# Preserve rootless Podman networking children

Audience: AI coding agents first.

status: ACTIVE — this session owns `wt/deck-podman-killmode`.
task IDs: owner localhost-testing correction, tooling sub-lane
source request: Fix canonical `deck-podman` source and installed `~/.local/bin/deck-podman`. Transient `systemd-run --wait --collect` default service kill behavior kills rootless Podman networking children when Podman exits; `KillMode=process` preserves them. Install before landing. Preserve live `devzone-wordpress:8080` fixture.

## Acceptance criteria

- Confined `deck-podman` passes `-p KillMode=process` to transient user service.
- Focused test proves property presence and existing wrapper behavior remains green.
- Installed `~/.local/bin/deck-podman` resolves to corrected runtime source before commit.
- Real installed entrypoint reaches `devzone-wordpress`; `http://localhost:8080` remains HTTP 200 after command exits.
- Commit tooling change separately from WordPress plugin lane.

## Preserved WIP

- Source worktree: `/home/user/Projects/overdeck/.worktrees/deck-podman-killmode`.
- Branch: `wt/deck-podman-killmode` from `origin/main`.
- Live deploy clone has unrelated `claude/lib/remote-build.mjs` modification; NEVER touch it.
- Live fixture currently serves HTTP 200. NEVER recreate/restart it during this fix.

## Constraints

- NEVER use raw `sudo`, raw `podman`, or destructive container lifecycle commands.
- Surgical change: transient unit kill mode plus focused regression only.
- Install-before-landing: update runtime-loaded source/symlink target, verify installed behavior, then commit.

## Execution steps

1. Add focused wrapper test for `KillMode=process`.
2. Add property to canonical wrapper source.
3. Run focused wrapper suite.
4. Install corrected wrapper into runtime-loaded deploy clone without disturbing unrelated WIP.
5. Verify installed wrapper and fixture HTTP response.
6. Commit isolated tooling source.

## Current receipt

- Canonical source is `/home/user/Projects/overdeck`; installed path resolves to `/home/user/.local/share/overdeck/deploy/modules/workstation/bin/deck-podman`.
- Isolated source worktree claimed.
- Added `-p KillMode=process` plus focused confined-path assertion.
- `bash tests/os/deck-podman.test.sh`: 12 passed, 0 failed, 0 skipped; pause-scope count unchanged at 38.
- Live-clone mutation guard correctly refused direct editing and requires standard ship path for atomic install.

## Next executable action

Commit source, land/deploy through project ship script, then verify installed wrapper and fixture HTTP 200.