R-1270 (P2): a restore whose app does not reach running in time is never a success — every restore path returns ErrRestoreNotStarted, the household reads that the data is back but the app has not started yet, one operator alarm; the data stays, the undo copy is kept, a late start turns the record into a success and releases the copy. Red-proved. Commit only.

controller/internal/web/handlers.go

@@ -1900,7 +1900,7 @@ func (s *Server) backupRestoreHandler(w http.ResponseWriter, r *http.Request) {
 		res, err := s.backupMgr.RestoreFromRecoveryUnit(stackName)
 		if err != nil {
 			s.logger.Printf("[ERROR] [web] Restore failed (async): stack=%s: %v", stackName, err)
-			s.backupMgr.EndRestoreOp(false, s.note("note.restore.unit_failed", s.noteErr(err)))
+			s.endRestoreFailed("note.restore.unit_failed", err, "")
 			return
 		}
 		s.logger.Printf("[INFO] [web] Restore completed (async): stack=%s in %s (volumes %d/%d, dbs %d/%d)",
@@ -1916,11 +1916,25 @@ func (s *Server) backupRestoreHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 // restoreFailedNote is the household's sentence for a restore that returned an error: key's „…sikertelen: %s"
-// around the error's own sentence.
+// around the error's own sentence — except a restore whose data is back but whose app did not start (R-1270), which is
+// neither a success nor a failure and reads its own sentence alone.
 func (s *Server) restoreFailedNote(key string, err error) string {
+	if errors.Is(err, backup.ErrRestoreNotStarted) {
+		return s.noteErr(err)
+	}
 	return s.note(key, s.noteErr(err))
 }
 
+// endRestoreFailed records a restore that returned an error: a not-started one (R-1270) as such — never ok, and a late
+// start can still turn it into a success — everything else as a failure.
+func (s *Server) endRestoreFailed(key string, err error, suffix string) {
+	if errors.Is(err, backup.ErrRestoreNotStarted) {
+		s.backupMgr.EndRestoreOpNotStarted(s.noteErr(err) + suffix)
+		return
+	}
+	s.backupMgr.EndRestoreOp(false, s.note(key, s.noteErr(err))+suffix)
+}
+
 // unitRestoreOutcomeMsg builds the OUTCOME sentence for a completed LOCAL recovery-unit restore. Pure,
 // so the wording is unit-testable — this string is the customer's only evidence that the operation did
 // what its label promised.
@@ -2232,7 +2246,7 @@ func (s *Server) backupTier2RestoreHandler(w http.ResponseWriter, r *http.Reques
 				return
 			}
 			s.logger.Printf("[ERROR] [web] Tier-2 file restore failed (async): stack=%s: %v", stackName, err)
-			s.backupMgr.EndRestoreOp(false, s.note("note.restore.file_failed", s.noteErr(err)))
+			s.endRestoreFailed("note.restore.file_failed", err, "")
 			return
 		}
 		// C9-F1 (the quiet half): even where the restore DOES cover something it covers only the
@@ -2302,7 +2316,7 @@ func (s *Server) backupTier2UnitRestoreHandler(w http.ResponseWriter, r *http.Re
 			files := s.note("note.restore.whole_files", res.Files.Restored, res.Files.Replaced, res.Files.KeptNewer, res.Files.Unchanged)
 			if err != nil {
 				s.logger.Printf("[ERROR] [web] Tier-2 whole restore failed (async): stack=%s: %v", stackName, err)
-				s.backupMgr.EndRestoreOp(false, s.note("note.restore.full_unit_failed", s.noteErr(err))+" "+files)
+				s.endRestoreFailed("note.restore.full_unit_failed", err, " "+files)
 				return
 			}
 			s.logger.Printf("[INFO] [web] Tier-2 whole restore completed (async): stack=%s in %s (files restored %d, replaced %d, kept-newer %d, unchanged %d; volumes %d/%d, dbs %d/%d)",
@@ -2336,7 +2350,7 @@ func (s *Server) backupTier2UnitRestoreHandler(w http.ResponseWriter, r *http.Re
 		res, err := s.backupMgr.RestoreTier2Unit(stackName)
 		if err != nil {
 			s.logger.Printf("[ERROR] [web] Tier-2 unit restore failed (async): stack=%s: %v", stackName, err)
-			s.backupMgr.EndRestoreOp(false, s.note("note.restore.full_unit_failed", s.noteErr(err)))
+			s.endRestoreFailed("note.restore.full_unit_failed", err, "")
 			return
 		}
 		s.logger.Printf("[INFO] [web] Tier-2 unit restore completed (async): stack=%s in %s (volumes %d/%d, dbs %d/%d)",