diff --git a/CHANGELOG.md b/CHANGELOG.md
index 427e1d07..668328c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,46 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ---
 
+## [1.19.2] — 2026-09-16
+
+> Bugfix-only release on the 1.19.0 stable line, following directly on
+> from v1.19.1. Adds a safety net for the macOS #825/#867 migration, plus
+> diagnostic logging to help track down a still-open, related report.
+
+### Fixed
+
+- **macOS: permanent in-place backup of `opensak.json` before the #825
+  migration touches anything (fixes #870)** — A real user (Mike Wood)
+  reported that his settings file (`opensak.json`) — username, home
+  coordinates, everything — disappeared entirely after upgrading on
+  macOS, despite the file-move logic itself behaving correctly when
+  traced step by step. The exact cause of the disappearance is still
+  under investigation, but regardless of that cause, there was no reason
+  a user should ever need a system backup to recover: the migration
+  already has the original file in hand for a moment before doing
+  anything to it. It now leaves a permanent copy
+  (`opensak.json.pre-825-migration-backup`) behind, in place, in the old
+  directory — explicitly excluded from the move/cleanup logic so it can
+  never be swept away by the same process, or by anything that happens
+  afterward. Previously, recovering from this required a Time Machine
+  (or similar) backup of a hidden path most backup tools don't cover by
+  default; this user was only able to recover in full because he
+  happened to have one.
+
+### Added
+
+- **Diagnostic logging for the macOS migration and database-manager
+  fallback (#870)** — Two new debug-log channels (`settings_migration`,
+  `db_manager`), enabled by default for now, trace exactly what the
+  #825/#867 migration finds and does at each step, and log a clear
+  warning at the precise moment `DatabaseManager` falls back to creating
+  a fresh, empty "Default" database because it couldn't find any
+  database it recognised. If this happens to you, `opensak.log` will now
+  show what your settings actually contained right before that point —
+  please attach it if you report a similar issue.
+
+---
+
 ## [1.19.1] — 2026-09-15
 
 > Bugfix-only release on the 1.19.0 stable line. Fixes a data-loss-looking
diff --git a/site/assets/screenshots/main-window.png b/site/assets/screenshots/main-window.png
index d06a2e0f..2fe2f0c3 100644
Binary files a/site/assets/screenshots/main-window.png and b/site/assets/screenshots/main-window.png differ
diff --git a/site/assets/screenshots/map-maximized.png b/site/assets/screenshots/map-maximized.png
index 6ddc1998..f8f6f390 100644
Binary files a/site/assets/screenshots/map-maximized.png and b/site/assets/screenshots/map-maximized.png differ
diff --git a/site/assets/screenshots/map-popout.png b/site/assets/screenshots/map-popout.png
index 1ce3a73f..040db706 100644
Binary files a/site/assets/screenshots/map-popout.png and b/site/assets/screenshots/map-popout.png differ
diff --git a/site/user-guide.html b/site/user-guide.html
index baded276..d31d68a5 100644
--- a/site/user-guide.html
+++ b/site/user-guide.html
@@ -3,7 +3,7 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>OpenSAK User Guide — v1.19.1</title>
+<title>OpenSAK User Guide — v1.19.2</title>
 <style>
   @import url('https://fonts.googleapis.com/css2?family=Playfair+Display:wght@700&family=Source+Serif+4:ital,wght@0,300;0,400;0,600;1,400&family=JetBrains+Mono:wght@400;500&display=swap');
 
@@ -473,7 +473,7 @@
 <nav>
   <div class="nav-header">
     <span class="nav-logo">OpenSAK</span>
-    <div class="nav-version">User Guide · v1.19.1</div>
+    <div class="nav-version">User Guide · v1.19.2</div>
   </div>
 
   <div class="nav-section-heading">Getting Started</div>
@@ -535,7 +535,7 @@
     <div class="hero-eyebrow">Complete User Guide</div>
     <h1>OpenSAK</h1>
     <p class="hero-sub">The open-source geocache management tool for Windows, Linux, and macOS.</p>
-    <div class="hero-meta">Version 1.19.1 &nbsp;·&nbsp; MIT Licence &nbsp;·&nbsp; <a href="https://github.com/OpenSAK-Org/opensak">github.com/OpenSAK-Org/opensak</a></div>
+    <div class="hero-meta">Version 1.19.2 &nbsp;·&nbsp; MIT Licence &nbsp;·&nbsp; <a href="https://github.com/OpenSAK-Org/opensak">github.com/OpenSAK-Org/opensak</a></div>
   </div>
 
