D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.

controller/internal/appexport/export.go

@@ -103,6 +103,9 @@ type Exporter struct {
 	// BOTH packages write ONE marker file — an exporter with its own file would be a second writer
 	// racing the same recovery. Nil = not wired (tests): the export runs exactly as it did before.
 	stopGuard appStopGuard
+	// prepareImages (R-1279, D48 for the import): resolves and pulls every image of the definition that will run,
+	// BEFORE the import removes anything; the returned func releases the image-work hold. Nil = unwired (tests).
+	prepareImages func(app, composePath string) (func(), error)
 
 	mu        sync.Mutex
 	activeJob *Job
@@ -137,6 +140,12 @@ func NewExporter(provider ExportStackProvider, logger *log.Logger, version strin
 // SetStopGuard wires the app-stop crash marker. INIT-ONLY — call once at startup, before any export.
 func (e *Exporter) SetStopGuard(g appStopGuard) { e.stopGuard = g }
 
+// SetImagePreparer wires the D48 download-first helper (backup.Manager.PrepareRestoreImages — the restores' own, passed
+// in so this package needs no import of the backup package). INIT-ONLY, main.go.
+func (e *Exporter) SetImagePreparer(fn func(app, composePath string) (func(), error)) {
+	e.prepareImages = fn
+}
+
 // stopGuardBegin records the app-stop marker before an export stops an app. An unwired guard is a
 // no-op (pre-v0.189.0 behaviour), never an error — a test exporter must not be forced to have one.
 func (e *Exporter) stopGuardBegin(stackName string) error {