v0.189.0 — desired state + the app-stop crash marker (R-166 / D-b)

The box stops inferring the customer's intent from a container count and reads
what they actually asked for.

Part 1 — desired state. AppConfig gains a tri-state `desired_state`
(""/running/stopped), written ONLY by the customer's own action: the API action
switch, DeployStack, UpdateOptionalConfig's redeploy branch, and the .fab
import. Intent is written BEFORE the act and a failed write REFUSES the act.
StartStack/StopStack are deliberately not writers — 14 callers, only 2 are the
customer. bootrecon.isBootOrphan now reads intent instead of len(Containers)>0,
which closes R-157 mechanism B (a power cut or interrupted deploy left an app
with zero containers, read as a deliberate stop, and stranded silently).

ABSENT MEANS UNKNOWN, NEVER "running": every pre-v0.189.0 app.yaml reads absent,
so the legacy fallback is byte-identical to the old rule. A running-only startup
backfill converges the unambiguous cases; `stopped` is never inferred.

Part 2 — backup.AppStopGuard, a persisted marker over every stop→work→start
window (volume dump, offbox reconstitute, .fab export). Its own file, never
quiesce's. Written before the stop, cleared only after a restart that succeeded,
kept when one fails. Recover() completes before the boot reconciler is launched
and returns its outcome, which main.go reports on the existing backup_failed
event once the notifier exists. A defer is not the mechanism — a SIGKILL runs
none (Campaign 8 fault 10).

Also: SaveAppConfig rebuilt AppConfig field-by-field (the R-100 shape) and would
have dropped desired_state on every save across nine call sites. Replaced with
copy-and-overlay. Measured: app.yaml does not round-trip unknown YAML keys.

No hub change, no agent coupling, no user-visible string. 27/27 packages green;
7 red-proofs observed FAIL then restored.

controller/internal/backup/offbox_reconstitute.go

@@ -276,6 +276,22 @@ func (m *Manager) ReconstituteFromOffsite(ctx context.Context, stack string) (Of
 	}
 
 	// --- FILES ----------------------------------------------------------------------------------
+	// R-166: mark the stop→restore→start window BEFORE stopping. A controller killed anywhere inside
+	// it used to leave the app down with nothing on disk recording that it was owed a restart — and a
+	// full offsite restore is a LONG window, so this is the shape most likely to be interrupted.
+	if err := m.appStop.Begin("offbox-reconstitute:"+stack, ReasonOffboxReconstitute, []string{stack}); err != nil {
+		return res, fmt.Errorf("a(z) %s leállítása előtti jelölő nem menthető: %w", stack, err)
+	}
+	// restartStack starts the app and clears the marker ONLY when the start actually succeeded — a
+	// failed start leaves the marker so the next startup retries. Every bring-up below goes through
+	// it; a bare StartStack here would clear nothing and strand the marker on the success path.
+	restartStack := func() error {
+		err := m.stackProvider.StartStack(stack)
+		if err == nil {
+			m.appStop.End()
+		}
+		return err
+	}
 	if err := m.stackProvider.StopStack(stack); err != nil {
 		m.logger.Printf("[WARN] [offbox] could not stop %s before reconstitution: %v (continuing)", stack, err)
 	}
@@ -291,7 +307,7 @@ func (m *Manager) ReconstituteFromOffsite(ctx context.Context, stack string) (Of
 		if cErr != nil {
 			// Best-effort bring-up: leaving the app stopped after a partial copy would turn a failed
 			// restore into an outage.
-			if sErr := m.stackProvider.StartStack(stack); sErr != nil {
+			if sErr := restartStack(); sErr != nil {
 				m.logger.Printf("[WARN] [offbox] %s: restart after failed placement also failed: %v", stack, sErr)
 			}
 			return res, fmt.Errorf("a(z) %s fájljainak visszaállítása sikertelen: %w", stack, cErr)
@@ -308,7 +324,7 @@ func (m *Manager) ReconstituteFromOffsite(ctx context.Context, stack string) (Of
 	if hasDB {
 		if err := m.stackProvider.StartStackServices(stack, dbServices); err != nil {
 			// Best-effort bring-up: a failed restore must not also be an outage.
-			if sErr := m.stackProvider.StartStack(stack); sErr != nil {
+			if sErr := restartStack(); sErr != nil {
 				m.logger.Printf("[WARN] [offbox] %s: full start after failed DB-only start also failed: %v", stack, sErr)
 			}
 			return res, fmt.Errorf("a(z) %s adatbázis-szolgáltatásának indítása sikertelen: %w", stack, err)
@@ -316,13 +332,13 @@ func (m *Manager) ReconstituteFromOffsite(ctx context.Context, stack string) (Of
 		n, iErr := m.reimportDBDumpsFrom(ctx, stack, scratchDumpDir)
 		res.DBsReplayed = n
 		if iErr != nil {
-			if sErr := m.stackProvider.StartStack(stack); sErr != nil {
+			if sErr := restartStack(); sErr != nil {
 				m.logger.Printf("[WARN] [offbox] %s: full start after failed replay also failed: %v", stack, sErr)
 			}
 			return res, fmt.Errorf("az adatbázis visszaállítása sikertelen: %w — a korábbi állapot mentése megvan: %s", iErr, filepath.Base(safety))
 		}
 	}
-	if err := m.stackProvider.StartStack(stack); err != nil {
+	if err := restartStack(); err != nil {
 		return res, fmt.Errorf("a(z) %s újraindítása sikertelen a fájlok visszaállítása után: %w", stack, err)
 	}
 	if err := m.waitForHealthy(stack, 90*time.Second); err != nil {