diff --git a/.github/workflows/extended_checks.yml b/.github/workflows/extended_checks.yml
index 690fe1bff7..5eaf313ca3 100644
--- a/.github/workflows/extended_checks.yml
+++ b/.github/workflows/extended_checks.yml
@@ -564,13 +564,6 @@ jobs:
         python3 ci/test_fix_md_ascii.py
         python3 ci/fix_md_ascii.py --check
 
-    - name: "Test watchdog tray wording (python)"
-      if: matrix.role != 'modules'
-      run: |
-        set -eux
-        python3 utils/watchdog/test_tray_state.py
-        python3 utils/watchdog/test_consent.py
-
     - name: "Test pip wheel repack (python)"
       if: matrix.role != 'modules'
       run: |
diff --git a/CHANGELIST.md b/CHANGELIST.md
index cbf142e379..1d5ea63867 100644
--- a/CHANGELIST.md
+++ b/CHANGELIST.md
@@ -232,6 +232,9 @@ Z3 SMT solver bindings as a dynamic module, dasLLVM-style.
 - **JIT debug tooling** (#3511); **`llvm_tune` per-box UX** (#3403) - scope / policy / `--tune`, self-tuning servers, `-exe` fix
 - **AOT batch-composition hash fix** (`g_isInAot` leak) + `aot_cpp` made AOT-linkable (#3409); **AOT fuzzer-failure hardening** (#3303)
 - **Standalone contexts link C++ modules** (#3947) - a `-ctx` context that reaches dasHV, fio or any handled type registers the modules it links (the builtin set in the C++ registrar's order, then dependencies-first) on first construction through a process-wide list (`include/daScript/simulate/standalone_modules.h`), so several generated contexts in one binary share one registry lifetime that ends with `Module::ShutdownStandalone` when the last context is destroyed; a builtin module the program calls at run time keeps its AOT header, the function table is dense (a slot per function the context still reaches), and `examples/standalone/06_full_runtime` (dasHV + fio, static, compiles nothing at run time, loads no shared module) is the worked example and a small-lane test
+- **Standalone contexts emit every used function of every module** (#3950) - a `-ctx` context is one translation unit, so a required das module's functions, its class methods (through their Func slots) and the modules their externs reach now land in it; a generic instance several modules instantiated is emitted once per name. The entry module alone was emitted before, which the example survived only because its one cross-module das call was inlined.
+- **`fio`: a long-lived child process** (#3950) - `spawn_process` / `process_drain` / `process_poll` / `process_wait` / `process_terminate` / `process_kill` / `process_pid` / `process_alive` / `close_process`, the `process_running` sentinel, and `with_process` in `daslib/fio`: an opaque `SubProcess?` a supervisor drives on its own clock, with a non-blocking line drain over merged stdout+stderr, `KEY=VALUE` environment overrides, a working directory, and tree-wide signals (a Windows job object, a POSIX process group). `popen_argv` stays the block-scoped, run-to-completion form.
+- **The watchdog is daslang, and a static executable** (#3950) - `utils/watchdog/watchdog.py` (and its Python dependency in every release bundle) is replaced by `utils/watchdog/watchdog.das` plus `bin/watchdog`, a standalone context on the full runtime with dasHV static: no compiler, no shared module, no lock on the files a deploy replaces. Config, `watchdog.json` layering, layout discovery, the exit 0 / 3 / 4 contract, startup stages, the JSON-lines log with rotation, crash bundles, WER and notifications carry over; the exchange consent dialog, the sidecar tray rails and the tray icon do not. Manifests ship it with the new `release_include_tool("watchdog")`, which resolves `bin/watchdog` or `bin/Release/watchdog.exe` per platform.
 - **LLVM-AOT in a large embedding host** (#3715) - scalar call ABI matched at bool/reference seams, target triple + data layout pinned on emitted objects, `-dll-path`/`DAS_DLL_PATH` dasbind search, per-object glob-init deferred to first link
 
 #### Runtime, Tooling, and Hosting
diff --git a/CLAUDE.md b/CLAUDE.md
index 6f42336857..73be925bd5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -238,6 +238,9 @@ diagnostic in any tier.
   fresh clone per registration, not the same variable passed twice.
 - **`new WithCtor(field = v)` skips the user constructor** - it is plain field-init, so
   inherited fields stay zero. Write `new WithCtor(args)` when the constructor must run.
+- **`exit(N)` does not set the process exit code under the daslang CLI.** It unwinds as an
+  abnormal termination and the process reports 1, whatever `N` was - a supervisor or shell sees a
+  crash. A code the parent must read comes from `def main() : int { return N }`.
 
 ### Code style - prefer idiomatic forms
 
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4b17962023..7b9a53c8d9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -2136,11 +2136,11 @@ install(FILES ${PROJECT_SOURCE_DIR}/utils/dasllama-convert/main.das
     DESTINATION utils/dasllama-convert
 )
 
-# Install watchdog (supervisor for long-running daslang programs; the worked
-# example in the daspkg skill's release_include_from docs)
+# Install watchdog (supervisor for long-running daslang programs; the static exe installs
+# beside daslang from utils/CMakeLists.txt, these are the library and the interpreter entry)
 install(FILES
-    ${PROJECT_SOURCE_DIR}/utils/watchdog/watchdog.py
-    ${PROJECT_SOURCE_DIR}/utils/watchdog/dummy_server.py
+    ${PROJECT_SOURCE_DIR}/utils/watchdog/watchdog.das
+    ${PROJECT_SOURCE_DIR}/utils/watchdog/main.das
     ${PROJECT_SOURCE_DIR}/utils/watchdog/README.md
     DESTINATION utils/watchdog
 )
diff --git a/ci/test_check_shipped_skills.py b/ci/test_check_shipped_skills.py
index 35cae3556b..8878059ad2 100644
--- a/ci/test_check_shipped_skills.py
+++ b/ci/test_check_shipped_skills.py
@@ -109,7 +109,7 @@ def test_utils_daslang_path_fires_watchdog_passes(self):
               "# Good\n\nsee utils/daslang/main.cpp for the gc hook\n")
         self.assert_fires("not in bundle", "utils/daslang/main.cpp")
         write(self.bundle, "skills/good.md",
-              "# Good\n\nrun `python utils/watchdog/watchdog.py`\n")
+              "# Good\n\nrun `daslang utils/watchdog/main.das -- --cwd .`\n")
         rc, out = self.run_gate()
         self.assertEqual(rc, 0, out)
 
diff --git a/daslib/ARCHITECTURE_EMIT.md b/daslib/ARCHITECTURE_EMIT.md
index df9cd8849c..fa3988c333 100644
--- a/daslib/ARCHITECTURE_EMIT.md
+++ b/daslib/ARCHITECTURE_EMIT.md
@@ -83,10 +83,20 @@ Companion to `ARCHITECTURE.md` in this folder; section numbers are unique across
   index. `[init]` function order is not re-derived at all: the emitter reads the
   simulated context's list through rtti `for_each_init_function`, so the C++ late-init
   sort stays the single source of truth.
-- **Cross-module limits fail loud at emit time**: only main-module, AOT-emitted `[init]`
-  functions can be called from the ctor (required-module and `[no_aot]` ones are collected
-  emit errors with the reason), because the standalone TU only emits the entry module's
-  function bodies.
+- **The TU holds every used function of every module.** A standalone context is one
+  translation unit with no other to link, so `prepareProgramForEmission`'s markers, the
+  block-variable collector, `registerAotCpp`'s `ArgsConverter` thunks and
+  `StandaloneContextGen` each walk the entry module through `visit_module` and then every
+  foreign used function through `visit(fn, adapter)` (`foreignUsedFunctions`, aot_cpp): a
+  builtin is C++ already, a template never emits, a used `[no_aot]` function was refused by
+  name before the walk. A generic instance several modules instantiated has one AOT name,
+  so declarations, bodies, thunks and table rows are emitted once per name. A foreign
+  global's initializer temporaries collect under the collector's null key, the one
+  `__init_script` declares. `UseTypeMarker` walks the foreign functions too, so an extern
+  or handled type reached only from one still links its module.
+- **Cross-module `[init]` is refused at emit time**: only entry-module, AOT-emitted `[init]`
+  functions are called from the ctor; a required module's and `[no_aot]` ones are collected
+  emit errors with the reason.
 - **Every used function must have an AOT body** - a standalone context has no
   interpreter, so a used `noAot` function (the `[no_aot]` annotation, or `NoAotMarker`
   finding a type AOT cannot express) is a collected emit error, never a
diff --git a/daslib/REVIEW.md b/daslib/REVIEW.md
index 0dc0e20b8a..0837b873ef 100644
--- a/daslib/REVIEW.md
+++ b/daslib/REVIEW.md
@@ -137,10 +137,11 @@ spell it are `aotStructName` and the `VarInfo` emitter's inline
 `aotSuffixNameEx(info.name, "_S", ...)`. One site changed alone writes `offsetof`s that
 name a struct declared under a different name.
 
-**A diff that adds or changes a function that runs `CppAot` or any subclass of it
-keeps `buildStructEnumCollisions` running before that visitor runs - directly or in a
-helper it calls.** The table decides when a name gets its collision suffix, and a run
-that skips the seeding spells structs differently from the run that seeded it.
+**A diff that adds or changes a function that emits a struct or enum C++ name - anything
+reaching `aotStructName` / `aotEnumName`, a `CppAot` subclass and `ArgsConverter` alike -
+keeps `buildStructEnumCollisions` running before it, directly or in a helper it calls.**
+The table decides when a name gets its collision suffix, and a run that skips the seeding
+spells structs differently from the run that seeded it.
 
 **Never pass a synthesized access expression's location to `match_error` - pass a pattern
 node's location.** `match_error` stores the `LineInfo` pointer BORROWED, and access nodes
diff --git a/daslib/aot_cpp.das b/daslib/aot_cpp.das
index 33223965d8..9ce915f1f9 100644
--- a/daslib/aot_cpp.das
+++ b/daslib/aot_cpp.das
@@ -4214,6 +4214,12 @@ def public dumpDependencies(program : ProgramPtr; var aotVisitor : CppAot?; prun
     var utm = new UseTypeMarker();
     make_visitor(*utm) $(adapter) {
         visit(program, adapter);
+        if (prune_to_used) {                       // a standalone context emits the foreign functions too
+            var foreign <- foreignUsedFunctions(program, false)
+            for (fn in foreign) {
+                visit(fn, adapter)
+            }
+        }
     }
     let remUS = program._options  |> find_arg("remove_unused_symbols") ?as tBool ?? true;
     let kept <- prune_to_used ? collectUsedModules(program) : table<Module?>()
@@ -4337,6 +4343,23 @@ def collectUsedFunctions(modules : array<Module?>; totalFunctions : int; this_mo
     return <- fnn;
 }
 
+//! The used functions living outside the entry module. A standalone context is one translation
+//! unit, so each is emitted there or nowhere - builtins are C++ already, templates never emit.
+//! `before_no_aot_marking` keeps the ones NoAotMarker has yet to judge; after it, `[no_aot]` is out.
+def public foreignUsedFunctions(program : ProgramPtr; before_no_aot_marking : bool) : array<Function?> {
+    let thisModule = program.getThisModule
+    var foreign : array<Function?>
+    program.get_ptr() |> for_each_module_no_order($(pm) {
+        if (pm == thisModule) return
+        pm |> for_each_module_function($(pfun) {
+            if (pfun.index < 0 || !pfun.flags.used || pfun.flags.builtIn || pfun.moreFlags.isTemplate
+                    || (!before_no_aot_marking && pfun.flags.noAot)) return
+            foreign |> push(pfun)
+        })
+    })
+    return <- foreign
+}
+
 def public collectProgramUsedFunctions(program : ProgramPtr; all_modules : bool; is_all : bool) : array<Function?> {
     //! Collects all used functions from a program's modules for AOT code generation.
     var modules : array<Module?>;
@@ -4351,6 +4374,21 @@ def registerAotCpp(var logs : StringBuilderWriter?; program : ProgramPtr; var co
     var visitor = new ArgsConverter(logs, cross_platform);
     make_visitor(*visitor) $(adapter_marker) {
         visit(program, adapter_marker);
+        if (all_modules) {
+            // a whole-program table (a standalone context) needs a thunk per foreign row as well;
+            // a generic instance several modules share has one name and gets one thunk
+            var thunked : table<string>
+            for (pfun in collectProgramUsedFunctions(program, false, false)) {
+                thunked |> insert(aotFuncName(pfun))
+            }
+            var foreign <- foreignUsedFunctions(program, false)
+            for (fn in foreign) {
+                let name = aotFuncName(fn)
+                if (thunked |> key_exists(name)) continue
+                thunked |> insert(name)
+                visit(fn, adapter_marker)
+            }
+        }
     }
     unsafe {
         delete visitor
@@ -4360,9 +4398,12 @@ def registerAotCpp(var logs : StringBuilderWriter?; program : ProgramPtr; var co
         write(*logs, "\n#ifdef _MSC_VER\n#pragma optimize(\"\", off)\n#endif\n");
         write(*logs, "struct AotFunction \{ uint64_t hash; bool is_cmres; void * fn; vec4f (*wrappedFn)(Context*); \};\n");
         write(*logs, "static AotFunction functions[] = \{\n");
+        var listed : table<string>
         for (fn in fnn) {
             let is_cmres = fn.flags.copyOnReturn || fn.flags.moveOnReturn ? "true" : "false";
             let fn_name = aotFuncName(fn);
+            if (listed |> key_exists(fn_name)) continue
+            listed |> insert(fn_name)
             write(*logs, "    // {get_aot_hash_comment(fn)}\n");
             write(*logs, "    \{ {fn.aotHash}, {is_cmres}, (void*)&{fn_name}, &__wrap_{fn_name} \},\n");
         }
@@ -4448,6 +4489,10 @@ def private collectUsedModules(program : ProgramPtr) : table<Module?> {
     var utm = new UseTypeMarker()
     make_visitor(*utm) $(adapter) {
         visit(program, adapter)
+        var foreign <- foreignUsedFunctions(program, false)
+        for (fn in foreign) {
+            visit(fn, adapter)
+        }
     }
     for (st in keys(utm.useStructs)) {
         if (st._module != null) {
diff --git a/daslib/aot_standalone.das b/daslib/aot_standalone.das
index 00cbd4fe97..ccc1c7bc4a 100644
--- a/daslib/aot_standalone.das
+++ b/daslib/aot_standalone.das
@@ -129,7 +129,7 @@ def writeStandaloneCtor(cfg : StandaloneContextCfg; initFunctions : string; var
     let requested_stack = stack_arg ?as tInt ?? int(program.policies.stack)
     let stack_base = requested_stack > 0 && stack_arg is tInt ? requested_stack : max(requested_stack, min_init_stack)
     let stack_size = stack_base + int(program.globalInitStackSize)
-    let usedFunctionCount = length(collectProgramUsedFunctions(program, false, false))
+    let usedFunctionCount = length(collectProgramUsedFunctions(program, true, false))
     write(tw, "{cfg.class_name}::{cfg.class_name}() : Context({stack_size}/*stack*/) \{\n");
     write(tw, "    auto & context = *this;\n");
     write(tw, "    CodeOfPolicies policies;");
@@ -257,14 +257,15 @@ class StandaloneContextGen : CppAot {
         declarations = ss |> string_builder_str();
         ss |> string_builder_clear();
         write(*ss, "\n");
-        let fnn = collectProgramUsedFunctions(prog, false, false);
+        // every used function of every module, declared once (a shared generic instance has one name)
+        let fnn = collectProgramUsedFunctions(prog, true, false);
         var inline_fns : array<string>
+        inline_fns |> reserve(length(fnn))
         for (pfun in fnn) {
-            let needInline = that == pfun._module;
-            if (needInline) {
-                inline_fns.push(describeCppFunc(pfun, collector, cross_platform, true, needInline));
-                used_functions.insert(aotFuncName(pfun));
-            }
+            let name = aotFuncName(pfun)
+            if (used_functions |> key_exists(name)) continue
+            inline_fns.push(describeCppFunc(pfun, collector, cross_platform, true, true));
+            used_functions.insert(name);
         }
         let sep = ";\n";
         let maybe_sem = inline_fns |> empty() ? "" : sep;
@@ -308,7 +309,7 @@ def writeRegistration(var header : StringBuilderWriter;
     write(source, "using namespace {program.thisNamespace};\n");
     write(header, "namespace {cfg.context_name} \{\n");
     write(source, "namespace {cfg.context_name} \{\n");
-    dumpRegisterAot(unsafe(addr(source)), program, context, false, cfg.cross_platform);
+    dumpRegisterAot(unsafe(addr(source)), program, context, true, cfg.cross_platform);
     writeModuleRegistration(source, registrations);
     writeStandaloneContext(program, initFunctions, header, source, cfg, context);
     write(header, "\} // namespace {cfg.context_name}\n");
@@ -374,9 +375,21 @@ def genStandaloneSrc(var program : ProgramPtr;
             make_visitor(*gen) $(adapter) {
                 gen.adapter := adapter
                 program |> visit_module(adapter, program.getThisModule);
+                // a generic instance several modules instantiated is one C++ function: emit the first copy only
+                var emitted : table<string>
+                for (pfun in collectProgramUsedFunctions(program, false, false)) {
+                    emitted |> insert(aotFuncName(pfun))
+                }
+                var foreign <- foreignUsedFunctions(program, false)
+                for (fn in foreign) {
+                    let name = aotFuncName(fn)
+                    if (emitted |> key_exists(name)) continue
+                    emitted |> insert(name)
+                    visit(fn, adapter)
+                }
             }
 
-            initFunctions = addFunctionInfo(collectProgramUsedFunctions(program, false, false), gen.helper);
+            initFunctions = addFunctionInfo(collectProgramUsedFunctions(program, true, false), gen.helper);
             type_defs += gen.declarations;
             gen.declarations = "";
             write(tw, gen.str());
@@ -421,14 +434,22 @@ def private checkAllUsedFunctionsCanAot(program : ProgramPtr) {
 
 def private prepareProgramForEmission(var program : ProgramPtr; context : Context) : BlockVariableCollector? {
     var noAotMarker = new NoAotMarker();
+    var unmarked <- foreignUsedFunctions(program, true)
     make_visitor(*noAotMarker) $(adapter_no_aot) {
         visit(program, adapter_no_aot)
+        for (fn in unmarked) {
+            visit(fn, adapter_no_aot)
+        }
     }
     checkAllUsedFunctionsCanAot(program)
+    var foreign <- foreignUsedFunctions(program, false)
 
     var pmarker = new PrologueMarker();
     make_visitor(*pmarker) $(adapter_p) {
         visit(program, adapter_p)
+        for (fn in foreign) {
+            visit(fn, adapter_p)
+        }
     }
 
     setAotHashes(program, context);
@@ -436,6 +457,9 @@ def private prepareProgramForEmission(var program : ProgramPtr; context : Contex
     var flags = new SetPrinterFlags();
     make_visitor(*flags) $(flags_adapter) {
         visit(program, flags_adapter)
+        for (fn in foreign) {
+            visit(fn, flags_adapter)
+        }
     }
     unsafe {
         delete flags
@@ -446,6 +470,18 @@ def private prepareProgramForEmission(var program : ProgramPtr; context : Contex
     var coll = new BlockVariableCollector();
     make_visitor(*coll) $(adapter_coll) {
         visit(program, adapter_coll)
+        for (fn in foreign) {
+            visit(fn, adapter_coll)
+        }
+        // foreign globals initialize in __init_script too: their temporaries collect under the null key
+        let thisModule = program.getThisModule
+        program.get_ptr() |> for_each_module_no_order($(pm) {
+            if (pm == thisModule) return
+            pm |> for_each_global($(pvar) {
+                if (pvar.index < 0 || !pvar.flags.used || pvar.init == null) return
+                visit_expression(pvar.init, adapter_coll)
+            })
+        })
     }
     return coll
 }
diff --git a/daslib/daspkg.das b/daslib/daspkg.das
index a380551d25..e33a3c44ac 100644
--- a/daslib/daspkg.das
+++ b/daslib/daspkg.das
@@ -137,6 +137,7 @@ struct ReleaseSpec {
     requires_jit : bool                 //!< app is JIT-only (per-box [tune]/[llvm_code] kernels); a baked -exe would run broken, so `daspkg release` refuses it
     include_symbols : bool              //!< ship debug symbols for every shipped binary into `<bundle>/symbols/`
     external_files : array<string>      //!< "src@dst" pairs shipped from outside the package; src is relative to <das_root>, dst to the bundle root
+    tools : array<string>               //!< built tools shipped by bare name from <das_root>/bin/ (bin/Release/ in an MSVC tree) to the bundle root; the platform adds .exe
 }
 
 var _release_spec : ReleaseSpec
@@ -177,7 +178,7 @@ def release_include_if_missing(pattern : string) {
     _release_spec.include_if_missing_globs |> push(pattern)
 }
 
-//! Ship a file that lives OUTSIDE this package — `release_include` only globs downward from the package root, so shared tooling (e.g. `utils/watchdog/watchdog.py`) is unreachable to it. `source` is relative to `<das_root>`; `dest` is relative to the bundle root and defaults to `source`'s file name. Errors loudly if the source is missing, so a moved file fails the release instead of silently shipping nothing.
+//! Ship a file that lives OUTSIDE this package — `release_include` only globs downward from the package root, so shared tooling (e.g. `dastest/dastest.das`) is unreachable to it. `source` is relative to `<das_root>`; `dest` is relative to the bundle root and defaults to `source`'s file name. Errors loudly if the source is missing, so a moved file fails the release instead of silently shipping nothing.
 def release_include_from(source, dest : string) {
     _release_spec.external_files |> push("{source}@{dest}")
 }
@@ -186,6 +187,11 @@ def release_include_from(source : string) {
     _release_spec.external_files |> push("{source}@")
 }
 
+//! Ship a tool the daslang build produced - `bin/<name>` (`bin/<name>.exe` on Windows, also looked for under `bin/Release/` in an MSVC tree) - to the bundle root, so a manifest names it once for every platform. A build without it fails the release rather than shipping a bundle short a tool. The supervisor is the worked example: `release_include_tool("watchdog")`.
+def release_include_tool(name : string) {
+    _release_spec.tools |> push(name)
+}
+
 def release_exclude(pattern : string) {
     _release_spec.exclude_globs |> push(pattern)
 }
diff --git a/daslib/fio.das b/daslib/fio.das
index cde51d9df6..b8a1222c2c 100644
--- a/daslib/fio.das
+++ b/daslib/fio.das
@@ -690,6 +690,23 @@ def rmdir_rec_result(path : string) : fs_result_bool {
     return fs_result_bool(value = res)
 }
 
+typedef process = SubProcess?
+
+def with_process(argv : array<string>; cwd : string; env : array<string>; blk : block<(var p : process) : void>) {
+    //! Spawn `argv` as a long-lived child (no shell; a forward-slash ``argv[0]`` spawns everywhere), run
+    //! `blk` with the live handle, then close it on scope exit - closing kills a child still running (the
+    //! Windows job tree, the POSIX group). `cwd` empty inherits the parent's; `env` is ``KEY=VALUE`` overrides.
+    var p = unsafe(spawn_process(argv, cwd, env))
+    invoke(blk, p)
+    unsafe(close_process(p))
+}
+
+def with_process(argv : array<string>; blk : block<(var p : process) : void>) {
+    //! `with_process` inheriting the parent's directory and environment.
+    let noenv : array<string>
+    with_process(argv, "", noenv, blk)
+}
+
 def run_and_capture(args : array<string>; var output : string&; timeout_sec : float = 0.0) : int {
     //! Run an external command and capture its stdout+stderr (merged into one pipe by the underlying ``popen_argv``). Returns the process exit code;
     //! -1 means the spawn itself failed. No shell is involved, and a forward-slash ``args[0]`` spawns on every platform (``popen_argv`` hands Windows the backslash spelling).
diff --git a/doc/reflections/das2rst.das b/doc/reflections/das2rst.das
index 551f26c5ef..520851e628 100644
--- a/doc/reflections/das2rst.das
+++ b/doc/reflections/das2rst.das
@@ -228,7 +228,7 @@ def document_module_fio(_root : string) {
         group_by_regex("Glob and pattern matching", mod, %regex~(match_glob|glob|glob_filtered|is_glob_pattern|expand_glob|parse_file_list)$%%),
         group_by_regex("Filesystem queries", mod, %regex~(temp_directory|temp_directory_result|create_temp_file|create_temp_file_result|create_temp_directory|create_temp_directory_result|disk_space)$%%),
         group_by_regex("Terminal queries", mod, %regex~(is_terminal|terminal_width)$%%),
-        group_by_regex("OS specific routines", mod, %regex~(sleep|exit|system|popen|popen_binary|popen_timeout|spawn_argv|popen_argv|popen_argv_pipe|popen_timed_out|run_and_capture|get_env_variable|set_env_variable|sanitize_command_line|has_env_variable)$%%),
+        group_by_regex("OS specific routines", mod, %regex~(sleep|exit|system|popen|popen_binary|popen_timeout|spawn_argv|popen_argv|popen_argv_pipe|popen_timed_out|run_and_capture|spawn_process|process_drain|process_poll|process_wait|process_terminate|process_kill|process_pid|process_alive|close_process|process_running|with_process|get_env_variable|set_env_variable|sanitize_command_line|has_env_variable)$%%),
         group_by_regex("Dynamic modules", mod, %regex~(register_dynamic_module|register_native_path|describe_pending_dynamic_modules)$%%)
     )
     documents("File input output library", mod, "fio.rst", groups)
diff --git a/doc/source/reference/utils/watchdog.rst b/doc/source/reference/utils/watchdog.rst
index 872be9fca9..59cf59e689 100644
--- a/doc/source/reference/utils/watchdog.rst
+++ b/doc/source/reference/utils/watchdog.rst
@@ -8,31 +8,40 @@
  watchdog --- Program Supervisor
 ======================================
 
-One Python supervisor for any daslang program that needs to stay up.  It
+One supervisor for any daslang program that needs to stay up.  It
 restarts the child with bounded backoff, captures crashes into bundles,
-reports startup progress, and optionally exposes a per-program control
-page.  In-tree it supervises ``utils/dasllama-server`` (JIT) and the
-telegram dictation example (a baked exe).
+reports startup progress, and polls health.  In-tree it supervises
+``utils/dasllama-server`` (JIT) and the telegram dictation example (a
+baked exe).
+
+It ships as a static executable, ``bin/watchdog`` (``bin/Release/watchdog.exe``
+in an MSVC tree): a standalone context on the full runtime that compiles
+nothing at run time, loads no shared module, and holds no lock on any file a
+deploy replaces.  The same code runs under the interpreter for development.
 
 Quick start
 ===========
 
 In a deployed bundle, beside the program::
 
-   python watchdog.py
+   ./watchdog
 
 From the source tree, point it at the program's directory::
 
-   python utils/watchdog/watchdog.py --cwd utils/dasllama-server
+   bin/watchdog --cwd utils/dasllama-server
+
+or, under the interpreter::
+
+   daslang utils/watchdog/main.das -- --cwd utils/dasllama-server
 
 What to supervise resolves in order, first match winning: command-line
 flags (``--program``, ``--script``, ``--name``, …); ``watchdog.json``
-beside ``watchdog.py`` (each key sets the default for the same-named
-flag; unknown keys are a hard error); layout discovery (``main.das``
-beside ``bin/Release/daslang`` → ``daslang -jit main.das``; exactly one
-``*.exe`` → that program — anything ambiguous is an error, never a
-guess).
+beside the executable (each key is a flag name with underscores and sets
+the default for that flag; unknown keys are a hard error); layout
+discovery (``main.das`` beside ``bin/Release/daslang`` → ``daslang -jit
+main.das``; exactly one ``*.exe`` → that program — anything ambiguous is
+an error, never a guess).  Everything after ``--`` goes to the child.
 
