hub v0.150.0: app_repaired_after_crash — allow-listed + operator-only, counts line in the operator mail (R-1007); decision 236 recorded

The operator's half of the repair after an unclean boot (controller 0.311.0): counts only, never a
file name; warning mails, info is recorded. Registered in allowedEventTypes and operatorOnlyEvents in
the same commit, plus the per-app cooldown list; tests pin the pair, a household that enabled the type
gets nothing, and the counts line (red-proofed). Decision 236 (operator, 2026-10-14): the box asks
Immich through Immich's own job queue. R-1007 updated; the scripts' run on 9202 added as evidence.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

documentation/audits/immich-repair-2026-10-14/C/scripts-on-9202.txt

@@ -0,0 +1,14 @@
+syntax rc=1
+uploaded admin 20 member 10
+damage: 4 empty files, 1 original deleted
+== repair.js with 4 ids
+FELHOM_REPAIR_OK queued=4 waited_ms=2005
+rc=0 in 2.38 s; empty now: 0
+controls rewritten: 0 of 53
+== lost.js
+LOST {"name":"gen-007.jpg","taken":"2026-01-03 01:00"}
+FELHOM_LOST_OK lost=1 waited_ms=2040
+rc=0 in 2.4 s
+== a second run of lost.js (a stale or repeated report?)
+FELHOM_LOST_OK lost=1 waited_ms=2040
+