D62: restore copies kept 30 days, listed with their date, deletable by hand (typed name, never a needed copy, operator event); D63: a test-build-only fault switch for the R-1256 H4/H5 live proofs — tests red first

controller/internal/notify/notifier.go

@@ -1585,6 +1585,25 @@ func (n *Notifier) NotifyAppDefinitionRefused(app, detail string) {
 	n.pushEventBoth("app_definition_refused", "warning", msg, "", AppDefinitionRefusedDetails{App: app, Refused: detail})
 }
 
+// RestoreCopyDeletedDetails is restore_copy_deleted's record: who deleted which app's copy, the restore it protected,
+// and its size.
+type RestoreCopyDeletedDetails struct {
+	App       string `json:"app"`
+	RestoreAt string `json:"restore_at"` // RFC 3339, UTC
+	SizeBytes int64  `json:"size_bytes"`
+	Who       string `json:"who"`
+	Path      string `json:"path"`
+}
+
+// NotifyRestoreCopyDeleted (D62, operator 2026-10-29): the household deleted a restore copy with „Törlés most" before
+// its 30 days. Info, operator-only on the hub (registered in both of its lists, hub D62): an audit line for support,
+// never a household mail. Pinned by TestD62_RestoreCopyDeletedEvent.
+func (n *Notifier) NotifyRestoreCopyDeleted(d RestoreCopyDeletedDetails) {
+	msg := fmt.Sprintf("%s: the restore copy from before the restore of %s (%d bytes) was deleted by hand — %s. That restore can no longer be undone from this box.",
+		d.App, d.RestoreAt, d.SizeBytes, d.Who)
+	n.pushEventBoth("restore_copy_deleted", "info", msg, "", d)
+}
+
 // healthSeverity is the event severity a health status would be sent at (R-647): the disabled path
 // names what it drops, and "warn" is a health STATUS, not a severity the hub knows.
 func healthSeverity(status string) string {