hub 0.166.0 source: the clock-ahead tunnel alarm wg_tunnel_stale/ok (R-1204, operator-only, edge-triggered); D21 + D4 proof evidence

hub/internal/notify/dispatcher.go

@@ -858,6 +858,10 @@ var operatorOnlyEvents = map[string]bool{
 	// The household cannot add swap to its host; the operator can.
 	"host_swap_short": true,
 	"host_swap_ok":    true,
+	// R-1204: the box's WireGuard tunnel to ep0 has not shaken hands (clock ran ahead, or ep0 dropped the peer) —
+	// the household cannot fix it.
+	"wg_tunnel_stale": true,
+	"wg_tunnel_ok":    true,
 	// R-1203 (2026-10-21): a household asked for a new box link while its old host is still linked — the operator
 	// gets the host name to delete. Registered in the same commit that mints the type.
 	"bind_old_host_linked": true,

hub/internal/notify/wg_tunnel_operator_only_test.go

@@ -0,0 +1,12 @@
+package notify
+
+import "testing"
+
+// R-1204: the household cannot repair its box's tunnel to ep0 — the alarm and its recovery are the operator's only.
+func TestR1204_TunnelEventsAreOperatorOnly(t *testing.T) {
+	for _, e := range []string{"wg_tunnel_stale", "wg_tunnel_ok"} {
+		if !operatorOnlyEvents[e] {
+			t.Fatalf("%s must be operator-only", e)
+		}
+	}
+}