v0.153.0 — R-47: the DB replay no longer races the app, on BOTH restore paths

Closes R-47. No new agent coupling — MinAgent stays 0.90.0.

The replay needs a running DB container, so both restore paths started the
WHOLE stack first, giving the application a window to rebuild the very schema
objects the dump was about to create. Measured live on 2026-07-19 (H4,
DIAG-immich-restore-round2): immich-server rebuilt clip_index two seconds
before the dump's CREATE INDEX, the replay aborted "already exists" under
ON_ERROR_STOP=1, and immich reported schema drift. The data survived only
because pg_dump emits COPY before CREATE INDEX.

Both paths now open a DB-ONLY window: only the stack's database service(s)
come up, the dump is replayed with the app still down, and the full start
runs only after the replay exits 0. Fail-closed: a dump with no identifiable
DB service refuses BEFORE the first mutation. Every exit from the window
still does a best-effort full start, so a failed restore never leaves a box
with a database and no application.

New: appbackup.DBServiceNames (yaml.v3 services-map parse — never a line
scan; immich's top-level volume keys are the decoy) sharing dbTypeForImage
with DiscoverDatabases; stacks.Manager.StartStackServices (refuses an empty
list — argument-less `up -d` is a full start); RedeployFromEnv split into
PersistUnitRedeployConfig + its unchanged tail. StackDataProvider's
RecreateStackFromUnit becomes RecreateStackDefinitionFromUnit — the hidden
`up -d` inside the old name is what carried the defect on the local path.

19 new tests (ordering plus state-at-replay-time, zero-mutation fail-closed
effects, replay-failure bring-up, parser decoys, empty-list refusal); three
companion red-proofs run and reverted. 23/23 packages green.

Not yet live-validated: STOP-1 supervised reconstitute, golden 0.153.0.

controller/internal/backup/offbox_reconstitute.go

@@ -239,6 +239,20 @@ func (m *Manager) ReconstituteFromOffsite(ctx context.Context, stack string) (Of
 	res.Skewed = res.OffsiteRunID == ""
 	res.LooksEmpty = m.sniffScratchDump(scratchDumpDir, stack)
 
+	// --- WHICH SERVICE HOLDS THE DATABASE (R-47) ------------------------------------------------
+	// Read from the LIVE compose, not the scratch one: reconstitution never overwrites the stack dir,
+	// so the live file is what `docker compose up` will actually act on. Resolved BEFORE the first
+	// mutation so the refusal below costs nothing.
+	var dbServices []string
+	if composePath, cOK := m.stackProvider.GetStackComposePath(stack); cOK && composePath != "" {
+		svcs, dsErr := DBServiceNames(composePath)
+		if dsErr != nil {
+			// "cannot tell" is not "no database" — leave dbServices empty and let the gate refuse.
+			m.logger.Printf("[WARN] [offbox] %s: could not read the live compose services: %v", stack, dsErr)
+		}
+		dbServices = svcs
+	}
+
 	// --- THE UNDO, BEFORE THE ACT ---------------------------------------------------------------
 	// Taken while the stack is still UP (a stopped database cannot be dumped) and before a single
 	// byte is overwritten, so a failure here aborts with the live app completely untouched.
@@ -253,6 +267,12 @@ func (m *Manager) ReconstituteFromOffsite(ctx context.Context, stack string) (Of
 			// Fail-closed: never replay when the undo is not verifiably on disk.
 			return res, fmt.Errorf("a biztonsági mentés nem található a lemezen — a visszaállítás biztonsági okból nem indult el")
 		}
+		// Fail-closed (R-47): the app HAS a database but no compose service can be identified to
+		// start alone for the replay. The only alternative would be to start everything and replay
+		// into the race that produced H4 — refusing with the live app untouched is the better outcome.
+		if len(dbServices) == 0 {
+			return res, fmt.Errorf("Az adatbázis-szolgáltatás nem azonosítható a(z) %s alkalmazásban — a visszaállítás biztonsági okból nem indult el.", stack)
+		}
 	}
 
 	// --- FILES ----------------------------------------------------------------------------------
@@ -280,19 +300,31 @@ func (m *Manager) ReconstituteFromOffsite(ctx context.Context, stack string) (Of
 	}
 
 	// --- DATABASE -------------------------------------------------------------------------------
-	// The stack must be UP for the replay: ImportDump talks to the running container using its own
-	// discovered credentials (the same precedence RestoreFromRecoveryUnit uses — the logical dump
-	// wins over whatever the file copy just laid down for the DB's own data dir).
-	if err := m.stackProvider.StartStack(stack); err != nil {
-		return res, fmt.Errorf("a(z) %s újraindítása sikertelen a fájlok visszaállítása után: %w", stack, err)
-	}
+	// The DB container must be UP for the replay (ImportDump talks to it with its own discovered
+	// credentials), but NOTHING ELSE may be — R-47. Until v0.153.0 this was a full StartStack, which
+	// gave the application a window to rebuild the very schema objects the dump was about to create:
+	// measured at 2 s on 2026-07-19, and the replay aborted `relation "clip_index" already exists`
+	// under ON_ERROR_STOP=1 (H4). Starting only the database service closes that window entirely.
 	if hasDB {
+		if err := m.stackProvider.StartStackServices(stack, dbServices); err != nil {
+			// Best-effort bring-up: a failed restore must not also be an outage.
+			if sErr := m.stackProvider.StartStack(stack); sErr != nil {
+				m.logger.Printf("[WARN] [offbox] %s: full start after failed DB-only start also failed: %v", stack, sErr)
+			}
+			return res, fmt.Errorf("a(z) %s adatbázis-szolgáltatásának indítása sikertelen: %w", stack, err)
+		}
 		n, iErr := m.reimportDBDumpsFrom(ctx, stack, scratchDumpDir)
 		res.DBsReplayed = n
 		if iErr != nil {
+			if sErr := m.stackProvider.StartStack(stack); sErr != nil {
+				m.logger.Printf("[WARN] [offbox] %s: full start after failed replay also failed: %v", stack, sErr)
+			}
 			return res, fmt.Errorf("az adatbázis visszaállítása sikertelen: %w — a korábbi állapot mentése megvan: %s", iErr, filepath.Base(safety))
 		}
 	}
+	if err := m.stackProvider.StartStack(stack); err != nil {
+		return res, fmt.Errorf("a(z) %s újraindítása sikertelen a fájlok visszaállítása után: %w", stack, err)
+	}
 	if err := m.waitForHealthy(stack, 90*time.Second); err != nil {
 		m.logger.Printf("[WARN] [offbox] %s reconstituted but health check failed: %v", stack, err)
 	}