Files
Teknium f7cd1f45b2 fix(gateway): a non-forced restart or update never stops a gateway still doing work
The gateway side already restarts when idle, but every CLI caller still
escalated when its own wait budget ran out: the pre-swap update pause stopped
supervised survivors through their supervisor and SIGKILLed bare ones, the
systemd and launchd restart commands fell through to a forced service
restart, and the post-update fleet restart, the stale-survivor pass and manual
gateways got a kickstart, a unit restart or SIGTERM. Each killed exactly the
live work the wait existed to protect.

Now, when the wait expires on a gateway that is alive, was reached by the
restart request and is not provably wedged (the existing wedged-loop
escalation is unchanged: a dead loop is not ongoing work), nothing stops it.
It already holds a pending restart and exits 75 at its first idle moment, so
its supervisor relaunches it from the new checkout. One line names what it is
still running (the drain report) and points at `hermes update --force`.

- update_cmd_drain_report: restart_left_pending / leave_restart_pending /
  report_restart_left_pending; progress lines no longer promise a forced
  restart.
- posix pause: survivors that took the drain leave the token (the rollback
  neither restarts nor replays a twin beside them) and the pause rolls back;
  the post-commit fleet restart does not wait on them a second time.
- fleet restart (systemd units, launchd siblings, invoking launchd job,
  manual gateways) and the stale-survivor pass count them restart-pending in
  the fleet matrix instead of stopping them.
- external supervisor restart returns instead of exiting 1.
Default timeouts are unchanged; they now bound the wait, not the work.
f7cd1f45b2 · 2026-11-14 02:23:19 -08:00
History
..
…