From 19afefab55be5856b0bae8d1e5c95d1eb58fae14 Mon Sep 17 00:00:00 2001
From: kisfenyo <nagyfenyvesi.viktor@gmail.com>
Date: Thu, 29 Oct 2026 08:23:29 +0100
Subject: [PATCH] =?UTF-8?q?hub(D62):=20restore=5Fcopy=5Fdeleted=20accepted?=
 =?UTF-8?q?=20and=20operator-only=20=E2=80=94=20the=20household's=20restor?=
 =?UTF-8?q?e-copy=20delete=20is=20recorded=20(test=20red=20first)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 hub/CHANGELOG.md                              |  7 ++++++-
 .../api/d62_restore_copy_event_test.go        | 19 +++++++++++++++++++
 hub/internal/api/handler.go                   |  4 ++++
 hub/internal/notify/dispatcher.go             |  4 ++++
 4 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 hub/internal/api/d62_restore_copy_event_test.go

diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md
index d9c0c704..fd4f8e83 100644
--- a/hub/CHANGELOG.md
+++ b/hub/CHANGELOG.md
@@ -1,4 +1,9 @@
-## Unreleased (2026-10-28 night) — R-1255: two escrow edges (review round 2, HUNT-3 H3/H4) — commit only; rides the next hub release (the morning list)
+## Unreleased (2026-10-28 night + 2026-10-29) — R-1255: two escrow edges (review round 2, HUNT-3 H3/H4); D62: the restore-copy delete event — commit only; rides the next hub release
+
+- **D62 (operator 2026-10-29) — `restore_copy_deleted` is accepted and operator-only.** The controller's „Törlés most"
+  on a restore copy (the household deletes it before its 30 days) sends one event: who, app, the restore's date, size.
+  Registered in `api.allowedEventTypes` AND `notify.operatorOnlyEvents` in the same commit (an unlisted type is a 400
+  and the record is lost). Test `TestD62_RestoreCopyDeletedIsAllowedAndOperatorOnly`, red before both entries.
 
 - **H3 — the carry takes the package that has a hash (`store/escrow_carry.go`).** The R-1176 carry moved the deleted
   host's NEWEST retained row and checked only its identity blob: a newer package without a repository-password hash
diff --git a/hub/internal/api/d62_restore_copy_event_test.go b/hub/internal/api/d62_restore_copy_event_test.go
new file mode 100644
index 00000000..bebc0483
--- /dev/null
+++ b/hub/internal/api/d62_restore_copy_event_test.go
@@ -0,0 +1,19 @@
+package api
+
+import (
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
+)
+
+// D62 (operator 2026-10-29): the household's „Törlés most" on a restore copy sends restore_copy_deleted (who, app,
+// date, size). It is accepted from a box (an unlisted type is a 400 and the record is lost) AND operator-only — both
+// registers, same commit. RED-PROOF: seen failing before either entry existed.
+func TestD62_RestoreCopyDeletedIsAllowedAndOperatorOnly(t *testing.T) {
+	if !allowedEventTypes["restore_copy_deleted"] {
+		t.Errorf("restore_copy_deleted is not in allowedEventTypes — POST /event would 400 and the record would be lost")
+	}
+	if !notify.IsOperatorOnly("restore_copy_deleted") {
+		t.Errorf("restore_copy_deleted is not operator-only")
+	}
+}
diff --git a/hub/internal/api/handler.go b/hub/internal/api/handler.go
index 7e414f38..4bf76297 100644
--- a/hub/internal/api/handler.go
+++ b/hub/internal/api/handler.go
@@ -2432,6 +2432,10 @@ var allowedEventTypes = map[string]bool{
 	"app_unexplained_upload_cleared": true,
 	"app_unexplained_cpu":            true,
 	"app_unexplained_cpu_cleared":    true,
+	// D62 (operator 2026-10-29; controller „Törlés most" on a restore copy): the household deleted a restore copy by hand
+	// — who, app, the restore's date, size. Operator-only (notify.operatorOnlyEvents) — registered in BOTH in the same
+	// commit.
+	"restore_copy_deleted": true,
 	// Special
 	"test": true,
 }
diff --git a/hub/internal/notify/dispatcher.go b/hub/internal/notify/dispatcher.go
index e46da93e..97885f27 100644
--- a/hub/internal/notify/dispatcher.go
+++ b/hub/internal/notify/dispatcher.go
@@ -915,6 +915,10 @@ var operatorOnlyEvents = map[string]bool{
 	"app_unexplained_upload_cleared": true,
 	"app_unexplained_cpu":            true,
 	"app_unexplained_cpu_cleared":    true,
+	// D62 (operator 2026-10-29). The household deleted a restore copy with „Törlés most" on its own box: the audit line
+	// for support (who, app, date, size). The household did it and saw the warning; the record is the operator's.
+	// Registered in the same commit that mints it.
+	"restore_copy_deleted": true,
 	// R-971 (v0.157.0, controller v0.328.0, operator decision D2 = A). The box's catalog allow-list refused an app's
 	// definition: someone pushed a catalog change asking for container rights the box does not give. The household can
 	// do nothing; its app page says the app keeps its last good definition. Registered in the same commit that mints it.