officer.dev: the restart rule was stale, and said the opposite

This file said "NEVER run pm2 yourself — tell the owner the exact command." The
owner granted the opposite on this machine on 2026-08-19, so the document and
the instruction disagreed for a day, and user/CLAUDE.md already flagged it as a
local rule to follow "while it says so".

It now says to run the restart and report it. The scope is unchanged and is the
part that mattered: only the process the change needs, never the whole
ecosystem.config.cjs.

Added the caveat the grant did not remove — check who else is live first. The
owner edits the platform using the platform, several sessions share one
checkout, and a restart is the moment a half-applied change from someone else's
work in progress would ship.

officer.dev/CLAUDE.md

@@ -28,10 +28,16 @@ This file captures the **cross-cutting operational reality** that neither of tho
   After editing anything under `platform/src` (backend *or* frontend), it needs a
   **`pm2 restart officer`** to take effect. Forgetting this looks exactly like "my fix didn't
   work." Confirm the reload before diagnosing further.
-  - **NEVER run pm2 yourself — tell the owner the exact command to run.** After a platform change,
-    print the precise `pm2 restart <process>` command that reloads ONLY the process(es) the change
-    needs (for platform TS edits that is `pm2 restart officer` alone — never the whole
-    `ecosystem.config.cjs`, which bounces every sidecar). The owner runs it.
+  - **Run the restart yourself, and say that you did.** This said "NEVER run pm2 yourself" until
+    2026-08-20. The owner granted the opposite on this machine: restart when a change needs it rather
+    than handing over a command to paste. What did NOT change is the scope — restart ONLY the
+    process(es) the change needs (for platform TS edits that is `pm2 restart officer` alone, never the
+    whole `ecosystem.config.cjs`, which bounces every sidecar).
+  - **Check who else is live first.** The owner edits the platform *using* the platform, and often has
+    several sessions open, so a restart can cut another agent off mid-turn or bounce the process you
+    are both running inside. Look at `pm2 list`, the session list, the process table. Restarting is
+    also the one moment a half-applied change from a shared checkout ships — confirm the tree is
+    coherent (typecheck clean, database schema matching the code) before you bounce anything.
 - **Capabilities ARE hot — no restart.** Files under `capabilities/` are re-read from disk on each
   run / request (Pi per agent session, the app per request). Edit `TASK.md` / `index.ts` /
   `categories.yaml` and it's live immediately. This asymmetry is the #1 source of confusion: