Audit finding. Under the shipped unit (install-linux.sh: Restart=always, default KillMode=control-group), the launcher's exit at handover kills app+gateway with it — 'the running stack … outlives the handover' (main.go:398-399) is false there. Bookkeeping stays sound (dead pids → records dropped, clean restart brings up the new version), but it is a brief stack outage the code comment denies, and a longer one than needed.
Decide: accept + fix the comment and document the blip; or KillMode=process (children survive, new launcher adopts) with the tradeoffs thought through (orphan risk if the relaunch fails).
Status (re-triaged 2026-08-28)
Narrowed by v0.9.26 (underSystemd now requires the cgroup to name smartbrain.service, so GNOME sessions never take this branch). Still true for real headless units: installer/install-linux.sh writes Restart=always with no KillMode=, so the default control-group kill takes the app and gateway down with the launcher on a self-update; the comment in main.go claiming the stack outlives the handover is false there. Maintainer-side release seam; input welcome on the orphan risk of KillMode=process.
Done means: Either KillMode=process ships with the failed-relaunch orphan case reasoned through, or the comment is corrected and the brief blip is documented in the headless docs.
Audit finding. Under the shipped unit (install-linux.sh: Restart=always, default KillMode=control-group), the launcher's exit at handover kills app+gateway with it — 'the running stack … outlives the handover' (main.go:398-399) is false there. Bookkeeping stays sound (dead pids → records dropped, clean restart brings up the new version), but it is a brief stack outage the code comment denies, and a longer one than needed.
Decide: accept + fix the comment and document the blip; or KillMode=process (children survive, new launcher adopts) with the tradeoffs thought through (orphan risk if the relaunch fails).
Status (re-triaged 2026-08-28)
Narrowed by v0.9.26 (
underSystemdnow requires the cgroup to name smartbrain.service, so GNOME sessions never take this branch). Still true for real headless units:installer/install-linux.shwritesRestart=alwayswith noKillMode=, so the default control-group kill takes the app and gateway down with the launcher on a self-update; the comment in main.go claiming the stack outlives the handover is false there. Maintainer-side release seam; input welcome on the orphan risk ofKillMode=process.Done means: Either
KillMode=processships with the failed-relaunch orphan case reasoned through, or the comment is corrected and the brief blip is documented in the headless docs.