hub v0.120.0: app_update_undone/held reach the household, per app, in its language

Allowlisted, not operator-only, seeded for new households and added
once (add-only) to every existing enabled_events row. mail.event entries
in hu and en name the app from details.stack_name. Per-app cooldown on
both the operator and the household leg.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/chaosnight_events_test.go

@@ -47,3 +47,23 @@ func TestRestoreInterruptedReachesTheHouseholdInHungarian(t *testing.T) {
 		t.Fatalf("negative control matched — the fragment search is broken")
 	}
 }
+
+// v0.120.0 — the two update outcomes reach the household, in its language, never as raw English.
+// RED-PROOF (REPORT.md): drop app_update_undone from allowedEventTypes → "must be in allowedEventTypes".
+func TestAppUpdateOutcomesReachTheHousehold(t *testing.T) {
+	for _, et := range []string{"app_update_undone", "app_update_held"} {
+		if !allowedEventTypes[et] {
+			t.Fatalf("%s must be in allowedEventTypes — the controller's push would 400", et)
+		}
+		if notify.IsOperatorOnly(et) {
+			t.Fatalf("%s must reach the household", et)
+		}
+		const raw = "RAW-ENGLISH-SENTINEL"
+		for _, lang := range []string{"hu", "en"} {
+			subject, _ := notify.FormatCustomerEmail(lang, "c1", et, "warning", raw, "", `{"stack_name":"docmost"}`)
+			if strings.Contains(subject, raw) || !strings.Contains(subject, "docmost:") {
+				t.Fatalf("%s/%s subject must be the entry naming the app, got %q", et, lang, subject)
+			}
+		}
+	}
+}

hub/internal/api/handler.go

@@ -2013,6 +2013,13 @@ var allowedEventTypes = map[string]bool{
 	// `backup_run_digest_event_test.go` pins the pair.
 	"backup_run_failures": true,
 
+	// v0.120.0 (`09` §3 decision 15): an app update the box UNDID by itself (warning) and one that ended
+	// HELD — the undo failed too, or the update held for any reason (error). BOTH reach the household
+	// (one mail per app per outcome — per-app cooldown, notify.perAppCustomerCooldownEvents) and the
+	// operator; both carry a Hungarian AND English `mail.event.*` entry, never the raw-English fallback.
+	"app_update_undone": true,
+	"app_update_held":   true,
+
 	// Controller-pushed events
 	"controller_started":      true,
 	"claim_lockout":           true, // v0.50.0 — claim/reset code brute-force lockout tripped