v0.76.0: campaign-#3 hardening (settings .bak recovery, restore stack_name validation, quiesce marker quarantine)

S1: corrupt settings.json recovers from .bak / safe-defaults+preserve, no crash-loop.
F2: validStackName gates restore + export handlers (reject /,\,..,NUL traversal).
S3: corrupt quiesce marker logged + quarantined, not silently dropped.
Tests T-S1/F2/S3 + red-proofs. Agent/hub untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/quiesce/quiesce.go

@@ -319,7 +319,12 @@ func (l *Loop) readMarker() (Marker, bool) {
 		return Marker{}, false
 	}
 	var m Marker
-	if json.Unmarshal(data, &m) != nil {
+	if err := json.Unmarshal(data, &m); err != nil {
+		// S3: a corrupt marker is NOT silently dropped — log it LOUD and quarantine the bad file (a real
+		// corrupted-mid-quiesce marker would otherwise skip stack-recovery with no trace). Still return
+		// false: "no usable marker" ⇒ no recovery is the correct contract.
+		l.logger.Printf("[WARN] [quiesce] marker at %s is corrupt (%v) — quarantining; stacks not auto-recovered from it", l.markerPath, err)
+		_ = os.Rename(l.markerPath, fmt.Sprintf("%s.corrupt-%d", l.markerPath, l.now().Unix()))
 		return Marker{}, false
 	}
 	return m, true

controller/internal/quiesce/quiesce_marker_test.go

@@ -0,0 +1,56 @@
+package quiesce
+
+import (
+	"bytes"
+	"log"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// T-S3a: a corrupt marker is quarantined + logged (not silently dropped). Still returns false.
+// Companion: pre-fix readMarker (silent return false) → no *.corrupt-* + no log → this fails.
+func TestReadMarker_QuarantinesCorrupt(t *testing.T) {
+	mp := filepath.Join(t.TempDir(), "quiesce-state.json")
+	if err := os.WriteFile(mp, []byte(`{ "active": true, BROKEN not json`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var buf bytes.Buffer
+	l := New(Options{
+		MarkerPath: mp, Poll: time.Hour, StatusPoll: time.Millisecond, MaxQuiesce: time.Second,
+		Logger: log.New(&buf, "", 0),
+	})
+	if _, ok := l.readMarker(); ok {
+		t.Fatal("corrupt marker must return ok=false")
+	}
+	if m, _ := filepath.Glob(mp + ".corrupt-*"); len(m) == 0 {
+		t.Error("corrupt marker must be quarantined as *.corrupt-*")
+	}
+	if !strings.Contains(buf.String(), "corrupt") {
+		t.Errorf("expected a WARN about the corrupt marker, got: %q", buf.String())
+	}
+}
+
+// T-S3b: valid marker → (marker, true), no quarantine (regression).
+func TestReadMarker_HappyPath(t *testing.T) {
+	mp := filepath.Join(t.TempDir(), "quiesce-state.json")
+	if err := os.WriteFile(mp, []byte(`{"active":true,"stopped_stacks":["romm","komga"]}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	l := New(Options{
+		MarkerPath: mp, Poll: time.Hour, StatusPoll: time.Millisecond, MaxQuiesce: time.Second,
+		Logger: log.New(&bytes.Buffer{}, "", 0),
+	})
+	m, ok := l.readMarker()
+	if !ok {
+		t.Fatal("valid marker must return ok=true")
+	}
+	if len(m.StoppedStacks) != 2 {
+		t.Errorf("expected 2 stopped stacks, got %d", len(m.StoppedStacks))
+	}
+	if g, _ := filepath.Glob(mp + ".corrupt-*"); len(g) != 0 {
+		t.Error("happy path must NOT quarantine")
+	}
+}