R-1270 (P2): a restore whose app does not reach running in time is never a success — every restore path returns ErrRestoreNotStarted, the household reads that the data is back but the app has not started yet, one operator alarm; the data stays, the undo copy is kept, a late start turns the record into a success and releases the copy. Red-proved. Commit only.

controller/internal/backup/restore_unit.go

@@ -564,15 +564,17 @@ func (m *Manager) RestoreFromRecoveryUnitAtWith(stackName, unitDir string, opt U
 		m.logger.Printf("[ERROR] [backup] starting %s after restore from unit: %v — putting the live data back", stackName, err)
 		return putBack(err, "err.backup.restore_failed_held_mixed", false)
 	}
+	// Slice 4: the app is back on its unit's definition and data and was started — the route back an
+	// update hold names. Lift that hold (and only that kind; see clearUpdateHoldAfterRestore).
+	m.clearUpdateHoldAfterRestore(stackName)
+	// R-1270: the verdict follows the app. A health timeout is NOT a success (it used to be a WARN, and the page said
+	// „az alkalmazás újraindult" over an app that never came up); the data stays restored and the undo copy is kept.
 	if err := m.waitForHealthy(stackName, healthTimeout); err != nil {
-		m.logger.Printf("[WARN] [backup] %s restored but health check failed: %v", stackName, err)
+		return res, m.restoreNotStarted(stackName, "unit restore", err, undo)
 	}
 
 	m.logger.Printf("[INFO] [backup] Restore-from-unit completed: %s — %d volume(s) of %d listed, %d database(s) of %d listed",
 		stackName, res.VolumesReplayed, res.ManifestVolumes, res.DBsReplayed, res.ManifestDBs)
-	// Slice 4: the app is back on its unit's definition and data and was started — the route back an
-	// update hold names. Lift that hold (and only that kind; see clearUpdateHoldAfterRestore).
-	m.clearUpdateHoldAfterRestore(stackName)
 	return res, nil
 }