Problem

archon setup unconditionally overwrites <repo>/.env on every run. No existence check, no backup, no confirmation prompt. Any user-added secrets — tokens, custom vars, credentials the wizard doesn't know about — are permanently lost.

This is a data-loss bug. .env is gitignored, so there is no recovery path; users rediscover the loss only when a platform adapter fails to authenticate and they have to re-collect every secret from scratch.

Where it happens

• packages/cli/src/commands/setup.ts:1311-1331 — writeEnvFiles() calls writeFileSync(repoEnvPath, content) unconditionally for both ~/.archon/.env and <repo>/.env.
• packages/cli/src/commands/setup.ts:1567-1614 — "Add platforms" mode makes it worse: the written SetupConfig is built from boolean presence flags returned by checkExistingConfig(), which never reads the actual values. Result on every "Add" run:
  • database is hardcoded to { type: 'sqlite' } → silently downgrades an existing PostgreSQL config
  • claudeApiKey / claudeOauthToken / codexTokens are undefined → auth lines are dropped from the regenerated file

Impact

• Lost secrets on every archon setup re-run touching an existing repo
• Silent PostgreSQL→SQLite downgrade in "Add" mode
• Forced re-collection of bot tokens, webhook secrets, API keys
• Happens on the documented onboarding path

Proposed Fix

1. Refuse to overwrite an existing non-empty <repo>/.env without explicit consent. Default to a timestamped backup + non-destructive merge (only add keys that don't already exist).
2. In "Add" mode, parse the existing file and carry all values forward; only write keys the user changed this run.
3. Explicit --force flag for users who actually want to regenerate.

Relationship to #1196

Same user journey, two angles:

• feat(cli/web): archon setup --init-repo — skill + .archon/ only, skip config wizard #1196: "Don't run the wizard at all when I just want the skill + .archon/ scaffold."
• This: "And when the wizard does run, it must not destroy my .env."

Landing #1196 avoids the overwrite for the scaffold-only path but doesn't fix it for users legitimately updating config. Both should ship — ideally together.

Severity

Data-loss bug → priority: high. No git history, no backup, no undo.

Definition of Done

• archon setup never silently overwrites a non-empty repo .env
• Existing values are preserved (merge) or backed up (.env.archon-backup-<ts>)
• "Add" mode reads existing values instead of regenerating from booleans
• --force flag for opt-in destructive rewrite
• Tests: fresh, merge-preserves-user-keys, add-mode-preserves-db-url, --force overwrites, --init-repo (feat(cli/web): archon setup --init-repo — skill + .archon/ only, skip config wizard #1196) never touches .env
• Cross-linked with feat(cli/web): archon setup --init-repo — skill + .archon/ only, skip config wizard #1196