D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.

controller/cmd/controller/r1279_wiring_test.go

@@ -0,0 +1,22 @@
+package main
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+// R-1279 — the `.fab` import downloads first only if main.go passes the restores' helper in; an unwired exporter keeps
+// the old order (volumes removed before the pull). Seam-built-but-never-wired is a recorded class (REUSE.md).
+func TestR1279_MainWiresTheImportsDownloadFirst(t *testing.T) {
+	b, err := os.ReadFile("main.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(b), "appExporter.SetImagePreparer(backupMgr.PrepareRestoreImages)") {
+		t.Fatal("main.go must wire the import's download-first helper (SetImagePreparer)")
+	}
+	if !strings.Contains(string(b), "func (a *stackAdapter) ContainerSamples(") {
+		t.Fatal("main.go's stack adapter must read container samples for the stable-start rule (fix A)")
+	}
+}