   <figure class="screenshot" style="margin-top:-0.5rem;">
@@ -1463,7 +1463,7 @@ <h3>Debug Log</h3>
         <tr><td>Bug reports &amp; feature requests</td><td><a href="https://github.com/OpenSAK-Org/opensak/issues">github.com/OpenSAK-Org/opensak/issues</a></td></tr>
         <tr><td>Community discussion</td><td><a href="https://www.facebook.com/groups/opensak">Facebook group: OpenSAK</a></td></tr>
         <tr><td>Releases &amp; downloads</td><td><a href="https://github.com/OpenSAK-Org/opensak/releases">github.com/OpenSAK-Org/opensak/releases</a></td></tr>
-        <tr><td>Changelog</td><td><a href="https://github.com/OpenSAK-Org/opensak/blob/v1.19.1/CHANGELOG.md">CHANGELOG.md on GitHub</a></td></tr>
+        <tr><td>Changelog</td><td><a href="https://github.com/OpenSAK-Org/opensak/blob/v1.19.2/CHANGELOG.md">CHANGELOG.md on GitHub</a></td></tr>
         <tr><td>Contributing</td><td><a href="https://github.com/OpenSAK-Org/opensak/blob/main/CONTRIBUTING.md">CONTRIBUTING.md on GitHub</a></td></tr>
         <tr><td>Support the project</td><td><a href="https://opencollective.com/opensak">opencollective.com/opensak</a></td></tr>
         <tr><td>Website</td><td><a href="https://opensak.com">opensak.com</a></td></tr>
@@ -1473,7 +1473,7 @@ <h3>Debug Log</h3>
     <div class="callout tip"><div class="callout-icon">💡</div><div>OpenSAK is free and open-source software released under the MIT licence. Contributions of any kind — code, translations, documentation, or testing — are very welcome.</div></div>
 
     <p style="margin-top:2rem;color:var(--ink-light);font-size:0.85rem;font-style:italic;">
-      This guide was generated from the OpenSAK source code (v1.19.1). Last updated August 2026.
+      This guide was generated from the OpenSAK source code (v1.19.2). Last updated August 2026.
     </p>
   </section>
 
diff --git a/src/opensak/__init__.py b/src/opensak/__init__.py
index edddafb7..b82cd94f 100644
--- a/src/opensak/__init__.py
+++ b/src/opensak/__init__.py
@@ -1,4 +1,4 @@
 """OpenSAK — cross-platform geocache management tool."""
-__version__ = "1.19.1"
+__version__ = "1.19.2"
 __author__ = "OpenSAK Contributors"
 __license__ = "MIT"
diff --git a/src/opensak/db/manager.py b/src/opensak/db/manager.py
index ff02d274..ed7f835a 100644
--- a/src/opensak/db/manager.py
+++ b/src/opensak/db/manager.py
@@ -21,6 +21,13 @@
 
 logger = logging.getLogger(__name__)
 
+# Issue #870: detaljeret sporing af hvad der reelt indlæses fra settings.
+# Tavs medmindre "db_manager"-flaget er aktivt i debug_flags.py. De
+# ovenstående logger.warning()-kald forbliver altid synlige uanset flag.
+from opensak.logger import get_logger
+
+_debug_log = get_logger("db_manager")
+
 _SQLITE_MAGIC = b"SQLite format 3\x00"
 
 
@@ -137,6 +144,12 @@ def _load_from_settings(self) -> None:
         """Indlæs liste over kendte databaser fra opensak.json."""
         store = get_store()
         db_list = store.get("databases.list", [])
+        raw_active_path = store.get("databases.active")
+        _debug_log.debug(
+            "_load_from_settings: databases.list=%r, databases.active=%r, "
+            "databases.dir=%r",
+            db_list, raw_active_path, store.get("databases.dir"),
+        )
         if isinstance(db_list, list):
             for entry in db_list:
                 if isinstance(entry, dict):
@@ -144,14 +157,23 @@ def _load_from_settings(self) -> None:
                     path = entry.get("path")
                     if name and path:
                         migrated = self._migrate_path(Path(path))
+                        _debug_log.debug(
+                            "_load_from_settings: database %r -> %s "
+                            "(oprindelig sti %r, findes på disk: %s)",
+                            name, migrated, path, migrated.exists(),
+                        )
                         info = DatabaseInfo(name, migrated)
                         self._databases.append(info)
 