 .. seealso::
 
-   :ref:`utils_daspkg` -- ``release_include_from`` ships the watchdog inside a package release
+   :ref:`utils_daspkg` -- ``release_include_tool("watchdog")`` ships the executable inside a package release
diff --git a/doc/source/stdlib/handmade/Variable-fio-process_running.rst b/doc/source/stdlib/handmade/Variable-fio-process_running.rst
new file mode 100644
index 0000000000..2dddd8e343
--- /dev/null
+++ b/doc/source/stdlib/handmade/Variable-fio-process_running.rst
@@ -0,0 +1 @@
+The value ``process_poll`` and ``process_wait`` return while the child is still running.  ``INT32_MIN``: no signal number and no ordinary exit code takes that value; the one collision is a Windows process that returns ``0x80000000`` as its own status on purpose.
diff --git a/doc/source/stdlib/handmade/annotation-fio-SubProcess.rst b/doc/source/stdlib/handmade/annotation-fio-SubProcess.rst
new file mode 100644
index 0000000000..561d492295
--- /dev/null
+++ b/doc/source/stdlib/handmade/annotation-fio-SubProcess.rst
@@ -0,0 +1 @@
+A long-lived child process spawned by ``spawn_process``: an opaque handle a supervisor polls, drains and signals across many ticks, unlike the block-scoped ``popen_argv``.  Free it with ``close_process``, or hold it in a ``with_process`` block.
diff --git a/doc/source/stdlib/handmade/function-fio-close_process-0xf82966f695d14fec.rst b/doc/source/stdlib/handmade/function-fio-close_process-0xf82966f695d14fec.rst
new file mode 100644
index 0000000000..ab14e46a59
--- /dev/null
+++ b/doc/source/stdlib/handmade/function-fio-close_process-0xf82966f695d14fec.rst
@@ -0,0 +1 @@
+Frees the handle.  A child still running dies with it - the Windows job object closes, the POSIX process group is killed and reaped - so a supervisor never leaks a child or leaves a zombie.  A null handle is ignored.
diff --git a/doc/source/stdlib/handmade/function-fio-process_alive-0x90274ac9d5662c36.rst b/doc/source/stdlib/handmade/function-fio-process_alive-0x90274ac9d5662c36.rst
new file mode 100644
index 0000000000..103fad2edd
--- /dev/null
+++ b/doc/source/stdlib/handmade/function-fio-process_alive-0x90274ac9d5662c36.rst
@@ -0,0 +1 @@
+Whether a process with this id exists - any process, not only a child - for a single-instance guard reading a pid file.  Probes without signalling: ``kill(pid, 0)`` on POSIX (a process that exists but is not ours to signal counts as alive), ``OpenProcess`` plus the still-active exit status on Windows.  A pid of zero or less is never alive.
diff --git a/doc/source/stdlib/handmade/function-fio-process_drain-0x4dd6d23e716a3381.rst b/doc/source/stdlib/handmade/function-fio-process_drain-0x4dd6d23e716a3381.rst
new file mode 100644
index 0000000000..1e1ebcab4e
--- /dev/null
+++ b/doc/source/stdlib/handmade/function-fio-process_drain-0x4dd6d23e716a3381.rst
@@ -0,0 +1 @@
+Hands ``block`` every complete line of the child's merged stdout+stderr that is ready right now, one call per line with the newline stripped, and never blocks: a partial line waits in the handle for the next drain, and a last line with no newline is delivered once the child closes its output.  Returns ``false`` once that output is closed and fully delivered, so a supervisor drains on every tick until it does.
diff --git a/doc/source/stdlib/handmade/function-fio-process_kill-0x430dd55ae318dbeb.rst b/doc/source/stdlib/handmade/function-fio-process_kill-0x430dd55ae318dbeb.rst
new file mode 100644
index 0000000000..625adb793e
--- /dev/null
+++ b/doc/source/stdlib/handmade/function-fio-process_kill-0x430dd55ae318dbeb.rst
@@ -0,0 +1 @@
+Kills the child and everything it spawned: ``SIGKILL`` to its process group on POSIX, ``TerminateJobObject`` with exit code 9 on Windows.  Nothing in the child runs after this.
diff --git a/doc/source/stdlib/handmade/function-fio-process_pid-0x349c5646dfa72325.rst b/doc/source/stdlib/handmade/function-fio-process_pid-0x349c5646dfa72325.rst
new file mode 100644
index 0000000000..d242b8c046
--- /dev/null
+++ b/doc/source/stdlib/handmade/function-fio-process_pid-0x349c5646dfa72325.rst
@@ -0,0 +1 @@
+The child's process id, for a pid file or a log line.
diff --git a/doc/source/stdlib/handmade/function-fio-process_poll-0x21f24a39d497e02e.rst b/doc/source/stdlib/handmade/function-fio-process_poll-0x21f24a39d497e02e.rst
new file mode 100644
index 0000000000..bb94202cf0
--- /dev/null
+++ b/doc/source/stdlib/handmade/function-fio-process_poll-0x21f24a39d497e02e.rst
@@ -0,0 +1 @@
+The child's exit code if it has exited, else ``process_running``; never waits.  On POSIX a child killed by a signal reports the signal number, as ``popen_argv`` does.  The code is remembered, so a later call answers the same.
diff --git a/doc/source/stdlib/handmade/function-fio-process_terminate-0x1227a543288285f0.rst b/doc/source/stdlib/handmade/function-fio-process_terminate-0x1227a543288285f0.rst
new file mode 100644
index 0000000000..b62f17c121
--- /dev/null
+++ b/doc/source/stdlib/handmade/function-fio-process_terminate-0x1227a543288285f0.rst
@@ -0,0 +1 @@
+Asks the child and everything it spawned to stop: ``SIGTERM`` to its process group on POSIX, ``TerminateJobObject`` with exit code 15 on Windows, where nothing gentler reaches a console-less process.  Follow with ``process_wait`` and, if still running, ``process_kill``.
diff --git a/doc/source/stdlib/handmade/function-fio-process_wait-0xe5ddee492688d8dc.rst b/doc/source/stdlib/handmade/function-fio-process_wait-0xe5ddee492688d8dc.rst
new file mode 100644
index 0000000000..6312c22afc
--- /dev/null
+++ b/doc/source/stdlib/handmade/function-fio-process_wait-0xe5ddee492688d8dc.rst
@@ -0,0 +1 @@
+Waits up to ``timeout`` seconds for the child to exit and returns its exit code, or ``process_running`` when the timeout passes first.  A timeout of zero or less waits forever.  The code is remembered, so a later ``process_poll`` answers the same.
diff --git a/doc/source/stdlib/handmade/function-fio-spawn_process-0x5eca268e4ba0b640.rst b/doc/source/stdlib/handmade/function-fio-spawn_process-0x5eca268e4ba0b640.rst
new file mode 100644
index 0000000000..9fe5a10b4d
--- /dev/null
+++ b/doc/source/stdlib/handmade/function-fio-spawn_process-0x5eca268e4ba0b640.rst
@@ -0,0 +1 @@
+Spawns ``argv`` as a long-lived child and returns its handle.  No shell is involved: ``argv[0]`` is the executable (a forward-slash path spawns on every platform; a relative path naming a directory resolves against the caller's directory, not ``cwd``), the rest are its arguments verbatim.  ``cwd`` empty inherits the caller's directory; each ``env`` entry is a ``KEY=VALUE`` override applied over the inherited environment.  The child's stdout and stderr merge into one pipe read by ``process_drain``; its stdin is empty.  On Windows the child sits in a kill-on-close job object, on POSIX it leads its own process group, so ``process_terminate`` / ``process_kill`` reach the whole tree and closing the handle kills a child still running.  An unspawnable executable is a thrown error on Windows and an exit code 127 on POSIX.
diff --git a/examples/games/latchpoint/start-server.ps1 b/examples/games/latchpoint/start-server.ps1
index 2bfb6521e2..43c6c279b0 100644
--- a/examples/games/latchpoint/start-server.ps1
+++ b/examples/games/latchpoint/start-server.ps1
@@ -4,12 +4,14 @@ param(
 $ErrorActionPreference = 'Stop'
 $repoRoot = (Resolve-Path "$PSScriptRoot/../../..").Path
 $runtime = Join-Path $repoRoot 'bin/Release/daslang.exe'
+$watchdog = Join-Path $repoRoot 'bin/Release/watchdog.exe'
 $runRoot = Join-Path $repoRoot 'logs/latchpoint-server'
 if (!(Test-Path -LiteralPath $runtime)) { throw "Build this checkout's daslang runtime first: $runtime" }
+if (!(Test-Path -LiteralPath $watchdog)) { throw "Build this checkout's watchdog first: $watchdog" }
 if (!(Test-Path -LiteralPath $Config)) { throw "Create $Config from server.example.toml with your model paths." }
 $Config = (Resolve-Path -LiteralPath $Config).Path
 New-Item -ItemType Directory -Force $runRoot | Out-Null
 $env:DAS_JOBQUE_THREADS = '8'
 $env:DASLLAMA_GPU = '0'
-python "$repoRoot/utils/watchdog/watchdog.py" --name latchpoint --daslang $runtime --script "$repoRoot/utils/dasllama-server/main.das" --cwd $runRoot --log "$runRoot/watchdog.log" --pid-file "$runRoot/watchdog.pid" --health-url 'http://127.0.0.1:18082/v1/models' --shutdown-url 'http://127.0.0.1:18082/shutdown' -- --config $Config
+& $watchdog --name latchpoint --daslang $runtime --script "$repoRoot/utils/dasllama-server/main.das" --cwd $runRoot --log "$runRoot/watchdog.log" --pid-file "$runRoot/watchdog.pid" --health-url 'http://127.0.0.1:18082/v1/models' --shutdown-url 'http://127.0.0.1:18082/shutdown' -- --config $Config
 exit $LASTEXITCODE
diff --git a/examples/games/latchpoint/start-server.sh b/examples/games/latchpoint/start-server.sh
index 91dbb7aff1..8191e91265 100755
--- a/examples/games/latchpoint/start-server.sh
+++ b/examples/games/latchpoint/start-server.sh
@@ -4,11 +4,13 @@ repo_root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../../.." && pwd)"
 runtime="$repo_root/bin/daslang"
 config="${1:-$repo_root/examples/games/latchpoint/server.local.toml}"
 run_root="$repo_root/logs/latchpoint-server"
+watchdog="$repo_root/bin/watchdog"
 [[ -x "$runtime" ]] || { echo "Build this checkout's daslang first: $runtime" >&2; exit 1; }
+[[ -x "$watchdog" ]] || { echo "Build this checkout's watchdog first: $watchdog" >&2; exit 1; }
 [[ -f "$config" ]] || { echo "Create $config from server.example.toml with local model paths." >&2; exit 1; }
 config="$(cd -- "$(dirname -- "$config")" && pwd)/$(basename -- "$config")"
 mkdir -p "$run_root"
-exec python3 "$repo_root/utils/watchdog/watchdog.py" --name latchpoint --daslang "$runtime" \
+exec "$watchdog" --name latchpoint --daslang "$runtime" \
     --script "$repo_root/utils/dasllama-server/main.das" --cwd "$run_root" \
     --log "$run_root/watchdog.log" --pid-file "$run_root/watchdog.pid" \
     --health-url http://127.0.0.1:18082/v1/models --shutdown-url http://127.0.0.1:18082/shutdown \
diff --git a/include/daScript/simulate/aot_builtin_fio.h b/include/daScript/simulate/aot_builtin_fio.h
index d13f719cc4..bea3d7dc06 100644
--- a/include/daScript/simulate/aot_builtin_fio.h
+++ b/include/daScript/simulate/aot_builtin_fio.h
@@ -115,6 +115,18 @@ namespace das {
     DAS_API bool builtin_spawn_argv ( const Array & args_arr, Context * context, LineInfoArg * at );
     DAS_API int builtin_popen_argv ( const Array & args_arr, float timeout_sec, const TBlock<void,const FILE *> & blk, Context * context, LineInfoArg * at );
     DAS_API int builtin_popen_argv_pipe ( const Array & args_arr, const TBlock<void,const FILE *,const FILE *> & blk, Context * context, LineInfoArg * at );
+    // A long-lived child process: spawned once, polled and drained across many ticks, unlike the
+    // block-scoped popen_argv. The handle (das `SubProcess?`) is opaque; free it with close_process.
+    struct DasSubProcess;
+    DAS_API DasSubProcess * builtin_spawn_process ( const Array & argv, const char * cwd, const Array & env, Context * context, LineInfoArg * at );
+    DAS_API bool builtin_process_drain ( DasSubProcess * p, const TBlock<void,char *> & blk, Context * context, LineInfoArg * at );
+    DAS_API int builtin_process_poll ( DasSubProcess * p, Context * context, LineInfoArg * at );
+    DAS_API int builtin_process_wait ( DasSubProcess * p, float timeout_sec, Context * context, LineInfoArg * at );
+    DAS_API void builtin_process_terminate ( DasSubProcess * p, Context * context, LineInfoArg * at );
+    DAS_API void builtin_process_kill ( DasSubProcess * p, Context * context, LineInfoArg * at );
+    DAS_API int builtin_process_pid ( DasSubProcess * p, Context * context, LineInfoArg * at );
+    DAS_API bool builtin_process_alive ( int32_t pid, Context * context, LineInfoArg * at );
+    DAS_API void builtin_close_process ( DasSubProcess * p, Context * context, LineInfoArg * at );
     DAS_API char * get_full_file_name ( const char * path, Context * context, LineInfoArg * );
     DAS_API char * builtin_resolve_this_module_dir ( const char * baked_path, bool standalone, Context * context );
     DAS_API bool builtin_remove_file ( const char * path );
diff --git a/install/CLAUDE.md b/install/CLAUDE.md
index d741df0ea9..9d83ff71a1 100644
--- a/install/CLAUDE.md
+++ b/install/CLAUDE.md
@@ -209,7 +209,7 @@ For path/filename ops use `fio` helpers (`base_name`/`dir_name`/`path_join`/...)
 - `utils/benchctl/` - benchmark result database + statistical comparison (needs the sqlite module)
 - `utils/dasllama-server/` - OpenAI-compatible dasLLAMA inference server (JIT-only; `deploy-jit.ps1` builds a standalone bundle)
 - `utils/dasllama-convert/` - offline GGUF -> `.dlim` model prep
-- `utils/watchdog/` - Python supervisor for long-running daslang programs (`python utils/watchdog/watchdog.py --cwd <program-dir>`)
+- `utils/watchdog/` - supervisor for long-running daslang programs: the static `bin/watchdog --cwd <program-dir>` (no compiler, no shared module, no lock on the files a deploy replaces), or `daslang utils/watchdog/main.das -- --cwd <program-dir>` under the interpreter
 - `utils/jobque-timeline/` - per-lane jobque trace viewer (ImGui)
 - `utils/vscode-daslang-test/` - VSCode Test Explorer extension for dastest (source; build per its README)
 - `tree-sitter-daslang/` - tree-sitter grammar, shared library, highlighting queries (`sgconfig.yml` at the SDK root wires ast-grep to it)
diff --git a/modules/dasLLAMA/ARCHITECTURE_ENGINE.md b/modules/dasLLAMA/ARCHITECTURE_ENGINE.md
index 7f6ecdd8b5..aa423394ad 100644
--- a/modules/dasLLAMA/ARCHITECTURE_ENGINE.md
+++ b/modules/dasLLAMA/ARCHITECTURE_ENGINE.md
@@ -251,7 +251,7 @@ file builds an `ArchDesc` (name * `configure` * the `ArchBlocks` fn-ptr quad * `
   The first-contact consent gate (GDPR) sits ahead of every lookup once a policy is on: an
   explicit `exchange_*` config counts as the expressed choice, otherwise the `<stem>.consent`
   sidecar-sibling file governs - unset asks on a real terminal, or emits
-  `@sidecar consent state=needed` for the watchdog dialog / control page, and no request
+  `@sidecar consent state=needed` for the control page, and no request
   leaves until a surface records "accepted". The client is meaningless without a sidecar, so
   every requirer takes it through the guard `require ?llvm dasllama/dasllama_exchange` (`llvm`
   is the C++ witness module dasLLVM compiles in exactly when the build is configured with it)
diff --git a/modules/dasLLAMA/ENVIRONMENT.md b/modules/dasLLAMA/ENVIRONMENT.md
index 7e4d05a936..2b377b63c9 100644
--- a/modules/dasLLAMA/ENVIRONMENT.md
+++ b/modules/dasLLAMA/ENVIRONMENT.md
@@ -263,7 +263,7 @@ Overrides for the dasllama.io exchange client.
 | Variable | Type | Default | Effect |
 |---|---|---|---|
 | `DASLLAMA_EXCHANGE_URL` | text | unset | Sidecar exchange base URL override (tests, mirrors); unset = the baked-in dasllama.io. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot). |
-| `DASLLAMA_EXCHANGE_ACCEPT` | text | unset | One-shot exchange accept-policy override: verified | any | off; unset = the app config's exchange_accept. The watchdog arms 'any' on a relaunch when the user adopts an unverified sidecar over finishing a tune. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot). |
+| `DASLLAMA_EXCHANGE_ACCEPT` | text | unset | One-shot exchange accept-policy override: verified | any | off; unset = the app config's exchange_accept. A host may arm 'any' for one relaunch to adopt an unverified sidecar over finishing a tune. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot). |
 
 ## daslang core knobs dasLLAMA honours
 
diff --git a/modules/dasLLAMA/REVIEW_EXCHANGE.md b/modules/dasLLAMA/REVIEW_EXCHANGE.md
index 0b039dcaaa..f28b4aa128 100644
--- a/modules/dasLLAMA/REVIEW_EXCHANGE.md
+++ b/modules/dasLLAMA/REVIEW_EXCHANGE.md
@@ -33,12 +33,11 @@ falls back to the sidecar on the box and the winners built into the binary.**
 
 **A diff that adds a tune-boot-path (`exchange_scope_resolver` /
 `exchange_boot_submit_check`) consent question with no terminal to ask on also emits that
-question as a `@sidecar` event, in the same change** - the watchdog dialog and the control
-page are the answer surfaces a supervised boot has.
+question as a `@sidecar` event, in the same change** - the control page is the answer surface
+a supervised boot has.
 
 **A diff that changes the exchange consent notice wording updates every checked-in copy in
 the same change, and a diff that adds a copy names it here in the same change:
-`EXCHANGE_CONSENT_NOTICE` (`dasllama/dasllama_exchange.das`), `CONSENT_TITLE` /
-`CONSENT_TEXT` (`utils/watchdog/watchdog.py`, repo root), and the captured
+`EXCHANGE_CONSENT_NOTICE` (`dasllama/dasllama_exchange.das`) and the captured
 `utils/dasllama-server/tests/fixtures/exchange.json` (repo root).** The console prompt and the
 control page render the served constant, so they are not copies.
diff --git a/modules/dasLLAMA/dasllama/dasllama_env.das b/modules/dasLLAMA/dasllama/dasllama_env.das
index e09a738b8d..11bbddf12d 100644
--- a/modules/dasLLAMA/dasllama/dasllama_env.das
+++ b/modules/dasLLAMA/dasllama/dasllama_env.das
@@ -726,7 +726,7 @@ struct public ExchangeEnv {
     @clarg_doc = "Sidecar exchange base URL override (tests, mirrors); unset = the baked-in dasllama.io. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot)."
     exchange_url : string = ""
 
-    @clarg_doc = "One-shot exchange accept-policy override: verified | any | off; unset = the app config's exchange_accept. The watchdog arms 'any' on a relaunch when the user adopts an unverified sidecar over finishing a tune. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot)."
+    @clarg_doc = "One-shot exchange accept-policy override: verified | any | off; unset = the app config's exchange_accept. A host may arm 'any' for one relaunch to adopt an unverified sidecar over finishing a tune. Setting it is an expressed choice to use the exchange - the first-contact consent question is skipped (announced at boot)."
     exchange_accept : string = ""
 }
 
diff --git a/modules/dasLLAMA/dasllama/dasllama_exchange.das b/modules/dasLLAMA/dasllama/dasllama_exchange.das
index ef44954022..5dabfb7613 100644
--- a/modules/dasLLAMA/dasllama/dasllama_exchange.das
+++ b/modules/dasLLAMA/dasllama/dasllama_exchange.das
@@ -56,8 +56,7 @@ struct ExchangePolicy {
 
 //! The first-contact notice, shown before ANY request leaves for the exchange (GDPR: the
 //! lookup transmits the box identity, and the server sees the connection's IP like any web
-//! server). PLACEHOLDER wording — Gaijin legal owns the final text; the watchdog dialog
-//! (utils/watchdog/watchdog.py CONSENT_*) carries the same wording, keep the two in sync.
+//! server). PLACEHOLDER wording — Gaijin legal owns the final text.
 let public EXCHANGE_CONSENT_NOTICE = "dasLLAMA can download a ready performance-tuning preset (a \"sidecar\") for this machine from dasllama.io, instead of tuning locally.\nThe request sends only your hardware class - platform, CPU model and OS build. No serial numbers, user names or other personal data; no cookies. Sharing your own tuning results back is always confirmed separately.\nDetails: https://legal.gaijin.net/privacypolicy"
 
 // structured events for the watchdog (same contract as @tune): folded into supervisor STATE
@@ -366,8 +365,8 @@ def exchange_consent_status() : string {
     return (word == "accepted" || word == "declined") ? word : ""
 }
 
-//! Record the first-contact choice (console prompt, watchdog dialog, control page — every
-//! surface lands here). Emits the `@sidecar consent` event so the supervisor state follows.
+//! Record the first-contact choice (console prompt, control page — every surface lands
+//! here). Emits the `@sidecar consent` event so the supervisor state follows.
 def exchange_record_consent(accept : bool) : bool {
     let word = accept ? "accepted" : "declined"
     if (!fwrite(exchange_consent_path(), "{word}\n")) {
@@ -402,7 +401,7 @@ def private consent_prompt_console() : bool {
 
 // The gate the resolver runs before the first request leaves. True = a request may be made.
 // No recorded choice: a real terminal asks inline; anything else stays offline this boot and
-// surfaces the question where a human is (watchdog dialog, control page) via the event.
+// surfaces the question where a human is (the control page) via the event.
 def private exchange_consent_gate() : bool {
     let status = exchange_consent_status()
     if (status == "accepted") {
diff --git a/plans/dasllama_io_site.md b/plans/dasllama_io_site.md
index f9d2a91652..7f29e73964 100644
--- a/plans/dasllama_io_site.md
+++ b/plans/dasllama_io_site.md
@@ -117,7 +117,7 @@ pick on the control page's exchange card; a proactive offer after repeated noise
 aborts (the noisy-box case); and DURING a tune via the live tray menu - where doing
 nothing means the tune just finishes.
 
-**Watchdog changes** (`utils/watchdog/watchdog.py`; backoff/health/crash logic UNCHANGED):
+**Watchdog changes** (`utils/watchdog/watchdog.das`; backoff/health/crash logic UNCHANGED):
 
 - The tray menu becomes a pure function of STATE - pystray re-evaluates callables on
   menu open, `icon.update_menu()` on transitions. Items: "Use available sidecar instead
diff --git a/plans/dasweb_backend.md b/plans/dasweb_backend.md
index 54bac3422a..dec65bb76c 100644
--- a/plans/dasweb_backend.md
+++ b/plans/dasweb_backend.md
@@ -112,7 +112,7 @@ is not.
 - `logger_init_tee("dasweb-playground")` in init -> ndjson to `logs/dasweb-playground.log` + stdout.
   No rotation in daslang; rotation is the watchdog's (20 MB x 5 - raise if request volume
   makes the window too short; the request log must cover at least days, not hours).
-- Supervisor = the shared `utils/watchdog/watchdog.py` (same one dasllama-server and the
+- Supervisor = the shared `utils/watchdog/` static executable (same one dasllama-server and the
   dictation bot ship). Contract the service honors:
   - exit **0** = intentional shutdown (watchdog stops), **4** = config-restart request,
     anything else = crash -> notify + bounded-backoff restart + crash bundle.
@@ -121,7 +121,7 @@ is not.
   - `POST /shutdown` - graceful stop; flips the service's own context flag.
 - `watchdog.json`: `{ "name": "dasweb-playground", "health_url": "http://127.0.0.1:8101/healthz",
   "shutdown_url": "http://127.0.0.1:8101/shutdown" }`.
-- systemd unit `dasweb-playground.service`: `ExecStart=python3 watchdog.py`, `WorkingDirectory=`
+- systemd unit `dasweb-playground.service`: `ExecStart=<release>/watchdog`, `WorkingDirectory=`
   the release bundle, `Restart=on-failure` (guards the watchdog itself), `User=dasweb`.
   Watchdog does the child restarts, stages, crash bundles; journald gets the watchdog's stdout.
 
@@ -145,7 +145,7 @@ ln -sfn releases/<sha> /srv/apps/dasweb-playground/current && systemctl restart
 
 - `.das_package`: `release_main("main.das")`, `release_name("dasweb-playground")`,
   `release_include_if_missing("dasweb-playground.toml")` (preserve deployed edits),
-  `release_include_from("utils/watchdog/watchdog.py")`, `release_include("watchdog.json")`.
+  `release_include_tool("watchdog")`, `release_include("watchdog.json")`.
 - Bundle exe is named `dasweb-playground.exe` even on Linux (daspkg convention; CI's sequence
   smoke test relies on the same).
 - **Launch with cwd = bundle dir** - a relocated exe's `get_das_root()` degrades to cwd
diff --git a/skills/cpp_integration.md b/skills/cpp_integration.md
index da8c8f7712..6d12d75e9c 100644
--- a/skills/cpp_integration.md
+++ b/skills/cpp_integration.md
@@ -338,10 +338,13 @@ module the context links and calls `Module::Initialize()` before constructing it
 by name - the runtime cannot add to an initialized registry and keep `Initialize`/`Shutdown`
 balanced.
 
-**Only what the program reaches is linked** - a module the script used at compile time alone is
-neither included nor registered. Worked example: `examples/standalone/06_full_runtime/` - read
-it for the shape; building it needs the daslang repository, since the bundle carries no dasHV
-headers or archive. The recipe above works from a bundle for any C++ module you build yourself.
+**Only what the program reaches is linked, and everything it reaches is emitted** - a module the
+script used at compile time alone is neither included nor registered, while every used function
+of every das module the script requires (daslib, a shared module of your own, class methods
+called through their slot) lands in the one generated translation unit; there is no other TU to
+link. Worked example: `examples/standalone/06_full_runtime/` - read it for the shape; building
+it needs the daslang repository, since the bundle carries no dasHV headers or archive. The recipe
+above works from a bundle for any C++ module you build yourself.
 
 ## Diagnostics - `TextPrinter`, never `fprintf(stderr, ...)`
 
diff --git a/skills/daslang/references/files-and-paths.md b/skills/daslang/references/files-and-paths.md
index db2bcea301..f336613651 100644
--- a/skills/daslang/references/files-and-paths.md
+++ b/skills/daslang/references/files-and-paths.md
@@ -65,6 +65,27 @@ fopen(path, "rb") $(f) {
 - `run_and_capture(args, var output, timeout_sec = 0.0) : int` runs a child with no shell, capturing
   merged stdout+stderr. A forward-slash `args[0]` spawns on every host - the spawn hands Windows
   the backslash spelling its CreateProcess wants.
+- A long-lived child - a supervisor's, a server's - is a `with_process` block over
+  `spawn_process` / `close_process`. `with_process` is safe; every `process_*` call is `unsafe`:
+
+  ```das
+  with_process(["/bin/echo", "hi"]) $(var p) {
+      unsafe {
+          while (process_drain(p) $(line) { print("{line}\n") }) { sleep(1u) }
+          print("code {process_wait(p, 5.0)} pid {process_pid(p)}\n")
+      }
+  }
+  ```
+
+  `with_process(argv)` inherits the parent's directory and environment; `with_process(argv, cwd,
+  env)` sets both (`cwd` empty inherits, `env` is `KEY=VALUE` overrides) - there is no cwd-only form.
+  `process_drain` hands over each complete line of merged stdout+stderr ready right now and returns
+  false at EOF, never blocking; `process_poll(p)` is the exit code or `process_running`;
+  `process_wait(p, timeout_sec)` the same with a wait; `process_terminate` / `process_kill` signal
+  the whole tree (a Windows job, a POSIX process group); `process_pid` / `process_alive(pid)` serve
+  a pid file. A relative `argv[0]` naming a path resolves against the caller's directory. Closing
+  the handle - leaving the block - kills a child still running. A child's exit code comes from
+  `def main() : int` - a das `exit(N)` reports 1.
 
