D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.

2026-10-25 12:45:33 +01:00
parent e8d2151a77
commit 7720439440
16 changed files with 549 additions and 27 deletions
@@ -105,6 +105,12 @@ func (m *Manager) prepareRestoreImages(stack, composePath string) (release func(
 	return end, nil
 }

+// PrepareRestoreImages is prepareRestoreImages for a caller outside this package — the `.fab` import (R-1279), wired in
+// main.go so the import refuses before it removes anything, in the restores' own words.
+func (m *Manager) PrepareRestoreImages(stack, composePath string) (func(), error) {
+	return m.prepareRestoreImages(stack, composePath)
+}
+
 // SetRestorePullRefusedNotify wires the operator notice for a restore refused because an image could not be downloaded.
 func (m *Manager) SetRestorePullRefusedNotify(fn func(stack, ref string, cause error)) {
 	m.restorePullRefusedNotify = fn