         # Aktiv database
-        active_path = store.get("databases.active")
+        active_path = raw_active_path
         if active_path:
             migrated_active = self._migrate_path(Path(active_path))
             found = self._find_by_path(migrated_active)
+            _debug_log.debug(
+                "_load_from_settings: aktiv sti %r -> %s, matchede en kendt "
+                "database: %s", active_path, migrated_active, found is not None,
+            )
             if found:
                 self._active = found
 
@@ -161,12 +183,25 @@ def _load_from_settings(self) -> None:
         # Hvis ingen databaser kendes, opret Default
         if not self._databases:
             default_path = self._default_db_path()
+            logger.warning(
+                "Ingen kendte databaser fundet i settings (databases.list var "
+                "%r, databases.active var %r) — opretter en frisk, tom "
+                "'Default'-database på %s. Hvis brugeren forventede en "
+                "eksisterende database, ligger den sandsynligvis stadig "
+                "urørt et andet sted på disken (se issue #870).",
+                db_list, raw_active_path, default_path,
+            )
             default = DatabaseInfo("Default", default_path)
             self._databases.append(default)
             self._active = default
             self._save_to_settings()
         elif self._active is None:
             # Databaser kendes men ingen aktiv — brug den første
+            _debug_log.debug(
+                "_load_from_settings: %d database(r) kendt, men ingen aktiv "
+                "— bruger den første: %r", len(self._databases),
+                self._databases[0].name,
+            )
             self._active = self._databases[0]
             self._save_to_settings()
 
diff --git a/src/opensak/debug_flags.py b/src/opensak/debug_flags.py
index 44fc1a84..ecd21cbb 100644
--- a/src/opensak/debug_flags.py
+++ b/src/opensak/debug_flags.py
@@ -17,12 +17,14 @@
 # Hvert modul der ønsker debug-logging skal have en nøgle her.
 # Nøglen bruges som logger-navn: logging.getLogger(f"opensak.{key}")
 DEBUG_MODULES: dict[str, bool] = {
-    "updater":          True,   # update checker — aktiveret for #204
-    "importer":         False,  # GPX/PQ import
-    "filter_engine":    False,  # filter beregning
-    "map_widget":       False,  # Leaflet/kort
-    "database":         False,  # SQLAlchemy queries
-    "geo":              False,  # reverse geocoding (boundaries, packs, store)
+    "updater":            True,   # update checker — aktiveret for #204
+    "importer":           False,  # GPX/PQ import
+    "filter_engine":      False,  # filter beregning
+    "map_widget":         False,  # Leaflet/kort
+    "database":           False,  # SQLAlchemy queries
+    "geo":                False,  # reverse geocoding (boundaries, packs, store)
+    "settings_migration": True,   # macOS #825/#867/#870-migration — aktiveret indtil #870's rodårsag er fundet
+    "db_manager":         True,   # DatabaseManager load/fallback-diagnostik — aktiveret indtil #870's rodårsag er fundet
 }
 
 
diff --git a/src/opensak/settings_store.py b/src/opensak/settings_store.py
index dd231fe0..02a16857 100644
--- a/src/opensak/settings_store.py
+++ b/src/opensak/settings_store.py
@@ -25,6 +25,12 @@
 from pathlib import Path
 from typing import Any
 
+# Issue #870: diagnostik for macOS-migreringen (#825/#867). Tavs medmindre
+# "settings_migration"-flaget er aktivt i debug_flags.py.
+from opensak.logger import get_logger
+
+_log = get_logger("settings_migration")
+
 
