controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

R-487: the local backup lists are keyed on the drives, not on what is
deployed — a removed app whose unit was kept is listed with the restore
that reinstalls it, the picker answers for it, and the restore opens the
unit where it sits. R-491: a removal clears the app's update hold.
R-490: /api/system/info reaches the API router and reads the default
storage path. R-489: volumes_removed is the real before/after difference,
[] when none. R-476: a Tier-2 copy is dated by its data, not its manifest.
R-456: the boot-orphan rule is pinned. Every fix red-proofed.

controller/internal/backup/restore_unit.go

@@ -184,7 +184,22 @@ type UnitRestoreResult struct {
 // An unresolvable drive path is still refused inside …At, in the same place and with the same
 // message, so the order of the checks a caller can observe is unchanged.
 func (m *Manager) RestoreFromRecoveryUnit(stackName string) (UnitRestoreResult, error) {
-	return m.RestoreFromRecoveryUnitAt(stackName, RecoveryUnitPath(m.namespaceRoot(m.GetAppDrivePath(stackName)), stackName))
+	return m.RestoreFromRecoveryUnitAt(stackName, m.primaryUnitDirFor(stackName))
+}
+
+// primaryUnitDirFor names the PRIMARY unit a keep-side restore opens. For a deployed app that is
+// backups/primary/<stack> on its own drive. For a REMOVED app (R-487) the drive is no longer known
+// — GetAppDrivePath falls back to the system path — so a unit kept on a data drive was unreachable
+// and the restore silently took the volume-only fallback. It is now found where it sits.
+func (m *Manager) primaryUnitDirFor(stackName string) string {
+	if m.stackProvider != nil {
+		if _, deployed := m.stackProvider.GetStackComposePath(stackName); !deployed {
+			if u, found := m.RemovedAppUnitFor(stackName); found {
+				return u.UnitDir
+			}
+		}
+	}
+	return RecoveryUnitPath(m.namespaceRoot(m.GetAppDrivePath(stackName)), stackName)
 }
 
 // RestoreFromRecoveryUnitAt is RestoreFromRecoveryUnit with an EXPLICIT recovery-unit directory.