R-1253 (P2): an export that stops its app refuses while another operation (a restore) holds the app-stop marker — its Undo is never replaced. Commit only.

CHANGELOG.md

@@ -22,6 +22,22 @@ brief 2026-10-24, Part 4 (commit only; the release rides the next normal train).
   `…OnlyWhenTheAgentWaitsAndAnAppRuns`, `…QBLimitRuleSkipsAHeldLimit`, `…TheTwoAppsReadAndWriteTheirLimit`,
   `TestLineTestRunOutlastsTheClientTimeout`, `TestStartUpwatchRecoversTheHoldFirst`, `TestUpwatchHoldGetsBothAgentCalls`.
 
+### An export never replaces another operation's restore record (R-1253, P2; review round 2 HUNT-1 H3) — 2026-10-24 night, commit only
+
+- **An export with „stop the app first" no longer overwrites a running restore's crash record.** The app-stop marker
+  has one slot; the exporter's `Begin` wrote it unconditionally, so a stop-first export during another app's restore
+  replaced the restore's record and its Undo, and a power cut then left the restored app on mixed data with no
+  put-back. Now the guard knows the operation of THIS process that holds the marker (`BusyWith`), `BeginExclusive`
+  refuses to replace it (`ErrAppStopBusy`), the export adapter uses it, and `StartExport` refuses a stop-first export
+  before anything starts („err.appexport.another_operation_running", HTTP 409). A marker a crash left does not block
+  (nothing in this process will end it; Recover already ran). **Picked over one marker per app** because that changes
+  the marker's format, Recover, `HeldStacks`, `SetUndo` and every caller; this touches the exporter and one guard method.
+  The other direction (a restore or the night dump replacing an export's marker) needs no refusal: the replaced record
+  only owed the exported app a restart, which the boot sweep gives every app the household wants running.
+- Tests (each seen failing with the refusal taken out): `TestR1253_AnExportNeverReplacesARestoresMarker` (main: the
+  review's two Begins through the real adapter; a crash-left marker does not block),
+  `TestR1253_AStopFirstExportWaitsForTheOtherOperation` (appexport: refused before any mark or stop).
+
 ### A rejected backup block never deletes second-drive copies (R-1252, P2; review round 2 HUNT-2 H1, H2, H9) — 2026-10-24 night, commit only
 
 - **One wrong line in an app's backup block no longer deletes its second-drive copy.** LoadMetadata rejects the whole