R-1270 (P2): a restore whose app does not reach running in time is never a success — every restore path returns ErrRestoreNotStarted, the household reads that the data is back but the app has not started yet, one operator alarm; the data stays, the undo copy is kept, a late start turns the record into a success and releases the copy. Red-proved. Commit only.

controller/internal/backup/kept_load.go

@@ -278,6 +278,10 @@ func (m *Manager) LoadKeptOffsite(app, drive string, c KeptCopy, prepare func()
 		}
 		res, err := m.keptUnitRestore()(app, unitDir)
 		cleanup()
+		if errors.Is(err, ErrRestoreNotStarted) {
+			m.keptLoadNotStarted(app, err, after)
+			return
+		}
 		if err != nil {
 			fail(err)
 			return
@@ -320,6 +324,10 @@ func (m *Manager) LoadKeptApp(app, unitDir string, okMsg, failMsg func(err error
 	go func() {
 		start := time.Now()
 		res, err := m.keptUnitRestore()(app, unitDir)
+		if errors.Is(err, ErrRestoreNotStarted) {
+			m.keptLoadNotStarted(app, err, after)
+			return
+		}
 		if err != nil {
 			m.logger.Printf("[ERROR] [backup] kept load %s from %s FAILED after %s: %v", app, unitDir, time.Since(start).Round(time.Second), err)
 			m.EndRestoreOp(false, failMsg(err))
@@ -336,3 +344,14 @@ func (m *Manager) LoadKeptApp(app, unitDir string, okMsg, failMsg func(err error
 		}
 	}()
 }
+
+// keptLoadNotStarted (R-1270): the kept data is loaded but the app did not start in time. Never „done": the record says
+// so (a late start turns it into a success); after(true) still runs — the data DID land, so the app's after_load (it
+// waits for the app) and the kept folder's tidy-up belong to it.
+func (m *Manager) keptLoadNotStarted(app string, err error, after func(ok bool)) {
+	m.logger.Printf("[WARN] [backup] kept load %s: the data is loaded, the app did not start in time — not reported as done", app)
+	m.EndRestoreOpNotStarted(m.noteErr(err))
+	if after != nil {
+		after(true)
+	}
+}