host: add supervisor-gated clean core.restart RPC

Return success before scheduling the existing shutdown path, coalesce pending
requests, and mark #loop invocations with SAUSAGE_LOOP=1. Keep core.exit
compatibility and document explicit per-call approval for all agents.

Card: SAU-134

DECISIONS.md

@@ -61,6 +61,19 @@ a plugin, or a change that the agent makes to itself.
 
 ## Small choices
 
+- **Restart is a clean stop supervised by `#loop`.** `core.restart` requires
+  the host startup marker `SAUSAGE_LOOP=1`, which the loop exports for its
+  invocation. Without a supervisor, restarting would only stop the world.
+  A single pending request answers first, allows 250 ms for delivery, then
+  signals the existing shutdown path; it does not use `process::exit` or
+  bypass detached-process cleanup, lock release, or journal draining. The
+  executable returns dedicated restart code **75** after cleanup. `#loop`
+  refreshes and starts again on 75 (and other nonzero exits); 0 stops it.
+  `core.exit` stays available for compatibility, but new callers use the
+  gated method. **HARD RULE: the mediator and all agents NEVER call
+  `core.restart` without the person's explicit approval each time.** This
+  approval rule also covers legacy `core.exit`; it must not bypass the gate.
+
 - **YAML for configuration, JSON for data.** A person edits configuration, so
   it needs comments. `init` writes commented templates instead of asking
   questions, so there is one way to configure a world.