R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first

H4: a failed definition write in the off-site restore writes the live definition back before the start;
    a failed write-back holds the app (restore_mixed).
H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut);
    a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge).
H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu;
    every web handler and the kept loads begin through it; install-time kept load asks about the mirror too.
H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore
    running, and older than 14 days.

Commit only; rides the next controller release.

controller/internal/api/kept_install.go

@@ -94,7 +94,9 @@ func (r *Router) keptDataAtInstall(w http.ResponseWriter, req *http.Request, nam
 			writeJSON(w, http.StatusConflict, apiResponse{OK: false, Error: data.UseOff, Data: data})
 			return true
 		}
-		if st := r.backupMgr.RestoreStatus(); st.Running || r.backupMgr.IsRunning() {
+		// R-1256 H6: every operation — a restore, a backup run, a second-drive copy — not only the first two; and the
+		// load itself begins in the same step as this question (startKeptLoad → ErrRestoreBusy).
+		if busy, _ := r.backupMgr.RestoreBusy(); busy != "" {
 			writeJSON(w, http.StatusConflict, apiResponse{OK: false, Error: r.msgLang(lang, "api.kept.busy")})
 			return true
 		}
@@ -104,7 +106,11 @@ func (r *Router) keptDataAtInstall(w http.ResponseWriter, req *http.Request, nam
 		}
 		r.logger.Printf("[INFO] [api] Deploy %s: USE MY KEPT DATA — loading from %s (tier %d, %s) under the kept files %v", name, src, cp.c.Tier, cp.c.Time.UTC().Format(time.RFC3339), old)
 		r.dropLeftoverHold(name, "use-kept-data") // R-704: this is a new install of an app that is not installed
-		r.startKeptLoad(name, hdd, cp.c, lang, nil)
+		if err := r.startKeptLoad(name, hdd, cp.c, lang, nil); err != nil {
+			r.logger.Printf("[WARN] [api] Deploy %s: use my kept data REFUSED at its start: %v", name, err)
+			writeJSON(w, http.StatusConflict, apiResponse{OK: false, Error: r.msgLang(lang, "api.kept.busy")})
+			return true
+		}
 		writeJSON(w, http.StatusAccepted, apiResponse{OK: true, Message: r.msgLang(lang, "kept.load.started", display)})
 		return true
 	default:
@@ -120,7 +126,7 @@ func (r *Router) keptCopyName(lang string, c backup.KeptCopy) string {
 
 // startKeptLoad runs the load and, when it succeeded, the app's after_load. then(ok) runs last. The
 // off-site copy goes through LoadKeptOffsite (download the unit alone, judge it, then the same restore).
-func (r *Router) startKeptLoad(name, drive string, c backup.KeptCopy, lang string, then func(ok bool)) {
+func (r *Router) startKeptLoad(name, drive string, c backup.KeptCopy, lang string, then func(ok bool)) error {
 	display := name
 	if st, ok := r.stackMgr.GetStack(name); ok && st.Meta.DisplayName != "" {
 		display = st.Meta.DisplayName
@@ -128,10 +134,9 @@ func (r *Router) startKeptLoad(name, drive string, c backup.KeptCopy, lang strin
 	okMsg := func(error) string { return r.msgLang(lang, "kept.load.done", display) }
 	failMsg := func(err error) string { return r.msgLang(lang, "kept.load.failed", display, err) }
 	if c.Tier == backup.KeptTierOffsite {
-		r.backupMgr.LoadKeptOffsite(name, drive, c, nil, okMsg, failMsg, r.keptAfterLoad(name, then))
-		return
+		return r.backupMgr.LoadKeptOffsite(name, drive, c, nil, okMsg, failMsg, r.keptAfterLoad(name, then))
 	}
-	r.backupMgr.LoadKeptApp(name, c.UnitDir, okMsg, failMsg, r.keptAfterLoad(name, then))
+	return r.backupMgr.LoadKeptApp(name, c.UnitDir, nil, okMsg, failMsg, r.keptAfterLoad(name, then))
 }
 
 // keptAfterLoad runs the app's after_load when the load succeeded, then then(ok).