Problem
Supervision liveness for the watcher was previously reduced to process existence. If a watcher child stayed alive but stopped producing fresh liveness beacons (a stalled child), the arm layer kept treating it as healthy. A stale watcher lock could then block a new watcher from starting, and supervision ownership stayed wedged until a session restart.
Seen in the field 2026-08-12: supervision went silent with no fresh beacon, and recovery required a restart.
Fix
PR #2320 changes the arm layer to keep verifying the owned child after start: a live but stale-beacon child is retired with a bounded TERM/KILL sequence (much shorter than the liveness grace), stale ownership is released through the watcher-down recovery transition, and the arm fails loudly so a persistent adapter can retry without a session restart.
Tests
Ships with updates to tests/fm-watch-arm.test.sh and tests/fm-watcher-lock.test.sh.
Problem
Supervision liveness for the watcher was previously reduced to process existence. If a watcher child stayed alive but stopped producing fresh liveness beacons (a stalled child), the arm layer kept treating it as healthy. A stale watcher lock could then block a new watcher from starting, and supervision ownership stayed wedged until a session restart.
Seen in the field 2026-08-12: supervision went silent with no fresh beacon, and recovery required a restart.
Fix
PR #2320 changes the arm layer to keep verifying the owned child after start: a live but stale-beacon child is retired with a bounded TERM/KILL sequence (much shorter than the liveness grace), stale ownership is released through the watcher-down recovery transition, and the arm fails loudly so a persistent adapter can retry without a session restart.
Tests
Ships with updates to tests/fm-watch-arm.test.sh and tests/fm-watcher-lock.test.sh.