Simplify dependency checking logic.
[oweals/dinit.git] / src / service.cc
index 25b62948cf51b6cc4c70f54a5a61c64ec0a6d6e2..8ae77e06a3045bf645d507c2809932fd912c119d 100644 (file)
@@ -17,6 +17,7 @@
 #include "service.h"
 #include "dinit-log.h"
 #include "dinit-socket.h"
+#include "dinit-util.h"
 
 /*
  * service.cc - Service management.
 // from dinit.cc:
 void open_control_socket(bool report_ro_failure = true) noexcept;
 void setup_external_log() noexcept;
-extern EventLoop_t eventLoop;
+extern eventloop_t eventLoop;
 
 // Find the requested service by name
-static ServiceRecord * find_service(const std::list<ServiceRecord *> & records,
+static service_record * find_service(const std::list<service_record *> & records,
                                     const char *name) noexcept
 {
     using std::list;
-    list<ServiceRecord *>::const_iterator i = records.begin();
+    list<service_record *>::const_iterator i = records.begin();
     for ( ; i != records.end(); i++ ) {
-        if (strcmp((*i)->getServiceName().c_str(), name) == 0) {
+        if (strcmp((*i)->get_service_name().c_str(), name) == 0) {
             return *i;
         }
     }
-    return (ServiceRecord *)0;
+    return nullptr;
 }
 
-ServiceRecord * ServiceSet::find_service(const std::string &name) noexcept
+service_record * service_set::find_service(const std::string &name) noexcept
 {
     return ::find_service(records, name.c_str());
 }
 
-void ServiceSet::startService(const char *name)
+void service_set::stop_service(const std::string & name) noexcept
 {
-    using namespace std;
-    ServiceRecord *record = loadServiceRecord(name);
-    
-    record->start();
-    processQueues(true);
-}
-
-void ServiceSet::stopService(const std::string & name) noexcept
-{
-    ServiceRecord *record = find_service(name);
+    service_record *record = find_service(name);
     if (record != nullptr) {
         record->stop();
-        processQueues(false);
+        process_queues();
     }
 }
 
-// Called when a service has actually stopped; dependents have stopped already.
-void ServiceRecord::stopped() noexcept
+// Called when a service has actually stopped; dependents have stopped already, unless this stop
+// is due to an unexpected process termination.
+void service_record::stopped() noexcept
 {
-    if (service_type != ServiceType::SCRIPTED && service_type != ServiceType::BGPROCESS && onstart_flags.runs_on_console) {
+    if (onstart_flags.runs_on_console) {
         tcsetpgrp(0, getpgrp());
         discard_console_log_buffer();
-        releaseConsole();
+        release_console();
     }
 
     force_stop = false;
 
     // If we are a soft dependency of another target, break the acquisition from that target now:
-    bool will_restart = (desired_state == ServiceState::STARTED) && service_set->get_auto_restart();
-    if (! will_restart) {
-        for (auto dependency : soft_dpts) {
-            if (dependency->holding_acq) {
-                dependency->holding_acq = false;
+    for (auto & dependent : dependents) {
+        if (dependent->dep_type == dependency_type::SOFT) {
+            if (dependent->holding_acq) {
+                dependent->holding_acq = false;
                 release();
             }
         }
     }
 
-    will_restart &= (desired_state == ServiceState::STARTED);
+    bool will_restart = (desired_state == service_state_t::STARTED)
+            && services->get_auto_restart();
+
     for (auto dependency : depends_on) {
-        if (! will_restart || ! dependency->can_interrupt_stop()) {
-            dependency->dependentStopped();
-        }
+        // we signal dependencies in case they are waiting for us to stop:
+        dependency.get_to()->dependent_stopped();
     }
 
+    service_state = service_state_t::STOPPED;
+
     if (will_restart) {
         // Desired state is "started".
-        service_state = ServiceState::STOPPED;
-        service_set->addToStartQueue(this);
+        restarting = true;
+        start(false);
     }
     else {
         if (socket_fd != -1) {
@@ -109,22 +104,18 @@ void ServiceRecord::stopped() noexcept
             start_explicit = false;
             release();
         }
-        
-        service_state = ServiceState::STOPPED;
-        if (required_by == 0) {
-            // Since state wasn't STOPPED until now, any release performed above won't have marked
-            // the service inactive. We check for that now:
-            service_set->service_inactive(this);
+        else if (required_by == 0) {
+            services->service_inactive(this);
         }
     }
 
-    logServiceStopped(service_name);
-    notifyListeners(ServiceEvent::STOPPED);
+    log_service_stopped(service_name);
+    notify_listeners(service_event::STOPPED);
 }
 
-dasynq::rearm ServiceChildWatcher::child_status(EventLoop_t &loop, pid_t child, int status) noexcept
+dasynq::rearm service_child_watcher::status_change(eventloop_t &loop, pid_t child, int status) noexcept
 {
-    ServiceRecord *sr = service;
+    base_process_service *sr = service;
     
     sr->pid = -1;
     sr->exit_status = status;
@@ -137,44 +128,59 @@ dasynq::rearm ServiceChildWatcher::child_status(EventLoop_t &loop, pid_t child,
     if (sr->waiting_for_execstat) {
         // We still don't have an exec() status from the forked child, wait for that
         // before doing any further processing.
-        return rearm::REMOVE;
+        return rearm::NOOP; // hold watch reservation
     }
     
-    // Must deregister now since handle_exit_status might result in re-launch:
-    deregister(loop, child);
+    // Must stop watch now since handle_exit_status might result in re-launch:
+    // (stop_watch instead of deregister, so that we hold watch reservation).
+    stop_watch(loop);
     
+    if (sr->stop_timer_armed) {
+        sr->restart_timer.stop_timer(loop);
+        sr->stop_timer_armed = false;
+    }
+
     sr->handle_exit_status(status);
-    return rearm::REMOVED;
+    return rearm::NOOP;
 }
 
-bool ServiceRecord::do_auto_restart() noexcept
+bool service_record::do_auto_restart() noexcept
 {
     if (auto_restart) {
-        return service_set->get_auto_restart();
+        return services->get_auto_restart();
     }
     return false;
 }
 
-void ServiceRecord::handle_exit_status(int exit_status) noexcept
+void service_record::emergency_stop() noexcept
 {
-    // TODO make abstract
+    if (! do_auto_restart() && start_explicit) {
+        start_explicit = false;
+        release();
+    }
+    forced_stop();
+    stop_dependents();
+    stopped();
 }
 
 void process_service::handle_exit_status(int exit_status) noexcept
 {
     bool did_exit = WIFEXITED(exit_status);
     bool was_signalled = WIFSIGNALED(exit_status);
+    restarting = false;
 
-    if (exit_status != 0 && service_state != ServiceState::STOPPING) {
+    if (exit_status != 0 && service_state != service_state_t::STOPPING) {
         if (did_exit) {
-            log(LogLevel::ERROR, "Service ", service_name, " process terminated with exit code ", WEXITSTATUS(exit_status));
+            log(loglevel_t::ERROR, "Service ", service_name, " process terminated with exit code ",
+                    WEXITSTATUS(exit_status));
         }
         else if (was_signalled) {
-            log(LogLevel::ERROR, "Service ", service_name, " terminated due to signal ", WTERMSIG(exit_status));
+            log(loglevel_t::ERROR, "Service ", service_name, " terminated due to signal ",
+                    WTERMSIG(exit_status));
         }
     }
 
