R-1199 reopened: a box with no list of its own reads the household's from the hub and adopts it, pushes its default once only when no household saved one; every push names its source; an empty saved list stays empty; R-1216 (D28 = A): the install page's swap sentence only when host swap is really short (shared case table); unreleased

controller/internal/notify/notifier.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"net/url"
 	"strings"
 	"sync"
 	"time"
@@ -1070,14 +1071,31 @@ type preferencesRequest struct {
 	// holds. OMITTED unless true: an empty address without it keeps the hub's no-clobber guard (an
 	// unconfigured box must never wipe a seeded address). Decoded by the hub's savePreferences.
 	EmailCleared bool `json:"email_cleared,omitempty"`
+	// Source (R-1199 reopened): PrefsSourceHousehold or PrefsSourceDefault. An older hub ignores it.
+	Source string `json:"source,omitempty"`
 }
 
-// SyncPreferences pushes the current notification preferences to the hub.
+// SyncPreferences pushes the household's saved notification preferences to the hub (source "household").
 // Synchronous — returns error for the handler to display to the user.
 // emailCleared (R-922) is settings.NotificationPrefs.EmailCleared — true only after a household's clear.
 func (n *Notifier) SyncPreferences(email string, enabledEvents []string, cooldownHours int, emailCleared bool) error {
+	_, err := n.SyncPreferencesAs(PrefsSourceHousehold, email, enabledEvents, cooldownHours, emailCleared)
+	return err
+}
+
+// PrefsSourceHousehold / PrefsSourceDefault (R-1199 reopened) tell the hub who chose the pushed list: the household
+// (the settings page, or the re-push of a list saved on this box) or the box's own default (nothing saved here and
+// the hub holds no household list). The hub never lets a default overwrite a household's list.
+const (
+	PrefsSourceHousehold = "household"
+	PrefsSourceDefault   = "default"
+)
+
+// SyncPreferencesAs is SyncPreferences with the source named. It returns the hub's status word: "ok", or "kept" when
+// the hub refused a default push because the household saved its own list (hub ≥ 0.165.0).
+func (n *Notifier) SyncPreferencesAs(source, email string, enabledEvents []string, cooldownHours int, emailCleared bool) (string, error) {
 	if !n.enabled {
-		return util.MsgError("err.notify.hub_nem_konfiguralt")
+		return "", util.MsgError("err.notify.hub_nem_konfiguralt")
 	}
 
 	payload := preferencesRequest{
@@ -1086,41 +1104,85 @@ func (n *Notifier) SyncPreferences(email string, enabledEvents []string, cooldow
 		EnabledEvents: enabledEvents,
 		CooldownHours: cooldownHours,
 		EmailCleared:  emailCleared,
+		Source:        source,
 	}
 
 	jsonData, err := json.Marshal(payload)
 	if err != nil {
-		return fmt.Errorf("marshal: %w", err)
+		return "", fmt.Errorf("marshal: %w", err)
 	}
 
-	url := n.hubURL + "/api/v1/preferences"
+	prefsURL := n.hubURL + "/api/v1/preferences"
 	if n.debug {
-		n.logger.Printf("[DEBUG] SyncPreferences: url=%s email=%s events=%v cooldown=%dh",
-			url, email, enabledEvents, cooldownHours)
+		n.logger.Printf("[DEBUG] SyncPreferences: url=%s source=%s email=%s events=%v cooldown=%dh",
+			prefsURL, source, email, enabledEvents, cooldownHours)
 	}
-	req, err := http.NewRequest("POST", url, bytes.NewReader(jsonData))
+	req, err := http.NewRequest("POST", prefsURL, bytes.NewReader(jsonData))
 	if err != nil {
-		return fmt.Errorf("request: %w", err)
+		return "", fmt.Errorf("request: %w", err)
 	}
 	req.Header.Set("Authorization", "Bearer "+n.apiKey)
 	req.Header.Set("Content-Type", "application/json")
 
 	resp, err := n.httpClient.Do(req)
 	if err != nil {
-		return util.MsgError("err.notify.hub_elerhetetlen", err)
+		return "", util.MsgError("err.notify.hub_elerhetetlen", err)
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode >= 400 {
 		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
-		return util.MsgError("err.notify.hub_error", resp.StatusCode, string(body))
+		return "", util.MsgError("err.notify.hub_error", resp.StatusCode, string(body))
+	}
+	var ack struct {
+		Status string `json:"status"`
+	}
+	_ = json.NewDecoder(io.LimitReader(resp.Body, 4096)).Decode(&ack) // an older hub answers {"status":"ok"} too
+	if ack.Status == "" {
+		ack.Status = "ok"
 	}
 