 # ── Bootstrap-sti ─────────────────────────────────────────────────────────────
 
@@ -494,43 +500,111 @@ def _rewrite_stale_install_dir_paths(
     have fuldført korrekt.
     """
     if not json_path.exists():
+        _log.debug("_rewrite_stale_install_dir_paths: %s findes ikke — intet at rette",
+                    json_path)
         return
     try:
         data = json.loads(json_path.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError):
+    except (json.JSONDecodeError, OSError) as exc:
+        _log.debug("_rewrite_stale_install_dir_paths: kunne ikke læse/parse "
+                    "%s (%s) — springer over", json_path, exc)
         return
     if not isinstance(data, dict):
+        _log.debug("_rewrite_stale_install_dir_paths: %s indeholder ikke et "
+                    "JSON-objekt — springer over", json_path)
         return
 
     old_str = str(old_prefix)
     new_str = str(new_prefix)
     changed = False
+    rewritten: list[str] = []
 
-    def _rewrite(value: Any) -> Any:
+    def _rewrite(value: Any, field: str) -> Any:
         nonlocal changed
         if isinstance(value, str) and value.startswith(old_str):
             changed = True
-            return new_str + value[len(old_str):]
+            new_value = new_str + value[len(old_str):]
+            rewritten.append(f"{field}: {value!r} -> {new_value!r}")
+            return new_value
         return value
 
     db_list = data.get("databases.list")
     if isinstance(db_list, list):
-        for entry in db_list:
+        for i, entry in enumerate(db_list):
             if isinstance(entry, dict) and "path" in entry:
-                entry["path"] = _rewrite(entry["path"])
+                entry["path"] = _rewrite(entry["path"], f"databases.list[{i}].path")
 
     if "databases.active" in data:
-        data["databases.active"] = _rewrite(data["databases.active"])
+        data["databases.active"] = _rewrite(data["databases.active"], "databases.active")
 
     if "databases.dir" in data:
-        data["databases.dir"] = _rewrite(data["databases.dir"])
+        data["databases.dir"] = _rewrite(data["databases.dir"], "databases.dir")
 
     if changed:
+        _log.debug("_rewrite_stale_install_dir_paths: retter %d felt(er) i %s: %s",
+                    len(rewritten), json_path, "; ".join(rewritten))
         try:
             _atomic_write(json_path, data)
         except OSError as exc:
             print(f"[settings] macOS-migration: kunne ikke genskrive "
                   f"stale stier i {json_path}: {exc}")
+            _log.debug("_rewrite_stale_install_dir_paths: _atomic_write af %s "
+                        "fejlede: %s", json_path, exc)
+    else:
+        _log.debug("_rewrite_stale_install_dir_paths: ingen stale stier fundet i %s "
+                    "(prefix %s)", json_path, old_str)
+
+
+_PRE_MIGRATION_BACKUP_NAME = "opensak.json.pre-825-migration-backup"
+
+
+def _backup_opensak_json_in_place(source_dir: Path) -> None:
+    """
+    Efterlad en permanent kopi af `opensak.json` i `source_dir`, FØR
+    migreringen rører noget som helst.
+
+    Baggrund: et rigtigt brugertilfælde (Mike, sep. 2026) viste at selve
+    filflytningen kan lykkes perfekt, og det færdigmigrerede opensak.json
+    alligevel efterfølgende gå tabt af en helt anden, endnu ikke fuldt
+    forstået årsag (formentlig en efterfølgende kørsel der ikke fandt
+    filen på det forventede tidspunkt). Uden en backup er brugerens
+    user.gc_username, hjemme-koordinater m.fl. i så fald definitivt væk —
+    kun bekræftet gendannet i praksis, fordi brugeren tilfældigvis havde
+    en Time Machine-backup af netop denne skjulte sti.
+
+    Denne funktion garanterer at en kopi altid bliver liggende, urørt, i
+    den ORIGINALE mappe — uafhængigt af om selve migreringen, eller noget
+    efter den, går galt. Filen flyttes/slettes ALDRIG af oprydnings-
+    logikken bagefter, netop fordi den gør mappen ikke-tom.
+
+    Kun `opensak.json` (typisk << 1 MB) sikkerhedskopieres — IKKE
+    databasefiler, som kan være mange GB og allerede håndteres af den
+    normale flytte-logik.
+
+    Best-effort: fejler stille (ingen exception) hvis kilden mangler,
+    allerede er sikkerhedskopieret, eller kopiering af en eller anden
+    grund ikke lykkes — dette må aldrig kunne forhindre selve
+    migreringen i at fortsætte.
+    """
+    source = source_dir / "opensak.json"
+    if not source.exists():
+        _log.debug("_backup_opensak_json_in_place: %s findes ikke — intet at "
+                    "sikkerhedskopiere", source)
+        return
+    backup = source_dir / _PRE_MIGRATION_BACKUP_NAME
+    if backup.exists():
+        _log.debug("_backup_opensak_json_in_place: backup findes allerede "
+                    "(%s) — springer over", backup)
+        return  # allerede sikkerhedskopieret (fx ved en tidligere, afbrudt kørsel)
+    try:
+        shutil.copy2(str(source), str(backup))
+        _log.debug("_backup_opensak_json_in_place: backup taget: %s -> %s "
+                    "(%d bytes)", source, backup, backup.stat().st_size)
+    except OSError as exc:
+        print(f"[settings] macOS-migration: kunne ikke tage backup af "
+              f"{source}: {exc}")
+        _log.debug("_backup_opensak_json_in_place: kopiering af %s fejlede: %s",
+                    source, exc)
 
