hub(D62): restore_copy_deleted accepted and operator-only — the household's restore-copy delete is recorded (test red first)

hub/CHANGELOG.md

@@ -1,4 +1,9 @@
-## Unreleased (2026-10-28 night) — R-1255: two escrow edges (review round 2, HUNT-3 H3/H4) — commit only; rides the next hub release (the morning list)
+## Unreleased (2026-10-28 night + 2026-10-29) — R-1255: two escrow edges (review round 2, HUNT-3 H3/H4); D62: the restore-copy delete event — commit only; rides the next hub release
+
+- **D62 (operator 2026-10-29) — `restore_copy_deleted` is accepted and operator-only.** The controller's „Törlés most"
+  on a restore copy (the household deletes it before its 30 days) sends one event: who, app, the restore's date, size.
+  Registered in `api.allowedEventTypes` AND `notify.operatorOnlyEvents` in the same commit (an unlisted type is a 400
+  and the record is lost). Test `TestD62_RestoreCopyDeletedIsAllowedAndOperatorOnly`, red before both entries.
 
 - **H3 — the carry takes the package that has a hash (`store/escrow_carry.go`).** The R-1176 carry moved the deleted
   host's NEWEST retained row and checked only its identity blob: a newer package without a repository-password hash

hub/internal/api/d62_restore_copy_event_test.go

@@ -0,0 +1,19 @@
+package api
+
+import (
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
+)
+
+// D62 (operator 2026-10-29): the household's „Törlés most" on a restore copy sends restore_copy_deleted (who, app,
+// date, size). It is accepted from a box (an unlisted type is a 400 and the record is lost) AND operator-only — both
+// registers, same commit. RED-PROOF: seen failing before either entry existed.
+func TestD62_RestoreCopyDeletedIsAllowedAndOperatorOnly(t *testing.T) {
+	if !allowedEventTypes["restore_copy_deleted"] {
+		t.Errorf("restore_copy_deleted is not in allowedEventTypes — POST /event would 400 and the record would be lost")
+	}
+	if !notify.IsOperatorOnly("restore_copy_deleted") {
+		t.Errorf("restore_copy_deleted is not operator-only")
+	}
+}

hub/internal/api/handler.go

@@ -2432,6 +2432,10 @@ var allowedEventTypes = map[string]bool{
 	"app_unexplained_upload_cleared": true,
 	"app_unexplained_cpu":            true,
 	"app_unexplained_cpu_cleared":    true,
+	// D62 (operator 2026-10-29; controller „Törlés most" on a restore copy): the household deleted a restore copy by hand
+	// — who, app, the restore's date, size. Operator-only (notify.operatorOnlyEvents) — registered in BOTH in the same
+	// commit.
+	"restore_copy_deleted": true,
 	// Special
 	"test": true,
 }

hub/internal/notify/dispatcher.go

@@ -915,6 +915,10 @@ var operatorOnlyEvents = map[string]bool{
 	"app_unexplained_upload_cleared": true,
 	"app_unexplained_cpu":            true,
 	"app_unexplained_cpu_cleared":    true,
+	// D62 (operator 2026-10-29). The household deleted a restore copy with „Törlés most" on its own box: the audit line
+	// for support (who, app, date, size). The household did it and saw the warning; the record is the operator's.
+	// Registered in the same commit that mints it.
+	"restore_copy_deleted": true,
 	// R-971 (v0.157.0, controller v0.328.0, operator decision D2 = A). The box's catalog allow-list refused an app's
 	// definition: someone pushed a catalog change asking for container rights the box does not give. The household can
 	// do nothing; its app page says the app keeps its last good definition. Registered in the same commit that mints it.