hub v0.147.0 (code): the operator's answers S4, S6, S10, S29, S30, S32, S33

- S4 / R-242: GoldenVouchChecker - a published golden unvouched for 2 h raises golden_not_vouched (operator only)
- S6 / R-244: the delete cascade de-references app_log_issues; one-time sweep flag -sweep-app-log-residue=count|apply
- S10 / R-266: read_failed storage entry shows "read failed", not 0 %
- S29 / R-250: host-key scan IPv4 first, ~2 min ladder, "safe to press Save again" error
- S30 / R-246: stale_at retired (reader, setter, badge)
- S32 / R-521: storage_reconnected ends the storage_disconnected cooldown on both channels
- S33 / R-402: host page "Last full check (off-site)" line; two wire-gate allowlist entries removed
Each with a test seen failing first. Not built or deployed yet (operator-attended deploy).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/wire_contract_gate.py

@@ -208,16 +208,6 @@ ALLOWLIST = {
     (_AH, "storage_targets.smart.model_name"): (
         "redundant for a verdict: the hub decodes smart.health plus every counter it bands on. The "
         "model string is a display label with no threshold attached to it."),
-    (_CH, "offsite.last_integrity_ok"): (
-        "R-359, controller v0.227.0: the off-site integrity VERDICT is published so a hub surface can "
-        "read it, and no hub surface reads it yet. That is deliberate and it is recorded rather than "
-        "quietly skipped. Building the display is a HUB change, and R-331 (2026-08-30) ruled exactly "
-        "that class a decision for the operator, not a thing to fold into a controller task: the "
-        "previous integrity display was REMOVED because it rendered `Integrity Unknown` for every "
-        "customer forever from fields nothing wrote. Publishing the value first, and consuming it when "
-        "someone decides what the screen should say, is the opposite order to the one that produced "
-        "that card. The sibling `offsite.last_integrity_check` is NOT allowlisted and passes on its "
-        "own — the string already occurs hub-side. **When a hub surface is built, delete this entry.**"),
 
     # ---- controller v0.271.0 (`09` §6.4 part 7): the automatic update leg's nightly summary ----
     (_CH, "update_leg"): (
@@ -243,7 +233,7 @@ ALLOWLIST = {
     (_CH, "offsite.last_proof_result"): (
         "R-87, controller v0.231.0: the nightly off-site content-proof VERDICT (pass / fail / "
         "cannot_judge). Published for a hub surface that does not exist yet — same class and same "
-        "ruling as offsite.last_integrity_ok below (R-331, R-402). ABSENT means NOT RECORDED (a "
+        "ruling as the integrity pair had until hub v0.147.0 read it on the host page (R-331, R-402). ABSENT means NOT RECORDED (a "
         "controller older than v0.231.0), never 'failed', so any future reader must degrade to "
         "unknown. **Delete this entry when a hub surface reads it.**"),
     (_CH, "offsite.last_proof_reason"): (
@@ -265,14 +255,6 @@ ALLOWLIST = {
         "reached, never on a skip, a missing snapshot or a restore error, so 'presence is not success' "
         "does not bite here. **Delete with its siblings.**"),
 
-    (_CH, "offsite.last_integrity_depth"): (
-        "R-399, controller v0.228.0: the DEPTH the verdict was reached at, published beside "
-        "last_integrity_ok above and unconsumed for the identical reason. It matters because 'checked, "
-        "OK' means two different things at structure depth and at 100%, so a hub surface that shows the "
-        "verdict without the depth shows the same words for a check that re-read every byte and one "
-        "that only read the index. Absent = the box cannot answer (a controller older than v0.228.0), "
-        "never 'structure'. **Delete this entry with its sibling when a hub surface is built** — filed "
-        "as R-402 in OPEN-ITEMS.md."),
 
     (_AH, "wireguard.last_handshake_age_s"): (
         "redundant: hub-side wgsync reconciles peers from its own state, and the OOB path's own "