v0.164.0: deliberately stopped apps no longer alarm (banner + email)

A UI stop (Leallitas -> compose down -> StateStopped) is the user's own
action, not a fault, and must not raise the deadapp banner OR the
app_start_failed event. Filter at the single fix-3 derivation point:
extract scanDeployedAppRunStates's pure core to classifyRunStates and
change the down predicate to IsDownState(st.State) && st.State !=
StateStopped. Suppresses StateStopped from both the banner dead-list and
the notifier Down-set at once.

Rests on two invariants (recorded at the seam, README, CONTEXT):
 I1 StopStack = compose down => zero containers => StateStopped
 I2 P2 census: all catalog services unless-stopped => faults never rest
    at stopped (they surface as exited/degraded).
IsDownState unchanged; out-of-band 'compose stop' (containers remain ->
exited) still alerts. Tests +4 (notify 3->4, main 4->7), both red-proofs
verified. No template/funcmap/notifier/counter/copy change.

controller/cmd/controller/main.go

@@ -1161,15 +1161,36 @@ func runBootReconcile(ctx context.Context, mgr bootrecon.StackProvider, logger *
 
 // scanDeployedAppRunStates returns the fix-3 view of the deployed apps: the DEAD ones (for the
 // state-based dashboard banner) and EVERY deployed app's run state (for the notifier's one-event-per-
-// transition tracking). Deploying apps are skipped (mid-deploy is not a fault). Pure over GetStacks().
+// transition tracking). Deploying apps are skipped (mid-deploy is not a fault). Pure over GetStacks()
+// — the derivation itself lives in classifyRunStates so it is testable without a live Manager.
 func scanDeployedAppRunStates(mgr *stacks.Manager) ([]web.DeadApp, []notify.AppRunState) {
+	return classifyRunStates(mgr.GetStacks())
+}
+
+// classifyRunStates is the pure fix-3 derivation over a plain stack slice. It splits the deployed
+// apps into the DEAD list (dashboard banner) and the per-app run states (notifier transition tracker).
+//
+// v0.164.0: a deliberate user stop is NOT a fault and must not alarm anywhere (banner OR email). The
+// down predicate therefore EXCLUDES StateStopped, resting on two invariants:
+//   - I1: the UI stop path Manager.StopStack runs `docker compose down` → containers are removed, and
+//     a deployed stack with zero containers aggregates to StateStopped (manager.go refreshStatusLocked).
+//     So StateStopped means "deployed, deliberately stopped by the user".
+//   - I2: the P2 restart-policy census (2026-07-21, 53 templates / 78 services) found every catalog
+//     service on `unless-stopped`, so a crashing app never comes to rest at `stopped` — faults surface
+//     as StateExited / StateDegraded (and restarting/unhealthy). StateStopped is therefore never a fault.
+//
+// If either invariant changes, revisit this suppression. (An out-of-band `docker compose stop` leaves
+// the containers present → StateExited → still alerts, which is correct: out-of-band tampering IS
+// reportable.) IsDownState is intentionally left unchanged — other callers rely on stopped counting as
+// down; the suppression is a filter at this single derivation point only.
+func classifyRunStates(sts []stacks.Stack) ([]web.DeadApp, []notify.AppRunState) {
 	var dead []web.DeadApp
 	var states []notify.AppRunState
-	for _, st := range mgr.GetStacks() {
+	for _, st := range sts {
 		if !st.Deployed || st.Deploying {
 			continue
 		}
-		down := stacks.IsDownState(st.State)
+		down := stacks.IsDownState(st.State) && st.State != stacks.StateStopped
 		states = append(states, notify.AppRunState{Name: st.Name, DisplayName: st.Meta.DisplayName, Down: down})
 		if down {
 			dead = append(dead, web.DeadApp{Name: st.Name, DisplayName: st.Meta.DisplayName, State: string(st.State)})