Restore-holes run close-out: README, CONTEXT, REPORT; the interrupted-restore log line names a waiting put-back. Commit only.

controller/README.md

@@ -1030,6 +1030,17 @@ Each app can define rich metadata in `.felhom.yml`:
     files stay); the operator gets `backup_run_failures` leg `restore-put-back`. Only a put-back that fails — or a
     replay AND rollback that both fail — still HOLDS the app (`restore_mixed` / the restore hold, operator-cleared),
     and then the copy is kept for support. On success the copy is removed. `offbox_restore_undo.go`.
+  - **A restore cut by a power loss, on a drive that comes back late (unreleased, R-1251).** The copy of the live
+    data lives on the app's drive. When it cannot be reached at start because the drive is not bound yet, the app is
+    HELD (`putback_pending`; „…A visszaállítás előtti adatai egy meghajtón vannak, amely most nem érhető el…") and no
+    path starts it; when the drive binds, the copy is poured back FIRST, then the app starts. A put-back that fails
+    holds the app for support („félúton megszakadt"). Stop pressed during the restore still gets the put-back. The
+    copy's folders are synced before the restore records it. `appstop_putback_wait.go`.
+  - **An export that stops its app waits for a running restore (unreleased, R-1253):** it is refused (409,
+    „Egy másik művelet … éppen leállítva tart egy alkalmazást…") while another operation holds the app-stop marker.
+  - **A broken backup block never deletes a second-drive copy (unreleased, R-1252):** the night copy deletes dest
+    folders only under a valid classification; a rejected block keeps every copy, says so on the app's status and
+    tells the operator once a day (`backup_run_failures`, leg `tier2-settings-unreadable`).
   - **Where an off-site restore puts the data (v0.219.0, R-356).** `ReconstituteFromOffsite` and
     `PlaceOffsiteRestore` resolve the destination with `Manager.GetAppDrivePath` — **the same
     resolver `CaptureRecoveryUnit` wrote the snapshot with**: the app's `HDD_PATH` if it declares

controller/internal/backup/restore_record.go

@@ -114,6 +114,9 @@ func (m *Manager) LoadRestoreRecordAfterRecovery(putBack, waiting []string) *Res
 		if res.PutBack {
 			tail = "the start-up put its data back as it was before the restore (R-1195), and the household is told so"
 		}
+		if res.PutBackWaiting {
+			tail = "its put-back waits for the app's drive (R-1251), and the household is told so — not to run it again"
+		}
 		m.logger.Printf("[WARN] [backup] restore of %s (%s, started %s) was INTERRUPTED by a controller stop — recorded as failed; %s",
 			rec.Stack, rec.Op, rec.StartedAt.Format(time.RFC3339), tail)
 	}