hub (unreleased): R-922 option A — a household's clear deletes its notification address (email_cleared); MAIL-HOLD — a restored hub sends no mail until released; two log lines drop the address; runbooks: mail hold is restore step 1; 07 §6.4 R-921 pre-check; R-921/R-922 narrowed

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/cmd/hub/main.go

@@ -21,6 +21,7 @@ import (
 	"gitea.dooplex.hu/admin/felhom-hub/internal/gitea"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/hetznerapi"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/intent"
+	"gitea.dooplex.hu/admin/felhom-hub/internal/mailhold"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/mailrelay"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/monitor"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
@@ -319,6 +320,17 @@ func main() {
 	)
 	apiHandler.SetDispatcher(dispatcher)
 
+	// MAIL-HOLD (internal/mailhold): while <data_dir>/MAIL-HOLD exists the hub sends NO e-mail on any path —
+	// dispatcher, /notify, app-mail relay. A hub started on a restored database mailed households within a minute
+	// (2026-10-09 restore drill); the marker makes a restored copy start quiet. Lifted by the operator with
+	// POST /configuration/mail-hold/release; held mails are dropped, not re-sent.
+	mailHold := mailhold.New(cfg.Server.DataDir, logger)
+	if mailHold.Held() {
+		logger.Printf("[WARN] MAIL-HOLD: marker present at start (%s) — the hub sends no e-mail until the operator releases it on the Configuration page", mailHold.Path)
+	}
+	dispatcher.SetMailHold(mailHold)
+	apiHandler.SetMailHold(mailHold)
+
 	// Customer-claim password arc (v0.50.0, F-4): the code engine — the dispatcher delivers the
 	// Hungarian emails, the store holds bcrypt(code) only. Wired into the API (Day-0 issue at
 	// config retrieve, live-box issue + claimed ingest + ACK on report, reset endpoint) and the
@@ -341,6 +353,8 @@ func main() {
 	webServer := web.New(dataStore, cfg.Auth.PasswordHash, cfg.API.ReportAPIKey, Version, staleThreshold, logger)
 	webServer.SetTemplateFetcher(templateFetcher)
 	webServer.SetAssetManager(assetsMgr)
+	// MAIL-HOLD banner on every operator page + the release button on Configuration.
+	webServer.SetMailHold(mailHold)
 	webServer.SetClaimEngine(claimEngine)   // v0.50.0 — Setup-tab claim chip + resend button
 	webServer.SetSelfBindMailer(dispatcher) // v0.66.0 (R-27) — customer self-bind link button (sibling of claim mailer)
 	webServer.SetEventEmitter(dispatcher.ProcessEvent) // v0.135.0 (R-604) — the "floor raise skipped boxes" mail