v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

Red-proofs RP31-RP38. MinAgent 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/backup.go

@@ -117,6 +117,10 @@ type Manager struct {
 	// offboxSizer (3a) — the mandatory-set byte estimator for the pre-push enlargement gate, overridable
 	// in tests so the gate is unit-testable without a real du. Nil → the real dirSizeBytes (du -sb).
 	offboxSizer func(path string) int64
+	// offsiteFit (decision 50, v0.283.0) — the last off-site size estimate against the quota, for the page.
+	offsiteFitMu      sync.Mutex
+	offsiteFit        OffsiteFit
+	offsiteFitRunning bool
 	// offboxNow (v0.206.0, R-241) is the abandonment countdown's clock. Nil → time.Now.
 	//
 	// IT EXISTS SO THE TERMINAL STEP IS TESTABLE WITHOUT SHORTENING A LIVE TIMER (§7.4). The sweep is
@@ -958,6 +962,12 @@ func (m *Manager) DumpAppVolumesSafe(stackName string) error {
 
 	dumpErr := m.DumpAppVolumes(stackName)
 
+	if hs, ok := m.stackProvider.(interface{ WantsStopped(string) bool }); ok && hs.WantsStopped(stackName) {
+		// R-721: the household pressed Stop while the dump had the app down — it stays stopped.
+		m.logger.Printf("[INFO] [backup] %s NOT restarted after the volume dump: the household stopped it meanwhile", stackName)
+		m.appStop.End() // nothing is owed a restart — the household wants it stopped
+		return dumpErr
+	}
 	m.logger.Printf("[INFO] [backup] Restarting %s after volume dump", stackName)
 	startErr := m.stackProvider.StartStack(stackName)
 	if startErr != nil {