-    if (service_state == ServiceState::STARTING) {
+    if (service_state == service_state_t::STARTING) {
         if (did_exit && WEXITSTATUS(exit_status) == 0) {
             started();
         }
@@ -182,95 +188,125 @@ void process_service::handle_exit_status(int exit_status) noexcept
             failed_to_start();
         }
     }
-    else if (service_state == ServiceState::STOPPING) {
+    else if (service_state == service_state_t::STOPPING) {
         // We won't log a non-zero exit status or termination due to signal here -
         // we assume that the process died because we signalled it.
         stopped();
     }
-    else if (smooth_recovery && service_state == ServiceState::STARTED && desired_state == ServiceState::STARTED) {
-        // TODO ensure a minimum time between restarts
-        // TODO if we are pinned-started then we should probably check
-        //      that dependencies have started before trying to re-start the
-        //      service process.
-        start_ps_process();
+    else if (smooth_recovery && service_state == service_state_t::STARTED
+            && desired_state == service_state_t::STARTED) {
+        do_smooth_recovery();
         return;
     }
     else {
-        if (! do_auto_restart()) desired_state = ServiceState::STOPPED;
-        forceStop();
+        emergency_stop();
+    }
+    services->process_queues();
+}
+
+void base_process_service::do_smooth_recovery() noexcept
+{
+    if (! restart_ps_process()) {
+        emergency_stop();
+        services->process_queues();
     }
-    service_set->processQueues(false);
 }
 
 void bgproc_service::handle_exit_status(int exit_status) noexcept
 {
+    begin:
     bool did_exit = WIFEXITED(exit_status);
     bool was_signalled = WIFSIGNALED(exit_status);
 
-    if (exit_status != 0 && service_state != ServiceState::STOPPING) {
+    if (exit_status != 0 && service_state != service_state_t::STOPPING) {
         if (did_exit) {
-            log(LogLevel::ERROR, "Service ", service_name, " process terminated with exit code ", WEXITSTATUS(exit_status));
+            log(loglevel_t::ERROR, "Service ", service_name, " process terminated with exit code ",
+                    WEXITSTATUS(exit_status));
         }
         else if (was_signalled) {
-            log(LogLevel::ERROR, "Service ", service_name, " terminated due to signal ", WTERMSIG(exit_status));
+            log(loglevel_t::ERROR, "Service ", service_name, " terminated due to signal ",
+                    WTERMSIG(exit_status));
         }
     }
 
-    if (doing_recovery) {
-        // (BGPROCESS only)
-        doing_recovery = false;
+    // This may be a "smooth recovery" where we are restarting the process while leaving the
+    // service in the STARTED state.
+    if (restarting && service_state == service_state_t::STARTED) {
+        restarting = false;
         bool need_stop = false;
         if ((did_exit && WEXITSTATUS(exit_status) != 0) || was_signalled) {
             need_stop = true;
         }
         else {
             // We need to re-read the PID, since it has now changed.
-            if (service_type == ServiceType::BGPROCESS && pid_file.length() != 0) {
-                if (! read_pid_file()) {
-                    need_stop = true;
+            if (pid_file.length() != 0) {
+                auto pid_result = read_pid_file(&exit_status);
+                switch (pid_result) {
+                    case pid_result_t::FAILED:
+                        // Failed startup: no auto-restart.
+                        need_stop = true;
+                        break;
+                    case pid_result_t::TERMINATED:
+                        goto begin;
+                    case pid_result_t::OK:
+                        break;
                 }
             }
         }
 
         if (need_stop) {
             // Failed startup: no auto-restart.
-            desired_state = ServiceState::STOPPED;
-            forceStop();
-            service_set->processQueues(false);
+            emergency_stop();
+            services->process_queues();
         }
 
         return;
     }
 
-    if (service_state == ServiceState::STARTING) {
+    restarting = false;
+    if (service_state == service_state_t::STARTING) {
         // POSIX requires that if the process exited clearly with a status code of 0,
         // the exit status value will be 0:
         if (exit_status == 0) {
-            started();
+            auto pid_result = read_pid_file(&exit_status);
+            switch (pid_result) {
+                case pid_result_t::FAILED:
+                    // Failed startup: no auto-restart.
+                    failed_to_start();
+                    break;
+                case pid_result_t::TERMINATED:
+                    // started, but immediately terminated
+                    started();
+                    goto begin;
+                case pid_result_t::OK:
+                    started();
+                    break;
+            }
         }
         else {
             failed_to_start();
         }
     }
-    else if (service_state == ServiceState::STOPPING) {
+    else if (service_state == service_state_t::STOPPING) {
         // We won't log a non-zero exit status or termination due to signal here -
         // we assume that the process died because we signalled it.
         stopped();
     }
-    else if (smooth_recovery && service_state == ServiceState::STARTED && desired_state == ServiceState::STARTED) {
-        // TODO ensure a minimum time between restarts
-        // TODO if we are pinned-started then we should probably check
-        //      that dependencies have started before trying to re-start the
-        //      service process.
-        doing_recovery = true;
-        start_ps_process();
+    else if (smooth_recovery && service_state == service_state_t::STARTED && desired_state == service_state_t::STARTED) {
+        do_smooth_recovery();
         return;
     }
     else {
-        if (! do_auto_restart()) desired_state = ServiceState::STOPPED;
-        forceStop();
+        // we must be STARTED
+        if (! do_auto_restart() && start_explicit) {
+            start_explicit = false;
+            release();
+        }
+        forced_stop();
+        stop_dependents();
+        stopped();
     }
-    service_set->processQueues(false);
+    services->process_queues();
 }
 
 void scripted_service::handle_exit_status(int exit_status) noexcept
@@ -278,23 +314,25 @@ void scripted_service::handle_exit_status(int exit_status) noexcept
     bool did_exit = WIFEXITED(exit_status);
     bool was_signalled = WIFSIGNALED(exit_status);
 
-    if (service_state == ServiceState::STOPPING) {
+    if (service_state == service_state_t::STOPPING) {
         if (did_exit && WEXITSTATUS(exit_status) == 0) {
             stopped();
         }
         else {
             // ??? failed to stop! Let's log it as info:
             if (did_exit) {
-                log(LogLevel::INFO, "Service ", service_name, " stop command failed with exit code ", WEXITSTATUS(exit_status));
+                log(loglevel_t::INFO, "Service ", service_name, " stop command failed with exit code ",
+                        WEXITSTATUS(exit_status));
             }
             else if (was_signalled) {
-                log(LogLevel::INFO, "Serivice ", service_name, " stop command terminated due to signal ", WTERMSIG(exit_status));
+                log(loglevel_t::INFO, "Serivice ", service_name, " stop command terminated due to signal ",
+                        WTERMSIG(exit_status));
             }
             // Just assume that we stopped, so that any dependencies
             // can be stopped:
             stopped();
         }
-        service_set->processQueues(false);
+        services->process_queues();
     }
     else { // STARTING
         if (exit_status == 0) {
@@ -303,20 +341,22 @@ void scripted_service::handle_exit_status(int exit_status) noexcept
         else {
             // failed to start
             if (did_exit) {
-                log(LogLevel::ERROR, "Service ", service_name, " command failed with exit code ", WEXITSTATUS(exit_status));
+                log(loglevel_t::ERROR, "Service ", service_name, " command failed with exit code ",
+                        WEXITSTATUS(exit_status));
             }
             else if (was_signalled) {
-                log(LogLevel::ERROR, "Service ", service_name, " command terminated due to signal ", WTERMSIG(exit_status));
+                log(loglevel_t::ERROR, "Service ", service_name, " command terminated due to signal ",
+                        WTERMSIG(exit_status));
             }
             failed_to_start();
         }
-        service_set->processQueues(true);
+        services->process_queues();
     }
 }
 
