v0.189.0 — desired state + the app-stop crash marker (R-166 / D-b)

The box stops inferring the customer's intent from a container count and reads
what they actually asked for.

Part 1 — desired state. AppConfig gains a tri-state `desired_state`
(""/running/stopped), written ONLY by the customer's own action: the API action
switch, DeployStack, UpdateOptionalConfig's redeploy branch, and the .fab
import. Intent is written BEFORE the act and a failed write REFUSES the act.
StartStack/StopStack are deliberately not writers — 14 callers, only 2 are the
customer. bootrecon.isBootOrphan now reads intent instead of len(Containers)>0,
which closes R-157 mechanism B (a power cut or interrupted deploy left an app
with zero containers, read as a deliberate stop, and stranded silently).

ABSENT MEANS UNKNOWN, NEVER "running": every pre-v0.189.0 app.yaml reads absent,
so the legacy fallback is byte-identical to the old rule. A running-only startup
backfill converges the unambiguous cases; `stopped` is never inferred.

Part 2 — backup.AppStopGuard, a persisted marker over every stop→work→start
window (volume dump, offbox reconstitute, .fab export). Its own file, never
quiesce's. Written before the stop, cleared only after a restart that succeeded,
kept when one fails. Recover() completes before the boot reconciler is launched
and returns its outcome, which main.go reports on the existing backup_failed
event once the notifier exists. A defer is not the mechanism — a SIGKILL runs
none (Campaign 8 fault 10).

Also: SaveAppConfig rebuilt AppConfig field-by-field (the R-100 shape) and would
have dropped desired_state on every save across nine call sites. Replaced with
copy-and-overlay. Measured: app.yaml does not round-trip unknown YAML keys.

No hub change, no agent coupling, no user-visible string. 27/27 packages green;
7 red-proofs observed FAIL then restored.

controller/internal/appexport/export.go

@@ -96,10 +96,26 @@ type Exporter struct {
 	// computation walks. Nil → the real os.ReadDir-based lister.
 	dirLister func(dir string) []string
 
+	// stopGuard (R-166) marks the stop→export→start window so a controller killed inside it leaves a
+	// durable record that the app is owed a restart. Declared consumer-side as a two-method interface
+	// so this package does not import internal/backup; main.go passes the backup manager's guard, so
+	// BOTH packages write ONE marker file — an exporter with its own file would be a second writer
+	// racing the same recovery. Nil = not wired (tests): the export runs exactly as it did before.
+	stopGuard appStopGuard
+
 	mu        sync.Mutex
 	activeJob *Job
 }
 
+// appStopGuard is the app-stop crash-marker seam. The REASON is deliberately not a parameter: it is
+// always "app export" from here, and the adapter in main.go supplies it. Passing it as a string
+// would duplicate backup.ReasonAppExport's value in a second package with nothing keeping the two in
+// step — a drift this codebase has paid for before (the offbox key that was guessed, R-7b).
+type appStopGuard interface {
+	Begin(opID string, stacks []string) error
+	End()
+}
+
 // NewExporter creates a new export/import engine.
 func NewExporter(provider ExportStackProvider, logger *log.Logger, version string) *Exporter {
 	return &Exporter{
@@ -109,6 +125,18 @@ func NewExporter(provider ExportStackProvider, logger *log.Logger, version strin
 	}
 }
 
+// SetStopGuard wires the app-stop crash marker. INIT-ONLY — call once at startup, before any export.
+func (e *Exporter) SetStopGuard(g appStopGuard) { e.stopGuard = g }
+
+// stopGuardBegin records the app-stop marker before an export stops an app. An unwired guard is a
+// no-op (pre-v0.189.0 behaviour), never an error — a test exporter must not be forced to have one.
+func (e *Exporter) stopGuardBegin(stackName string) error {
+	if e.stopGuard == nil {
+		return nil
+	}
+	return e.stopGuard.Begin("app-export:"+stackName, []string{stackName})
+}
+
 // SetDebug enables or disables verbose debug logging.
 func (e *Exporter) SetDebug(debug bool) {
 	e.debug = debug
@@ -226,6 +254,14 @@ func (e *Exporter) executeExport(req ExportRequest, job *Job) {
 	// Optionally stop the app
 	wasRunning := false
 	if req.StopApp && e.provider.IsStackRunning(req.StackName) {
+		// R-166: mark BEFORE the stop. The defer below covers the graceful exits; it does NOT cover a
+		// SIGKILL or a power cut, which run no deferred function (Campaign 8 fault 10, on live
+		// hardware) — only this marker does, and a big export is a long window to be killed in.
+		if err := e.stopGuardBegin(req.StackName); err != nil {
+			e.failJob(job, step, "Az alkalmazás leállítása előtti jelölő nem menthető — az exportálás nem indult el.")
+			e.logger.Printf("[ERROR] Export: could not record the app-stop marker for %s (refusing to stop it unprotected): %v", req.StackName, err)
+			return
+		}
 		wasRunning = true
 		e.logger.Printf("[INFO] Export: stopping %s", req.StackName)
 		e.debugf("stopping stack %s before export", req.StackName)
@@ -246,6 +282,11 @@ func (e *Exporter) executeExport(req ExportRequest, job *Job) {
 				e.logger.Printf("[WARN] Export: could not restart %s: %v", req.StackName, err)
 			} else {
 				e.debugf("stack %s restarted successfully", req.StackName)
+				// Cleared only on a restart that succeeded — a failed one keeps the marker so the
+				// next startup retries.
+				if e.stopGuard != nil {
+					e.stopGuard.End()
+				}
 			}
 		}()
 	}