A post-restore `restic check` failure was reported to every surface (web async op, CLI) as a clean success. Introduce a distinct RestoreResult status "degraded" that still runs the persist/scan/resumable tail but no longer masquerades as "ok". A single `_run_long_op` branch maps it to a new terminal phase "degraded" (added to both TERMINAL_PHASES and the front-end terminalPhases set); the byo and hosted paths forward it verbatim. Distinguish couldn't-verify (check returncode 11/124 -> integrity_unverified) from damaged (-> integrity_failed) with truthful owner-facing copy, and make the CLI exit non-zero with reason-aware wording that never claims a bare "restore failed". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>