feat(service): apply definitions without a daemon restart

[edwin-zvs]

The problem

Service definitions were loaded once at boot, so every edit returned restart_required: true and did nothing until the daemon restarted. Parts of that were worse than a missing feature:

• paused was a lie. Consulted only at startup, so pausing a running service left its listener bound and serving.
• Rotating a credential left the old one working, since the token was snapshotted when the listener bound.
• Both UIs asserted the restriction in prose rather than reading restart_required, which nothing consumed — ~14 hardcoded strings.

What applies when

Published as shared data (PropagationClass / ServiceField) that the daemon and its clients both read, so the promise beside a field is the promise the daemon keeps:

Change	Applies
Channel attachment, port, enabled, credential	immediately
Routing rule, paused, approval timeout	next request
Instruction, harness, model, cwd, sandbox	new sessions

Instruction and model stay next-session deliberately. A harness assembles its system prompt at startup, and resuming one skips its seed prompt (agent.rs, if !persist::is_resume()) so the model isn't charged twice — so respawning re-delivers nothing and there is no honest way to re-instruct a live conversation. The classes say that rather than implying otherwise.

Design

A supervisor task (modeled on remote_supervisor) owns every listener; the registry lives in its stack frame, so reloads serialize by construction. Config is read at the point of use behind RwLock<Arc<ServiceConfig>>, so only a port change touches a socket.

• All or nothing. A definition that fails to parse leaves the running configuration untouched — which is also what makes watching the config directory safe against a file caught mid-write.
• Stops complete before starts, awaiting each handle, so two channels can exchange ports (the port frees when the listener drops inside its task, not at cancellation).
• Connections drain, sockets rebind. Cancelling stops accepting; a request already being served runs to completion, because it has an agent turn behind it.
• ServiceShared is never rebuilt for a name that already has one — two would race on the same state file and reset the dedup ring, stranding live conversations and admitting duplicate deliveries.
• Duplicate ports are reported, and the already-serving claim keeps the port.
• restart_required → ServiceApplyResult reporting the socket work actually performed.

Also fixed in passing: persist_state wrote without tmp+rename, so a crash mid-write lost every routed session mapping.

Verification

Live daemon, every change made by hand-editing TOML, no restart:

rotate credential  old token -> 401,  new token -> 202
routing rule       per-event now accepted without session_key (was 400)
pause              connection refused, port released
resume + move port old port free, new port -> 202
malformed TOML     still serving during bad parse, recovers when fixed
service.delete     returns null (client-compatible), port released

Caught during verification: returning the apply report from service.delete would have broken Client::delete_service, which deserializes into () — deletes keep a null response and still reload.

Tests: 6 new in the supervisor (plan ordering, paused/disabled release, deterministic duplicate-port loser, port-release-after-await, propagation coverage). construct-daemon --lib 495, construct-cli --bins 1314, construct-protocol 1, workspace builds clean. The test asserting the old restart note failed loudly as intended and was updated.

Specs: adds 0173-service-definitions-apply-without-restart; amends 0163's "V1 does not promise runtime definition reload".

Touches crates/daemon, crates/protocol, crates/cli, web assets → all in the construct binary.

[edwin-zvs]

Added regression coverage

The reload loop and the per-request config reads were only verified by hand against a running daemon, so nothing would have caught a regression. Service tests go from 6 to 14.

Over the real reload path (files on disk, real SessionManager, real sockets):

• a reload reuses a known service's state — the invariant whose violation strands live conversations and admits duplicate deliveries
• a broken definition changes nothing
• services appear and disappear with their definitions
• a channel binds, moves, and releases across reloads
• one service hands a port to another in a single reload

The mechanism the listener never sees:

• a rotated credential takes effect without rebinding (and a detached channel authenticates nobody)
• pausing or disabling stops a channel serving
• an edit preserves routed sessions and delivery history

Each was checked against a deliberately broken build, so it fails for the reason it claims: rebuilding shared state on reload, skipping the await before rebind, removing the release pass, freezing the token snapshot, ignoring paused, and clearing dedup on edit. All six mutations failed the intended test.

That exercise found two problems in this PR:

1. The stop-before-start test was vacuous. Reversing the plan's ordering did not fail it — a port swap produces two rebinds and no Start to order against. Investigating showed the guarantee is enforced by the executor's two passes, not by plan, so the comment crediting the plan is corrected and the test now uses a port handover, where a stop and a start genuinely coexist. There is also an end-to-end version that fails with EADDRINUSE if the release pass is removed.
2. A flaky test. The suite failed once at 502/1 while passing when filtered — the port-claiming tests racing for the same ephemeral port, since free_port reports one that was free a moment ago. They now serialize; 5/5 clean afterward.

construct-daemon --lib 503, construct-cli --bins 1314, workspace builds clean.