controller v0.264.0: the household is told when an update is undone or held, in its language

app_update_undone / app_update_held events (09 decision 15), on by
default and seeded once on existing boxes; R-606 update sentences as
key+args rendered per reader; R-646 startup applied-meta backfill for
apps current with the catalog; R-620 a disabled notifier WARNs once per
event type. Needs hub v0.120.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/handlers.go

@@ -1524,7 +1524,7 @@ func (s *Server) buildAppBackupRows(status *backup.FullBackupStatus, lang string
 		// the customer's data may not be intact. Measured 2026-08-22: after a failed MariaDB replay
 		// the app reported `health=healthy, running=true, restarts=0` while its schema-version table
 		// held zero rows.
-		if held, why := s.backupMgr.RestoreHoldFor(app.StackName); held {
+		if held, why := s.backupMgr.RestoreHoldForLang(app.StackName, lang); held {
 			row.Status = "red"
 			row.StatusText = why
 			row.RestoreHeld = true
@@ -2656,6 +2656,9 @@ func (s *Server) settingsNotificationsHandler(w http.ResponseWriter, r *http.Req
 		// regardless: processOperator consults operatorOn, the address and a cooldown, and never the
 		// customer's preferences. This toggle governs the customer leg only.
 		"app_start_failed",
+		// v0.264.0: the update outcomes (default ON). A type the page cannot render is a type every
+		// Save drops — so they are listed here AND carry a checkbox.
+		"app_update_undone", "app_update_held",
 		"storage_reconnected", "health_recovered",
 	} {
 		if r.FormValue("event_"+evt) == "on" {