@skyhook-io/radar-app 1.17.0 → 1.17.1

package/src/components/cnpg/recovery/restoreModel.test.ts

@@ -0,0 +1,709 @@
+import { describe, expect, it } from 'vitest'
+import type { CNPGRecoveryResponse } from '../../../api/cnpg-recovery'
+import {
+  resourcesText,
+  restoreBackupDeclared,
+  restoreNextSteps,
+  restorePermission,
+  buildRestoreManifest,
+  cnpgRestoredPrimaryUp,
+  observeRestore,
+  pitrWarnings,
+  preflightFacts,
+  recoveryEvidenceFor,
+  latestEvidence,
+  assessRestoreSources,
+  restoreSourceForBackup,
+  restoreSourcesFor,
+  restoreSourcesForStore,
+  restoreTargetKinds,
+  describeSource,
+  targetIsoFrom,
+  sourceClusterFor,
+} from './restoreModel'
+import { restoreOperationObserver } from './restoreOperation'
+
+const cluster = {
+  apiVersion: 'postgresql.cnpg.io/v1',
+  kind: 'Cluster',
+  metadata: { name: 'pg-a', namespace: 'db' },
+  spec: {
+    instances: 3,
+    imageCatalogRef: { kind: 'ClusterImageCatalog', name: 'std', major: 17 },
+    storage: { size: '10Gi', storageClass: 'fast' },
+    walStorage: { size: '2Gi' },
+    postgresql: { parameters: { max_connections: '200', shared_buffers: '256MB' } },
+    plugins: [{ name: 'barman-cloud.cloudnative-pg.io', isWALArchiver: true, parameters: { barmanObjectName: 'store', serverName: 'pg-a-v2' } }],
+  },
+  status: { conditions: [{ type: 'ContinuousArchiving', status: 'True' }] },
+}
+
+const pluginBackup = {
+  apiVersion: 'postgresql.cnpg.io/v1',
+  metadata: { name: 'b-plugin', namespace: 'db' },
+  spec: { cluster: { name: 'pg-a' }, method: 'plugin', pluginConfiguration: { name: 'barman-cloud.cloudnative-pg.io' } },
+  status: { phase: 'completed', backupId: '20260929T220000', stoppedAt: '2026-09-29T22:00:09Z', majorVersion: 17 },
+}
+
+const store = {
+  metadata: { name: 'store', namespace: 'db' },
+  status: { serverRecoveryWindow: { 'pg-a-v2': { firstRecoverabilityPoint: '2026-09-20T00:00:00Z', lastSuccessfulBackupTime: '2026-09-29T22:00:09Z' } } },
+}
+
+describe('restore sources', () => {
+  it('matches an in-tree archive by destination and endpoint as well as server name', () => {
+    const source = { kind: 'inTree' as const, serverName: 'pg-a', barmanObjectStore: { destinationPath: 's3://bucket/archive/', endpointURL: 'https://storage.example' } }
+    const sourceCluster = { metadata: { name: 'pg-a', namespace: 'db' }, spec: { backup: { barmanObjectStore: { ...source.barmanObjectStore, destinationPath: 's3://bucket/archive' } } } }
+    const other = { metadata: { name: 'pg-a', namespace: 'db' }, spec: {} }
+    expect(sourceClusterFor(source, [other, sourceCluster], 'db')).toBe(sourceCluster)
+    expect(sourceClusterFor(source, [{ ...sourceCluster, spec: { backup: { barmanObjectStore: { ...source.barmanObjectStore, endpointURL: 'https://other.example' } } } }], 'db')).toBeNull()
+  })
+  it('recognizes a restored Cluster with its own archive declaration, while ignoring disabled plugins', () => {
+    const restored = { ...cluster, spec: { ...cluster.spec, bootstrap: { recovery: { source: 'origin' } } } }
+    const source = { kind: 'objectStore' as const, objectStore: 'store', serverName: 'pg-a-v2' }
+    expect(sourceClusterFor(source, [restored], 'db')).toBe(restored)
+    expect(sourceClusterFor(source, [{ ...restored, spec: { ...restored.spec, plugins: [{ ...cluster.spec.plugins[0], enabled: false }] } }], 'db')).toBeNull()
+  })
+  it('copies source settings from a backup-only plugin when restoring from its ObjectStore', () => {
+    const source = { kind: 'objectStore' as const, objectStore: 'store', serverName: 'pg-a-v2' }
+    const backupOnly = { ...cluster, spec: { ...cluster.spec, resources: { requests: { cpu: '1' } }, plugins: [{ ...cluster.spec.plugins[0], isWALArchiver: false }] } }
+    const picked = sourceClusterFor(source, [backupOnly], 'db')
+    const manifest = buildRestoreManifest({ sourceCluster: picked, source, namespace: 'db', newName: 'restored', target: { kind: 'latest' } })
+    expect(picked).toBe(backupOnly)
+    expect(manifest.spec).toMatchObject({ instances: 3, storage: cluster.spec.storage, walStorage: cluster.spec.walStorage, postgresql: cluster.spec.postgresql, resources: backupOnly.spec.resources })
+    expect(manifest.spec.plugins).toBeUndefined()
+    expect(sourceClusterFor(source, [backupOnly], 'other')).toBeNull()
+  })
+  it('restores a plugin Backup through its ObjectStore with the backup ID pinned', () => {
+    expect(restoreSourceForBackup(pluginBackup, cluster)).toEqual({
+      kind: 'objectStore',
+      majorVersion: 17,
+      objectStore: 'store',
+      serverName: 'pg-a-v2',
+      backupID: '20260929T220000',
+      backupName: 'b-plugin',
+      backupEnd: '2026-09-29T22:00:09Z',
+    })
+    const inTree = { ...pluginBackup, spec: { cluster: { name: 'pg-a' } }, status: { phase: 'completed', stoppedAt: 'x' } }
+    expect(restoreSourceForBackup(inTree, cluster)).toMatchObject({ kind: 'backup', backup: 'b-plugin' })
+    expect(restoreSourceForBackup({ ...pluginBackup, status: { phase: 'running' } }, cluster)).toBeNull()
+  })
+
+  it('ignores Backup parameters for the store and server, including the Cluster-name default', () => {
+    const conflicting = { ...pluginBackup, spec: { ...pluginBackup.spec, pluginConfiguration: { ...pluginBackup.spec.pluginConfiguration, parameters: { barmanObjectName: 'backup-store', serverName: 'backup-server' } } } }
+    expect(restoreSourceForBackup(conflicting, cluster)).toEqual(restoreSourceForBackup(pluginBackup, cluster))
+    const defaultServer = { ...cluster, spec: { plugins: [{ name: 'barman-cloud.cloudnative-pg.io', parameters: { barmanObjectName: 'cluster-store' } }] } }
+    expect(restoreSourceForBackup(conflicting, defaultServer)).toMatchObject({ objectStore: 'cluster-store', serverName: 'pg-a' })
+    expect(restoreSourceForBackup(conflicting, null)).toBeNull()
+    expect(restoreSourceForBackup(conflicting, { ...cluster, spec: { plugins: [{ name: 'barman-cloud.cloudnative-pg.io' }] } })).toBeNull()
+    expect(restoreSourceForBackup(conflicting, { ...cluster, spec: { plugins: [{ ...cluster.spec.plugins[0], enabled: false }] } })).toBeNull()
+  })
+
+  it('lists the store first, then completed Backups of this cluster only', () => {
+    const other = { ...pluginBackup, metadata: { name: 'x', namespace: 'db' }, spec: { ...pluginBackup.spec, cluster: { name: 'other' } } }
+    const sources = restoreSourcesFor(cluster, [pluginBackup, other])
+    expect(sources.map((s) => s.kind)).toEqual(['objectStore', 'objectStore'])
+    expect(sources[1]).toMatchObject({ backupName: 'b-plugin' })
+  })
+
+  it('offers one source per server an ObjectStore reports', () => {
+    expect(restoreSourcesForStore(store)).toEqual([{ kind: 'objectStore', objectStore: 'store', serverName: 'pg-a-v2' }])
+  })
+})
+
+describe('restore manifest', () => {
+  it('copies what the data needs, reads the source store and never archives into it', () => {
+    const m = buildRestoreManifest({ sourceCluster: cluster, source: { kind: 'objectStore', objectStore: 'store', serverName: 'pg-a-v2' }, namespace: 'db', newName: 'pg-a-restore', target: { kind: 'time', iso: '2026-09-28T12:00:00Z' } })
+    expect(m.spec.bootstrap.recovery).toEqual({ source: 'origin', recoveryTarget: { targetTime: '2026-09-28T12:00:00Z' } })
+    expect(m.spec.externalClusters[0].plugin.parameters).toEqual({ barmanObjectName: 'store', serverName: 'pg-a-v2' })
+    expect(m.spec.plugins).toBeUndefined()
+    expect(m.spec.backup).toBeUndefined()
+    expect(m.spec).toMatchObject({ instances: 3, walStorage: { size: '2Gi' }, postgresql: { parameters: { max_connections: '200' } } })
+    expect(m.spec.imageCatalogRef.major).toBe(17)
+  })
+
+  it('stops at the end of a pinned backup with targetImmediate', () => {
+    const source = restoreSourceForBackup(pluginBackup, cluster)!
