outlast openbao's cold restart in the agent ca unit's start limit

nix/host-modules/swarm-bao.nix

@@ -59,6 +59,9 @@ let
   openbaoStartSec = 240;
   containerStartSec = openbaoStartSec + 60;
 
+  # systemd's default stop limit, which bounds the stop half of a restart.
+  openbaoStopSec = 90;
+
   # Upstream's own default, kept so its documentation matches. The raft data
   # lives INSIDE the container on `ephemeral = false`, the same way
   # ./swarm-grafana.nix keeps its sqlite database — no sibling service binds
@@ -3950,9 +3953,10 @@ in
           Restart = "on-failure";
           RestartSec = 30;
           # An attempt may generate a 4096-bit RSA root and then wait on a
-          # blocking restart of openbao: its stop and its start, 90s each by
-          # systemd's defaults.
-          TimeoutStartSec = "5min";
+          # blocking restart of openbao: its stop (`openbaoStopSec`) and its
+          # start (`openbaoStartSec`), plus 120s for the key generation and
+          # the calls around it. 90 + 240 + 120 = 450s.
+          TimeoutStartSec = "${toString (openbaoStopSec + openbaoStartSec + 120)}s";
         };
         script = ''
           set -euo pipefail

nix/module-eval/bao-basics.nix

@@ -255,6 +255,20 @@ let
         && !(lib.hasInfix "certificate=@${tlsDir}/listener-client-ca.pem" scripts)
         && !(lib.hasInfix "certificate=@${tlsDir}/agent-ca.pem" scripts);
     }
+    {
+      # The unit's blocking `systemctl restart openbao.service` stops (90 s)
+      # then starts openbao (240 s), so its own limit must exceed both or a
+      # slow cold open kills the job mid-restart. Control: openbao's own limit
+      # is read from the same container, so a wrong path fails the 240 arm.
+      name = "the agent CA unit's start limit outlasts the restart of openbao it waits on";
+      ok =
+        let
+          limit = lib.toInt (
+            lib.removeSuffix "s" baoPkcs11.systemd.services.swarm-bao-agent-pki.serviceConfig.TimeoutStartSec
+          );
+        in
+        (baoUnits baoPkcs11).openbao.serviceConfig.TimeoutStartSec == 240 && limit >= 90 + 240 + 60;
+    }
     {
       # Both writers compose the bundle through one function, which refuses
       # a result that does not begin with the store CA and replaces the file