 	if n.debug {
 		n.logger.Printf("[DEBUG] SyncPreferences: response HTTP %d", resp.StatusCode)
 	}
-	n.logger.Printf("[INFO] Notification preferences synced to hub: email=%s, events=%v, cooldown=%dh, email_cleared=%t", email, enabledEvents, cooldownHours, emailCleared)
-	return nil
+	n.logger.Printf("[INFO] Notification preferences synced to hub: source=%s status=%s email=%s, events=%v, cooldown=%dh, email_cleared=%t", source, ack.Status, email, enabledEvents, cooldownHours, emailCleared)
+	return ack.Status, nil
+}
+
+// HubPrefs is the hub's stored notification list for this box's customer (GET /api/v1/preferences, hub ≥ 0.165.0).
+type HubPrefs struct {
+	Exists         bool     `json:"exists"`
+	HouseholdSaved bool     `json:"household_saved"`
+	Email          string   `json:"email"`
+	EnabledEvents  []string `json:"enabled_events"`
+	CooldownHours  int      `json:"cooldown_hours"`
+}
+
+// FetchPreferences reads the hub's stored list for this customer (R-1199 reopened): a box with no list of its own
+// adopts the household's instead of pushing its default over it. Any failure — an older hub (404), no network — is
+// an error, and the caller then pushes nothing.
+func (n *Notifier) FetchPreferences() (*HubPrefs, error) {
+	if !n.enabled {
+		return nil, util.MsgError("err.notify.hub_nem_konfiguralt")
+	}
+	req, err := http.NewRequest("GET", n.hubURL+"/api/v1/preferences?customer_id="+url.QueryEscape(n.customerID), nil)
+	if err != nil {
+		return nil, fmt.Errorf("request: %w", err)
+	}
+	req.Header.Set("Authorization", "Bearer "+n.apiKey)
+	resp, err := n.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("hub unreachable: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("hub answered HTTP %d", resp.StatusCode)
+	}
+	var hp HubPrefs
+	if err := json.NewDecoder(io.LimitReader(resp.Body, 1<<16)).Decode(&hp); err != nil {
+		return nil, fmt.Errorf("decode: %w", err)
+	}
+	return &hp, nil
 }
 
 // ── Test notification ────────────────────────────────────────────────

controller/internal/notify/prefs_source_test.go

@@ -0,0 +1,46 @@
+package notify
+
+import (
+	"encoding/json"
+	"io"
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
+)
+
+// R-1199 reopened: the push names its source on the wire and returns the hub's "kept"; the read sends the box's own
+// customer id with its key and decodes the hub's answer. The hub side: felhom.eu hub household_prefs.go.
+func TestR1199Reopened_TheWire(t *testing.T) {
+	var gotSource, gotQuery, gotAuth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		if r.Method == http.MethodGet {
+			gotQuery = r.URL.RawQuery
+			w.Write([]byte(`{"exists":true,"household_saved":true,"email":"f@example.hu","enabled_events":["node_down"],"cooldown_hours":6}`))
+			return
+		}
+		var body map[string]any
+		json.NewDecoder(r.Body).Decode(&body)
+		gotSource, _ = body["source"].(string)
+		w.Write([]byte(`{"status":"kept","household_saved":true}`))
+	}))
+	defer srv.Close()
+	sett, _ := settings.Load(filepath.Join(t.TempDir(), "settings.json"), log.New(io.Discard, "", 0))
+	n := New(srv.URL, "box-key", "demo-felhom", sett, log.New(io.Discard, "", 0), false)
+
+	status, err := n.SyncPreferencesAs(PrefsSourceDefault, "", []string{"node_down"}, 6, false)
+	if err != nil || status != "kept" || gotSource != "default" {
+		t.Fatalf("push: status=%q err=%v source=%q", status, err, gotSource)
+	}
+	hp, err := n.FetchPreferences()
+	if err != nil || !hp.HouseholdSaved || len(hp.EnabledEvents) != 1 || gotQuery != "customer_id=demo-felhom" || gotAuth != "Bearer box-key" {
+		t.Fatalf("read: %+v err=%v query=%q", hp, err, gotQuery)
+	}
+	if err := n.SyncPreferences("f@example.hu", nil, 6, false); err != nil || gotSource != "household" {
+		t.Fatalf("the page save must be the household's: err=%v source=%q", err, gotSource)
+	}
+}

