v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

Red-proofs RP31-RP38. MinAgent 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -155,6 +155,14 @@ backups, monitoring and notifications. All Proxmox/disk operations are delegated
   action block right; used by the dashboard installed-apps list, the Távoli mentés toggle list
   and the Visszaállítás restore-to-verify/.fab lists; the backups-apps expander header is
   ALIGNED to the same grammar (own markup — it carries the toggle). Protected infra stacks
+  **Apps go off-site by themselves (v0.283.0, decision 50):** a fresh install on a box whose customer has off-site
+  switches the app's off-site copy ON (`settings.DefaultOffboxOnForNewApp`, deploy-done hook); an earlier choice is
+  kept. Older apps: one press on both backup pages (`/backup/offbox/enable-all`, „Nem most" dismisses). The size
+  card (`backup/offbox_fit.go`) compares the selected apps' estimated off-site size with the quota — measured at the
+  start of each off-site run and in the background from the page (≤ every 6 h) — and names the largest when they do
+  not fit. Over the quota nothing but the ruled retention runs; no history is deleted to make room.
+  **A Stop holds (v0.283.0, R-721):** the quiesce resume, the nightly volume dump and the update leg skip an app whose
+  desired state is „stopped" (`stacks.Manager.WantsStopped`).
   **The off-site restore list is keyed on the STORE (v0.204.0, R-237):** `offsite_restore_list.go`
   builds it from `OffsiteInventoryList` (the repository's own snapshot tags), NOT from deployed +
   offsite-toggled apps. A rebuilt box has neither and used to be shown nothing to restore while its