fix: restore channels after gateway restart

tools/deploy/production-deploy.sh

@@ -241,8 +241,6 @@ else
   systemctl enable --now cmpp-api cmpp-send-worker cmpp-gateway nginx
 fi
 systemctl restart cmpp-security-agent
-systemctl restart cmpp-api
-systemctl restart cmpp-send-worker
 if [[ "${SEND_SUBMIT_OUTBOX_SEPARATE_PROCESS_ENABLED:-false}" == "true" ]]; then
   systemctl enable --now cmpp-submit-outbox
   systemctl restart cmpp-submit-outbox
@@ -261,9 +259,11 @@ if [[ "${GATEWAY_PROTOCOL_LOG_STREAM_ENABLED:-false}" == "true" ]]; then
 else
   systemctl disable --now cmpp-protocol-log-worker 2>/dev/null || true
 fi
-# Gateway is restarted after the callback listener so supplier events never point
-# at a callback port that has not completed Nest/Prisma initialization.
+# Gateway is restarted after the callback listener, then API is restarted after
+# Gateway so API startup reconciliation always restores the active channel set.
 systemctl restart cmpp-gateway
+systemctl restart cmpp-api
+systemctl restart cmpp-send-worker
 systemctl restart nginx
 
 echo "[deploy] Health checks"

tools/deploy/verify-production-deployment.mjs

@@ -58,4 +58,11 @@ if (!workerMain.includes("process.env.API_WORKER_METRICS_HOST?.trim() || '127.0.
   throw new Error('send worker metrics must default to loopback');
 }
 
+const gatewayRestart = deploy.indexOf('systemctl restart cmpp-gateway');
+const apiRestart = deploy.indexOf('systemctl restart cmpp-api');
+const workerRestart = deploy.indexOf('systemctl restart cmpp-send-worker');
+if (gatewayRestart < 0 || apiRestart < gatewayRestart || workerRestart < apiRestart) {
+  throw new Error('production deploy must restart Gateway before API and the send worker so API startup restores active channels');
+}
+
 console.log('Production deployment verified: Nginx/API guards and the split durable send worker contract are present.');