The calendar-bucket point caught me out — I had always assumed keep-daily=7 meant seven days of coverage, not seven buckets that can stretch or shrink depending on when jobs actually ran. I have had a backup job fail quietly for weeks before, and the idea that the next successful run could then prune away the older copies is exactly the kind of thing you only discover when you need a restore. I now try to take a protected copy before any big change. Do you set that protected backup manually before an upgrade, or have you automated it somehow?