controller v0.264.0: the household is told when an update is undone or held, in its language

app_update_undone / app_update_held events (09 decision 15), on by
default and seeded once on existing boxes; R-606 update sentences as
key+args rendered per reader; R-646 startup applied-meta backfill for
apps current with the catalog; R-620 a disabled notifier WARNs once per
event type. Needs hub v0.120.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,32 @@
+## v0.264.0 — the undo reaches the fleet, and the household is TOLD, in its own language (2026-09-23, `09` §6.4 parts 2–3)
+
+**MinAgent: 0.131.0** (unchanged). **Needs hub v0.120.0** (deployed first). New strings: yes (hu + en).
+
+- **Two new events (`09` §3 decision 15).** `app_update_undone` (warning): the update failed and the
+  box put the previous version and its data back — sent once, at the end of a successful undo.
+  `app_update_held` (error): the update, or its undo, failed and the app is held — sent once, also
+  when the hold could not be saved (the operator must hear exactly that). Details:
+  `{app, stack_name, from, to, at, copy_tier, copy_date, copy_holds}`. The held mail's line is the
+  hold sentence in the household's language (`RestoreHoldForLang`). Wired by
+  `Manager.SetUpdateEventSink` in main.go (pinned by `TestUpdateEventSinkIsWiredAtStartup`).
+- **On by default, and on for existing boxes.** Both joined `DefaultEnabledEvents`; a box that already
+  has a list gets them once, add-only (`app_update_events_seeded`). Two new toggles on the
+  notifications page — without them, the next page save would push a list without the new types to
+  the hub and undo the hub's own migration. The parity fixture for that page was regenerated; the
+  measured diff is exactly the two toggles.
+- **R-606 — every update sentence in the reader's language.** `UpdateError` is stored as a key + args
+  (`update.error.*`, `update.refusal.*`); phase labels (`update.phase.*`), the undo line and prefix,
+  the hold sentence (`hold.update.*`) and `UpdateCopyHolds` (`hold.copy_holds.*`) all render per
+  reader on both pages and in `GET /api/stacks/<name>`. The stored Hungarian is byte-identical
+  (parity gate green); a sentence stored by an older version renders as stored.
+- **R-646 — the startup pass.** `BackfillAppliedMeta` records `applied-meta/.felhom.yml` for every
+  deployed, pinned app that is CURRENT with the catalog and has no record; a behind app is skipped
+  and named in the log (its pinned version's file is gone — guessing it is worse). Idempotent; never
+  overwrites.
+- **R-620 — a disabled notifier says what it drops.** One WARN per event type per process
+  (`notifier disabled (no hub configured): DROPPED event <type> …`), then DEBUG.
+- Red-proofs (REPORT): nine, each seen failing.
+
 ## v0.263.2 — the undo keeps the probe of the PINNED version, recorded when it was pinned (2026-09-23, R-637)
 
 **MinAgent: 0.131.0** (unchanged). No new strings.