R-1270 (P2): a restore whose app does not reach running in time is never a success — every restore path returns ErrRestoreNotStarted, the household reads that the data is back but the app has not started yet, one operator alarm; the data stays, the undo copy is kept, a late start turns the record into a success and releases the copy. Red-proved. Commit only.

controller/internal/backup/backup.go

@@ -241,6 +241,8 @@ type Manager struct {
 	// restorePutBackNotify (R-893 option A) is called once when a failed off-site restore was put back and the app
 	// started again. Operator-tier, the same seam shape as restoreHoldNotify.
 	restorePutBackNotify func(stack string, replayErr error)
+	// restoreNotStartedNotify (R-1270) is called once when a restore's data is back but its app did not start in time.
+	restoreNotStartedNotify func(stack, kind string, cause error)
 
 	// R-403 unit-REHYDRATE seam — the copy that refills the primary unit from the Tier-2 mirror after
 	// a restore, overridable so the "only when hollow" condition and the byte-identical non-effect are