D65 = A: reboot_guest joins the agent's closed operator-action list — guards (busy controller file, heavy gate, jobs, lock, parked, 1/hour, the brake), result with both times, GET /guest/operator-reboot for the household line; one read-only sudo vector

internal/localapi/controllersupervisor.go

@@ -254,6 +254,10 @@ func (s *Server) ControllerSupervisorTick(ctx context.Context) {
 		if !s.provisionedGuest(g.VMID) {
 			continue
 		}
+		if s.rebooting(g.VMID) { // D65: the operator's reboot owns the guest until it is up again
+			s.resetNotRunning(g.VMID)
+			continue
+		}
 		evaluated++
 		if !s.superviseOneController(ctx, g.VMID, g.Status) {
 			down++