diff --git a/deploy/orchestra-tmux.service b/deploy/orchestra-tmux.service
index 5b2afd8..ed6f474 100644
--- a/deploy/orchestra-tmux.service
+++ b/deploy/orchestra-tmux.service
@@ -22,21 +22,23 @@ Description=Orchestra tmux execution runtime
 After=network.target
 
 [Service]
-Type=forking
-User=orchestra
+# -D runs the server in the foreground, so systemd tracks the real server pid
+# as MainPID. Type=forking left MainPID=0, and systemd then read a crashed
+# server as a clean exit, which Restart=on-failure ignores.
+#
+# -D also turns exit-empty off, so the server outlives its last agent pane.
+# That removes the need for a synthetic idle session to hold it open.
+#
 # The socket name is the worker's tmux_socket for this harness (-L, not -S).
 # Keep the two in step; the worker does not create the server any more.
-#
-# The idle session exists so the server outlives its last agent pane. Without
-# it the runtime exits whenever a task completes, and the next launch spawns a
-# fresh server back inside whichever cgroup asked for it.
-ExecStart=/usr/bin/tmux -L orchestra new-session -d -s orchestra-runtime
-ExecStop=/usr/bin/tmux -L orchestra kill-server
+Type=simple
+User=kami
+ExecStart=/usr/bin/tmux -D -L orchestra
 # The runtime coming back empty is honest: the panes are gone either way, and
 # F16 observes that as real execution loss. Refusing to restart would instead
 # block every later launch until an operator noticed.
 Restart=on-failure
-RestartSec=5
+RestartSec=1
 
 [Install]
 WantedBy=multi-user.target