Function select_restore_repository 

pub fn select_restore_repository(
    policy: &SnapshotPolicySpec,
    policy_name: &str,
    policy_ns: &str,
    explicit: Option<&RepositoryRef>,
    restore_ns: &str,
) -> Result<RepositoryRef, ValidationError>

The repository a fromPolicy restore reads, resolved from the policy’s repository set + the restore’s optional explicit spec.repository. Pure — the resolver backstop shared with the M9 webhook mirror, so the two can never disagree.

• Explicit selection — it must be a MEMBER of the policy’s repository set (compared by normalized repo_key; the explicit ref resolves relative to restore_ns, the members relative to policy_ns), else ValidationError: a typo’d ref must not silently read a repository the recipe never wrote to. A member ref is returned verbatim (the caller resolves it in the restore’s namespace, exactly as an explicit ref always has been).
• No selection, single-repo — the policy’s one repository, verbatim.
• No selection, multi-repo — ValidationError::RestoreRepositorySelectionRequired, naming every valid choice; repository #1 is never guessed (the N repositories are independent captures that can diverge).