+    const end = buildRestoreManifest({ sourceCluster: cluster, source, namespace: 'db', newName: 'r', target: { kind: 'backupEnd' } })
+    expect(end.spec.bootstrap.recovery.recoveryTarget).toEqual({ backupID: '20260929T220000', targetImmediate: true })
+    const latest = buildRestoreManifest({ sourceCluster: cluster, source, namespace: 'db', newName: 'r', target: { kind: 'latest' } })
+    expect(latest.spec.bootstrap.recovery.recoveryTarget).toEqual({ backupID: '20260929T220000' })
+  })
+
+  it('restores an in-tree Backup by reference', () => {
+    const m = buildRestoreManifest({ sourceCluster: cluster, source: { kind: 'backup', backup: 'b1' }, namespace: 'db', newName: 'r', target: { kind: 'latest' } })
+    expect(m.spec.bootstrap.recovery).toEqual({ backup: { name: 'b1' } })
+    expect(m.spec.externalClusters).toBeUndefined()
+    const pitr = buildRestoreManifest({ sourceCluster: cluster, source: { kind: 'backup', backup: 'b1' }, namespace: 'db', newName: 'r', target: { kind: 'time', iso: '2026-09-28T12:00:00Z' } })
+    expect(pitr.spec.bootstrap.recovery).toEqual({ backup: { name: 'b1' }, recoveryTarget: { targetTime: '2026-09-28T12:00:00Z' } })
+  })
+
+  it('offers only the end of a volume snapshot, and writes no later target for it', () => {
+    const snap = { apiVersion: 'postgresql.cnpg.io/v1', metadata: { name: 'snap', namespace: 'db' }, spec: { cluster: { name: 'pg-a' }, method: 'volumeSnapshot' }, status: { phase: 'completed', method: 'volumeSnapshot', stoppedAt: '2026-09-30T12:00:00Z' } }
+    const source = restoreSourceForBackup(snap, cluster)!
+    expect(source).toMatchObject({ kind: 'backup', backup: 'snap', snapshot: true, backupEnd: '2026-09-30T12:00:00Z' })
+    expect(restoreTargetKinds(source)).toEqual(['backupEnd'])
+    expect(describeSource(source)).toBe('Backup snap (volume snapshot)')
+    for (const target of [{ kind: 'backupEnd' as const }, { kind: 'latest' as const }, { kind: 'time' as const, iso: '2026-09-30T13:00:00Z' }]) {
+      const m = buildRestoreManifest({ sourceCluster: cluster, source, namespace: 'db', newName: 'r', target })
+      expect(m.spec.bootstrap.recovery).toEqual({ backup: { name: 'snap' } })
+      expect(m.spec.externalClusters).toBeUndefined()
+    }
+    const inTree = restoreSourceForBackup({ ...snap, spec: { cluster: { name: 'pg-a' }, method: 'barmanObjectStore' }, status: { ...snap.status, method: 'barmanObjectStore' } }, cluster)!
+    expect(inTree).not.toHaveProperty('snapshot')
+    expect(restoreTargetKinds(inTree)).toEqual(['latest', 'time'])
+    expect(restoreTargetKinds(restoreSourceForBackup(pluginBackup, cluster)!)).toEqual(['backupEnd', 'latest', 'time'])
+    expect(restoreTargetKinds({ kind: 'objectStore', objectStore: 'store', serverName: 'pg-a-v2' })).toEqual(['latest', 'time'])
+  })
+
+  it('lists copied facts and says what is missing without a source cluster', () => {
+    const facts = preflightFacts(cluster)
+    expect(facts.find((f) => f.path === 'spec.walStorage')?.copied).toBe(true)
+    expect(facts.find((f) => f.path === 'spec.postgresql.parameters')?.value).toContain('max_connections')
+    const none = preflightFacts(null)
+    expect(none.every((f) => !f.copied)).toBe(true)
+  })
+})
+
+describe('PITR evidence', () => {
+  const evidence = recoveryEvidenceFor({ kind: 'objectStore', objectStore: 'store', serverName: 'pg-a-v2' }, { sourceCluster: cluster, stores: [store], backups: [pluginBackup], namespace: 'db' })
+  const runtime = {
+    permission: { proxy: 'allowed' },
+    instances: [{ pod: 'pg-a-1', role: 'primary', status: { state: 'ok', archiving: { lastArchivedAt: '2026-09-30T08:00:00Z', lastArchivedWal: 'wal', lastFailedAt: '2026-09-30T07:00:00Z' } } }],
+  } as any
+
+  it.each([false, true])('uses WAL evidence only from the matching archiver (pinned backup: %s)', (pinned) => {
+    const source = { kind: 'objectStore' as const, objectStore: 'store', serverName: 'pg-a-v2', ...(pinned ? { backupID: '20260929T220000', backupName: 'b-plugin' } : {}) }
+    const e = recoveryEvidenceFor(source, { sourceCluster: cluster, stores: [store], backups: [pluginBackup], namespace: 'db', runtime })
+    expect(e.archiving.tone).toBe('healthy')
+    expect(e.lastArchived).toMatchObject({ at: '2026-09-30T08:00:00Z', source: 'instance manager on pg-a-1' })
+    expect(e.lastArchiveFailure?.at).toBe('2026-09-30T07:00:00Z')
+    expect(pitrWarnings('2026-09-30T06:00:00Z', e, Date.parse('2026-09-30T12:00:00Z'))).toEqual([])
+
+    for (const plugin of [
+      { ...cluster.spec.plugins[0], isWALArchiver: false },
+      { ...cluster.spec.plugins[0], enabled: false },
+      { ...cluster.spec.plugins[0], parameters: { barmanObjectName: 'other', serverName: 'pg-a-v2' } },
+      { ...cluster.spec.plugins[0], parameters: { barmanObjectName: 'store', serverName: 'other' } },
+    ]) {
+      const sourceCluster = { ...cluster, spec: { ...cluster.spec, plugins: [plugin] } }
+      const unknown = recoveryEvidenceFor(source, { sourceCluster, stores: [store], backups: [pluginBackup], namespace: 'db', runtime })
+      expect(unknown.archiving.tone).toBe('unknown')
+      expect(unknown.lastArchived).toBeUndefined()
+      expect(unknown.lastArchiveFailure).toBeUndefined()
+      expect(latestEvidence(unknown)?.at).toBe('2026-09-29T22:00:09Z')
+      expect(unknown.gaps).toContain('No live cluster archives into this source, so WAL archived after the last backup is unknown')
+      expect(pitrWarnings('2026-09-30T06:00:00Z', unknown, Date.parse('2026-09-30T12:00:00Z'))[0]).toContain('after the newest evidence')
+    }
+  })
+
+  it('reads the window from the store and archiving from the condition, naming sources', () => {
+    expect(evidence.firstPoint).toEqual({ at: '2026-09-20T00:00:00Z', source: 'ObjectStore store status, server pg-a-v2' })
