R-1286: a held app says why it is held — each hold reason gets its own sentence in the start gate, the boot sweep and --restore-holds (an unhealthy stop read as a failed restore). Red-proved. Commit only.

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 **MinAgent: 0.158.1** (unchanged). The hold acts only on a box whose agent reports `waiting_for_quiet` (≥ 0.165.0).
 
+### A held app says WHY it is held (R-1286, found reading demo-hp's Kimai)
+
+- `cmd/controller/main.go` `holdWhy`: the start gate (and through it the boot sweep's line and `--restore-holds`) now
+  names each hold reason — a crash-loop / OOM stop („stopped by the box for a crash loop … the household's Start gives
+  it one more try"), a failed update, a failed off-site replay, a pending put-back, a failed restore. demo-hp's Kimai
+  was stopped by the crash-loop guard on 2026-10-14 09:06Z (the night power drill) and every surface called it „held
+  after a failed restore whose rollback also failed" for 11 days. `--restore-holds` prints the reason too.
+  `TestR1286_EveryHoldReasonSaysWhatItIs` (red-proof: felhom.eu `documentation/audits/night-2026-10-25/redproof-r1286.txt`).
+
 ### A restore of a set-aside copy retires the replaced install's unit at once, quietly (R-1288, P4)
 
 - `internal/backup/unit_owner.go` `RestoreSetAsideUnit` → `retireReplacedUnit`: after the household restored an earlier