D22: every restore puts the data back exactly on failure and after a power cut (R-1177, R-1195); whole restore asks the unit first (R-1178); no mirror during a restore (R-1180); W22 restore refusals in Hungarian; unreleased

controller/cmd/controller/main.go

@@ -457,6 +457,15 @@ func main() {
 		gate:   driveStartGate{mgr: stackMgr, sett: sett},
 		logger: logger,
 	})
+	// D22 / R-1195: a restore cut after its copy of the live data was taken is put back before the restart — the
+	// copy's volumes poured back and the live definition written back (backup/restore_crash_putback.go).
+	appStopGuard.SetPutBacker(backup.NewCrashPutBack(stackMgr.StopStack, func(name, defDir string) error {
+		cfg := stacks.LoadAppConfigDecrypted(defDir, encKey)
+		if cfg == nil {
+			return fmt.Errorf("the kept app.yaml of %s is unreadable", name)
+		}
+		return (&stackAdapter{mgr: stackMgr, encKey: encKey}).RecreateStackDefinitionFromUnit(name, defDir, cfg.Env)
+	}, logger))
 	appStopRecovery := appStopGuard.Recover()
 
 	// --- R-166: desired-state backfill (running-only) ---
@@ -568,7 +577,11 @@ func main() {
 	if cfg.Backup.Enabled {
 		backupMgr = backup.NewManager(cfg, sett, logger)
 		// R-550: load the persisted restore record BEFORE any page can ask for it.
-		interruptedRestore = loadRestoreRecordAtStartup(backupMgr, cfg.Paths.DataDir, logger)
+		var putBack []string
+		if appStopRecovery != nil {
+			putBack = appStopRecovery.PutBack
+		}
+		interruptedRestore = loadRestoreRecordAtStartup(backupMgr, cfg.Paths.DataDir, logger, putBack)
 		// R-519: an app-data run the stop cut off is said on the backup pages until the next complete run.
 		loadRunRecordAtStartup(backupMgr, cfg.Paths.DataDir, logger)
 		// R-166: use the guard that already ran Recover at startup, not a second one over the same