controller/internal/settings/notif_empty_list_test.go

@@ -0,0 +1,36 @@
+package settings
+
+import (
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// R-1199 reopened (2026-10-22): a household that unticks every mail must see an empty list after a restart — the hub
+// mails by that empty list. Before: omitempty dropped the [] and the getter turned the missing list into the defaults.
+// Both shapes: a fresh save, and the file Tester 1 and demo-hp actually hold (`{"cooldown_hours": 6}` only).
+// RED-PROOF: with the getter's nil → DefaultEnabledEvents restored, both assertions fail — seen failing 2026-10-22.
+func TestR1199Reopened_AnEmptySavedListStaysEmpty(t *testing.T) {
+	p := filepath.Join(t.TempDir(), "s.json")
+	s, _ := Load(p, log.New(io.Discard, "", 0))
+	if err := s.SetNotificationPrefs(&NotificationPrefs{EnabledEvents: []string{}}); err != nil {
+		t.Fatal(err)
+	}
+	s2, _ := Load(p, log.New(io.Discard, "", 0))
+	if got := s2.GetNotificationPrefs().EnabledEvents; len(got) != 0 {
+		t.Fatalf("a saved empty list came back as %v", got)
+	}
+	q := filepath.Join(t.TempDir(), "old.json")
+	os.WriteFile(q, []byte(`{"notifications":{"cooldown_hours":6}}`), 0o600)
+	s3, _ := Load(q, log.New(io.Discard, "", 0))
+	if got := s3.GetNotificationPrefs().EnabledEvents; len(got) != 0 || !s3.NotificationPrefsSaved() {
+		t.Fatalf("the live boxes' file shape reads as %v (saved=%t), want an empty saved list", got, s3.NotificationPrefsSaved())
+	}
+	// A box with nothing saved still shows the defaults.
+	s4, _ := Load(filepath.Join(t.TempDir(), "n.json"), log.New(io.Discard, "", 0))
+	if got := s4.GetNotificationPrefs().EnabledEvents; len(got) != len(DefaultEnabledEvents) {
+		t.Fatalf("an unsaved box must show the defaults, got %d", len(got))
+	}
+}

controller/internal/settings/settings.go

@@ -649,8 +649,11 @@ func (p StoragePath) IsInternal() bool { return p.Kind == StorageKindInternal }
 
 // NotificationPrefs holds customer notification preferences.
 type NotificationPrefs struct {
-	Email         string   `json:"email,omitempty"`
-	EnabledEvents []string `json:"enabled_events,omitempty"`
+	Email string `json:"email,omitempty"`
+	// EnabledEvents: no omitempty since R-1199 reopened (2026-10-22) — a household that unticks every mail saves [],
+	// and omitempty dropped it, so after the next start the page showed every default mail ticked while the hub mailed
+	// by the empty list (measured on Tester 1 and demo-hp: their file held only `cooldown_hours`).
+	EnabledEvents []string `json:"enabled_events"`
 	CooldownHours int      `json:"cooldown_hours,omitempty"` // default: 6
 	// EmailCleared (R-922, operator ruling 2026-10-09 option A) marks a DELIBERATE clear: the household
 	// saved an empty address where one was stored. Every hub push carries it as `email_cleared: true`
@@ -770,6 +773,11 @@ func Load(path string, logger *log.Logger) (*Settings, error) {
 	if err != nil {
 		if os.IsNotExist(err) {
 			logger.Printf("[INFO] [settings] No settings.json found, using defaults")
+			// A fresh box's defaults already carry every type the one-time add-only seeds add, so they are DONE for it.
+			// Unset, they ran at the second start and re-added a type the household had just switched off — the
+			// „a later opt-out sticks" promise of each seed was false on every new box (found 2026-10-22, R-1199
+			// reopened). Persisted with the first save. Pinned by TestR1199Reopened_AnEmptySavedListStaysEmpty.
+			s.OffboxEnlargeNoticeSeeded, s.AppUpdateEventsSeeded, s.UnhealthyStopEventSeeded = true, true, true
 			return s, nil
 		}
 		return nil, fmt.Errorf("reading settings file: %w", err)
@@ -1354,7 +1362,10 @@ func (s *Settings) GetNotificationPrefs() *NotificationPrefs {
 		prefs.CooldownHours = 6
 	}
 	if prefs.EnabledEvents == nil {
-		prefs.EnabledEvents = DefaultEnabledEvents
+		// A SAVED list with no events is a household that unticked every mail (the only writer is the settings page;
+		// before R-1199 reopened omitempty dropped its []). It reads as empty — never as the defaults, which the hub
+		// does not mail by. Pinned by TestR1199Reopened_AnEmptySavedListStaysEmpty.
+		prefs.EnabledEvents = []string{}
 	}
 	// Return a copy of the slice verbatim. The offbox_enlarge_blocked seed is a ONE-TIME persisted
 	// migration (seedOffboxEnlargeNotice at Load), NOT a getter append — so a customer's later opt-out

