Kernel-Assisted Observation

sysg observes service lifecycle with pidfd on Linux: at spawn it opens a pidfd for the service, and the monitor poll()s those descriptors, so a process exit wakes supervision instantly rather than at the next poll tick. waitpid remains authoritative for reaping; the pidfd only supplies readiness. This needs Linux 5.3+, no elevated capabilities, no kernel BTF, and adds no dependencies to the supervisor.

Why pidfd and not eBPF

sysg does not ship eBPF process-event observation. It buys nothing over pidfd here:

• Exit detection is already instant. pidfd wakes the monitor the moment a managed service exits; the sched_process_exit tracepoint adds nothing.
• Descendants are already tracked. Service process trees are owned via their private session (SID), the generational provenance ledger, and — when sysg is PID 1 — the wait broker. eBPF's fork/exec lineage is redundant for the processes sysg manages.
• The one residual gap is not reliably closable by eBPF. A service that fork()s, calls setsid(), and re-parents into a new session leaves sysg's tree. Tracepoint events are advisory and lossy: after a dropped fork event, /proc cannot reconstruct ownership. cgroup v2 is the authoritative boundary for containing escaped descendants, not tracepoint lineage.
• The cost is real. eBPF adds the Aya dependency tree to the root supervisor's trust base, requires CAP_BPF/CAP_PERFMON and kernel BTF at /sys/kernel/btf/vmlinux, and fails to load on minimal musl-static containers — a larger root attack surface for a narrow, unreliable gain.

Known limitation

sysg supervises the process it spawns and the private session that process retains. A service that deliberately escapes into a new session (double-fork + setsid) and outlives its launcher is not tracked. Run services in the foreground and let sysg own the process rather than self-daemonizing.