R-1007 closed: proven live on demo-hp — a real power cut mid-upload, 41 of 41 broken photos repaired by Immich itself, 120 controls untouched

Docs 02/05/07/13 and capability F12 (PROVEN-LIVE); the audit's C and D sections; R-1020 (the
duration reads 0) and R-1021 (the hub build builds a stale checkout) filed; STATUS one screen.
Register 133 -> 140 (this session: opened 2, closed 1; another session added 6). Both plugs ON.
Report: REPORT-immich-repair-2026-10-14.md.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/architecture/capability-map-detail/F.md

@@ -198,3 +198,20 @@ v0.310.0 (the card, `POST /api/server/poweroff`).
 **Gap / roadmap:** the website FAQ line (R-1000); the hosts-page badge reads ONLINE for the first 45 min (R-1002).
 
 ---
+
+## F12 — After a power cut, an app rebuilds the files the cut left empty
+
+*Map row: [F12](../00-capability-map.md#f12).*
+
+**Scenario:** the power goes off while photos upload; some thumbnails and previews are left zero bytes, rarely an
+original is lost. After the unclean boot (and the 15-minute crash grace) the box asks Immich to rebuild exactly those
+photos, runs Immich's missing-files check, shows a lost photo's name and date on the app page, and gives the operator the
+counts.
+
+**Components:** controller v0.311.0 (`internal/aftercrash`, `internal/stacks/after_unclean_boot.go`), hub v0.150.0
+(`app_repaired_after_crash`, operator-only), catalog `templates/immich/.felhom.yml` `after_unclean_boot` (proven on
+`immich-server:v3.2.4`). Decision 236.
+
+**Evidence:** `audits/immich-repair-2026-10-14/` — spike A on 9202 (the five candidates), the scripts on real damage
+(9202), the live cut on demo-hp 9201 (D/). **Not exercised live:** a lost original (the cut lost none); pinned by unit
+tests and the 9202 run.