hub: operator actions for a box (D1, R-314/R-279/R-177, decision 185)

Host page "Operator Actions" card: run off-site backup now, run a check now
(fixed job list), stop / extend (1-30 days) a deletion countdown. POST
/hosts/{id}/operator-action validates against the CLOSED list before
storing (unknown -> 400, no row), stores operator_actions(id, customer_id,
action, arg, requested_at, requested_by, done_at, outcome, message), logs
who pressed (channel + address) and bumps the box's intent. The report ACK
lists pending rows as operator_actions until the box's
operator_action_results closes them (matched on id AND reporting
customer); each closed row becomes a hub-minted operator_action event
(stored, never dispatched). Unanswered after 24 h: expired. A customer
RESET cancels pending rows. Wire gate: new root + field-by-field mirror
(controller report.OperatorAction) — needs the controller commit first.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/wire_contract_gate.py

@@ -90,6 +90,10 @@ ROOTS = [
     # contract nothing can check.
     ("hub -> agent   (GET /hosts/<id>/escrow/retained)",
      "hub", "internal/api", "RetainedEscrowResponse", "agent"),
+    # Decision 185 (2026-10-08, R-314/R-279/R-177): the operator's actions, one entry of the report
+    # ACK's operator_actions list. Named type for the same reason as R-311's root above.
+    ("hub -> controller  (report ACK, `operator_actions` entry)",
+     "hub", "internal/store", "OperatorActionDirective", "controller"),
 ]
 
 # R-315: a root whose receiver decodes it into ONE NAMED MIRROR TYPE gets the stronger check —
@@ -103,6 +107,7 @@ ROOTS = [
 MIRRORS = {
     "hub -> agent   (GET /hosts/<id>/escrow/retained)": ("internal/hub", "RetainedEscrowResponse"),
     "hub -> controller  (report ACK, `escrow` object)": ("internal/report", "EscrowStatus"),
+    "hub -> controller  (report ACK, `operator_actions` entry)": ("internal/report", "OperatorAction"),
 }
 
 # R-444 (2026-10-06): a SUBTREE of a name-checked root whose receiver decodes it into one named mirror type gets the