kept second-drive copies (D25: R-1175, R-1181, R-1179); .fab import keeps the family gate (R-1191); stale restore temp (R-1188 c); the overcommit sentence made true (R-1192); escrow before the floor (R-1176); unreleased

controller/internal/appexport/provider.go

@@ -53,6 +53,9 @@ type ExportStackProvider interface {
 	// SaveEncryptedAppConfig saves app.yaml with re-encrypted sensitive fields.
 	// env is the plaintext env map from the bundle; encryption uses the current server key.
 	SaveEncryptedAppConfig(stackDir string, env map[string]string) error
+	// PrepareImportedApp gives the imported app its family gate and sign-up lock BEFORE it starts (R-1191): called
+	// after the config step (the compose file is in place) and before StartStack. An error means „do not start".
+	PrepareImportedApp(stackDir string, env map[string]string) error
 	// RefreshStacks rescans all stacks and refreshes container state.
 	RefreshStacks() error
 	// RemoveStackVolumes stops the stack and removes its named Docker volumes.

controller/internal/appexport/restore.go

@@ -459,6 +459,11 @@ func (e *Exporter) executeImport(req ImportRequest, job *Job) {
 	job.setStep(step, "running", "")
 	stepStart = time.Now()
 
+	// R-1191: the doors first — a family-only app must never start open (the import used to drop its gate).
+	if err := e.provider.PrepareImportedApp(stackDir, env); err != nil {
+		e.failJob(job, step, fmt.Sprintf("Alkalmazás előkészítése sikertelen: %v", err))
+		return
+	}
 	e.debugf("starting stack %s", manifest.AppName)
 	if err := e.provider.StartStack(manifest.AppName); err != nil {
 		e.failJob(job, step, fmt.Sprintf("Alkalmazás indítása sikertelen: %v", err))

controller/internal/appexport/roundtrip_test.go

@@ -188,3 +188,5 @@ func TestFabRoundTrip_ExportImportContentEquality(t *testing.T) {
 		t.Error("import must start the restored app")
 	}
 }
+
+func (p *rtProvider) PrepareImportedApp(string, map[string]string) error { return nil }