-rearm ServiceIoWatcher::fd_event(EventLoop_t &loop, int fd, int flags) noexcept
+rearm exec_status_pipe_watcher::fd_event(eventloop_t &loop, int fd, int flags) noexcept
 {
-    ServiceRecord *sr = service;
+    base_process_service *sr = service;
     sr->waiting_for_execstat = false;
     
     int exec_status;
@@ -326,12 +366,20 @@ rearm ServiceIoWatcher::fd_event(EventLoop_t &loop, int fd, int flags) noexcept
     
     if (r > 0) {
         // We read an errno code; exec() failed, and the service startup failed.
+        if (sr->pid != -1) {
+            sr->child_listener.deregister(eventLoop, sr->pid);
+            sr->reserved_child_watch = false;
+            if (sr->stop_timer_armed) {
+                sr->restart_timer.stop_timer(loop);
+                sr->stop_timer_armed = false;
+            }
+        }
         sr->pid = -1;
-        log(LogLevel::ERROR, sr->service_name, ": execution failed: ", strerror(exec_status));
-        if (sr->service_state == ServiceState::STARTING) {
+        log(loglevel_t::ERROR, sr->service_name, ": execution failed: ", strerror(exec_status));
+        if (sr->service_state == service_state_t::STARTING) {
             sr->failed_to_start();
         }
-        else if (sr->service_state == ServiceState::STOPPING) {
+        else if (sr->service_state == service_state_t::STOPPING) {
             // Must be a scripted service. We've logged the failure, but it's probably better
             // not to leave the service in STARTED state:
             sr->stopped();
@@ -339,11 +387,11 @@ rearm ServiceIoWatcher::fd_event(EventLoop_t &loop, int fd, int flags) noexcept
     }
     else {
         // exec() succeeded.
-        if (sr->service_type == ServiceType::PROCESS) {
+        if (sr->record_type == service_type::PROCESS) {
             // This could be a smooth recovery (state already STARTED). Even more, the process
             // might be stopped (and killed via a signal) during smooth recovery.  We don't to
             // process startup again in either case, so we check for state STARTING:
-            if (sr->service_state == ServiceState::STARTING) {
+            if (sr->service_state == service_state_t::STARTING) {
                 sr->started();
             }
         }
@@ -354,87 +402,94 @@ rearm ServiceIoWatcher::fd_event(EventLoop_t &loop, int fd, int flags) noexcept
         }
     }
     
-    sr->service_set->processQueues(true);
+    sr->services->process_queues();
     
     return rearm::REMOVED;
 }
 
-void ServiceRecord::require() noexcept
+void service_record::require() noexcept
 {
     if (required_by++ == 0) {
-        
-        if (! prop_require) {
-            prop_require = true;
-            prop_release = false;
-            service_set->addToPropQueue(this);
-        }
-        
-        if (service_state == ServiceState::STOPPED) {
-            // (In any other state, the service is already considered active.)
-            service_set->service_active(this);
-        }
+        prop_require = !prop_release;
+        prop_release = false;
+        services->add_prop_queue(this);
     }
 }
 
-void ServiceRecord::release() noexcept
+void service_record::release() noexcept
 {
     if (--required_by == 0) {
-        desired_state = ServiceState::STOPPED;
-        // Can stop, and can release dependencies now:
-        prop_release = true;
+        desired_state = service_state_t::STOPPED;
+
+        // Can stop, and can release dependencies now. We don't need to issue a release if
+        // the require was pending though:
+        prop_release = !prop_require;
         prop_require = false;
-        service_set->addToPropQueue(this);
-        if (service_state != ServiceState::STOPPED) {
-            service_set->addToStopQueue(this);
+        services->add_prop_queue(this);
+
+        if (service_state == service_state_t::STOPPED) {
+            services->service_inactive(this);
         }
         else {
-            service_set->service_inactive(this);
+            do_stop();
         }
     }
 }
 
-void ServiceRecord::release_dependencies() noexcept
+void service_record::release_dependencies() noexcept
 {
-    for (sr_iter i = depends_on.begin(); i != depends_on.end(); ++i) {
-        (*i)->release();
-    }
-
-    for (auto i = soft_deps.begin(); i != soft_deps.end(); ++i) {
-        ServiceRecord * to = i->getTo();
-        if (i->holding_acq) {
-            to->release();
-            i->holding_acq = false;
+    for (auto & dependency : depends_on) {
+        service_record * dep_to = dependency.get_to();
+        if (dependency.holding_acq) {
+            dep_to->release();
+            dependency.holding_acq = false;
         }
     }
 }
 
-void ServiceRecord::start(bool activate) noexcept
+void service_record::start(bool activate) noexcept
 {
     if (activate && ! start_explicit) {
         require();
         start_explicit = true;
     }
     
-    if (desired_state == ServiceState::STARTED && service_state != ServiceState::STOPPED) return;
+    if (desired_state == service_state_t::STARTED && service_state != service_state_t::STOPPED) return;
+
+    bool was_active = service_state != service_state_t::STOPPED || desired_state != service_state_t::STOPPED;
+    desired_state = service_state_t::STARTED;
     
-    desired_state = ServiceState::STARTED;
-    service_set->addToStartQueue(this);
+    if (service_state != service_state_t::STOPPED) {
+        // We're already starting/started, or we are stopping and need to wait for
+        // that the complete.
+        if (service_state != service_state_t::STOPPING || ! can_interrupt_stop()) {
+            return;
+        }
+        // We're STOPPING, and that can be interrupted. Our dependencies might be STOPPING,
+        // but if so they are waiting (for us), so they too can be instantly returned to
+        // STARTING state.
+        notify_listeners(service_event::STOPCANCELLED);
+    }
+    else if (! was_active) {
+        services->service_active(this);
+    }
+
+    service_state = service_state_t::STARTING;
+    waiting_for_deps = true;
+
+    if (start_check_dependencies()) {
+        services->add_transition_queue(this);
+    }
 }
 
-void ServiceRecord::do_propagation() noexcept
+void service_record::do_propagation() noexcept
 {
     if (prop_require) {
         // Need to require all our dependencies
-        for (sr_iter i = depends_on.begin(); i != depends_on.end(); ++i) {
-            (*i)->require();
-        }
-
-        for (auto i = soft_deps.begin(); i != soft_deps.end(); ++i) {
-            ServiceRecord * to = i->getTo();
-            to->require();
-            i->holding_acq = true;
+        for (auto & dep : depends_on) {
+            dep.get_to()->require();
+            dep.holding_acq = true;
         }
-        
         prop_require = false;
     }
     
@@ -448,119 +503,92 @@ void ServiceRecord::do_propagation() noexcept
         failed_to_start(true);
     }
     
-    if (waiting_for_deps) {
-        if (service_state == ServiceState::STARTING) {
-            if (startCheckDependencies(false)) {
-                allDepsStarted();
-            }
-        }
-        else if (service_state == ServiceState::STOPPING) {
-            if (stopCheckDependents()) {
-                allDepsStopped();
-            }
-        }
+    if (prop_start) {
+        prop_start = false;
+        start(false);
+    }
+
+    if (prop_stop) {
+        prop_stop = false;
+        do_stop();
     }
 }
 
-void ServiceRecord::execute_transition() noexcept
+void service_record::execute_transition() noexcept
 {
-    bool is_started = (service_state == ServiceState::STARTED)
-            || (service_state == ServiceState::STARTING && can_interrupt_start());
-    bool is_stopped = (service_state == ServiceState::STOPPED)
-            || (service_state == ServiceState::STOPPING && can_interrupt_stop());
-
-    if (is_started && (desired_state == ServiceState::STOPPED || force_stop)) {
-        if (! pinned_started) {
-            do_stop();
+    // state is STARTED with restarting set true if we are running a smooth recovery.
+    if (service_state == service_state_t::STARTING || (service_state == service_state_t::STARTED
+            && restarting)) {
+        if (check_deps_started()) {
+            bool have_console = service_state == service_state_t::STARTED && onstart_flags.runs_on_console;
+            all_deps_started(have_console);
         }
     }
-    else if (is_stopped && desired_state == ServiceState::STARTED) {
-        if (! pinned_stopped) {
-            do_start();
+    else if (service_state == service_state_t::STOPPING) {
+        if (stop_check_dependents()) {
+            all_deps_stopped();
         }
     }
 }
 
-void ServiceRecord::do_start() noexcept
+void service_record::do_start() noexcept
 {
     if (pinned_stopped) return;
     
-    if (service_state != ServiceState::STOPPED) {
-        // We're already starting/started, or we are stopping and need to wait for
-        // that the complete.
-        if (service_state != ServiceState::STOPPING || ! can_interrupt_stop()) {
-            return;
-        }
-        // We're STOPPING, and that can be interrupted. Our dependencies might be STOPPING,
-        // but if so they are waiting (for us), so they too can be instantly returned to
-        // STARTING state.
-        notifyListeners(ServiceEvent::STOPCANCELLED);
+    if (service_state != service_state_t::STARTING) {
+        return;
     }
     
-    service_state = ServiceState::STARTING;
+    service_state = service_state_t::STARTING;
 
     waiting_for_deps = true;
 
     // Ask dependencies to start, mark them as being waited on.
-    if (! startCheckDependencies(true)) {
-        return;
+    if (check_deps_started()) {
+        // Once all dependencies are started, we start properly:
+        all_deps_started();
     }
-
-    // Actually start this service.
-    allDepsStarted();
 }
 
-void ServiceRecord::dependencyStarted() noexcept
+void service_record::dependencyStarted() noexcept
 {
-    if (service_state == ServiceState::STARTING && waiting_for_deps) {
-        service_set->addToPropQueue(this);
+    if ((service_state == service_state_t::STARTING || service_state == service_state_t::STARTED)
+            && waiting_for_deps) {
+        services->add_transition_queue(this);
     }
 }
 
-bool ServiceRecord::startCheckDependencies(bool start_deps) noexcept
+bool service_record::start_check_dependencies() noexcept
 {
     bool all_deps_started = true;
 
-    for (sr_iter i = depends_on.begin(); i != depends_on.end(); ++i) {
-        if ((*i)->service_state != ServiceState::STARTED) {
-            if (start_deps) {
-                all_deps_started = false;
-                (*i)->start(false);
-            }
-            else {
-                return false;
+    for (auto & dep : depends_on) {
+        service_record * to = dep.get_to();
+        if (to->service_state != service_state_t::STARTED) {
+            if (to->service_state != service_state_t::STARTING) {
+                to->prop_start = true;
+                services->add_prop_queue(to);
             }
+            dep.waiting_on = true;
+            all_deps_started = false;
         }
     }
+    
+    return all_deps_started;
+}
 
-    for (auto i = soft_deps.begin(); i != soft_deps.end(); ++i) {
-        ServiceRecord * to = i->getTo();
-        if (start_deps) {
-            if (to->service_state != ServiceState::STARTED) {
-                to->start(false);
-                i->waiting_on = true;
-                all_deps_started = false;
-            }
-            else {
-                i->waiting_on = false;
-            }
-        }
-        else if (i->waiting_on) {
-            if (to->service_state != ServiceState::STARTING) {
-                // Service has either started or is no longer starting
-                i->waiting_on = false;
-            }
-            else {
-                // We are still waiting on this service
-                return false;
-            }
+bool service_record::check_deps_started() noexcept
+{
+    for (auto & dep : depends_on) {
+        if (dep.waiting_on) {
+            return false;
         }
     }
-    
-    return all_deps_started;
+
+    return true;
 }
 
-bool ServiceRecord::open_socket() noexcept
+bool service_record::open_socket() noexcept
 {
     if (socket_path.empty() || socket_fd != -1) {
         // No socket, or already open
@@ -568,29 +596,46 @@ bool ServiceRecord::open_socket() noexcept
     }
     
     const char * saddrname = socket_path.c_str();
-    uint sockaddr_size = offsetof(struct sockaddr_un, sun_path) + socket_path.length() + 1;
+    
+    // Check the specified socket path
+    struct stat stat_buf;
+    if (stat(saddrname, &stat_buf) == 0) {
+        if ((stat_buf.st_mode & S_IFSOCK) == 0) {
+            // Not a socket
+            log(loglevel_t::ERROR, service_name, ": Activation socket file exists (and is not a socket)");
+            return false;
+        }
+    }
+    else if (errno != ENOENT) {
+        // Other error
+        log(loglevel_t::ERROR, service_name, ": Error checking activation socket: ", strerror(errno));
+        return false;
+    }
+
+    // Remove stale socket file (if it exists).
+    // We won't test the return from unlink - if it fails other than due to ENOENT, we should get an
+    // error when we try to create the socket anyway.
+    unlink(saddrname);
 
+    uint sockaddr_size = offsetof(struct sockaddr_un, sun_path) + socket_path.length() + 1;
     struct sockaddr_un * name = static_cast<sockaddr_un *>(malloc(sockaddr_size));
     if (name == nullptr) {
-        log(LogLevel::ERROR, service_name, ": Opening activation socket: out of memory");
+        log(loglevel_t::ERROR, service_name, ": Opening activation socket: out of memory");
         return false;
     }
-    
-    // Un-link any stale socket. TODO: safety check? should at least confirm the path is a socket.
-    unlink(saddrname);
 
     name->sun_family = AF_UNIX;
     strcpy(name->sun_path, saddrname);
 
     int sockfd = dinit_socket(AF_UNIX, SOCK_STREAM, 0, SOCK_NONBLOCK | SOCK_CLOEXEC);
     if (sockfd == -1) {
-        log(LogLevel::ERROR, service_name, ": Error creating activation socket: ", strerror(errno));
+        log(loglevel_t::ERROR, service_name, ": Error creating activation socket: ", strerror(errno));
         free(name);
         return false;
     }
 
     if (bind(sockfd, (struct sockaddr *) name, sockaddr_size) == -1) {
-        log(LogLevel::ERROR, service_name, ": Error binding activation socket: ", strerror(errno));
+        log(loglevel_t::ERROR, service_name, ": Error binding activation socket: ", strerror(errno));
         close(sockfd);
         free(name);
         return false;
@@ -598,22 +643,22 @@ bool ServiceRecord::open_socket() noexcept
     
     free(name);
     
-    // POSIX (1003.1, 2013) says that fchown and fchmod don't necesarily work on sockets. We have to
+    // POSIX (1003.1, 2013) says that fchown and fchmod don't necessarily work on sockets. We have to
     // use chown and chmod instead.
     if (chown(saddrname, socket_uid, socket_gid)) {
-        log(LogLevel::ERROR, service_name, ": Error setting activation socket owner/group: ", strerror(errno));
+        log(loglevel_t::ERROR, service_name, ": Error setting activation socket owner/group: ", strerror(errno));
         close(sockfd);
         return false;
     }
     
     if (chmod(saddrname, socket_perms) == -1) {
-        log(LogLevel::ERROR, service_name, ": Error setting activation socket permissions: ", strerror(errno));
+        log(loglevel_t::ERROR, service_name, ": Error setting activation socket permissions: ", strerror(errno));
         close(sockfd);
         return false;
     }
 
     if (listen(sockfd, 128) == -1) { // 128 "seems reasonable".
-        log(LogLevel::ERROR, ": Error listening on activation socket: ", strerror(errno));
+        log(loglevel_t::ERROR, ": Error listening on activation socket: ", strerror(errno));
         close(sockfd);
         return false;
     }
@@ -622,94 +667,127 @@ bool ServiceRecord::open_socket() noexcept
     return true;
 }
 
-void ServiceRecord::allDepsStarted(bool has_console) noexcept
+void service_record::all_deps_started(bool has_console) noexcept
 {
-    if (onstart_flags.runs_on_console && ! has_console) {
+    if (onstart_flags.starts_on_console && ! has_console) {
         waiting_for_deps = true;
-        queueForConsole();
+        queue_for_console();
         return;
     }
     
     waiting_for_deps = false;
 
+    // We overload can_interrupt_start to check whether there is any other
+    // process (eg restart timer) that needs to finish before starting.
+    if (can_interrupt_start()) {
+        waiting_for_deps = true;
+        return;
+    }
+
     if (! open_socket()) {
         failed_to_start();
     }
 
-    if (service_type == ServiceType::PROCESS || service_type == ServiceType::BGPROCESS
-            || service_type == ServiceType::SCRIPTED) {
-        bool start_success = start_ps_process();
-        if (! start_success) {
-            failed_to_start();
-        }
-    }
-    else {
-        // "internal" service
-        started();
+    bool start_success = start_ps_process();
+    if (! start_success) {
+        failed_to_start();
     }
 }
 
-void ServiceRecord::acquiredConsole() noexcept
+void service_record::acquired_console() noexcept
 {
-    if (service_state != ServiceState::STARTING) {
+    if (service_state != service_state_t::STARTING) {
         // We got the console but no longer want it.
-        releaseConsole();
+        release_console();
     }
-    else if (startCheckDependencies(false)) {
-        allDepsStarted(true);
+    else if (check_deps_started()) {
+        all_deps_started(true);
     }
     else {
         // We got the console but can't use it yet.
-        releaseConsole();
+        release_console();
     }
 }
 
-bool ServiceRecord::read_pid_file() noexcept
+bgproc_service::pid_result_t
+bgproc_service::read_pid_file(int *exit_status) noexcept
 {
     const char *pid_file_c = pid_file.c_str();
     int fd = open(pid_file_c, O_CLOEXEC);
-    if (fd != -1) {
-        char pidbuf[21]; // just enought to hold any 64-bit integer
-        int r = read(fd, pidbuf, 20);
-        if (r > 0) {
-            pidbuf[r] = 0; // store nul terminator
-            pid = std::atoi(pidbuf);
-            if (kill(pid, 0) == 0) {                
-                child_listener.add_watch(eventLoop, pid);
+    if (fd == -1) {
+        log(loglevel_t::ERROR, service_name, ": read pid file: ", strerror(errno));
+        return pid_result_t::FAILED;
+    }
+
+    char pidbuf[21]; // just enough to hold any 64-bit integer
+    int r = ss_read(fd, pidbuf, 20);
+    if (r < 0) {
+        // Could not read from PID file
+        log(loglevel_t::ERROR, service_name, ": could not read from pidfile; ", strerror(errno));
+        close(fd);
+        return pid_result_t::FAILED;
+    }
+
+    close(fd);
+    pidbuf[r] = 0; // store nul terminator
+
+    bool valid_pid = false;
+    try {
+        unsigned long long v = std::stoull(pidbuf, nullptr, 0);
+        if (v <= std::numeric_limits<pid_t>::max()) {
+            pid = (pid_t) v;
+            valid_pid = true;
+        }
+    }
+    catch (std::out_of_range &exc) {
+        // Too large?
+    }
+    catch (std::invalid_argument &exc) {
+        // Ok, so it doesn't look like a number: proceed...
+    }
+
+    if (valid_pid) {
+        pid_t wait_r = waitpid(pid, exit_status, WNOHANG);
+        if (wait_r == -1 && errno == ECHILD) {
+            // We can't track this child - check process exists:
+            if (kill(pid, 0) == 0 || errno != ESRCH) {
+                tracking_child = false;
+                return pid_result_t::OK;
             }
             else {
-                log(LogLevel::ERROR, service_name, ": pid read from pidfile (", pid, ") is not valid");
+                log(loglevel_t::ERROR, service_name, ": pid read from pidfile (", pid, ") is not valid");
                 pid = -1;
-                close(fd);
-                return false;
+                return pid_result_t::FAILED;
             }
         }
-        close(fd);
-        return true;
-    }
-    else {
-        log(LogLevel::ERROR, service_name, ": read pid file: ", strerror(errno));
-        return false;
+        else if (wait_r == pid) {
+            pid = -1;
+            return pid_result_t::TERMINATED;
+        }
+        else if (wait_r == 0) {
+            // We can track the child
+            child_listener.add_reserved(eventLoop, pid, DEFAULT_PRIORITY - 10);
+            tracking_child = true;
+            reserved_child_watch = true;
+            return pid_result_t::OK;
+        }
     }
+
+    log(loglevel_t::ERROR, service_name, ": pid read from pidfile (", pid, ") is not valid");
+    pid = -1;
+    return pid_result_t::FAILED;
 }
 
-void ServiceRecord::started() noexcept
+void service_record::started() noexcept
 {
-    if (onstart_flags.runs_on_console && (service_type == ServiceType::SCRIPTED || service_type == ServiceType::BGPROCESS)) {
+    if (onstart_flags.starts_on_console && ! onstart_flags.runs_on_console) {
         tcsetpgrp(0, getpgrp());
-        releaseConsole();
-    }
-    
-    if (service_type == ServiceType::BGPROCESS && pid_file.length() != 0) {
-        if (! read_pid_file()) {
-            failed_to_start();
-            return;
-        }
+        release_console();
     }
-    
-    logServiceStarted(service_name);
-    service_state = ServiceState::STARTED;
-    notifyListeners(ServiceEvent::STARTED);
+
+    log_service_started(service_name);
+    service_state = service_state_t::STARTED;
+    notify_listeners(service_event::STARTED);
 
     if (onstart_flags.rw_ready) {
         open_control_socket();
@@ -718,70 +796,89 @@ void ServiceRecord::started() noexcept
         setup_external_log();
     }
 
-    if (force_stop || desired_state == ServiceState::STOPPED) {
+    if (force_stop || desired_state == service_state_t::STOPPED) {
         // We must now stop.
-        service_set->addToStopQueue(this);
+        do_stop();
         return;
     }
 
     // Notify any dependents whose desired state is STARTED:
-    for (auto i = dependents.begin(); i != dependents.end(); i++) {
-        (*i)->dependencyStarted();
-    }
-    for (auto i = soft_dpts.begin(); i != soft_dpts.end(); i++) {
-        (*i)->getFrom()->dependencyStarted();
+    for (auto dept : dependents) {
+        dept->get_from()->dependencyStarted();
+        dept->waiting_on = false;
     }
 }
 
-void ServiceRecord::failed_to_start(bool depfailed) noexcept
+void service_record::failed_to_start(bool depfailed) noexcept
 {
-    if (!depfailed && onstart_flags.runs_on_console) {
+    if (!depfailed && onstart_flags.starts_on_console) {
         tcsetpgrp(0, getpgrp());
-        releaseConsole();
+        release_console();
     }
     
-    logServiceFailed(service_name);
-    service_state = ServiceState::STOPPED;
+    log_service_failed(service_name);
+    service_state = service_state_t::STOPPED;
     if (start_explicit) {
         start_explicit = false;
         release();
     }
-    notifyListeners(ServiceEvent::FAILEDSTART);
+    notify_listeners(service_event::FAILEDSTART);
     
     // Cancel start of dependents:
-    for (sr_iter i = dependents.begin(); i != dependents.end(); i++) {
-        if ((*i)->service_state == ServiceState::STARTING) {
-            (*i)->prop_failure = true;
-            service_set->addToPropQueue(*i);
-        }
-    }    
-    for (auto i = soft_dpts.begin(); i != soft_dpts.end(); i++) {
-        // We can send 'start', because this is only a soft dependency.
-        // Our startup failure means that they don't have to wait for us.
-        if ((*i)->waiting_on) {
-            (*i)->holding_acq = false;
-            (*i)->waiting_on = false;
-            (*i)->getFrom()->dependencyStarted();
-            release();
+    for (auto & dept : dependents) {
+        if (dept->dep_type == dependency_type::REGULAR) {
+            if (dept->get_from()->service_state == service_state_t::STARTING) {
+                dept->get_from()->prop_failure = true;
+                services->add_prop_queue(dept->get_from());
+            }
+        }
+        else if (dept->dep_type == dependency_type::SOFT) {
+            if (dept->waiting_on) {
+                dept->waiting_on = false;
+                dept->get_from()->dependencyStarted();
+            }
+            if (dept->holding_acq) {
+                dept->holding_acq = false;
+                release();
+            }
         }
     }
 }
 
-bool ServiceRecord::start_ps_process() noexcept
+bool service_record::start_ps_process() noexcept
 {
-    return start_ps_process(exec_arg_parts, onstart_flags.runs_on_console);
+    // default implementation: there is no process, so we are started.
+    started();
+    return true;
 }
 
-bool ServiceRecord::start_ps_process(const std::vector<const char *> &cmd, bool on_console) noexcept
+bool base_process_service::start_ps_process() noexcept
+{
+    if (restarting) {
+        if (pid == -1) {
+            return restart_ps_process();
+        }
+        return true;
+    }
+    else {
+        eventLoop.get_time(restart_interval_time, clock_type::MONOTONIC);
+        restart_interval_count = 0;
+        return start_ps_process(exec_arg_parts, onstart_flags.starts_on_console);
+    }
+}
+
+bool base_process_service::start_ps_process(const std::vector<const char *> &cmd, bool on_console) noexcept
 {
     // In general, you can't tell whether fork/exec is successful. We use a pipe to communicate
     // success/failure from the child to the parent. The pipe is set CLOEXEC so a successful
     // exec closes the pipe, and the parent sees EOF. If the exec is unsuccessful, the errno
     // is written to the pipe, and the parent can read it.
 
+    eventLoop.get_time(last_start_time, clock_type::MONOTONIC);
+
     int pipefd[2];
     if (pipe2(pipefd, O_CLOEXEC)) {
-        log(LogLevel::ERROR, service_name, ": can't create status check pipe: ", strerror(errno));
+        log(loglevel_t::ERROR, service_name, ": can't create status check pipe: ", strerror(errno));
         return false;
     }
 
@@ -791,12 +888,12 @@ bool ServiceRecord::start_ps_process(const std::vector<const char *> &cmd, bool
     }
 
     bool child_status_registered = false;
-    ControlConn *control_conn = nullptr;
+    control_conn_t *control_conn = nullptr;
     
     int control_socket[2] = {-1, -1};
     if (onstart_flags.pass_cs_fd) {
         if (dinit_socketpair(AF_UNIX, SOCK_STREAM, /* protocol */ 0, control_socket, SOCK_NONBLOCK)) {
-            log(LogLevel::ERROR, service_name, ": can't create control socket: ", strerror(errno));
+            log(loglevel_t::ERROR, service_name, ": can't create control socket: ", strerror(errno));
             goto out_p;
         }
         
@@ -805,10 +902,10 @@ bool ServiceRecord::start_ps_process(const std::vector<const char *> &cmd, bool
         fcntl(control_socket[0], F_SETFD, fdflags | FD_CLOEXEC);
         
         try {
-            control_conn = new ControlConn(&eventLoop, service_set, control_socket[0]);
+            control_conn = new control_conn_t(&eventLoop, services, control_socket[0]);
         }
         catch (std::exception &exc) {
-            log(LogLevel::ERROR, service_name, ": can't launch process; out of memory");
+            log(loglevel_t::ERROR, service_name, ": can't launch process; out of memory");
             goto out_cs;
         }
     }
@@ -821,10 +918,15 @@ bool ServiceRecord::start_ps_process(const std::vector<const char *> &cmd, bool
         child_status_listener.add_watch(eventLoop, pipefd[0], IN_EVENTS);
         child_status_registered = true;
         
-        forkpid = child_listener.fork(eventLoop);
+        // We specify a high priority (i.e. low priority value) so that process termination is
+        // handled early. This means we have always recorded that the process is terminated by the
+        // time that we handle events that might otherwise cause us to signal the process, so we
+        // avoid sending a signal to an invalid (and possibly recycled) process ID.
+        forkpid = child_listener.fork(eventLoop, reserved_child_watch, DEFAULT_PRIORITY - 10);
+        reserved_child_watch = true;
     }
     catch (std::exception &e) {
-        log(LogLevel::ERROR, service_name, ": Could not fork: ", e.what());
+        log(loglevel_t::ERROR, service_name, ": Could not fork: ", e.what());
         goto out_cs_h;
     }
 
@@ -865,7 +967,7 @@ bool ServiceRecord::start_ps_process(const std::vector<const char *> &cmd, bool
     return false;
 }
 
-void ServiceRecord::run_child_proc(const char * const *args, const char *logfile, bool on_console,
+void service_record::run_child_proc(const char * const *args, const char *logfile, bool on_console,
         int wpipefd, int csfd) noexcept
 {
     // Child process. Must not allocate memory (or otherwise risk throwing any exception)
@@ -885,11 +987,12 @@ void ServiceRecord::run_child_proc(const char * const *args, const char *logfile
     sigdelset(&sigwait_set, SIGCHLD);
     sigdelset(&sigwait_set, SIGINT);
     sigdelset(&sigwait_set, SIGTERM);
+    sigdelset(&sigwait_set, SIGQUIT);
     
     constexpr int bufsz = ((CHAR_BIT * sizeof(pid_t)) / 3 + 2) + 11;
     // "LISTEN_PID=" - 11 characters; the expression above gives a conservative estimate
-    // on the maxiumum number of bytes required for LISTEN=xxx, including nul terminator,
-    // where xxx is a pid_t in decimal (i.e. one decimal digit is worth just over 3 bits).
+    // on the maxiumum number of bytes required for LISTEN=nnn, including nul terminator,
+    // where nnn is a pid_t in decimal (i.e. one decimal digit is worth just over 3 bits).
     char nbuf[bufsz];
     
