
+
+    #[test]
+    fn restore_plan_collapses_descendants_when_entry_type_changes() {
+        let current = BTreeMap::from([
+            ("cache".to_string(), restore_directory("cache")),
+            (
+                "cache/data.bin".to_string(),
+                restore_file("cache/data.bin", "old"),
+            ),
+        ]);
+        let target = BTreeMap::from([(
+            "cache".to_string(),
+            restore_file("cache", "new"),
+        )]);
+
+        let plan = compare_restore_entries("snapshot", current, target);
+
+        assert_eq!(plan.preview.modified_files, 1);
+        assert_eq!(plan.preview.deleted_files, 1);
+        assert_eq!(plan.roots.len(), 1);
+        assert_eq!(plan.roots[0].path, "cache");
+        assert!(plan.roots[0].had_current);
+    }
+
+    #[tokio::test]
+    async fn restore_scan_hashes_files_and_skips_exclusions() {
+        let temp = tempfile::tempdir().unwrap();
+        tokio::fs::create_dir_all(temp.path().join("config"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(temp.path().join("caches"))
+            .await
+            .unwrap();
+        tokio::fs::write(temp.path().join("config/value.txt"), b"value")
+            .await
+            .unwrap();
+        tokio::fs::write(temp.path().join("caches/value.bin"), b"ignored")
+            .await
+            .unwrap();
+
+        let entries = scan_restore_entries(
+            temp.path(),
+            true,
+            &[],
+            &[BackupExclusion {
+                path: "caches".to_string(),
+                kind: BackupExclusionKind::Directory,
+            }],
+            None,
+        )
+        .await
+        .unwrap();
+
+        assert!(entries.contains_key("config"));
+        assert!(entries.contains_key("config/value.txt"));
+        assert!(!entries.contains_key("caches"));
+        assert_eq!(
+            entries["config/value.txt"].object_hash.as_deref(),
+            Some(
+                "cd42404d52ad55ccfa9aca4adc828aa5800ad9d385a0671fbcbf724118320619"
+            )
+        );
+    }
+
+    #[tokio::test]
+    async fn incremental_restore_replaces_only_changed_paths() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("instance");
+        let operation_root = temp.path().join("operation");
+        tokio::fs::create_dir_all(root.join("config"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(operation_root.join("staged/config"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(operation_root.join("rollback"))
+            .await
+            .unwrap();
+        tokio::fs::write(root.join("config/unchanged.txt"), b"same")
+            .await
+            .unwrap();
+        tokio::fs::write(root.join("config/changed.txt"), b"current")
+            .await
+            .unwrap();
+        tokio::fs::write(
+            operation_root.join("staged/config/changed.txt"),
+            b"backup",
+        )
+        .await
+        .unwrap();
+
+        apply_restore_roots(
+            &root,
+            &operation_root,
+            &[RestoreJournalRoot {
+                path: "config/changed.txt".to_string(),
+                had_current: true,
+            }],
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(
+            tokio::fs::read(root.join("config/unchanged.txt"))
+                .await
+                .unwrap(),
+            b"same"
+        );
+        assert_eq!(
+            tokio::fs::read(root.join("config/changed.txt"))
+                .await
+                .unwrap(),
+            b"backup"
+        );
+        assert_eq!(
+            tokio::fs::read(operation_root.join("rollback/config/changed.txt"))
+                .await
+                .unwrap(),
+            b"current"
+        );
+    }
+
+    #[tokio::test]
+    async fn cancellation_is_rejected_after_snapshot_saving_starts() {
+        let operation_id = Uuid::new_v4();
+        let (cancellation, _cancellable) =
+            register_backup_operation(operation_id, "instance");
+        assert!(cancel_backup(operation_id).await.unwrap());
+        assert!(cancellation.is_cancelled());
+        BACKUP_CANCELLATIONS.remove(&operation_id);
+
+        let operation_id = Uuid::new_v4();
+        let (cancellation, cancellable) =
+            register_backup_operation(operation_id, "instance");
+        cancellable.store(false, Ordering::Release);
+        assert!(!cancel_backup(operation_id).await.unwrap());
+        assert!(!cancellation.is_cancelled());
+        BACKUP_CANCELLATIONS.remove(&operation_id);
+    }
+
+    #[test]
+    fn only_one_operation_can_reserve_an_instance() {
+        let instance_id = format!("instance-{}", Uuid::new_v4());
+        let first = Uuid::new_v4();
+        assert!(reserve_instance_operation(&instance_id, first).is_ok());
+        assert!(
+            reserve_instance_operation(&instance_id, Uuid::new_v4()).is_err()
+        );
+        assert!(has_active_instance_operation(&instance_id));
+        ACTIVE_INSTANCE_OPERATIONS.remove(&instance_id);
+        assert!(!has_active_instance_operation(&instance_id));
