watchdog: the shared-host start guard runs before the thermal stop, so a failing guard leaves a hot miner running #665

What's the problem

watchdog() calls _shared_host_start_guard straight after parse_config (rigforge.sh:4852 at #664's head), before any of its branches: the thermal-hold lift, the thermal stop at :4882 and the wedge restart.

On a shared_host rig, the guard calls error and exits when the loaded miner unit is out of profile (util/shared-host.sh:234-242). That happens when the profile marker is missing, when the slice or the ExecStartPre check differs, or when systemctl show fails. Two ways to get there:

• shared_host was added to config.json and apply has not run yet.
• A transient systemctl show failure.

Every watchdog tick then exits before it reaches the thermal check, so a running miner above max_temp_c is never stopped. The guard exists to refuse starts, but it also blocks the stop path.

What it impacts

Shared-host rigs with max_temp_c set. While the guard keeps failing, the over-temperature cutoff and the wedge recovery do nothing, and every tick only logs the guard error.

How I found it

Found in the adversarial review of the develop-v1.19.0 fold-back (#664) and confirmed by a second reviewer reading the merged lines. The ordering comes from the shared-host profile (#611) on the 1.19.0 branch, not from the merge. Neither the watchdog's #631 retry changes nor the tests/test-shared-host*.sh tests cover this case.

How important is it

Should-fix before 1.19.0 ships. The trigger is narrow, but it disables a safety cutoff without anyone noticing.

Acceptance criteria

• With shared_host: true, max_temp_c set, an out-of-profile loaded unit and a temperature above max_temp_c, a watchdog tick stops the miner and records the thermal hold.
• With the same rig in thermal hold and the unit still out of profile, the hold-lift start is refused with the guard's message and the hold is kept.
• A test covers both cases.

Possible solutions

• Call _shared_host_start_guard only immediately before the two systemctl start calls in the hold-lift branches, and decide whether the wedge restart also needs it. Never call it ahead of the stop.
• Alternatively, have the guard return non-zero instead of calling error, and let watchdog() skip only the start actions when it fails.

🤖 Generated with Claude Code