R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first

H4: a failed definition write in the off-site restore writes the live definition back before the start;
    a failed write-back holds the app (restore_mixed).
H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut);
    a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge).
H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu;
    every web handler and the kept loads begin through it; install-time kept load asks about the mirror too.
H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore
    running, and older than 14 days.

Commit only; rides the next controller release.

controller/cmd/controller/main.go

@@ -1400,6 +1400,13 @@ func main() {
 			return nil
 		})
 
+		// R-1256 H8: a restore copy no hold, no pending put-back and no running restore needs goes after 14 days. Every 6
+		// hours — a copy outliving its age by hours costs disk, never data. TestR1256_H8_TheSweepIsWiredAtStartup.
+		sched.Every("restore-copy-sweep", 6*time.Hour, func(ctx context.Context) error {
+			backupMgr.SweepUnusedRestoreCopies(time.Now())
+			return nil
+		})
+
 		// Tier 2: off-drive copy of each HDD app's recovery unit + userdata (auto-enabled, auto-target).
 		// Runs after the DB dump so it copies a fresh unit.
 		backupMgr.SetTier2Notifier(func(stackName, destLabel string, dur time.Duration, err error) {

controller/cmd/controller/r1256_sweep_wiring_test.go

@@ -0,0 +1,13 @@
+package main
+
+import "testing"
+
+// TestR1256_H8_TheSweepIsWiredAtStartup — R-1256 H8: an unused restore copy goes only through
+// SweepUnusedRestoreCopies, so main.go must CALL it (the seam-built-but-never-wired class).
+// RED-PROOF: delete the `restore-copy-sweep` job — this fails.
+func TestR1256_H8_TheSweepIsWiredAtStartup(t *testing.T) {
+	lines, _, _ := slice4CallLines(t)
+	if len(lines["SweepUnusedRestoreCopies"]) == 0 {
+		t.Fatal("SweepUnusedRestoreCopies is never called — an unused restore copy would stay on the drive for ever")
+	}
+}