hub v0.115.0: host_* mails skip the quiet hour (ruling 2, R-529); ruling 1 recorded (CC may sign agent_update until the first paying customer)

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/CHANGELOG.md

@@ -1,3 +1,12 @@
+## v0.115.0 — „the box is down" skips the quiet hour on the HOST plane too (2026-09-16, R-529, operator ruling 2)
+
+- **`host_stale`, `host_down`, `host_recovered` join the `node_*` cooldown bypass** (`nodeLivenessEvents`),
+  with the same 5-minute per-host dedupe. The 2026-09-15 ruling named only the controller-plane types;
+  R-529 was filed the same day for the agent-plane siblings, and the operator ruled them in on
+  2026-09-16. Everything else keeps the 1-hour operator cooldown. Recorded in `08-alarm-ladder.md` §6.2.
+- Red-proof: with the three host types taken back out, `TestOperatorCooldown_NodeLivenessBypassesQuietHour`
+  fails at "host_stale 39 min after the previous one was suppressed (sent=1)".
+
 ## v0.114.0 — the connect e-mail goes by itself, „box is down" skips the quiet hour, a stuck PBS token is adopted (2026-09-15, R-509 / R-511 / R-523 / R-518 / R-514)
 
 - **R-509 (P1, operator decision A 2026-09-15) — the self-bind link goes out whenever a customer is

hub/internal/notify/dispatcher.go

@@ -401,12 +401,18 @@ func cooldownStackSuffix(eventType, detailsJSON string) string {
 // suppressed because F8's `node_stale` had used the hour 39 minutes earlier; the `node_recovered`
 // mail was suppressed the same way. "The box is down" must not wait out a quiet hour. A 5-minute
 // dedupe stays, so a flapping link cannot mail every sweep. The key is unchanged (customer:type), and
-// a customer has one box, so the dedupe is per host. host_* (agent-plane) siblings are NOT in the
-// ruling and keep the hour.
+// a customer has one box, so the dedupe is per host. EXTENDED 2026-09-16 (ruling 2, R-529) to the
+// agent-plane siblings host_stale / host_down / host_recovered — same box, same sentence.
 var nodeLivenessEvents = map[string]bool{
 	"node_stale":     true,
 	"node_down":      true,
 	"node_recovered": true,
+	// OPERATOR RULING 2026-09-16 (ruling 2, hub v0.115.0): the HOST-plane siblings join it. They are
+	// the same sentence about the same box — the agent's dead-man's-switch rather than the
+	// controller's — and R-529 was filed precisely because the 2026-09-15 ruling named only node_*.
+	"host_stale":     true,
+	"host_down":      true,
+	"host_recovered": true,
 }
 
 const (

hub/internal/notify/node_liveness_cooldown_test.go

@@ -24,6 +24,7 @@ func TestOperatorCooldown_NodeLivenessBypassesQuietHour(t *testing.T) {
 
 	// The previous node_stale mail went 39 minutes ago.
 	d.mu.Lock()
+	d.opCooldowns["c1:host_stale"] = time.Now().Add(-39 * time.Minute)
 	d.opCooldowns["c1:node_stale"] = time.Now().Add(-39 * time.Minute)
 	d.opCooldowns["c1:app_start_failed"] = time.Now().Add(-39 * time.Minute)
 	d.mu.Unlock()
@@ -37,9 +38,14 @@ func TestOperatorCooldown_NodeLivenessBypassesQuietHour(t *testing.T) {
 	if count() != 1 {
 		t.Fatalf("node_stale 1 min after a sent one was mailed again (sent=%d) — the 5-minute dedupe is gone", count())
 	}
+	// Ruling 2: the same for a HOST-plane mail, 39 minutes after the last one.
+	d.processOperator("c1", "host_stale", "warning", "host stale", "{}", "hub")
+	if count() != 2 {
+		t.Fatalf("host_stale 39 min after the previous one was suppressed (sent=%d) — ruling 2 (R-529)", count())
+	}
 	// The design is unchanged for every other type: still the hour.
 	d.processOperator("c1", "app_start_failed", "warning", "app down", "{}", "hub")
-	if count() != 1 {
+	if count() != 2 {
 		t.Fatalf("a non-liveness type lost its 1-hour cooldown (sent=%d)", count())
 	}
 	for _, et := range []string{"node_down", "node_recovered"} {
@@ -47,7 +53,14 @@ func TestOperatorCooldown_NodeLivenessBypassesQuietHour(t *testing.T) {
 			t.Fatalf("%s is not in the ruling's bypass", et)
 		}
 	}
-	if operatorCooldownFor("host_stale") != operatorCooldown {
-		t.Fatal("host_stale is not in the 2026-09-15 ruling and must keep the hour")
+	// Ruling 2 (2026-09-16, R-529): the host-plane siblings joined the bypass.
+	for _, et := range []string{"host_stale", "host_down", "host_recovered"} {
+		if operatorCooldownFor(et) != nodeLivenessDedupeWindow {
+			t.Fatalf("%s must bypass the quiet hour too (operator ruling 2026-09-16)", et)
+		}
+	}
+	// A type in neither ruling keeps the hour — the design is narrowed, not removed.
+	if operatorCooldownFor("storage_disconnected") != operatorCooldown {
+		t.Fatal("an unrelated type lost its 1-hour cooldown")
 	}
 }