 
 def migrate_macos_default_paths() -> bool:
@@ -564,12 +638,23 @@ def migrate_macos_default_paths() -> bool:
 
     new_bootstrap = _bootstrap_path()
     if new_bootstrap.exists():
+        _log.debug("migrate_macos_default_paths: %s findes allerede — "
+                    "intet at migrere", new_bootstrap)
         return False  # allerede migreret, eller frisk install på korrekt sti
 
     old_bootstrap = _legacy_macos_bootstrap_path()
     old_default_install = _legacy_macos_default_install_dir()
 
+    _log.debug(
+        "migrate_macos_default_paths: start — old_bootstrap=%s (exists=%s), "
+        "old_default_install=%s (exists=%s)",
+        old_bootstrap, old_bootstrap.exists(),
+        old_default_install, old_default_install.exists(),
+    )
+
     if not old_bootstrap.exists() and not old_default_install.exists():
+        _log.debug("migrate_macos_default_paths: hverken gammel bootstrap "
+                    "eller gammel install-mappe findes — helt frisk install")
         return False  # intet at migrere — helt frisk installation
 
     migrated_something = False
@@ -584,38 +669,59 @@ def migrate_macos_default_paths() -> bool:
             candidate = data.get("install_dir")
             if candidate:
                 actual_install_dir = Path(candidate)
-        except (json.JSONDecodeError, OSError):
-            pass
+        except (json.JSONDecodeError, OSError) as exc:
+            _log.debug("migrate_macos_default_paths: kunne ikke læse gammel "
+                        "bootstrap %s (%s) — bruger standard-sti", old_bootstrap, exc)
 
     if actual_install_dir == old_default_install:
+        _log.debug("migrate_macos_default_paths: standard-sti-gren "
+                    "(actual_install_dir == old_default_install = %s)",
+                    old_default_install)
         # Standard-sti — flyt selve indholdet (opensak.json, databaser osv.)
         # til den nye standard-sti. Samme "best-effort, spring kollisioner
         # over"-mønster som _move_remaining_install_dir_contents() i
         # velkomst-wizarden (issue #562).
         new_install_dir = _default_install_dir()
         if old_default_install.exists():
+            _backup_opensak_json_in_place(old_default_install)
             new_install_dir.mkdir(parents=True, exist_ok=True)
             try:
                 entries = list(old_default_install.iterdir())
-            except OSError:
+            except OSError as exc:
+                _log.debug("migrate_macos_default_paths: kunne ikke liste "
+                            "%s: %s", old_default_install, exc)
                 entries = []
+            _log.debug("migrate_macos_default_paths: indhold fundet i %s: %s "
+                        "(backup-filen '%s' flyttes ikke, bliver liggende i "
+                        "den gamle mappe)", old_default_install,
+                        [e.name for e in entries], _PRE_MIGRATION_BACKUP_NAME)
             for entry in entries:
+                if entry.name == _PRE_MIGRATION_BACKUP_NAME:
+                    continue  # skal blive liggende urørt i den GAMLE mappe
                 target = new_install_dir / entry.name
                 if target.exists():
+                    _log.debug("migrate_macos_default_paths: kollision på %s "
+                                "— springer over, rører intet", target)
                     continue  # kollision — rør det ikke, behold begge som de er
                 try:
                     shutil.move(str(entry), str(target))
                     migrated_something = True
+                    _log.debug("migrate_macos_default_paths: flyttede %s -> %s",
+                                entry, target)
                 except OSError as exc:
                     print(f"[settings] macOS-migration: kunne ikke flytte "
                           f"{entry} → {target}: {exc}")
+                    _log.debug("migrate_macos_default_paths: flytning af %s "
+                                "-> %s fejlede: %s", entry, target, exc)
             try:
                 if not any(old_default_install.iterdir()):
                     old_default_install.rmdir()
+                    _log.debug("migrate_macos_default_paths: %s var tom og "
+                                "blev fjernet", old_default_install)
             except OSError:
                 pass
 