+    expect(evidence.lastBackup?.at).toBe('2026-09-29T22:00:09Z')
+    expect(evidence.archiving.tone).toBe('healthy')
+    expect(evidence.gaps.some((g) => g.includes('last archived WAL'))).toBe(true)
+  })
+
+  it('says the primary was unreachable rather than that it reported nothing', () => {
+    const runtime = {
+      permission: { proxy: 'allowed' },
+      instances: [{ pod: 'pg-a-1', role: 'primary', status: { state: 'unreachable', error: 'the Pod did not answer on port 8000 within 5 s' }, metrics: { state: 'unreachable' } }],
+    } as any
+    const e = recoveryEvidenceFor({ kind: 'objectStore', objectStore: 'store', serverName: 'pg-a-v2' }, { sourceCluster: cluster, stores: [store], backups: [pluginBackup], namespace: 'db', runtime })
+    expect(e.gaps).toContain('The primary’s instance manager could not be read (the Pod did not answer on port 8000 within 5 s), so the last archived WAL time is unknown')
+  })
+
+  it('warns, never blocks, outside the evidence', () => {
+    const now = Date.parse('2026-09-30T12:00:00Z')
+    expect(pitrWarnings('2026-09-25T00:00:00Z', evidence, now)).toEqual([])
+    expect(pitrWarnings('2026-09-01T00:00:00Z', evidence, now)[0]).toContain('before the first recoverability point')
+    expect(pitrWarnings('2026-09-30T06:00:00Z', evidence, now)[0]).toContain('after the newest evidence')
+    expect(pitrWarnings('2026-10-01T00:00:00Z', evidence, now)[0]).toContain('future')
+  })
+
+  describe('evidence per source', () => {
+    const now = Date.parse('2026-09-30T13:00:00Z')
+    const archive = { destinationPath: 's3://bucket/pg-b', endpointURL: 'https://storage.example' }
+    const inTreeCluster = {
+      apiVersion: 'postgresql.cnpg.io/v1',
+      metadata: { name: 'pg-b', namespace: 'db' },
+      spec: { backup: { barmanObjectStore: archive } },
+      status: {
+        conditions: [{ type: 'ContinuousArchiving', status: 'True' }],
+        firstRecoverabilityPoint: '2026-09-01T00:00:00Z',
+        firstRecoverabilityPointByMethod: { barmanObjectStore: '2026-09-29T00:00:00Z', volumeSnapshot: '2026-09-01T00:00:00Z' },
+        lastSuccessfulBackup: '2026-09-30T12:00:00Z',
+        lastSuccessfulBackupByMethod: { barmanObjectStore: '2026-09-30T09:00:00Z', volumeSnapshot: '2026-09-30T12:00:00Z' },
+      },
+    }
+    const backup = (name: string, method: string, stoppedAt: string, status: Record<string, unknown> = {}) => ({
+      apiVersion: 'postgresql.cnpg.io/v1',
+      metadata: { name, namespace: 'db' },
+      spec: { cluster: { name: 'pg-b' }, method },
+      status: { phase: 'completed', method, stoppedAt, ...status },
+    })
+    const base = backup('base-0900', 'barmanObjectStore', '2026-09-30T09:00:00Z', { destinationPath: 's3://bucket/pg-b/', endpointURL: 'https://storage.example', serverName: 'pg-b' })
+    const noonSnapshot = backup('snap-1200', 'volumeSnapshot', '2026-09-30T12:00:00Z')
+    const elsewhere = backup('other-1000', 'barmanObjectStore', '2026-09-30T10:00:00Z', { destinationPath: 's3://bucket/other', endpointURL: 'https://storage.example', serverName: 'pg-b' })
+    const unrecorded = backup('unrecorded-1030', 'barmanObjectStore', '2026-09-30T10:30:00Z')
+    const inTree = { kind: 'inTree' as const, barmanObjectStore: archive, serverName: 'pg-b' }
+    const backups = [base, noonSnapshot, elsewhere, unrecorded]
+
+    it('keeps a noon volume snapshot out of an in-tree archive whose newest base backup is 09:00', () => {
+      const e = recoveryEvidenceFor(inTree, { sourceCluster: inTreeCluster, stores: [], backups, namespace: 'db' })
+      expect(e.firstPoint?.at).toBe('2026-09-29T00:00:00Z')
+      expect(e.lastBackup?.at).toBe('2026-09-30T09:00:00Z')
+      expect(pitrWarnings('2026-09-30T11:00:00Z', e, now)[0]).toContain('after the newest evidence Radar has (2026-09-30 09:00:00 UTC')
+      expect(pitrWarnings('2026-09-28T12:00:00Z', e, now)[0]).toContain('before the first recoverability point')
+    })
+
+    it('reads the plain status fields from an operator that reports no per-method times', () => {
+      const plain = { conditions: inTreeCluster.status.conditions, firstRecoverabilityPoint: '2026-09-01T00:00:00Z', lastSuccessfulBackup: '2026-09-30T08:00:00Z' }
+      const e = recoveryEvidenceFor(inTree, { sourceCluster: { ...inTreeCluster, status: plain }, stores: [], backups: [base], namespace: 'db' })
+      expect(e.firstPoint?.at).toBe('2026-09-01T00:00:00Z')
+      expect(e.lastBackup).toEqual({ at: '2026-09-30T09:00:00Z', source: 'Backup base-0900' })
+    })
+
+    it('counts only plugin Backups into an ObjectStore, while their Cluster still points at it', () => {
+      const snapshotOfA = { ...noonSnapshot, spec: { ...noonSnapshot.spec, cluster: { name: 'pg-a' } } }
+      const inTreeOfA = { ...base, spec: { ...base.spec, cluster: { name: 'pg-a' } }, status: { ...base.status, stoppedAt: '2026-09-30T11:00:00Z' } }
+      const source = { kind: 'objectStore' as const, objectStore: 'store', serverName: 'pg-a-v2' }
+      const e = recoveryEvidenceFor(source, { sourceCluster: cluster, stores: [], backups: [pluginBackup, snapshotOfA, inTreeOfA], namespace: 'db' })
+      expect(e.lastBackup).toEqual({ at: '2026-09-29T22:00:09Z', source: 'Backup b-plugin' })
+      const moved = { ...cluster, spec: { ...cluster.spec, plugins: [{ ...cluster.spec.plugins[0], parameters: { barmanObjectName: 'elsewhere', serverName: 'pg-a-v2' } }] } }
+      expect(recoveryEvidenceFor(source, { sourceCluster: moved, stores: [], backups: [pluginBackup], namespace: 'db' }).lastBackup).toBeUndefined()
+    })
+
+    it('reads a Backup source as that Backup, and WAL only from the archive it recorded', () => {
+      const source = restoreSourceForBackup(base, inTreeCluster)!
