The machine's backups as the node-backup seat (novox/hq ADR 0214, to-be 43, ADR 0233): one restic repository on the machine, one restore point per module a night, thinned by the machine's settings. Against mistakes, not disasters: nothing leaves the machine.

How restore points are kept

A night's restore point is tagged with its module alone and thinned by keep-daily, keep-weekly and keep-monthly (14, 8 and 6 by default).
A restore point taken by hand (node-backup.now, asked by a person, or by the mesh before a module moves) is tagged hand as well. The thinning keeps that tag (--keep-tag hand), so the next night never takes it (novox/hq issue 453). It is let go, by its id, only when both hold: it is older than keep-hand-taken-days (7 by default), and a later night of its module was recorded as good. A partial night, where restic wrote a restore point but could not read every file, does not count.
A module that left the machine gets no later night, so its restore points taken by hand are kept for good. That is a choice: deleting a module's last restore point is a person's act, and until then it costs only space.

node-backup.backed-up lists each module's restore points taken by hand under handTaken: when each was taken, the time it is kept at least until, whether it still waits for a later good night, and a sentence saying so.