diff --git a/backend.js b/backend.js
index 1b44f8e..593a35f 100644
--- a/backend.js
+++ b/backend.js
@@ -57,8 +57,11 @@ const logger = {
     },
     _write(streams, obj) {
         const line = JSON.stringify(obj) + '\n';
-        for (const s of streams) {
-            if (s) s.write(line); else console.log(line.trimEnd());
+        const writable = streams.filter(Boolean);
+        if (writable.length > 0) {
+            for (const s of writable) s.write(line);
+        } else {
+            console.log(line.trimEnd());
         }
     },
     info(eventType, msg, extra = {}) {
@@ -204,7 +207,12 @@ app.post('/autofix/webhook', async (req, res) => {
     const requestId = req.id;
     try {
         const sig     = req.headers['x-autofix-signature'] ?? req.headers['x-hub-signature-256'] ?? '';
-        const rawBody = req.rawBody ?? Buffer.alloc(0);
+        const rawBody = req.rawBody;
+
+        if (!rawBody || !Buffer.isBuffer(rawBody)) {
+            logger.error('autofix.webhook', 'Missing rawBody — middleware misconfiguration', { requestId });
+            return res.status(500).json({ ok: false, error: 'Internal server error', requestId });
+        }
 
         if (!AUTOFIX_SECRET || !verifySignature(rawBody, sig)) {
             const reason = !AUTOFIX_SECRET ? 'AUTOFIX_SECRET not configured' : 'Signature mismatch';
diff --git a/prod-run.sh b/prod-run.sh
index 025a21e..1ca91ff 100755
--- a/prod-run.sh
+++ b/prod-run.sh
@@ -424,8 +424,14 @@ if command -v systemctl >/dev/null 2>&1; then
         say "runewager-endpoint restarted via systemd"
     else
         warn "systemctl restart runewager-endpoint failed — falling back to nohup"
-        pkill -f "node .*backend\.js" 2>/dev/null || true
+        pkill -f "node .*${PROJECT_DIR}/backend\.js" 2>/dev/null || true
         sleep 1
+        # Re-check port: another process may have bound it during the failed systemd restart window
+        if is_port_listening "$ENDPOINT_PORT"; then
+            say "Port $ENDPOINT_PORT still in use — freeing before nohup fallback..."
+            free_port_if_conflicted "$ENDPOINT_PORT" "" || true
+            sleep 1
+        fi
         nohup node "$PROJECT_DIR/backend.js" \
             >> "$ENDPOINT_LOG" 2>> "$ENDPOINT_ERR" < /dev/null &
         disown || true
@@ -433,7 +439,7 @@ if command -v systemctl >/dev/null 2>&1; then
     fi
 else
     # No systemd — direct nohup
-    pkill -f "node .*backend\.js" 2>/dev/null || true
+    pkill -f "node .*${PROJECT_DIR}/backend\.js" 2>/dev/null || true
     sleep 1
     if is_port_listening "$ENDPOINT_PORT"; then
         free_port_if_conflicted "$ENDPOINT_PORT" "" || true
diff --git a/runewager-endpoint.service b/runewager-endpoint.service
index 0504337..469ed2d 100644
--- a/runewager-endpoint.service
+++ b/runewager-endpoint.service
@@ -22,7 +22,8 @@ Wants=network-online.target
 Type=simple
 WorkingDirectory=/var/www/html/Runewager
 # Clear any stale process holding port 3001 before each start to prevent EADDRINUSE crash-loops.
-ExecStartPre=/bin/sh -c 'port=${ENDPOINT_PORT:-3001}; pid=$(lsof -t -i:"$port" 2>/dev/null || fuser "$port"/tcp 2>/dev/null || true); [ -n "$pid" ] && echo "[endpoint-prestart] killing stale PID $pid on port $port" && kill -9 $pid && sleep 1 || true'
+# The '+' prefix runs this step as root so it can kill processes owned by any user.
+ExecStartPre=+/bin/sh -c 'port=${ENDPOINT_PORT:-3001}; pid=$(lsof -t -i:"$port" 2>/dev/null || fuser "$port"/tcp 2>/dev/null || true); [ -n "$pid" ] && echo "[endpoint-prestart] killing stale PID $pid on port $port" && kill -9 $pid && sleep 1 || true'
 ExecStart=/usr/bin/node /var/www/html/Runewager/backend.js
 User=root
 Group=root
diff --git a/scripts/rw_cpu_guard.sh b/scripts/rw_cpu_guard.sh
index 687f5f3..bc9c63a 100755
--- a/scripts/rw_cpu_guard.sh
+++ b/scripts/rw_cpu_guard.sh
@@ -104,8 +104,9 @@ DRY_RUN="${DRY_RUN:-0}"
 # Any process whose *parent* matches a pattern is also protected.
 #
 WHITELIST_PATTERNS=(
-    # Guard itself
+    # Guard itself + sibling monitoring scripts — never touch these
     "rw_cpu_guard"
+    "gcz_cpu_guard"
 
     # Runewager bot — all known launch forms
     "runewager"