 ## Mutating operations and their three error forms
 
diff --git a/skills/daspkg.md b/skills/daspkg.md
index 814770924b..cf3db59a3d 100644
--- a/skills/daspkg.md
+++ b/skills/daspkg.md
@@ -195,8 +195,9 @@ def release() {
     release_name("MyApp")               // optional; defaults to package_name() / root dir
     release_include("data/**")          // ship matching files (glob; multiple calls accumulate)
     release_include("*.png")
-    release_include_from("utils/watchdog/watchdog.py")        // a file OUTSIDE the package
-    release_include_from("utils/watchdog/watchdog.py", "tools/wd.py")  // ... with an explicit dest
+    release_include_from("dastest/dastest.das")        // a file OUTSIDE the package
+    release_include_from("dastest/dastest.das", "tools/dastest.das")  // ... with an explicit dest
+    release_include_tool("watchdog")    // a built tool from the build's bin/, .exe added per platform
     release_exclude("data/secret/**")
     release_shared_module("dasSQLITE")  // force-include a dylib not auto-detected
     release_include_symbols()           // ship debug symbols into <bundle>/symbols/
@@ -231,13 +232,18 @@ If a module is loaded only at runtime (e.g. data files read while the .das is ne
 
 The bundle is the host platform only. Cross-compilation is deferred until daslang itself supports it; v1 has no platform-tag suffix or auto-archive (`--zip` etc.). Recipients can tar/zip the directory themselves.
 
-### Shipping a file from outside the package - `release_include_from()`
+### Shipping files from outside the package - `release_include_from()` / `release_include_tool()`
 
 `release_include` globs **downward from the package root**, so it cannot reach shared tooling that
 lives elsewhere in the tree. `release_include_from(source[, dest])` resolves `source` against
 `<das_root>` and copies it to `dest` (relative to the bundle root; defaults to `source`'s file
-name, and may name a subdirectory). This is how `utils/dasllama-server` (and the
-dictation bot in the das-telegram package) ships the one supervisor in `utils/watchdog/`.
+name, and may name a subdirectory).
+
+A built tool has a platform-dependent name and location - `bin/watchdog`, or the per-config
+subdirectory and `.exe` on an MSVC tree - so `release_include_tool("watchdog")` names it once:
+daspkg resolves the exe and copies it to the bundle root. This is how
+`utils/dasllama-server` (and the dictation bot in the das-telegram package) ships the one
+supervisor, `utils/watchdog/`'s static executable.
 
 A missing source **fails the release** with exit 1 rather than shipping a bundle quietly short a
 file - a `release_include` whose target has moved away silently ships nothing, which is the failure
diff --git a/skills/internal/aot_testing.md b/skills/internal/aot_testing.md
index bde11350c2..6cdd5b68fd 100644
--- a/skills/internal/aot_testing.md
+++ b/skills/internal/aot_testing.md
@@ -96,11 +96,19 @@ This applies to ALL test directories (e.g., `tests/fio/`, `tests/fs/`, `tests/js
 
 **Do NOT use `options no_aot`** to mask a missing CMake registration - register the tests properly instead.
 
-**Exception - a file that genuinely can't AOT** (codegen/emitter bug, interpreted-only by design): use BOTH markers together, each with a comment + issue link:
-1. `options no_aot` in the file - makes test_aot's `fail_on_no_aot` skip AOT linking for it at runtime;
-2. exclude it from the directory's AOT glob in `tests/aot/CMakeLists.txt` - skips generating stubs that wouldn't compile.
-
-**Trap:** glob exclusion ALONE is not enough. `test_aot` runs every file under `tests/` regardless of what was stub-generated, so an excluded-but-not-`no_aot` file fails at runtime with `error[50101]` on all its functions (precedent: `tests/fixed_array/test_interop.das`, issue #3077).
+**Exception - a file that genuinely can't AOT** (codegen/emitter bug, a process-spawning or
+timing test, interpreted-only by design): put `options no_aot` in the file. The AOT build
+silently skips such files when it generates stubs, and `test_aot`'s `fail_on_no_aot` skips AOT
+linking for the file's own functions at runtime - one marker, both halves.
+
+**Trap:** a glob exclusion in `tests/aot/CMakeLists.txt` ALONE is not enough. `test_aot` runs every
+file under `tests/` regardless of what was stub-generated, so an excluded-but-not-`no_aot` file
+fails at runtime with `error[50101]` on all its functions.
+
+**Trap:** `options no_aot` covers the FILE, not what it requires. A test requiring a module
+outside the AOT set (a `utils/` tool's module, say) still fails the link with `error[50101]` on
+that module's functions under `test_aot`; gate its directory off under `--use-aot` in
+`tests/.das_test` (the `watchdog` folder is the precedent).
 
 **Trap - `_`-prefixed fixture MODULES in an existing test dir.** The per-dir AOT globs
 exclude `_*` files (`EXCLUDE REGEX "/_"`), so a new same-dir fixture module (`require`d by a
diff --git a/skills/internal/tests_in_repo.md b/skills/internal/tests_in_repo.md
index 0942e700f9..76e7271e0d 100644
--- a/skills/internal/tests_in_repo.md
+++ b/skills/internal/tests_in_repo.md
@@ -16,13 +16,14 @@ passes PR CI and fails the nightly. Creating a new test directory => register it
 see `skills/internal/aot_testing.md` sec. "Registering a New Test Directory" for the irregular cases -
 or the nightly/preflight fails with `error[50101]: AOT link failed`.
 
-If a specific file genuinely can't AOT (emitter bug, interpreted-only by design): put
-`options no_aot` IN THE FILE **and** exclude it from the directory's AOT glob, with a
-comment + issue link on both. Glob exclusion alone is NOT enough - test_aot still *runs*
-the file and trips 50101 on its missing stubs; `options no_aot` is what makes the runtime
-skip AOT linking for it. (2026-06-11: in-file `options no_aot` currently fails in the AOT
-hash itself - fix incoming on master; until it lands, interp-only tests are gated by the
-directory filter below instead.)
+If a specific file genuinely can't AOT (emitter bug, a process-spawning or timing test,
+interpreted-only by design): put `options no_aot` IN THE FILE. The AOT build silently skips
+such files (`tests/aot/CMakeLists.txt`), and the runtime skips AOT linking for the file's own
+functions. **It does not skip the modules the file requires**: `test_aot` still runs the file,
+and a required module that is not in the AOT set (anything outside `daslib/` and the registered
+suites - `utils/watchdog/watchdog.das`, say) fails the link with `error[50101]` on that module's
+functions. A test like that is gated off under `--use-aot` by the directory filter below, and
+its directory still registers in `DAS_AOT_SUITES` like any other.
 
 ## The `tests/.das_test` directory filter - and its root-path caveat
 
diff --git a/src/builtin/module_builtin_fio.cpp b/src/builtin/module_builtin_fio.cpp
index 80dfc48d13..69dbc854e6 100644
--- a/src/builtin/module_builtin_fio.cpp
+++ b/src/builtin/module_builtin_fio.cpp
@@ -19,7 +19,14 @@
 #include <sstream>
 #include <chrono>
 
+#ifndef _WIN32
+extern char ** environ;
+#endif
+
 #define DAS_POPEN_TIMEOUT 0x7FFFFF01
+// process_poll / process_wait return this while the child is still running: INT32_MIN, a value no
+// signal number and no ordinary exit code takes (a Windows process could return 0x80000000 on purpose).
+#define DAS_PROCESS_RUNNING (-2147483647-1)
 
 MAKE_TYPE_FACTORY(clock, das::Time)// use MAKE_TYPE_FACTORY out of namespace. Some compilers not happy otherwise
 
@@ -235,6 +242,15 @@ namespace das {
     char * builtin_fs_create_temp_directory ( const char * prefix, char * & error, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
     int builtin_popen_argv ( const Array & args_arr, float timeout_sec, const TBlock<void,const FILE *> & blk, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
     int builtin_popen_argv_pipe ( const Array & args_arr, const TBlock<void,const FILE *,const FILE *> & blk, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
+    DasSubProcess * builtin_spawn_process ( const Array & argv, const char * cwd, const Array & env, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
+    bool builtin_process_drain ( DasSubProcess * p, const TBlock<void,char *> & blk, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
+    int builtin_process_poll ( DasSubProcess * p, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
+    int builtin_process_wait ( DasSubProcess * p, float timeout_sec, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
+    void builtin_process_terminate ( DasSubProcess * p, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
+    void builtin_process_kill ( DasSubProcess * p, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
+    int builtin_process_pid ( DasSubProcess * p, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
+    bool builtin_process_alive ( int32_t pid, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
+    void builtin_close_process ( DasSubProcess * p, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
     void * register_dynamic_module_silent ( const char * path, const char * mod_name, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
     void for_each_registered_native_path ( const TBlock<void,const char *,const char *,const char *> & block, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
     void for_each_registered_dynamic_module ( const TBlock<void,const char *,const char *,const char *> & block, Context * context, LineInfoArg * at ) GENERATE_IO_STUB
@@ -317,6 +333,7 @@ namespace das {
 #include <filesystem>
 #include <fstream>
 #include <random>
+#include <cerrno>            // errno for non-blocking process_drain
 
 namespace das {
     void builtin_sleep ( uint32_t msec ) {
@@ -1707,6 +1724,341 @@ namespace das {
 #endif
     }
 
+    // A long-lived child: spawn once, then poll / drain / signal across many ticks. popen_argv
+    // is block-scoped and blocks to EOF; this hands back an opaque handle a supervisor drives on
+    // its own clock. The read end (stdout+stderr merged) is non-blocking so drain never stalls
+    // the tick; on Windows the child sits in a kill-on-close job object and its group is signalled
+    // as a tree, on POSIX the child leads its own process group and killpg reaches the tree.
+    // process_poll / process_wait answer DAS_PROCESS_RUNNING while the child is still alive.
+    struct DasSubProcess {
+#ifdef _WIN32
+        HANDLE hProcess = nullptr;
+        HANDLE hJob = nullptr;
+        HANDLE hRead = INVALID_HANDLE_VALUE;
+        DWORD  pid = 0;
+#else
+        pid_t  pid = -1;
+        int    fd = -1;
+#endif
+        string buf;                 // partial-line accumulator across drains
+        bool stdoutOpen = true;
+        bool reaped = false;
+        int  exitCode = 0;
+    };
+
+#ifdef _WIN32
+    static string winBuildEnvBlock ( const Array & env ) {
+        vector<string> entries;
+        LPCH base = GetEnvironmentStringsA();
+        if ( base ) {
+            for ( LPCH e = base; *e; e += strlen(e) + 1 ) entries.emplace_back(e);
+            FreeEnvironmentStringsA(base);
+        }
+        char ** ov = (char **) env.data;
+        for ( uint64_t i = 0; i < env.size; ++i ) {
+            if ( !ov[i] ) continue;
+            string entry = ov[i];
+            size_t eq = entry.find('=');
+            string key = eq == string::npos ? entry : entry.substr(0, eq);
+            for ( auto & e : entries ) {           // replace an existing key (case-insensitive)
+                size_t k = e.find('=');
+                string ek = k == string::npos ? e : e.substr(0, k);
+                if ( ek.size() == key.size() && _stricmp(ek.c_str(), key.c_str()) == 0 ) { e.clear(); break; }
+            }
+            entries.push_back(entry);
+        }
+        string block;
+        for ( auto & e : entries ) { if ( e.empty() ) continue; block.append(e); block.push_back('\0'); }
+        block.push_back('\0');                      // the block ends in a second NUL
+        return block;
+    }
+#endif
+
+    DasSubProcess * builtin_spawn_process ( const Array & argv_arr, const char * cwd, const Array & env,
+                                            Context * context, LineInfoArg * at ) {
+        if ( argv_arr.size == 0 ) {
+            context->throw_error_at(at, "spawn_process with empty argv");
+            return nullptr;
+        }
+        char ** argv = (char **) argv_arr.data;
+        if ( !argv[0] ) {
+            context->throw_error_at(at, "spawn_process with null exe");
+            return nullptr;
+        }
+        bool hasCwd = cwd && *cwd;
+#ifdef _WIN32
+        SECURITY_ATTRIBUTES sa;
+        sa.nLength = sizeof(SECURITY_ATTRIBUTES);
+        sa.bInheritHandle = TRUE;
+        sa.lpSecurityDescriptor = NULL;
+        HANDLE hRead = NULL, hWrite = NULL;
+        if ( !CreatePipe(&hRead, &hWrite, &sa, 0) ) {
+            context->throw_error_at(at, "spawn_process: CreatePipe failed");
+            return nullptr;
+        }
+        SetHandleInformation(hRead, HANDLE_FLAG_INHERIT, 0);   // parent's read end stays in-process
+        HANDLE hNull = CreateFileA("NUL", GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, &sa,
+            OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+        HANDLE hJob = CreateJobObjectA(NULL, NULL);
+        if ( hJob ) {
+            JOBOBJECT_EXTENDED_LIMIT_INFORMATION jeli;
+            memset(&jeli, 0, sizeof(jeli));
+            jeli.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
+            SetInformationJobObject(hJob, JobObjectExtendedLimitInformation, &jeli, sizeof(jeli));
+        }
+        STARTUPINFOA si;
+        memset(&si, 0, sizeof(si));
+        si.cb = sizeof(si);
+        si.dwFlags = STARTF_USESTDHANDLES;
+        si.hStdInput = (hNull == INVALID_HANDLE_VALUE) ? NULL : hNull;
+        si.hStdOutput = hWrite;
+        si.hStdError = hWrite;
+        string cmdLine = winBuildCommandLine(argv, argv_arr.size);
+        string envBlock;
+        LPVOID lpEnv = NULL;
+        if ( env.size ) { envBlock = winBuildEnvBlock(env); lpEnv = (LPVOID)&envBlock[0]; }
+        PROCESS_INFORMATION pi;
+        memset(&pi, 0, sizeof(pi));
+        vector<char> cmdBuf(cmdLine.begin(), cmdLine.end());   // CreateProcess may write into the command line
+        cmdBuf.push_back('\0');
+        BOOL ok = CreateProcessA(NULL, cmdBuf.data(), NULL, NULL, TRUE,
+            CREATE_NO_WINDOW | CREATE_SUSPENDED, lpEnv, hasCwd ? cwd : NULL, &si, &pi);
+        CloseHandle(hWrite);
+        if ( hNull != INVALID_HANDLE_VALUE ) CloseHandle(hNull);
+        if ( !ok ) {
+            CloseHandle(hRead);
+            if ( hJob ) CloseHandle(hJob);
+            context->throw_error_at(at, "spawn_process: CreateProcess failed");
+            return nullptr;
+        }
+        if ( hJob && !AssignProcessToJobObject(hJob, pi.hProcess) ) {
+            CloseHandle(hJob);      // a job we cannot assign (a restrictive parent job) must not shadow hProcess
+            hJob = NULL;
+        }
+        ResumeThread(pi.hThread);
+        CloseHandle(pi.hThread);
+        DasSubProcess * p = new DasSubProcess();
+        p->hProcess = pi.hProcess;
+        p->hJob = hJob;
+        p->hRead = hRead;
+        p->pid = pi.dwProcessId;
+        return p;
+#else
+        vector<char *> cargv;
+        cargv.reserve(argv_arr.size + 1);
+        for ( uint64_t i = 0; i < argv_arr.size; ++i ) cargv.push_back(argv[i] ? argv[i] : (char *)"");
+        cargv.push_back(nullptr);
+        // A relative argv[0] that names a path (has a '/') resolves against the caller's directory,
+        // not the child's cwd - so make it absolute before the child chdir's, matching Windows, where
+        // CreateProcess already searches the exe from the parent's directory rather than lpCurrentDirectory.
+        // A bare name (no '/') is a PATH lookup, which chdir does not affect - leave it alone.
+        string absExe;
+        if ( hasCwd && cargv[0][0] && cargv[0][0] != '/' && strchr(cargv[0], '/') ) {
+            char cwdbuf[4096];
+            if ( getcwd(cwdbuf, sizeof(cwdbuf)) ) {
+                absExe = string(cwdbuf) + "/" + cargv[0];
+                cargv[0] = (char *)absExe.c_str();
+            }
+        }
+        int pipefd[2];
+        if ( pipe(pipefd) == -1 ) {
+            context->throw_error_at(at, "spawn_process: pipe failed");
+            return nullptr;
+        }
+        // the child's environment, composed here: the parent's entries minus the overridden keys,
+        // then the overrides (the eastl build poisons putenv/setenv, and execvpe is Linux-only)
+        char ** ov = (char **) env.data;
+        vector<char *> cenv;
+        if ( env.size ) {
+            for ( char ** e = environ; e && *e; ++e ) {
+                const char * eq = strchr(*e, '=');
+                size_t klen = eq ? (size_t)(eq - *e) : strlen(*e);
+                bool overridden = false;
+                for ( uint64_t i = 0; i < env.size && !overridden; ++i ) {
+                    overridden = ov[i] && strncmp(ov[i], *e, klen) == 0 && ov[i][klen] == '=';
+                }
+                if ( !overridden ) cenv.push_back(*e);
+            }
+            for ( uint64_t i = 0; i < env.size; ++i ) if ( ov[i] ) cenv.push_back(ov[i]);
+            cenv.push_back(nullptr);
+        }
+        pid_t pid = fork();
+        if ( pid == -1 ) {
+            close(pipefd[0]);
+            close(pipefd[1]);
+            context->throw_error_at(at, "spawn_process: fork failed");
+            return nullptr;
+        }
+        if ( pid == 0 ) {
+            close(pipefd[0]);
+            int devnull = open("/dev/null", O_RDONLY);
+            if ( devnull >= 0 ) { dup2(devnull, STDIN_FILENO); close(devnull); }
+            dup2(pipefd[1], STDOUT_FILENO);
+            dup2(pipefd[1], STDERR_FILENO);
+            close(pipefd[1]);
+            setpgid(0, 0);                          // lead a group so killpg reaches the tree
+            if ( hasCwd && chdir(cwd) != 0 ) _exit(127);
+            if ( env.size ) environ = cenv.data();
+            execvp(cargv[0], cargv.data());
+            _exit(127);
+        }
+        close(pipefd[1]);
+        fcntl(pipefd[0], F_SETFL, O_NONBLOCK);      // drain never blocks the tick
+        DasSubProcess * p = new DasSubProcess();
+        p->pid = pid;
+        p->fd = pipefd[0];
+        return p;
+#endif
+    }
+
+    bool builtin_process_drain ( DasSubProcess * p, const TBlock<void,char *> & blk,
+                                 Context * context, LineInfoArg * at ) {
+        if ( !p ) { context->throw_error_at(at, "process_drain on null process"); return false; }
+        if ( p->stdoutOpen ) {
+            char tmp[4096];
+#ifdef _WIN32
+            for ( ;; ) {
+                DWORD avail = 0;
+                if ( !PeekNamedPipe(p->hRead, NULL, 0, NULL, &avail, NULL) ) { p->stdoutOpen = false; break; }
+                if ( avail == 0 ) break;
+                DWORD toRead = avail > sizeof(tmp) ? (DWORD)sizeof(tmp) : avail;
+                DWORD got = 0;
+                if ( !ReadFile(p->hRead, tmp, toRead, &got, NULL) || got == 0 ) { p->stdoutOpen = false; break; }
+                p->buf.append(tmp, got);
+            }
+#else
+            for ( ;; ) {
+                ssize_t n = read(p->fd, tmp, sizeof(tmp));
+                if ( n > 0 ) { p->buf.append(tmp, (size_t)n); continue; }
+                if ( n == 0 ) { p->stdoutOpen = false; break; }                 // EOF: child closed stdout
+                if ( errno == EAGAIN || errno == EWOULDBLOCK ) break;           // nothing ready this tick
+                p->stdoutOpen = false; break;                                   // real read error
+            }
+#endif
+        }
+        size_t start = 0, nl;
+        while ( (nl = p->buf.find('\n', start)) != string::npos ) {
+            string line = p->buf.substr(start, nl - start);
+            if ( !line.empty() && line.back() == '\r' ) line.pop_back();
+            char * s = context->allocateString(line.data(), (uint32_t)line.size(), at);
+            vec4f cargs[1]; cargs[0] = cast<char *>::from(s);
+            context->invoke(blk, cargs, nullptr, at);
+            start = nl + 1;
+        }
+        p->buf.erase(0, start);
+        if ( !p->stdoutOpen && !p->buf.empty() ) {                             // a last line with no newline
+            string line = p->buf;
+            if ( !line.empty() && line.back() == '\r' ) line.pop_back();
+            char * s = context->allocateString(line.data(), (uint32_t)line.size(), at);
+            vec4f cargs[1]; cargs[0] = cast<char *>::from(s);
+            context->invoke(blk, cargs, nullptr, at);
+            p->buf.clear();
+        }
+        return p->stdoutOpen;
+    }
+
+    int builtin_process_poll ( DasSubProcess * p, Context * context, LineInfoArg * at ) {
+        if ( !p ) { context->throw_error_at(at, "process_poll on null process"); return DAS_PROCESS_RUNNING; }
+        if ( p->reaped ) return p->exitCode;
+#ifdef _WIN32
+        if ( WaitForSingleObject(p->hProcess, 0) == WAIT_TIMEOUT ) return DAS_PROCESS_RUNNING;
+        DWORD code = 0; GetExitCodeProcess(p->hProcess, &code);
+        p->reaped = true; p->exitCode = (int)code; return p->exitCode;
+#else
+        int status = 0;
+        pid_t r = waitpid(p->pid, &status, WNOHANG);
+        if ( r == 0 ) return DAS_PROCESS_RUNNING;
+        p->reaped = true;
+        p->exitCode = r < 0 ? -1
+            : WIFEXITED(status) ? WEXITSTATUS(status) : WIFSIGNALED(status) ? WTERMSIG(status) : status;
+        return p->exitCode;
+#endif
+    }
+
+    int builtin_process_wait ( DasSubProcess * p, float timeout_sec, Context * context, LineInfoArg * at ) {
+        if ( !p ) { context->throw_error_at(at, "process_wait on null process"); return DAS_PROCESS_RUNNING; }
+        if ( p->reaped ) return p->exitCode;
+#ifdef _WIN32
+        DWORD ms = timeout_sec <= 0.0f ? INFINITE : (DWORD)(timeout_sec * 1000.0f);
+        if ( WaitForSingleObject(p->hProcess, ms) == WAIT_TIMEOUT ) return DAS_PROCESS_RUNNING;
+        DWORD code = 0; GetExitCodeProcess(p->hProcess, &code);
+        p->reaped = true; p->exitCode = (int)code; return p->exitCode;
+#else
+        auto deadline = std::chrono::steady_clock::now()
+            + std::chrono::milliseconds((int)(timeout_sec * 1000.0f));
+        for ( ;; ) {
+            int status = 0;
+            pid_t r = waitpid(p->pid, &status, WNOHANG);
+            if ( r > 0 ) {
+                p->reaped = true;
+                p->exitCode = WIFEXITED(status) ? WEXITSTATUS(status)
+                    : WIFSIGNALED(status) ? WTERMSIG(status) : status;
+                return p->exitCode;
+            }
+            if ( r < 0 ) { p->reaped = true; p->exitCode = -1; return -1; }
+            if ( timeout_sec > 0.0f && std::chrono::steady_clock::now() >= deadline )
+                return DAS_PROCESS_RUNNING;
+            std::this_thread::sleep_for(std::chrono::milliseconds(10));
+        }
+#endif
+    }
+
+    void builtin_process_terminate ( DasSubProcess * p, Context * context, LineInfoArg * at ) {
+        if ( !p ) { context->throw_error_at(at, "process_terminate on null process"); return; }
+#ifdef _WIN32
+        if ( p->hJob ) TerminateJobObject(p->hJob, 15);
+        else if ( p->hProcess ) TerminateProcess(p->hProcess, 15);
+#else
+        killpg(p->pid, SIGTERM);
+#endif
+    }
+
+    void builtin_process_kill ( DasSubProcess * p, Context * context, LineInfoArg * at ) {
+        if ( !p ) { context->throw_error_at(at, "process_kill on null process"); return; }
+#ifdef _WIN32
+        if ( p->hJob ) TerminateJobObject(p->hJob, 9);
+        else if ( p->hProcess ) TerminateProcess(p->hProcess, 9);
+#else
+        killpg(p->pid, SIGKILL);
+#endif
+    }
+
+    int builtin_process_pid ( DasSubProcess * p, Context * context, LineInfoArg * at ) {
+        if ( !p ) { context->throw_error_at(at, "process_pid on null process"); return 0; }
+        return (int)p->pid;
+    }
+
+    bool builtin_process_alive ( int32_t pid, Context *, LineInfoArg * ) {
+        if ( pid <= 0 ) return false;
+#ifdef _WIN32
+        HANDLE h = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, (DWORD)pid);
+        if ( !h ) return false;
+        DWORD code = 0; BOOL ok = GetExitCodeProcess(h, &code);
+        CloseHandle(h);
+        return ok && code == STILL_ACTIVE;
+#else
+        // signal 0 probes without delivering; EPERM means it exists but is not ours to signal.
+        if ( ::kill((pid_t)pid, 0) == 0 ) return true;
+        return errno == EPERM;
+#endif
+    }
+
+    void builtin_close_process ( DasSubProcess * p, Context *, LineInfoArg * ) {
+        if ( !p ) return;
+#ifdef _WIN32
+        if ( p->hRead && p->hRead != INVALID_HANDLE_VALUE ) CloseHandle(p->hRead);
+        if ( p->hProcess ) CloseHandle(p->hProcess);
+        if ( p->hJob ) CloseHandle(p->hJob);       // kill-on-close reaps a still-running tree
+#else
+        if ( p->fd >= 0 ) close(p->fd);
+        if ( !p->reaped ) {                        // never leave a zombie
+            int status = 0;
+            if ( waitpid(p->pid, &status, WNOHANG) == 0 ) { killpg(p->pid, SIGKILL); waitpid(p->pid, &status, 0); }
+        }
+#endif
+        delete p;
+    }
+
     int builtin_system ( const char * cmd, Context * context, LineInfoArg * at ) {
         if ( !cmd ) {
             context->throw_error_at(at, "system of null");
@@ -2456,6 +2808,7 @@ namespace das {
 