+    }
+
+    #[test]
+    fn normalizes_and_deduplicates_exclusions() {
+        assert_eq!(
+            canonicalize_exclusions(vec![
+                BackupExclusion {
+                    path: "saves/world".to_string(),
+                    kind: BackupExclusionKind::Directory,
+                },
+                BackupExclusion {
+                    path: "config\\bigdb.sqlite".to_string(),
+                    kind: BackupExclusionKind::File,
+                },
+                BackupExclusion {
+                    path: "saves".to_string(),
+                    kind: BackupExclusionKind::Directory,
+                },
+            ])
+            .unwrap(),
+            [
+                BackupExclusion {
+                    path: "saves".to_string(),
+                    kind: BackupExclusionKind::Directory,
+                },
+                BackupExclusion {
+                    path: "config/bigdb.sqlite".to_string(),
+                    kind: BackupExclusionKind::File,
+                },
+            ]
+        );
+    }
+
+    #[test]
+    fn rejects_paths_outside_the_instance() {
+        for path in ["", ".", "..", "../saves", "/saves", "C:\\saves"] {
+            assert!(normalize_relative_directory(path).is_err(), "{path}");
+        }
+    }
+
+    #[tokio::test]
+    async fn independent_repository_migration_creates_expected_schema() {
+        let temp = tempfile::tempdir().unwrap();
+        let database = temp.path().join(DATABASE_FILE);
+        let options = SqliteConnectOptions::new()
+            .filename(&database)
+            .create_if_missing(true)
+            .foreign_keys(true);
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect_with(options)
+            .await
+            .unwrap();
+        BACKUP_MIGRATOR.run(&pool).await.unwrap();
+        let tables: Vec<String> = sqlx::query_scalar(
+            "SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name",
+        )
+        .fetch_all(&pool)
+        .await
+        .unwrap();
+        assert!(tables.contains(&"backup_snapshots".to_string()));
+        assert!(tables.contains(&"backup_exclusions".to_string()));
+        assert!(tables.contains(&"snapshot_entries".to_string()));
+        assert!(tables.contains(&"snapshot_exclusions".to_string()));
+        assert!(tables.contains(&"backup_objects".to_string()));
+        assert!(tables.contains(&"backup_operations".to_string()));
+        assert!(!tables.contains(&"backup_selections".to_string()));
+        let operation_columns: Vec<String> = sqlx::query_scalar(
+			"SELECT name FROM pragma_table_info('backup_operations') ORDER BY cid",
+		)
+		.fetch_all(&pool)
+		.await
+		.unwrap();
+        assert!(operation_columns.contains(&"cancellable".to_string()));
+        assert!(operation_columns.contains(&"cancel_requested".to_string()));
+        let foreign_key_errors: Vec<(String, i64, String, i64)> =
+            sqlx::query_as("PRAGMA foreign_key_check")
+                .fetch_all(&pool)
+                .await
+                .unwrap();
+        assert!(foreign_key_errors.is_empty());
+    }
+
+    #[tokio::test]
+    async fn operation_cancellation_migration_preserves_existing_operations() {
+        let temp = tempfile::tempdir().unwrap();
+        let options = SqliteConnectOptions::new()
+            .filename(temp.path().join(DATABASE_FILE))
+            .create_if_missing(true)
+            .foreign_keys(true);
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect_with(options)
+            .await
+            .unwrap();
+        sqlx::raw_sql(include_str!(
+            "../../../backup_migrations/20260920200000_operations.sql"
+        ))
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::query(
+            "INSERT INTO backup_operations
+			 (id, operation_type, instance_id, state, created_at, updated_at)
+			 VALUES ('operation', 'create', 'instance', 'hashing', 1, 1)",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::raw_sql(include_str!(
+			"../../../backup_migrations/20260920210000_operation_cancellation.sql"
+		))
+        .execute(&pool)
+        .await
+        .unwrap();
+
+        let row: (String, i64) = sqlx::query_as(
+			"SELECT state, cancel_requested FROM backup_operations WHERE id = 'operation'",
+		)
+		.fetch_one(&pool)
+		.await
+		.unwrap();
+        assert_eq!(row, ("hashing".to_string(), 0));
+        let foreign_key_errors: Vec<(String, i64, String, i64)> =
+            sqlx::query_as("PRAGMA foreign_key_check")
+                .fetch_all(&pool)
+                .await
+                .unwrap();
+        assert!(foreign_key_errors.is_empty());
+    }
+
+    #[tokio::test]
+    async fn repository_move_migration_preserves_operations_and_extends_type() {
+        let temp = tempfile::tempdir().unwrap();
+        let options = SqliteConnectOptions::new()
+            .filename(temp.path().join(DATABASE_FILE))
+            .create_if_missing(true)
+            .foreign_keys(true);
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect_with(options)
+            .await
