Unify previous source resolution

internal/app/restore_commit_test.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+	"strings"
 	"testing"
 	"time"
 
@@ -42,6 +43,45 @@ func TestCommittedRestorePlanUsesOnlyDeclaredObjects(t *testing.T) {
 	}
 }
 
+func TestCommittedRestoreReusesVerifiedManifestCandidate(t *testing.T) {
+	cfg := restorePlanConfig(t)
+	fake := &storage.FakeBackend{}
+	current := seedCommittedRestoreSnapshot(t, cfg, fake, "20260519T010203Z-a1b2c3d4", nil)
+
+	plan, err := buildRestorePlan(context.Background(), cfg, current, fake, RestorePlanOptions{})
+	if err != nil {
+		t.Fatalf("buildRestorePlan() error = %v", err)
+	}
+	if _, err := executeRestorePlan(context.Background(), cfg, current, plan, nil, fake); err != nil {
+		t.Fatalf("executeRestorePlan() error = %v", err)
+	}
+	if got := fakeDownloadCount(fake, current.CurrentManifestKey); got != 1 {
+		t.Fatalf("manifest downloads = %d, want one discovery transfer reused by restore", got)
+	}
+	if got := fakeDownloadBytes(fake, current.CurrentManifestKey); got != int64(len(current.ManifestData)) {
+		t.Fatalf("manifest bytes transferred = %d, want one verified candidate (%d)", got, len(current.ManifestData))
+	}
+}
+
+func TestCommittedRestoreRejectsChangedGenerationForVerifiedManifestCandidate(t *testing.T) {
+	cfg := restorePlanConfig(t)
+	fake := &storage.FakeBackend{}
+	current := seedCommittedRestoreSnapshot(t, cfg, fake, "20260519T010203Z-a1b2c3d4", nil)
+	plan, err := buildRestorePlan(context.Background(), cfg, current, fake, RestorePlanOptions{})
+	if err != nil {
+		t.Fatalf("buildRestorePlan() error = %v", err)
+	}
+	fake.SeedObject(storage.FakeObject{Key: current.CurrentManifestKey, Data: []byte("changed manifest"), ETag: "changed-generation"})
+
+	_, err = executeRestorePlan(context.Background(), cfg, current, plan, nil, fake)
+	if err == nil || !strings.Contains(err.Error(), "generation mismatch") {
+		t.Fatalf("executeRestorePlan() error = %v, want generation mismatch", err)
+	}
+	if got := fakeDownloadCount(fake, current.CurrentManifestKey); got != 1 {
+		t.Fatalf("manifest downloads = %d, want no second transfer for rejected candidate", got)
+	}
+}
+
 func TestCommittedStatusReportsOnlyDeclaredPublishedOutputs(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	cfg.Pipeline.Publish = &config.PublishConfig{Outputs: []config.PublishOutputRule{{
@@ -252,6 +292,16 @@ func remoteRestoreArtifact(fake *storage.FakeBackend, artifactType artifacts.Rem
 	}
 }
 
+func fakeDownloadBytes(fake *storage.FakeBackend, key string) int64 {
+	var count int64
+	for _, call := range fake.Downloads {
+		if call.Key == key {
+			count += call.Bytes
+		}
+	}
+	return count
+}
+
 func restoreCommitSHA256(data []byte) string {
 	sum := sha256.Sum256(data)
 	return hex.EncodeToString(sum[:])