close-out 2026-10-29 evening release (D65 = A): 04/09/03/05/08 [DESIGN]; R-1349, R-1350 closed (proven live); R-1351 filed; R-1346 measured (the save's own DB step); R-1344 planned events; CONTEXT, STATUS, report, evidence

documentation/architecture/03-host-agent.md

@@ -214,6 +214,19 @@ by verb**:
   `unresponsive_since` in the stanza, the hub's operator-only `controller_unresponsive`. Not counted during a swap, a
   parked or locked guest, or a vzdump. **It does not restart for it** until the R-1344 measurement (every probe, both
   test boxes, through the 2026-10-29/30 night chain) shows a busy night never reads unhealthy that long.
+- **`[DESIGN]` 2026-10-29 — the operator's „Reboot guest" (D65 = A, agent `ca15a31`, released v0.170.0; `04` §6.1,
+  `09` §3 decision 284).** The agent's list gains `reboot_guest <vmid>`: the existing guest-reboot path (`pct reboot`
+  of THAT guest — never the host), for a stuck Docker or a stuck network inside the box. Guards, each refusing with the
+  reason: provisioned, running, not locked, not parked; the host-wide heavy-operation gate free (held from the checks
+  until the guest is up); `jobBlocker` (agent backup job, controller swap, drive/NAS job, escrow ceremony, vzdump); the
+  controller's busy file not fresh (the controller rewrites `data/ctl/busy` every 15 s during a backup, restore,
+  off-site run, night catch-up, app update or app export/import; older than 90 s = a controller that stopped writing,
+  not a busy one; any read failure but „no file" refuses); at most one per hour per guest (`<guests>/<vmid>/
+  operator-reboot.json`, persisted); the restart brake (a reboot counts as a restart). The guest-power watchdog and the
+  supervisor leave the guest alone while it reboots. The result names both times from the press („rebooted; the guest was
+  up after N s, the controller answered after M s"). The record is written BEFORE the reboot; `GET /guest/operator-reboot`
+  (self-scoped) hands it to the controller that starts after it, and the household's dashboard says „A Felhom
+  ügyfélszolgálata HH:MM-kor újraindította a dobozt." for a day.
 
 **[RULING 2026-09-16, operator] The brake catches a FAST crash loop and is blind to a SLOW one — a
 second, slower counter is owed (R-539).** MEASURED the same day on the drill box: the controller was

documentation/architecture/04-control-plane-authorization.md

@@ -193,7 +193,21 @@ report held now. **The AGENT has its own closed list on the host report's reply
 (`store.ValidateHostOperatorAction` / agent `localapi.OperatorActionNames`; never a shared verb, `TestHostOperatorActions_ClosedList`):
 the supervisor's restart with its guards, the 3-in-15-minutes brake counting operator restarts too (then 30 minutes
 refused), the result in the next report (requested at once), a vmid that is not a guest of that host refused at the hub.
-Neither verb deletes data, starts a countdown or shortens one. A guest reboot from the hub is NOT on either list.
+Neither verb deletes data, starts a countdown or shortens one. ~~A guest reboot from the hub is NOT on either list.~~
+(Superseded the same day by D65 below.)
+
+**`[DESIGN]` 2026-10-29 — D65 = A: `reboot_guest <vmid>` joins the AGENT's list (operator ruling 15:50; `09` §3
+decision 284).** No signature: a reboot destroys nothing (`03`). The agent's list is now `restart_controller` and
+`reboot_guest`; the controller's list does not change and the two never share a verb (`TestHostOperatorActions_ClosedList`,
+agent `TestOpActions_AgentClosedList`). The act is `pct reboot` of that guest over the existing exact sudo vector — never
+the host. The agent refuses (reason in the result, nothing called) a guest it did not provision, a stopped, locked or
+parked guest, a held heavy-operation gate, any agent job (`jobBlocker`: backup, controller swap, drive/NAS job, escrow
+ceremony, vzdump), a fresh controller busy file (backup, restore, off-site run, night catch-up, app update, app
+export/import — read over ONE new read-only grant, `pct exec <vmid> -- cat <the controller-data volume>/data/ctl/busy`;
+any read failure but „no file" refuses), a second reboot within an hour (persisted), and the restart brake (a reboot
+counts as a restart). It holds the heavy-operation gate until the guest is up. The hub expires an unpicked reboot after
+30 minutes (a restart keeps the day). The closed list's rule stands: nothing on either list deletes data, starts a
+countdown or shortens one.
 
