diff --git a/docs/conventions.md b/docs/conventions.md
index cefdbcf3..050358c6 100644
--- a/docs/conventions.md
+++ b/docs/conventions.md
@@ -358,6 +358,7 @@ that allows the underlying resource access.
 | `manage_root_agent` | may lifecycle-manage the root/manager agent via `kill`/`start`/`restart` |
 | `read_host_journal` | `get_host_journal` MCP tool is registered + `GET /journal-host` requests are served |
 | `query_agent_state` | may call `get_loose_ends` / `CountPendingReminders` targeting non-child agents |
+| `infra_admin` | may call `restart(name)` on hive infrastructure containers (`hive-ci`, `hive-gateway`, `hive-forge`); each restart is logged to the dashboard AUDIT trail |
 
 **Config storage** — per-agent capabilities live in
 `/var/lib/hyperhive/meta/capabilities.json` alongside `tool-groups.json`.
diff --git a/docs/turn-loop.md b/docs/turn-loop.md
index e2759e19..7818e4cd 100644
--- a/docs/turn-loop.md
+++ b/docs/turn-loop.md
@@ -577,7 +577,10 @@ at_unix_timestamp?)`, `request_next_turn()`.
   `{state_dir}/hyperhive-status`. Pass `""` to clear.
 - `get_agent_meta` — fetch identity + status metadata for an agent:
   `{ name, hyperhive_rev, running, status_text, status_set_at,
-  hive_name?, swarm_name? }`. Omit `name` to query self.
+  hive_name?, swarm_name?, matrix_accounts? }`. `matrix_accounts` is a
+  list of matrix identities the agent can act as (`name`, `user_id?`,
+  `homeserver`); omitted for agents with no matrix provisioning. Omit
+  `name` to query self.
 
 ### Privileged tools (by tool group)
 
diff --git a/docs/web-ui/dashboard.md b/docs/web-ui/dashboard.md
index ef65b09f..0d8636d8 100644
--- a/docs/web-ui/dashboard.md
+++ b/docs/web-ui/dashboard.md
@@ -311,6 +311,7 @@ The current capabilities are:
 | `manage_root_agent` | allows the `set_status` / lifecycle tools on the root agent |
 | `read_host_journal` | unlocks `get_host_journal` to read journald from inside a container |
 | `query_agent_state` | allows `get_loose_ends(agent: "<name>")` calls targeting other agents |
+| `infra_admin` | allows `restart` on hive infrastructure containers (`hive-ci`, `hive-gateway`, `hive-forge`); each restart is logged to the AUDIT trail |
 
 Each row is one agent. Columns are the capability names returned by
 `GET /api/capabilities` as `caps: Vec<String>`. Checking or unchecking