controller v0.269.0: whole restore from the second drive; crash loops stopped; exact image digests; steps judged by their own .felhom.yml (decisions 26-28, R-661 R-666 R-667 R-668 R-664 R-665 R-662, 09 6.4 part 6)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/notify/notifier.go

@@ -1304,6 +1304,27 @@ func (n *Notifier) NotifyAppUpdateHeld(d AppUpdateDetails, sentence func(lang st
 	n.pushEventBoth("app_update_held", "error", hu, household, d)
 }
 
+// AppStoppedUnhealthyDetails is the payload of app_stopped_unhealthy (v0.269.0, decision 28).
+type AppStoppedUnhealthyDetails struct {
+	App       string `json:"app"`
+	StackName string `json:"stack_name"`
+	Kind      string `json:"kind"` // crash_loop / oom_storm
+	Count     int64  `json:"count"`
+	WindowMin int    `json:"window_min"`
+	Trip      int    `json:"trip"`
+}
+
+// NotifyAppStoppedUnhealthy (v0.269.0, `09` §3 decision 28): the box stopped an app that kept crashing
+// or kept running out of memory. Household event (warning), per-app cooldown on the hub (v0.123.0).
+func (n *Notifier) NotifyAppStoppedUnhealthy(app, kind string, count int64, window time.Duration, trip int) {
+	key := "event.app_stopped_unhealthy"
+	if trip >= 2 {
+		key = "event.app_stopped_unhealthy.repeat"
+	}
+	n.pushEventMsg("app_stopped_unhealthy", "warning", key,
+		AppStoppedUnhealthyDetails{App: app, StackName: app, Kind: kind, Count: count, WindowMin: int(window.Minutes()), Trip: trip}, app)
+}
+
 // AppHoldNoWholeCopyDetails is the payload of app_hold_no_whole_copy (v0.268.0, R-659).
 type AppHoldNoWholeCopyDetails struct {
 	App        string            `json:"app"`