+            .unwrap();
+        sqlx::raw_sql(include_str!(
+            "../../../backup_migrations/20260920200000_operations.sql"
+        ))
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::raw_sql(include_str!(
+            "../../../backup_migrations/20260920210000_operation_cancellation.sql"
+        ))
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::query(
+            "INSERT INTO backup_operations
+             (id, operation_type, instance_id, state, created_at, updated_at)
+             VALUES ('create-operation', 'create', 'instance', 'completed', 1, 1)",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::raw_sql(include_str!(
+            "../../../backup_migrations/20260920223000_repository_move_operations.sql"
+        ))
+        .execute(&pool)
+        .await
+        .unwrap();
+        let existing: String = sqlx::query_scalar(
+            "SELECT operation_type FROM backup_operations WHERE id = 'create-operation'",
+        )
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(existing, "create");
+        sqlx::query(
+            "INSERT INTO backup_operations
+             (id, operation_type, instance_id, state, created_at, updated_at)
+             VALUES ('move-operation', 'repository_move', ?, 'queued', 2, 2)",
+        )
+        .bind(REPOSITORY_OPERATION_KEY)
+        .execute(&pool)
+        .await
+        .unwrap();
+    }
+
+    #[tokio::test]
+    async fn restore_preview_migration_preserves_operations_and_result_columns()
+    {
+        let temp = tempfile::tempdir().unwrap();
+        let options = SqliteConnectOptions::new()
+            .filename(temp.path().join(DATABASE_FILE))
+            .create_if_missing(true)
+            .foreign_keys(true);
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect_with(options)
+            .await
+            .unwrap();
+        for migration in [
+            include_str!(
+                "../../../backup_migrations/20260920200000_operations.sql"
+            ),
+            include_str!(
+                "../../../backup_migrations/20260920210000_operation_cancellation.sql"
+            ),
+            include_str!(
+                "../../../backup_migrations/20260920223000_repository_move_operations.sql"
+            ),
+        ] {
+            sqlx::raw_sql(migration).execute(&pool).await.unwrap();
+        }
+        sqlx::query(
+            "INSERT INTO backup_operations
+             (id, operation_type, instance_id, state, created_at, updated_at)
+             VALUES ('existing', 'restore', 'instance', 'completed', 1, 1)",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        sqlx::raw_sql(include_str!(
+            "../../../backup_migrations/20260920230000_restore_preview_operations.sql"
+        ))
+        .execute(&pool)
+        .await
+        .unwrap();
+        let existing: String = sqlx::query_scalar(
+            "SELECT operation_type FROM backup_operations WHERE id = 'existing'",
+        )
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(existing, "restore");
+        sqlx::query(
+            "INSERT INTO backup_operations
+             (id, operation_type, instance_id, state, created_at, updated_at,
+              preview_added_files, preview_modified_files, preview_deleted_files,
+              preview_plan_token)
+             VALUES ('preview', 'restore_preview', 'instance', 'completed', 2, 2,
+                     1, 2, 3, 'token')",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        let result: (i64, i64, i64, String) = sqlx::query_as(
+            "SELECT preview_added_files, preview_modified_files,
+                    preview_deleted_files, preview_plan_token
+             FROM backup_operations WHERE id = 'preview'",
+        )
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(result, (1, 2, 3, "token".to_string()));
+    }
+
+    #[tokio::test]
+    async fn repository_validation_rejects_foreign_key_violations() {
+        let temp = tempfile::tempdir().unwrap();
+        tokio::fs::create_dir_all(temp.path().join(OBJECTS_DIR))
+            .await
+            .unwrap();
+        let options = SqliteConnectOptions::new()
+            .filename(temp.path().join(DATABASE_FILE))
+            .create_if_missing(true)
+            .foreign_keys(false);
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect_with(options)
+            .await
+            .unwrap();
+        BACKUP_MIGRATOR.run(&pool).await.unwrap();
+        sqlx::query(
+            "INSERT INTO backup_snapshots
+             (id, instance_id, instance_name, created_at, file_count,
+              symlink_count, logical_size, added_size)
+             VALUES ('snapshot', 'missing', 'Missing', 0, 0, 0, 0, 0)",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        pool.close().await;
+
+        let error = validate_repository_at(temp.path()).await.unwrap_err();
+        assert!(error.to_string().contains("foreign key check"));
+    }
+
+    #[tokio::test]
+    async fn default_repository_follows_launcher_directory_move_idempotently() {
