R-1270 (P2): a restore whose app does not reach running in time is never a success — every restore path returns ErrRestoreNotStarted, the household reads that the data is back but the app has not started yet, one operator alarm; the data stays, the undo copy is kept, a late start turns the record into a success and releases the copy. Red-proved. Commit only.

CHANGELOG.md

@@ -22,6 +22,25 @@ brief 2026-10-24, Part 4 (commit only; the release rides the next normal train).
   `…OnlyWhenTheAgentWaitsAndAnAppRuns`, `…QBLimitRuleSkipsAHeldLimit`, `…TheTwoAppsReadAndWriteTheirLimit`,
   `TestLineTestRunOutlastsTheClientTimeout`, `TestStartUpwatchRecoversTheHoldFirst`, `TestUpwatchHoldGetsBothAgentCalls`.
 
+### A restore whose app does not start is never „success" (R-1270, P2) — 2026-10-25, commit only
+
+- **Measured before (9202, 0.342.0 = `e1613ae` for these files; `audits/restore-truth-2026-10-25/before/`):** the
+  Tandoor restore whose app stayed `starting` was recorded `ok: true`, „A(z) tandoor: 3 adatkötet és az adatbázis
+  visszaállítva — az alkalmazás újraindult." The health timeout was a WARN on every restore path.
+- **Now (`internal/backup/restore_verdict.go`):** the unit restore (so the second drive's unit and whole restore, a
+  kept load and a set-aside unit), the off-site restore, the second drive's file restore and the no-unit fallback
+  return `ErrRestoreNotStarted` when the app does not reach running in time. The household reads „A(z) %s: az
+  adatokat visszatöltöttük, de az alkalmazás még nem indult el. Várj pár percet, majd nyisd meg újra. Ha így marad,
+  szólj nekünk." alone (the record is `ok: false`, `not_started: true`); the operator gets one `backup_run_failures`
+  line (leg `restore-not-started`).
+- **The safest reading (the operator may change it):** a timeout does NOT pour the old data back (a slow first start
+  is common). The data stays restored; the restore's undo copy is KEPT, like a failed put-back's copy for support —
+  no new retention rule. A watcher looks 30 more minutes: when the app runs, the record turns to success („…elindult:
+  a visszaállítás kész.") and the copy is removed, as after any successful restore.
+- Tests (each seen failing with the old WARN): `TestR1270_AUnitRestoreWhoseAppDoesNotStartIsNotASuccess`,
+  `…ALateStartTurnsTheRecordIntoASuccess`, `…TheOffsiteRestoreToo`, web `…TheRecordOfANotStartedRestore`; controls
+  `…AHealthyRestoreIsASuccessAsBefore`, `…MarkLateStartTouchesOnlyItsOwnRecord`.
+
 ### A new install never writes into an earlier install's backup (D47, R-1269, P2) — 2026-10-25, commit only
 
 Operator ruling D47 (2026-10-25 08:38, `09` §3): a recovery unit's definition and its data are written only together,