A model's replicas restarted one at a time, always. RestartPace says how many restart at once: MaxSurge beside themselves (replacement first), MaxUnavailable stopped first (no room needed, out while loading); the reconciler begins that many per model per pass. The admin API takes max_surge and max_unavailable on POST /api/v1/restart. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>