+        let temp = tempfile::tempdir().unwrap();
+        let source = temp.path().join("old/Backups/instances");
+        let destination = temp.path().join("new/Backups/instances");
+        let pool = open_repository_at(&source, true).await.unwrap().unwrap();
+        pool.close().await;
+
+        let pending = move_default_repository_for_launcher_directory(
+            &source,
+            &destination,
+        )
+        .await
+        .unwrap();
+        assert!(pending.is_none());
+        assert!(!source.exists());
+        validate_repository_at(&destination).await.unwrap();
+
+        let repeated = move_default_repository_for_launcher_directory(
+            &source,
+            &destination,
+        )
+        .await
+        .unwrap();
+        assert!(repeated.is_none());
+        validate_repository_at(&destination).await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn full_instance_scan_includes_future_content_and_honors_exclusions()
+    {
+        let temp = tempfile::tempdir().unwrap();
+        let instance = temp.path().join("instance");
+        let repository = temp.path().join("repository");
+        let staging = repository.join(STAGING_DIR).join("first");
+        tokio::fs::create_dir_all(instance.join("config"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(instance.join("caches"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(repository.join(OBJECTS_DIR))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(&staging).await.unwrap();
+        tokio::fs::write(instance.join("config/first.toml"), b"same")
+            .await
+            .unwrap();
+        tokio::fs::write(instance.join("config/bigdb.sqlite"), b"ignored")
+            .await
+            .unwrap();
+        tokio::fs::write(instance.join("caches/data.bin"), b"ignored")
+            .await
+            .unwrap();
+        tokio::fs::write(instance.join("options.txt"), b"root")
+            .await
+            .unwrap();
+        let exclusions = [
+            BackupExclusion {
+                path: "caches".to_string(),
+                kind: BackupExclusionKind::Directory,
+            },
+            BackupExclusion {
+                path: "config/bigdb.sqlite".to_string(),
+                kind: BackupExclusionKind::File,
+            },
+        ];
+
+        let mut first_objects = HashSet::new();
+        let (first_entries, first_added) = scan_snapshot(
+            &instance,
+            &repository,
+            &staging,
+            &exclusions,
+            Uuid::new_v4(),
+            "instance",
+            0,
+            &CancellationToken::new(),
+            &mut first_objects,
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            first_entries
+                .iter()
+                .filter(|entry| entry.kind == EntryKind::File)
+                .count(),
+            2
+        );
+        assert!(
+            first_entries
+                .iter()
+                .any(|entry| entry.path == "options.txt")
+        );
+        assert!(
+            !first_entries
+                .iter()
+                .any(|entry| entry.path.starts_with("caches"))
+        );
+        assert!(
+            !first_entries
+                .iter()
+                .any(|entry| entry.path == "config/bigdb.sqlite")
+        );
+        assert_eq!(first_added, 8);
+
+        tokio::fs::write(instance.join("config/second.toml"), b"new")
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(instance.join("logs"))
+            .await
+            .unwrap();
+        tokio::fs::write(instance.join("logs/latest.log"), b"future")
+            .await
+            .unwrap();
+        let second_staging = repository.join(STAGING_DIR).join("second");
+        tokio::fs::create_dir_all(&second_staging).await.unwrap();
+        let mut second_objects = HashSet::new();
+        let (second_entries, second_added) = scan_snapshot(
+            &instance,
+            &repository,
+            &second_staging,
+            &exclusions,
+            Uuid::new_v4(),
+            "instance",
+            0,
+            &CancellationToken::new(),
+            &mut second_objects,
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            second_entries
+                .iter()
+                .filter(|entry| entry.kind == EntryKind::File)
+                .count(),
+            4
+        );
+        assert!(
+            second_entries
+                .iter()
+                .any(|entry| entry.path == "logs/latest.log")
+        );
+        assert_eq!(second_added, 9, "only new content should be stored");
+        assert_eq!(second_objects.len(), 2);
+    }
+
+    #[tokio::test]
+    async fn deleting_last_snapshot_reference_collects_the_object() {
+        let temp = tempfile::tempdir().unwrap();
+        let repository = temp.path();
+        tokio::fs::create_dir_all(repository.join(OBJECTS_DIR))
+            .await
+            .unwrap();
+        let options = SqliteConnectOptions::new()
+            .filename(repository.join(DATABASE_FILE))
+            .create_if_missing(true)
