[Unit]
Description=Periodic backstop re-wrap of Playwright browsers

[Timer]
# A .path trigger raised while the service is already running is consumed and
# never re-fires, so the sweep — not the inotify edge — is what bounds exposure.
OnBootSec=2min
OnUnitActiveSec=15min
Persistent=true
RandomizedDelaySec=2m
Unit=headless-guard.service

[Install]
WantedBy=timers.target