clear_hold (D64 = B) + the box command through the running controller (R-1343), R-1340, R-1341 — tests red first; commit only

- clear_hold: a fifth verb in the closed operator-action list; lifts a hold of any reason in the RUNNING
  controller (memory + settings.json together), forgets the update's held flag, drops a waiting put-back
  from the app-stop marker (copy kept). Refused on a bad name or no hold. No new event type.
- --clear-restore-hold asks the running controller over <data dir>/ctl/hold.sock (unix, 0600, peer uid
  checked, no TCP); edits settings.json only when no controller answers, and says so (in-guest restart).
- R-1340: the operator's HELD STOPPED mail is built from the hold record (restore kind, mixed cause,
  failed put-back step, database replay or not, kept copy) — never the option-C database story by default.
- R-1341: the OOM WARN line once per new kill (container, start time, kill count); event unchanged.

controller/internal/settings/settings.go

@@ -1982,8 +1982,36 @@ type RestoreHold struct {
 	// first stop or a repeat within 24 h (Trip >= 2 → the sentence says support is informed).
 	UnhealthyKind string `json:"unhealthy_kind,omitempty"`
 	Trip          int    `json:"trip,omitempty"`
+
+	// R-1340 (2026-10-29): what put a restore hold in place, so the operator's „HELD STOPPED" mail tells the real
+	// story instead of the option-C database story for every cause. All empty on a hold written before them: the mail
+	// then names only what the record carries (cmd/controller heldStoppedOperatorText).
+	//
+	// RestoreKind is which restore: RestoreKindOffsite or RestoreKindLocal.
+	RestoreKind string `json:"restore_kind,omitempty"`
+	// MixedCause (restore_mixed only) is the branch that held the app: MixedCause*.
+	MixedCause string `json:"mixed_cause,omitempty"`
+	// FailedStep is the put-back step that failed, with its error (MixedCausePutBack).
+	FailedStep string `json:"failed_step,omitempty"`
+	// DBReplay: the restore's own failure was its database replay. False = the app's database was never touched
+	// by the failure, so the mail never says „database".
+	DBReplay bool `json:"db_replay,omitempty"`
 }
 
+// Restore kinds and mixed-hold causes (R-1340). See RestoreHold.RestoreKind / MixedCause.
+const (
+	RestoreKindOffsite = "offsite"
+	RestoreKindLocal   = "local"
+
+	// MixedCauseDefinitionWrite: the backup's definition could not be written (no data moved yet) and writing the
+	// live definition back failed too (R-1256 H4).
+	MixedCauseDefinitionWrite = "definition_write"
+	// MixedCausePutBack: the restore failed and putting the live data back failed at FailedStep (D20/R-1256 H5).
+	MixedCausePutBack = "put_back"
+	// MixedCauseInterruptedPutBack: a restore cut by a stop could not be put back at the next start (R-1251 H2).
+	MixedCauseInterruptedPutBack = "interrupted_put_back"
+)
+
 // Hold reasons. See RestoreHold.Reason.
 const (
 	HoldReasonRestoreFailed = ""              // R-379/R-380: a restore AND its rollback failed