fix: harden retention cleanup safety

backend/service/app.py

@@ -30,7 +30,7 @@ from .line_spacing import analyze_svg_line_spacing_file
 from .log_config import get_logger
 from .metadata_store import MetadataStore
 from .product_archive_service import ProductArchiveService, ProductPendingCleanupError
-from .product_archive_store import ProductArchiveStore
+from .product_archive_store import ProductArchiveStore, ProductPurgeInProgressError
 from .runner import JobRunner
 from .schemas import (
     Asset,
@@ -1073,10 +1073,12 @@ def _cleanup_scheduler_loop() -> None:
 
 def _start_cleanup_scheduler() -> None:
     global _cleanup_scheduler_thread
-    _run_scheduled_cleanup_once()
-    if _cleanup_scheduler_thread is not None and _cleanup_scheduler_thread.is_alive():
-        return
+    if _cleanup_scheduler_thread is not None:
+        if _cleanup_scheduler_thread.is_alive():
+            return
+        _cleanup_scheduler_thread = None
     _cleanup_scheduler_stop.clear()
+    _run_scheduled_cleanup_once()
     _cleanup_scheduler_thread = threading.Thread(
         target=_cleanup_scheduler_loop,
         name="retention-cleanup",
@@ -1088,8 +1090,10 @@ def _start_cleanup_scheduler() -> None:
 def _stop_cleanup_scheduler() -> None:
     global _cleanup_scheduler_thread
     _cleanup_scheduler_stop.set()
-    if _cleanup_scheduler_thread is not None:
-        _cleanup_scheduler_thread.join(timeout=1)
+    worker = _cleanup_scheduler_thread
+    if worker is not None:
+        worker.join(timeout=5)
+    if worker is not None and not worker.is_alive() and _cleanup_scheduler_thread is worker:
         _cleanup_scheduler_thread = None
 
 
@@ -1240,6 +1244,8 @@ def restore_product(request: Request, product_id: str) -> ProductRecord:
     _get_product_or_404(product_id)
     try:
         return product_archive_store.restore_product(product_id, now=datetime.now(timezone.utc))
+    except ProductPurgeInProgressError as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
     except ValueError as exc:
         raise HTTPException(status_code=400, detail=str(exc)) from exc