Security night 2026-11-02: the triage, six proven 9202 walks + the negative control, three bench runs, the watch's logs on both runners (evidence only); 05/07 design lines for R-1352, R-1347, R-1348. Docs only.

documentation/architecture/05-hub-architecture.md

@@ -849,4 +849,6 @@ cost is 3 minutes of disk load. The vouch save answers in the request: its datab
 background save is needed. **R-1344 restart:** the hub mails `controller_unresponsive_restart` (warning, operator-only)
 when the stanza's `unresponsive_restart_at` moves, and not also `controller_restarted_by_agent` for that act; the
 `controller_unresponsive` text says when the agent restarts (`unresponsive_restart_after_s`), or that an older agent
-does not.
+does not. **R-1352 (2026-11-02, hub commit only):** the alarm of an episode whose restart arrives in the same report is not
+emitted: the restart's mail says all of it. An episode that began after that restart still alarms; a time that cannot be read
+counts as a new episode (`episodeRestarted`, `TestR1352_*`).

documentation/architecture/07-backup-architecture.md

@@ -813,6 +813,12 @@ returns), or a copy gone while its drive is bound, leaves the app **held** with
 the copy kept, and the marker lets go of the app — never stopped-and-unheld (H2). Stop pressed during the restore still
 gets the put-back; only the start is skipped (H7). A removal clears a waiting put-back; a later restore that completes
 drops it (the household chose that data). The copy's folders are synced to disk BEFORE the marker names the copy.
+**`[DESIGN]` 2026-11-02 — a failed put-back at start-up reaches the operator; a restore that lifts an update hold forgets the
+in-memory flag (R-1348, R-1347; controller `c4b6844`, commit only).** The hold from `Recover` is written before any notifier exists, so
+the guard keeps the name and `SetHeldNotify` (main.go, where the notifier is wired) sends the R-1340 sentence once; a later failure, a
+drive that returned, mails at once. `clearUpdateHoldAfterRestore` also calls `ForgetUpdateHeld` through `SetUpdateHeldForgetter`: the
+hold store and the flag go together, as in the operator's clear (R-1343), so the crash-loop watcher and the night leg take the
+restored app again. Live proof: `audits/security-2026-11-02/part3/`.
 **`[FACT]` 2026-10-24 night, Tester 1 (VM 341; MeTube on the data drive, 1.5 GB in its volume;
 `audits/restore-holes-2026-10-24/P1-tester1/`):** a local restore cut by powering the VM off 2.1 s after „the restore
 copy is recorded", the data disk taken off, the box booted: held as waiting, Start and Update refused (409, the