hub v0.150.0: app_repaired_after_crash — allow-listed + operator-only, counts line in the operator mail (R-1007); decision 236 recorded

The operator's half of the repair after an unclean boot (controller 0.311.0): counts only, never a
file name; warning mails, info is recorded. Registered in allowedEventTypes and operatorOnlyEvents in
the same commit, plus the per-app cooldown list; tests pin the pair, a household that enabled the type
gets nothing, and the counts line (red-proofed). Decision 236 (operator, 2026-10-14): the box asks
Immich through Immich's own job queue. R-1007 updated; the scripts' run on 9202 added as evidence.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/architecture/09-update-architecture.md

@@ -915,6 +915,17 @@ its length, and both fixes cost something the household would notice — operato
 127. **The agent's three by-design abilities (`03` §3.1) stay for now**; revisited before the first paying customer.
      *Operator ruling 2026-10-05.* (R-861)
 
+### 2026-10-14 — R-1007: how the box asks Immich to repair after a power cut (recorded before the build)
+
+236. **The box repairs Immich's broken photos through Immich's OWN job queue (option 1, spike A4)** — the controller adds
+     the same job Immich's API adds (`AssetGenerateThumbnails {id}` on `thumbnailGeneration`, Immich's own `bullmq`
+     inside `immich-server`) for the asset ids of the zero-byte thumbnail/preview files only, queues Immich's own
+     missing-files check, and READS its report from the database (a SELECT, never a write). Not chosen: a household-made
+     API key (it covers only the admin's photos — a family member's were refused, measured), a database write, the
+     household pressing „thumbnails: all". The job/queue names are internal to Immich: the catalog pins the Immich
+     versions they were proven on; any other version is skipped and reported, never guessed. Evidence:
+     `audits/immich-repair-2026-10-14/` Part A. *Operator ruling 2026-10-14, in chat.*
+
 ### 2026-10-12 (evening) — the notification page's two questions answered (recorded before the work; the disk + shrink brief)
 
 *Operator answers in chat 2026-10-12 ~16:30, „as picked" (`08` §8.1).*