D49 = A follow-ups: (A) the undo copy is released only after a stable start — 3 min of running, healthy, no restart, one rule for the first verdict and the late-start watch; a watch ends only for a restore begun after it; (B, R-1279) the .fab import downloads first with the restores' D48 helper, before it removes anything. Red-proved. Commit only.

controller/internal/backup/restore_verdict_test.go

@@ -68,7 +68,7 @@ func TestR1270_AHealthyRestoreIsASuccessAsBefore(t *testing.T) {
 	if _, err := m.RestoreFromRecoveryUnit("app"); err != nil {
 		t.Fatalf("a healthy restore is a success: %v", err)
 	}
-	if left := undoCopies(t, rig.undoRoot); len(left) != 0 {
+	if left := waitNoCopies(t, rig.undoRoot); len(left) != 0 {
 		t.Fatalf("the copy is released after a healthy restore, found %v", left)
 	}
 	if len(*alarms) != 0 {
@@ -148,3 +148,16 @@ func TestR1270_MarkLateStartTouchesOnlyItsOwnRecord(t *testing.T) {
 	}
 	_ = os.Getpid
 }
+
+// waitNoCopies waits (bounded) for a deferred release — fix A releases the copy after the stable window, not at return.
+func waitNoCopies(t *testing.T, root string) []string {
+	t.Helper()
+	deadline := time.Now().Add(3 * time.Second)
+	for time.Now().Before(deadline) {
+		if left := undoCopies(t, root); len(left) == 0 {
+			return nil
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	return undoCopies(t, root)
+}