 ### 6.2 Who may press the operator's buttons: session, Basic, or a scoped token [hub v0.152.0, `09` §3 decision 251]
 

documentation/architecture/05-hub-architecture.md

@@ -824,4 +824,12 @@ agent does not report — found live, fixed in 0.176.1); it stores an AGENT row
 and shows the result under Operator Actions. „Clear hold" sits on each Held apps row; its confirm step names the app,
 the reason and since when, and for a restore or put-back hold warns that the app may start on half-restored data; the hub
 refuses an app the box does not report held now. Both are `hosts:write`, CSRF like every form (a token press needs none
-and is recorded as `access token "<name>"`), and neither is reachable without the confirm fold-out in the browser.
+and is recorded as `access token "<name>"`), and neither is reachable without the confirm fold-out in the browser.
+
+**`[DESIGN]` 2026-10-29 — „Reboot guest" beside it (hub v0.177.0; D65 = A, `04` §6.1).** One per guest of a customer
+host, behind its own confirm step (the whole guest reboots, every app stops for about a minute, when it is refused); it
+stores an AGENT row `reboot_guest <vmid>` and pokes the box like the restart. **A reboot row the agent did not pick up in
+30 minutes expires** (`HostOperatorActionRebootTTL`; a restart keeps the 24 h) — a box that was off must not reboot by
+itself when it comes back. The agent's result closes the row with one `operator_action` event. **R-1346:** the access-log
+middleware also writes `[WARN] slow request: <method> <path> <status> <ms>` for a request over 5 s (path only;
+`/api/v1/wait` exempt), and the artifact vouch save logs each leg's time.

documentation/architecture/08-alarm-ladder.md

@@ -127,6 +127,11 @@ live 2026-08-23 — one event across 22 scans.
 
 - **Operator/hub event + dashboard banner.** `app_start_failed` is **not** in
   `settings.DefaultEnabledEvents`, so by default it does **not** e-mail the customer.
+- **`[DESIGN]` 2026-10-29 — no alarm after the operator's hold clear (R-1350).** The clear starts nothing, so a held app
+  stays stopped; the clear now records that stop as WANTED (desired state „stopped") for an app that is not up — once the
+  hold is found, before it is lifted — so the scan's tri-state reads „the household asked" and stays quiet. The
+  household's Start records „running" and ends it. Measured before the fix on Tester 1: `app_start_failed` 30 s after a
+  clear from the hub (controller, R-1350).
 - **F-OBS heartbeat**, every 20 scans (~10 min), at `[INFO]`:
   `[deadapp] check alive: N scans since boot, M deployed app(s) evaluated, K currently down`.
   This line exists because an absent alarm and a stopped detector look identical in a log.

documentation/architecture/09-update-architecture.md

@@ -1206,6 +1206,17 @@ Wanderer's Meilisearch went 256 → 384 MB and was measured again (it sizes itse
      `-tags faultinject` test build — never in the release image (`TestD63_TheReleaseBuildHasNoFaultSwitch`). *Operator,
      2026-10-29 08:17.* `07` §6.3.
 
+### 2026-10-29 (15:50, operator) — D65 = A: the hub may reboot a guest
+
+284. **D65 = A — `reboot_guest` joins the AGENT's closed operator-action list, with no signature.** The operator reboots
+     one guest from the hub's host page (`pct reboot` of THAT guest, the existing guest-reboot path — never the host),
+     for a stuck Docker or a stuck network inside the box that „Restart controller" cannot reach. A reboot destroys
+     nothing (`03`, „healing … non-destructive by construction"). Guards on the agent: no backup of any tier, restore,
+     update, controller swap or other heavy job (the controller's busy file included); not a locked, stopped or parked
+     guest; at most one per hour per guest; the restart brake counts it. A press the agent did not pick up in 30 minutes
+     expires. The household's dashboard says for a day that Felhom support restarted the box. `04` §6.1, `03`.
+     *Operator, 2026-10-29 15:50.*
+
 ### 2026-10-29 (12:10, operator) — D64 = B: the hub may clear any hold
 
 283. **D64 = B — the hub's „Clear hold" works for every hold reason, with no operator signature.** The operator accepted