R-1251: sync the restore copy's folders before the marker names it (a cut left undo.json as .tmp on Tester 1); the interrupted-restore record says the put-back waits, not 'run it again'. Commit only.

controller/cmd/controller/main.go

@@ -602,11 +602,11 @@ func main() {
 			logger.Printf("[ERROR] [backup] leftover second-drive copy check: %v", err)
 		}
 		// R-550: load the persisted restore record BEFORE any page can ask for it.
-		var putBack []string
+		var putBack, waiting []string
 		if appStopRecovery != nil {
-			putBack = appStopRecovery.PutBack
+			putBack, waiting = appStopRecovery.PutBack, appStopRecovery.Waiting
 		}
-		interruptedRestore = loadRestoreRecordAtStartup(backupMgr, cfg.Paths.DataDir, logger, putBack)
+		interruptedRestore = loadRestoreRecordAtStartup(backupMgr, cfg.Paths.DataDir, logger, putBack, waiting)
 		// R-519: an app-data run the stop cut off is said on the backup pages until the next complete run.
 		loadRunRecordAtStartup(backupMgr, cfg.Paths.DataDir, logger)
 		// R-166: use the guard that already ran Recover at startup, not a second one over the same

controller/cmd/controller/restore_record_wiring.go

@@ -24,14 +24,15 @@ type restoreEventPusher interface {
 }
 
 // loadRestoreRecordAtStartup wires persistence and returns the restore the last stop interrupted.
-// putBack names the apps the crash recovery put back (AppStopRecovery.PutBack, D22 / R-1195).
-func loadRestoreRecordAtStartup(mgr *backup.Manager, dataDir string, logger *log.Logger, putBack []string) *backup.RestoreOpResult {
+// putBack names the apps the crash recovery put back (AppStopRecovery.PutBack, D22 / R-1195); waiting those whose
+// put-back waits for their drive (AppStopRecovery.Waiting, R-1251).
+func loadRestoreRecordAtStartup(mgr *backup.Manager, dataDir string, logger *log.Logger, putBack, waiting []string) *backup.RestoreOpResult {
 	if mgr == nil {
 		return nil
 	}
 	path := filepath.Join(dataDir, restoreRecordFileName)
 	mgr.SetRestoreRecordPath(path)
-	res := mgr.LoadRestoreRecordAfterRecovery(putBack)
+	res := mgr.LoadRestoreRecordAfterRecovery(putBack, waiting)
 	if logger != nil {
 		logger.Printf("[INFO] [backup] restore record wired: %s (interrupted at startup: %t)", path, res != nil)
 	}
@@ -43,10 +44,11 @@ func reportInterruptedRestore(p restoreEventPusher, res *backup.RestoreOpResult)
 	if p == nil || res == nil {
 		return
 	}
-	if res.PutBack {
+	if res.PutBack || res.PutBackWaiting {
 		// D22 / R-1195: the data is back as before the restore — the record's own sentence, in the box's language.
+		// R-1251: or it is put back when the drive is there; „start it again" would restore the backup over it.
 		p.PushEvent("restore_interrupted", "warning", res.Stack+": "+res.Message,
-			map[string]any{"stack": res.Stack, "op": res.Op, "put_back": true})
+			map[string]any{"stack": res.Stack, "op": res.Op, "put_back": res.PutBack, "put_back_waiting": res.PutBackWaiting})
 		return
 	}
 	p.PushEvent("restore_interrupted", "warning",

controller/cmd/controller/restore_record_wiring_test.go

@@ -33,13 +33,13 @@ func TestRestoreRecordAtStartup_RaisesInterruptedOnce(t *testing.T) {
 	before.BeginRestoreOp("restore", "gokapi") // the box stops here
 
 	rec := &pushRecorder{}
-	reportInterruptedRestore(rec, loadRestoreRecordAtStartup(new(backup.Manager), dir, lg, nil))
+	reportInterruptedRestore(rec, loadRestoreRecordAtStartup(new(backup.Manager), dir, lg, nil, nil))
 	if len(rec.got) != 1 || rec.got[0].eventType != "restore_interrupted" || rec.got[0].severity != "warning" {
 		t.Fatalf("an interrupted restore raised no restore_interrupted (warning): %+v", rec.got)
 	}
 
 	again := &pushRecorder{}
-	reportInterruptedRestore(again, loadRestoreRecordAtStartup(new(backup.Manager), dir, lg, nil))
+	reportInterruptedRestore(again, loadRestoreRecordAtStartup(new(backup.Manager), dir, lg, nil, nil))
 	if len(again.got) != 0 {
 		t.Fatalf("the same interruption was raised again on the next start: %+v", again.got)
 	}