+      const e = recoveryEvidenceFor(source, { sourceCluster: inTreeCluster, stores: [], backups, namespace: 'db', runtime })
+      expect(e.lastBackup).toEqual({ at: '2026-09-30T09:00:00Z', source: 'Backup base-0900' })
+      expect(e.archiving.tone).toBe('healthy')
+      expect(e.lastArchived?.at).toBe('2026-09-30T08:00:00Z')
+
+      const away = recoveryEvidenceFor(restoreSourceForBackup(elsewhere, inTreeCluster)!, { sourceCluster: inTreeCluster, stores: [], backups, namespace: 'db', runtime })
+      expect(away.lastBackup).toEqual({ at: '2026-09-30T10:00:00Z', source: 'Backup other-1000' })
+      expect(away.archiving.tone).toBe('unknown')
+      expect(away.lastArchived).toBeUndefined()
+      expect(away.gaps).toContain('No live cluster archives into this source, so WAL archived after the last backup is unknown')
+      expect(recoveryEvidenceFor(restoreSourceForBackup(unrecorded, inTreeCluster)!, { sourceCluster: inTreeCluster, stores: [], backups, namespace: 'db', runtime }).lastArchived).toBeUndefined()
+    })
+
+    it('reads a volume snapshot as its own end, with no archived WAL applied', () => {
+      const e = recoveryEvidenceFor(restoreSourceForBackup(noonSnapshot, inTreeCluster)!, { sourceCluster: inTreeCluster, stores: [], backups, namespace: 'db', runtime })
+      expect(e.lastBackup).toEqual({ at: '2026-09-30T12:00:00Z', source: 'Backup snap-1200' })
+      expect(e.archiving).toMatchObject({ text: 'Not replayed', tone: 'neutral' })
+      expect(e.lastArchived).toBeUndefined()
+      expect(e.lastArchiveFailure).toBeUndefined()
+      expect(e.gaps).toEqual([])
+    })
+  })
+
+  it('reads the target in the chosen zone and writes UTC without milliseconds', () => {
+    expect(targetIsoFrom('2026-09-28T12:00', 'utc')).toBe('2026-09-28T12:00:00Z')
+    expect(targetIsoFrom('2026-09-28T12:00:30', 'utc')).toBe('2026-09-28T12:00:30Z')
+    expect(targetIsoFrom('nope', 'utc')).toBeNull()
+  })
+})
+
+function snapshot(over: Partial<CNPGRecoveryResponse> & { phase?: string; ready?: number | null; instances?: number | null }): CNPGRecoveryResponse {
+  return {
+    cluster: { uid: 'u', phase: over.phase, instances: over.instances ?? 1, readyInstances: over.ready === undefined ? 0 : over.ready },
+    recovery: { sourceKind: 'objectStore', objectStore: 'store', serverName: 'pg-a' },
+    pods: over.pods ?? [],
+    jobs: over.jobs ?? [],
+    events: [],
+    coverage: over.coverage ?? { pods: { state: 'ok' }, jobs: { state: 'ok' }, events: { state: 'ok' } },
+    capturedAt: '2026-09-30T00:00:00Z',
+  }
+}
+
+describe('observeRestore', () => {
+  const recoveryPod = (init: 'running' | 'crash') => ({
+    name: 'r-1-full-recovery-x',
+    uid: 'p',
+    kind: 'job' as const,
+    job: 'r-1-full-recovery',
+    ownerVerified: true,
+    phase: init === 'crash' ? 'Pending' : 'Running',
+    ready: false,
+    initContainers: [init === 'crash' ? { name: 'bootstrap-controller', state: 'waiting' as const, reason: 'CrashLoopBackOff', restarts: 3, ready: false } : { name: 'bootstrap-controller', state: 'terminated' as const, exitCode: 0, restarts: 0, ready: false }],
+    containers: [{ name: 'full-recovery', state: init === 'crash' ? ('waiting' as const) : ('running' as const), restarts: 0, ready: false }],
+  })
+
+  it('follows the recovery Pod and points at its logs', () => {
+    const o = observeRestore(snapshot({ phase: 'Setting up primary', pods: [recoveryPod('running')] }))
+    expect(o.state).toBe('progressing')
+    expect(o.logsPod).toEqual({ name: 'r-1-full-recovery-x', container: 'full-recovery' })
+  })
+
+  it('surfaces a crashing init container', () => {
+    const o = observeRestore(snapshot({ phase: 'Setting up primary', pods: [recoveryPod('crash')] }))
+    expect(o.tone).toBe('alert')
+    expect(o.logsPod?.container).toBe('bootstrap-controller')
+  })
+
+  it('fails on a failed recovery Job, by role or by name', () => {
+    const failedWith = 'BackoffLimitExceeded: Job has reached the specified backoff limit'
+    expect(observeRestore(snapshot({ jobs: [{ name: 'r-1-full-recovery', active: 0, succeeded: 0, failed: 6, complete: false, failedWith }] })).state).toBe('failed')
+    expect(observeRestore(snapshot({ jobs: [{ name: 'r-1-restore', role: 'snapshot-recovery', active: 0, succeeded: 0, failed: 6, complete: false, failedWith }] })).state).toBe('failed')
+  })
+
+  it('completes once a restored instance is ready, read from its Pod or the Cluster', () => {
+    const instance = { name: 'r-1', uid: 'i1', kind: 'instance' as const, ownerVerified: true, phase: 'Running', ready: true, initContainers: [], containers: [] }
+    const fromPod = observeRestore(snapshot({ phase: 'Creating a new replica', ready: 0, instances: 3, pods: [instance] }))
+    expect(fromPod.state).toBe('completed')
+    const denied = { pods: { state: 'denied' as const }, jobs: { state: 'denied' as const }, events: { state: 'denied' as const } }
+    expect(observeRestore(snapshot({ phase: 'Cluster in healthy state', ready: 1, instances: 3, coverage: denied })).state).toBe('completed')
+    expect(observeRestore(snapshot({ phase: 'Setting up primary', ready: 0, instances: 3 })).state).toBe('progressing')
+  })
+
+  describe('weeks after the restore', () => {
+    const ready = (name: string) => ({ name, uid: name, kind: 'instance' as const, ownerVerified: true, phase: 'Running', ready: true, initContainers: [], containers: [] })
+    const join = (phase: string) => ({
+      name: 'r-4-join-x',
+      uid: 'j',
+      kind: 'job' as const,
+      job: 'r-4-join',
+      ownerVerified: true,
+      phase,
+      ready: false,
+      initContainers: [{ name: 'bootstrap-controller', state: 'terminated' as const, exitCode: 0, restarts: 0, ready: false }],
+      containers: [{ name: 'join', state: 'running' as const, restarts: 0, ready: false }],
+    })
+    const recovered = { name: 'r-1-full-recovery', role: 'full-recovery', active: 0, succeeded: 1, failed: 0, complete: true }
+
+    it('a switchover reads restored, not "Restore in progress"', () => {
+      const o = observeRestore(snapshot({ phase: 'Switchover in progress', ready: 2, instances: 3, pods: [ready('r-1'), ready('r-2')], jobs: [recovered] }))
+      expect(o.state).toBe('completed')
+    })
+
+    it('a scale-up join Pod is not read as restoring the base backup', () => {