 MAKE_TYPE_FACTORY(FStat, das::FStat)
 MAKE_TYPE_FACTORY(FILE,FILE)
+MAKE_TYPE_FACTORY(SubProcess, das::DasSubProcess)
 MAKE_TYPE_FACTORY(DiskSpaceInfo, das::DiskSpaceInfo)
 
 namespace das {
@@ -2497,6 +2850,7 @@ namespace das {
             addBuiltinDependency(lib, Module::require("strings"));
             // type
             addAnnotation(new DummyTypeAnnotation("FILE", "FILE", 16, 16));
+            addAnnotation(new DummyTypeAnnotation("SubProcess", "das::DasSubProcess", sizeof(void *), alignof(void *)));
             addAnnotation(new FStatAnnotation(lib));
             // seek constants
             addConstant<int32_t>(*this, "seek_set", SEEK_SET);
@@ -2674,6 +3028,35 @@ namespace das {
                 SideEffects::modifyExternal, "builtin_popen_argv_pipe")
                     ->args({"args","scope","context","at"})->unsafeOperation = true;
             addConstant<int32_t>(*this, "popen_timed_out", DAS_POPEN_TIMEOUT);
+            // long-lived child process (spawn once, poll/drain/signal across ticks)
+            addExtern<DAS_BIND_FUN(builtin_spawn_process)>(*this, lib, "spawn_process",
+                SideEffects::modifyExternal, "builtin_spawn_process")
+                    ->args({"argv","cwd","env","context","at"})->unsafeOperation = true;
+            addExtern<DAS_BIND_FUN(builtin_process_drain)>(*this, lib, "process_drain",
+                SideEffects::modifyExternal, "builtin_process_drain")
+                    ->args({"process","block","context","at"})->unsafeOperation = true;
+            addExtern<DAS_BIND_FUN(builtin_process_poll)>(*this, lib, "process_poll",
+                SideEffects::modifyExternal, "builtin_process_poll")
+                    ->args({"process","context","at"})->unsafeOperation = true;
+            addExtern<DAS_BIND_FUN(builtin_process_wait)>(*this, lib, "process_wait",
+                SideEffects::modifyExternal, "builtin_process_wait")
+                    ->args({"process","timeout","context","at"})->unsafeOperation = true;
+            addExtern<DAS_BIND_FUN(builtin_process_terminate)>(*this, lib, "process_terminate",
+                SideEffects::modifyExternal, "builtin_process_terminate")
+                    ->args({"process","context","at"})->unsafeOperation = true;
+            addExtern<DAS_BIND_FUN(builtin_process_kill)>(*this, lib, "process_kill",
+                SideEffects::modifyExternal, "builtin_process_kill")
+                    ->args({"process","context","at"})->unsafeOperation = true;
+            addExtern<DAS_BIND_FUN(builtin_process_pid)>(*this, lib, "process_pid",
+                SideEffects::accessExternal, "builtin_process_pid")
+                    ->args({"process","context","at"})->unsafeOperation = true;
+            addExtern<DAS_BIND_FUN(builtin_process_alive)>(*this, lib, "process_alive",
+                SideEffects::accessExternal, "builtin_process_alive")
+                    ->args({"pid","context","at"})->unsafeOperation = true;
+            addExtern<DAS_BIND_FUN(builtin_close_process)>(*this, lib, "close_process",
+                SideEffects::modifyExternal, "builtin_close_process")
+                    ->args({"process","context","at"})->unsafeOperation = true;
+            addConstant<int32_t>(*this, "process_running", DAS_PROCESS_RUNNING);
             addExtern<DAS_BIND_FUN(builtin_system)>(*this, lib, "system",
                 SideEffects::modifyExternal, "builtin_system")
                     ->args({"command","context","at"})->unsafeOperation = true;
diff --git a/tests/.das_test b/tests/.das_test
index 2f5edab403..91fe55251f 100644
--- a/tests/.das_test
+++ b/tests/.das_test
@@ -13,6 +13,22 @@ def can_visit_folder(folder_name : string; var result : bool?) {
         *result = has_module("dashv")
         return
     }
+    // the supervisor polls health over dasHV's client; its tests are no_aot (they spawn and
+    // time children), and the utils/watchdog module they require is not in the AOT set, so
+    // the AOT sweep would still fail the link on that module - interp and JIT only
+    if (folder_name == "watchdog") {
+        *result = has_module("dashv")
+        if (*result) {
+            let args <- get_command_line_arguments()
+            for (arg in args) {
+                if (arg == "--use-aot") {
+                    *result = false
+                    return
+                }
+            }
+        }
+        return
+    }
     if (folder_name == "dasPUGIXML") {
         *result = has_module("pugixml")
         return
diff --git a/tests/aot/CMakeLists.txt b/tests/aot/CMakeLists.txt
index 3e1a08d586..b9833b31ff 100644
--- a/tests/aot/CMakeLists.txt
+++ b/tests/aot/CMakeLists.txt
@@ -273,9 +273,6 @@ FILE(GLOB AOT_METAL_FILES RELATIVE ${PROJECT_SOURCE_DIR} CONFIGURE_DEPENDS "test
 list(FILTER AOT_METAL_FILES EXCLUDE REGEX "/_")
 SET(AOT_METAL_MODULE_FILES
     tests/metal/_metal_common.das
-    # f16_cvt is a generic daslib helper the tensor-ops test requires; it used to ride
-    # the (deleted) dasLLAMA module lib — dasLLAMA itself is NEVER AOT'd (see above)
-    daslib/f16_cvt.das
 )
 IF(APPLE)
     # das_metal_boost hard-requires the APPLE-gated das_metal C++ module; the GPU-behavioral
@@ -290,6 +287,7 @@ SET(AOT_DASLIB_FILES
     tests/daslib/tty_test.das
     tests/daslib/test_sha_256.das
     tests/daslib/test_faker.das
+    tests/daslib/test_tune_shells.das
 )
 
 FILE(GLOB AOT_MCP_FILES RELATIVE ${PROJECT_SOURCE_DIR} CONFIGURE_DEPENDS "tests/mcp/*.das")
@@ -391,7 +389,7 @@ set(DAS_AOT_SUITES
     jobque json jsonrpc language linq lint long_array_table loops lpipe lsp
     macro_boost macro_call match math mcp md_boost module_cache module_tests option promote quote
     reader_macro regex rtti safe_addr soa spoof strings stbimage table_packed template
-    tests type_lattice type_traits typemacro uri with_boost delegate)
+    tests type_lattice type_traits typemacro uri watchdog with_boost delegate)
 foreach(_s IN LISTS DAS_AOT_SUITES)
     string(TOUPPER ${_s} _u)
     # suites with an irregular dir / a filter / a curated list define AOT_<UC>_FILES above;
diff --git a/tests/aot/_standalone_dep_call.das b/tests/aot/_standalone_dep_call.das
new file mode 100644
index 0000000000..1ab1bbe45d
--- /dev/null
+++ b/tests/aot/_standalone_dep_call.das
@@ -0,0 +1,17 @@
+options gen2
+
+module _standalone_dep_call public
+
+require daslib/fio
+
+// A required module whose FUNCTIONS the entry module calls at run time - a plain one that reaches
+// a C++ extern only from here, and a class method dispatched through its Func slot.
+def dep_probe(x : int) : int {
+    return x + length(getcwd())
+}
+
+class DepProbe {
+    def method(x : int) : int {
+        return x * 2
+    }
+}
diff --git a/tests/aot/_standalone_foreign_call_fixture.das b/tests/aot/_standalone_foreign_call_fixture.das
new file mode 100644
index 0000000000..12104e9a13
--- /dev/null
+++ b/tests/aot/_standalone_foreign_call_fixture.das
@@ -0,0 +1,13 @@
+options gen2
+
+require _standalone_dep_call
+
+[export]
+def call_foreign(x : int) : int {
+    var probe = new DepProbe()
+    let result = dep_probe(x) + probe->method(x)
+    unsafe {
+        delete probe
+    }
+    return result
+}
diff --git a/tests/aot/test_standalone_emit.das b/tests/aot/test_standalone_emit.das
index 2f6e050b36..6b7e9479ae 100644
--- a/tests/aot/test_standalone_emit.das
+++ b/tests/aot/test_standalone_emit.das
@@ -164,6 +164,32 @@ def test_standalone_emit(t : T?) {   // nolint:STYLE038 - flat list of emit subc
         t |> success(find(files.source, "static_assert(sizeof(DepSpan)") < 0, "the source does not redefine the required module's struct")
     }
 
+    t |> run("a required module's used functions emit into the one translation unit, and link their externs' modules") @(t : T?) {
+        let source = generate_standalone_source(t, "_standalone_foreign_call_fixture", out_dir)
+        t |> success(find(source, "// @_standalone_dep_call::dep_probe ") >= 0, "the foreign function has a row in the function table")
+        t |> success(find(source, "// @_standalone_dep_call::DepProbe`method ") >= 0, "the foreign class method has a row: it dispatches through its Func slot")
+        t |> success(find(source, "__cwd_rename_at") >= 0 || find(source, "builtin_getcwd") >= 0, "the foreign function's body is emitted, not just declared")
+        t |> success(find(source, "\"fio_core\", &::register_Module_FIO") >= 0, "an extern reached only from the foreign function still registers its module")
+        // the ctor sizes context.functions by one count and fills one info row per function; with
+        // foreign rows in play the two are computed separately and must agree
+        let alloc_marker = "context.code->allocate( "
+        let alloc_at = find(source, alloc_marker)
+        t |> success(alloc_at >= 0, "the ctor allocates the function table")
+        if (alloc_at >= 0) {
+            let after = slice(source, alloc_at + length(alloc_marker), length(source))
+            let declared = to_int(slice(after, 0, find(after, "/*")))
+            var rows = 0
+            var at = find(source, ", FunctionInfo(\"")
+            while (at >= 0) {
+                rows++
+                at = find(source, ", FunctionInfo(\"", at + 1)
+            }
+            t |> equal(rows, declared, "the table is sized by exactly the rows it fills, foreign rows included")
+            t |> success(rows >= 4, "the foreign function, its class's method, ctor and finalizer are rows: {rows}")
+        }
+        t |> equal(brace_balance(source), 0, "unbalanced braces in the generated C++")
+    }
+
     t |> run("struct and enum signatures put the type definitions in the header") @(t : T?) {
         let files = generate_standalone_files(t, "_standalone_struct_sig_fixture", out_dir)
         t |> success(find(files.header, "static_assert(sizeof(Pair)") >= 0, "the struct definition is in the header")
diff --git a/tests/fio/_fixture_process_child.das b/tests/fio/_fixture_process_child.das
new file mode 100644
index 0000000000..77ffdde1c9
--- /dev/null
+++ b/tests/fio/_fixture_process_child.das
@@ -0,0 +1,32 @@
+options gen2
+options no_aot
+
+require daslib/clargs
+require daslib/fio
+
+// Child for test_process.das: prints a few known lines (env override, working directory, two
+// plain lines), signals ready, waits for the parent's release event, then exits with code 7.
+// Codes come back from main - a das `exit()` unwinds as an abnormal termination and the CLI
+// reports 1, so it cannot carry a code. The elapsed-time check is only a deadlock guard.
+[export]
+def main() : int {
+    let args <- get_cli_arguments()
+    if (length(args) != 2) return 2
+    let ready = args[0]
+    let release = args[1]
+    var env_val = "<unset>"
+    if (has_env_variable("DAS_PROC_TEST")) {
+        env_val = get_env_variable("DAS_PROC_TEST")
+    }
+    print("env={env_val}\n")
+    print("cwd={base_name(getcwd())}\n")
+    print("hello one\n")
+    print("hello two\n")
+    if (!fwrite(ready, "ready")) return 3
+    let started = ref_time_ticks()
+    while (!fexist(release)) {
+        if (get_time_usec(started) > 30000000) return 4
+        sleep(5u)
+    }
+    return 7
+}
diff --git a/tests/fio/test_process.das b/tests/fio/test_process.das
new file mode 100644
index 0000000000..a9fa4916c1
--- /dev/null
+++ b/tests/fio/test_process.das
@@ -0,0 +1,155 @@
+options gen2
+options no_aot
+
+require dastest/testing_boost public
+require daslib/fio
+
+// argv[0] is the running interpreter (dastest is launched as `daslang dastest/dastest.das ...`),
+// so it spawns the daslang we want the child to run. Same trick as popen_argv.das.
+def das_exe() : string {
+    let args <- get_command_line_arguments()
+    return empty(args) ? "" : args[0]
+}
+
+def has_line(lines : array<string>; s : string) : bool {
+    for (l in lines) {
+        if (l == s) return true
+    }
+    return false
+}
+
+def child_argv(fixture, ready, release : string) : array<string> {
+    return [das_exe(), "-dasroot", get_das_root(), fixture, "--", ready, release]
+}
+
+def make_temp_root(t : T?; prefix : string) : string {
+    let tmp = create_temp_directory_result(prefix)
+    if (!(tmp is value)) {
+        t |> failure("could not create temp directory: {tmp as error}")
+        return ""
+    }
+    return tmp as value
+}
+
+// drain until the child's ready file appears; the file event drives it, the clock only guards
+def wait_for_ready(t : T?; var p : process; ready : string) {
+    let started = ref_time_ticks()
+    while (!fexist(ready)) {
+        unsafe(process_drain(p) $(_line) {})
+        if (get_time_usec(started) > 15000000) {
+            t |> failure("child never signaled ready")
+            return
+        }
+        sleep(5u)
+    }
+}
+
+[test]
+def test_process_lifecycle(t : T?) {
+    t |> run("spawn, drain lines, poll running, wait exit code, apply env + cwd") @(t : T?) {
+        let tmp = create_temp_directory_result("das process test ")
+        if (!(tmp is value)) {
+            t |> failure("could not create temp directory: {tmp as error}")
+            return
+        }
+        let root_dir = tmp as value
+        let ready = path_join(root_dir, "ready")
+        let release = path_join(root_dir, "release")
+        let fixture = path_join(get_das_root(), "tests/fio/_fixture_process_child.das")
+        var p = unsafe(spawn_process(child_argv(fixture, ready, release), root_dir, ["DAS_PROC_TEST=marker42"]))
+        t |> success(p != null, "spawn_process returned a handle")
+        // Drain the child's stdout until it signals ready; the file event drives completion,
+        // the elapsed check is only a guard.
+        var lines : array<string>
+        let started = ref_time_ticks()
+        while (!fexist(ready)) {
+            unsafe(process_drain(p) $(line) {
+                lines |> push(clone_string(line))
+            })
+            if (get_time_usec(started) > 15000000) {
+                t |> failure("child never signaled ready")
+                break
+            }
+            sleep(5u)
+        }
+        unsafe(process_drain(p) $(line) {
+            lines |> push(clone_string(line))
+        })
+        t |> success(has_line(lines, "env=marker42"), "env override reached the child: {lines}")
+        t |> success(has_line(lines, "cwd={base_name(root_dir)}"), "cwd applied to the child: {lines}")
+        t |> success(has_line(lines, "hello one") && has_line(lines, "hello two"),
+            "both stdout lines drained one per line: {lines}")
+        t |> equal(unsafe(process_poll(p)), process_running, "child is still running while parked on release")
+        let pid = unsafe(process_pid(p))
+        t |> success(pid > 0, "pid is positive: {pid}")
+        t |> success(unsafe(process_alive(pid)), "process_alive is true while running")
+        t |> success(fwrite(release, "go"), "wrote the release event")
+        t |> equal(unsafe(process_wait(p, 5.0)), 7, "child exited with its own code")
+        t |> success(!unsafe(process_alive(pid)), "process_alive is false after exit")
+        unsafe(close_process(p))
+        let cleanup = rmdir_rec_result(root_dir)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_close_kills_a_running_child(t : T?) {
+    t |> run("closing the handle - explicitly, or leaving a with_process block - kills a child still running") @(t : T?) {
+        let root_dir = make_temp_root(t, "das process close ")
+        if (empty(root_dir)) return
+        let fixture = path_join(get_das_root(), "tests/fio/_fixture_process_child.das")
+        let noenv : array<string>
+        var explicit_pid = 0
+        var p = unsafe(spawn_process(child_argv(fixture, path_join(root_dir, "ready1"), path_join(root_dir, "never1")), "", noenv))
+        wait_for_ready(t, p, path_join(root_dir, "ready1"))
+        explicit_pid = unsafe(process_pid(p))
+        t |> success(unsafe(process_alive(explicit_pid)), "the child is alive before close")
+        unsafe(close_process(p))
+        t |> success(!unsafe(process_alive(explicit_pid)), "close_process killed the running child")
+        var scoped_pid = 0
+        with_process(child_argv(fixture, path_join(root_dir, "ready2"), path_join(root_dir, "never2"))) $(var q) {
+            wait_for_ready(t, q, path_join(root_dir, "ready2"))
+            scoped_pid = unsafe(process_pid(q))
+            t |> success(unsafe(process_alive(scoped_pid)), "the child is alive inside the block")
+        }
+        t |> success(!unsafe(process_alive(scoped_pid)), "leaving the with_process block killed the running child")
+        let cleanup = rmdir_rec_result(root_dir)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_process_terminate(t : T?) {
+    t |> run("terminate stops a child parked on a release that never comes") @(t : T?) {
+        let tmp = create_temp_directory_result("das process kill ")
+        if (!(tmp is value)) {
+            t |> failure("could not create temp directory: {tmp as error}")
+            return
+        }
+        let root_dir = tmp as value
+        let ready = path_join(root_dir, "ready")
+        let release = path_join(root_dir, "release")   // deliberately never written
+        let fixture = path_join(get_das_root(), "tests/fio/_fixture_process_child.das")
+        let noenv : array<string>
+        var p = unsafe(spawn_process(child_argv(fixture, ready, release), "", noenv))
+        t |> success(p != null, "spawn_process returned a handle")
+        let started = ref_time_ticks()
+        while (!fexist(ready)) {
+            unsafe(process_drain(p) $(_line) {})
+            if (get_time_usec(started) > 15000000) {
+                t |> failure("child never signaled ready")
+                break
+            }
+            sleep(5u)
+        }
+        let pid = unsafe(process_pid(p))
+        t |> equal(unsafe(process_wait(p, 0.2)), process_running, "wait answers process_running when the timeout passes first")
+        unsafe(process_terminate(p))
+        let rc = unsafe(process_wait(p, 5.0))
+        t |> success(rc != process_running, "child stopped after terminate (rc={rc})")
+        t |> success(!unsafe(process_alive(pid)), "process_alive is false after terminate")
+        unsafe(close_process(p))
+        let cleanup = rmdir_rec_result(root_dir)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
diff --git a/tests/watchdog/_fixture_watchdog_child.das b/tests/watchdog/_fixture_watchdog_child.das
new file mode 100644
index 0000000000..5c1d4af7d7
--- /dev/null
+++ b/tests/watchdog/_fixture_watchdog_child.das
@@ -0,0 +1,69 @@
+options gen2
+options no_aot
+
+require daslib/clargs
+require daslib/fio
+
+// The supervised child for test_watchdog.das. `state_dir mode`: a run counter in state_dir
+// tells the child which launch it is, and `mode` picks the story it acts out:
+//   crash-then-ok    run 1 prints the ready line and exits 9; run 2 prints it and exits 0
+//   tune-then-ok     run 1 prints the tune marker and exits 3; run 2 exits 0
+//   config-restart   run 1 exits 4; run 2 exits 0
+//   tune-abort       run 1 exits 3 with no restart marker; run 2 exits 0
+//   park             prints a line, waits for the stop file named by CADMUS_STOP_FILE (or, with
+//                    none named, to be terminated), exits 0
+// Codes return from main: a das exit() is an abnormal termination and reports 1.
+def run_number(state_dir : string) : int {
+    let path = path_join(state_dir, "runs")
+    var runs = 0
+    if (fexist(path)) {
+        fopen(path, "rb") $(f) {
+            if (f != null) {
+                runs = to_int(fread(f))
+            }
+        }
+    }
+    runs++
+    fwrite(path, "{runs}")
+    return runs
+}
+
+[export]
+def main() : int {
+    let args <- get_cli_arguments()
+    if (length(args) != 2) return 2
+    let run = run_number(args[0])
+    let mode = args[1]
+    if (mode == "crash-then-ok") {
+        print("[I] LLVM JIT: DLL cache hit .jitted_scripts/sub/fake.dll\n")
+        print("listening on http://127.0.0.1:1/\n")
+        return run == 1 ? 9 : 0
+    }
+    if (mode == "tune-then-ok") {
+        if (run == 1) {
+            print("llvm_tune: tuning scope 'fixture'\n")
+            print("llvm_tune: restart to apply the winners\n")
+            return 3
+        }
+        return 0
+    }
+    if (mode == "config-restart") {
+        return run == 1 ? 4 : 0
+    }
+    if (mode == "tune-abort") {
+        return run == 1 ? 3 : 0
+    }
+    if (mode == "park") {
+        print("parked\n")
+        // parks until the stop file the supervisor named appears; with none named it parks until
+        // terminated (the deadlock guard is the only other way out)
+        let stop_file = has_env_variable("CADMUS_STOP_FILE") ? get_env_variable("CADMUS_STOP_FILE") : ""
+        let started = ref_time_ticks()
+        while (empty(stop_file) || !fexist(stop_file)) {
+            if (get_time_usec(started) > 30000000) return 6
+            sleep(5u)
+        }
+        return 0
+    }
+    return 7
+}
diff --git a/tests/watchdog/test_watchdog.das b/tests/watchdog/test_watchdog.das
new file mode 100644
index 0000000000..a5984b5416
--- /dev/null
+++ b/tests/watchdog/test_watchdog.das
@@ -0,0 +1,483 @@
+options gen2
+options no_aot
+
+require dastest/testing_boost public
+require daslib/fio
+require daslib/json_boost
+require daslib/strings_boost
+require ../../utils/watchdog/watchdog.das
+
+// argv[0] is the daslang running dastest; the supervised "program" is that binary running the
+// fixture, so program mode and script mode both spawn a real daslang child. Absolute, because a
+// relative --program resolves against --cwd, which is a temp dir here.
+def das_exe() : string {
+    let args <- get_command_line_arguments()
+    return empty(args) ? "" : get_full_file_name(args[0])
+}
+
+def fixture_path() : string {
+    return path_join(get_das_root(), "tests/watchdog/_fixture_watchdog_child.das")
+}
+
+def make_temp(t : T?; prefix : string) : string {
+    let tmp = create_temp_directory_result(prefix)
+    if (!(tmp is value)) {
+        t |> failure("could not create temp directory: {tmp as error}")
+        return ""
+    }
+    return tmp as value
+}
+
+def read_events(log_path : string) : array<JsonValue?> {
+    var events : array<JsonValue?>
+    if (!fexist(log_path)) return <- events
+    var text : string
+    fopen(log_path, "rb") $(f) {
+        if (f != null) {
+            text = fread(f)
+        }
+    }
+    for (line in split(text, "\n")) {
+        if (empty(strip(line))) continue
+        var error : string
+        var js = read_json(line, error)
+        if (js != null) {
+            events |> push(js)
+        }
+    }
+    return <- events
+}
+
+def event_names(events : array<JsonValue?>) : array<string> {
+    return <- [for (ev in events); ev?["event"] ?? ""]
+}
+
+def count_event(events : array<JsonValue?>; name : string) : int {
+    var n = 0
+    for (ev in events) {
+        if ((ev?["event"] ?? "") == name) {
+            n++
+        }
+    }
+    return n
+}
+
+def event_int(events : array<JsonValue?>; name, key : string; nth : int = 0) : int {
+    var seen = 0
+    for (ev in events) {
+        if ((ev?["event"] ?? "") != name) continue
+        if (seen == nth) return int(ev?[key] ?? -999999l)
+        seen++
+    }
+    return -999999
+}
+
+def child_args(state_dir, mode : string) : array<string> {
+    return ["-dasroot", get_das_root(), fixture_path(), "--", state_dir, mode]
+}
+
+def program_mode_args(root, state_dir, mode : string) : array<string> {
+    var args <- ["--program", das_exe(), "--name", "wdtest", "--cwd", root, "--no-health",
+        "--stable-seconds", "0.1", "--max-restart-delay", "0.5", "--"]
+    args |> push_from(child_args(state_dir, mode))
+    return <- args
+}
+
+// A supervision that never ends fails the test instead of hanging the sweep: tick with a
+// deadline, and past it stop the supervisor and name the events it logged.
+def run_bounded(t : T?; var sup : Supervisor?; seconds : float) : int {
+    let started = ref_time_ticks()
+    while (!sup->tick()) {
+        if (float(get_time_usec(started)) > seconds * 1000000.0) {
+            t |> failure("supervision did not end within {seconds} s: {event_names(read_events(sup.cfg.log))}")
+            sup->request_stop()
+            let grace = ref_time_ticks()
+            while (!sup->tick() && get_time_usec(grace) < 30000000) {
+                sleep(50u)
+            }
+            break
+        }
+        sleep(10u)
+    }
+    return sup.result
+}
+
+// Script mode is `daslang -jit <script>`, and a daslang that cannot start the JIT (no LLVM
+// library beside it) has no script-mode child to supervise. The fixture with no arguments
+// returns 2; any other code from a -jit run means the JIT never came up.
+def jit_runs() : bool {
+    let argv <- [das_exe(), "-jit", fixture_path()]
+    let no_env : array<string>
+    var code : int
+    unsafe {
+        var p = spawn_process(argv, "", no_env)
+        code = process_wait(p, 60.0)
+        close_process(p)
+    }
+    return code == 2
+}
+
+def skip_without_jit(t : T?) : bool {
+    if (jit_runs()) return false
+    t |> skip("this daslang cannot start the JIT, so script mode (daslang -jit) has no child to supervise here")
+    return true
+}
+
+[test]
+def test_config_layering(t : T?) {
+    t |> run("watchdog.json sets flag defaults, a flag on the command line wins, -- goes to the child") @(t : T?) {
+        let root = make_temp(t, "wd config ")
+        if (empty(root)) return
+        fwrite(path_join(root, "watchdog.json"),
+            "\{\"name\": \"fromjson\", \"health_interval\": 7, \"no_health\": true, \"server_args\": [\"a\", \"b\"]\}")
+        let resolved <- resolve_config(["--name", "fromcli", "--program", das_exe()], root)
+        t |> equal(resolved.error, "")
+        t |> equal(resolved.cfg.name, "fromcli", "the flag beats the config")
+        t |> equal(resolved.cfg.health_interval, 7.0, "the config sets a default")
+        t |> success(resolved.cfg.no_health, "a true bool in the config sets the flag")
+        t |> equal(length(resolved.cfg.server_args), 2, "server_args default from the config: {resolved.cfg.server_args}")
+        let with_tail <- resolve_config(["--program", das_exe(), "--", "-x", "child arg"], root)
+        t |> equal(with_tail.error, "")
+        t |> equal(length(with_tail.cfg.server_args), 2)
+        if (length(with_tail.cfg.server_args) == 2) {
+            t |> equal(with_tail.cfg.server_args[0], "-x", "flag-shaped child args survive")
+            t |> equal(with_tail.cfg.server_args[1], "child arg")
+        }
+        t |> equal(with_tail.cfg.name, "fromjson", "the config's name applies when no flag names one")
+        t |> success(ends_with(with_tail.cfg.log, "fromjson-watchdog.log"), "log path keyed on the name: {with_tail.cfg.log}")
+        fwrite(path_join(root, "watchdog.json"), "\{\"helth_url\": \"x\"\}")
+        let typo <- resolve_config(["--program", das_exe()], root)
+        t |> success(find(typo.error, "helth_url") >= 0, "an unknown key is fatal and named: {typo.error}")
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_discovery(t : T?) {
+    t |> run("main.das beside bin/Release/daslang means script mode; two exes are ambiguous; nothing is an error") @(t : T?) {
+        let root = make_temp(t, "wd discover ")
+        if (empty(root)) return
+        mkdir(path_join(root, "bin"))
+        mkdir(path_join(root, "bin/Release"))
+        fwrite(path_join(root, "main.das"), "")
+        fwrite(path_join(root, "bin/Release/daslang"), "")
+        let script_mode <- resolve_config(["--no-health"], root)
+        t |> equal(script_mode.error, "")
+        t |> success(ends_with(script_mode.cfg.script, "main.das"), "script discovered: {script_mode.cfg.script}")
+        t |> success(ends_with(replace(script_mode.cfg.daslang, "\\", "/"), "bin/Release/daslang"), "the daslang beside it is the one discovered, not the bare fallback: {script_mode.cfg.daslang}")
+        t |> equal(script_mode.cfg.name, base_name(root), "a script names itself after its directory")
+        let command <- child_command(script_mode.cfg)
+        t |> success(length(command) >= 4 && command[1] == "-jit" && command[3] == "--", "script command shape: {command}")
+        remove(path_join(root, "bin/Release/daslang"))
+        mkdir(path_join(root, "tree"))
+        mkdir(path_join(root, "tree/bin"))
+        fwrite(path_join(root, "tree/bin/daslang"), "")
+        let in_tree <- resolve_config(["--no-health", "--cwd", root], path_join(root, "tree/bin"))
+        t |> equal(in_tree.error, "")
+        t |> success(ends_with(replace(in_tree.cfg.daslang, "\\", "/"), "tree/bin/daslang"), "no daslang beside the script: the one beside the watchdog serves it: {in_tree.cfg.daslang}")
+        remove(path_join(root, "tree/bin/daslang"))
+        let alone <- resolve_config(["--no-health", "--cwd", root], path_join(root, "tree"))
+        t |> success(find(alone.error, "nothing to supervise") >= 0, "main.das with no daslang in reach is refused: {alone.error}")
+        remove(path_join(root, "main.das"))
+        fwrite(path_join(root, "one.exe"), "")
+        fwrite(path_join(root, "two.exe"), "")
+        let ambiguous <- resolve_config([], root)
+        t |> success(find(ambiguous.error, "2 executables") >= 0, "two exes are refused: {ambiguous.error}")
+        remove(path_join(root, "two.exe"))
+        let program_mode <- resolve_config([], root)
+        t |> equal(program_mode.error, "")
+        t |> equal(program_mode.cfg.name, "one", "an executable names itself")
+        remove(path_join(root, "one.exe"))
+        let nothing <- resolve_config([], root)
+        t |> success(find(nothing.error, "nothing to supervise") >= 0, "an empty directory is an error: {nothing.error}")
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_stages_are_ranked_and_monotonic(t : T?) {
+    t |> run("only a forward move reports; the tune restart rewinds the rank") @(t : T?) {
+        var detector = new StageDetector()
+        var stage = Stage(name = "", rank = 0, since = 0.0)
+        var moved = detector->advance(stage, "LLVM JIT: DLL cache miss, codegen for foo.dll", 1.0)
+        t |> success(moved != null && (moved?["stage"] ?? "") == "jit_codegen", "first move: jit_codegen")
+        moved = detector->advance(stage, "Library foo linked - ok", 2.5)
+        t |> success(moved != null && (moved?["stage"] ?? "") == "jit_linked", "forward move: jit_linked")
+        t |> equal(moved?["after"] ?? "", "jit_codegen", "the previous stage is named")
+        t |> equal(float(moved?["elapsed_s"] ?? 0.0lf), 1.5, "and how long it took")
+        moved = detector->advance(stage, "LLVM JIT: DLL cache miss, codegen for bar.dll", 3.0)
+        t |> success(moved == null, "a lower-ranked line mid-tune does not flap the stage back")
+        moved = detector->advance(stage, "llvm_tune: restart to apply the winners", 4.0)
+        t |> success(moved != null && (moved?["stage"] ?? "") == "tune_restart", "the restart marker is a move")
+        t |> equal(stage.rank, 0, "and it resets the rank so the sequence can replay")
+        moved = detector->advance(stage, "LLVM JIT: DLL cache hit foo.dll", 5.0)
+        t |> success(moved != null && (moved?["stage"] ?? "") == "jit_cached", "the replay advances again")
+        t |> success(detector->advance(stage, "nothing to see here", 6.0) == null, "an unmatched line is not a stage")
+        unsafe {
+            delete detector
+        }
+    }
+}
+
+[test]
+def test_parse_child_event(t : T?) {
+    t |> run("@tune <kind> k=v ... splits into a kind and fields; other lines do not") @(t : T?) {
+        let ev <- parse_child_event("@tune plan scope=metal total=12", "@tune ")
+        t |> equal(ev.kind, "plan")
+        t |> equal(ev.fields?["scope"] ?? "", "metal")
+        t |> equal(ev.fields?["total"] ?? "", "12")
+        let none <- parse_child_event("plain child output", "@tune ")
+        t |> equal(none.kind, "")
+    }
+}
+
+[test]
+def test_emitter_envelope_and_rotation(t : T?) {
+    t |> run("one JSON object per line with ts and event, fields beside them; the file rotates at the size cap") @(t : T?) {
+        let root = make_temp(t, "wd log ")
+        if (empty(root)) return
+        let log_path = path_join(root, "logs/x-watchdog.log")
+        var log = new Emitter(log_path)
+        log.tee = false
+        log->emit("hello", JV((pid = 42, note = "n")))
+        let events <- read_events(log_path)
+        t |> equal(length(events), 1)
+        if (length(events) == 1) {
+            t |> equal(events[0]?["event"] ?? "", "hello")
+            t |> equal(int(events[0]?["pid"] ?? 0l), 42)
+            t |> equal(events[0]?["note"] ?? "", "n")
+            t |> success(length(events[0]?["ts"] ?? "") >= 19, "an ISO timestamp: {events[0]?["ts"] ?? ""}")
+        }
+        log.max_bytes = 1l
+        log->emit("second")
+        t |> success(fexist("{log_path}.1"), "the full file rotated to .1")
+        let after <- read_events(log_path)
+        t |> equal(length(after), 1, "the live file holds only the record written after rotation")
+        unsafe {
+            delete log
+        }
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_supervise_crash_then_clean_exit(t : T?) {
+    t |> run("a crash is reported, bundled and restarted with backoff; exit 0 ends supervision") @(t : T?) {
+        notifications_enabled = false
+        let root = make_temp(t, "wd crash ")
+        if (empty(root)) return
+        let state_dir = path_join(root, "state")
+        mkdir(state_dir)
+        // the child names a cached JIT DLL under the (cwd-relative) jit dir; the bundle must
+        // copy it and its siblings under jitted_scripts/ keeping the relative layout
+        mkdir(path_join(root, ".jitted_scripts"))
+        mkdir(path_join(root, ".jitted_scripts/sub"))
+        fwrite(path_join(root, ".jitted_scripts/sub/fake.dll"), "dll")
+        fwrite(path_join(root, ".jitted_scripts/sub/fake.pdb"), "pdb")
+        var code = 0
+        var sup = watchdog_start(program_mode_args(root, state_dir, "crash-then-ok"), root, 0, code)
+        t |> success(sup != null, "supervision started (code {code})")
+        if (sup == null) return
+        t |> equal(run_bounded(t, sup, 60.0), 0, "supervision ends with 0 after the child's clean exit")
+        let events <- read_events(sup.cfg.log)
+        t |> equal(count_event(events, "child_started"), 2, "the child ran twice: {event_names(events)}")
+        t |> equal(event_int(events, "crash", "code"), 9, "the first exit was reported as a crash")
+        t |> equal(count_event(events, "crash_bundle"), 1, "one bundle collected")
+        t |> equal(event_int(events, "child_exited", "code", 1), 0, "the second exit was clean")
+        t |> equal(count_event(events, "intentional_shutdown"), 1)
+        t |> equal(count_event(events, "watchdog_stopped"), 1)
+        t |> equal(count_event(events, "stage"), 4, "the JIT line and the ready line moved the stage on both runs")
+        var bundles = 0
+        dir(sup.cfg.crash_dir) $(fname) {
+            if (starts_with(fname, "wdtest-")) {
+                bundles++
+                let bundle = path_join(sup.cfg.crash_dir, fname)
+                t |> success(fexist(path_join(bundle, "crash.json")), "crash.json in the bundle")
+                t |> success(fexist(path_join(bundle, "jitted_scripts/sub/fake.dll")), "the named JIT DLL is in the bundle under its relative path")
+                t |> success(fexist(path_join(bundle, "jitted_scripts/sub/fake.pdb")), "and its sibling artifacts beside it")
+            }
+        }
+        t |> equal(bundles, 1)
+        unsafe {
+            delete sup
+        }
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_supervise_config_restart(t : T?) {
+    t |> run("exit 4 relaunches at once with no crash report") @(t : T?) {
+        notifications_enabled = false
+        let root = make_temp(t, "wd config restart ")
+        if (empty(root)) return
+        let state_dir = path_join(root, "state")
+        mkdir(state_dir)
+        var code = 0
+        var sup = watchdog_start(program_mode_args(root, state_dir, "config-restart"), root, 0, code)
+        t |> success(sup != null, "supervision started (code {code})")
+        if (sup == null) return
+        t |> equal(run_bounded(t, sup, 60.0), 0)
+        let events <- read_events(sup.cfg.log)
+        t |> equal(count_event(events, "config_restart_relaunch"), 1, "{event_names(events)}")
+        t |> equal(count_event(events, "crash"), 0, "no crash was reported")
+        t |> equal(count_event(events, "child_started"), 2)
+        unsafe {
+            delete sup
+        }
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_supervise_tune_bootstrap(t : T?) {
+    t |> run("script mode: exit 3 after the restart marker relaunches at once") @(t : T?) {
+        if (skip_without_jit(t)) return
+        notifications_enabled = false
+        let root = make_temp(t, "wd tune ")
+        if (empty(root)) return
+        let state_dir = path_join(root, "state")
+        mkdir(state_dir)
+        let args <- ["--daslang", das_exe(), "--script", fixture_path(), "--name", "wdtune", "--cwd", root,
+            "--no-health", "--stable-seconds", "0.1", "--max-restart-delay", "0.5", "--", state_dir, "tune-then-ok"]
+        var code = 0
+        var sup = watchdog_start(args, root, 0, code)
+        t |> success(sup != null, "supervision started (code {code})")
+        if (sup == null) return
+        t |> equal(run_bounded(t, sup, 60.0), 0)
+        let events <- read_events(sup.cfg.log)
+        t |> equal(count_event(events, "tune_bootstrap_complete"), 1, "{event_names(events)}")
+        t |> equal(count_event(events, "crash"), 0)
+        t |> equal(count_event(events, "child_started"), 2)
+        unsafe {
+            delete sup
+        }
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_supervise_tune_abort_backs_off(t : T?) {
+    t |> run("script mode: exit 3 without the restart marker is a tuner abort - relaunched with backoff, not a crash") @(t : T?) {
+        if (skip_without_jit(t)) return
+        notifications_enabled = false
+        let root = make_temp(t, "wd tune abort ")
+        if (empty(root)) return
+        let state_dir = path_join(root, "state")
+        mkdir(state_dir)
+        let args <- ["--daslang", das_exe(), "--script", fixture_path(), "--name", "wdabort", "--cwd", root,
+            "--no-health", "--stable-seconds", "0.1", "--max-restart-delay", "0.5", "--", state_dir, "tune-abort"]
+        var code = 0
+        var sup = watchdog_start(args, root, 0, code)
+        t |> success(sup != null, "supervision started (code {code})")
+        if (sup == null) return
+        t |> equal(run_bounded(t, sup, 60.0), 0)
+        let events <- read_events(sup.cfg.log)
+        t |> equal(count_event(events, "tune_incomplete"), 1, "{event_names(events)}")
+        t |> equal(count_event(events, "tune_bootstrap_complete"), 0, "no marker, no bootstrap")
+        t |> equal(count_event(events, "crash"), 0, "an abort is not a crash")
+        t |> equal(count_event(events, "child_started"), 2)
+        unsafe {
+            delete sup
+        }
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_request_stop_terminates_with_no_shutdown(t : T?) {
+    t |> run("--no-shutdown: the stop request terminates the child instead of asking it") @(t : T?) {
+        notifications_enabled = false
+        let root = make_temp(t, "wd stop terminate ")
+        if (empty(root)) return
+        let state_dir = path_join(root, "state")
+        mkdir(state_dir)
+        var args <- ["--program", das_exe(), "--name", "wdterm", "--cwd", root, "--no-health", "--no-shutdown", "--"]
+        args |> push_from(child_args(state_dir, "park"))
+        var code = 0
+        var sup = watchdog_start(args, root, 0, code)
+        t |> success(sup != null, "supervision started (code {code})")
+        if (sup == null) return
+        var parked = false
+        let started = ref_time_ticks()
+        while (!parked && get_time_usec(started) < 15000000) {
+            sup->tick()
+            for (ev in read_events(sup.cfg.log)) {
+                if ((ev?["event"] ?? "") == "child" && (ev?["message"] ?? "") == "parked") {
+                    parked = true
+                }
+            }
+        }
+        t |> success(parked, "the child reported it was parked")
+        sup->request_stop()
+        var done = false
+        let stop_started = ref_time_ticks()
+        while (!done && get_time_usec(stop_started) < 15000000) {
+            done = sup->tick()
+        }
+        t |> success(done, "supervision ended after the stop request")
+        t |> equal(sup.result, 0, "a stop the host asked for ends with 0 whatever the child's code")
+        let events <- read_events(sup.cfg.log)
+        t |> equal(count_event(events, "terminate_requested"), 1, "{event_names(events)}")
+        t |> equal(count_event(events, "stop_file_requested"), 0)
+        t |> equal(count_event(events, "shutdown_requested"), 0)
+        unsafe {
+            delete sup
+        }
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
+[test]
+def test_request_stop_uses_the_stop_file(t : T?) {
+    t |> run("the host's stop request writes the stop file; the parked child exits 0 and supervision ends") @(t : T?) {
+        notifications_enabled = false
+        let root = make_temp(t, "wd stop ")
+        if (empty(root)) return
+        let state_dir = path_join(root, "state")
+        mkdir(state_dir)
+        var args <- ["--program", das_exe(), "--name", "wdpark", "--cwd", root, "--no-health",
+            "--stop-file", path_join(root, "stop"), "--"]
+        args |> push_from(child_args(state_dir, "park"))
+        var code = 0
+        var sup = watchdog_start(args, root, 0, code)
+        t |> success(sup != null, "supervision started (code {code})")
+        if (sup == null) return
+        var parked = false
+        let started = ref_time_ticks()
+        while (!parked && get_time_usec(started) < 15000000) {
+            sup->tick()
+            for (ev in read_events(sup.cfg.log)) {
+                if ((ev?["event"] ?? "") == "child" && (ev?["message"] ?? "") == "parked") {
+                    parked = true
+                }
+            }
+        }
+        t |> success(parked, "the child reported it was parked")
+        sup->request_stop()
+        var done = false
+        let stop_started = ref_time_ticks()
+        while (!done && get_time_usec(stop_started) < 15000000) {
+            done = sup->tick()
+        }
+        t |> success(done, "supervision ended after the stop request")
+        t |> equal(sup.result, 0)
+        let events <- read_events(sup.cfg.log)
+        t |> equal(count_event(events, "stop_file_requested"), 1, "{event_names(events)}")
+        t |> equal(event_int(events, "child_exited", "code"), 0, "the child left through its stop-file handshake")
+        t |> success(!fexist(path_join(root, "stop")), "the stop file is cleared at the end")
+        unsafe {
+            delete sup
+        }
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
diff --git a/utils/CMakeLists.txt b/utils/CMakeLists.txt
index df8c121369..1494f67d25 100644
--- a/utils/CMakeLists.txt
+++ b/utils/CMakeLists.txt
@@ -171,6 +171,7 @@ SET(DAS_UTILS_TO_TEST
     internal/ast-fuzz
     internal/requirefix
     internal/test-release
+    daspkg/test_daspkg.das
 )
 