+            .foreign_keys(true);
+        let pool = SqlitePoolOptions::new()
+            .max_connections(1)
+            .connect_with(options)
+            .await
+            .unwrap();
+        BACKUP_MIGRATOR.run(&pool).await.unwrap();
+        sqlx::query(
+            "INSERT INTO instance_backup_configs
+             (instance_id, instance_name, created_at, modified_at)
+             VALUES ('instance', 'Instance', 1, 1)",
+        )
+        .execute(&pool)
+        .await
+        .unwrap();
+        let hash = "a".repeat(64);
+        let object = object_path(repository, &hash);
+        tokio::fs::create_dir_all(object.parent().unwrap())
+            .await
+            .unwrap();
+        tokio::fs::write(&object, b"same").await.unwrap();
+        sqlx::query(
+            "INSERT INTO backup_objects (hash, size, ref_count)
+             VALUES (?, 4, 2)",
+        )
+        .bind(&hash)
+        .execute(&pool)
+        .await
+        .unwrap();
+        for snapshot in ["first", "second"] {
+            sqlx::query(
+                "INSERT INTO backup_snapshots
+                 (id, instance_id, instance_name, created_at, file_count,
+                  symlink_count, logical_size, added_size)
+                 VALUES (?, 'instance', 'Instance', 1, 1, 0, 4, 0)",
+            )
+            .bind(snapshot)
+            .execute(&pool)
+            .await
+            .unwrap();
+            sqlx::query(
+                "INSERT INTO snapshot_entries
+                 (snapshot_id, path, kind, object_hash, size)
+                 VALUES (?, 'config/file', 'file', ?, 4)",
+            )
+            .bind(snapshot)
+            .bind(&hash)
+            .execute(&pool)
+            .await
+            .unwrap();
+        }
+
+        delete_snapshots_in_pool(repository, &pool, Some("first"), None)
+            .await
+            .unwrap();
+        assert!(object.exists());
+        let ref_count: i64 = sqlx::query_scalar(
+            "SELECT ref_count FROM backup_objects WHERE hash = ?",
+        )
+        .bind(&hash)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert_eq!(ref_count, 1);
+
+        delete_snapshots_in_pool(repository, &pool, Some("second"), None)
+            .await
+            .unwrap();
+        assert!(!object.exists());
+        let exists: bool = sqlx::query_scalar(
+            "SELECT EXISTS(SELECT 1 FROM backup_objects WHERE hash = ?)",
+        )
+        .bind(&hash)
+        .fetch_one(&pool)
+        .await
+        .unwrap();
+        assert!(!exists);
+    }
+
+    #[tokio::test]
+    async fn interrupted_restore_rolls_back_every_selected_root() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("instance");
+        let operation_root = temp.path().join("operation");
+        tokio::fs::create_dir_all(operation_root.join("rollback/config"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(root.join("config"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(root.join("saves")).await.unwrap();
+        tokio::fs::write(
+            operation_root.join("rollback/config/value.txt"),
+            b"before",
+        )
+        .await
+        .unwrap();
+        tokio::fs::write(root.join("config/value.txt"), b"restored")
+            .await
+            .unwrap();
+        tokio::fs::write(root.join("saves/new.txt"), b"restored")
+            .await
+            .unwrap();
+
+        recover_restore_operation(
+            &root,
+            &operation_root,
+            &[
+                RestoreJournalRoot {
+                    path: "config".to_string(),
+                    had_current: true,
+                },
+                RestoreJournalRoot {
+                    path: "saves".to_string(),
+                    had_current: false,
+                },
+            ],
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(
+            tokio::fs::read(root.join("config/value.txt"))
+                .await
+                .unwrap(),
+            b"before"
+        );
+        assert!(!root.join("saves").exists());
+        assert!(!operation_root.exists());
+    }
+
+    #[tokio::test]
+    async fn interrupted_whole_root_restore_preserves_excluded_content() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("instance");
+        let operation_root = temp.path().join("operation");
+        let rollback_root = operation_root.join("rollback/instance");
+        tokio::fs::create_dir_all(rollback_root.join("config"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(root.join("caches"))
+            .await
+            .unwrap();
+        tokio::fs::write(rollback_root.join("config/value.txt"), b"before")
+            .await
+            .unwrap();
+        tokio::fs::write(root.join("config.txt"), b"restored")
+            .await
+            .unwrap();
+        tokio::fs::write(root.join("caches/data.bin"), b"preserved")
+            .await
+            .unwrap();
+
+        recover_whole_root_restore(
+            &root,
+            &operation_root,
+            &[BackupExclusion {