+      const o = observeRestore(snapshot({ phase: 'Creating a new replica', ready: 3, instances: 4, pods: [ready('r-1'), ready('r-2'), ready('r-3'), join('Running')], jobs: [recovered, { name: 'r-4-join', role: 'join', active: 1, succeeded: 0, failed: 0, complete: false }] }))
+      expect(o.state).toBe('completed')
+      expect(o.recoveryPods).toEqual([])
+    })
+
+    it('a failed join Job is not a failed restore', () => {
+      const failedJoin = { name: 'r-4-join', role: 'join', active: 0, succeeded: 0, failed: 6, complete: false, failedWith: 'BackoffLimitExceeded' }
+      expect(observeRestore(snapshot({ phase: 'Creating a new replica', ready: 3, instances: 4, pods: [ready('r-1'), ready('r-2'), ready('r-3')], jobs: [recovered, failedJoin] })).state).toBe('completed')
+      expect(observeRestore(snapshot({ phase: 'Creating a new replica', ready: 3, instances: 4, pods: [ready('r-1')], jobs: [{ ...failedJoin, role: undefined }] })).state).toBe('completed')
+    })
+
+    it('stays restored while every instance is down, from the completed recovery Job', () => {
+      const down = (name: string) => ({ ...ready(name), phase: 'Pending', ready: false })
+      const hibernated = observeRestore(snapshot({ phase: 'Cluster in hibernation', ready: 0, instances: 3, jobs: [recovered] }))
+      expect(hibernated.state).toBe('completed')
+      expect(hibernated.detail).toBe('Recovery Job r-1-full-recovery completed · 0/3 instances ready · Cluster in hibernation')
+      expect(observeRestore(snapshot({ phase: 'Setting up primary', ready: 0, pods: [down('r-1')], jobs: [{ ...recovered, role: undefined, complete: false }] })).state).toBe('completed')
+      expect(observeRestore(snapshot({ phase: 'Waiting for the instances to become active', ready: 0, pods: [down('r-1')], jobs: [{ name: 'r-1-join', role: 'join', active: 0, succeeded: 1, failed: 0, complete: true }] })).state).toBe('progressing')
+      const snapshotJob = { name: 'r-1-snapshot-recovery', role: 'snapshot-recovery', active: 0, succeeded: 1, failed: 0, complete: true }
+      expect(observeRestore(snapshot({ phase: 'Setting up primary', ready: 0, pods: [down('r-1')], jobs: [snapshotJob] })).state).toBe('progressing')
+      expect(observeRestore(snapshot({ phase: 'Setting up primary', ready: 0, pods: [down('r-1')], jobs: [{ ...snapshotJob, role: undefined }] })).state).toBe('progressing')
+      const noJobs = { pods: { state: 'ok' as const }, jobs: { state: 'denied' as const }, events: { state: 'ok' as const } }
+      expect(observeRestore(snapshot({ phase: 'Setting up primary', ready: 0, pods: [down('r-1')], coverage: noJobs }))).toMatchObject({ state: 'progressing', title: 'Waiting for the recovery to start' })
+    })
+
+    it('a Job read without its role counts as recovery only by its role-suffixed name', () => {
+      const o = observeRestore(snapshot({ phase: 'Setting up primary', ready: 0, pods: [join('Running')], jobs: [{ name: 'r-4-join', active: 1, succeeded: 0, failed: 0, complete: false }] }))
+      expect(o.recoveryPods).toEqual([])
+      expect(o.title).toBe('Waiting for the recovery to start')
+    })
+  })
+
+  it('still reads an in-progress recovery as progressing', () => {
+    const o = observeRestore(snapshot({ phase: 'Setting up primary', ready: 0, pods: [recoveryPod('running')], jobs: [{ name: 'r-1-full-recovery', role: 'full-recovery', active: 1, succeeded: 0, failed: 0, complete: false }] }))
+    expect(o.state).toBe('progressing')
+    expect(o.title).toBe('Restoring the base backup and replaying WAL')
+    expect(o.recoveryPods.map((p) => p.name)).toEqual(['r-1-full-recovery-x'])
+  })
+
+  it('never reads missing access as progress or failure', () => {
+    const o = observeRestore(snapshot({ coverage: { pods: { state: 'denied', grant: { verb: 'list', resource: 'pods', namespace: 'db' } }, jobs: { state: 'denied' }, events: { state: 'denied' } } }))
+    expect(o.state).toBe('unobservable')
+    expect(o.detail).toContain('list pods')
+  })
+})
+
+describe('restore operation observer', () => {
+  const op = { id: '1', kind: 'restore', label: 'Restore into r', apiBase: '/api', context: 'c', namespace: 'db', cluster: 'r', startedAt: 0, baseline: {}, state: 'requested' as const, lastProgressAt: 0 }
+
+  it('waits for the Cluster, then completes on a healthy phase with all instances ready', () => {
+    expect(restoreOperationObserver(op, { now: 1000 }).state).toBe('requested')
+    const progressing = restoreOperationObserver(op, { now: 1000, cluster: { spec: { instances: 1 }, status: { phase: 'Setting up primary', readyInstances: 0 } } })
+    expect(progressing.state).not.toBe('completed')
+    const done = restoreOperationObserver(op, {
+      now: 1000,
+      cluster: { spec: { instances: 1 }, status: { phase: 'Cluster in healthy state', readyInstances: 1 } },
+      ha: { jobs: { state: 'ok', items: [{ name: 'r-1-full-recovery', role: 'full-recovery', phase: 'succeeded' }] } } as any,
+    })
+    expect(done.state).toBe('completed')
+  })
+
+  it('completes without Job access once the restored cluster is healthy and ready', () => {
+    const done = restoreOperationObserver(op, {
+      now: 1000,
+      cluster: { spec: { instances: 1 }, status: { phase: 'Cluster in healthy state', readyInstances: 1 } },
+      ha: { jobs: { state: 'denied' } } as any,
+    })
+    expect(done.state).toBe('completed')
+  })
+
+  it('fails when the recovery Job fails', () => {
+    const r = restoreOperationObserver(op, {
+      now: 1000,
+      cluster: { spec: { instances: 1 }, status: { phase: 'Setting up primary' } },
+      ha: { jobs: { state: 'ok', items: [{ name: 'r-1-full-recovery', role: 'full-recovery', phase: 'failed', reason: 'BackoffLimitExceeded' }] } } as any,
+    })
+    expect(r.state).toBe('failed')
+  })
+})
+
+describe('restorePermission', () => {
+  it('blocks review with the grant when create clusters is denied, whichever way the dialog opened', () => {
+    const r = restorePermission('db', { allowed: false, permission: 'denied', grant: { verb: 'create', group: 'postgresql.cnpg.io', resource: 'clusters', namespace: 'db' }, reason: 'x' }, undefined)
+    expect(r.blocked).toContain('needs create clusters (postgresql.cnpg.io) in namespace db')
+  })
+  it('blocks with the refusal when the operator webhook rejects writes', () => {
+    expect(restorePermission('db', { allowed: false, permission: 'allowed', reason: 'The API server would reject it: no ready endpoint' }, undefined).blocked).toContain('no ready endpoint')
+  })
