D62: restore copies kept 30 days, listed with their date, deletable by hand (typed name, never a needed copy, operator event); D63: a test-build-only fault switch for the R-1256 H4/H5 live proofs — tests red first

controller/cmd/controller/main.go

@@ -3191,6 +3191,9 @@ func (a *stackAdapter) ListDeployedStacks() []backup.StackSummary {
 }
 
 func (a *stackAdapter) StopStack(name string) error {
+	if err := faultPoint("stop-" + name); err != nil { // D63: a no-op outside a -tags faultinject test build
+		return err
+	}
 	return a.mgr.StopStack(name)
 }
 
@@ -3435,6 +3438,9 @@ func (a *stackAdapter) RecreateStackDefinitionFromUnit(name, composeSrcDir strin
 			return fmt.Errorf("restoring %s from unit: %w", fname, err)
 		}
 	}
+	if err := faultPoint("defwrite-after-compose"); err != nil { // D63: a no-op outside a -tags faultinject test build
+		return err
+	}
 	// R-1057 (v0.314.0): the gate as the backup recorded it — the unit's app.yaml, read BEFORE the write.
 	gate := stacks.ReadGateAtBackup(filepath.Join(composeSrcDir, "app.yaml"))
 	if err := a.mgr.PersistUnitRedeployConfigGate(name, fullEnv, gate); err != nil {