v0.311.0: after a power cut, an app repairs the files the cut left empty; the household sees lost photos (R-1007)

New template block after_unclean_boot (decision 236): once per controller start that followed an
UNCLEAN host boot (crashboot's own verdict, after the 15-minute crash grace; a normal or unknown boot
never runs it), each app with the block rebuilds ONLY its zero-byte files (scan: regular files, no
symlinks, its own filesystem; ids appended to the app's own command in batches; one retry, then
reported) and its own lost-file check is read. The household sees lost files (name, date taken) on
the app page until dismissed; the operator gets app_repaired_after_crash with counts only. Skips,
with the reason, an unproven image, an unknown key, an app not running. MinAgent 0.155.0 unchanged.
Tests red-proofed (14 guards). One new parity fixture (the new card only).

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/crashboot/crashboot_test.go

@@ -104,3 +104,20 @@ func TestR856_AgentProbeReadsTheCrashGuardState(t *testing.T) {
 		t.Error("an agent that predates the route (404) is unknown — a normal boot")
 	}
 }
+
+// R-1007: Decided exposes the same verdict, with the unclean boot's time. Unknown stays unresolved inside the
+// normal grace and resolves to NOT a crash at its end.
+func TestDecided_CrashCarriesTheBootTimeUnknownResolvesNormal(t *testing.T) {
+	boot := start.Add(-time.Minute)
+	g := New(start, fixed(Fact{Known: true, Unclean: true, BootAt: boot}, nil), nil)
+	if res, crash, at := g.Decided(start.Add(time.Second)); !res || !crash || !at.Equal(boot) {
+		t.Fatalf("crash: resolved=%t crash=%t at=%s", res, crash, at)
+	}
+	u := New(start, fixed(Fact{}, nil), nil)
+	if res, _, _ := u.Decided(start.Add(10 * time.Second)); res {
+		t.Fatal("unknown must not resolve inside the normal grace (the agent may come up late)")
+	}
+	if res, crash, _ := u.Decided(start.Add(NormalGrace)); !res || crash {
+		t.Fatalf("unknown at the end of the normal grace: resolved=%t crash=%t, want a normal boot", res, crash)
+	}
+}