hub v0.121.0: app_oom_storm allow-listed, operator-only, per-app cooldown (R-636)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/chaosnight_events_test.go

@@ -67,3 +67,16 @@ func TestAppUpdateOutcomesReachTheHousehold(t *testing.T) {
 		}
 	}
 }
+
+// R-636 (v0.121.0) — app_oom_storm is allow-listed AND operator-only, pinned together (allow-listed
+// but not operator-only is the v0.78.0 defect: raw English to a household).
+// RED-PROOF (REPORT.md): drop it from operatorOnlyEvents → "must be operator-only".
+func TestAppOOMStormIsAllowlistedAndOperatorOnly(t *testing.T) {
+	et := "app_oom_storm"
+	if !allowedEventTypes[et] {
+		t.Fatalf("%s must be in allowedEventTypes — the controller's push would 400", et)
+	}
+	if !notify.IsOperatorOnly(et) {
+		t.Fatalf("%s must be operator-only — container names and memory figures are not a household's business", et)
+	}
+}

hub/internal/api/handler.go

@@ -2140,6 +2140,9 @@ var allowedEventTypes = map[string]bool{
 	"pbsdr_adopted":       true,
 	"backup_tier_skipped": true,
 	"app_oom":             true,
+	// R-636 (hub v0.121.0, controller v0.265.0): the same container run OOM-killed 20+ times in 30 min.
+	// Operator-only (notify.operatorOnlyEvents) — registered in BOTH in the same commit.
+	"app_oom_storm": true,
 	// Special
 	"test": true,
 }