docs: operator restart + clear hold [DESIGN] lines (03, 05, 08); R-1346/R-1347/R-1348 filed; release-2026-10-29b evidence (restart presses, clear_hold, health log so far, controller 0.348.0 walk)

documentation/architecture/03-host-agent.md

@@ -199,6 +199,22 @@ by verb**:
   neither lose nor invent one. New goldens run the controller with `--restart always`, which covers
   only a Docker daemon restart.
 
+- **`[DESIGN]` 2026-10-29 — the operator's „Restart controller" (agent `637c92c`, released v0.169.0; `04` §6.1).** The
+  host report's reply carries the AGENT's own closed list — `restart_controller <vmid>` only; the agent acts once per id
+  with the supervisor's act and guards (provisioned, running, not parked, no swap, not locked, no vzdump; an unreadable
+  guest list or vzdump state refuses), the brake counts these restarts with the supervisor's (3 in 15 minutes → refused,
+  then 30 minutes refused, `opBrakeUntil`), and the result rides the next report, requested at once. It works with the
+  controller stopped or stuck. **[FACT] Tester 1, 2026-10-29 13:01–13:02 CET:** four presses through the host page's
+  endpoint — poke to the agent in ~1 s, the controller healthy again after 9 s each, the result on the hub 15–17 s after
+  the press; the second press with the controller stopped by hand (`docker stop`) restarted it 5 s after the stop; the
+  fourth was refused („3 restarts in 15 minutes — presses are refused until 12:32 UTC") (`audits/release-2026-10-29b/`).
+- **`[DESIGN]` 2026-10-29 — a controller that RUNS but does not answer (R-1344): ALARM ONLY.** Each sweep also reads
+  Docker's health status (the controller's own HEALTHCHECK, `curl -f /api/health` every 30 s, timeout 5 s); 6
+  consecutive „unhealthy" sweeps — on top of Docker's 3 failed probes, ~4.5 minutes in all — start an episode:
+  `unresponsive_since` in the stanza, the hub's operator-only `controller_unresponsive`. Not counted during a swap, a
+  parked or locked guest, or a vzdump. **It does not restart for it** until the R-1344 measurement (every probe, both
+  test boxes, through the 2026-10-29/30 night chain) shows a busy night never reads unhealthy that long.
+
 **[RULING 2026-09-16, operator] The brake catches a FAST crash loop and is blind to a SLOW one — a
 second, slower counter is owed (R-539).** MEASURED the same day on the drill box: the controller was
 killed four times, each kill 20 minutes after the last. Every one was restarted (dashboard back in