hub v0.78.0 — R-97a: whole-guest backup events, operator-only

internal/quiesce had no route to the hub at all: three failed whole-guest backups
on 2026-07-27 produced zero events. Hub half of the fix.

whole_guest_backup_failed / _recovered are allowlisted with NO customerMessages
entry. Deliberately not backup_failed/backup_completed — those have customer
Hungarian templates AND sit in demo-felhom's live enabled_events, so reusing them
would email the customer that their backup failed while it is still retrying
behind the R-88 breaker.

The recovery joins recoveredPairedDownTypes because it is severity info and
severityNotifies drops info — otherwise the operator hears it break and never
hears it heal. Its customer leg is pairing-gated and can never fire.

Operator cooldown gains a per-tier dimension from the event details, so one tier
cannot mask another for an hour. Narrow: empty suffix unless a tier is sent, so
no existing event type changes.

hub/internal/api/handler.go

@@ -1555,6 +1555,19 @@ var allowedEventTypes = map[string]bool{
 	"restore_test_failed": true,
 	"restore_test_stale":  true,
 
+	// R-97a: the WHOLE-GUEST (vzdump) backup tier's outcome. Controller-pushed from
+	// `internal/quiesce`, which until now had no route to the hub at all — on 2026-07-27 three failed
+	// whole-guest backups and twelve app-stack stop/starts produced ZERO events.
+	//
+	// DELIBERATELY NOT `backup_failed`/`backup_completed`. Those two carry customerMessages entries
+	// AND sit in demo-felhom's live enabled_events, so reusing them would email the CUSTOMER, in
+	// Hungarian, that their backup failed — while it is still retrying behind the R-88 breaker. A
+	// customer can take no action on a failed whole-guest backup. These follow the R-85 pattern
+	// instead: allowlisted, with NO customerMessages entry, so the dispatcher structurally cannot
+	// route them to a customer. Do NOT add customerMessages entries without a copy review.
+	"whole_guest_backup_failed":    true,
+	"whole_guest_backup_recovered": true,
+
 	// Controller-pushed events
 	"controller_started":      true,
 	"claim_lockout":           true, // v0.50.0 — claim/reset code brute-force lockout tripped

hub/internal/api/whole_guest_event_test.go

@@ -0,0 +1,18 @@
+package api
+
+import "testing"
+
+// R-97a — the allowlist entry is the delivery chain's first link.
+//
+// The recorded gotcha: an event type missing from allowedEventTypes makes POST /event return 400 and
+// the event vanishes. `internal/quiesce` had no route to the hub at all, so three failed whole-guest
+// backups on 2026-07-27 produced zero events. This pins the entry so a cleanup cannot quietly
+// re-break the chain.
+func TestWholeGuestBackupEventTypesAreAllowlisted(t *testing.T) {
+	for _, et := range []string{"whole_guest_backup_failed", "whole_guest_backup_recovered"} {
+		if !allowedEventTypes[et] {
+			t.Fatalf("%s must be in allowedEventTypes, or POST /event 400s and the whole-guest "+
+				"backup tier goes silent again", et)
+		}
+	}
+}