v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

R-537 — the contents label is now PER TIER. One string computed from the app's
shape was rendered on all three tier rows; a Tier-1 unit has no file-copy step, so
for the four class-A apps it was claiming „Adatok" for files it does not hold.

R-538 — a unit restore REFUSES before anything is touched when the unit cannot
return the app's drive-side files, and names the route that can. It runs before the
stack is stopped because the measured harm included the app's own wastebasket going
unreachable, which still held every byte.

R-536 — „Alkalmazás telepítve" moved from the deploy's acceptance to its completion,
with app_deploy_started and app_deploy_failed as the honest pair.

Each fix red-proofed: seen failing with its own sentence, passing when restored.
Requires hub v0.116.0 for the two new event types. MinAgent unchanged (0.131.0).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/notify/notifier.go

@@ -515,12 +515,40 @@ type EndpointDriftDetails struct {
 }
 
 // NotifyAppDeployed sends an app deployment event.
+//
+// R-536: it is called when the deploy COMPLETES (the compose up succeeded and the app's durable
+// state was written), never when the request was merely accepted. It used to fire beside the 202,
+// so an install that was interrupted five seconds later still stood on the hub's timeline as
+// „Alkalmazás telepítve" forever — measured 2026-09-16 with mealie, which ended `not_deployed`.
 func (n *Notifier) NotifyAppDeployed(stackName, displayName string) {
 	n.PushEvent("app_deployed", "info",
 		fmt.Sprintf("Alkalmazás telepítve: %s", displayName),
 		AppDetails{StackName: stackName, DisplayName: displayName})
 }
 
+// NotifyAppDeployStarted records the ACCEPTANCE — the fact `app_deployed` used to assert. It keeps
+// the timeline's "the customer asked for this app at 12:31" without claiming the install finished.
+//
+// NOTE: the hub validates event_type against allowedEventTypes and 400s an unknown one, so this type
+// MUST exist there too (hub handler.go) or the event is silently inert.
+func (n *Notifier) NotifyAppDeployStarted(stackName, displayName string) {
+	n.PushEvent("app_deploy_started", "info",
+		fmt.Sprintf("Alkalmazás telepítése elindult: %s", displayName),
+		AppDetails{StackName: stackName, DisplayName: displayName})
+}
+
+// NotifyAppDeployFailed closes the pair. severity=warning, not info: an install the customer started
+// and that did not finish is a thing someone should see, and the silent version of this is exactly
+// what left a completed-install record for an app that was never installed.
+func (n *Notifier) NotifyAppDeployFailed(stackName, displayName, reason string) {
+	msg := fmt.Sprintf("Alkalmazás telepítése nem sikerült: %s", displayName)
+	if reason != "" {
+		msg += " — " + reason
+	}
+	n.PushEvent("app_deploy_failed", "warning", msg,
+		AppDetails{StackName: stackName, DisplayName: displayName})
+}
+
 // AppRunState is one deployed app's running state for the fix-3 start-failure notifier: Down=true
 // when the app is deployed but its containers are not running.
 type AppRunState struct {