controller/internal/web/handler_debug.go

@@ -18,6 +18,7 @@ import (
 	"gitea.dooplex.hu/admin/felhom-controller/internal/appexport"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/monitor"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/notify"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/report"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/system"
@@ -612,7 +613,12 @@ func (s *Server) debugPreferencesSync(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	prefs := s.settings.GetNotificationPrefs()
-	if err := s.notifier.SyncPreferences(prefs.Email, prefs.EnabledEvents, prefs.CooldownHours, prefs.EmailCleared); err != nil {
+	// R-1199 reopened: a list never saved on this box is the box's default, never the household's choice.
+	source := notify.PrefsSourceDefault
+	if s.settings.NotificationPrefsSaved() {
+		source = notify.PrefsSourceHousehold
+	}
+	if _, err := s.notifier.SyncPreferencesAs(source, prefs.Email, prefs.EnabledEvents, prefs.CooldownHours, prefs.EmailCleared); err != nil {
 		writeDebugJSON(w, http.StatusOK, false, s.errText(r, err), nil)
 		return
 	}

controller/internal/web/r1192_swap_short_test.go

@@ -1,6 +1,8 @@
 package web
 
 import (
+	"encoding/json"
+	"os"
 	"testing"
 
 	"gitea.dooplex.hu/admin/felhom-controller/internal/agentapi"
@@ -26,3 +28,39 @@ func TestR1192_SwapShortJudgesTheHostSwapAgainstTheGuestRAM(t *testing.T) {
 		}
 	}
 }
+
+// R-1216 / D28 = A: the shared case table (byte-identical in felhom.eu hub/internal/api/testdata/, checked by felhom.eu
+// scripts/host_swap_rule_gate.py), plus the page's own input: a 12 GB guest on an 8 GB-swap host (demo-felhom) is NOT
+// short; the guest's RAM stands in when the agent sends no guest_swap_mb.
+// RED-PROOF: with the morning's rule (`host < the guest's RAM`) the demo-hp, demo-felhom and 32 GB rows fail — seen
+// failing 2026-10-22.
+func TestR1216_HostSwapRuleCases(t *testing.T) {
+	b, err := os.ReadFile("testdata/host_swap_rule_cases.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var f struct {
+		Cases []struct {
+			Name  string `json:"name"`
+			Host  int64  `json:"host_swap_mb"`
+			Guest int64  `json:"guest_swap_mb"`
+			Short bool   `json:"short"`
+		} `json:"cases"`
+	}
+	if err := json.Unmarshal(b, &f); err != nil || len(f.Cases) < 10 {
+		t.Fatalf("case table: %v (%d cases)", err, len(f.Cases))
+	}
+	mb := func(v int64) *int64 { return &v }
+	for _, c := range f.Cases {
+		if got := hostSwapRuleShort(c.Host, c.Guest); got != c.Short {
+			t.Errorf("%s: host %d / guests %d → short=%t, want %t", c.Name, c.Host, c.Guest, got, c.Short)
+		}
+		// Through the page's own input, the agent's answer.
+		if got := swapShort(agentapi.GuestMemoryInfo{AllocatedMB: c.Guest, HostSwapMB: mb(c.Host), GuestSwapMB: mb(c.Guest)}); got != c.Short {
+			t.Errorf("%s (page input): short=%t, want %t", c.Name, got, c.Short)
+		}
+	}
+	if swapShort(agentapi.GuestMemoryInfo{AllocatedMB: 12288, HostSwapMB: mb(8191)}) {
+		t.Error("demo-felhom without guest_swap_mb (the guest's RAM stands in) must not be short")
+	}
+}

controller/internal/web/system_memory_handlers.go

@@ -193,8 +193,9 @@ func procMemTotalMB() int64 {
 	return 0
 }
 
-// hostSwapShort (R-1192 follow-up, night 2026-10-21) asks the agent whether the HOST's swap is below this guest's RAM
-// — the guest swap fix (swap = RAM) puts a memory burst there, and a host with none gets nothing from it. False when
+// hostSwapShort (R-1192 follow-up, night 2026-10-21; the rule R-1216 / D28 = A, 2026-10-22) asks the agent whether the
+// HOST has too little swap behind this guest — the guest swap fix (swap = RAM) puts a memory burst there, and a host
+// with none gets nothing from it. False when
 // it cannot tell (an older agent, an agent that does not answer within 2 s): the install page then shows only the
 // overcommit sentence, as before.
 func (s *Server) hostSwapShort() bool {
@@ -211,7 +212,38 @@ func (s *Server) hostSwapShort() bool {
 	return swapShort(info)
 }
 
