services: Restarting a node could stop an unrelated program that happened to be reusing a process id recorded before the restart. On managed cloud nodes this reliably hit the helper that provides remote access, and the node then restarted repeatedly until the ids stopped colliding. A service is now stopped only when it can be positively identified as one this node started. Anything that cannot be identified is left alone, and the stale record is cleared with a warning naming what was actually found.
services: Stopping a service now asks it to exit first, and forces it only if it has not stopped within a few seconds. Services were previously forced immediately, which cut off the end of the service's own log and left its connection to the store to be noticed as a dropped connection rather than closed cleanly. This applies when you switch a service off, change which program it runs, delete it, or shut the node down.
diagnostics: CPU and memory for a service were read without confirming the process still belonged to it, so after a restart a service could report an unrelated program's usage. Because these readings are kept as history, the wrong figures persisted rather than correcting themselves. Readings are now taken only from a confirmed process, and reported as zero otherwise.
services: Stopping a service whose process had already exited could report it as unrecognised and quietly decline to stop it. That case is now treated as what it is, a process that has already gone, and cleared.
Performance
services: Supervision no longer scans every program running on the host on each pass.