fix(#1329): restart hive-matrix-daemon after token write so new credential is picked up immediately

hive-c0re/src/matrix.rs

@@ -697,6 +697,15 @@ pub async fn ensure_user_for(
         .await
         .with_context(|| format!("matrix: write matrix-token for {name} via hive-priv"))?;
     tracing::info!(%name, "matrix: provisioned access token");
+
+    // Kick the daemon so it picks up the new token without waiting for a
+    // full container restart — see docs/matrix.md::Provisioning flow.
+    if let Err(e) = crate::priv_client::restart_matrix_daemon(name).await {
+        tracing::warn!(%name, error = ?e, "matrix: could not restart hive-matrix-daemon (token written; daemon will reload on next container start)");
+    } else {
+        tracing::info!(%name, "matrix: restarted hive-matrix-daemon to pick up new token");
+    }
+
     Ok(())
 }
 

hive-c0re/src/priv_client.rs

@@ -280,6 +280,17 @@ pub async fn write_agent_matrix_token(agent_name: &str, token: &str) -> Result<(
     .await?)
 }
 
+/// Restart `hive-matrix-daemon.service` inside an agent container via
+/// `systemctl --machine=h-<agent_name> restart hive-matrix-daemon.service`.
+/// Non-fatal: callers should handle errors gracefully — if the container is
+/// not running the restart will fail (the unit starts naturally on next boot).
+pub async fn restart_matrix_daemon(agent_name: &str) -> Result<()> {
+    ok(call(&PrivRequest::RestartMatrixDaemon {
+        agent_name: agent_name.to_owned(),
+    })
+    .await?)
+}
+
 fn check(resp: PrivResponse) -> Result<(String, String)> {
     if resp.ok {
         Ok((resp.stdout, resp.stderr))