hub 0.164.0 (unreleased): host_swap_short / host_swap_ok operator alarm from the agent's host and guest swap numbers (R-1192 follow-up); wire gate allowlists guests.spec.swap_bytes

hub/internal/notify/dispatcher.go

@@ -854,6 +854,10 @@ var operatorOnlyEvents = map[string]bool{
 	// Registered in the same commit that mints the types.
 	"escrow_carried":       true,
 	"escrow_carry_refused": true,
+	// R-1192 follow-up (night 2026-10-21): the host's swap is below its guests' swap allowance — and covered again.
+	// The household cannot add swap to its host; the operator can.
+	"host_swap_short": true,
+	"host_swap_ok":    true,
 	// R-1203 (2026-10-21): a household asked for a new box link while its old host is still linked — the operator
 	// gets the host name to delete. Registered in the same commit that mints the type.
 	"bind_old_host_linked": true,

hub/internal/notify/host_swap_operator_only_test.go

@@ -0,0 +1,13 @@
+package notify
+
+import "testing"
+
+// R-1192 follow-up (night 2026-10-21): the household cannot add swap to its host — the host-swap alarm and its
+// recovery are the operator's only.
+func TestR1192_HostSwapEventsAreOperatorOnly(t *testing.T) {
+	for _, e := range []string{"host_swap_short", "host_swap_ok"} {
+		if !operatorOnlyEvents[e] {
+			t.Fatalf("%s must be operator-only", e)
+		}
+	}
+}