D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.

controller/internal/appexport/restore.go

@@ -338,6 +338,27 @@ func (e *Exporter) executeImport(req ImportRequest, job *Job) {
 		return
 	}
 
+	// R-1279 (D48 for the import, brief 2026-10-26 fix B): DOWNLOAD FIRST. Every image of the definition that will run
+	// (the bundle's compose; the live one when the bundle carries none) is on the box BEFORE step 1 removes the running
+	// app's volumes — or the import is refused here with the app untouched, in the restores' two sentences (a version
+	// its maker deleted / a busy or unreachable registry). Measured before: the volumes went first and the pull came at
+	// the database start, so a version that could not be downloaded left the app gone.
+	if e.prepareImages != nil {
+		runCompose := filepath.Join(tmpDir, "config", "docker-compose.yml")
+		if _, serr := os.Stat(runCompose); serr != nil {
+			if p, ok := e.provider.GetStackComposePath(manifest.AppName); ok {
+				runCompose = p
+			}
+		}
+		release, perr := e.prepareImages(manifest.AppName, runCompose)
+		if perr != nil {
+			e.logger.Printf("[WARN] Import: REFUSED before anything was touched — an image of %s could not be downloaded: %v (R-1279)", manifest.AppName, perr)
+			e.failJob(job, step, util.ErrText("hu", perr))
+			return
+		}
+		defer release()
+	}
+
 	e.debugf("step 0 (open bundle) done in %v", time.Since(stepStart))
 
 	job.setStep(step, "done", "")