hub: Restart controller (the agent's closed list on the host-report reply) and Clear hold (D64 = B, the controller's list) on the host page, each behind a confirm; controller_unresponsive (R-1344, alarm only); 04 §6.1 + 09 §3 decision 283; wire gate declares both new wires; R-1344 filed — tests red first

documentation/architecture/04-control-plane-authorization.md

@@ -183,6 +183,18 @@ the deletion is the hub's), `run_job` (`fill-watch`, `offsite-integrity`, `offsi
 Anything else is refused at the hub's POST and again on the box. No action deletes data, starts a countdown or
 shortens one (`TestOpActions_ClosedList`, `TestOperatorActions_ClosedList`). Unanswered after 24 h: expired.
 
+**`[DESIGN]` 2026-10-29 — D64 = B, and the agent's own list (operator ruling 12:10; `09` §3 decision 283).** The
+controller's list gains **`clear_hold <app>`** for every hold reason, with no signature: the RUNNING controller clears the
+hold in memory and saves at once (no later settings save can write it back — R-1343). The operator accepted the cost in
+words: a compromised hub could release a data-protecting hold and start an app on half-restored data; the hub's confirm
+step shows the hold's reason and, for a restore or put-back hold, that warning. **R-379 („only a person clears a hold")
+now reads „a person — on the box, or the operator on the hub".** The hub refuses `clear_hold` for an app the box does not
+report held now. **The AGENT has its own closed list on the host report's reply — `restart_controller <vmid>` only**
+(`store.ValidateHostOperatorAction` / agent `localapi.OperatorActionNames`; never a shared verb, `TestHostOperatorActions_ClosedList`):
+the supervisor's restart with its guards, the 3-in-15-minutes brake counting operator restarts too (then 30 minutes
+refused), the result in the next report (requested at once), a vmid that is not a guest of that host refused at the hub.
+Neither verb deletes data, starts a countdown or shortens one. A guest reboot from the hub is NOT on either list.
+
 ### 6.2 Who may press the operator's buttons: session, Basic, or a scoped token [hub v0.152.0, `09` §3 decision 251]
 
 The hub's operator surface has three ways in: a browser session, Basic auth with the operator password (scripts,

documentation/architecture/09-update-architecture.md

@@ -1206,6 +1206,14 @@ Wanderer's Meilisearch went 256 → 384 MB and was measured again (it sizes itse
      `-tags faultinject` test build — never in the release image (`TestD63_TheReleaseBuildHasNoFaultSwitch`). *Operator,
      2026-10-29 08:17.* `07` §6.3.
 
+### 2026-10-29 (12:10, operator) — D64 = B: the hub may clear any hold
+
+283. **D64 = B — the hub's „Clear hold" works for every hold reason, with no operator signature.** The operator accepted
+     that a compromised hub could clear a data-protecting hold (an app could start on half-restored data); the confirm
+     step shows the hold's reason and, for a restore or put-back hold, that warning before the press. R-379 now reads
+     „a person — on the box, or the operator on the hub". Built as the controller's `clear_hold` operator action
+     (`04` §6.1), cleared by the running controller (R-1343). *Operator, 2026-10-29 12:10.*
+
 ### 2026-10-28 (day, attended) — RomM kept; the runtime cache fills itself in CI
 
 277. **D61 = keep RomM offered** (R-1330) while no RomM release carries Node ≥ 24.22.1; the first one that does is taken