     // "DINIT_CS_FD=" - 12 bytes. (we -1 from sizeof(int) in account of sign bit).
@@ -942,11 +1045,14 @@ void ServiceRecord::run_child_proc(const char * const *args, const char *logfile
         }
         else goto failure_out;
         
-        // We have the option of creating a new process group and/or session. If
-        // we just create a new process group, the child process cannot make itself
-        // a session leader if it wants to do that (eg getty/login will generally
-        // want this). If we do neither, and we are running with a controlling
-        // terminal, a ^C or similar will also affect the child process.
+        // We have the option of creating a session and process group, or just a new process
+        // group. If we just create a new process group, the child process cannot make itself
+        // a session leader if it wants to do that (eg getty/login will generally want this).
+        // If we do neither, and we are running with a controlling terminal, a ^C or similar
+        // will also affect the child process (which probably isn't so bad, though since we
+        // will handle the shutdown ourselves it's not necessary). Creating a new session
+        // (and a new process group as part of that) seems like a safe bet, and has the
+        // advantage of letting us signal the process as part of a process group.
         setsid();
     }
     else {
@@ -982,56 +1088,61 @@ void ServiceRecord::run_child_proc(const char * const *args, const char *logfile
 }
 
 // Mark this and all dependent services as force-stopped.
-void ServiceRecord::forceStop() noexcept
+void service_record::forced_stop() noexcept
 {
-    if (service_state != ServiceState::STOPPED) {
+    if (service_state != service_state_t::STOPPED) {
         force_stop = true;
-        service_set->addToStopQueue(this);
+        services->add_transition_queue(this);
     }
 }
 
-void ServiceRecord::dependentStopped() noexcept
+void service_record::dependent_stopped() noexcept
 {
-    if (service_state == ServiceState::STOPPING && waiting_for_deps) {
-        service_set->addToPropQueue(this);
+    if (service_state == service_state_t::STOPPING && waiting_for_deps) {
+        services->add_transition_queue(this);
     }
 }
 
-void ServiceRecord::stop(bool bring_down) noexcept
+void service_record::stop(bool bring_down) noexcept
 {
     if (start_explicit) {
         start_explicit = false;
         release();
     }
-    
-    if (bring_down && desired_state != ServiceState::STOPPED) {
-        desired_state = ServiceState::STOPPED;
-        service_set->addToStopQueue(this);
+
+    if (bring_down) {
+        do_stop();
     }
 }
 
-void ServiceRecord::do_stop() noexcept
+void service_record::do_stop() noexcept
 {
     if (pinned_started) return;
 
-    if (service_state != ServiceState::STARTED) {
-        if (service_state == ServiceState::STARTING) {
+    if (start_explicit && ! do_auto_restart()) {
+        start_explicit = false;
+        release();
+        if (required_by == 0) return; // release will re-call us anyway
+    }
+
+    if (service_state != service_state_t::STARTED) {
+        if (service_state == service_state_t::STARTING) {
             if (! can_interrupt_start()) {
                 // Well this is awkward: we're going to have to continue
                 // starting, but we don't want any dependents to think that
                 // they are still waiting to start.
                 // Make sure they remain stopped:
-                stopDependents();
+                stop_dependents();
                 return;
             }
 
             // We must have had desired_state == STARTED.
-            notifyListeners(ServiceEvent::STARTCANCELLED);
+            notify_listeners(service_event::STARTCANCELLED);
             
-            // Reaching this point, we have can_interrupt_start() == true. So,
-            // we can stop. Dependents might be starting, but they must be
-            // waiting on us, so they should also be immediately stoppable.
-            // Fall through to below,.
+            interrupt_start();
+
+            // Reaching this point, we are starting interruptibly - so we
+            // stop now (by falling through to below).
         }
         else {
             // If we're starting we need to wait for that to complete.
@@ -1040,20 +1151,18 @@ void ServiceRecord::do_stop() noexcept
         }
     }
 
-    service_state = ServiceState::STOPPING;
+    service_state = service_state_t::STOPPING;
     waiting_for_deps = true;
-
-    // If we get here, we are in STARTED state; stop all dependents.
-    if (stopDependents()) {
-        allDepsStopped();
+    if (stop_dependents()) {
+        services->add_transition_queue(this);
     }
 }
 
-bool ServiceRecord::stopCheckDependents() noexcept
+bool service_record::stop_check_dependents() noexcept
 {
     bool all_deps_stopped = true;
-    for (sr_iter i = dependents.begin(); i != dependents.end(); ++i) {
-        if (! (*i)->is_stopped()) {
+    for (auto dept : dependents) {
+        if (dept->dep_type == dependency_type::REGULAR && ! dept->get_from()->is_stopped()) {
             all_deps_stopped = false;
             break;
         }
@@ -1062,108 +1171,261 @@ bool ServiceRecord::stopCheckDependents() noexcept
     return all_deps_stopped;
 }
 
-bool ServiceRecord::stopDependents() noexcept
+bool service_record::stop_dependents() noexcept
 {
     bool all_deps_stopped = true;
-    for (sr_iter i = dependents.begin(); i != dependents.end(); ++i) {
-        if (! (*i)->is_stopped()) {
-            // Note we check *first* since if the dependent service is not stopped,
-            // 1. We will issue a stop to it shortly and
-            // 2. It will notify us when stopped, at which point the stopCheckDependents()
-            //    check is run anyway.
-            all_deps_stopped = false;
-        }
+    for (auto dept : dependents) {
+        if (dept->dep_type == dependency_type::REGULAR) {
+            if (! dept->get_from()->is_stopped()) {
+                // Note we check *first* since if the dependent service is not stopped,
+                // 1. We will issue a stop to it shortly and
+                // 2. It will notify us when stopped, at which point the stop_check_dependents()
+                //    check is run anyway.
+                all_deps_stopped = false;
+            }
+
+            if (force_stop) {
+                // If this service is to be forcefully stopped, dependents must also be.
+                dept->get_from()->forced_stop();
+            }
 
-        (*i)->forceStop();
+            dept->get_from()->prop_stop = true;
+            services->add_prop_queue(dept->get_from());
+        }
     }
 
