hub v0.114.0: self-bind auto-send while a customer waits for a box (R-509); node_* bypass the quiet hour (ruling 2026-09-15); PBS re-issue adopts an endpoint token (R-511); controller supervisor events (R-523); event registers

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/controller_supervisor_event_test.go

@@ -0,0 +1,21 @@
+package api
+
+import (
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
+)
+
+// R-523 — both halves of the register for the two supervisor event types (the R-158 pattern):
+// allowlisted (the project's single register of legitimate types) AND operator-only (a missing
+// customerMessages entry is not a block — the v0.78.0 defect).
+func TestControllerSupervisorEventsAreAllowlistedAndOperatorOnly(t *testing.T) {
+	for _, et := range []string{"controller_restarted_by_agent", "controller_crashloop"} {
+		if !allowedEventTypes[et] {
+			t.Fatalf("%s must be in allowedEventTypes (R-77: an unregistered type is an inert seam)", et)
+		}
+		if !notify.IsOperatorOnly(et) {
+			t.Fatalf("%s must be operator-only — a household would get raw English about host ids", et)
+		}
+	}
+}