fix restore breaking lifecycle stuff

server/src/services/backupRestoreService/backupRestore.test.js

@@ -116,7 +116,9 @@ test('applies validated replacement data and removes rollback only after startup
   const applied = startupRestore.applyPendingRestore();
   assert.equal(applied.status, 'awaiting-health');
   assert.equal(fs.existsSync(path.join(temporaryRoot, 'old-state.txt')), false);
-  assert.equal(fs.existsSync(path.join(temporaryRoot, 'runtime')), false);
+  // Runtime is outside the durable backup payload and can contain state owned
+  // by the separate lifecycle controller, so applying a restore preserves it.
+  assert.equal(fs.readFileSync(path.join(temporaryRoot, 'runtime', 'active.tmp'), 'utf8'), 'discard during restore');
   assert.equal(fs.readFileSync(path.join(temporaryRoot, 'state.json'), 'utf8'), '{"preserved":true}\n');
   assert.equal(fs.existsSync(path.join(temporaryRoot, 'backup-restore', 'rollback', 'old-state.txt')), true);
 

server/src/services/backupRestoreService/startupRestore.js

@@ -35,7 +35,11 @@ function listActiveDataEntries({ includeRuntime = true } = {}) {
 }
 
 function removeActiveData() {
-  for (const name of listActiveDataEntries()) {
+  // Runtime contains disposable work owned by active companion processes as
+  // well as the lifecycle controller's status directory. It is deliberately
+  // absent from backup archives, so restore must leave it untouched instead
+  // of trying to delete root-owned controller state from the non-root server.
+  for (const name of listActiveDataEntries({ includeRuntime: false })) {
     fs.rmSync(path.join(resolveDataDir(), name), { recursive: true, force: true });
   }
 }