v0.189.0 — desired state + the app-stop crash marker (R-166 / D-b)

The box stops inferring the customer's intent from a container count and reads
what they actually asked for.

Part 1 — desired state. AppConfig gains a tri-state `desired_state`
(""/running/stopped), written ONLY by the customer's own action: the API action
switch, DeployStack, UpdateOptionalConfig's redeploy branch, and the .fab
import. Intent is written BEFORE the act and a failed write REFUSES the act.
StartStack/StopStack are deliberately not writers — 14 callers, only 2 are the
customer. bootrecon.isBootOrphan now reads intent instead of len(Containers)>0,
which closes R-157 mechanism B (a power cut or interrupted deploy left an app
with zero containers, read as a deliberate stop, and stranded silently).

ABSENT MEANS UNKNOWN, NEVER "running": every pre-v0.189.0 app.yaml reads absent,
so the legacy fallback is byte-identical to the old rule. A running-only startup
backfill converges the unambiguous cases; `stopped` is never inferred.

Part 2 — backup.AppStopGuard, a persisted marker over every stop→work→start
window (volume dump, offbox reconstitute, .fab export). Its own file, never
quiesce's. Written before the stop, cleared only after a restart that succeeded,
kept when one fails. Recover() completes before the boot reconciler is launched
and returns its outcome, which main.go reports on the existing backup_failed
event once the notifier exists. A defer is not the mechanism — a SIGKILL runs
none (Campaign 8 fault 10).

Also: SaveAppConfig rebuilt AppConfig field-by-field (the R-100 shape) and would
have dropped desired_state on every save across nine call sites. Replaced with
copy-and-overlay. Measured: app.yaml does not round-trip unknown YAML keys.

No hub change, no agent coupling, no user-visible string. 27/27 packages green;
7 red-proofs observed FAIL then restored.

controller/internal/api/router.go

@@ -534,6 +534,24 @@ func (r *Router) startGatedByMissingDrive(name string) (bool, string) {
 	return false, ""
 }
 
+// desiredStateForAction maps a stack action to the customer intent it expresses, or (_, false) for
+// an action that expresses none. Pure, so the §8.1/§1.3 mapping is testable without a Manager.
+//
+// `restart` and `update` both mean running: a customer who updates or restarts an app is asking for
+// it to be up afterwards, and both end in `compose up -d`. Anything not listed here — an unknown
+// action string — records nothing rather than guessing, so a future action cannot silently acquire
+// an intent it was never meant to carry.
+func desiredStateForAction(action string) (string, bool) {
+	switch action {
+	case "start", "restart", "update":
+		return stacks.DesiredStateRunning, true
+	case "stop":
+		return stacks.DesiredStateStopped, true
+	default:
+		return "", false
+	}
+}
+
 func (r *Router) actionStack(w http.ResponseWriter, action, name string) {
 	r.logger.Printf("[INFO] [api] %s requested for stack: %s", action, name)
 	r.dbg("actionStack: action=%s name=%s", action, name)
@@ -579,6 +597,26 @@ func (r *Router) actionStack(w http.ResponseWriter, action, name string) {
 		}
 	}
 
+	// R-166: THE CUSTOMER-INTENT POINT. This switch is where a human's decision about whether their
+	// app should be running enters the system, and until v0.189.0 that decision was recorded nowhere
+	// — so the box had to infer it from container counts, and inferred wrong for a power cut and for
+	// an interrupted backup alike.
+	//
+	// Written BEFORE the act (§8.2) and a failed write REFUSES the act: performing a stop whose
+	// intent could not be recorded would recreate exactly the ambiguity this closes. Both gates that
+	// can legitimately refuse an action (protected-stack, drive-absent, memory) have already run
+	// above, so nothing is recorded for an action that was never going to happen.
+	if desired, ok := desiredStateForAction(action); ok {
+		if derr := r.stackMgr.SetDesiredState(name, desired); derr != nil {
+			r.logger.Printf("[ERROR] [api] %s for %s refused: could not record desired state: %v", action, name, derr)
+			writeJSON(w, http.StatusInternalServerError, apiResponse{
+				OK:    false,
+				Error: "A művelet nem hajtható végre: az alkalmazás beállításai nem menthetők.",
+			})
+			return
+		}
+	}
+
 	var err error
 	switch action {
 	case "start":