[Unit]
Description=Heal a wedged partner-edge subsystem (bounded, verified, escalating)
After=network.target docker.service
Requires=docker.service

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/oxpulse-partner-edge-selfheal
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=7
# A CONTAINER restart's outcome is verified on the NEXT tick, never waited for
# inline: a container needs start_period + interval*retries (~2 min on this
# stack) to leave `starting`, so an inline wait would make a 60s oneshot run for
# minutes and overlap its own timer.
#
# The systemd and disk healers cannot be async in the same way — `systemctl
# restart` on a Type=oneshot BLOCKS until that unit finishes, and a docker prune
# runs as long as it runs. Both are individually bounded (`timeout 60` / `120`)
# and the script caps itself at OXPULSE_SELFHEAL_ACTS_PER_TICK systemd actions
# per tick, so the worst case is roughly 2*60s + 2*120s plus inspects. 600s
# leaves headroom; being killed mid-prune would leave the run unrecorded.
TimeoutStartSec=600