v0.153.0 — R-47: the DB replay no longer races the app, on BOTH restore paths

Closes R-47. No new agent coupling — MinAgent stays 0.90.0.

The replay needs a running DB container, so both restore paths started the
WHOLE stack first, giving the application a window to rebuild the very schema
objects the dump was about to create. Measured live on 2026-07-19 (H4,
DIAG-immich-restore-round2): immich-server rebuilt clip_index two seconds
before the dump's CREATE INDEX, the replay aborted "already exists" under
ON_ERROR_STOP=1, and immich reported schema drift. The data survived only
because pg_dump emits COPY before CREATE INDEX.

Both paths now open a DB-ONLY window: only the stack's database service(s)
come up, the dump is replayed with the app still down, and the full start
runs only after the replay exits 0. Fail-closed: a dump with no identifiable
DB service refuses BEFORE the first mutation. Every exit from the window
still does a best-effort full start, so a failed restore never leaves a box
with a database and no application.

New: appbackup.DBServiceNames (yaml.v3 services-map parse — never a line
scan; immich's top-level volume keys are the decoy) sharing dbTypeForImage
with DiscoverDatabases; stacks.Manager.StartStackServices (refuses an empty
list — argument-less `up -d` is a full start); RedeployFromEnv split into
PersistUnitRedeployConfig + its unchanged tail. StackDataProvider's
RecreateStackFromUnit becomes RecreateStackDefinitionFromUnit — the hidden
`up -d` inside the old name is what carried the defect on the local path.

19 new tests (ordering plus state-at-replay-time, zero-mutation fail-closed
effects, replay-failure bring-up, parser decoys, empty-list refusal); three
companion red-proofs run and reverted. 23/23 packages green.

Not yet live-validated: STOP-1 supervised reconstitute, golden 0.153.0.

CONTEXT.md

@@ -7,7 +7,38 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-07-20 (v0.152.0 + samba 1.1.0 — mDNS for macOS; S-3 closed)
+Last updated: 2026-07-20 (v0.153.0 — R-47: the DB replay no longer races the app, both paths)
+
+> **2026-07-20 — v0.153.0 (R-47).** Closes the H4 race on **BOTH** restore paths. The replay needs a
+> running DB container, so both paths started the WHOLE stack first — giving the application a window
+> to rebuild the schema objects the dump was about to create. Measured at 8 s on 2026-07-19
+> (`DIAG-immich-restore-round2-2026-07-19`): immich-server rebuilt `clip_index` two seconds before
+> the dump's `CREATE INDEX`, the replay aborted `already exists` under `ON_ERROR_STOP=1`, and immich
+> then reported schema drift. The photos came back **by accident** — `pg_dump` emits COPY before
+> CREATE INDEX, so the abort landed after the rows; a collision earlier in the script would have left
+> a genuinely half-restored database, reported identically.
+>
+> **DECISION: the DB-only bring-up is done by compose SERVICE scoping**, not by container tricks —
+> `StartStackServices(name, []string{svc})` → `compose up -d <svc>`. Every catalog template's
+> dependency direction is app→db, so naming the DB starts the DB and nothing else. `docker start
+> <ctr>` was never an option: `StopStack` is `compose down`, so the containers no longer exist.
+> `RestartStack`/`RedeployFromEnv` are traps here — both end in a full `up -d`.
+>
+> **DECISION: fail-closed.** A `.sql` dump with no identifiable DB service refuses BEFORE the first
+> mutation, on both paths (one Hungarian string, shared). The alternative would be to start everything
+> and replay into the race. It should be structurally unreachable — `dbTypeForImage` is now shared by
+> `DiscoverDatabases` and `DBServiceNames`, and a dump can only exist because discovery matched the
+> container's image, which IS the compose `image:` value — so this is the belt for template drift.
+>
+> Enablers: `RedeployFromEnv` split into `PersistUnitRedeployConfig` (persist, starts nothing) + the
+> unchanged tail; `StackDataProvider.RecreateStackFromUnit` renamed to
+> `RecreateStackDefinitionFromUnit` because the old name promised less than the method did — the
+> hidden `up -d` inside it is what carried the defect on the local path. `StartStackServices` REFUSES
+> an empty list (argument-less `up -d` is a full start). **No agent coupling — MinAgent stays 0.90.0.**
+> 19 new tests, 3 red-proofs, 23/23 green. **NOT live-validated yet:** STOP-1 supervised reconstitute,
+> golden 0.153.0 bake (P3 registry-reachability probe from the vacation site is load-bearing), Viktor's
+> two hub saves, and his C6 customer-restore UI run.
+
 
 > **2026-07-20 — v0.152.0 + felhom-samba 1.1.0 (Megosztás on a Mac).** Closes **S-3**. **A capture
 > on the box overturned the earlier guess:** macOS DOES send a correct NBNS query for `<NÉV><20>` and