-            # Issue #XXX: databases.list/.active/.dir i opensak.json
+            # Issue #867: databases.list/.active/.dir i opensak.json
             # indeholder absolutte stier under den gamle mappe, som
             # ovenstående filflytning ikke selv retter — uden dette leder
             # DatabaseManager efter databasen på en sti der ikke længere
@@ -628,7 +734,11 @@ def migrate_macos_default_paths() -> bool:
     else:
         # Brugervalgt mappe — indholdet er ikke ramt af bug'en, kun
         # bootstrap.json's egen (forkerte) placering skal rettes.
+        _log.debug("migrate_macos_default_paths: brugervalgt install-mappe-gren "
+                    "— actual_install_dir=%s (rører ikke indholdet)",
+                    actual_install_dir)
         new_install_dir = actual_install_dir
+        _backup_opensak_json_in_place(actual_install_dir)
 
     # Skriv bootstrap.json på den nye, korrekte sti, pegende på den
     # (evt. flyttede) installationsmappe.
@@ -651,6 +761,14 @@ def migrate_macos_default_paths() -> bool:
         print(f"[settings] macOS-sti migreret: {old_default_install} → "
               f"{new_install_dir}")
 
+    _log.debug(
+        "migrate_macos_default_paths: færdig — migrated_something=%s, "
+        "new_install_dir=%s, new_bootstrap=%s (findes=%s), indhold i "
+        "new_install_dir=%s",
+        migrated_something, new_install_dir, new_bootstrap, new_bootstrap.exists(),
+        sorted(p.name for p in new_install_dir.iterdir()) if new_install_dir.exists() else None,
+    )
+
     return migrated_something
 
 
diff --git a/tests/unit-tests/test_settings_store.py b/tests/unit-tests/test_settings_store.py
index e80e4f9a..74e32235 100644
--- a/tests/unit-tests/test_settings_store.py
+++ b/tests/unit-tests/test_settings_store.py
@@ -485,14 +485,18 @@ def test_default_install_dir_windows_msix_packaged_uses_documents(self, monkeypa
 
 # ── macOS default-path migration (issue #825) ──────────────────────────────
 
+def _patch_macos_platform(monkeypatch, home: Path):
+    """Common setup: pretend to be macOS, rooted at a temp $HOME."""
+    monkeypatch.setattr(ss.sys, "platform", "darwin")
+    monkeypatch.setattr(ss.os, "name", "posix")
+    monkeypatch.setattr(ss.Path, "home", lambda: home)
+    monkeypatch.delenv("XDG_CONFIG_HOME", raising=False)
+    monkeypatch.delenv("XDG_DATA_HOME", raising=False)
+
+
 class TestMigrateMacosDefaultPaths:
     def _patch_platform(self, monkeypatch, home: Path):
-        """Common setup: pretend to be macOS, rooted at a temp $HOME."""
-        monkeypatch.setattr(ss.sys, "platform", "darwin")
-        monkeypatch.setattr(ss.os, "name", "posix")
-        monkeypatch.setattr(ss.Path, "home", lambda: home)
-        monkeypatch.delenv("XDG_CONFIG_HOME", raising=False)
-        monkeypatch.delenv("XDG_DATA_HOME", raising=False)
+        _patch_macos_platform(monkeypatch, home)
 
