R-1187 (c): refuse a .fab import over an installed app that is not running (it merged old and bundle data); R-1189 (d): the off-site proof + integrity check run after a catch-up; unreleased

controller/internal/appexport/restore.go

@@ -358,6 +358,18 @@ func (e *Exporter) executeImport(req ImportRequest, job *Job) {
 	}
 	e.debugf("existing stack: deployed=%v running=%v", isDeployed, isRunning)
 
+	// R-1187 (c) (data-loss hunt 2026-10-20; proven on 9202 2026-10-22): an import over an app that is installed but
+	// NOT running used to „overwrite config in place" — its volumes were never removed, and `docker cp` only adds and
+	// overwrites, so the result was the old data MERGED with the bundle's (a stale SQLite -wal beside the bundle's .db
+	// is a corruption shape), reported as success. Only a running app's volumes are removed first. So this import is
+	// refused here, before anything is written; the household starts the app (or removes it) and imports again.
+	// Pinned by TestR1187c_AStoppedAppIsNotImportedOver.
+	if isDeployed && !isRunning {
+		e.logger.Printf("[WARN] Import: refused — %s is installed but not running; importing over it would merge the old data with the bundle's (R-1187 c)", manifest.AppName)
+		e.failJob(job, step, "Az alkalmazás telepítve van, de nem fut, ezért a csomagot nem töltjük vissza: a régi adatai összekeveredhetnének a csomagéval. Az alkalmazás érintetlen. Indítsd el (vagy távolítsd el), és próbáld újra.")
+		return
+	}
+
 	if isDeployed {
 		if isRunning {
 			e.logger.Printf("[INFO] Import: removing existing stack %s (with volumes)", manifest.AppName)