v0.311.0: after a power cut, an app repairs the files the cut left empty; the household sees lost photos (R-1007)

New template block after_unclean_boot (decision 236): once per controller start that followed an
UNCLEAN host boot (crashboot's own verdict, after the 15-minute crash grace; a normal or unknown boot
never runs it), each app with the block rebuilds ONLY its zero-byte files (scan: regular files, no
symlinks, its own filesystem; ids appended to the app's own command in batches; one retry, then
reported) and its own lost-file check is read. The household sees lost files (name, date taken) on
the app page until dismissed; the operator gets app_repaired_after_crash with counts only. Skips,
with the reason, an unproven image, an unknown key, an app not running. MinAgent 0.155.0 unchanged.
Tests red-proofed (14 guards). One new parity fixture (the new card only).

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/crashboot/crashboot.go

@@ -58,6 +58,7 @@ type Grace struct {
 	mu        sync.Mutex
 	resolved  bool
 	crashBoot bool
+	bootAt    time.Time // the unclean boot this start followed (set only when crashBoot)
 }
 
 // New builds the grace for a controller that started at start. probe may be nil (no agent): unknown.
@@ -116,10 +117,24 @@ func (g *Grace) tryResolve(final bool) {
 		g.resolve(false, "the host's last unclean boot ("+f.BootAt.UTC().Format(time.RFC3339)+") is not the one this start followed")
 	default:
 		g.crashBoot = true
+		g.bootAt = f.BootAt
 		g.resolve(true, "the host's last boot ("+f.BootAt.UTC().Format(time.RFC3339)+") followed an UNCLEAN stop")
 	}
 }
 
+// Decided reports the run's verdict once it is known (R-1007): resolved=false while the fact may still arrive;
+// then crash (and the unclean boot's time) or not. It asks the probe like Within does — unknown resolves to a normal
+// boot at the end of the normal grace, never to a crash. Pinned by TestDecided_* in crashboot_test.go.
+func (g *Grace) Decided(now time.Time) (resolved, crash bool, bootAt time.Time) {
+	g.duration(now.Sub(g.start))
+	g.mu.Lock()
+	defer g.mu.Unlock()
+	return g.resolved, g.crashBoot, g.bootAt
+}
+
+// Start is the controller start this grace measures from.
+func (g *Grace) Start() time.Time { return g.start }
+
 func (g *Grace) resolve(crash bool, why string) {
 	g.resolved = true
 	if g.logger == nil {