The snapshot restore 'clean' manager check only checks to see whether there are any deployments in the database.
It should ideally check the database for all resource types it will destroy so that it can alert if the manager is at all unclean.
I think the original idea was that if there are no blueprints, then by the way the DB is set up, you won't have any deployments, nodes, etc.
You're right, however, that users, tenant, groups, plugins and secrets can be present without blueprints, and those should be checked as well.
However, after a bootstrap you will have leftover executions from sanity, and you always have the default tenant and the admin user and some roles. So you can't go and do a blanket check. We need some elegant solution for this.
Yes, but it doesn't check for blueprints either. Either way, yes, we need to make this check in at least a little more detail.