v0.283.1: a Stop holds during the volume dump in production and at the crash recovery (R-721, found live on v0.283.0)

Red-proofs RP43, RP44. MinAgent 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/appstop_marker.go

@@ -279,7 +279,14 @@ func (g *AppStopGuard) Recover() *AppStopRecovery {
 		m.Reason.humanReason(), m.OpID, len(m.Stacks), m.Stacks)
 
 	res := &AppStopRecovery{Reason: m.Reason, OpID: m.OpID, StartedAt: m.StartedAt}
+	hs, _ := g.starter.(interface{ WantsStopped(string) bool })
 	for _, name := range m.Stacks {
+		if hs != nil && hs.WantsStopped(name) {
+			// R-721 (v0.283.1): the household pressed Stop while the interrupted operation had the app down.
+			// It is owed nothing; the marker still clears below.
+			g.logger.Printf("[INFO] [appstop] crash recovery: NOT restarting %s — the household stopped it", name)
+			continue
+		}
 		if err := g.starter.StartStack(name); err != nil {
 			// R-174: a REFUSAL is not a failure. The starter's gate has said this app must not be
 			// started (an absent data drive), so the app is left down deliberately and the holder

controller/internal/backup/r721_recover_test.go

@@ -0,0 +1,36 @@
+package backup
+
+import (
+	"io"
+	"log"
+	"path/filepath"
+	"testing"
+)
+
+type stoppedStarter struct {
+	fakeStarter
+	stopped map[string]bool
+}
+
+func (s *stoppedStarter) WantsStopped(n string) bool { return s.stopped[n] }
+
+// R-721 (v0.283.1): a controller crash during a volume dump leaves a marker owing the app a restart; if the
+// household pressed Stop meanwhile, the startup recovery does not start it — and the marker still clears.
+// COMPANION RED-PROOF: remove the WantsStopped skip in Recover → started=[immich].
+func TestR721_CrashRecoveryKeepsTheHouseholdsStop(t *testing.T) {
+	dir := t.TempDir()
+	g1, _ := newGuard(t, dir)
+	if err := g1.Begin("volume-dump:immich", ReasonVolumeDump, []string{"immich"}); err != nil {
+		t.Fatal(err)
+	}
+	s := &stoppedStarter{stopped: map[string]bool{"immich": true}}
+	g2 := NewAppStopGuard(filepath.Join(dir, "appstop-state.json"), log.New(io.Discard, "", 0))
+	g2.SetStarter(s)
+	g2.Recover()
+	if len(s.starts) != 0 {
+		t.Fatalf("the crash recovery started %v — the household stopped it (R-721)", s.starts)
+	}
+	if markerExists(t, dir) {
+		t.Fatal("the marker survived — the next boot would try again")
+	}
+}