Stray-copy fix: the capped second-drive copy container never outlives the copy — fixed name + label, removed by name on any error (the timeout included), every leftover removed at start before the scheduler and web server; a restore is refused while a copy runs or may still run; --mount (refuses a path the daemon does not see) and the image ID with --pull never (review); red-proved; unreleased

controller/cmd/controller/main.go

@@ -576,6 +576,12 @@ func main() {
 	}
 	if cfg.Backup.Enabled {
 		backupMgr = backup.NewManager(cfg, sett, logger)
+		// The stray-copy fix: a second-drive copy container a previous controller process lost (restart, self-update)
+		// still runs `rsync --delete`. Remove every one BEFORE the scheduler or the web server can start a backup or a
+		// restore; until that succeeds, restores are refused. Pinned by TestStrayCopy_ClearIsWiredBeforeTheScheduler.
+		if err := backup.ClearLeftoverTier2Copies(ctx); err != nil {
+			logger.Printf("[ERROR] [backup] leftover second-drive copy check: %v", err)
+		}
 		// R-550: load the persisted restore record BEFORE any page can ask for it.
 		var putBack []string
 		if appStopRecovery != nil {