     return all_deps_stopped;
 }
 
 // All dependents have stopped; we can stop now, too. Only called when STOPPING.
-void ServiceRecord::allDepsStopped()
+void service_record::all_deps_stopped() noexcept
 {
     waiting_for_deps = false;
-    if (service_type == ServiceType::PROCESS || service_type == ServiceType::BGPROCESS) {
-        if (pid != -1) {
-            // The process is still kicking on - must actually kill it.
-            if (! onstart_flags.no_sigterm) {
-                kill(pid, SIGTERM);
-            }
-            if (term_signal != -1) {
-                kill(pid, term_signal);
-            }
-            
-            // In most cases, the rest is done in process_child_callback.
-            // If we are a BGPROCESS and the process is not our immediate child, however, that
-            // won't work - check for this now:
-            if (service_type == ServiceType::BGPROCESS) {
-                int status;
-                pid_t r = waitpid(pid, &status, WNOHANG);
-                if (r == -1 && errno == ECHILD) {
-                    // We can't track this child (or it's terminated already)
-                    stopped();
-                }
-                else if (r == pid) {
-                    // TODO, examine status and log anything unusual.
-                    stopped();
-                }
-            }
+    stopped();
+}
+
+void base_process_service::kill_pg(int signo) noexcept
+{
+    pid_t pgid = getpgid(pid);
+    if (pgid == -1) {
+        // only should happen if pid is invalid, which should never happen...
+        log(loglevel_t::ERROR, service_name, ": can't signal process: ", strerror(errno));
+        return;
+    }
+    kill(-pgid, signo);
+}
+
+void base_process_service::all_deps_stopped() noexcept
+{
+    waiting_for_deps = false;
+    if (pid != -1) {
+        // The process is still kicking on - must actually kill it. We signal the process
+        // group (-pid) rather than just the process as there's less risk then of creating
+        // an orphaned process group:
+        if (! onstart_flags.no_sigterm) {
+            kill_pg(SIGTERM);
         }
-        else {
-            // The process is already dead.
-            stopped();
+        if (term_signal != -1) {
+            kill_pg(term_signal);
         }
-    }
-    else if (service_type == ServiceType::SCRIPTED) {
-        // Scripted service.
-        if (stop_command.length() == 0) {
+
+        // In most cases, the rest is done in handle_exit_status.
+        // If we are a BGPROCESS and the process is not our immediate child, however, that
+        // won't work - check for this now:
+        if (record_type == service_type::BGPROCESS && ! tracking_child) {
             stopped();
         }
-        else if (! start_ps_process(stop_arg_parts, false)) {
-            // Couldn't execute stop script, but there's not much we can do:
-            stopped();
+        else if (stop_timeout != time_val(0,0)) {
+            restart_timer.arm_timer_rel(eventLoop, stop_timeout);
+            stop_timer_armed = true;
         }
     }
     else {
+        // The process is already dead.
+        stopped();
+    }
+}
+
+void scripted_service::all_deps_stopped() noexcept
+{
+    waiting_for_deps = false;
+    if (stop_command.length() == 0) {
+        stopped();
+    }
+    else if (! start_ps_process(stop_arg_parts, false)) {
+        // Couldn't execute stop script, but there's not much we can do:
         stopped();
     }
+    else {
+        // successfully started stop script: start kill timer:
+        if (stop_timeout != time_val(0,0)) {
+            restart_timer.arm_timer_rel(eventLoop, stop_timeout);
+            stop_timer_armed = true;
+        }
+    }
 }
 
-void ServiceRecord::unpin() noexcept
+void service_record::unpin() noexcept
 {
     if (pinned_started) {
         pinned_started = false;
-        if (desired_state == ServiceState::STOPPED) {
+        if (desired_state == service_state_t::STOPPED || force_stop) {
             do_stop();
-            service_set->processQueues(false);
+            services->process_queues();
         }
     }
     if (pinned_stopped) {
         pinned_stopped = false;
-        if (desired_state == ServiceState::STARTED) {
+        if (desired_state == service_state_t::STARTED) {
             do_start();
-            service_set->processQueues(true);
+            services->process_queues();
         }
     }
 }
 
-void ServiceRecord::queueForConsole() noexcept
+void service_record::queue_for_console() noexcept
 {
-    service_set->append_console_queue(this);
+    services->append_console_queue(this);
 }
 
-void ServiceRecord::releaseConsole() noexcept
+void service_record::release_console() noexcept
 {
-    service_set->pullConsoleQueue();
+    services->pull_console_queue();
 }
 
-void ServiceSet::service_active(ServiceRecord *sr) noexcept
+void service_record::interrupt_start() noexcept
+{
+    services->unqueue_console(this);
+}
+
+void service_set::service_active(service_record *sr) noexcept
 {
     active_services++;
 }
 
-void ServiceSet::service_inactive(ServiceRecord *sr) noexcept
+void service_set::service_inactive(service_record *sr) noexcept
 {
     active_services--;
 }
+
+base_process_service::base_process_service(service_set *sset, string name,
+        service_type service_type_p, string &&command,
+        std::list<std::pair<unsigned,unsigned>> &command_offsets,
+        const std::list<prelim_dep> &deplist_p)
+     : service_record(sset, name, service_type_p, std::move(command), command_offsets,
+         deplist_p), child_listener(this), child_status_listener(this)
+{
+    restart_interval_count = 0;
+    restart_interval_time = {0, 0};
+    restart_timer.service = this;
+    restart_timer.add_timer(eventLoop);
+
+    // By default, allow a maximum of 3 restarts within 10.0 seconds:
+    restart_interval.seconds() = 10;
+    restart_interval.nseconds() = 0;
+    max_restart_interval_count = 3;
+
+    waiting_restart_timer = false;
+    reserved_child_watch = false;
+    tracking_child = false;
+    stop_timer_armed = false;
+}
+
+void base_process_service::do_restart() noexcept
+{
+    waiting_restart_timer = false;
+    restart_interval_count++;
+
+    // We may be STARTING (regular restart) or STARTED ("smooth recovery"). This affects whether
+    // the process should be granted access to the console:
+    bool on_console = service_state == service_state_t::STARTING
+            ? onstart_flags.starts_on_console : onstart_flags.runs_on_console;
+
+    if (service_state == service_state_t::STARTING) {
+        // for a smooth recovery, we want to check dependencies are available before actually
+        // starting:
+        if (! check_deps_started()) {
+            waiting_for_deps = true;
+            return;
+        }
+    }
+
+    if (! start_ps_process(exec_arg_parts, on_console)) {
+        restarting = false;
+        if (service_state == service_state_t::STARTING) {
+            failed_to_start();
+        }
+        else {
+            desired_state = service_state_t::STOPPED;
+            forced_stop();
+        }
+        services->process_queues();
+    }
+}
+
+bool base_process_service::restart_ps_process() noexcept
+{
+    using time_val = eventloop_t::time_val;
+
+    time_val current_time;
+    eventLoop.get_time(current_time, clock_type::MONOTONIC);
+
+    if (max_restart_interval_count != 0) {
+        // Check whether we're still in the most recent restart check interval:
+        time_val int_diff = current_time - restart_interval_time;
+        if (int_diff < restart_interval) {
+            if (restart_interval_count >= max_restart_interval_count) {
+                log(loglevel_t::ERROR, "Service ", service_name, " restarting too quickly; stopping.");
+                return false;
+            }
+        }
+        else {
+            restart_interval_time = current_time;
+            restart_interval_count = 0;
+        }
+    }
+
+    // Check if enough time has lapsed since the prevous restart. If not, start a timer:
+    time_val tdiff = current_time - last_start_time;
+    if (restart_delay <= tdiff) {
+        // > restart delay (normally 200ms)
+        do_restart();
+    }
+    else {
+        time_val timeout = restart_delay - tdiff;
+        restart_timer.arm_timer_rel(eventLoop, timeout);
+        waiting_restart_timer = true;
+    }
+    return true;
+}
+
+void base_process_service::interrupt_start() noexcept
+{
+    // overridden in subclasses
+    if (waiting_restart_timer) {
+        restart_timer.stop_timer(eventLoop);
+        waiting_restart_timer = false;
+    }
+    service_record::interrupt_start();
+}
+
+void base_process_service::kill_with_fire() noexcept
+{
+    if (pid != -1) {
+        log(loglevel_t::WARN, "Service ", service_name, "with pid ", pid, " exceeded allowed stop time; killing.");
+        kill_pg(SIGKILL);
+    }
+}
+
+dasynq::rearm process_restart_timer::timer_expiry(eventloop_t &, int expiry_count)
+{
+    if (service->service_state == service_state_t::STOPPING) {
+        service->kill_with_fire();
+        service->stop_timer_armed = false;
+    }
+    else {
+        // STARTING / STARTED:
+        service->do_restart();
+    }
+    return dasynq::rearm::DISARM;
+}