hub v0.150.0: app_repaired_after_crash — allow-listed + operator-only, counts line in the operator mail (R-1007); decision 236 recorded

The operator's half of the repair after an unclean boot (controller 0.311.0): counts only, never a
file name; warning mails, info is recorded. Registered in allowedEventTypes and operatorOnlyEvents in
the same commit, plus the per-app cooldown list; tests pin the pair, a household that enabled the type
gets nothing, and the counts line (red-proofed). Decision 236 (operator, 2026-10-14): the box asks
Immich through Immich's own job queue. R-1007 updated; the scripts' run on 9202 added as evidence.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

hub/internal/api/chaosnight_events_test.go

@@ -111,3 +111,15 @@ func TestAppStoppedUnhealthyIsAHouseholdEvent(t *testing.T) {
 		}
 	}
 }
+
+// R-1007 (v0.150.0) — app_repaired_after_crash is allow-listed AND operator-only, pinned together.
+// RED-PROOF: drop it from allowedEventTypes → "the controller's push would 400".
+func TestAppRepairedAfterCrashIsAllowlistedAndOperatorOnly(t *testing.T) {
+	et := "app_repaired_after_crash"
+	if !allowedEventTypes[et] {
+		t.Fatalf("%s must be in allowedEventTypes — the controller's push would 400", et)
+	}
+	if !notify.IsOperatorOnly(et) {
+		t.Fatalf("%s must be operator-only — counts of a household's damaged files are support's", et)
+	}
+}

hub/internal/api/handler.go

@@ -2318,6 +2318,10 @@ var allowedEventTypes = map[string]bool{
 	// with NO copy on its box that brings it back whole — support must act. Operator-only
 	// (notify.operatorOnlyEvents) — registered in BOTH in the same commit.
 	"app_hold_no_whole_copy": true,
+	// R-1007 (hub v0.150.0, controller v0.311.0, `09` §3 decision 236): what an app's after_unclean_boot run found
+	// and repaired after an unclean host boot — COUNTS ONLY. Operator-only (notify.operatorOnlyEvents) — registered in
+	// BOTH in the same commit; the household's side is the app page's lost-files note on its own box.
+	"app_repaired_after_crash": true,
 	// Special
 	"test": true,
 }