+  it('is pending while checking, open when allowed, and unchecked (not blocked) when the check failed', () => {
+    expect(restorePermission('db', undefined, undefined).pending).toBeDefined()
+    expect(restorePermission('db', { allowed: true, permission: 'allowed' }, undefined)).toEqual({})
+    const failed = restorePermission('db', undefined, new Error('boom'))
+    expect(failed.blocked).toBeUndefined()
+    expect(failed.unchecked).toContain('boom')
+  })
+})
+
+describe('restoreNextSteps', () => {
+  it('marks done or to do only what Radar can read, never whether applications moved', () => {
+    const fresh = restoreNextSteps({ validationRecorded: false, backup: 'none' })
+    expect(fresh.map((s) => [s.id, s.state])).toEqual([
+      ['connect', 'unknown'],
+      ['validate', 'todo'],
+      ['backup', 'todo'],
+    ])
+    expect(fresh[2].note).toContain('no backup destination')
+    expect(restoreNextSteps({ validationRecorded: true, backup: 'walArchiving' }).map((s) => s.state)).toEqual(['unknown', 'done', 'partial'])
+    expect(restoreNextSteps({ validationRecorded: false, backup: undefined })[2].state).toBe('unknown')
+  })
+  it('never counts volume snapshots alone, or backups without WAL archiving, as done', () => {
+    const plugin = (isWALArchiver: boolean) => ({ spec: { plugins: [{ name: 'barman-cloud.cloudnative-pg.io', isWALArchiver, parameters: { barmanObjectName: 'store' } }] } })
+    const step = (cluster: any) => restoreNextSteps({ validationRecorded: false, backup: restoreBackupDeclared(cluster) })[2]
+    expect(step({ spec: { backup: { volumeSnapshot: { className: 'csi' } } } })).toMatchObject({
+      state: 'partial',
+      note: 'Volume snapshots declared, but no WAL archiving, so no point-in-time recovery',
+    })
+    expect(step(plugin(false))).toMatchObject({ state: 'partial' })
+    expect(step(plugin(true)).state).toBe('partial')
+    const noDestination = step({ spec: { plugins: [{ name: 'barman-cloud.cloudnative-pg.io', isWALArchiver: true }] } })
+    expect(noDestination.state).toBe('partial')
+    expect(noDestination.note).toContain('names no ObjectStore')
+    expect(step({ spec: { backup: { barmanObjectStore: { destinationPath: 's3://b' } } } }).state).toBe('partial')
+    expect(step({ spec: {} }).state).toBe('todo')
+  })
+})
+
+describe('resourcesText', () => {
+  it('reads requests and limits instead of JSON', () => {
+    expect(resourcesText({ requests: { cpu: '50m', memory: '128Mi' } })).toBe('requests: cpu 50m, memory 128Mi')
+    expect(resourcesText({ requests: { cpu: '50m' }, limits: { memory: '256Mi' } })).toBe('requests: cpu 50m · limits: memory 256Mi')
+  })
+})
+
+describe('cnpgRestoredPrimaryUp', () => {
+  const pod = (kind: 'job' | 'instance', phase: string, ready: boolean) => ({ name: `${kind}-x`, uid: kind, kind, ownerVerified: true, phase, ready, initContainers: [], containers: [] })
+  it('is up once a restored instance is ready, even if the cluster later degrades', () => {
+    // A replica lost after the restore does not reopen the restore.
+    const degraded = snapshot({ phase: 'Cluster in healthy state', ready: 1, instances: 2, pods: [pod('job', 'Succeeded', false), pod('instance', 'Running', true), pod('instance', 'Running', false)] as any })
+    expect(observeRestore(degraded).state).toBe('completed')
+    expect(cnpgRestoredPrimaryUp(degraded)).toBe(true)
+  })
+  it('is not up while recovery runs or when Pods cannot be seen, and a join Job does not hide it', () => {
+    expect(cnpgRestoredPrimaryUp(snapshot({ pods: [pod('job', 'Running', false)] as any }))).toBe(false)
+    // A replica joining after the restore runs a Job too.
+    expect(cnpgRestoredPrimaryUp(snapshot({ pods: [pod('job', 'Running', false), pod('instance', 'Running', true)] as any }))).toBe(true)
+    expect(cnpgRestoredPrimaryUp(snapshot({ pods: [pod('instance', 'Running', true)] as any, coverage: { pods: { state: 'denied' }, jobs: { state: 'ok' }, events: { state: 'ok' } } as any }))).toBe(false)
+  })
+})
+
+describe('restore availability and image review', () => {
+  it('disables only a readable, empty source list', async () => {
+    const { assessRestoreSources } = await import('./restoreModel')
+    const sourceCluster = { metadata: { name: 'pg', namespace: 'db' }, spec: {} }
+    const data = { objects: { backups: [] }, coverage: { backups: { state: 'full' } } } as any
+    expect(assessRestoreSources(data, 'db', sourceCluster).disabledReason).toContain('Nothing to restore')
+    for (const state of ['denied', 'error', 'syncing', 'uncached']) {
+      const result = assessRestoreSources({ ...data, coverage: { backups: { state } } }, 'db', sourceCluster)
+      expect(result.disabledReason).toBeUndefined()
+      expect(result.unreadReason).toContain('could not be read')
+    }
+    const partial = { ...data, coverage: { backups: { state: 'partial', deniedNamespaces: ['other'] } } }
+    expect(assessRestoreSources(partial, 'db', sourceCluster).disabledReason).toBeDefined()
+    expect(assessRestoreSources(partial, 'other', sourceCluster).disabledReason).toBeUndefined()
+    expect(assessRestoreSources(data, 'db', cluster).disabledReason).toBeUndefined()
+  })
+  it('copies status.image for an unpinned archive only without a declared image or catalog and labels its origin', () => {
+    const source = { kind: 'objectStore', objectStore: 'store', serverName: 'pg' } as const
+    const build = (sourceCluster: any) => buildRestoreManifest({ sourceCluster, source, namespace: 'db', newName: 'r', target: { kind: 'latest' } }).spec
+    const fromStatus = { spec: {}, status: { image: 'pg:17.6' } }
+    expect(build(fromStatus).imageName).toBe('pg:17.6')
+    expect(preflightFacts(fromStatus).find((f) => f.label === 'Image')).toMatchObject({ copied: true, value: 'pg:17.6 (from status.image)' })
+    const declared = { spec: { imageName: 'pg:17.7' }, status: { image: 'pg:17.6' } }
+    expect(build(declared).imageName).toBe('pg:17.7')
+    const catalog = { ...cluster, status: { image: 'pg:17.6' } }
+    expect(build(catalog).imageCatalogRef).toEqual(cluster.spec.imageCatalogRef)
+    expect(build(catalog).imageName).toBeUndefined()
+    expect(preflightFacts(catalog).find((f) => f.label === 'Image')?.path).toBe('spec.imageCatalogRef')
+  })
+})
+
+it('separates declared destinations, unread sources and recorded recovery evidence', async () => {
+  const { assessRestoreSources } = await import('./restoreModel')
