D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.

controller/internal/backup/main_test.go

@@ -14,6 +14,7 @@ import (
 // The production values are captured here BEFORE they are shortened, so the pin below reads what a
 // box runs, not what the tests run.
 var prodHealthSettle, prodHealthInterval, prodHealthTimeout = healthSettle, healthInterval, healthTimeout
+var prodStableWindow, prodStablePoll, prodStableWatch = stableStartWindow, stableStartPoll, stableReleaseWatch
 
 func TestMain(m *testing.M) {
 	healthSettle = 0
@@ -22,6 +23,8 @@ func TestMain(m *testing.M) {
 	// D48 / R-650: no test in this package reaches Docker for the restore's pre-pull — every image is present unless a
 	// test says otherwise (m.imagePresentFn / m.imagePullFn).
 	imagePresentDefault = func(string) bool { return true }
+	// fix A (R-1270 follow-up): the stable-start window, shortened for the package the way the health wait is.
+	stableStartWindow, stableStartPoll, stableReleaseWatch = 30*time.Millisecond, 2*time.Millisecond, 2*time.Second
 	os.Exit(m.Run())
 }
 
@@ -32,6 +35,9 @@ func TestR488_HealthWaitDefaultsAreProduction(t *testing.T) {
 		t.Fatalf("production health wait changed: settle=%v interval=%v timeout=%v (want 3s/5s/1m30s) — "+
 			"a restored app now gets a different grace on every box", prodHealthSettle, prodHealthInterval, prodHealthTimeout)
 	}
+	if prodStableWindow != 3*time.Minute || prodStablePoll != 10*time.Second || prodStableWatch != 30*time.Minute {
+		t.Fatalf("production stable-start rule changed: window=%v poll=%v watch=%v (want 3m/10s/30m)", prodStableWindow, prodStablePoll, prodStableWatch)
+	}
 }
 
 // The consequence the seam must not break: a stack that never comes up is still reported as a