Review round 2: a media restart no longer starts an app the household stopped (R-721); the file manager's header name file appears whole (R-1100 race, 44/300 -> 0/300); both red-proved; unreleased

controller/internal/stacks/media_library.go

@@ -283,6 +283,21 @@ func (m *Manager) MediaApps() []string {
 	return out
 }
 
+// MediaAppsToRecreate is MediaApps without the apps the household stopped (R-721, „a Stop holds"): the media restart
+// and the safe removal recreate with `up -d --force-recreate` (RestartStack), which would START a stopped app. Their
+// override is already written for the drives present now, so their next start sees them. `stopped` is returned for the
+// caller's log. Found by review round 2 (2026-10-24); pinned by TestMediaAppsToRecreate_SkipsAppsTheHouseholdStopped.
+func (m *Manager) MediaAppsToRecreate() (recreate, stopped []string) {
+	for _, name := range m.MediaApps() {
+		if m.WantsStopped(name) {
+			stopped = append(stopped, name)
+			continue
+		}
+		recreate = append(recreate, name)
+	}
+	return recreate, stopped
+}
+
 // MediaAppsNeedingRestart renders every media app's override for the drives present NOW and returns the apps whose
 // binds changed — the apps that must restart to see a drive that was added, removed or came back (the notice of
 // decision 238). It writes the files; the restart itself is the household's „restart now" (RestartStack).