diff --git a/hive-c0re/src/job_queue/exec.rs b/hive-c0re/src/job_queue/exec.rs
index 2b8f55e3..28a0f668 100644
--- a/hive-c0re/src/job_queue/exec.rs
+++ b/hive-c0re/src/job_queue/exec.rs
@@ -145,6 +145,11 @@ fn emit_rebuilt(coord: &Arc<Coordinator>, terminal: &super::TerminalDag) {
 /// intent to its observed state — the operator's cancel means "don't do it", so
 /// the intent snaps back instead of the flip executing as a surprise side effect
 /// of some later reconcile. Noop on any non-cancelled outcome.
+///
+/// Only valid for templates carrying a `SetWanted` head (start / stop): the
+/// revert writes *observed* state, so dispatching it for a template that never
+/// wrote an intent doesn't restore anything — it invents one. See
+/// [`super::terminal_hook`].
 async fn revert_intent(coord: &Arc<Coordinator>, terminal: &super::TerminalDag) {
     if terminal.state != State::Cancelled {
         return;
diff --git a/hive-c0re/src/job_queue/mod.rs b/hive-c0re/src/job_queue/mod.rs
index 877ca89a..17b8c7c0 100644
--- a/hive-c0re/src/job_queue/mod.rs
+++ b/hive-c0re/src/job_queue/mod.rs
@@ -169,12 +169,22 @@ pub enum HookKind {
     ResolveApproval,
     /// Rebuild / perm-change: emit one `Rebuilt` manager event per agent.
     EmitRebuilt,
-    /// Power-op: on a *cancelled* DAG, revert each agent's `wanted` intent.
+    /// Intent-writing power-op: on a *cancelled* DAG, revert each agent's
+    /// `wanted` intent. Only for templates that actually carry a `SetWanted`
+    /// head — reverting an intent a DAG never wrote invents one.
     RevertIntent,
 }
 
 /// The terminal hook a DAG needs, from its template + approval id — or `None`
 /// for a DAG with no terminal side effect (meta-update, boot, bare reconcile).
+///
+/// Restart is deliberately **not** a `RevertIntent` template. `restart_chain`
+/// writes no `SetWanted` (it bounces the container and lets the tail
+/// `Reconcile` converge to the agent's existing intent), so there is nothing
+/// for a cancel to revert — and `revert_intent` writes the *observed* state,
+/// which for a down-but-`wanted = Up` agent (crashed, or mid-bounce) would
+/// flip it to `Offline` and keep it down. Cancelling a restart must leave the
+/// intent exactly as it was found.
 #[must_use]
 pub fn terminal_hook(template: Template, approval_id: Option<i64>) -> Option<HookKind> {
     if approval_id.is_some() {
@@ -182,11 +192,7 @@ pub fn terminal_hook(template: Template, approval_id: Option<i64>) -> Option<Hoo
     }
     match template {
         Template::Rebuild | Template::PermChange => Some(HookKind::EmitRebuilt),
-        Template::Start
-        | Template::Stop
-        | Template::GracefulStop
-        | Template::Restart
-        | Template::GracefulRestart => Some(HookKind::RevertIntent),
+        Template::Start | Template::Stop | Template::GracefulStop => Some(HookKind::RevertIntent),
         _ => None,
     }
 }
diff --git a/hive-c0re/src/job_queue/tests.rs b/hive-c0re/src/job_queue/tests.rs
index 1327515a..f0de064e 100644
--- a/hive-c0re/src/job_queue/tests.rs
+++ b/hive-c0re/src/job_queue/tests.rs
@@ -863,6 +863,51 @@ fn cancel_refuses_running_dag() {
     assert_eq!(state_of(&q, id), State::Running);
 }
 
+/// A cancelled restart must fire **no** intent revert. `restart_chain` writes
+/// no `SetWanted`, so a cancel has nothing to roll back — and the revert hook
+/// writes the agent's *observed* state, which for a down-but-`wanted = Up`
+/// agent (crashed, or caught mid-bounce) would flip the intent to `Offline`
+/// and leave it deliberately-stopped as far as reconcile and crash-watch are
+/// concerned. Invisible for a running agent (observed == recorded), which is
+/// why it went unnoticed; the window is exactly "observed ≠ intent", which is
+/// when a restart is most likely to be issued and then cancelled.
+#[test]
+fn cancelled_restart_reverts_no_intent() {
+    for graceful in [false, true] {
+        for running in [false, true] {
+            let q = JobQueue::new(1);
+            let targets = vec![("agent-a".to_owned(), running)];
+            let spec =
+                submit::restart_spec(&targets, graceful, Source::Manual, "bounce".to_owned());
+            assert!(
+                !spec
+                    .nodes
+                    .iter()
+                    .any(|n| matches!(n.kind, NodeKind::SetWanted { .. })),
+                "restart writes no intent (graceful={graceful}, running={running})"
+            );
+            let id = submit(&q, spec);
+            let summary = q.cancel(id).expect("cancelled while queued");
+            assert_eq!(summary.state, State::Cancelled);
+            assert_eq!(
+                terminal_hook(summary.template, summary.approval_id),
+                None,
+                "cancelled restart (graceful={graceful}, running={running}) must \
+                 not revert an intent it never wrote"
+            );
+        }
+    }
+    // Contrast: stop *does* carry a `SetWanted` head, so its cancel still has a
+    // real intent flip to undo.
+    let q = JobQueue::new(1);
+    let id = submit(&q, stop_online(&["agent-a"], false, "stop"));
+    let summary = q.cancel(id).expect("cancelled while queued");
+    assert_eq!(
+        terminal_hook(summary.template, summary.approval_id),
+        Some(HookKind::RevertIntent)
+    );
+}
+
 // ---- terminal reporting + lease release ----
 
 #[test]