if you Google for sysinternals filemon, it might be a help to find who is changing the file.

Thanks

I have done a bit of digging on this one, there is a feature/bug/action where if you cancel/stop/interrupt a g-code file loading it turns the watchdog on.

Could this be the cause?

 

You are correct

I tested this morning, and if the file-load is called and then cancelled it flips the watchdog thingy to on!

I have no idea why or how that could have crept into the source code but of course its there forever

At least i know that i need to check after each file load now.

Another undocumented feature discovered 

Yep, its the file-load "Cancel"button triggers it.

If you invoke file-load and press "Cancel" it flips the watchdogs on.

If you invoke file-load and press "Ok" without selecting a file it cancels the load request and does NOT flip the watchdog on.