v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

Red-proofs RP31-RP38. MinAgent 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/cmd/controller/main.go

@@ -1776,6 +1776,13 @@ func main() {
 			if notifier != nil {
 				notifier.NotifyAppDeployed(name, display)
 			}
+			// v0.283.0 (decision 50, R-720): a FRESH install on a box whose customer has off-site is in the
+			// off-site copy by default. An app with an earlier backup choice keeps it (settings rule).
+			if on, why := sett.DefaultOffboxOnForNewApp(name); on {
+				log.Printf("[INFO] [backup] %s: off-site copy switched ON at install (decision 50)", name)
+			} else {
+				log.Printf("[DEBUG] [backup] %s: off-site default not applied: %s", name, why)
+			}
 			// v0.279.0 (decision 45): a FRESH install replaces a known default login with its generated one,
 			// when the template declares after_install. Never on a restore or a kept-data load — those do not
 			// pass through the deploy-done hook.

controller/cmd/controller/offsite_default_wiring_test.go

@@ -0,0 +1,40 @@
+package main
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"testing"
+)
+
+// v0.283.0 (decision 50, R-720): the deploy-done hook's SUCCESS branch — the one place a fresh install ends —
+// calls sett.DefaultOffboxOnForNewApp. The rule itself is pinned in internal/settings/offbox_default_test.go;
+// this pins that it is reached.
+// COMPANION RED-PROOF: delete the call from the hook → this test fails.
+func TestDecision50_DefaultIsWiredIntoTheDeployDoneHook(t *testing.T) {
+	f, err := parser.ParseFile(token.NewFileSet(), "main.go", nil, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	ast.Inspect(f, func(n ast.Node) bool {
+		c, ok := n.(*ast.CallExpr)
+		if !ok {
+			return true
+		}
+		if s, ok := c.Fun.(*ast.SelectorExpr); ok && s.Sel.Name == "SetDeployDoneHook" && len(c.Args) == 1 {
+			ast.Inspect(c.Args[0], func(m ast.Node) bool {
+				if cc, ok := m.(*ast.CallExpr); ok {
+					if ss, ok := cc.Fun.(*ast.SelectorExpr); ok && ss.Sel.Name == "DefaultOffboxOnForNewApp" {
+						found = true
+					}
+				}
+				return true
+			})
+		}
+		return true
+	})
+	if !found {
+		t.Fatal("the deploy-done hook does not call DefaultOffboxOnForNewApp — a new app would start with off-site OFF (R-720)")
+	}
+}