Restart-loop watchdog with delta-only thresholds blind to slow leaks (19/h forever bypasses 20/h threshold)
Diagnosis
Watchdogs typically check delta(NRestarts) >= THRESHOLD per window. Catches fast loops but misses slow loops below threshold. 19 restarts/h forever × 24h = 456/day same damage, slower fuse.
Fix
Add absolute-count guardrail alongside delta. Pattern: if count >= ABS_THRESHOLD and count/ABS > prev/ABS then alert. Multiple-crossing guard prevents spam — fires once at 50, quiet until 100. Apply to systemd-restart-watchdog and docker-health-check. Generalizes to any error-counter watchdog.