hub: Restart controller (the agent's closed list on the host-report reply) and Clear hold (D64 = B, the controller's list) on the host page, each behind a confirm; controller_unresponsive (R-1344, alarm only); 04 §6.1 + 09 §3 decision 283; wire gate declares both new wires; R-1344 filed — tests red first

scripts/wire_contract_gate.py

@@ -106,6 +106,9 @@ ROOTS = [
     # ACK's operator_actions list. Named type for the same reason as R-311's root above.
     ("hub -> controller  (report ACK, `operator_actions` entry)",
      "hub", "internal/store", "OperatorActionDirective", "controller"),
+    # 2026-10-29 (operator brief, Part 1): the AGENT's operator actions — the same entry type on the host-report reply.
+    ("hub -> agent   (host-report reply, `operator_actions` entry)",
+     "hub", "internal/store", "OperatorActionDirective", "agent"),
     # R-922 (2026-10-09): the notification-prefs push. Declared when the household's deliberate clear
     # (`email_cleared`) joined it — a flag the hub cannot decode would leave the cleared address stored.
     ("controller -> hub   (POST /preferences)",
@@ -124,6 +127,7 @@ MIRRORS = {
     "hub -> agent   (GET /hosts/<id>/escrow/retained)": ("internal/hub", "RetainedEscrowResponse"),
     "hub -> controller  (report ACK, `escrow` object)": ("internal/report", "EscrowStatus"),
     "hub -> controller  (report ACK, `operator_actions` entry)": ("internal/report", "OperatorAction"),
+    "hub -> agent   (host-report reply, `operator_actions` entry)": ("internal/hub", "OperatorAction"),
 }
 
 # R-444 (2026-10-06): a SUBTREE of a name-checked root whose receiver decodes it into one named mirror type gets the
@@ -136,6 +140,8 @@ MIRRORS = {
 SUBTREE_MIRRORS = {
     ("agent -> hub   (POST /host-report)", "guest_disk_trim"): ("internal/sysfacts", "DiskTrim"),
     ("agent -> hub   (POST /host-report)", "line_test"): ("internal/sysfacts", "LineTest"),
+    # 2026-10-29: the agent's answers to the operator's actions (hub api.hostOperatorActionResult).
+    ("agent -> hub   (POST /host-report)", "operator_action_results"): ("internal/api", "hostOperatorActionResult"),
 }
 
 # Tag names whose literal string carries no information in a repo-wide search. NOT CHECKED.