feat(discord): systemd user service with a supervised run; brakes exit 3 and are never retried (#1509)

QUEUE row 17, MVP iteration 2. scripts/discord-service.sh renders and installs mosaic-discord@<binding> from packages/discord/systemd/. The unit's main process is `run --supervised`, which applies the new recover policy first: a lock whose owner is gone is cleared and only the STOP written for that is removed; an operator STOP or a held binding refuses with exit 3, which RestartPreventExitStatus never retries. `recover` is also a CLI verb. First cut used ExecStartPre and looped live, since systemd honours the never-retry status only from the main process; replaced and re-verified before any message traffic. Suite 40/40, 95 node tests. Co-Authored-By: Claude Fable 5.1 <[email protected]>
2026-09-13 14:39:11 -05:00
parent dc5902aafd
commit 436ba6ed6b
15 changed files with 630 additions and 30 deletions
@@ -0,0 +1,35 @@
+# Mosaic Discord connector, one instance per binding: mosaic-discord@<binding>.
+# Rendered by scripts/discord-service.sh from packages/discord/systemd/;
+# @REPO@ and @PATH@ are filled in at install time. Edit the template and
+# reinstall; do not edit the installed copy.
+[Unit]
+Description=Mosaic Discord connector (%i)
+Documentation=file://@REPO@/packages/discord/README.md
+After=network-online.target
+Wants=network-online.target
+StartLimitIntervalSec=600
+StartLimitBurst=5
+
+[Service]
+Type=simple
+WorkingDirectory=@REPO@
+Environment=PATH=@PATH@
+# A supervised run first clears a lock left by a crash or a reboot, and
+# refuses with exit 3 while STOP is present or the binding is held. Exit 3
+# is never retried: the brake belongs to the operator. This happens inside
+# the main process on purpose: systemd honours RestartPreventExitStatus only
+# for the main process, so a refusing ExecStartPre would loop.
+ExecStart=@REPO@/scripts/discord.sh run %i --supervised
+Restart=on-failure
+RestartSec=15
+RestartPreventExitStatus=3
+# `systemctl --user stop` sends SIGTERM; the connector finishes the turn in
+# flight, then exits 0. The stop timeout covers the largest turn timeout a
+# binding may set (3600 s) plus margin; a normal stop takes seconds.
+KillSignal=SIGTERM
+KillMode=mixed
+TimeoutStopSec=3700
+NoNewPrivileges=yes
+
+[Install]
+WantedBy=default.target