+                path: "caches".to_string(),
+                kind: BackupExclusionKind::Directory,
+            }],
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(
+            tokio::fs::read(root.join("config/value.txt"))
+                .await
+                .unwrap(),
+            b"before"
+        );
+        assert_eq!(
+            tokio::fs::read(root.join("caches/data.bin")).await.unwrap(),
+            b"preserved"
+        );
+        assert!(!root.join("config.txt").exists());
+        assert!(!operation_root.exists());
+    }
+
+    #[tokio::test]
+    async fn whole_root_restore_replaces_managed_content_and_keeps_exclusions()
+    {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("instance");
+        let operation_root = temp.path().join("operation");
+        tokio::fs::create_dir_all(root.join("caches"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(operation_root.join("staged/config"))
+            .await
+            .unwrap();
+        tokio::fs::create_dir_all(operation_root.join("rollback"))
+            .await
+            .unwrap();
+        tokio::fs::write(root.join("old.txt"), b"old")
+            .await
+            .unwrap();
+        tokio::fs::write(root.join("caches/data.bin"), b"preserved")
+            .await
+            .unwrap();
+        tokio::fs::write(
+            operation_root.join("staged/config/value.txt"),
+            b"snapshot",
+        )
+        .await
+        .unwrap();
+
+        replace_whole_root(
+            &root,
+            &operation_root,
+            &[BackupExclusion {
+                path: "caches".to_string(),
+                kind: BackupExclusionKind::Directory,
+            }],
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(
+            tokio::fs::read(root.join("config/value.txt"))
+                .await
+                .unwrap(),
+            b"snapshot"
+        );
+        assert_eq!(
+            tokio::fs::read(root.join("caches/data.bin")).await.unwrap(),
+            b"preserved"
+        );
+        assert!(!root.join("old.txt").exists());
+        assert_eq!(
+            tokio::fs::read(operation_root.join("rollback/instance/old.txt"))
+                .await
+                .unwrap(),
+            b"old"
+        );
+    }
+}
diff --git a/packages/app-lib/src/api/instance/lifecycle.rs b/packages/app-lib/src/api/instance/lifecycle.rs
index a8b14d6..097fbc3 100644
--- a/packages/app-lib/src/api/instance/lifecycle.rs
+++ b/packages/app-lib/src/api/instance/lifecycle.rs
@@ -103,6 +103,7 @@ pub async fn edit(
     patch: EditInstance,
 ) -> crate::Result<InstanceMetadata> {
     let state = State::get().await?;
+    super::ensure_backup_eligible_edit(instance_id, &patch).await?;
     crate::state::edit_instance(instance_id, patch, &state.pool).await?;
 
     let instance = crate::state::get_instance(instance_id, &state.pool)
diff --git a/packages/app-lib/src/api/instance/mod.rs b/packages/app-lib/src/api/instance/mod.rs
index 0886a37..8f5117c 100644
--- a/packages/app-lib/src/api/instance/mod.rs
+++ b/packages/app-lib/src/api/instance/mod.rs
@@ -1,5 +1,6 @@
 //! Theseus instance management interface
 
+mod backup;
 mod content;
 mod core_components;
 mod export_mrpack;
@@ -16,6 +17,33 @@ mod screenshot_groups;
 mod screenshots;
 mod upgrade;
 
+pub use self::backup::{
+    BackupDeleteSummary, BackupExclusion, BackupExclusionKind, BackupOperation,
+    BackupOperationState, BackupOperationType, BackupRepositoryStatus,
+    BackupRestorePreview, BackupSnapshot, InstanceBackupConfig,
+    InstanceBackupEligibility, cancel_backup,
+    delete_snapshot as delete_backup_snapshot, disable as disable_backups,
+    enable as enable_backups,
+    exclusion_from_absolute_path as get_backup_exclusion_from_path,
+    has_active_operations as has_active_backup_operations,
+    has_active_repository_move as has_active_backup_repository_move,
+    instance_config as get_backup_config,
+    instance_delete_summary as get_backup_delete_summary,
+    interrupt_active_operations as interrupt_active_backup_operations,
+    list_operations as list_backup_operations,
+    list_snapshots as list_backup_snapshots,
+    maintain_repository as maintain_backup_repository,
+    repository_status as get_backup_repository_status, restore_snapshot,
+    start_repository_move as move_backup_repository,
+    start_restore_preview as get_backup_restore_preview,
+    start_snapshot as start_backup_snapshot,
+    update_exclusions as update_backup_exclusions,
+};
+pub(crate) use self::backup::{
+    begin_instance_deletion, cancel_instance_deletion, delete_instance_backups,
+    ensure_backup_eligible_edit, has_active_instance_operation,
+    lock_instance_maintenance, move_default_repository_for_launcher_directory,
+};
 pub use self::content::{
     apply_content_update_plan, get_content_items, get_content_items_by_paths,
     get_content_snapshot, get_dependencies_as_content_items,
diff --git a/packages/app-lib/src/api/instance/run.rs b/packages/app-lib/src/api/instance/run.rs
index 7d51a16..b32fcb8 100644
