seed: carry restart approval policy into new worlds

Make legacy core.exit share core.restart's supervisor gate and pending
request. Seed the stable agent prompt and boot comments with the approval
and shutdown contract, and check real init output under a deadline.
Cover both aliases' gate, response grace, coalescing and exit status.

Card: SAU-135

cli/src/boot.yaml

@@ -2,6 +2,9 @@
 # Each method is a plugin.method name. params contains its named arguments.
 # The core waits for each result before it starts the next service.
 # After a plugin upgrade, the core restarts that plugin's services.
+# Host restart is separate: #loop sets SAUSAGE_LOOP=1 to enable core.restart
+# (and its alias core.exit). It answers before clean shutdown with exit code 75.
+# Agents need the person's explicit approval each time; never add it as a service.
 # Example (replace [] with this list):
 # - method: www.start
 #   params:

cli/src/core.rs

@@ -62,11 +62,7 @@ impl Host {
             }
             "log" => Ok(self.0.journal.query(p).await),
             "activate" | "revert" => self.activation(caller, method, p).await,
-            "restart" => self.request_restart(),
-            "exit" => {
-                self.0.exit.send_replace(true);
-                Ok(json!({}))
-            }
+            "restart" | "exit" => self.request_restart(),
             _ => Err(error(-32601, "method not found")),
         }
     }

cli/src/host.rs

@@ -147,7 +147,7 @@ impl Host {
         )
         .await
     }
-    /// Wait until core.restart (after its response grace) or core.exit requests shutdown.
+    /// Wait until core.restart (or its alias core.exit) requests shutdown after its response grace.
     pub async fn exit_requested(&self) {
         let mut exit = self.0.exit.subscribe();
         let _ = exit.wait_for(|requested| *requested).await;

cli/src/restart.rs

@@ -60,14 +60,21 @@ mod tests {
     async fn restart_without_supervisor_never_triggers_exit() {
         timeout(Duration::from_secs(10), async {
             let (_dir, host) = host(false).await;
-            let error = host.call("core.restart", json!({})).await.unwrap_err();
-            assert_eq!(error["code"], -32600);
-            assert!(
-                error["message"]
-                    .as_str()
-                    .unwrap()
-                    .contains("SAUSAGE_LOOP not set")
-            );
+            for method in ["core.restart", "core.exit"] {
+                let error = host.call(method, json!({})).await.unwrap_err();
+                assert_eq!(error["code"], -32600);
+                assert!(
+                    error["message"]
+                        .as_str()
+                        .unwrap()
+                        .contains("SAUSAGE_LOOP not set")
+                );
+                let indirect = host
+                    .call("core.call", json!({"method":method}))
+                    .await
+                    .unwrap_err();
+                assert_eq!(indirect, error);
+            }
             assert!(!host.0.restart_pending.load(Ordering::SeqCst));
             assert!(
                 timeout(Duration::from_millis(300), host.exit_requested())
@@ -81,37 +88,40 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn restart_answers_before_trigger_and_duplicates_are_noops() {
+    async fn restart_and_exit_share_response_grace_and_coalescing() {
         timeout(Duration::from_secs(10), async {
-            let (_dir, host) = host(true).await;
-            // Same dispatch as a plugin's core.call, without killing this runner.
-            assert_eq!(
-                host.call("core.call", json!({"method":"core.restart"}))
+            for first in ["core.restart", "core.exit"] {
+                let (_dir, host) = host(true).await;
+                // Same dispatch as a plugin's core.call, without killing this runner.
+                assert_eq!(
+                    host.call("core.call", json!({"method":first}))
+                        .await
+                        .unwrap(),
+                    json!({})
+                );
+                assert!(!host.restart_requested());
+                assert!(host.0.restart_pending.load(Ordering::SeqCst));
+                assert_eq!(
+                    host.call("core.restart", json!({})).await.unwrap(),
+                    json!({})
+                );
+                timeout(Duration::from_secs(1), host.exit_requested())
                     .await
-                    .unwrap(),
-                json!({})
-            );
-            assert!(!host.restart_requested());
-            assert!(host.0.restart_pending.load(Ordering::SeqCst));
-            assert_eq!(
-                host.call("core.restart", json!({})).await.unwrap(),
-                json!({})
-            );
-            timeout(Duration::from_secs(1), host.exit_requested())
-                .await
-                .unwrap();
-            // A duplicate after the trigger must not schedule a second task.
-            host.0.exit.send_replace(false);
-            assert_eq!(
-                host.call("core.restart", json!({})).await.unwrap(),
-                json!({})
-            );
-            assert!(
-                timeout(Duration::from_millis(300), host.exit_requested())
-                    .await
-                    .is_err()
-            );
-            host.stop().await;
+                    .unwrap();
+                // A duplicate after the trigger must not schedule a second task.
+                host.0.exit.send_replace(false);
+                assert_eq!(
+                    host.call("core.restart", json!({})).await.unwrap(),
+                    json!({})
+                );
+                assert_eq!(host.call("core.exit", json!({})).await.unwrap(), json!({}));
+                assert!(
+                    timeout(Duration::from_millis(300), host.exit_requested())
+                        .await
+                        .is_err()
+                );
+                host.stop().await;
+            }
         })
         .await
         .unwrap();