hub: controller_unresponsive_restart (R-1344 restart, agent >= 0.171.0) — one mail per restart, not also controller_restarted_by_agent; the unresponsive alarm text says what the agent will do

hub/internal/api/controller_supervisor_event_test.go

@@ -10,7 +10,7 @@ import (
 // allowlisted (the project's single register of legitimate types) AND operator-only (a missing
 // customerMessages entry is not a block — the v0.78.0 defect).
 func TestControllerSupervisorEventsAreAllowlistedAndOperatorOnly(t *testing.T) {
-	for _, et := range []string{"controller_restarted_by_agent", "controller_crashloop"} {
+	for _, et := range []string{"controller_restarted_by_agent", "controller_crashloop", "controller_unresponsive", "controller_unresponsive_restart"} {
 		if !allowedEventTypes[et] {
 			t.Fatalf("%s must be in allowedEventTypes (R-77: an unregistered type is an inert seam)", et)
 		}

hub/internal/api/handler.go

@@ -2419,7 +2419,9 @@ var allowedEventTypes = map[string]bool{
 	// R-539 (hub v0.117.0, agent v0.132.0) — hub-generated from slow_crashloop_since; operator-only.
 	"controller_slow_crashloop": true,
 	// R-1344 (2026-10-29): hub-generated from the stanza's unresponsive_since; operator-only (notify.operatorOnlyEvents).
-	"controller_unresponsive": true,
+	// 2026-10-30: controller_unresponsive_restart from unresponsive_restart_at (agent ≥ 0.171.0); operator-only.
+	"controller_unresponsive":         true,
+	"controller_unresponsive_restart": true,
 	// R-550 (hub v0.117.0, controller v0.246.0) — pushed by the controller at startup when it finds a
 	// restore that was in flight when the box stopped. For the household: they can run it again.
 	"restore_interrupted": true,