D65 = A: the busy file the agent reads before an operator reboot, and the household's 'Felhom support restarted your box' line; R-1350: a hold clear records the wanted stop so no app_start_failed follows it

controller/internal/stacks/desiredstate_test.go

@@ -336,3 +336,27 @@ func TestDesiredStateOf_NilAppConfigIsUnknown(t *testing.T) {
 		t.Fatalf("a stack with no AppConfig reported desired state %q — absent must read as unknown", got)
 	}
 }
+
+// R-1350: the operator's hold clear records „stopped" for an app that is NOT up, and leaves a running app's wish alone
+// (a clear never stops anything). RED-PROOF: write „stopped" without the up check → the running case FAILS.
+func TestR1350_RecordStopWantedIfDown(t *testing.T) {
+	m, root := newDSManager(t, "gokapi", "immich")
+	for _, n := range []string{"gokapi", "immich"} {
+		writeAppYAML(t, stackDirOf(root, n), "deployed: true\ndesired_state: running\n")
+		m.stacks[n].AppConfig = LoadAppConfig(stackDirOf(root, n))
+	}
+	m.stacks["gokapi"].State = StateStopped
+	m.stacks["immich"].State = StateRunning
+	if rec, err := m.RecordStopWantedIfDown("gokapi"); err != nil || !rec {
+		t.Fatalf("gokapi: recorded=%v err=%v", rec, err)
+	}
+	if got := LoadAppConfig(stackDirOf(root, "gokapi")).DesiredState; got != DesiredStateStopped {
+		t.Fatalf("gokapi desired_state on disk = %q, want stopped", got)
+	}
+	if rec, err := m.RecordStopWantedIfDown("immich"); err != nil || rec {
+		t.Fatalf("immich (running): recorded=%v err=%v", rec, err)
+	}
+	if got := LoadAppConfig(stackDirOf(root, "immich")).DesiredState; got != DesiredStateRunning {
+		t.Fatalf("a running app's wish was changed to %q", got)
+	}
+}