R-1270 (P2): a restore whose app does not reach running in time is never a success — every restore path returns ErrRestoreNotStarted, the household reads that the data is back but the app has not started yet, one operator alarm; the data stays, the undo copy is kept, a late start turns the record into a success and releases the copy. Red-proved. Commit only.

2026-10-25 09:33:26 +01:00
parent 02daebe9c5
commit b680db85cb
18 changed files with 405 additions and 23 deletions
@@ -1160,8 +1160,9 @@ func (m *Manager) ReconstituteFromOffsite(ctx context.Context, stack string, ack
 	// so without this line a successful off-site restore would leave the app refusing its next start.
 	// Pinned by TestR475_OffsiteRestoreClearsAnUpdateHold.
 	m.clearUpdateHoldAfterRestore(stack)
+	// R-1270: never a success over an app that did not start; the data stays, the undo copy (and the safety dump) stay.
 	if err := m.waitForHealthy(stack, healthTimeout); err != nil {
-		m.logger.Printf("[WARN] [offbox] %s reconstituted but health check failed: %v", stack, err)
+		return res, m.restoreNotStarted(stack, "off-site restore", err, undo)
 	}

 	// R-382: VolumesReplayed was set above and never printed, so the operator log said