     def test_noop_on_non_macos(self, monkeypatch, tmp_path):
         monkeypatch.setattr(ss.sys, "platform", "linux")
@@ -531,8 +535,11 @@ def test_migrates_default_path_contents(self, monkeypatch, tmp_path):
         new_dir = ss._default_install_dir()
         assert (new_dir / "opensak.json").exists()
         assert (new_dir / "MyCaches.sqlite").read_text(encoding="utf-8") == "dummy-db"
-        # Old dir should be cleaned up once empty.
-        assert not old_dir.exists()
+        # Old dir is now intentionally kept (not rmdir'd) because a
+        # permanent opensak.json backup lives there for safety (see
+        # TestBackupOpensakJsonInPlace) — it's no longer "empty" by design.
+        assert old_dir.exists()
+        assert sorted(p.name for p in old_dir.iterdir()) == [ss._PRE_MIGRATION_BACKUP_NAME]
         # New bootstrap.json must point at the new default install dir.
         new_bootstrap_data = json.loads(ss._bootstrap_path().read_text(encoding="utf-8"))
         assert Path(new_bootstrap_data["install_dir"]) == new_dir
@@ -661,3 +668,71 @@ def test_rewrite_helper_invalid_json_is_safe(self, tmp_path):
         bad.write_text("{not valid json", encoding="utf-8")
         ss._rewrite_stale_install_dir_paths(bad, tmp_path / "old", tmp_path / "new")
         assert bad.read_text(encoding="utf-8") == "{not valid json"  # left untouched
+
+
+class TestBackupOpensakJsonInPlace:
+    """
+    Regression tests for the pre-migration backup safety net added after a
+    real macOS user (Mike, Sep 2026) had a fully-migrated opensak.json go
+    missing for reasons unrelated to the move itself. The backup exists so
+    that scenario is always recoverable directly from the user's own
+    machine, without needing a Time Machine backup.
+    """
+
+    @posix_only
+    def test_backup_left_behind_and_survives_new_copy_being_lost(
+        self, monkeypatch, tmp_path
+    ):
+        _patch_macos_platform(monkeypatch, tmp_path)
+        old_dir = ss._legacy_macos_default_install_dir()
+        old_dir.mkdir(parents=True)
+        original_content = json.dumps({"user.gc_username": "MikeWood"})
+        (old_dir / "opensak.json").write_text(original_content, encoding="utf-8")
+
+        assert ss.migrate_macos_default_paths() is True
+
+        backup = old_dir / ss._PRE_MIGRATION_BACKUP_NAME
+        assert backup.exists()
+        assert backup.read_text(encoding="utf-8") == original_content
+
+        # Simulate whatever later wiped Mike's migrated settings file —
+        # the backup must be completely unaffected.
+        new_dir = ss._default_install_dir()
+        (new_dir / "opensak.json").unlink()
+        assert backup.exists()
+        assert backup.read_text(encoding="utf-8") == original_content
+
+    @posix_only
+    def test_backup_not_swept_up_by_the_generic_move_loop(self, monkeypatch, tmp_path):
+        """
+        The backup file is created inside the same directory the generic
+        move loop iterates over — it must explicitly skip it, or the
+        'permanent, in-place' guarantee is broken.
+        """
+        _patch_macos_platform(monkeypatch, tmp_path)
+        old_dir = ss._legacy_macos_default_install_dir()
+        old_dir.mkdir(parents=True)
+        (old_dir / "opensak.json").write_text("{}", encoding="utf-8")
+
+        ss.migrate_macos_default_paths()
+
+        new_dir = ss._default_install_dir()
+        assert not (new_dir / ss._PRE_MIGRATION_BACKUP_NAME).exists()
+        assert (old_dir / ss._PRE_MIGRATION_BACKUP_NAME).exists()
+
+    def test_noop_when_source_missing(self, tmp_path):
+        """Must not raise or create anything if there's no opensak.json to back up."""
+        ss._backup_opensak_json_in_place(tmp_path)
+        assert not (tmp_path / ss._PRE_MIGRATION_BACKUP_NAME).exists()
+
+    def test_does_not_overwrite_an_existing_backup(self, tmp_path):
+        """A second call (e.g. an interrupted earlier run) must not clobber
+        an existing backup with different/newer content."""
+        (tmp_path / "opensak.json").write_text('{"v": 2}', encoding="utf-8")
+        (tmp_path / ss._PRE_MIGRATION_BACKUP_NAME).write_text(
+            '{"v": 1}', encoding="utf-8"
+        )
+        ss._backup_opensak_json_in_place(tmp_path)
+        assert (tmp_path / ss._PRE_MIGRATION_BACKUP_NAME).read_text(
+            encoding="utf-8"
+        ) == '{"v": 1}'