 FOREACH(_das ${DAS_UTILS_TO_TEST})
@@ -186,3 +187,54 @@ ADD_CUSTOM_TARGET(run_utils_tests
     WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}
     COMMENT "Running utils tests"
 )
+
+# watchdog: the supervisor as a standalone context on the full runtime - libDaScript and dasHV
+# as static archives, no compiler, no shared module, no lock on the files it deploys (the shape of
+# examples/standalone/06_full_runtime). Lands in bin/ and installs beside daslang.
+if(NOT DAS_HV_DISABLED)
+    set(WATCHDOG_GEN "${CMAKE_CURRENT_BINARY_DIR}/_watchdog_ctx_generated")
+    file(MAKE_DIRECTORY "${WATCHDOG_GEN}")
+    file(GLOB WATCHDOG_DAS_SOURCES CONFIGURE_DEPENDS "${PROJECT_SOURCE_DIR}/utils/watchdog/*.das")
+    add_custom_command(
+        OUTPUT "${WATCHDOG_GEN}/main.das.cpp" "${WATCHDOG_GEN}/main.das.h"
+        COMMAND $<TARGET_FILE:daslang>
+            "${PROJECT_SOURCE_DIR}/utils/aot/main.das"
+            -- -ctx "${PROJECT_SOURCE_DIR}/utils/watchdog/main.das"
+            "${WATCHDOG_GEN}/"
+        DEPENDS daslang
+            ${WATCHDOG_DAS_SOURCES}
+            "${PROJECT_SOURCE_DIR}/utils/aot/main.das"
+            "${PROJECT_SOURCE_DIR}/daslib/aot_standalone.das"
+            "${PROJECT_SOURCE_DIR}/daslib/aot_cpp.das"
+        WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
+        COMMENT "Standalone AOT (full runtime): watchdog"
+        VERBATIM
+    )
+    add_executable(watchdog
+        "${PROJECT_SOURCE_DIR}/utils/watchdog/main.cpp" "${WATCHDOG_GEN}/main.das.cpp")
+    target_include_directories(watchdog PRIVATE
+        "${WATCHDOG_GEN}"
+        ${NEED_MODULES_PATH}
+        "${PROJECT_SOURCE_DIR}/modules/dasHV/hv/$<CONFIG>/include")
+    target_link_libraries(watchdog PRIVATE libDaScript ${SRC_LIBRARIES} libDasModuleHV)
+    SETUP_CPP11(watchdog)
+    SETUP_BIN_RPATH(watchdog)
+    set_target_properties(watchdog PROPERTIES
+        RUNTIME_OUTPUT_DIRECTORY ${PROJECT_SOURCE_DIR}/bin
+        FOLDER "utils")
+    if(NOT MSVC AND CMAKE_BUILD_TYPE STREQUAL "Release")
+        add_custom_command(TARGET watchdog POST_BUILD
+            COMMAND ${CMAKE_STRIP} $<TARGET_FILE:watchdog>
+            COMMENT "Stripping watchdog")
+    endif()
+    INSTALL(TARGETS watchdog RUNTIME DESTINATION ${DAS_INSTALL_BINDIR})
+    add_test(NAME watchdog_smoke
+        COMMAND ${CMAKE_COMMAND}
+            -DWATCHDOG=$<TARGET_FILE:watchdog>
+            -DDASLANG=$<TARGET_FILE:daslang>
+            -DDAS_ROOT=${PROJECT_SOURCE_DIR}
+            -DWORK_DIR=${CMAKE_CURRENT_BINARY_DIR}/watchdog_smoke
+            -P ${PROJECT_SOURCE_DIR}/utils/watchdog/smoke_test.cmake)
+    set_tests_properties(watchdog_smoke PROPERTIES LABELS "small" TIMEOUT 120)
+    add_dependencies(test-small watchdog)
+endif()
diff --git a/utils/dasllama-server/.das_package b/utils/dasllama-server/.das_package
index afcfc16a78..7d3741266e 100644
--- a/utils/dasllama-server/.das_package
+++ b/utils/dasllama-server/.das_package
@@ -15,7 +15,7 @@ def release() {
     // JIT-only: per-box [tune]/[llvm_code] kernels + a shared-module [init] global (the vulkan
     // GPU-tier arm probe) that a baked -exe mis-wires. daspkg release refuses; deploy via -jit.
     release_requires_jit()
-    release_include_from("utils/watchdog/watchdog.py")
+    release_include_tool("watchdog")
     release_include("watchdog.json")
     release_include("control.html")
     release_include("tray.ico")   // the forge dasllama mark — watchdog --tray picks it up
diff --git a/utils/dasllama-server/CONTROL_PAGE_PLAN.md b/utils/dasllama-server/CONTROL_PAGE_PLAN.md
index 57f693635c..a51cf207de 100644
--- a/utils/dasllama-server/CONTROL_PAGE_PLAN.md
+++ b/utils/dasllama-server/CONTROL_PAGE_PLAN.md
@@ -148,7 +148,7 @@ scheduler 12/12, server 17/17 live (post-work stats assertions), page via mock+p
   the program (created if the server started config-less). `GET /config` returns effective
   config + per-key source (default / cli / toml) for the form.
 - **Restart**: `POST /restart` = drain like `/shutdown`, then exit with a **distinct** exit
-  code (3 stays tune-restart; pick 4 = config-restart; `watchdog.py` treats both as relaunch,
+  code (3 stays tune-restart; pick 4 = config-restart; the watchdog treats both as relaunch,
   logs them apart).
 - **Model picker**: server enumerates `*.gguf` / `*.dlim` in the configured model's directory
   (`load_model` already auto-caches gguf->`.dlim` beside the file in q8 mode - show which rail
diff --git a/utils/dasllama-server/README.md b/utils/dasllama-server/README.md
index 0c149396b1..12da46f902 100644
--- a/utils/dasllama-server/README.md
+++ b/utils/dasllama-server/README.md
@@ -157,17 +157,17 @@ Set-Location E:/dasllama-server
 
 # Run once from an elevated PowerShell. Installs an app-specific WER normal-minidump policy;
 # it does not dump the model weights/private heap.
-python ./watchdog.py --install-local-dumps
+.\watchdog.exe --install-local-dumps
 
 # Day-to-day launch, no elevation. dasllama-server.toml is auto-loaded from this directory.
 $env:DAS_JOBQUE_THREADS = "16"
-python ./watchdog.py --require-dumps
+.\watchdog.exe --require-dumps
 ```
 
-From the source tree the watchdog no longer sits beside the script, so pass `--cwd`:
+From the source tree the watchdog does not sit beside the script, so pass `--cwd`:
 
