close-out 2026-10-30: R-1344 and R-1346 closed, R-1228 switched (D35) and narrowed; R-1352, R-1353 filed; 01/03/05 [DESIGN], total-loss + publish-train runbooks, poster facts; instruction files: the site publishes to Cloudflare Pages

documentation/architecture/03-host-agent.md

@@ -214,6 +214,20 @@ by verb**:
   `unresponsive_since` in the stanza, the hub's operator-only `controller_unresponsive`. Not counted during a swap, a
   parked or locked guest, or a vzdump. **It does not restart for it** until the R-1344 measurement (every probe, both
   test boxes, through the 2026-10-29/30 night chain) shows a busy night never reads unhealthy that long.
+- **`[DESIGN]` 2026-10-30 — R-1344 decided from the measurement: the alarm becomes a RESTART (agent `bd18347`,
+  released v0.171.0; hub 0.178.0 `controller_unresponsive_restart`).** The measurement (`audits/release-2026-10-30/
+  p1-r1344/`): 4 733 probes on Tester 1 and demo-hp, 2026-10-29 11:12 → 2026-10-30 07:00 UTC, through demo-hp's PBS
+  vzdump, Tester 1's local vzdump, both DB dumps, tier-2, the off-site push, a restore test and two controller updates —
+  no failed probe, no 5-s timeout, slowest 303 ms (demo-hp, during the PBS vzdump). So: the alarm stays at 6 unhealthy
+  sweeps; at **10** (2 minutes later, ~6.5 minutes after the first failed probe) the agent restarts the bootstrap unit
+  — unless the controller's busy file is fresh (a backup, a restore, an update, an export) or unreadable, or the
+  supervisor's brake refuses (3 restarts in 15 minutes → the crash-loop pause). A swap, a parked or locked guest and a
+  vzdump keep resetting the count. The restart counts in both brakes (fast and R-539's slow counter); after it the count
+  starts from zero. The stanza carries `unresponsive_restart_after_s` (the hub's alarm text says when the restart comes,
+  and says „does not restart" for an older agent) and `unresponsive_restart_at` (the hub mails
+  `controller_unresponsive_restart` once — not also `controller_restarted_by_agent`). Proven live on Tester 1
+  2026-10-30: the controller frozen (SIGSTOP) 09:24:50 UTC → Docker „unhealthy" 09:26:36 → the alarm 09:29:21 → the
+  restart 09:31:22 → healthy 09:31:24.
 - **`[DESIGN]` 2026-10-29 — the operator's „Reboot guest" (D65 = A, agent `ca15a31`, released v0.170.0; `04` §6.1,
   `09` §3 decision 284).** The agent's list gains `reboot_guest <vmid>`: the existing guest-reboot path (`pct reboot`
   of THAT guest — never the host), for a stuck Docker or a stuck network inside the box. Guards, each refusing with the