docs: operator restart + clear hold [DESIGN] lines (03, 05, 08); R-1346/R-1347/R-1348 filed; release-2026-10-29b evidence (restart presses, clear_hold, health log so far, controller 0.348.0 walk)

documentation/architecture/03-host-agent.md

@@ -199,6 +199,22 @@ by verb**:
   neither lose nor invent one. New goldens run the controller with `--restart always`, which covers
   only a Docker daemon restart.
 
+- **`[DESIGN]` 2026-10-29 — the operator's „Restart controller" (agent `637c92c`, released v0.169.0; `04` §6.1).** The
+  host report's reply carries the AGENT's own closed list — `restart_controller <vmid>` only; the agent acts once per id
+  with the supervisor's act and guards (provisioned, running, not parked, no swap, not locked, no vzdump; an unreadable
+  guest list or vzdump state refuses), the brake counts these restarts with the supervisor's (3 in 15 minutes → refused,
+  then 30 minutes refused, `opBrakeUntil`), and the result rides the next report, requested at once. It works with the
+  controller stopped or stuck. **[FACT] Tester 1, 2026-10-29 13:01–13:02 CET:** four presses through the host page's
+  endpoint — poke to the agent in ~1 s, the controller healthy again after 9 s each, the result on the hub 15–17 s after
+  the press; the second press with the controller stopped by hand (`docker stop`) restarted it 5 s after the stop; the
+  fourth was refused („3 restarts in 15 minutes — presses are refused until 12:32 UTC") (`audits/release-2026-10-29b/`).
+- **`[DESIGN]` 2026-10-29 — a controller that RUNS but does not answer (R-1344): ALARM ONLY.** Each sweep also reads
+  Docker's health status (the controller's own HEALTHCHECK, `curl -f /api/health` every 30 s, timeout 5 s); 6
+  consecutive „unhealthy" sweeps — on top of Docker's 3 failed probes, ~4.5 minutes in all — start an episode:
+  `unresponsive_since` in the stanza, the hub's operator-only `controller_unresponsive`. Not counted during a swap, a
+  parked or locked guest, or a vzdump. **It does not restart for it** until the R-1344 measurement (every probe, both
+  test boxes, through the 2026-10-29/30 night chain) shows a busy night never reads unhealthy that long.
+
 **[RULING 2026-09-16, operator] The brake catches a FAST crash loop and is blind to a SLOW one — a
 second, slower counter is owed (R-539).** MEASURED the same day on the drill box: the controller was
 killed four times, each kill 20 minutes after the last. Every one was restarted (dashboard back in

documentation/architecture/05-hub-architecture.md

@@ -816,3 +816,12 @@ the DB override. Now `main` always mounts `webServer.Handler()` (`TestWebMountAl
 answers **503** on every operator route; `/bind/` stays public, `/login` renders but cannot succeed
 (`TestRequireAuth_NoPasswordRefusesEveryOperatorRoute`). **The live hub was never open:** 2026-10-15, hub 0.150.0, an
 unauthenticated `GET /`, `/configuration`, `/hosts` each answered 302 → `/login`, and the ConfigMap carries a hash.
+
+
+**`[DESIGN]` 2026-10-29 — two buttons on the host page (hub v0.176.0/0.176.1; `04` §6.1, D64 = B).** „Restart controller"
+sits in the guest table, one per guest of a customer host (0.176.0 gated it on a reported controller version, which the
+agent does not report — found live, fixed in 0.176.1); it stores an AGENT row (`operator_actions.host_id`), pokes the box
+and shows the result under Operator Actions. „Clear hold" sits on each Held apps row; its confirm step names the app,
+the reason and since when, and for a restore or put-back hold warns that the app may start on half-restored data; the hub
+refuses an app the box does not report held now. Both are `hosts:write`, CSRF like every form (a token press needs none
+and is recorded as `access token "<name>"`), and neither is reachable without the confirm fold-out in the browser.

documentation/architecture/08-alarm-ladder.md

@@ -307,6 +307,8 @@ bands.
 |---|---|---|---|---|
 | `controller_slow_crashloop` | warning | **operator only** | hub, from the agent's `slow_crashloop_since` moving (agent v0.132.0, hub v0.117.0) | host ids and vmids; the household's side of it is the dashboard coming back each time |
 | `restore_interrupted` | warning | **the household** (and the operator) | controller v0.246.0 at startup, once per interruption | they pressed restore, were told it started, and can run it again — Hungarian `customerMessages` entry |
+| `controller_unresponsive` (2026-10-29, R-1344) | warning | **operator only** | hub, from the agent's `unresponsive_since` moving (agent v0.169.0, hub v0.176.0) | the controller runs but does not answer; the agent only alarms — the operator decides (Restart controller) |
+| `restore_copy_deleted` (2026-10-29, D62) | info | **operator only** | controller v0.347.0, per „Törlés most" | the household did it after the warning; the record (who, app, date, size) is support's |
 
 | Family | Grain | Key carries | Why |
 |---|---|---|---|