 ```powershell
-python utils/watchdog/watchdog.py --cwd utils/dasllama-server --jit-stack
+bin/Release/watchdog.exe --cwd utils/dasllama-server --jit-stack
 ```
 
 The first JIT start on an untuned box writes the tune sidecar and exits with code 3; the watchdog
@@ -175,20 +175,20 @@ recognizes that bootstrap exit and relaunches. That cold path - DLL cache miss,
 (`jit_codegen` -> `jit_linked` -> `tuning` -> `model_load` -> `ready`) with the elapsed time of
 each, and reports health only on transition plus a heartbeat.
 
-It writes rotating JSON-line logs, samples process memory once a minute, and polls `/v1/models`
+It writes rotating JSON-line logs and polls `/v1/models`
 (use `--health-url`/`--shutdown-url` for a non-default port). `--jit-stack` records every generated
 daslang call in the logical stack; Windows JIT links also retain a compact `.map` beside the
 `.dll/.o`. After a crash it waits for the WER minidump, copies it with the matching JIT artifacts,
 tune manifest, metadata and log into `logs/crashes/`, shows a Windows notification, and restarts
 with bounded exponential backoff. The ten newest bundles are retained.
 
-Full watchdog reference - config keys, discovery rules, control plugins: `utils/watchdog/README.md`.
+Full watchdog reference - config keys, discovery rules, the log: `utils/watchdog/README.md`.
 
 ## Deploying (daspkg release)
 
 `release_requires_jit()` makes `daspkg release` refuse this package outright: baking a `-exe`
 would drop the per-box JIT kernels and ship a broken binary. Deploy by staging the JIT bundle -
-`main.das`, `bin/Release/daslang.exe` plus the runtime DLLs and shared modules, `watchdog.py`,
+`main.das`, `bin/Release/daslang.exe` plus the runtime DLLs and shared modules, `watchdog.exe`,
 `watchdog.json`, `control.html` - into the target directory, and keep the deployed
 `dasllama-server.toml` and `dasllama-server.tune.json` across upgrades. Stop a running server first;
 Windows locks the DLLs.
@@ -257,9 +257,9 @@ boot resolver and submit check are never registered and every `/exchange*` route
 expressed. Setting any `exchange_*` key (TOML or env) IS that choice; on the zero-config
 path the recorded choice lives in `<app>.tune.consent` beside the sidecar
 (`accepted`/`declined`, one word). With no recorded choice: an interactive terminal asks
-inline (Enter = Accept); a supervised boot emits `@sidecar consent state=needed` - the
-watchdog shows a native Accept/Decline dialog - and this page's exchange card carries the
-same banner (`POST /exchange/consent`). Until one of those answers, the box tunes locally
+inline (Enter = Accept); a supervised boot emits `@sidecar consent state=needed`, and this
+page's exchange card carries the banner (`POST /exchange/consent`). Until one of those
+answers, the box tunes locally
 and no request leaves. The `gpu` key (`auto | off | metal | metal-required | vulkan`) is the first-class
 backend selector, and **defaults-first: unset (with no legacy `--metal` flag) behaves as
 `auto`** - the boot probes the box and serves on the best detected backend (the Metal rails
diff --git a/utils/dasllama-server/deploy-jit.ps1 b/utils/dasllama-server/deploy-jit.ps1
index f191adcdb7..0b10c294ed 100644
--- a/utils/dasllama-server/deploy-jit.ps1
+++ b/utils/dasllama-server/deploy-jit.ps1
@@ -9,7 +9,7 @@
 # all resolve.
 #
 # Run:  powershell -File utils/dasllama-server/deploy-jit.ps1 [-Dest E:\dasllama-server]
-# Then, from the bundle:  python watchdog.py    (finds bin/Release/daslang.exe, runs -jit main.das)
+# Then, from the bundle:  .\watchdog.exe    (finds bin/Release/daslang.exe, runs -jit main.das)
 #
 # The config (dasllama-server.toml) is PRESERVED if it already exists.
 
@@ -45,11 +45,11 @@ foreach ($m in @("dasLLAMA","dasLLVM","dasVulkan","dasHV","dasSpirv","dasAudio",
 
 # 4. server sources + control page + watchdog at the bundle root (main.das's require siblings
 #    live beside it; SERVE_FILE reads control.html from the main.das dir). The watchdog is the
-#    shared supervisor from utils/watchdog; watchdog.json pins the deployment name.
+#    shared supervisor, the static bin\Release\watchdog.exe; watchdog.json pins the deployment name.
 foreach ($f in @("main.das","openai_server.das","llm_scheduler.das","ask.das","wav2txt.das","control.html","watchdog.json","tray.ico",".das_package")) {
     Copy-Item (Join-Path $PSScriptRoot $f) $Dest -Force
 }
-Copy-Item (Join-Path $Repo "utils\watchdog\watchdog.py") $Dest -Force
+Copy-Item (Join-Path $Repo "bin\Release\watchdog.exe") $Dest -Force
 # ship the box tune sidecar (main.das's app sidecar) so first launch runs the tuned kernels
 # instead of re-tuning (which would exit 3 restart-loop under the watchdog).
 $tune = Join-Path $PSScriptRoot "main.tune.json"
@@ -70,4 +70,4 @@ foreach ($stale in @("dasllama-server.exe","dasllama-server.lib","dasllama-serve
     if (Test-Path $p) { Remove-Item $p -Force }
 }
 
-Write-Host "deploy-jit: done. Launch from $Dest with:  python watchdog.py"
+Write-Host "deploy-jit: done. Launch from $Dest with:  .\watchdog.exe"
diff --git a/utils/dasllama-server/test_openai_server.das b/utils/dasllama-server/test_openai_server.das
index 63eb99ce88..93edbc2a53 100644
--- a/utils/dasllama-server/test_openai_server.das
+++ b/utils/dasllama-server/test_openai_server.das
@@ -602,7 +602,7 @@ def test_openai_server(t : T?) {   // nolint:STYLE038 — one live server sessio
             }
             remove(junk)
             // POST /restart — LAST in the block: the server starts draining after this. The exit-4
-            // half of the contract lives in main.das + watchdog.py (not exercisable here).
+            // half of the contract lives in main.das + utils/watchdog (not exercisable here).
             POST("{base_url}/restart", "") $(resp) {
                 t |> equal(int(resp.status_code), int(http_status.OK))
                 t |> success(find(string(resp.body), "\"restarting\":true") >= 0, "restart response flags restarting")
diff --git a/utils/dasllama-server/watchdog.json b/utils/dasllama-server/watchdog.json
index becef821bc..f19b0ea6ec 100644
--- a/utils/dasllama-server/watchdog.json
+++ b/utils/dasllama-server/watchdog.json
@@ -1,4 +1,3 @@
 {
-  "name": "dasllama",
-  "tray": true
+  "name": "dasllama"
 }
diff --git a/utils/daspkg/REVIEW.md b/utils/daspkg/REVIEW.md
index b0a6525d07..2b49a11b78 100644
--- a/utils/daspkg/REVIEW.md
+++ b/utils/daspkg/REVIEW.md
@@ -13,16 +13,17 @@ change.** The integration suite is `bin/daslang dastest/dastest.das -- --test
 utils/daspkg/test_daspkg_git.das`, and it needs network (the `borisbat/daspkg-test-*` fixture
 repos).
 
-**A change to `cmd_release`, `cmd_release_wasm`, or a `release_*` helper states in the review
-whether the release was run on macOS.** The release layout differs per platform (`.app` bundle
-vs flat directory).
+**A diff that changes any code on the `daspkg release` path - `cmd_release`, `cmd_release_wasm`,
+and the `ship_*` / `release_*` helpers they call in `commands.das` - states in the review whether
+the release was run on macOS.** The release layout differs per platform (`.app` bundle vs flat
+directory).
 
 **A diff that adds a command or a flag also adds its `print_usage` line and its `README.md`
 table row, in the same change.**
 
-**A `cmd_release` bundle that ships an exe without a tune sidecar beside it is a defect** - the
+**A `cmd_release` bundle whose main exe ships without a tune sidecar beside it is a defect** - the
 tune sidecar is the `<bundle>.tune.json` file of measured kernel choices the exe reads at run
-time.
+time; a tool shipped by `release_include_tool` carries no `[tune]` kernels and needs none.
 
 **A diff that lets a release path other than `--quick` reuse a sidecar from an earlier run is a
 defect.**
@@ -46,7 +47,9 @@ account for.
 **A test in `test_daspkg.das` that reaches the network is a defect** - network coverage belongs
 in `test_daspkg_git.das`.
 
-**A shell command built from any string a `.das_package` supplies - a package, bundle, app or
-module name - outside `commands.das`, or without an `is_safe_pkg_name` check on that string
-first, is a defect** - `is_safe_pkg_name` is private to `commands.das`. The emcc flags of
-`release_emcc_arg` are the carve-out: free-form shell text by design, appended verbatim.
+**A shell command or filesystem path built from any string a `.das_package` supplies - a
+package, bundle, app, module or tool name - outside `commands.das`, or without an
+`is_safe_pkg_name` check on that string first, is a defect** - `is_safe_pkg_name` is private to
+`commands.das`, and a name carrying a separator or `..` reads or writes outside the directory
+the path was built for. The emcc flags of `release_emcc_arg` are the carve-out: free-form shell
+text by design, appended verbatim.
diff --git a/utils/daspkg/commands.das b/utils/daspkg/commands.das
index 544dee14f7..6395587537 100644
--- a/utils/daspkg/commands.das
+++ b/utils/daspkg/commands.das
@@ -1983,6 +1983,38 @@ def private ship_external_files(bundle_name, dst_dir : string; external_files :
 }
 
 
+//! A built tool ships by bare name from `<das_root>/bin/` - the installed SDK and single-config
+//! trees - or `bin/Release/` in an MSVC tree, with the platform's `.exe`, to the bundle root.
+def public ship_tools(bundle_name, dst_dir : string; tools : array<string>; var shipped : array<string>; das_root : string) : int {
+    let ext = get_platform_name() == "windows" ? ".exe" : ""
+    shipped |> reserve(length(shipped) + length(tools))
+    for (name in tools) {
+        if (!is_safe_pkg_name(name)) {
+            to_log(LOG_ERROR, "release: `{bundle_name}` declared release_include_tool(\"{name}\") - a tool is a bare name, no path separators\n")
+            return 1
+        }
+        var src = path_join(das_root, "bin/{name}{ext}")
+        if (!fexist(src)) {
+            src = path_join(das_root, "bin/Release/{name}{ext}")
+        }
+        if (!fexist(src)) {
+            to_log(LOG_ERROR, "release: `{bundle_name}` declared release_include_tool(\"{name}\") but neither bin/{name}{ext} nor bin/Release/{name}{ext} exists under {das_root}\n")
+            return 1
+        }
+        let dst = path_join(dst_dir, "{name}{ext}")
+        var err : string
+        if (!copy_file(src, dst, true, err)) {
+            to_log(LOG_ERROR, "release: copy_file({src} -> {dst}) failed: {err}\n")
+            return 1
+        }
+        scrub_external_rpaths(dst)
+        ship_symbols_for(src, shipped)
+        shipped |> push("{name}{ext}")
+    }
+    log("  ship tools: {length(tools)} file(s)\n")
+    return 0
+}
+
 def private ship_native_dlls(dep_name, dst_dir : string; native_dlls : array<string>;
                              var shipped : array<string>; rel_prefix : string) : int {
     let platform = get_platform_name()
@@ -2506,6 +2538,10 @@ def cmd_release(root : string; out_dir : string; paranoid = false; quick = false
         let rc4 = ship_external_files(bundle_name, bundle_dir, spec.external_files, shipped)
         if (rc4 != 0) return rc4
     }
+    if (!empty(spec.tools)) {
+        let rc5 = ship_tools(bundle_name, bundle_dir, spec.tools, shipped, get_das_root())
+        if (rc5 != 0) return rc5
+    }
 
     // 5. macOS .app: write Contents/Info.plist. Bundle ID source priority:
     //    explicit release_bundle_id() > derived com.<sanitized-author>.<sanitized-name>
diff --git a/utils/daspkg/package_runner.das b/utils/daspkg/package_runner.das
index 3071052394..7bacb623f2 100644
--- a/utils/daspkg/package_runner.das
+++ b/utils/daspkg/package_runner.das
@@ -49,6 +49,7 @@ struct PackageReleaseInfo {
     requires_jit : bool
     include_symbols : bool
     external_files : array<string>
+    tools : array<string>
 }
 
 
@@ -159,6 +160,9 @@ def run_das_package_release(das_package_path : string; var info : PackageRelease
             for (e in src.external_files) {
                 info.external_files |> push(clone_string(e))
             }
+            for (tool in src.tools) {
+                info.tools |> push(clone_string(tool))
+            }
         }
     }
     return ok
diff --git a/utils/daspkg/test_daspkg.das b/utils/daspkg/test_daspkg.das
index 8f717e1144..c334321530 100644
--- a/utils/daspkg/test_daspkg.das
+++ b/utils/daspkg/test_daspkg.das
@@ -55,6 +55,41 @@ def moved_bundle_exe_path(moved_root, name : string) : string {
     return path_join(moved_root, "{name}.exe")
 }
 
+[test]
+def test_ship_tools(t : T?) {
+    t |> run("a tool ships by bare name from bin/, then bin/Release/, with the platform's exe suffix; a missing tool fails the release") @(t : T?) {
+        let tmp = create_temp_directory_result("daspkg tools ")
+        if (!(tmp is value)) {
+            t |> failure("could not create temp directory: {tmp as error}")
+            return
+        }
+        let root = tmp as value
+        let das_root = path_join(root, "root")
+        let bundle = path_join(root, "bundle")
+        let ext = get_platform_name() == "windows" ? ".exe" : ""
+        mkdir(das_root)
+        mkdir(path_join(das_root, "bin"))
+        mkdir(path_join(path_join(das_root, "bin"), "Release"))
+        mkdir(bundle)
+        fwrite(path_join(das_root, "bin/flat{ext}"), "flat")
+        fwrite(path_join(das_root, "bin/Release/msvc{ext}"), "msvc")
+        var shipped : array<string>
+        t |> equal(ship_tools("pkg", bundle, ["flat", "msvc"], shipped, das_root), 0, "both tools resolve")
+        t |> equal(length(shipped), 2)
+        t |> success(fexist(path_join(bundle, "flat{ext}")), "bin/<tool> lands at the bundle root")
+        t |> success(fexist(path_join(bundle, "msvc{ext}")), "bin/Release/<tool> lands at the bundle root")
+        var none : array<string>
+        t |> equal(ship_tools("pkg", bundle, ["absent"], none, das_root), 1, "a tool no build produced fails the release")
+        t |> equal(length(none), 0)
+        fwrite(path_join(root, "escaped{ext}"), "outside")
+        var unsafe_name : array<string>
+        t |> equal(ship_tools("pkg", bundle, ["../escaped"], unsafe_name, das_root), 1, "a name with a path separator is refused before any path is built")
+        t |> success(!fexist(path_join(bundle, "escaped{ext}")), "nothing was copied for the refused name")
+        let cleanup = rmdir_rec_result(root)
+        t |> success(cleanup is value && cleanup as value, "temp dir removed")
+    }
+}
+
 [test]
 def test_package_name_from_source(t : T?) {
     t |> run("github URL") @(t : T?) {
diff --git a/utils/internal/dasllama-ladder/.das_package b/utils/internal/dasllama-ladder/.das_package
index cf7660072e..815f09527e 100644
--- a/utils/internal/dasllama-ladder/.das_package
+++ b/utils/internal/dasllama-ladder/.das_package
@@ -13,7 +13,7 @@ def release() {
     release_main("main.das")
     release_name("dasllama-ladder")
     release_include_if_missing("dasllama-ladder.toml") // initialize once; preserve deployed edits (paths, submit_open) on upgrades
-    release_include_from("utils/watchdog/watchdog.py")
+    release_include_tool("watchdog")
     release_include_if_missing("watchdog.json")        // carries the port + health/shutdown urls — an operator edit must survive upgrades
     release_include("admin.das")                       // operator curation CLI; run with a daslang SDK on the box
     release_include("admin.html")                      // the loopback /admin/ operator page, served beside the sources
diff --git a/utils/internal/dasllama-ladder/README.md b/utils/internal/dasllama-ladder/README.md
index c39041546d..1df091d668 100644
--- a/utils/internal/dasllama-ladder/README.md
+++ b/utils/internal/dasllama-ladder/README.md
@@ -87,7 +87,7 @@ re-race, cross-box matrix, version diff) is in `plans/dasllama_io_site.md`.
 
 ## 6. Deploy
 
-Mirrors dasweb-playground: a `daspkg release` bundle, supervised by `systemd -> watchdog.py`,
+Mirrors dasweb-playground: a `daspkg release` bundle, supervised by `systemd -> watchdog`,
 fronted by Caddy on the `dasllama.io` vhost. `dasllama-deploy.sh` is the box-side tool, run
 through the scoped sudoers drop-in (`dasllama-deploy.sudoers`) - the one privileged surface.
 
diff --git a/utils/internal/dasllama-ladder/dasllama-deploy.sh b/utils/internal/dasllama-ladder/dasllama-deploy.sh
index 06a3012215..74f8aad2ce 100644
--- a/utils/internal/dasllama-ladder/dasllama-deploy.sh
+++ b/utils/internal/dasllama-ladder/dasllama-deploy.sh
@@ -50,7 +50,7 @@ Type=simple
 User=$SVCUSER
 Group=$SVCUSER
 WorkingDirectory=$APP/current
-ExecStart=/usr/bin/python3 watchdog.py
+ExecStart=$APP/current/watchdog
 Restart=on-failure
 RestartSec=5
 
diff --git a/utils/internal/dasweb-buildd/.das_package b/utils/internal/dasweb-buildd/.das_package
index 3526882a7a..da6aef3b4c 100644
--- a/utils/internal/dasweb-buildd/.das_package
+++ b/utils/internal/dasweb-buildd/.das_package
@@ -13,7 +13,7 @@ def release() {
     release_main("main.das")
     release_name("dasweb-buildd")
     release_include_if_missing("dasweb-buildd.toml")   // initialize once; preserve deployed edits on upgrades
-    release_include_from("utils/watchdog/watchdog.py")
+    release_include_tool("watchdog")
     release_include_if_missing("watchdog.json")
     release_include("run_build.sh")                    // the sandboxed build recipe the service invokes
     release_include("Containerfile")                   // the sandbox image definition; run_build.sh refuses to build without it
diff --git a/utils/internal/dasweb-buildd/README.md b/utils/internal/dasweb-buildd/README.md
index bdf9dc07af..062af5a539 100644
--- a/utils/internal/dasweb-buildd/README.md
+++ b/utils/internal/dasweb-buildd/README.md
@@ -14,8 +14,9 @@ death degrades to a backed-up queue, never a site outage. Review rules: `REVIEW.
 # development against a local playground (start that first on :8101)
 daslang utils/internal/dasweb-buildd/main.das -- --token dev --toolchain <40-hex> --build-cmd "bash run_build.sh"
 
-# supervised production form (inside a daspkg release bundle)
-python3 watchdog.py
+# supervised production form (inside a daspkg release bundle): the static watchdog binary
+# the release ships at the bundle root (release_include_tool), no Python on the box
+./watchdog
 
 # release bundle
 daslang utils/daspkg/main.das -- release --root utils/internal/dasweb-buildd --out <dir>
diff --git a/utils/internal/dasweb-playground/.das_package b/utils/internal/dasweb-playground/.das_package
index d0c1565d8f..ddc7337d41 100644
--- a/utils/internal/dasweb-playground/.das_package
+++ b/utils/internal/dasweb-playground/.das_package
@@ -13,7 +13,7 @@ def release() {
     release_main("main.das")
     release_name("dasweb-playground")
     release_include_if_missing("dasweb-playground.toml") // initialize once; preserve deployed edits on upgrades
-    release_include_from("utils/watchdog/watchdog.py")
+    release_include_tool("watchdog")
     release_include_if_missing("watchdog.json")          // carries the port too — an operator edit must survive upgrades
     release_include("admin.das")                         // operator curation CLI; run with a daslang SDK on the box
 }
diff --git a/utils/internal/dasweb-playground/README.md b/utils/internal/dasweb-playground/README.md
index 89ca934d99..95846c0012 100644
--- a/utils/internal/dasweb-playground/README.md
+++ b/utils/internal/dasweb-playground/README.md
@@ -10,8 +10,9 @@ curated-sample listing and the wasm build queue. Review rules: `REVIEW.md` (bind
 # development (interpreted or -jit)
 daslang utils/internal/dasweb-playground/main.das -- --port 8101 --db samples.db
 
-# supervised production form (inside a daspkg release bundle)
-python3 watchdog.py
+# supervised production form (inside a daspkg release bundle): the static watchdog binary
+# the release ships at the bundle root (release_include_tool), no Python on the box
+./watchdog
 
 # release bundle
 daslang utils/daspkg/main.das -- release --root utils/internal/dasweb-playground --out <dir>
diff --git a/utils/watchdog/README.md b/utils/watchdog/README.md
index c297a22a5c..1ac8bfa754 100644
--- a/utils/watchdog/README.md
+++ b/utils/watchdog/README.md
@@ -1,38 +1,41 @@
 # watchdog
 
-One Python supervisor for any daslang program that needs to stay up. It restarts the child with
-bounded backoff, captures crashes into bundles, reports startup progress, and optionally exposes a
-per-program control page.
+One supervisor for any daslang program that needs to stay up. It restarts the child with
+bounded backoff, captures crashes into bundles, reports startup progress, and polls health.
+It supervises `utils/dasllama-server` (JIT) in-tree and the dictation bot in the das-telegram
+package (a baked exe).
 
-It supervises `utils/dasllama-server` (JIT) in-tree and the dictation bot in the
-das-telegram package (a baked exe) - and was merged from the two forks those grew.
+It ships as a static executable, `bin/watchdog` (`bin/Release/watchdog.exe` in an MSVC tree): a
+`-ctx` standalone context on the full runtime with `libDaScript` and dasHV linked as static
+archives. It compiles nothing at run time, loads no shared module, and holds no lock on any file
+a deploy replaces, so a deploy can overwrite the runtime while the watchdog runs. The same code
+runs under the interpreter for development: `daslang utils/watchdog/main.das -- --cwd <dir>`.
 
 ## Running it
 
-In a deployed bundle, with no arguments:
+In a deployed bundle, beside the program, with no arguments:
 
 ```
-python watchdog.py
+./watchdog
 ```
 
 That works because the watchdog resolves what to supervise in this order, first match winning:
 
 1. **A command-line flag** - `--program`, `--script`, `--name`, and the rest (`--help` lists them).
-2. **`watchdog.json`** beside `watchdog.py` - every key sets the *default* for the flag of the same
-   name, so a flag still overrides it. An unknown key is a hard error: silently ignoring a typo
-   would supervise the program with the wrong wiring and nothing would say so.
-3. **Layout discovery** - `main.das` next to `bin/Release/daslang.exe` means `daslang -jit main.das`;
-   exactly one `*.exe` in the directory means that program. Anything ambiguous is an error, never a
-   guess.
-
-Both in-tree programs are discoverable, so their `watchdog.json` only pins the identity that the
-log, pid file and notifications key on (`cadmus`, `dasllama`) plus whatever discovery cannot know -
-that the bot has no HTTP health endpoint, for instance.
-
-From the source tree the watchdog no longer sits beside what it supervises, so pass `--cwd`:
+2. **`watchdog.json`** beside the executable - every key is a flag name with underscores, and
+   sets the *default* for that flag, so a flag still overrides it. An unknown key is a hard error:
+   silently ignoring a typo would supervise the program with the wrong wiring and nothing would
+   say so. A `server_args` array is the default for what follows `--`.
+3. **Layout discovery** - `main.das` means `daslang -jit main.das`, with the daslang found beside
+   it (`bin/Release/daslang(.exe)`) or beside the watchdog itself, which is how `bin/watchdog`
+   in a source tree finds `bin/daslang`; exactly one `*.exe` in the directory means that
+   program. Anything ambiguous is an error, never a guess.
+
+Everything after `--` goes to the child verbatim. From the source tree the watchdog does not sit
+beside what it supervises, so pass `--cwd`:
 
 ```
-python utils/watchdog/watchdog.py --cwd utils/dasllama-server
+bin/watchdog --cwd utils/dasllama-server
 ```
 
 ## Exit codes it acts on
@@ -40,117 +43,88 @@ python utils/watchdog/watchdog.py --cwd utils/dasllama-server
 | code | meaning |
 |---|---|
 | 0 | intentional shutdown - the watchdog stops too |
-| 3 | tune bootstrap wrote the sidecar (local tuner OR an exchange download - both print a "restart to apply the winners" marker); relaunch immediately (JIT only) |
+| 3 | tune bootstrap wrote the sidecar (the child printed "restart to apply the winners"); relaunch immediately (script mode only) |
 | 4 | config restart requested by a control page; relaunch immediately |
 | other | crash - report, notify, bundle, restart with bounded exponential backoff |
 
-Exit 3 *without* the marker is a tuner abort (noise gate, or a tray-requested stop). A noise
-abort restarts with backoff - an immediate relaunch on a loud box just aborts again. A
-tray-requested stop relaunches immediately with the policy the user picked (below).
+Exit 3 *without* the marker is a tuner abort (the noise gate found the box too loud to trust);
+it restarts with backoff, because an immediate relaunch on a loud box just aborts again. A code
+comes back from the child's `main`: a das `exit(N)` is an abnormal termination and reports 1.
 
-## Startup stages
+## Stopping it
+
+Ctrl-C or SIGTERM asks the child to stop: through `--stop-file` (the path is handed to the child
+in the `--stop-env` variable, `CADMUS_STOP_FILE` by default, and the file is created on the
+request), through a POST to `--shutdown-url`, or with `--no-shutdown` by terminating it. The
+stop is a ladder with an end: after `--stop-timeout` seconds the child is terminated, ten
+seconds later killed, and ten seconds after that left behind (`child_unkillable`, exit 1).
+Supervision otherwise ends with 0.
 
-A cold JIT start takes minutes (DLL cache miss, codegen, per-box tuning, model load), which used to
-look like a hang punctuated by health-check spam. The watchdog now tracks ranked, monotonic stages -
-`jit_cached`, `jit_codegen`, `jit_linked`, `exchange_lookup`, `tuning`, `tune_restart`,
-`model_load`, `asr_init`, `ready` - and logs a `stage` event on each forward move, with how long
-the previous stage took.
+Two watchdogs would mean two children fighting over one port, so the pid file (`--pid-file`,
+`logs/<name>-watchdog.pid` by default) both records and protects: a second start refuses while
+the recorded pid is alive.
 
-Ranked and monotonic matters: a tune runs many codegen/link cycles, and a naive matcher flaps
-between stages once per kernel variant. Health is logged only on transition plus a heartbeat, so a
+## Startup stages
+
+A cold JIT start takes minutes (DLL cache miss, codegen, per-box tuning, model load), which
+would otherwise look like a hang punctuated by health-check spam. The watchdog tracks ranked,
+monotonic stages from the child's own log lines - `jit_cached`, `jit_codegen`, `jit_linked`,
+`exchange_lookup`, `tuning`, `tune_restart`, `model_load`, `asr_init`, `ready` - and logs a
+`stage` event on each forward move, with how long the previous stage took. Ranked and monotonic
+matters: a tune runs many codegen/link cycles, and a naive matcher flaps between stages once
+per kernel variant; `tune_restart` is the one legitimate rewind, since the process restarts to
+apply the winners. Health is logged only on transition plus a heartbeat every five minutes, so a
 long quiet run stays quiet.
 
-Stages are still detected from the child's own log prose, which is brittle by nature. The planned
-replacement is an explicit `das-stage: <name>` token emitted by the program, with these regexes
-kept as fallback.
-
-### Tune progress
-
-The one part no longer inferred from prose. `llvm_tune` emits structured progress as
-`@tune <kind> k=v ...` lines, and a supervised child never owns a terminal, so it *forwards* those
-events rather than drawing a progress bar - which is what makes them ours to consume.
-
-The watchdog folds them into `STATE["tune"]` (`scope`, `done`/`total` kernels, `kernel`,
-`round`/`rounds`, `phase`, `live`) for the control plugin's status route, and logs a `tune` event
-only at `plan` and `end` - a real tune is hundreds of steps, and logging each one would recreate
-the flood these events exist to replace. On a measured run that is **26 log records from 551
-events**, where the whole raw tuner output used to be JSON-wrapped into the log line by line.
-
-Every field is a counter. Nothing is an estimate: the tuner cannot know how long it has left, so
-no ETA is published and none should be synthesized from these numbers.
-
-### The exchange (`@sidecar` events, the tray's tune actions)
-
-dasllama's exchange client emits `@sidecar <kind> k=v ...` on the same contract (`lookup`,
-`none`, `offer`, `apply`, `pending_submit`, `submitted`, `consent`); the watchdog folds them
-into `STATE["sidecar"]` and logs each one. `consent state=needed` (the GDPR first-contact
-gate: the client found no recorded choice and no terminal to ask on) raises a native
-Accept/Decline dialog - osascript on macOS, MessageBoxW on Windows, a plain notification
-pointing at the control page elsewhere - once per consent file for the watchdog's lifetime.
-The answer lands in the consent file the event names (url-encoded `path=`); Accept during a
-tune also rides the stop rail below (mode `consent`: stop at the boundary, relaunch clean,
-the fresh boot runs the now-consented lookup). Walking away from the dialog answers nothing.
-Balloons announce a decision but never carry the action - the tray menu and the control page
-do:
-
-- **Use available sidecar instead (stops tuning)** - visible while a tune is in flight AND an
-  unverified offer exists. Writes the tune-control file (the tuner polls `DAS_TUNE_CONTROL` at
-  kernel-family boundaries, so the measurement in flight always completes), then relaunches with
-  a ONE-SHOT `DASLLAMA_EXCHANGE_ACCEPT=any` - consent that never outlives the click.
-- **Stop tuning, run untuned** - visible while a tune is in flight. Same stop file, then a
-  `DAS_TUNE_POLICY=fallback` hold kept in `STATE["sticky_env"]` and re-applied on every spawn,
-  so a later crash-restart cannot surprise the box with a ~12-minute tune. The hold shows as
-  `* tuning off` in the tooltip and is revocable via **Resume tuning**; a control-page config
-  restart (which a re-tune rides) also clears it, so the re-tune is not silently defeated.
-- **Resume tuning** - visible only while a run-untuned hold is active; clears it so the next
-  start tunes normally again.
-- **Share this box's tune...** - visible while a `pending_submit` offer stands and the server is
-  healthy; opens the control page at the exchange card.
-
-Balloons fire once per distinct sidecar sha across restarts, so an untuned noise-abort loop does
-not re-announce the same offer every boot.
-
-The tray menu is a pure function of `STATE`, but note the mechanism: pystray bakes each item's
-`visible`/`enabled` when the menu is BUILT and does **not** re-evaluate them when the menu opens.
-The supervision tick's `update_menu()` on a `STATE` transition is therefore the only thing that
-refreshes the dynamic items - so its transition key must name every `STATE` field an item's
-predicate reads (health, the sidecar state, `tuning_disabled`), or that item never appears.
-
-## Control plugin
-
-If a `watchdog_control.py` sits beside `watchdog.py`, the watchdog imports it and calls
-`start(logger, args)`, injecting `host` (the watchdog module) first so the plugin can use
-`host.emit(...)` and `host.read_state()` rather than re-declaring them and drifting.
-
-Supervision stays generic; anything that knows what a *particular* program is lives in the plugin.
-The dictation bot's `watchdog_control.py` (das-telegram package) is the worked example: it owns `dictation.toml`,
-the prompt set, generation defaults and the activity feed, and is ~480 lines that have no business
-in a supervisor. A plugin that fails to import is reported and skipped, never fatal - keeping the
-program alive outranks being able to reconfigure it.
-
-`host.read_state()` publishes supervision state (`child_pid`, `child_started_at`,
-`child_exit_code`, `restart_delay`, `stage`, `healthy`, `serving_since`, `tune`, `sidecar`,
-`tuning_disabled`) for the plugin's status route. Transient control keys (`tune_stop`,
-`sticky_env`, `resume_tuning`) also live in `STATE` but are consumed by the supervision loop -
-a status route should not surface them.
+`llvm_tune` emits structured progress as `@tune <kind> k=v ...` lines; the watchdog logs a
+`tune` event at the kernel boundaries (`plan`, `end`, `abort`) and drops the hundreds of steps
+between them.
+
+## The log
+
+`logs/<name>-watchdog.log` (`--log`), one JSON object per line, `{"ts", "event", ...}`, rotated
+at 20 MB with five backups, and echoed to stdout. The events: `watchdog_started`,
+`child_started`, `spawn_failed`, `child` (one per line the child wrote), `stage`, `tune`,
+`health`, `health_heartbeat`, `recovered`, `child_exited`, `intentional_shutdown`,
+`tune_bootstrap_complete`, `tune_incomplete`, `config_restart_relaunch`, `crash`,
+`crash_bundle`, `stop_file_requested`, `shutdown_requested`, `shutdown_request_failed`,
+`terminate_requested`, `kill_requested`, `child_unkillable`, `watchdog_already_running`,
+`wer_ready` / `wer_not_ready` / `wer_installed` / `wer_install_failed`, `watchdog_stopped`.
+In-tree readers: `smoke_test.cmake` and `tests/watchdog/test_watchdog.das`.
+
+## Crash capture
+
+Crash bundles collect the log, any WER minidump, the program's symbols, the tune sidecar and
+the JIT artifacts the child named into `logs/crashes/<name>-<stamp>-pid<pid>/`, pruned to the
+newest `--crash-bundles`. WER local dumps need a one-time elevated `--install-local-dumps`
+(Windows); `--require-dumps` refuses to start without a policy, for a deployment where losing
+the dump is not acceptable. See `examples/crash/README.md` for which failure families are
+visible to which tier.
+
+## Notifications
+
+A crash, a recovery and a refused start raise a desktop notification: a PowerShell balloon on
+Windows, Notification Center through `osascript` on macOS, `notify-send` on Linux, nothing where
+none exists. Never fatal.
 
 ## Shipping it
 
-`watchdog.py` lives outside every package, so manifests reach it with `release_include_from`, which
-sources relative to the daslang root:
+A package manifest names the tool once for every platform:
 
