The household is told: controller v0.264.0 + hub v0.120.0 proven live, floor 0.264.0

09 §6.4 parts 2-3 SHIPPED. R-606, R-620, R-646 closed; R-647 (three
leftovers) and R-648 (whole-box backup press in the harness) opened.
Open rows 335 -> 334. Evidence: audits/undo-fleet-2026-09-23/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -14,6 +14,28 @@
 > language, one screen, no identifiers in the prose. Same subjects, different readers; merging them
 > would make one of the two audiences stop reading. `STATUS.md` is also a **view of `OPEN-ITEMS.md`**
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
+## 2026-09-23 (evening) — the household is told: controller v0.264.0 + hub v0.120.0 (`09` §6.4 parts 2–3); floor 0.264.0
+
+**Events.** `app_update_undone` (warning) and `app_update_held` (error), one per app per outcome, sent by the
+controller through `Manager.SetUpdateEventSink` (wired in main.go). Details `{app, stack_name, from, to, at,
+copy_tier, copy_date, copy_holds}`. The held mail's message line is the hold sentence rendered in the
+household's language (`pushEventBoth`); the operator gets the Hungarian wire text.
+**Hub.** Allow-listed, NOT operator-only, in `defaultSeedEvents`; `mail.event.*` hu+en name the app via the
+new register `appNamedMailEvents` (reads `details.stack_name`). **Existing households:** a one-time add-only
+migration `Store.SeedEventTypesOnce` guarded by `hub_settings.seed_app_update_events_v1` — it changed all
+three rows (`demo-felhom`, `demo-hp`, `_resend-rotation-test`; before/after in
+`audits/undo-fleet-2026-09-23/10-*`, `11-*`). **Cooldown:** per app on both legs — operator via R-389's
+`perAppCooldownEvents` (widened on purpose), household via a NEW sibling `perAppCustomerCooldownEvents`
+(the customer key was `customer:type`). `app_start_failed`'s household grain is unchanged (pinned).
+**Why the box also seeds:** the controller pushes its own `EnabledEvents` to the hub on every notifications
+page save, so a hub-only migration would be undone by the next save; the box seeds once
+(`app_update_events_seeded`) and the page has the two toggles.
+**R-606:** update sentences are keys + args, rendered per reader; leftovers R-647. **R-620:** a disabled
+notifier WARNs once per type. **R-646:** startup `BackfillAppliedMeta` for apps current with the catalog.
+**Voice:** the undone line ends „nincs teendőd" (the product's „te"), not the brief's „teendője nincs".
+**Harness lesson (R-648):** the drill's „Mentés most" is whole-box and restarts standing apps.
+Evidence: `audits/undo-fleet-2026-09-23/README.md`.
+
 ## 2026-09-23 (afternoon) — the undo is built: controller v0.263.2 (decisions 15, 19, 20)
 
 **Operator rulings 19 and 20** recorded in `09` §3: the copy method is chosen by a bake-off; on update