v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

Red-proofs RP31-RP38. MinAgent 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/r721_volume_dump_stop_test.go

@@ -0,0 +1,40 @@
+package backup
+
+import "testing"
+
+// stopDuringDump is the real DumpAppVolumesSafe's provider: the household presses Stop while the dump holds
+// the app down (between StopStack and the restart).
+type stopDuringDump struct {
+	suppressWatchProvider
+	wantsStopped bool
+	started      int
+}
+
+func (p *stopDuringDump) StopStack(n string) error {
+	p.wantsStopped = true // the household's Stop lands during the dump
+	return p.suppressWatchProvider.StopStack(n)
+}
+func (p *stopDuringDump) StartStack(n string) error {
+	p.started++
+	return p.suppressWatchProvider.StartStack(n)
+}
+func (p *stopDuringDump) WantsStopped(string) bool { return p.wantsStopped }
+
+// R-721 (v0.283.0): the nightly volume dump does not start an app the household stopped while it was down.
+// COMPANION RED-PROOF: remove the WantsStopped check in DumpAppVolumesSafe → started=1.
+func TestR721_VolumeDumpKeepsTheHouseholdsStop(t *testing.T) {
+	p := &stopDuringDump{}
+	m := newSuppressManager(t, &p.suppressWatchProvider)
+	m.stackProvider = p
+	if err := m.DumpAppVolumesSafe("actualbudget"); err != nil {
+		t.Fatalf("DumpAppVolumesSafe: %v", err)
+	}
+	if p.started != 0 {
+		t.Fatalf("the dump started the app %d time(s) after the household stopped it (R-721)", p.started)
+	}
+	// The crash marker is what a restart after a controller crash reads: it must owe nothing. (The short
+	// alarm-grace set is a different thing and stays by design.)
+	if got := m.appStop.HeldStacks(); len(got) != 0 {
+		t.Fatalf("the stop marker still holds %v — the next startup would restart an app the household stopped", got)
+	}
+}