 ```das
-release_include_from("utils/watchdog/watchdog.py")
-release_include("watchdog_control.py")   // package-local, if the program has one
+release_include_tool("watchdog")         // bin/watchdog or bin/Release/watchdog.exe -> bundle root
 release_include("watchdog.json")
 ```
 
-A missing source fails the release rather than shipping a bundle quietly short a file.
+A build without the executable fails the release rather than shipping a bundle quietly short
+a supervisor.
 
-## Crash capture
+## Layout
 
-Crash bundles collect the log, any WER minidump, the program's symbols, the tune sidecar and the JIT
-artifact cache into `logs/crashes/<name>-<stamp>-pid<pid>/`, pruned to the newest N. WER local dumps
-need a one-time elevated `--install-local-dumps`; `--require-dumps` refuses to start without a
-policy, for a deployment where losing the dump is not acceptable. See `examples/crash/README.md` for
-which failure families are visible to which tier.
+- `watchdog.das` - the library: configuration, discovery, the log, stages, crash capture, and
+  `Supervisor`, a state machine the host ticks (`tick()` / `request_stop()` / `run()`).
+- `main.das` - the entry for both hosts: `start` / `tick` / `request_stop` / `result` for the
+  executable, `main` for the interpreter.
+- `main.cpp` - the executable's `main`: argv, the pid, the signals, the loop.
+- `smoke_test.cmake` - the `watchdog_smoke` ctest: the binary supervising a daslang child through
+  a crash and a clean exit. The library's own tests are `tests/watchdog/`.
diff --git a/utils/watchdog/REVIEW.md b/utils/watchdog/REVIEW.md
index 24f1516a46..f61074582f 100644
--- a/utils/watchdog/REVIEW.md
+++ b/utils/watchdog/REVIEW.md
@@ -3,5 +3,17 @@
 **Read `REVIEW_COMMON.md` (repo root) first - its contract binds this checklist.** Architecture
 doc: `README.md`.
 
-**A diff that changes the consent wording in `watchdog.py` answers to
-`modules/dasLLAMA/performance/REVIEW.md` (repo root) too.**
+**A diff that renames or removes a name on the JSON-lines log - an `event` value, a key of one,
+or a startup stage name - updates every reader in the same change: the event list and the stage
+list in `README.md`, `smoke_test.cmake`, and `tests/watchdog/test_watchdog.das` (repo root), and
+names any out-of-tree reader in the PR description** - the log is the wire everything
+downstream reads, and a reader that stops seeing the event it waits for never fails loudly.
+
+**A diff that adds a field to `WatchdogConfig` makes it discoverable in the same change: a
+`@clarg_doc` on a flag field, or - for a `@clarg_skip` field - its key exemption in
+`config_to_args` and its line in `README.md`** - the flag table is the whole of `--help`, and
+`watchdog.json` keys are validated against the same field list.
+
+**A diff that removes or renames a `WatchdogConfig` field updates every `watchdog.json` in the
+tree in the same change** - an unknown key refuses the start, so a stale key in a bundled
+config is a supervisor that never comes up.
diff --git a/utils/watchdog/dummy_server.py b/utils/watchdog/dummy_server.py
deleted file mode 100644
index b616968004..0000000000
--- a/utils/watchdog/dummy_server.py
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/usr/bin/env python3
-"""Dummy supervised program for exercising the watchdog's desktop surfaces (tray icon, menu,
-notifications) without a real service. Serves the health endpoint the watchdog polls, a hello
-page for the tray's Open item, a /crash link to trip the crash path on demand, and the
-POST /shutdown the tray's Shutdown routes through.
-
-Rig: put watchdog.py beside this file with a watchdog.json of
-  {"name": "dummy", "tray": true, "program": "dummy_server.py",
-   "health_url": "http://127.0.0.1:8765/v1/models",
-   "shutdown_url": "http://127.0.0.1:8765/shutdown", "stable_seconds": 15}
-then run `python3 watchdog.py`.
-"""
-import os
-import threading
-import time
-from http.server import BaseHTTPRequestHandler, HTTPServer
-
-PORT = 8765
-
-PAGE = """<!doctype html><meta charset="utf-8"><title>dummy server</title>
-<body style="font: 16px system-ui; padding: 2em; max-width: 40em">
-<h1>dummy server</h1>
-<p>Watchdog desktop-surface test target. The tray's Open item brought you here.</p>
-<p><a href="/crash">crash me</a> — exits 139 so the watchdog's crash notification,
-bundle, backoff, and recovery notification can all be watched in one click.</p>
-</body>"""
-
-
-def exit_soon(code: int) -> None:
-    # let the in-flight response land before the process dies
-    threading.Thread(target=lambda: (time.sleep(0.2), os._exit(code)), daemon=True).start()
-
-
-class Handler(BaseHTTPRequestHandler):
-    def reply(self, code: int, body: str, ctype: str = "text/plain") -> None:
-        data = body.encode("utf-8")
-        self.send_response(code)
-        self.send_header("Content-Type", f"{ctype}; charset=utf-8")
-        self.send_header("Content-Length", str(len(data)))
-        self.end_headers()
-        self.wfile.write(data)
-
-    def do_GET(self) -> None:
-        if self.path == "/v1/models":
-            self.reply(200, '{"object":"list","data":[]}', "application/json")
-        elif self.path == "/crash":
-            print("dummy: crashing on request", flush=True)
-            self.reply(200, "crashing\n")
-            exit_soon(139)
-        else:
-            self.reply(200, PAGE, "text/html")
-
-    def do_POST(self) -> None:
-        if self.path == "/shutdown":
-            print("dummy: shutdown requested", flush=True)
-            self.reply(200, "bye\n")
-            exit_soon(0)
-        else:
-            self.reply(404, "no such endpoint\n")
-
-    def log_message(self, *_args) -> None:
-        pass  # the watchdog logs every stdout line; per-request spam adds nothing
-
-
-def main() -> None:
-    print("dummy: warming up", flush=True)
-    time.sleep(3)  # long enough for the tray to visibly show "booting"
-    server = HTTPServer(("127.0.0.1", PORT), Handler)
-    # this exact phrase trips the watchdog's "ready" startup stage, like the real server
-    print(f"listening on http://127.0.0.1:{PORT}", flush=True)
-    server.serve_forever()
-
-
-if __name__ == "__main__":
-    main()
diff --git a/utils/watchdog/main.cpp b/utils/watchdog/main.cpp
new file mode 100644
index 0000000000..05ba1bcd1f
--- /dev/null
+++ b/utils/watchdog/main.cpp
@@ -0,0 +1,45 @@
+// The watchdog as a standalone context on the full runtime: libDaScript and dasHV linked as static
+// archives, no compiler, no shared module, no lock on any file a deploy replaces. main owns what a
+// context cannot - argv, the process id, the signals - and drives the supervisor one tick at a time;
+// everything else is utils/watchdog/watchdog.das.
+
+#include "daScript/daScript.h"
+#include "daScript/simulate/aot_builtin.h"
+#include "main.das.h"
+
+#include <atomic>
+#include <csignal>
+#ifdef _WIN32
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#else
+#include <unistd.h>
+#endif
+
+using namespace das;
+
+static std::atomic<bool> g_stop_requested{false};
+
+static void on_stop_signal ( int ) {
+    g_stop_requested = true;
+}
+
+int main ( int argc, char * argv[] ) {
+    setCommandLineArguments(argc, argv);
+    std::signal(SIGINT, on_stop_signal);
+    std::signal(SIGTERM, on_stop_signal);
+#ifdef _WIN32
+    std::signal(SIGBREAK, on_stop_signal);
+    const int32_t pid = (int32_t)GetCurrentProcessId();
+#else
+    const int32_t pid = (int32_t)getpid();
+#endif
+    main::Standalone ctx;
+    if ( !ctx.start(pid) ) return ctx.result();
+    bool done = false;
+    while ( !done ) {
+        if ( g_stop_requested ) ctx.request_stop();
+        done = ctx.tick();
+    }
+    return ctx.result();
+}
diff --git a/utils/watchdog/main.das b/utils/watchdog/main.das
new file mode 100644
index 0000000000..4cfae33e1f
--- /dev/null
+++ b/utils/watchdog/main.das
@@ -0,0 +1,63 @@
+options gen2
+options stack = 65536
+
+require daslib/fio
+require daslib/clargs
+require watchdog
+
+//! Two hosts share this entry. The standalone exe (`bin/watchdog`, a `-ctx` context on the full
+//! runtime) calls `start` / `tick` / `request_stop` / `result` from its C++ main, which owns argv,
+//! the pid and the signals. The interpreter (`daslang utils/watchdog/main.das -- --cwd <dir> ...`)
+//! runs `main`, the same supervision without the pid file or a signal hook.
+
+var private g_supervisor : Supervisor?
+var private g_exit_code = 0
+
+def private program_dir_from(args : array<string>) : string {
+    for (i in range(length(args) - 1)) {
+        if (args[i] == "--cwd") return get_full_file_name(args[i + 1])
+        if (args[i] == "--") break
+    }
+    return getcwd()
+}
+
+//! The exe host. `argv[0]` locates the bundle: `watchdog.json` and the discovered program sit
+//! beside the executable, exactly where the Python sat beside what it supervised.
+[export]
+def start(self_pid : int) : bool {
+    let argv <- get_command_line_arguments()
+    let args <- [for (i in range(1, length(argv))); argv[i]]
+    let program_dir = !empty(argv) ? dir_name(get_full_file_name(argv[0])) : getcwd()
+    g_supervisor = watchdog_start(args, program_dir, self_pid, g_exit_code)
+    return g_supervisor != null
+}
+
+[export]
+def tick() : bool {
+    return g_supervisor == null ? true : g_supervisor->tick()
+}
+
+[export]
+def request_stop() {
+    if (g_supervisor != null) {
+        g_supervisor->request_stop()
+    }
+}
+
+[export]
+def result() : int {
+    if (g_supervisor != null) {
+        g_exit_code = g_supervisor.result
+        unsafe {
+            delete g_supervisor
+        }
+    }
+    return g_exit_code
+}
+
+//! The interpreter host: the program directory is `--cwd`, or the current directory.
+[export]
+def main() : int {
+    let args <- get_cli_arguments()
+    return watchdog_main(args, program_dir_from(args), 0)
+}
diff --git a/utils/watchdog/smoke_test.cmake b/utils/watchdog/smoke_test.cmake
new file mode 100644
index 0000000000..40be7d6ca8
--- /dev/null
+++ b/utils/watchdog/smoke_test.cmake
@@ -0,0 +1,30 @@
+# The watchdog exe supervising a daslang child that crashes once and then exits cleanly:
+# supervision must end with 0, the log must carry one crash and two starts.
+# Inputs: WATCHDOG, DASLANG, DAS_ROOT, WORK_DIR.
+file(REMOVE_RECURSE "${WORK_DIR}")
+file(MAKE_DIRECTORY "${WORK_DIR}/state")
+execute_process(
+    COMMAND "${WATCHDOG}"
+        --program "${DASLANG}" --name smoke --cwd "${WORK_DIR}" --no-health
+        --stable-seconds 0.1 --max-restart-delay 0.5
+        -- -dasroot "${DAS_ROOT}" "${DAS_ROOT}/tests/watchdog/_fixture_watchdog_child.das"
+        -- "${WORK_DIR}/state" crash-then-ok
+    RESULT_VARIABLE rc
+    OUTPUT_VARIABLE out
+    ERROR_VARIABLE err
+    TIMEOUT 90)
+if(NOT rc EQUAL 0)
+    message(FATAL_ERROR "watchdog exited ${rc}\n--- stdout ---\n${out}\n--- stderr ---\n${err}")
+endif()
+file(READ "${WORK_DIR}/logs/smoke-watchdog.log" log)
+string(REGEX MATCHALL "\"event\": \"child_started\"" starts "${log}")
+string(REGEX MATCHALL "\"event\": \"crash\"" crashes "${log}")
+list(LENGTH starts n_starts)
+list(LENGTH crashes n_crashes)
+if(NOT n_starts EQUAL 2 OR NOT n_crashes EQUAL 1)
+    message(FATAL_ERROR "expected 2 child_started and 1 crash, got ${n_starts} and ${n_crashes}\n${log}")
+endif()
+string(FIND "${log}" "\"event\": \"intentional_shutdown\"" shutdown_at)
+if(shutdown_at EQUAL -1)
+    message(FATAL_ERROR "no intentional_shutdown in the log\n${log}")
+endif()
diff --git a/utils/watchdog/test_consent.py b/utils/watchdog/test_consent.py
deleted file mode 100644
index 00e1dd0bd0..0000000000
--- a/utils/watchdog/test_consent.py
+++ /dev/null
@@ -1,162 +0,0 @@
-"""The consent surface: the `@sidecar consent` fold, the non-sticky "consent" stop mode, and
-handle_consent_needed's write-then-stop contract (dialog mocked at the show_consent_dialog
-seam — the native call itself is not unit-testable). Self-runnable:
-python3 utils/watchdog/test_consent.py (pytest also works)."""
-
-import argparse
-import importlib.util
-import logging
-from pathlib import Path
-import tempfile
-from types import SimpleNamespace
-from urllib.parse import quote
-
-spec = importlib.util.spec_from_file_location("wd", Path(__file__).with_name("watchdog.py"))
-wd = importlib.util.module_from_spec(spec)
-spec.loader.exec_module(wd)
-
-
-def test_consent_event_folds_into_sidecar_state():
-    sidecar = {}
-    wd.apply_sidecar_event(sidecar, "consent", {"state": "needed", "path": "x"})
-    assert sidecar["consent"] == "needed"
-    wd.apply_sidecar_event(sidecar, "consent", {"state": "accepted"})
-    assert sidecar["consent"] == "accepted"
-
-
-def test_consent_stop_mode_is_one_shot_and_env_free():
-    # "consent" must relaunch CLEAN: no DASLLAMA_EXCHANGE_ACCEPT widening (that is
-    # use_sidecar's one-shot), no sticky DAS_TUNE_POLICY hold (that is run-untuned's)
-    with tempfile.TemporaryDirectory() as td:
-        args = argparse.Namespace(name="t", log=Path(td) / "t.log")
-        saved_notify, saved_set = wd.notify, wd.set_state
-        armed = {}
-        wd.notify = lambda *a, **k: None
-        wd.set_state = lambda **kv: armed.update(kv)
-        try:
-            wd.request_tune_stop(args, logging.getLogger("t"), "consent")
-        finally:
-            wd.notify, wd.set_state = saved_notify, saved_set
-        action = armed["tune_stop"]
-        assert action["mode"] == "consent"
-        assert action["env"] == {}
-        assert action["sticky"] is False
-        assert (Path(td) / "t.tune-stop").read_text() == "stop\n"
-
-
-def run_handler(answer, tune_running, consent_path):
-    """Drive handle_consent_needed with the dialog seam and thread spawn mocked; returns
-    the list of stop modes requested."""
-    args = argparse.Namespace(name="t", log=consent_path.parent / "t.log")
-    stopped = []
-    saved = (wd.show_consent_dialog, wd.tune_in_flight, wd.request_tune_stop,
-             wd.threading, wd.notify)
-    wd.show_consent_dialog = lambda: answer
-    wd.tune_in_flight = lambda: tune_running
-    wd.request_tune_stop = lambda a, lg, mode: stopped.append(mode)
-    wd.notify = lambda *a, **k: None
-
-    class SyncThread:
-        def __init__(self, target=None, **_kw):
-            self._target = target
-
-        def start(self):
-            self._target()
-
-    # rebind the MODULE's threading attribute - never mutate the shared stdlib module
-    wd.threading = SimpleNamespace(Thread=SyncThread)
-    try:
-        wd.handle_consent_needed(args, logging.getLogger("t"), quote(str(consent_path)))
-    finally:
-        (wd.show_consent_dialog, wd.tune_in_flight, wd.request_tune_stop,
-         wd.threading, wd.notify) = saved
-    return stopped
-
-
-def test_accept_writes_file_and_stops_a_running_tune():
-    with tempfile.TemporaryDirectory() as td:
-        p = Path(td) / "main.tune.consent"
-        stopped = run_handler(True, True, p)
-        assert p.read_text() == "accepted\n"
-        assert stopped == ["consent"]
-
-
-def test_accept_with_no_tune_in_flight_only_records():
-    with tempfile.TemporaryDirectory() as td:
-        p = Path(td) / "main.tune.consent"
-        stopped = run_handler(True, False, p)
-        assert p.read_text() == "accepted\n"
-        assert stopped == []
-
-
-def test_decline_records_and_never_stops_the_tune():
-    with tempfile.TemporaryDirectory() as td:
-        p = Path(td) / "main.tune.consent"
-        stopped = run_handler(False, True, p)
-        assert p.read_text() == "declined\n"
-        assert stopped == []
-
-
-def test_walkaway_answers_nothing():
-    # None (timeout / closed / no surface) must leave the question open: no file, no stop
-    with tempfile.TemporaryDirectory() as td:
-        p = Path(td) / "main.tune.consent"
-        stopped = run_handler(None, True, p)
-        assert not p.exists()
-        assert stopped == []
-
-
-def test_stream_child_dispatches_the_dialog_once_per_path():
-    # the @sidecar consent event must reach handle_consent_needed exactly once per consent
-    # file for the watchdog's lifetime - a noise/untuned boot loop re-emits it every restart
-    class FakeProc:
-        def __init__(self, lines):
-            self.stdout = iter(lines)
-            self.pid = 42
-    lines = [
-        "@sidecar consent state=needed path=a%2Fb.consent\n",
-        "@sidecar consent state=needed path=a%2Fb.consent\n",
-        "@sidecar consent state=needed path=other.consent\n",
-    ]
-    calls = []
-    args = argparse.Namespace(name="t", log=Path("/tmp/t.log"))
-    saved = (wd.handle_consent_needed, wd.notify)
-    wd.handle_consent_needed = lambda a, lg, path: calls.append(path)
-    wd.notify = lambda *a, **k: None
-    wd._BALLOONED.clear()
-    try:
-        wd.stream_child(FakeProc(lines), logging.getLogger("t"),
-                        __import__("threading").Event(), set(), {}, "t", args)
-    finally:
-        wd.handle_consent_needed, wd.notify = saved
-        wd._BALLOONED.clear()
-    assert calls == ["a%2Fb.consent", "other.consent"]
-
-
-def test_darwin_dialog_parse_arms():
-    # the osascript OUTPUT parse is unit-testable even though showing the dialog is not:
-    # Accept/Decline must map to True/False, gave-up and Escape must leave the question open
-    if not hasattr(wd, "show_consent_dialog") or wd.IS_WINDOWS or wd.sys.platform != "darwin":
-        return  # the parse under test is the darwin arm
-    def fake_run(stdout):
-        return SimpleNamespace(stdout=stdout)
-    saved = wd.subprocess
-    outs = {}
-    wd.subprocess = SimpleNamespace(
-        run=lambda *a, **k: fake_run(outs["v"]), TimeoutExpired=Exception)
-    try:
-        for text, want in [("button returned:Accept", True),
-                           ("button returned:Decline", False),
-                           ("button returned:Accept, gave up:true", None),
-                           ("", None)]:
-            outs["v"] = text
-            assert wd.show_consent_dialog() is want, (text, want)
-    finally:
-        wd.subprocess = saved
-
-
-if __name__ == "__main__":
-    for name, fn in sorted(globals().items()):
-        if name.startswith("test_"):
-            fn()
-            print(f"PASS {name}")
diff --git a/utils/watchdog/test_tray_state.py b/utils/watchdog/test_tray_state.py
deleted file mode 100644
index a238665907..0000000000
--- a/utils/watchdog/test_tray_state.py
+++ /dev/null
@@ -1,67 +0,0 @@
-"""tray_state() wording: a child that has never been healthy is "starting up" (amber, with
-plain-language stage labels); "unhealthy" (red) is reserved for a server that served and then
-stopped answering. Self-runnable: python3 utils/watchdog/test_tray_state.py (pytest also works)."""
-
-import importlib.util
-from pathlib import Path
-
-spec = importlib.util.spec_from_file_location("wd", Path(__file__).with_name("watchdog.py"))
-wd = importlib.util.module_from_spec(spec)
-spec.loader.exec_module(wd)
-
-
-def tray(**kv):
-    state = {"child_pid": 1, "healthy": None, "serving_since": 0.0, "stage": None}
-    state.update(kv)
-    saved = wd.read_state
-    wd.read_state = lambda: state
-    try:
-        return wd.tray_state()
-    finally:
-        wd.read_state = saved
-
-
-def test_cold_start_is_starting_up_not_unhealthy():
-    line, cls = tray(healthy=False, stage="jit_codegen")
-    assert cls == "amber"
-    assert line.startswith("starting up — ")
-    assert "unhealthy" not in line
-
-
-def test_every_stage_gets_a_plain_language_label():
-    for stage, label in wd.STAGE_LABELS.items():
-        line, cls = tray(healthy=False, stage=stage)
-        assert cls == "amber"
-        assert line == f"starting up — {label}"
-
-
-def test_unknown_stage_passes_through_and_no_stage_is_bare():
-    line, _ = tray(stage="model_warmup")
-    assert line == "starting up — model_warmup"
-    line, _ = tray(stage=None)
-    assert line == "starting up"
-
-
-def test_unhealthy_requires_having_served():
-    line, cls = tray(healthy=False, serving_since=123.0, stage="ready")
-    assert cls == "red"
-    assert line == "unhealthy (ready)"
-
-
-def test_serving_line_untouched():
-    line, cls = tray(healthy=True, serving_since=1.0)
-    assert cls == "base"
-    assert line.startswith("serving · healthy")
-
-
-if __name__ == "__main__":
-    failed = 0
-    for name, fn in sorted(globals().items()):
-        if name.startswith("test_") and callable(fn):
-            try:
-                fn()
-                print(f"PASS {name}")
-            except AssertionError as e:
-                failed += 1
-                print(f"FAIL {name}: {e}")
-    raise SystemExit(1 if failed else 0)
diff --git a/utils/watchdog/watchdog.das b/utils/watchdog/watchdog.das
new file mode 100644
index 0000000000..374f61d2ba
--- /dev/null
+++ b/utils/watchdog/watchdog.das
@@ -0,0 +1,1254 @@
+options gen2
+options indenting = 4
+
+module watchdog shared
+
+require strings
+require math
+require daslib/strings_boost
+require daslib/fio
+require daslib/clargs
+require daslib/result
+require daslib/json_boost
+require daslib/regex
+require daslib/regex_boost
+require dashv/dashv_boost
+
+//! Supervise a daslang program (`daslang -jit main.das`) or a standalone executable: restart it with
+//! bounded backoff, capture crashes into bundles, report startup stages, poll health. Exit 0 is an
+//! intentional shutdown, 3 a tune bootstrap (relaunched at once when the child printed the restart
+//! marker), 4 a config restart, anything else a crash. The host drives `Supervisor.tick()` on its
+//! own clock and calls `request_stop()` on a signal; `watchdog_main` runs that loop for a host that
+//! owns nothing else.
+
+let public TUNE_RESTART_EXIT = 3
+let public CONFIG_RESTART_EXIT = 4
+let public CONFIG_NAME = "watchdog.json"
+let private HEALTH_HEARTBEAT_SECONDS = 300.0
+let private TICK_MS = 250u
+let private LOG_MAX_BYTES = 20l * 1024l * 1024l
+let private LOG_BACKUPS = 5
+let private TUNE_EVENT_PREFIX = "@tune "
+
+// ---------------------------------------------------------------------------------------------
+// configuration: flags, watchdog.json beside the program, layout discovery, identity
+
+[CommandLineArgs]
+struct public WatchdogConfig {
+    @clarg_doc = "Identity the log, pid file and notifications key on; derived from the program"
+    name : string
+    @clarg_doc = "Run this standalone program instead of daslang -jit <script>; relative paths use --cwd"
+    program : string
+    @clarg_doc = "daslang binary for script mode; discovered beside the program when unset"
+    daslang : string
+    @clarg_doc = "Script for daslang -jit; discovered as main.das beside the program when unset"
+    script : string
+    @clarg_doc = "Directory the child runs in; defaults to the watchdog's own directory"
+    cwd : string
+    @clarg_doc = "JSON-lines log; defaults to logs/<name>-watchdog.log under --cwd"
+    log : string
+    @clarg_doc = "Single-instance pid file; defaults to logs/<name>-watchdog.pid under --cwd"
+    pid_file : string
+    @clarg_doc = "GET here every --health-interval seconds; 2xx is healthy"
+    health_url : string = "http://127.0.0.1:8080/v1/models"
+    @clarg_doc = "POST here to ask the child to stop"
+    shutdown_url : string = "http://127.0.0.1:8080/shutdown"
+    @clarg_doc = "Do not poll health"
+    no_health : bool
+    @clarg_doc = "Terminate instead of POSTing the shutdown url"
+    no_shutdown : bool
+    @clarg_doc = "Create this file to request a lifecycle-safe standalone shutdown"
+    stop_file : string
+    @clarg_doc = "Environment variable that carries --stop-file to the child"
+    stop_env : string = "CADMUS_STOP_FILE"
+    @clarg_doc = "Seconds to wait after a shutdown request before terminating"
+    stop_timeout : float = 1200.0
+    @clarg_doc = "Seconds between health polls"
+    health_interval : float = 5.0
+    @clarg_doc = "Uptime after which the restart backoff resets"
+    stable_seconds : float = 300.0
+    @clarg_doc = "Cap on the exponential restart delay"
+    max_restart_delay : float = 60.0
+    @clarg_doc = "Pass -jit-stack to daslang so every generated call has a logical stack frame"
+    jit_stack : bool
+    @clarg_doc = "Expected WER LocalDumps output folder"
+    dump_dir : string = "logs/dumps"
+    @clarg_doc = "Install an app-specific WER minidump policy and exit (Windows, elevated)"
+    install_local_dumps : bool
+    @clarg_doc = "Dumps WER keeps"
+    dump_count : int = 10
+    @clarg_doc = "Refuse to start unless a WER minidump policy is active"
+    require_dumps : bool
+    @clarg_doc = "Crash bundle destination"
+    crash_dir : string = "logs/crashes"
+    @clarg_doc = "Crash bundles kept"
+    crash_bundles : int = 10
+    @clarg_doc = "JIT artifact cache copied into each crash bundle"
+    jit_dir : string = ".jitted_scripts"
+    @clarg_doc = "Do not collect crash bundles"
+    no_crash_bundle : bool
+    @clarg_skip
+    server_args : array<string>
+}
+
+def private resolve_from(path, base : string) : string {
+    return get_full_file_name(is_absolute(path) ? path : path_join(base, path))
+}
+
+//! The config keys are the flag names with underscores; a key sets that flag's default, so a flag
+//! on the command line still wins. An unknown key is fatal: a typo must not supervise the program
+//! with the wrong wiring and say nothing.
+def private config_to_args(config : JsonValue?; cli : array<string>; source : string) : Result<array<string>; string> {
+    var out : array<string>
+    if (config == null) {
+        out |> push_from(cli)
+        return <- move_ok(out, type<string>)
+    }
+    let info <- get_command_info(type<WatchdogConfig>)
+    let known <- {for (arg in info.args); arg.field_name => 0}
+    for (key, val in keys(config as _object), values(config as _object)) {
+        if (key == "server_args") continue
+        if (!(known |> key_exists(key))) {
+            var names <- [for (arg in info.args); arg.field_name]
+            names |> sort()
+            return <- err("{source} has unknown key '{key}'; known keys: {join(names, ", ")}", type<array<string>>)
+        }
+        // the config's value goes first and the command line's copy after it: clargs keeps the
+        // last occurrence, so a flag on the command line wins without a lookup here
+        let flag = "--" + replace(key, "_", "-")
+        if (val is _bool) {
+            if (val as _bool) {
+                out |> push(flag)
+            }
+        } elif (val is _string) {
+            out |> push(flag)
+            out |> push(val as _string)
+        } elif (val is _longint) {
+            out |> push(flag)
+            out |> push("{val as _longint}")
+        } elif (val is _number) {
+            out |> push(flag)
+            out |> push("{val as _number}")
+        } elif (!(val is _null)) {
+            return <- err("{source}: key '{key}' must be a string, number or bool", type<array<string>>)
+        }
+    }
+    out |> push_from(cli)
+    return <- move_ok(out, type<string>)
+}
+
+//! The config's `server_args` array, the default for what follows `--` on the command line.
+def private config_server_args(config : JsonValue?) : array<string> {
+    var out : array<string>
+    if (config == null) return <- out
+    let val = config?["server_args"]
+    if (val == null || !(val is _array)) return <- out
+    out |> reserve(length(val as _array))
+    for (item in val as _array) {
+        out |> push(item is _string ? item as _string : write_json(item))
+    }
+    return <- out
+}
+
+struct private LoadedConfig {
+    js : JsonValue?
+    error : string
+}
+
+def private load_config(folder : string) : LoadedConfig {
+    let path = path_join(folder, CONFIG_NAME)
+    if (!fexist(path)) return LoadedConfig()
+    var text : string
+    fopen(path, "rb") $(f) {
+        if (f != null) {
+            text = fread(f)
+        }
+    }
+    var error : string
+    var js = read_json(text, error)
+    if (js == null) return LoadedConfig(error = "watchdog: {path} is not valid JSON: {error}")
+    if (!(js is _object)) return LoadedConfig(error = "watchdog: {path} must hold a JSON object")
+    return LoadedConfig(js = js)
+}
+
+//! What to supervise, from the layout: `main.das` means script mode when a daslang sits beside it
+//! (`bin/Release/daslang(.exe)`) or beside the watchdog itself (a source tree keeps both in `bin/`);
+//! exactly one `*.exe` means that program. Ambiguity is an error, never a guess.
+def private discover_target(var cfg : WatchdogConfig; folder, program_dir : string) : string {