+  const cluster = { metadata: { name: 'pg', namespace: 'db' }, spec: { backup: { barmanObjectStore: { destinationPath: 's3://backups' } } }, status: {} as any }
+  const data = { coverage: { backups: { state: 'full' } }, objects: { backups: [] as any[] } } as any
+  expect(assessRestoreSources(data, 'db', cluster).recoveryState).toBe('none')
+  expect(assessRestoreSources(undefined, 'db', cluster).recoveryState).toBe('unknown')
+  expect(assessRestoreSources({ ...data, coverage: { backups: { state: 'denied' } } }, 'db', cluster).recoveryState).toBe('unknown')
+  cluster.status.lastSuccessfulBackup = '2026-10-01T00:00:00Z'
+  expect(assessRestoreSources(data, 'db', cluster).recoveryState).toBe('available')
+  delete cluster.status.lastSuccessfulBackup
+  data.objects.backups = [{ metadata: { name: 'completed', namespace: 'db' }, spec: { cluster: { name: 'pg' }, method: 'volumeSnapshot' }, status: { phase: 'completed' } }]
+  expect(assessRestoreSources(data, 'db', { ...cluster, spec: {} }).recoveryState).toBe('available')
+  const plugin = { ...cluster, spec: { plugins: [{ name: 'barman-cloud.cloudnative-pg.io', parameters: { barmanObjectName: 'store' } }] } }
+  data.objects.backups = []
+  expect(assessRestoreSources({ ...data, coverage: { ...data.coverage, objectStores: { state: 'denied' } } }, 'db', plugin).recoveryState).toBe('unknown')
+  data.objects.objectStores = [{ metadata: { name: 'store', namespace: 'db' }, status: { serverRecoveryWindow: { pg: { lastSuccessfulBackupTime: '2026-10-01T00:00:00Z' } } } }]
+  expect(assessRestoreSources({ ...data, coverage: { ...data.coverage, objectStores: { state: 'full' } } }, 'db', plugin).recoveryState).toBe('available')
+})
+
+
+describe('Cluster plugin recovery destinations', () => {
+  const sourceCluster = { apiVersion: 'postgresql.cnpg.io/v1', kind: 'Cluster', metadata: { name: 'pg-a', namespace: 'db' }, spec: { plugins: [{ name: 'barman-cloud.cloudnative-pg.io' }] } }
+  const schedule = { apiVersion: 'postgresql.cnpg.io/v1', kind: 'ScheduledBackup', metadata: { name: 'nightly', namespace: 'db' }, spec: { cluster: { name: 'pg-a' }, method: 'plugin', pluginConfiguration: { name: 'barman-cloud.cloudnative-pg.io', parameters: { barmanObjectName: 'store', serverName: 'pg-a-v2' } } } }
+  const data = { coverage: { backups: { state: 'full' }, scheduledBackups: { state: 'full' }, objectStores: { state: 'full' } }, objects: { backups: [], scheduledBackups: [schedule], objectStores: [store] } } as any
+
+  it('cannot obtain a recovery destination from a schedule parameter', async () => {
+    const { assessRestoreSources } = await import('./restoreModel')
+    expect(assessRestoreSources(data, 'db', sourceCluster)).toEqual({ sources: [], recoveryState: 'none', unreadReason: undefined, disabledReason: 'Nothing to restore from yet: no backup destination and no completed Backup.' })
+  })
+  it('keeps a completed barman-cloud Backup unknown when the Cluster no longer names its ObjectStore', async () => {
+    const { assessRestoreSources } = await import('./restoreModel')
+    const completed = { apiVersion: 'postgresql.cnpg.io/v1', kind: 'Backup', metadata: { name: 'b1', namespace: 'db' }, spec: { cluster: { name: 'pg-a' }, method: 'plugin', pluginConfiguration: { name: 'barman-cloud.cloudnative-pg.io' } }, status: { phase: 'completed', backupId: 'x' } }
+    const assessment = assessRestoreSources({ ...data, objects: { ...data.objects, backups: [completed] } }, 'db', sourceCluster)
+    expect(assessment.recoveryState).toBe('unknown')
+    expect(assessment.unreadReason).toContain('Backup b1 completed with the barman-cloud plugin, but the Cluster no longer names an ObjectStore')
+    expect(assessment.disabledReason).toBeUndefined()
+  })
+  it('keeps unreadable or missing Cluster ObjectStores unknown and explains why', async () => {
+    const { assessRestoreSources } = await import('./restoreModel')
+    for (const state of ['denied', 'error', 'syncing', 'uncached']) {
+      const assessment = assessRestoreSources({ ...data, coverage: { ...data.coverage, objectStores: { state } } }, 'db', cluster)
+      expect(assessment.recoveryState).toBe('unknown')
+      expect(assessment.unreadReason).toContain('ObjectStore store could not be read in db')
+      expect(assessment.disabledReason).toBeUndefined()
+      expect(assessment.sources).toEqual([{ kind: 'objectStore', objectStore: 'store', serverName: 'pg-a-v2' }])
+    }
+    expect(assessRestoreSources({ ...data, objects: { ...data.objects, objectStores: [] } }, 'db', cluster)).toMatchObject({ recoveryState: 'unknown', unreadReason: expect.stringContaining('ObjectStore store could not be read') })
+  })
+  it('does not add a conflicting schedule destination to the Cluster recovery sources', async () => {
+    const { assessRestoreSources } = await import('./restoreModel')
+    const other = { ...schedule, spec: { ...schedule.spec, pluginConfiguration: { ...schedule.spec.pluginConfiguration, parameters: { barmanObjectName: 'schedule-store', serverName: 'schedule-server' } } } }
+    expect(assessRestoreSources({ ...data, objects: { ...data.objects, scheduledBackups: [other] } }, 'db', cluster)).toEqual({ sources: [{ kind: 'objectStore', objectStore: 'store', serverName: 'pg-a-v2' }], recoveryState: 'available', disabledReason: undefined, unreadReason: undefined })
+    expect(restoreSourcesFor(sourceCluster, [])).toEqual([])
+  })
+  it('ignores schedules from another namespace or API group when assessing unsupported methods', async () => {
+    const { assessRestoreSources } = await import('./restoreModel')
+    const unsupported = { ...schedule, spec: { ...schedule.spec, pluginConfiguration: { name: 'other.example.com' } } }
+    const foreign = [{ ...unsupported, metadata: { ...schedule.metadata, namespace: 'other' } }, { ...unsupported, apiVersion: 'other.io/v1' }]
+    expect(assessRestoreSources({ ...data, objects: { ...data.objects, scheduledBackups: foreign } }, 'db', cluster)).toEqual({ sources: [{ kind: 'objectStore', objectStore: 'store', serverName: 'pg-a-v2' }], recoveryState: 'available', disabledReason: undefined, unreadReason: undefined })
+  })
+  it('keeps unsupported plugin methods unknown instead of claiming there are no backups', async () => {
+    const { assessRestoreSources } = await import('./restoreModel')
+    const unsupported = { ...schedule, spec: { ...schedule.spec, pluginConfiguration: { name: 'other.example.com' } } }
