no-mistakes(review): fix pending-reload path, token modes, restart check

scripts/capture-dsh-token.sh

@@ -71,6 +71,21 @@ if [ -e "$LEGACY_8081" ] || [ -L "$LEGACY_8081" ]; then
   log "removed legacy :8081 endpoint -> $STASHED"
 fi
 
+# ── 1b. Honor a recorded pending reload regardless of token selection ───────
+# A failed reload leaves PENDING_FILE set so a stashed legacy :8081 file can
+# never remain loaded in the running nginx while dsh-web is down or not yet
+# answering. Reconcile it before the token wait.
+if [ -e "$PENDING_FILE" ]; then
+  if ! nginx -t >/dev/null 2>&1; then
+    die "pending nginx reload recorded but 'nginx -t' fails; fix the config and rerun"
+  fi
+  if ! nginx -s reload; then
+    die "pending nginx reload recorded but 'nginx -s reload' failed; will retry next run"
+  fi
+  rm -f "$PENDING_FILE"
+  log "completed pending nginx reload"
+fi
+
 # ── 2. Select the token the RUNNING service actually accepts ────────────────
 # Functionally verify each journal candidate against the local dsh-web using the
 # public authority, exactly as the /dsh-web-login proxy does. A token from a
@@ -114,6 +129,7 @@ if ! printf '%s\n' "$TOKEN" | cmp -s - "$TOKEN_FILE" 2>/dev/null; then
   mv "$TOKEN_FILE.tmp" "$TOKEN_FILE"
   log "recorded live launch token in $TOKEN_FILE"
 fi
+chmod 600 "$TOKEN_FILE"
 
 # ── 4. Regenerate the nginx login include (reload only when it changes) ────
 NEW_INCLUDE="$(mktemp "$INCLUDE_FILE.XXXXXX")"
@@ -126,6 +142,8 @@ chmod 600 "$NEW_INCLUDE"
 # reload path so the include can never silently diverge from what nginx serves.
 APPLIED=""
 [ -f "$STAMP_FILE" ] && APPLIED="$(cat "$STAMP_FILE" 2>/dev/null || true)"
+[ -f "$INCLUDE_FILE" ] && chmod 600 "$INCLUDE_FILE"
+[ -f "$STAMP_FILE" ] && chmod 600 "$STAMP_FILE"
 
 if [ "$APPLIED" = "$TOKEN" ] && [ -f "$INCLUDE_FILE" ] && cmp -s "$NEW_INCLUDE" "$INCLUDE_FILE" \
   && [ ! -e "$PENDING_FILE" ]; then
@@ -140,6 +158,7 @@ RESTORE=""
 if [ -f "$INCLUDE_FILE" ]; then
   RESTORE="$(mktemp "$INCLUDE_FILE.bak.XXXXXX")"
   cp -p "$INCLUDE_FILE" "$RESTORE"
+  chmod 600 "$RESTORE"
 fi
 
 mv "$NEW_INCLUDE" "$INCLUDE_FILE"