--- a/packages/app-lib/src/api/instance/run.rs
+++ b/packages/app-lib/src/api/instance/run.rs
@@ -75,6 +75,15 @@ async fn run_with_extra_launch_args_inner(
     extra_launch_args: Option<Vec<String>>,
     gc_intent: Option<GcLaunchIntent>,
 ) -> crate::Result<(ProcessMetadata, Option<GcLaunchReport>)> {
+    if crate::api::instance::has_active_instance_operation(instance_id) {
+        return Err(crate::ErrorKind::InputError(
+            "Wait for the active backup operation to finish before launching this instance"
+                .to_string(),
+        )
+        .into());
+    }
+    let _maintenance_guard =
+        crate::api::instance::lock_instance_maintenance(instance_id).await;
     let _hosted_guard =
         crate::pack::hosted::prepare_launch(instance_id, offline_mode).await?;
     let state = State::get().await?;
diff --git a/packages/app-lib/src/event/emit.rs b/packages/app-lib/src/event/emit.rs
index 1c533d5..9b0f15a 100644
--- a/packages/app-lib/src/event/emit.rs
+++ b/packages/app-lib/src/event/emit.rs
@@ -1,8 +1,8 @@
 use super::{FriendPayload, LoadingBarId};
 use crate::event::{
-    CommandPayload, EventError, InstanceBulkUpdateProgressPayload,
-    InstancePayloadType, LoadingBar, LoadingBarType, ProcessPayloadType,
-    ServerPayloadType,
+    CommandPayload, EventError, InstanceBackupProgressPayload,
+    InstanceBulkUpdateProgressPayload, InstancePayloadType, LoadingBar,
+    LoadingBarType, ProcessPayloadType, ServerPayloadType,
 };
 #[cfg(feature = "tauri")]
 use crate::event::{
@@ -358,6 +358,21 @@ pub async fn emit_instance_bulk_update_progress(
     Ok(())
 }
 
+#[allow(unused_variables)]
+pub async fn emit_instance_backup_progress(
+    payload: InstanceBackupProgressPayload,
+) -> crate::Result<()> {
+    #[cfg(feature = "tauri")]
+    {
+        let event_state = crate::EventState::get()?;
+        event_state
+            .app
+            .emit("instance_backup_progress", payload)
+            .map_err(EventError::from)?;
+    }
+    Ok(())
+}
+
 // emit_command(CommandPayload::Something { something })
 // ie: installing a pack, opening an .mrpack, etc
 // Generally used for url deep links and file opens that we want to handle in the frontend
diff --git a/packages/app-lib/src/event/mod.rs b/packages/app-lib/src/event/mod.rs
index 5532814..a12e48f 100644
--- a/packages/app-lib/src/event/mod.rs
+++ b/packages/app-lib/src/event/mod.rs
@@ -248,6 +248,57 @@ pub enum InstanceBulkUpdateProgressStage {
     Finishing,
 }
 
+#[derive(Serialize, Clone)]
+#[serde(rename_all = "camelCase")]
+pub struct InstanceBackupProgressPayload {
+    pub operation_id: Uuid,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub instance_id: Option<String>,
+    pub operation_type: InstanceBackupOperationType,
+    pub stage: InstanceBackupProgressStage,
+    pub processed_bytes: u64,
+    pub total_bytes: u64,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub final_state: Option<InstanceBackupOperationFinalState>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub snapshot_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub message: Option<String>,
+}
+
+#[derive(Serialize, Clone, Copy)]
+#[serde(rename_all = "snake_case")]
+pub enum InstanceBackupOperationType {
+    Create,
+    Restore,
+    Delete,
+    RepositoryMove,
+    RestorePreview,
+}
+
+#[derive(Serialize, Clone, Copy)]
+#[serde(rename_all = "snake_case")]
+pub enum InstanceBackupOperationFinalState {
+    Completed,
+    Cancelled,
+    Failed,
+}
+
+#[derive(Serialize, Clone)]
+#[serde(rename_all = "snake_case")]
+pub enum InstanceBackupProgressStage {
+    Scanning,
+    Hashing,
+    Saving,
+    Validating,
+    Copying,
+    Restoring,
+    Deleting,
+    Completed,
+    Cancelled,
+    Failed,
+}
+
 #[derive(Serialize, Deserialize, Clone)]
 #[serde(tag = "event")]
 pub enum CommandPayload {
diff --git a/packages/app-lib/src/state/dirs.rs b/packages/app-lib/src/state/dirs.rs
index 5e173bb..eae7211 100644
--- a/packages/app-lib/src/state/dirs.rs
+++ b/packages/app-lib/src/state/dirs.rs
@@ -363,6 +363,32 @@ impl DirectoryInfo {
                     return Err(crate::ErrorKind::DirectoryMoveError(format!("Cannot move directory to {}: directory is not writable", move_dir.display())).into());
                 }
 
+                // If the user hasn't chosen a custom backup repository, the
+                // default one lives next to the launcher data. Move it along
+                // with the rest of the directory and queue a cleanup of the
+                // old copy on next startup.
+                if settings.backup_repository_path.is_none() {
+                    let old_repository =
+                        prev_dir.join("Backups").join("instances");
+                    let new_repository =
+                        move_dir.join("Backups").join("instances");
+                    if let Some(path) = crate::api::instance::move_default_repository_for_launcher_directory(
+                        &old_repository,
+                        &new_repository,
+                    )
+                    .await?
