Review round 2: a media restart no longer starts an app the household stopped (R-721); the file manager's header name file appears whole (R-1100 race, 44/300 -> 0/300); both red-proved; unreleased

controller/internal/web/media_events.go

@@ -50,6 +50,19 @@ func (s *Server) mediaApps() []string {
 	return s.stackMgr.MediaApps()
 }
 
+// mediaAppsToRecreate is the list the media restart and the safe removal recreate: every media app except the ones the
+// household stopped (R-721) — a recreate would start them; their next start reads the override already written.
+func (s *Server) mediaAppsToRecreate(why string) []string {
+	if s.stackMgr == nil {
+		return nil
+	}
+	recreate, stopped := s.stackMgr.MediaAppsToRecreate()
+	for _, name := range stopped {
+		s.logger.Printf("[INFO] [media] %s: NOT recreating %s — the household stopped it; it sees the drives at its next start", why, name)
+	}
+	return recreate
+}
+
 func (s *Server) presentMediaDrives() []mediawire.Drive {
 	if s.stackMgr == nil {
 		return nil
@@ -195,7 +208,7 @@ func (s *Server) MediaNotice(checkStale bool) MediaDriveNotice {
 // recreates the file browser, records the restart on every drive, then wires the present drives in.
 func (s *Server) restartMediaApps(reason string) []string {
 	var failed []string
-	for _, name := range s.mediaApps() {
+	for _, name := range s.mediaAppsToRecreate("restart (" + reason + ")") {
 		if s.appHeld(name) {
 			continue
 		}
@@ -304,7 +317,7 @@ func (s *Server) mediaSafeRemoval(path, durableID string) []string {
 	if err := s.settings.SetEjected(path, durableID, paused); err != nil {
 		s.logger.Printf("[WARN] [media] safe removal %s: recording it: %v", path, err)
 	}
-	for _, name := range s.mediaApps() {
+	for _, name := range s.mediaAppsToRecreate("safe removal " + path) {
 		if s.appHeld(name) {
 			continue
 		}

controller/internal/web/r2_media_recreate_wiring_test.go

@@ -0,0 +1,49 @@
+package web
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"strings"
+	"testing"
+)
+
+// Review round 2 (2026-10-24, DOC-D2 U2): both web paths that recreate the media apps must take their list from
+// mediaAppsToRecreate (which leaves out the apps the household stopped, R-721), never from mediaApps(). A source pin:
+// the decision itself is tested in stacks (TestMediaAppsToRecreate_SkipsAppsTheHouseholdStopped); this pins the
+// WIRING, the half a seam test cannot see. COMPANION RED-PROOF: put `s.mediaApps()` back in either loop → this fails.
+func TestR2_MediaRecreateLoopsSkipStoppedApps(t *testing.T) {
+	src, err := os.ReadFile("media_events.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, "media_events.go", src, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]bool{"restartMediaApps": false, "mediaSafeRemoval": false}
+	for _, d := range f.Decls {
+		fn, ok := d.(*ast.FuncDecl)
+		if !ok {
+			continue
+		}
+		if _, tracked := want[fn.Name.Name]; !tracked {
+			continue
+		}
+		body := string(src[fset.Position(fn.Body.Pos()).Offset:fset.Position(fn.Body.End()).Offset])
+		if strings.Contains(body, "range s.mediaApps()") {
+			t.Errorf("%s ranges over s.mediaApps(): it would recreate (start) an app the household stopped", fn.Name.Name)
+		}
+		if !strings.Contains(body, "s.mediaAppsToRecreate(") || !strings.Contains(body, "RestartStack(") {
+			t.Errorf("%s no longer recreates from s.mediaAppsToRecreate", fn.Name.Name)
+		}
+		want[fn.Name.Name] = true
+	}
+	for name, seen := range want {
+		if !seen {
+			t.Errorf("function %s not found in media_events.go — the pin is stale", name)
+		}
+	}
+}