fix(#2398): graceful restart as one atomic DAG, not compose-and-await

mara's review on #2436: no submit-await-submit composition, even
server-side. Adds Template::GracefulRestart (Signal -> Drain ->
StopForUpdate -> Reconcile, wanted=Up) mirroring how Restart already
does StopForUpdate -> Reconcile, plus submit::graceful_restart and
templates::graceful_restart. handle_restart_scoped now submits exactly
one DAG per agent up front for both the graceful and non-graceful
case -- no await_dags in the loop anymore.
This commit is contained in:
atlas 2026-07-14 20:21:06 +02:00 committed by mara
commit 901ab6a779
8 changed files with 103 additions and 40 deletions

View file

@ -1643,10 +1643,12 @@ async fn start(socket: &Path, scope: hive_host_sock::LifecycleScope, no_wait: bo
}
/// Restart — one `RestartScoped` daemon call, server-side DAG-based (see
/// issue tracker "dagify hivectl commands"). Each targeted agent rides one
/// atomic `Restart` DAG (or, with `--graceful`, a server-awaited
/// graceful-stop DAG followed by a start DAG); infra containers restart
/// synchronously. Unlike the old client-side stop-then-start compose, a
/// issue tracker "dagify hivectl commands"). Each targeted agent rides
/// exactly one atomic DAG queued up front — `Restart` (mechanical stop +
/// reconcile), or `GracefulRestart` with `--graceful` (signal → drain →
/// mechanical stop → reconcile); infra containers restart synchronously.
/// No "submit one DAG, wait for it, submit another" composition on either
/// side of the wire: unlike the old client-side stop-then-start compose, a
/// dropped `hivectl` connection mid-restart no longer leaves an agent
/// stopped with no automatic follow-up — the daemon owns the whole
/// sequence once this call is made.