v0.283.0: apps go off-site by themselves (decision 50) with a size warning; a Stop holds during a backup (R-721); page slips (R-724/R-725)

Red-proofs RP31-RP38. MinAgent 0.131.0 (unchanged).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/quiesce/quiesce.go

@@ -744,9 +744,21 @@ func within(p, start, span int) bool {
 // no caller could learn that a customer's app had not come back — and the classifier downstream
 // therefore had nothing to key on. A restart failure is the single most important fact this loop
 // produces; it must leave the function.
+// householdStopped is the optional question a Stacks implementation answers (R-721): did the household
+// press Stop on this app while we had it down? The stacks manager implements it; test fakes may not.
+type householdStopped interface {
+	WantsStopped(name string) bool
+}
+
 func (l *Loop) restartAll(stacks []string) []string {
 	var failed []string
+	hs, _ := l.stacks.(householdStopped)
 	for _, s := range stacks {
+		if hs != nil && hs.WantsStopped(s) {
+			// R-721: a Stop pressed while the backup had the app down holds — the backup does not undo it.
+			l.logger.Printf("[INFO] [quiesce] %s NOT restarted: the household stopped it during the backup", s)
+			continue
+		}
 		if err := l.stacks.StartStack(s); err != nil {
 			l.logger.Printf("[ERROR] [quiesce] restart %s: %v", s, err)
 			failed = append(failed, s)