Follow-up to #396/#400: systemd oneshot units default to KillMode=control-group, which killed the daemon recover had just revived the moment the oneshot exited (observed live: recover ok at 22:13:40, process gone by 22:13:42). The generated watchdog unit now sets KillMode=process.
Why: auto-recovery must leave the recovered service running.
Evidence: test_watchdog_print_plan asserts KillMode=process; suite 10/10 + make test-governance rerun on the task card; live host re-demo after merge.
Impact: scripts/svc.sh wd_service_text + one test assertion.
Follow-up to #396/#400: systemd oneshot units default to KillMode=control-group, which killed the daemon recover had just revived the moment the oneshot exited (observed live: recover ok at 22:13:40, process gone by 22:13:42). The generated watchdog unit now sets KillMode=process.
Why: auto-recovery must leave the recovered service running.
Evidence: test_watchdog_print_plan asserts KillMode=process; suite 10/10 + make test-governance rerun on the task card; live host re-demo after merge.
Impact: scripts/svc.sh wd_service_text + one test assertion.
Why: systemd's default KillMode=control-group kills every process in
the unit's cgroup when the oneshot finishes -- the daemon recover just
started died seconds after the recover ok event (observed live on the
host: revived at 22:13:40, gone by 22:13:42).
Evidence: unit text now carries KillMode=process (asserted in
test_watchdog_print_plan); suite 10/10 and make test-governance rerun
recorded on the card; live re-demo on the host after merge.
Impact: scripts/svc.sh wd_service_text only.
Refs: .task/feature-svc-autorecover.md
Why: include the current integration baseline before verification.
Evidence: fetched origin/main=77391479a0645f06b631bc64ac9e55554f7e4f4e.
Impact: integrate upstream changes without rewriting task history.
Refs: task-sync
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Follow-up to #396/#400: systemd oneshot units default to KillMode=control-group, which killed the daemon recover had just revived the moment the oneshot exited (observed live: recover ok at 22:13:40, process gone by 22:13:42). The generated watchdog unit now sets KillMode=process.
Why: auto-recovery must leave the recovered service running.
Evidence: test_watchdog_print_plan asserts KillMode=process; suite 10/10 + make test-governance rerun on the task card; live host re-demo after merge.
Impact: scripts/svc.sh wd_service_text + one test assertion.