R-899: a daytime press never cancels the night's whole-guest backup (operator ruling 2026-10-08, option A); press sends trigger=manual

Unreleased; ships with tomorrow's release.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/cmd/controller/main.go

@@ -3471,8 +3471,9 @@ func (b quiesceBackend) Due(ctx context.Context) (bool, *int64, error) {
 	return r.Due, r.AgeSecs, err
 }
 func (b quiesceBackend) StartBackup(ctx context.Context) (string, error) {
-	r, err := b.c.StartBackup(ctx)
-	return r.JobID, mapBusy(err) // F-A1: the untargeted (pre-R-82) path can 409 identically
+	// R-899: a press says so. F-A1: the untargeted (pre-R-82) path can 409 identically.
+	r, err := b.c.StartBackupForTrigger(ctx, "", quiesce.IsManualTrigger(ctx))
+	return r.JobID, mapBusy(err)
 }
 func (b quiesceBackend) BackupStatus(ctx context.Context) (string, error) {
 	r, err := b.c.BackupStatus(ctx)
@@ -3508,7 +3509,7 @@ func (b quiesceBackend) DueFor(ctx context.Context, target string) (bool, *int64
 	return r.Due, r.AgeSecs, r.AgeState, err
 }
 func (b quiesceBackend) StartBackupFor(ctx context.Context, target string) (string, error) {
-	r, err := b.c.StartBackupFor(ctx, target)
+	r, err := b.c.StartBackupForTrigger(ctx, target, quiesce.IsManualTrigger(ctx)) // R-899: a press says so
 	// F-A1: translate the agent's HTTP 409 into the loop's vocabulary, exactly as Tiers translates a
 	// 404 into ErrTiersUnsupported. 409 means the agent's R-85 single-flight gate refused because a
 	// restore-test (or another backup) holds it — CONTENTION, not failure. `internal/quiesce` keeps