@@ -39,6 +39,22 @@ The backup controller performs the following steps automatically:
 After the Velero Restore completes, the HelmReleases resume and the VM boots
 with the restored disk data while retaining its original IP and MAC addresses.
 
+### Reclaiming the kept disks
+
+With `keepOriginalPVC: true`, the default, step 3 switches each disk's PV to the `Retain` reclaim policy so that it outlives the PVC it is renamed from. Nothing removes the `-orig` PVCs or sets the policy back afterwards: they stay until an operator deletes them.
+
+The policy the PV had before the restore is recorded in the `backups.cozystack.io/original-reclaim-policy` annotation, on the PV and on the `-orig` PVC. Set it back on the PV before deleting the `-orig` PVC, or a PV that was `Delete` stays `Retain` once released and its volume is never reclaimed. A PVC renamed by an older controller carries no annotation; the snippet then leaves the PV on `Retain` for you to decide.
+
+```bash
+PVC=vm-disk-ubuntu-source-orig-1a2b
+PV=$(kubectl -n "$NAMESPACE" get pvc "$PVC" -o jsonpath='{.spec.volumeName}')
+POLICY=$(kubectl get pv "$PV" -o jsonpath='{.metadata.annotations.backups\.cozystack\.io/original-reclaim-policy}')
+kubectl patch pv "$PV" --type=merge -p "{\"spec\":{\"persistentVolumeReclaimPolicy\":\"${POLICY:-Retain}\"}}"
+kubectl -n "$NAMESPACE" delete pvc "$PVC"
+```
+
+The `<hash>` is derived from the RestoreJob name, so an `-orig` PVC left behind by a deleted RestoreJob takes the name a new RestoreJob of the same name would use. That RestoreJob fails before it halts the VM, naming the PVC, rather than restoring without keeping the current disk. Reclaim the leftover PVC as above, or give the new RestoreJob another name.
+
 ## Method 2: Cross-Namespace Restore (Copy)
 
 ```bash
 
@@ -37,6 +37,10 @@ type RestoreJobReconciler struct {
 	Scheme            *runtime.Scheme
 	Recorder          record.EventRecorder
 	CredentialsConfig BackupCredentialsConfig
+	// APIReader is the manager's uncached reader. The keepOriginalPVC rename
+	// reads back objects it has just written, which the cache may not have
+	// seen yet. Wired in SetupWithManager.
+	APIReader client.Reader
 }
 
 func (r *RestoreJobReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
@@ -160,6 +164,7 @@ func (r *RestoreJobReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 
 // SetupWithManager registers our controller with the Manager and sets up watches.
 func (r *RestoreJobReconciler) SetupWithManager(mgr ctrl.Manager) error {
+	r.APIReader = mgr.GetAPIReader()
 	cfg := mgr.GetConfig()
 	var err error
 	if r.Interface, err = dynamic.NewForConfig(cfg); err != nil {
@@ -177,6 +182,16 @@ func (r *RestoreJobReconciler) SetupWithManager(mgr ctrl.Manager) error {
 		Complete(r)
 }
 
+// apiReader returns the uncached reader. Reconcilers built by hand in unit
+// tests have none and fall back to their fake Client, which has no cache to
+// bypass.
+func (r *RestoreJobReconciler) apiReader() client.Reader {
+	if r.APIReader != nil {
+		return r.APIReader
+	}
+	return r.Client
+}
+
 // handleProjectionError classifies a credentials-projection error as
 // transient (requeue with Ready=False/CredentialsProjectionPending) or
 // terminal (markRestoreJobFailed). Mirrors the BackupJob variant — both