+    const assessment = assessRestoreSources({ ...data, objects: { ...data.objects, scheduledBackups: [unsupported] } }, 'db', { ...sourceCluster, spec: { plugins: [{ name: 'other.example.com' }] } })
+    expect(assessment.recoveryState).toBe('unknown')
+    expect(assessment.sources).toEqual([])
+    expect(assessment.unreadReason).toContain('plugin other.example.com cannot be assessed')
+    expect(assessment.disabledReason).toBeUndefined()
+    expect(restoreSourceForBackup({ ...pluginBackup, spec: { ...pluginBackup.spec, pluginConfiguration: { name: 'other.example.com', parameters: { barmanObjectName: 'store' } } } }, cluster)).toBeNull()
+  })
+  it('reserves none for assessed destinations with no recorded evidence', async () => {
+    const { assessRestoreSources } = await import('./restoreModel')
+    const assessment = assessRestoreSources({ ...data, objects: { ...data.objects, objectStores: [{ ...store, status: {} }] } }, 'db', cluster)
+    expect(assessment.recoveryState).toBe('none')
+    expect(assessment.unreadReason).toBeUndefined()
+    expect(assessment.disabledReason).toBeUndefined()
+  })
+})
+
+
+it('does not let unreadable schedules hide that a Cluster has nothing to restore from', async () => {
+  const { assessRestoreSources } = await import('./restoreModel')
+  const cluster = { apiVersion: 'postgresql.cnpg.io/v1', kind: 'Cluster', metadata: { name: 'pg', namespace: 'db' }, spec: {} }
+  const data = { coverage: { backups: { state: 'full' }, scheduledBackups: { state: 'denied' } }, objects: { backups: [], scheduledBackups: [] } } as any
+  expect(assessRestoreSources(data, 'db', cluster)).toMatchObject({ recoveryState: 'none', unreadReason: undefined, disabledReason: 'Nothing to restore from yet: no backup destination and no completed Backup.' })
+})
+
+
+it('does not count an unsupported plugin Backup as evidence for an assessable destination', async () => {
+  const { assessRestoreSources } = await import('./restoreModel')
+  const unsupported = { ...pluginBackup, kind: 'Backup', spec: { ...pluginBackup.spec, pluginConfiguration: { name: 'other.example.com' } } }
+  const data = { coverage: { backups: { state: 'full' }, scheduledBackups: { state: 'full' }, objectStores: { state: 'full' } }, objects: { backups: [unsupported], scheduledBackups: [], objectStores: [{ ...store, status: {} }] } } as any
+  const assessment = assessRestoreSources(data, 'db', cluster)
+  expect(assessment.recoveryState).toBe('unknown')
+  expect(assessment.unreadReason).toContain('Backup b-plugin using plugin other.example.com cannot be assessed')
+  expect(assessment.disabledReason).toBeUndefined()
+})
+
+
+describe('physical recovery compatibility', () => {
+ it('uses the backup major in the source catalog after a major upgrade', () => {
+  const source = restoreSourceForBackup({ ...pluginBackup, status: { ...pluginBackup.status, majorVersion: 16 } }, cluster)!
+  const spec = buildRestoreManifest({ sourceCluster: cluster, source, namespace: 'db', newName: 'restore', target: { kind: 'backupEnd' } }).spec
+  expect(spec.imageCatalogRef).toEqual({ ...cluster.spec.imageCatalogRef, major: 16 })
+ })
+ it('requires an explicit image when the recorded major differs or is missing', () => {
+  const current = { ...cluster, spec: { ...cluster.spec, imageCatalogRef: undefined, imageName: 'custom:17' }, status: { pgDataImageInfo: { majorVersion: 17 } } }
+  for (const majorVersion of [16, undefined]) {
+   const source = restoreSourceForBackup({ ...pluginBackup, status: { ...pluginBackup.status, majorVersion } }, current)!
+   expect(buildRestoreManifest({ sourceCluster: current, source, namespace: 'db', newName: 'restore', target: { kind: 'backupEnd' } }).spec.imageName).toBeUndefined()
+  }
+ })
+ it('rejects plugin backups belonging to a predecessor Cluster', () => {
+  const current = { ...cluster, metadata: { ...cluster.metadata, uid: 'current', creationTimestamp: '2026-09-30T00:00:00Z' } }
+  expect(restoreSourceForBackup({ ...pluginBackup, status: { ...pluginBackup.status, pluginMetadata: { clusterUID: 'old' } } }, current)).toBeNull()
+  expect(restoreSourceForBackup({ ...pluginBackup, status: { ...pluginBackup.status, startedAt: '2026-09-29T22:00:00Z' } }, current)).toBeNull()
+ })
+ it('does not mark backup protection complete from its declaration alone', () => {
+  const step = restoreNextSteps({ validationRecorded: false, backup: 'walArchiving' })[2]
+  expect(step.state).toBe('partial')
+  expect(step.note).toContain('complete a new base backup')
+ })
+})
+
+
+it('pins all named Backup methods to their recorded major and requires an image when unknown', () => {
+  for (const method of ['barmanObjectStore', 'volumeSnapshot']) {
+    const backup = { ...pluginBackup, spec: { cluster: { name: 'pg-a' }, method }, status: { ...pluginBackup.status, method, majorVersion: 16 } }
+    const source = restoreSourceForBackup(backup, cluster)!
+    expect(source).toMatchObject({ kind: 'backup', majorVersion: 16 })
+    const args = { sourceCluster: cluster, source, namespace: 'db', newName: 'restore', target: { kind: 'latest' as const } }
+    expect(buildRestoreManifest(args).spec.imageCatalogRef.major).toBe(16)
+    const unknown = restoreSourceForBackup({ ...backup, status: { ...backup.status, majorVersion: undefined } }, cluster)!
+    expect(buildRestoreManifest({ ...args, source: unknown }).spec.imageCatalogRef).toBeUndefined()
+    expect(buildRestoreManifest({ ...args, source: unknown }).spec.imageName).toBeUndefined()
+  }
+})
+
+it('does not use predecessor Backup metadata as evidence of recovery for a recreated Cluster', () => {
+  const current = { ...cluster, metadata: { ...cluster.metadata, uid: 'current', creationTimestamp: '2026-09-29T00:00:00Z' } }
+  const old = { ...pluginBackup, status: { ...pluginBackup.status, pluginMetadata: { clusterUID: 'previous' } } }
+  const data = { coverage: { backups: { state: 'full' }, objectStores: { state: 'full' } }, objects: { backups: [old], objectStores: [{ ...store, status: {} }] } } as any
+  const assessment = assessRestoreSources(data, 'db', current)
+  expect(assessment.recoveryState).toBe('unknown')
+  expect(assessment.unreadReason).toContain('previous Cluster incarnation')
+  expect(assessment.unreadReason).not.toContain('no longer names an ObjectStore')
+  expect(recoveryEvidenceFor(assessment.sources[0], { sourceCluster: current, stores: [], backups: [old], namespace: 'db' }).lastBackup).toBeUndefined()
+})