-// swapShort: the host's swap is known and below the guest's RAM.
+// swapShort: the host's swap is known and short for this guest's swap allowance (the agent's guest_swap_mb; the guest's
+// RAM when an agent reports none — the fix sets swap = RAM) under the shared rule below.
 func swapShort(info agentapi.GuestMemoryInfo) bool {
-	return info.HostSwapMB != nil && info.AllocatedMB > 0 && *info.HostSwapMB < info.AllocatedMB
+	if info.HostSwapMB == nil {
+		return false // an older agent: not judged
+	}
+	guest := info.AllocatedMB
+	if info.GuestSwapMB != nil {
+		guest = *info.GuestSwapMB
+	}
+	return hostSwapRuleShort(*info.HostSwapMB, guest)
+}
+
+// installerMaxSwapMB is the most host swap Proxmox's installer gives any machine (Install.pm compute_swapsize: the RAM,
+// at least 4096 MB on a disk of 64 GB or more, at most 8192 MB; read from the 9.2-1 ISO, 2026-10-22).
+const installerMaxSwapMB = 8192
+
+// hostSwapRuleShort is the R-1216 rule (D28 = A, operator 2026-10-22), the SAME as the hub's host_swap_short: short when
+// the host has no swap, or less than 90 % of min(the guests' swap allowance, 8192 MB). The morning's first rule (host
+// swap < the guest's RAM) told every household with a guest above 8 GB to call us; the 8 GB soak's burst used 2.7 GB.
+// The CONTRACT is testdata/host_swap_rule_cases.json, byte-identical in felhom.eu's hub (felhom.eu
+// scripts/host_swap_rule_gate.py); TestR1216_HostSwapRuleCases runs it here.
+func hostSwapRuleShort(hostMB, guestMB int64) bool {
+	if hostMB <= 0 {
+		return true
+	}
+	need := guestMB
+	if need > installerMaxSwapMB {
+		need = installerMaxSwapMB
+	}
+	if need <= 0 {
+		return false
+	}
+	return hostMB*10 < need*9
 }

controller/internal/web/testdata/host_swap_rule_cases.json

@@ -0,0 +1,17 @@
+{
+  "rule": "R-1216 / D28 = A (operator 2026-10-22): short when host swap is 0, or below 90 % of min(guests' swap, 8192 MB). 8192 MB is the most Proxmox's installer gives (Install.pm compute_swapsize: RAM, at least 4096 on a disk >= 64 GB, at most 8192). This file is the CONTRACT: the hub (felhom.eu hub/internal/api/testdata/) and the controller (felhom-controller controller/internal/web/testdata/) carry byte-identical copies, checked by felhom.eu scripts/host_swap_rule_gate.py.",
+  "cases": [
+    {"name": "8 GB machine from our installer, 4 GB guest (the soak box)", "host_swap_mb": 7871, "guest_swap_mb": 4096, "short": false},
+    {"name": "32 GB machine, 8 GB swap, 24 GB guest", "host_swap_mb": 8192, "guest_swap_mb": 24576, "short": false},
+    {"name": "demo-hp as measured 2026-10-22", "host_swap_mb": 8191, "guest_swap_mb": 25898, "short": false},
+    {"name": "demo-felhom as measured 2026-10-22", "host_swap_mb": 8191, "guest_swap_mb": 12288, "short": false},
+    {"name": "Tester 1 as measured 2026-10-22", "host_swap_mb": 7871, "guest_swap_mb": 4096, "short": false},
+    {"name": "any host with no swap", "host_swap_mb": 0, "guest_swap_mb": 4096, "short": true},
+    {"name": "a host with no swap and no guest", "host_swap_mb": 0, "guest_swap_mb": 0, "short": true},
+    {"name": "BYO host, 1 GB swap, 4 GB guest", "host_swap_mb": 1024, "guest_swap_mb": 4096, "short": true},
+    {"name": "the no-swap test 2026-10-22 (swap almost all off)", "host_swap_mb": 938, "guest_swap_mb": 4096, "short": true},
+    {"name": "boundary: exactly 90 % of 8192", "host_swap_mb": 7373, "guest_swap_mb": 30000, "short": false},
+    {"name": "boundary: just under 90 % of 8192", "host_swap_mb": 7372, "guest_swap_mb": 30000, "short": true},
+    {"name": "small guest, host swap equal to it", "host_swap_mb": 2048, "guest_swap_mb": 2048, "short": false}
+  ]
+}