fix(sre): allow exact clawbot stop contract

apps/api/tests/test_host188_openclaw_callback_forwarder_ansible_catalog.py

@@ -213,6 +213,29 @@ def test_openclaw_playbook_is_check_first_bounded_and_rollback_capable() -> None
     assert tasks["Fail closed when systemd source identity is outside host188 scope"][
         "ansible.builtin.assert"
     ]["that"] == ["openclaw_workdir in allowed_working_directories"]
+    systemd_fields = tasks[
+        "Pin bounded systemd start and stop contracts separately"
+    ]["ansible.builtin.set_fact"]
+    assert "^ExecStart=" in systemd_fields["clawbot_exec_start_line"]
+    assert "^ExecStop=" in systemd_fields["clawbot_exec_stop_line"]
+    systemd_contract = tasks[
+        "Require the existing systemd-owned Compose up contract"
+    ]["ansible.builtin.assert"]["that"]
+    assert (
+        "'argv[]=/usr/bin/docker compose up -d ;' in clawbot_exec_start_line"
+        in systemd_contract
+    )
+    assert (
+        "'argv[]=/usr/bin/docker compose down ;' in clawbot_exec_stop_line"
+        in systemd_contract
+    )
+    assert (
+        "' down ' not in (' ' ~ clawbot_exec_start_line ~ ' ')"
+        in systemd_contract
+    )
+    assert "' down ' not in (' ' ~ clawbot_systemd_shape.stdout ~ ' ')" not in (
+        systemd_contract
+    )
 
     check_receipt = tasks["Publish check-mode overlay diff and no-write receipt"]
     assert check_receipt["when"] == "ansible_check_mode"