diff --git a/deployments/systemd/claire-agent.service b/deployments/systemd/claire-agent.service
index 52d1374..4eb2164 100644
--- a/deployments/systemd/claire-agent.service
+++ b/deployments/systemd/claire-agent.service
@@ -8,6 +8,13 @@ Wants=network-online.target
 
 [Service]
 Type=simple
+# KillMode=process (NOT the default control-group): restarting this unit on a
+# redeploy must NOT tear down the worker claude/tmux sessions the agent spawned
+# into its cgroup. control-group SIGTERMs the whole tree, silently killing live
+# dispatched workers on every deploy (the next-tour-planner was lost this way on
+# 2026-06-02). With process, only `claire agent run` is signalled; the panes
+# survive and the fresh agent re-discovers them via the pull/liveness pass.
+KillMode=process
 # rclaude (session-tools) lives in ~/.local/bin (+ pnpm global). systemd --user
 # starts with a minimal PATH, so the supervisor couldn't find rclaude — add the
 # user bin dirs. (Where rclaude is absent, the supervisor self-disables.)