hub v0.134.0: a down box is judged on longer missed-backup lines (R-872); household outage mail at most weekly (R-873); backup_catchup_done allowed (R-871)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/handler.go

@@ -2050,6 +2050,10 @@ var allowedEventTypes = map[string]bool{
 	// of memory. Household + operator; hu AND en `mail.event.*`; per-app cooldown on both legs.
 	"app_stopped_unhealthy": true,
 
+	// R-871 (v0.134.0, controller v0.295.0, `09` decision 109): the box was off at its backup time and made the
+	// missed backups when it came back. Info — recorded on the box's timeline, never mailed.
+	"backup_catchup_done": true,
+
 	// Controller-pushed events
 	"controller_started":      true,
 	"claim_lockout":           true, // v0.50.0 — claim/reset code brute-force lockout tripped

hub/internal/api/r871_catchup_event_test.go

@@ -0,0 +1,12 @@
+package api
+
+import "testing"
+
+// R-871 (v0.134.0): the box's "missed backup made now" line (controller v0.295.0, event backup_catchup_done) must be
+// an allowed type, or POST /event answers 400 and the household's timeline line vanishes (hub-event-allowlist trap).
+// COMPANION RED-PROOF: remove "backup_catchup_done" from allowedEventTypes → this fails.
+func TestR871_CatchUpEventIsAllowed(t *testing.T) {
+	if !allowedEventTypes["backup_catchup_done"] {
+		t.Fatal("backup_catchup_done is not an allowed event type — the box's catch-up line would be dropped with a 400")
+	}
+}