+                    {
+                        sqlx::query(
+                            "INSERT INTO pending_backup_repository_cleanups (path, created_at)
+                             VALUES (?, unixepoch('subsec') * 1000)
+                             ON CONFLICT(path) DO UPDATE SET created_at = excluded.created_at",
+                        )
+                        .bind(path.to_string_lossy().to_string())
+                        .execute(exec)
+                        .await?;
+                    }
+                }
+
                 const MOVE_DIRS: &[&str] = &[
                     CACHES_FOLDER_NAME,
                     INSTANCES_FOLDER_NAME,
diff --git a/packages/app-lib/src/state/instances/commands/remove_instance.rs b/packages/app-lib/src/state/instances/commands/remove_instance.rs
index 4b18b0b..8103ba1 100644
--- a/packages/app-lib/src/state/instances/commands/remove_instance.rs
+++ b/packages/app-lib/src/state/instances/commands/remove_instance.rs
@@ -9,7 +9,36 @@ pub(crate) async fn remove_instance(
     state: &State,
 ) -> crate::Result<()> {
     let _instance_lock = state.lock_instance_content(instance_id).await;
+    let _maintenance_guard =
+        crate::api::instance::lock_instance_maintenance(instance_id).await;
+    crate::api::instance::begin_instance_deletion(instance_id).await?;
 
+    let result = remove_instance_files_and_state(instance_id, state).await;
+
+    match result {
+        Ok(()) => {
+            crate::api::instance::delete_instance_backups(instance_id).await
+        }
+        Err(error) => {
+            if let Err(cancel_error) =
+                crate::api::instance::cancel_instance_deletion(instance_id)
+                    .await
+            {
+                tracing::warn!(
+                    instance_id,
+                    %cancel_error,
+                    "Failed to clear pending backup deletion marker"
+                );
+            }
+            Err(error)
+        }
+    }
+}
+
+async fn remove_instance_files_and_state(
+    instance_id: &str,
+    state: &State,
+) -> crate::Result<()> {
     let instance = instance_rows::get_instance_by_id(instance_id, &state.pool)
         .await?
         .ok_or_else(|| {
diff --git a/packages/app-lib/src/state/mod.rs b/packages/app-lib/src/state/mod.rs
index 18c5c70..3875ae1 100644
--- a/packages/app-lib/src/state/mod.rs
+++ b/packages/app-lib/src/state/mod.rs
@@ -623,7 +623,7 @@ impl State {
     }
 
     /// 在设置变更（如忽略 SSL 证书开关）后重建 HTTP 客户端。
-    pub(crate) async fn update_http_client_for_settings(
+    pub async fn update_http_client_for_settings(
         &self,
         settings: &Settings,
     ) -> crate::Result<()> {
diff --git a/packages/app-lib/src/state/process.rs b/packages/app-lib/src/state/process.rs
index 7d9a18e..adf5a7d 100644
--- a/packages/app-lib/src/state/process.rs
+++ b/packages/app-lib/src/state/process.rs
@@ -533,6 +533,13 @@ impl ProcessManager {
             .collect()
     }
 
+    /// Whether any tracked process belongs to the given instance.
+    pub fn has_instance_process(&self, instance_id: &str) -> bool {
+        self.processes
+            .iter()
+            .any(|entry| entry.value().metadata.instance_id == instance_id)
+    }
+
     pub fn try_wait(
         &self,
         id: Uuid,
diff --git a/packages/app-lib/src/state/settings.rs b/packages/app-lib/src/state/settings.rs
index 019ddf2..8ded758 100644
--- a/packages/app-lib/src/state/settings.rs
+++ b/packages/app-lib/src/state/settings.rs
@@ -145,6 +145,12 @@ pub struct Settings {
     #[serde(default = "default_ui_scale")]
     pub ui_scale: f64,
     #[serde(default)]
+    pub ui_font: Option<String>,
+    #[serde(default)]
+    pub backup_repository_path: Option<String>,
+    #[serde(default)]
+    pub mono_font: Option<String>,
+    #[serde(default)]
     pub close_behavior: String,
     #[serde(default)]
     pub auto_hide_downloads_button: bool,
@@ -289,6 +295,9 @@ impl Settings {
                 json(home_widgets) as \"home_widgets?: String\", auto_hide_downloads_button,
                 json(terracotta_public_nodes) terracotta_public_nodes,
                 ui_scale,
+                ui_font,
+                backup_repository_path,
+                mono_font,
                 version
             FROM settings
             "
@@ -362,6 +371,9 @@ impl Settings {
             transparent_background_blur: res.transparent_background_blur == 1,
             sidebar_instance_count: res.sidebar_instance_count as u32,
             ui_scale: res.ui_scale,
+            ui_font: res.ui_font,
+            backup_repository_path: res.backup_repository_path,
+            mono_font: res.mono_font,
             close_behavior,
             auto_hide_downloads_button: res.auto_hide_downloads_button == 1,
             home_layout: HomeLayout::from_string(&res.home_layout),
@@ -665,6 +677,20 @@ impl Settings {
             .bind(self.ui_scale)
             .execute(exec)
             .await?;
+        sqlx::query("UPDATE settings SET ui_font = ? WHERE id = 0")
+            .bind(&self.ui_font)
+            .execute(exec)
+            .await?;
+        sqlx::query(
+            "UPDATE settings SET backup_repository_path = ? WHERE id = 0",
+        )
+        .bind(&self.backup_repository_path)
+        .execute(exec)
+        .await?;
+        sqlx::query("UPDATE settings SET mono_font = ? WHERE id = 0")
+            .bind(&self.mono_font)
+            .execute(exec)
+            .await?;
         Ok(())
     }