docs(platform): design self-host stack supervision — keep pgid, decline Quadlet (RIG-3239)

docs/designs/DECISIONS.md

@@ -298,6 +298,7 @@ check enforces the mechanical half. Full rationale:
 | DL-319 | The Compass native app is DUAL-MODE again: `mode="embedded"` returns as the low-friction onboarding / local-dev front door — the app spawns/supervises a LOCAL stack via rootless podman on the user's own machine (macOS via podman machine, Linux native; Windows/WSL deferred) — ADDED ALONGSIDE the fully-surviving client mode, which stays first-class and is the RECOMMENDED steady-state for real self-host (always-on VPS/EC2 running `compass-stack up`, reached over TLS). Rationale is the trust model (DL-318): single-tenant operator-own-code needs no KVM isolation; podman is a permanent supported tier (microVM recommended where the host has KVM). Supersedes DL-235 (the "client is the ONLY mode" thesis — the exclusivity dies, the client surface survives whole) and the app-never-spawns half of DL-236 (whose standalone-`compass-stack` half stays Active and load-bearing); restores the dual-mode SHAPE of DL-106 by citation, and partial-supersedes DL-259's KVM-floor clause by citation (funnel entry 2's podman tier runs on a KVM-absent VPS) | Active (Matt, 2026-09-01) | [embedded-revival §A1](ui/compass-native-embedded-revival/design.md#a1--mode-selection-contract-dual-mode-returns-embedded-is-the-onboarding-default) |
 | DL-320 | app.toml is dual-mode: absent → embedded (the zero-config onboarding default returns); `mode="embedded"` accepts no server_url/ca_cert; `mode="client"` keeps the built contract (https-only server_url required, optional ca_cert, keychain-first bearer per DL-109); the `--mode`/`$COMPASS_APP_MODE` override returns (flag > env > file > default). Graduation embedded→client is a config edit documented in the self-host doc, not an in-app flow. Supersedes DL-237 | Active (Matt, 2026-09-01) | [embedded-revival §A1](ui/compass-native-embedded-revival/design.md#a1--mode-selection-contract-dual-mode-returns-embedded-is-the-onboarding-default) |
 | DL-321 | The app bundle carries embedded's sidecars again — `bin/{compass-app,compass-stack,compass-server,compass-runner}` + dist, PATH-threaded (DL-215's mechanism restored by citation) — but NO postgres tooling and no `compass-postgres` sidecar: the embedded stack's postgres is the DL-260 stock `postgres:18` container via rootless podman (the CLI's own default), leaving rootless podman (plus podman machine on macOS) as the packaged embedded mode's sole container prerequisite. DL-217 STAYS superseded. macOS stages the same four binaries in `Contents/MacOS/`. Supersedes DL-238 | Active (Matt, 2026-09-01) | [embedded-revival §A4](ui/compass-native-embedded-revival/design.md#a4--bundle-re-scope-sidecars-return-postgres-stays-a-container) |
+| DL-328 | Self-host stack supervision KEEPS the hand-rolled DL-183/DL-262 pgid mechanism as the SINGLE cross-platform supervision model; per-service Podman Quadlet units are NOT adopted (Linux/systemd-only, so Quadlet structurally fails the ruled all-platforms bar AND the pgid path survives regardless — two models vs one; the imperative cold sequence would need oneshot pre-units + sdnotify re-plumbing; per-service units displace the DL-259-named `compass-stack up` verb). Whole-stack CRASH RECOVERY ships as a blocking `compass-stack up --supervise` foreground mode (up-to-Ready, watch children, non-zero exit on child death, teardown on signal) wrapped by the platform-native OS supervisor's restart policy, plus a one-command `compass-stack service install`/`uninstall` that writes + enables the native unit — systemd USER unit (`Type=exec`, `Restart=on-failure`, `TimeoutStopSec>=90`) on Linux, launchd LaunchAgent (`RunAtLoad`, `KeepAlive={SuccessfulExit=false}`, `ExitTimeOut>=90`) on macOS — auto-start at reboot + restart-on-crash; the OS supervisor supplies ONLY restart/backoff/boot-start (DL-183 spawn/teardown unchanged), status truth stays `compass-stack status`. Docker-socket declined at the stack layer (daemon model vs the rootless/no-daemon hard requirement; no per-container keep-id equivalent) | Active (Matt, 2026-09-04) | [stack supervision §Approach](platform/compass-stack-supervision/design.md#approach) |
 
 ## Agent batteries