🚧 WIP

README.md

@@ -152,12 +152,15 @@ Hardening done beyond the plan:
 - [x] Unpublished-port warning: listeners on ports not mapped by
       compose.yaml warn in the preview/deploy (reachable only inside
       the Docker network; keep PUBLISHED_PORTS in sync with compose)
+- [x] Restart-required detection + restart from the UI: deploy compares
+      listener lines against the previous deployed revision (reload
+      cannot apply listener changes, §28) and sets a pending-restart
+      flag; a glowing sidebar indicator links to Administration →
+      System, where the broker restarts via the control sidecar
+      (SIGTERM to PID 1, Docker policy revives it; audited as
+      BROKER_RESTARTED, §29/§38)
 - [ ] Configuration diff view (revision N-1 → N)
 - [ ] Configuration rollback (creates a new revision, §62)
-- [ ] Reload-vs-restart classification (§28) — the deploy health check
-      passes on reload, but a NEW listener still needs an explicit
-      broker restart (docker compose restart mosquitto); surfacing
-      that in the UI is pending
 - [ ] CA import (existing external CA)
 - [ ] Root-key export + removal workflow (§18)
 - [ ] CSR signing (client-side key generation)
@@ -170,9 +173,11 @@ Hardening done beyond the plan:
 
 - [x] Audit logging (backend records every privileged action: LOGIN,
       LOGOUT, CLIENT_*, GROUP_*, ROLE_*, ACL_CHANGED, LISTENER_*,
-      BROKER_CONFIG_DEPLOYED, USER_*, …)
+      BROKER_CONFIG_DEPLOYED, BROKER_RESTARTED, USER_*, …)
 - [x] Client metadata/tags (owner / purpose / tags in PostgreSQL; API
       accepts them on create)
+- [x] Administration → System page: broker status + restart (the
+      §28 restart gap is closed end-to-end from the UI)
 - [ ] Audit browsing UI (events are recorded; no viewer page yet)
 - [ ] Forced password-change UI (backend flag + API exist; the frontend
       does not enforce `must_change_password` yet)