hub v0.123.0: app_stopped_unhealthy (decision 28); 09 decisions 26-28 recorded

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/chaosnight_events_test.go

@@ -92,3 +92,22 @@ func TestAppHoldNoWholeCopyIsAllowlistedAndOperatorOnly(t *testing.T) {
 		t.Fatalf("%s must be operator-only — the household is told by app_update_held; this carries support's detail", et)
 	}
 }
+
+// Decision 28 (hub v0.123.0) — app_stopped_unhealthy is a HOUSEHOLD event: allow-listed, NOT operator-only,
+// and it has a Hungarian AND English mail entry (never the raw-English fallback).
+// RED-PROOF (REPORT.md): drop it from allowedEventTypes → "the controller's push would 400".
+func TestAppStoppedUnhealthyIsAHouseholdEvent(t *testing.T) {
+	et := "app_stopped_unhealthy"
+	if !allowedEventTypes[et] {
+		t.Fatalf("%s must be in allowedEventTypes — the controller's push would 400", et)
+	}
+	if notify.IsOperatorOnly(et) {
+		t.Fatalf("%s must reach the household", et)
+	}
+	for _, lang := range []string{"hu", "en"} {
+		subject, _ := notify.FormatCustomerEmail(lang, "c1", et, "warning", "RAW-ENGLISH-SENTINEL", "", `{"stack_name":"gokapi"}`)
+		if strings.Contains(subject, "RAW-ENGLISH-SENTINEL") || !strings.Contains(subject, "gokapi:") {
+			t.Fatalf("%s/%s subject must be the mail entry naming the app, got %q", et, lang, subject)
+		}
+	}
+}

hub/internal/api/handler.go

@@ -2019,6 +2019,9 @@ var allowedEventTypes = map[string]bool{
 	// operator; both carry a Hungarian AND English `mail.event.*` entry, never the raw-English fallback.
 	"app_update_undone": true,
 	"app_update_held":   true,
+	// v0.123.0 (decision 28, controller v0.269.0): the box stopped an app that kept crashing / ran out
+	// of memory. Household + operator; hu AND en `mail.event.*`; per-app cooldown on both legs.
+	"app_stopped_unhealthy": true,
 
 	// Controller-pushed events
 	"controller_started":      true,