v0.311.0: after a power cut, an app repairs the files the cut left empty; the household sees lost photos (R-1007)

New template block after_unclean_boot (decision 236): once per controller start that followed an
UNCLEAN host boot (crashboot's own verdict, after the 15-minute crash grace; a normal or unknown boot
never runs it), each app with the block rebuilds ONLY its zero-byte files (scan: regular files, no
symlinks, its own filesystem; ids appended to the app's own command in batches; one retry, then
reported) and its own lost-file check is read. The household sees lost files (name, date taken) on
the app page until dismissed; the operator gets app_repaired_after_crash with counts only. Skips,
with the reason, an unproven image, an unknown key, an app not running. MinAgent 0.155.0 unchanged.
Tests red-proofed (14 guards). One new parity fixture (the new card only).

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/README.md

@@ -3297,6 +3297,16 @@ alarms for 14 days (hub v0.149.0). Design: felhom.eu `documentation/architecture
 **„A Felhom újraindítása"** (was „Kiszolgáló újraindítása", R-999) restarts the guest — the dashboard and the apps —
 not the machine; its text now says so. `/api/server/reboot` is POST only (R-983, one of its seven).
 
+### 8b. After a power cut — an app repairs its empty files (v0.311.0, R-1007)
+
+A power cut while an app writes can leave files ZERO BYTES. A template may carry `after_unclean_boot` (catalog README
+„After an unclean boot"): where such files are, how the app rebuilds THOSE only, and its own lost-file check. Once per
+controller start that followed an UNCLEAN host boot (the crash guard's fact via the agent; unknown = normal), after
+the 15-minute crash grace, the box scans, asks the app to repair, re-scans, retries once, and reads the lost list.
+The household sees lost files (name, date taken) on the app page until dismissed; the operator gets
+`app_repaired_after_crash` with counts only. Immich is the first user (`09` §3 decision 236: Immich's own job queue —
+no key into the household's account). Code: `internal/stacks/after_unclean_boot.go`, `internal/aftercrash/`.
+
 ### 9. Central Hub Reporting
 
 #### Operator actions (`internal/report/opactions.go`, `09` §3 decision 185)