v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

R-537 — the contents label is now PER TIER. One string computed from the app's
shape was rendered on all three tier rows; a Tier-1 unit has no file-copy step, so
for the four class-A apps it was claiming „Adatok" for files it does not hold.

R-538 — a unit restore REFUSES before anything is touched when the unit cannot
return the app's drive-side files, and names the route that can. It runs before the
stack is stopped because the measured harm included the app's own wastebasket going
unreachable, which still held every byte.

R-536 — „Alkalmazás telepítve" moved from the deploy's acceptance to its completion,
with app_deploy_started and app_deploy_failed as the honest pair.

Each fix red-proofed: seen failing with its own sentence, passing when restored.
Requires hub v0.116.0 for the two new event types. MinAgent unchanged (0.131.0).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/deploy.go

@@ -401,6 +401,15 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 
 // runComposeDeploy executes docker compose up -d in background.
 // On success it refreshes status; on failure it reverts the deploy state.
+// SetDeployDoneHook registers the callback fired (in the deploy goroutine) when an async deploy
+// ENDS — successfully or not. It is the seam R-536 needed: the deploy's outcome is known here and
+// nowhere else, and the hub event that asserts an app is installed must hang off the outcome rather
+// than off the acceptance.
+//
+// Same shape as SetMigrationDoneHook, deliberately: the policy (which event, what wording) lives in
+// the caller, and this package only reports what happened.
+func (m *Manager) SetDeployDoneHook(fn func(name string, ok bool, detail string)) { m.deployDoneHook = fn }
+
 func (m *Manager) runComposeDeploy(name, stackDir string, env map[string]string, appCfg *AppConfig) {
 	start := time.Now()
 	_, composeErr := m.composeExecWithEnv(stackDir, env, "up", "-d")
@@ -421,6 +430,15 @@ func (m *Manager) runComposeDeploy(name, stackDir string, env map[string]string,
 		// Save reverted state to disk with encryption (H05 fix)
 		meta := LoadMetadata(stackDir)
 		_ = SaveAppConfig(stackDir, appCfg, m.encKey, SensitiveEnvVars(&meta))
+		// R-536: the deploy ended, and it ended badly. Say so — the alternative is the silence that
+		// let an accept-time „Alkalmazás telepítve" stand as the last word on an app that never ran.
+		//
+		// The app.yaml is deliberately NOT deleted here: it is the crash-safe record written with
+		// Deployed:false, it carries the settings the customer typed, and a redeploy reuses them. The
+		// state the surfaces read is `not_deployed`, which is the fact that matters.
+		if m.deployDoneHook != nil {
+			m.deployDoneHook(name, false, composeErr.Error())
+		}
 		return
 	}
 
@@ -472,6 +490,19 @@ func (m *Manager) runComposeDeploy(name, stackDir string, env map[string]string,
 	m.logPostStartStatus(name, stackDir, deployEnv)
 
 	_ = m.RefreshStatus()
+
+	// R-536: ONLY NOW is „Alkalmazás telepítve" a true sentence — the compose up succeeded, the
+	// durable record says deployed, the images are recorded and the status has been refreshed. The
+	// observed state rides along rather than being asserted: a stack that is still `starting` is
+	// installed, and the detail says which it is instead of the event implying health it has not
+	// measured.
+	if m.deployDoneHook != nil {
+		state := ""
+		if s, ok := m.GetStack(name); ok {
+			state = string(s.State)
+		}
+		m.deployDoneHook(name, true, state)
+	}
 }
 
 // UpdateStackConfig updates non-locked fields for a deployed stack.