v0.246.0: an interrupted restore is told; the recovery-code reminder waits until the box can take it

MinAgent: 0.131.0 (unchanged). Requires hub v0.117.0 for restore_interrupted.

R-550 (operator ruling: fix). A design reversed and recorded: the restore
op-status was in memory by choice. Now restore-status.json in DataDir, written
atomically at both ends of an op. At startup a record still marked running
becomes a failed, interrupted result kept per app until that app's next
restore, shown on /backups/restore and the off-site wizard, and raised once as
restore_interrupted. Cooldowns stay in memory.

R-546. The R-543 reminder bar consults the agent's own preflight ok (every
blocking item, not a copy of pbs_storage_id), cached 60 s, probed only while
paused. /backup/escrow shows a waiting card that polls and reloads instead of
red crosses and English diagnostics. POST /api/escrow/start refuses 409 before
staging or starting - the direct path chaos night used. Unknown readiness keeps
the bar.

Red-proofs (each seen failing): restore record across restart; main() calls
both startup functions; startup helper with loading skipped; restore page card;
bar held back; waiting card; start refusal. go build/vet/test ./... green, 28
packages; controller_gates --fast all OK.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/cmd/controller/main.go

@@ -527,6 +527,8 @@ func main() {
 
 	// --- Initialize backup manager (app-data only: DB dumps + Docker-volume tars) ---
 	var backupMgr *backup.Manager
+	// R-550: the restore the last stop interrupted, found when the record loads; raised once the notifier exists.
+	var interruptedRestore *backup.RestoreOpResult
 	stackProv := &stackAdapter{
 		mgr:             stackMgr,
 		getStoragePaths: func() []settings.StoragePath { return sett.GetStoragePaths() },
@@ -534,6 +536,8 @@ func main() {
 	}
 	if cfg.Backup.Enabled {
 		backupMgr = backup.NewManager(cfg, sett, logger)
+		// R-550: load the persisted restore record BEFORE any page can ask for it.
+		interruptedRestore = loadRestoreRecordAtStartup(backupMgr, cfg.Paths.DataDir, logger)
 		// R-166: use the guard that already ran Recover at startup, not a second one over the same
 		// file (see SetAppStopGuard — one file, one owner).
 		backupMgr.SetAppStopGuard(appStopGuard)
@@ -580,6 +584,8 @@ func main() {
 
 	// --- Initialize notifier ---
 	notifier := notify.New(cfg.Hub.URL, cfg.Hub.APIKey, cfg.Customer.ID, sett, logger, cfg.Logging.Level == "debug")
+	// R-550: an interrupted restore is raised once, now that the notifier exists.
+	reportInterruptedRestore(notifier, interruptedRestore)
 
 	// R-97a: wire the quiesce loop's hub-event seam. It MUST happen here and not in
 	// startQuiesceLoop, because the notifier is constructed after it — and it must happen at all,