v0.283.1: a Stop holds during the volume dump in production and at the crash recovery (R-721, found live on v0.283.0)

Red-proofs RP43, RP44. MinAgent 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,19 @@
+## v0.283.1 — a Stop holds during the nightly volume dump IN PRODUCTION, and at the crash recovery (R-721) (2026-09-30)
+
+**MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). No new strings.
+
+- **Found live, on v0.283.0 itself (9202, 2026-09-30 08:42):** the household's Stop was recorded during the volume
+  dump, and the dump restarted the app 8 s later. v0.283.0 asked `WantsStopped` through an optional interface; the
+  unit test's fake answered it, but production hands the backup manager `cmd/controller`'s `stackAdapter`, which did
+  not — the assertion failed and the check silently skipped (the "seam built but never wired" class). The quiesce
+  path was fine (it is handed the stacks manager itself).
+- `stackAdapter.WantsStopped` and `gatedAppStopStarter.WantsStopped` forward to the stacks manager; the startup
+  crash recovery (`AppStopGuard.Recover`) skips an app the household stopped, and still clears its marker.
+- Tests: `TestR721_TheBackupsStackProviderAnswersWantsStopped` (the PRODUCTION types — adapter, gated starter, stacks
+  manager — each answer the question), `TestR721_CrashRecoveryKeepsTheHouseholdsStop`. Red-proofs RP43, RP44.
+- A second release in one session, deliberately: the rule is one release per repo per session, and shipping a Stop
+  that is known to be undone every night serves no purpose of that rule.
+
 ## v0.283.0 — apps go off-site by themselves (decision 50), with a size warning; a Stop holds during a backup (R-721); page slips (R-724, R-725) (2026-09-30)
 
 **MinAgent: 0.131.0** (unchanged). Needs hub v0.123.0 (unchanged). New strings: `backups_offsite.offer_text`,