R-1007 closed: proven live on demo-hp — a real power cut mid-upload, 41 of 41 broken photos repaired by Immich itself, 120 controls untouched

Docs 02/05/07/13 and capability F12 (PROVEN-LIVE); the audit's C and D sections; R-1020 (the
duration reads 0) and R-1021 (the hub build builds a stale checkout) filed; STATUS one screen.
Register 133 -> 140 (this session: opened 2, closed 1; another session added 6). Both plugs ON.
Report: REPORT-immich-repair-2026-10-14.md.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/architecture/02-controller-module-map.md

@@ -285,6 +285,17 @@ own; every caller that is not the customer must decide for itself whether the ap
 | `collector.go` | **PORT** | Container metrics (`docker stats`) keep; host metrics via `system.GetInfo` (temp, physical disk) become **agent-provided or dropped**. | needs-rework |
 | `sysinfo.go`/`sysinfo_other.go` | **MODIFY** | Reads `/host/etc`, `/proc/cpuinfo`, uptime — host static info; in-guest some is meaningful, hardware identity via agent. | needs-rework |
 
+### `aftercrash/` + `stacks/after_unclean_boot.go` — KEEP (v0.311.0, R-1007, `09` §3 decision 236)
+
+**[FACT, read from source 2026-10-14, felhom-controller `3b85a0c`]** Once per controller start that followed an UNCLEAN
+host boot — `crashboot.Grace.Decided` (the host crash guard's fact via the agent; unknown = a normal boot), after
+`CrashGrace` (15 min) — `aftercrash.Runner` runs each deployed app's `after_unclean_boot` template block: scan the app's
+folder for zero-byte regular files (no symlinks, one filesystem), map names to the app's ids, run the app's own repair
+command for those ids in batches, re-scan, retry once, run the app's lost-file check; record in `app.yaml`
+(`after_unclean_boot:`), push `app_repaired_after_crash` (counts only). The commands run through a QUIET compose exec
+(`quietComposeExec`: nothing logged, stderr dropped, the error is the exit code only) because their output can carry the
+household's file names. The household's lost list is shown on the app page (`lostFilesNote`) until dismissed.
+
 ### `monitor/`
 | File | Class | Reason | Risk |
 |---|---|---|---|