As is often found with these things, buried in errata sheet (eventually). I had a problem with another brand chip, and during power up the transition from detecting rising supply rail caused an undocumented spike in supply current so the rail dropped slightly and made a complicated oscillator! AND the clock never got going, so the watchdog never got going. Manufacturer visit uncovered the problem -- not documented, till I found it.
Solution: Specified supply capacitor was too small.