+    let script = path_join(folder, "main.das")
+    if (fexist(script)) {
+        if (!empty(cfg.daslang)) {
+            cfg.script = script
+            return ""
+        }
+        let exe = find_daslang(daslang_roots(program_dir, folder))
+        if (fexist(exe)) {
+            cfg.script = script
+            cfg.daslang = exe
+            return ""
+        }
+    }
+    var exes : array<string>
+    dir(folder) $(fname) {
+        if (ends_with(fname, ".exe")) {
+            exes |> push(path_join(folder, fname))
+        }
+    }
+    if (length(exes) == 1) {
+        cfg.program = exes[0]
+        if (empty(cfg.name)) {
+            cfg.name = stem(exes[0])
+        }
+        return ""
+    }
+    if (length(exes) > 1) {
+        return "watchdog: {folder} holds {length(exes)} executables; pick one with --program or {CONFIG_NAME}"
+    }
+    return "watchdog: nothing to supervise in {folder} - expected a single *.exe, or main.das with a daslang beside it or beside the watchdog. Use --program/--script or ship {CONFIG_NAME}."
+}
+
+//! Where a daslang may sit, nearest first: beside the script, beside the watchdog, and one level
+//! up from the watchdog - `bin/watchdog` in a source tree finds `bin/daslang` through its parent.
+def private daslang_roots(program_dir, cwd : string) : array<string> {
+    return <- [cwd, program_dir, dir_name(program_dir)]
+}
+
+def private find_daslang(dirs : array<string>) : string {
+    for (root in dirs) {
+        for (rel in ["bin/Release/daslang.exe", "bin/daslang.exe", "bin/Release/daslang", "bin/daslang", "build/daslang"]) {
+            let candidate = path_join(root, rel)
+            if (fexist(candidate)) return candidate
+        }
+    }
+    return get_platform_name() == "windows" ? "daslang.exe" : "daslang"
+}
+
+struct public ResolvedConfig {
+    cfg : WatchdogConfig = WatchdogConfig()
+    error : string
+}
+
+//! Flags over `watchdog.json` beside the program over layout discovery; every path then resolves
+//! against `cwd`. Everything after the first `--` goes to the child verbatim (the config's
+//! `server_args` when there is no `--`). `error` carries the text of a fatal configuration.
+def public resolve_config(args : array<string>; program_dir : string) : ResolvedConfig {
+    let loaded = load_config(program_dir)
+    if (!empty(loaded.error)) return ResolvedConfig(error = loaded.error)
+    var head : array<string>
+    var tail : array<string>
+    var past_separator = false
+    for (arg in args) {
+        if (!past_separator && arg == "--") {
+            past_separator = true
+            continue
+        }
+        if (past_separator) {
+            tail |> push(arg)
+        } else {
+            head |> push(arg)
+        }
+    }
+    var merged <- config_to_args(loaded.js, head, path_join(program_dir, CONFIG_NAME))
+    if (merged |> is_err) return ResolvedConfig(error = merged |> unwrap_err)
+    var parsed <- parse_args(type<WatchdogConfig>, merged |> move_unwrap)
+    if (parsed |> is_err) return ResolvedConfig(error = "watchdog: {parsed |> unwrap_err}")
+    var cfg <- parsed |> move_unwrap
+    if (past_separator) {
+        cfg.server_args <- tail
+    } else {
+        cfg.server_args <- config_server_args(loaded.js)
+    }
+    if (empty(cfg.cwd)) {
+        cfg.cwd = program_dir
+    }
+    cfg.cwd = get_full_file_name(cfg.cwd)
+    if (empty(cfg.program) && empty(cfg.script)) {
+        let why = discover_target(cfg, cfg.cwd, program_dir)
+        if (!empty(why)) return ResolvedConfig(error = why)
+    }
+    if (empty(cfg.name)) {
+        cfg.name = !empty(cfg.program) ? stem(cfg.program) : base_name(cfg.cwd)
+    }
+    if (empty(cfg.daslang)) {
+        cfg.daslang = find_daslang(daslang_roots(program_dir, cfg.cwd))
+    }
+    if (empty(cfg.log)) {
+        cfg.log = "logs/{cfg.name}-watchdog.log"
+    }
+    if (empty(cfg.pid_file)) {
+        cfg.pid_file = "logs/{cfg.name}-watchdog.pid"
+    }
+    cfg.log = resolve_from(cfg.log, cfg.cwd)
+    cfg.pid_file = resolve_from(cfg.pid_file, cfg.cwd)
+    cfg.dump_dir = resolve_from(cfg.dump_dir, cfg.cwd)
+    cfg.crash_dir = resolve_from(cfg.crash_dir, cfg.cwd)
+    cfg.jit_dir = resolve_from(cfg.jit_dir, cfg.cwd)
+    if (!empty(cfg.script)) {
+        cfg.script = resolve_from(cfg.script, cfg.cwd)
+    }
+    if (!empty(cfg.program)) {
+        cfg.program = resolve_from(cfg.program, cfg.cwd)
+    }
+    if (!empty(cfg.stop_file)) {
+        cfg.stop_file = resolve_from(cfg.stop_file, cfg.cwd)
+    }
+    let daslang_candidate = resolve_from(cfg.daslang, cfg.cwd)
+    if (fexist(daslang_candidate)) {
+        cfg.daslang = daslang_candidate
+    }
+    return <- ResolvedConfig(cfg <- cfg)
+}
+
+//! The child's argv: the program, or `daslang -jit [-jit-stack] <script> --`, then the server args.
+def public child_command(cfg : WatchdogConfig) : array<string> {
+    var command : array<string>
+    if (!empty(cfg.program)) {
+        command |> push(cfg.program)
+    } else {
+        command |> push(cfg.daslang)
+        command |> push("-jit")
+        if (cfg.jit_stack) {
+            command |> push("-jit-stack")
+        }
+        command |> push(cfg.script)
+        command |> push("--")
+    }
+    command |> push_from(cfg.server_args)
+    return <- command
+}
+
+// ---------------------------------------------------------------------------------------------
+// the log: one JSON object per line, {"ts","event",...}, to a rotating file and stdout
+
+def private mkdir_p(path : string) {
+    if (empty(path) || fexist(path)) return
+    mkdir_p(dir_name(path))
+    mkdir(path)
+}
+
+class public Emitter {
+    path : string
+    tee : bool = true
+    max_bytes : int64 = LOG_MAX_BYTES
+
+    def Emitter(log_path : string) {
+        path = log_path
+        mkdir_p(dir_name(path))
+    }
+
+    def private rotate() {
+        for (k in range(LOG_BACKUPS - 1)) {
+            let i = LOG_BACKUPS - 1 - k
+            let older = "{path}.{i}"
+            if (fexist(older)) {
+                let target = "{path}.{i + 1}"
+                if (fexist(target)) {
+                    remove(target)
+                }
+                rename(older, target)
+            }
+        }
+        let first = "{path}.1"
+        if (fexist(first)) {
+            remove(first)
+        }
+        rename(path, first)
+    }
+
+    //! `fields` is an object whose keys land beside `ts` and `event`; a `ts`/`event` key in it
+    //! would shadow the envelope and is skipped.
+    def emit(event : string; var fields : JsonValue? = null) {
+        var obj <- {"ts" => JV(iso8601_now()), "event" => JV(event)}
+        if (fields != null && fields is _object) {
+            for (key, val in keys(fields as _object), values(fields as _object)) {
+                if (key == "ts" || key == "event") continue
+                obj[key] = val
+            }
+        }
+        let line = write_json_compact(JV(obj))
+        if (fexist(path) && stat(path).size >= uint64(max_bytes)) {
+            rotate()
+        }
+        fopen(path, "ab") $(f) {
+            if (f != null) {
+                fwrite(f, line)
+                fwrite(f, "\n")
+            }
+        }
+        if (tee) {
+            print("{line}\n")
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// desktop notification: best effort, never fatal, no dependency beyond the platform's own helper
+
+def private applescript_quote(s : string) : string {
+    return replace(replace(replace(s, "\\", "\\\\"), "\"", "\\\""), "\n", " - ")
+}
+
+def private powershell_quote(s : string) : string {
+    return replace(s, "'", "''")
+}
+
+//! Off under tests and on a headless box, where a balloon has no one to reach.
+var public notifications_enabled = true
+
+//! Windows: a PowerShell balloon; macOS: Notification Center via osascript; Linux: notify-send.
+//! A platform with none of those gets nothing - the same never-fatal contract everywhere.
+def public notify(title, message : string; error : bool) {
+    if (!notifications_enabled) return
+    let plat = get_platform_name()
+    if (plat == "windows") {
+        let icon = error ? "Error" : "Info"
+        let script = ("Add-Type -AssemblyName System.Windows.Forms;Add-Type -AssemblyName System.Drawing;"
+            + "$n=New-Object System.Windows.Forms.NotifyIcon;$n.Icon=[System.Drawing.SystemIcons]::{icon};$n.Visible=$true;"
+            + "$n.ShowBalloonTip(10000,'{powershell_quote(title)}','{powershell_quote(message)}',[System.Windows.Forms.ToolTipIcon]::{icon});"
+            + "Start-Sleep -Seconds 11;$n.Dispose()")
+        unsafe(spawn_argv(["powershell.exe", "-NoProfile", "-NonInteractive", "-Command", script]))
+    } elif (plat == "darwin") {
+        let script = "display notification \"{applescript_quote(message)}\" with title \"{applescript_quote(title)}\""
+        unsafe(spawn_argv(["osascript", "-e", script]))
+    } else {
+        unsafe(spawn_argv(["notify-send", "-u", error ? "critical" : "normal", "-a", "watchdog", title, message]))
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// startup stages: ranked and monotonic, detected from the child's own log prose
+
+struct public StageRule {
+    name : string
+    rank : int
+    pattern : string
+}
+
+//! A tune codegens each kernel variant, so the JIT lines fire hundreds of times mid-tune; only a
+//! forward move is reported. `tune_restart` is the one legitimate rewind - the process restarts to
+//! apply the winners - so it resets the rank and the sequence starts over.
+let public TUNE_RESTART_RANK = 5
+
+def public stage_rules() : array<StageRule> {
+    return <- [
+        StageRule(name = "jit_cached", rank = 1, pattern = "LLVM JIT: DLL cache hit"),
+        StageRule(name = "jit_codegen", rank = 1, pattern = "LLVM JIT: DLL cache miss, codegen for"),
+        StageRule(name = "jit_linked", rank = 2, pattern = "Library .+ linked - ok"),
+        StageRule(name = "exchange_lookup", rank = 3, pattern = "exchange: scope .+ looking up a sidecar"),
+        StageRule(name = "tuning", rank = 4, pattern = "llvm_tune: tuning scope"),
+        StageRule(name = "tune_restart", rank = TUNE_RESTART_RANK, pattern = "restart to apply the winners"),
+        StageRule(name = "model_load", rank = 6, pattern = "dasLLAMA: prepared image mapped"),
+        StageRule(name = "asr_init", rank = 7, pattern = "starting \\d+ asynchronous ASR worker"),
+        StageRule(name = "ready", rank = 8, pattern = "listening on http")]
+}
+
+struct public Stage {
+    name : string
+    rank : int
+    since : float
+}
+
+class public StageDetector {
+    rules : array<StageRule>
+    regexes : array<Regex>
+
+    def StageDetector() {
+        rules <- stage_rules()
+        for (rule in rules) {
+            var re : Regex
+            regex_compile(re, rule.pattern)
+            regexes |> emplace(re)
+        }
+    }
+
+    def detect(message : string) : int {
+        for (i in range(length(rules))) {
+            if (regex_search(regexes[i], message).x >= 0) return i
+        }
+        return -1
+    }
+
+    //! The fields to log for a forward stage move, or null. Mutates `stage` on a move.
+    def advance(var stage : Stage&; message : string; now : float) : JsonValue? {
+        let found = detect(message)
+        if (found < 0) return null
+        let rule = rules[found]
+        if (rule.rank <= stage.rank) return null
+        var fields : table<string; JsonValue?>
+        fields["stage"] = JV(rule.name)
+        if (!empty(stage.name)) {
+            fields["after"] = JV(stage.name)
+            fields["elapsed_s"] = JV(round_to(now - stage.since, 1))
+        }
+        stage.name = rule.name
+        stage.rank = rule.rank == TUNE_RESTART_RANK ? 0 : rule.rank
+        stage.since = now
+        return JV(fields)
+    }
+}
+
+def private round_to(v : float; digits : int) : float {
+    let scale = pow(10.0, float(digits))
+    return round(v * scale) / scale
+}
+
+// ---------------------------------------------------------------------------------------------
+// `@tune <kind> k=v ...` lines from llvm_tune: a supervised child never owns a terminal, so it
+// forwards structured progress instead of drawing a bar; the kernel boundaries are logged
+
+//! `(kind, fields)` for a `<prefix><kind> k=v ...` line; kind is empty when the line is not one.
+def public parse_child_event(message, prefix : string) : tuple<kind : string; fields : table<string; string>> {
+    var fields : table<string; string>
+    if (!starts_with(message, prefix)) return (kind = "", fields <- fields)
+    let parts <- split(chop(message, length(prefix), length(message) - length(prefix)), " ")
+    var kind = ""
+    for (token in parts) {
+        if (empty(token)) continue
+        if (empty(kind)) {
+            kind = token
+            continue
+        }
+        let eq = find(token, "=")
+        if (eq > 0) {
+            fields[chop(token, 0, eq)] = chop(token, eq + 1, length(token) - eq - 1)
+        }
+    }
+    return (kind = kind, fields <- fields)
+}
+
+// ---------------------------------------------------------------------------------------------
+// health and shutdown over HTTP
+
+def public health_ok(url : string) : bool {
+    var ok = false
+    with_http_request() $(var req) {
+        req.method = http_method.GET
+        req.url := url
+        req.timeout = 2
+        req.connect_timeout = 2
+        request(req) $(resp) {
+            if (resp != null) {
+                let status = int(resp.status_code)
+                ok = status >= 200 && status < 300
+            }
+        }
+    }
+    return ok
+}
+
+def private request_shutdown(url : string; var log : Emitter?) {
+    var status = -1
+    with_http_request() $(var req) {
+        req.method = http_method.POST
+        req.url := url
+        req.timeout = 5
+        req.connect_timeout = 5
+        request(req) $(resp) {
+            if (resp != null) {
+                status = int(resp.status_code)
+            }
+        }
+    }
+    if (status >= 0) {
+        log->emit("shutdown_requested", JV((status = status)))
+    } else {
+        log->emit("shutdown_request_failed", JV((error = "no response from {url}")))
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// crash capture: WER local dumps (Windows) and the bundle a crash leaves behind
+
+let private WER_LOCAL_DUMPS = "HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps"
+
+def private reg_query_value(key, name : string; var value : string&) : bool {
+    var out : string
+    let rc = run_and_capture(["reg.exe", "query", key, "/v", name, "/reg:64"], out, 10.0)
+    if (rc != 0) return false
+    for (line in split(out, "\n")) {
+        let trimmed = strip(line)
+        if (!starts_with(trimmed, name)) continue
+        let parts <- split(trimmed, "    ")
+        if (length(parts) >= 3) {
+            value = strip(parts[length(parts) - 1])
+            return true
+        }
+    }
+    return false
+}
+
+//! The effective WER dump policy for an executable: `(dump_type, folder)`, type -1 when none. An
+//! application key wins; the root key counts only when it carries a policy value of its own.
+def public windows_local_dump_config(exe_name : string) : tuple<dump_type : int; folder : string> {
+    if (get_platform_name() != "windows") return (dump_type = -1, folder = "")
+    for (app_specific in [true, false]) {
+        let key = app_specific ? "{WER_LOCAL_DUMPS}\\{exe_name}" : WER_LOCAL_DUMPS
+        var dump_type_text : string
+        var folder_text : string
+        let has_type = reg_query_value(key, "DumpType", dump_type_text)
+        let has_folder = reg_query_value(key, "DumpFolder", folder_text)
+        if (!app_specific) {
+            var dump_count : string
+            var flags : string
+            let has_policy = (has_type || has_folder
+                || reg_query_value(key, "DumpCount", dump_count) || reg_query_value(key, "CustomDumpFlags", flags))
+            if (!has_policy) continue
+        } elif (!has_type && !has_folder) {
+            var out : string
+            if (run_and_capture(["reg.exe", "query", key, "/reg:64"], out, 10.0) != 0) continue
+        }
+        var dump_type = 1
+        if (has_type) {
+            let parsed = starts_with(dump_type_text, "0x") ? int(to_uint(dump_type_text, true)) : to_int(dump_type_text)
+            dump_type = parsed
+        }
+        let folder = has_folder ? folder_text : path_join(get_env_variable("LOCALAPPDATA"), "CrashDumps")
+        return (dump_type = dump_type, folder = folder)
+    }
+    return (dump_type = -1, folder = "")
+}
+
+//! Install an application-specific normal-minidump policy (needs elevation). Empty on success.
+def public install_windows_local_dumps(exe_name, dump_dir : string; count : int) : string {
+    if (get_platform_name() != "windows") return "WER LocalDumps is available only on Windows"
+    mkdir_p(dump_dir)
+    let key = "{WER_LOCAL_DUMPS}\\{exe_name}"
+    for (args in [
+        ["reg.exe", "add", key, "/v", "DumpFolder", "/t", "REG_EXPAND_SZ", "/d", dump_dir, "/f", "/reg:64"],
+        ["reg.exe", "add", key, "/v", "DumpCount", "/t", "REG_DWORD", "/d", "{max(count, 1)}", "/f", "/reg:64"],
+        ["reg.exe", "add", key, "/v", "DumpType", "/t", "REG_DWORD", "/d", "1", "/f", "/reg:64"]]) {
+        var out : string
+        if (run_and_capture(args, out, 10.0) != 0) return "reg add failed: {strip(out)}"
+    }
+    return ""
+}
+
+def private newest_matching(root : string; prefix : string; not_before : clock; suffix : string) : string {
+    var newest = ""
+    var newest_time : clock
+    if (!fexist(root)) return ""
+    dir(root) $(fname) {
+        if (!starts_with(fname, prefix) || !ends_with(fname, suffix)) return
+        let path = path_join(root, fname)
+        let st = stat(path)
+        if (!st.is_valid || st.mtime < not_before) return
+        if (empty(newest) || st.mtime > newest_time) {
+            newest = path
+            newest_time = st.mtime
+        }
+    }
+    return newest
+}
+
+def public latest_wer_report(started : clock) : string {
+    if (get_platform_name() != "windows") return ""
+    let program_data = has_env_variable("ProgramData") ? get_env_variable("ProgramData") : "C:\\ProgramData"
+    let root = path_join(program_data, "Microsoft/Windows/WER")
+    var best = ""
+    var best_time : clock
+    for (sub in ["ReportArchive", "ReportQueue"]) {
+        let found = newest_matching(path_join(root, sub), "AppCrash_", started, "")
+        if (empty(found)) continue
+        let st = stat(found)
+        if (empty(best) || st.mtime > best_time) {
+            best = found
+            best_time = st.mtime
+        }
+    }
+    return best
+}
+
+//! Wait for WER to finish publishing the newest dump for this child; empty when none arrives.
+def public wait_for_recent_dump(dump_dir, exe_name : string; started : clock; timeout_sec : float) : string {
+    let deadline = ref_time_ticks()
+    let prefix = to_lower(exe_name)
+    while (float(get_time_usec(deadline)) / 1000000.0 < timeout_sec) {
+        var newest = ""
+        var newest_time : clock
+        if (fexist(dump_dir)) {
+            dir(dump_dir) $(fname) {
+                if (!starts_with(to_lower(fname), prefix) || !ends_with(to_lower(fname), ".dmp")) return
+                let path = path_join(dump_dir, fname)
+                let st = stat(path)
+                if (!st.is_valid || st.mtime < started) return
+                if (empty(newest) || st.mtime > newest_time) {
+                    newest = path
+                    newest_time = st.mtime
+                }
+            }
+        }
+        if (!empty(newest)) {
+            var readable = false
+            fopen(newest, "rb") $(f) {
+                readable = f != null
+            }
+            if (readable) return newest
+        }
+        sleep(250u)
+    }
+    return ""
+}
+
+struct private CrashMeta {
+    timestamp : string
+    pid : int
+    exit_code : int
+    exit_code_hex : string
+    started_at : string
+    command : array<string>
+    cwd : string
+    wer_report : string
+    dump : string
+    jit_dlls : array<string>
+    program_artifacts : array<string>
+}
+
+let private JIT_ARTIFACT_SUFFIXES = [".dll", ".exp", ".lib", ".map", ".o", ".obj", ".pdb"]
+
+def private prune_crash_bundles(root, name : string; keep : int) {
+    if (keep <= 0 || !fexist(root)) return
+    var bundles : array<tuple<path : string; mtime : clock>>
+    dir(root) $(fname) {
+        if (!starts_with(fname, "{name}-")) return
+        let path = path_join(root, fname)
+        let st = stat(path)
+        if (st.is_valid && st.is_dir) {
+            bundles |> push((path = path, mtime = st.mtime))
+        }
+    }
+    bundles |> sort() $(a, b) {
+        return a.mtime > b.mtime
+    }
+    for (i in range(keep, length(bundles))) {
+        rmdir_rec(bundles[i].path)
+    }
+}
+
+def private copy_into(src, dst_dir : string) {
+    if (!fexist(src)) return
+    mkdir_p(dst_dir)
+    let _ = copy_file_result(src, path_join(dst_dir, base_name(src)), true)
+}
+
+//! Everything a crash leaves behind, in `crash_dir/<name>-<stamp>-pid<pid>/`: crash.json, the log,
+//! the minidump, the program's symbols, the tune sidecar, and the JIT artifacts the child loaded
+//! (or the newest cached DLL when it named none). Pruned to the newest `crash_bundles`.
+def public collect_crash_bundle(cfg : WatchdogConfig; command : array<string>; child_pid, return_code : int;
+                                started_at : string; wer_report, dump_path : string; jit_dlls : array<string>) : string {
+    let stamp = replace(replace(replace(slice(iso8601_now(), 0, 19), "-", ""), ":", ""), "T", "-")
+    let bundle = path_join(cfg.crash_dir, "{cfg.name}-{stamp}-pid{child_pid}")
+    mkdir_p(bundle)
+    var meta = CrashMeta(
+        timestamp = iso8601_now(),
+        pid = child_pid,
+        exit_code = return_code,
+        exit_code_hex = "0x{fmt(":08X", uint(return_code))}",
+        started_at = started_at,
+        cwd = cfg.cwd,
+        wer_report = wer_report,
+        dump = empty(dump_path) ? "" : base_name(dump_path))
+    meta.command := command
+    if (!empty(cfg.program)) {
+        for (candidate in [cfg.program, replace_extension(cfg.program, ".map"), replace_extension(cfg.program, ".pdb")]) {
+            if (fexist(candidate)) {
+                meta.program_artifacts |> push(base_name(candidate))
+            }
+        }
+    }
+    var sorted_dlls := jit_dlls
+    sorted_dlls |> sort()
+    meta.jit_dlls := sorted_dlls
+    fwrite(path_join(bundle, "crash.json"), sprint_json(meta, true) + "\n")
+    copy_into(cfg.log, bundle)
+    if (!empty(dump_path)) {
+        copy_into(dump_path, bundle)
+    }
+    if (!empty(cfg.program)) {
+        for (candidate in [cfg.program, replace_extension(cfg.program, ".map"), replace_extension(cfg.program, ".pdb")]) {
+            copy_into(candidate, bundle)
+        }
+    }
+    let tune_file = replace_extension(!empty(cfg.program) ? cfg.program : cfg.script, ".tune.json")
+    copy_into(tune_file, bundle)
+    if (fexist(cfg.jit_dir)) {
+        var resolved : array<string>
+        for (dll in jit_dlls) {
+            let source = get_full_file_name(is_absolute(dll) ? dll : path_join(cfg.cwd, dll))
+            let rel = relative_result(source, cfg.jit_dir)
+            if (!(rel is value) || starts_with(rel as value, "..") || !fexist(source)) continue
+            resolved |> push(source)
+        }
+        if (empty(resolved)) {
+            var newest = ""
+            var newest_time : clock
+            dir_rec(cfg.jit_dir) $(fname, is_dir) {
+                if (is_dir || !ends_with(fname, ".dll")) return
+                let path = path_join(cfg.jit_dir, fname)
+                let st = stat(path)
+                if (empty(newest) || st.mtime > newest_time) {
+                    newest = path
+                    newest_time = st.mtime
+                }
+            }
+            if (!empty(newest)) {
+                resolved |> push(newest)
+            }
+        }
+        for (dll in resolved) {
+            let rel = relative_result(dll, cfg.jit_dir)
+            if (!(rel is value)) continue
+            let target_dir = path_join(path_join(bundle, "jitted_scripts"), dir_name(rel as value))
+            for (suffix in JIT_ARTIFACT_SUFFIXES) {
+                let source = replace_extension(dll, suffix)
+                if (!fexist(source)) continue
+                copy_into(source, target_dir)
+            }
+        }
+    }
+    prune_crash_bundles(cfg.crash_dir, cfg.name, cfg.crash_bundles)
+    return bundle
+}
+
+// ---------------------------------------------------------------------------------------------
+// the supervision loop, as a state machine the host steps
+
+def private now_seconds(origin : int64) : float {
+    return float(get_time_usec(origin)) / 1000000.0
+}
+
+class public Supervisor {
+    cfg : WatchdogConfig = WatchdogConfig()
+    log : Emitter?
+    command : array<string>
+    child_exe_name : string
+    dump_type : int = -1
+    self_pid : int
+    stages : StageDetector?
+    jit_dll_re : Regex
+
+    origin : int64
+    stopping : bool = false
+    finished : bool = false
+    result : int = 0
+    failures : int = 0
+    recovery_pending : bool = false
+    restart_at : float = 0.0
+    child_env : array<string>
+
+    child : process = null
+    child_pid : int = 0
+    started_at : float = 0.0
+    started_clock : clock
+    started_iso : string
+    stage : Stage
+    tune_restart_seen : bool = false
+    stdout_open : bool = true
+    jit_dlls : array<string>
+    next_health : float = 0.0
+    next_heartbeat : float = 0.0
+    last_health : int = -1
+    last_health_change : float = 0.0
+    shutdown_sent : bool = false
+    shutdown_requested_at : float = 0.0
+    terminate_sent_at : float = -1.0
+    kill_sent_at : float = -1.0
+
+    def Supervisor(config : WatchdogConfig; var emitter : Emitter?; command_line : array<string>; own_pid : int) {
+        cfg := config
+        log = emitter
+        command := command_line
+        child_exe_name = base_name(command[0])
+        self_pid = own_pid
+        stages = new StageDetector()
+        regex_compile(jit_dll_re, "LLVM JIT: DLL cache (?:hit |miss, codegen for )(.+\\.dll)$")
+        origin = ref_time_ticks()
+        if (!empty(cfg.stop_file)) {
+            child_env |> push("{cfg.stop_env}={cfg.stop_file}")
+        }
+    }
+
+    def now() : float {
+        return now_seconds(origin)
+    }
+
+    //! The host's stop signal (Ctrl-C, SIGTERM, a tray item): the child is asked to stop on the
+    //! next tick, and supervision ends with 0 once it has.
+    def request_stop() {
+        stopping = true
+    }
+
+    def private unlink_stop_file() {
+        if (!empty(cfg.stop_file) && fexist(cfg.stop_file)) {
+            remove(cfg.stop_file)
+        }
+    }
+
+    def private spawn() : bool {
+        unlink_stop_file()
+        started_at = now()
+        started_clock = get_clock()
+        started_iso = iso8601_now()
+        child = unsafe(spawn_process(command, cfg.cwd, child_env))
+        if (child == null) {
+            log->emit("spawn_failed", JV((error = "could not start {command[0]}")))
+            notify("{cfg.name} watchdog", "Could not start child: {command[0]}", true)
+            return false
+        }
+        child_pid = unsafe(process_pid(child))
+        log->emit("child_started", JV((pid = child_pid)))
+        stage = Stage(name = "", rank = 0, since = started_at)
+        tune_restart_seen = false
+        stdout_open = true
+        jit_dlls |> clear()
+        next_health = started_at
+        next_heartbeat = started_at + HEALTH_HEARTBEAT_SECONDS
+        last_health = -1
+        last_health_change = started_at
+        shutdown_sent = false
+        shutdown_requested_at = 0.0
+        terminate_sent_at = -1.0
+        kill_sent_at = -1.0
+        return true
+    }
+
+    def private on_child_line(message : string) {
+        let event <- parse_child_event(message, TUNE_EVENT_PREFIX)
+        if (!empty(event.kind)) {
+            // a tune is hundreds of steps; log the kernel boundaries, or the log becomes the
+            // flood these events exist to replace
+            if (event.kind == "plan" || event.kind == "end" || event.kind == "abort") {
+                var fields <- {"pid" => JV(child_pid), "kind" => JV(event.kind)}
+                for (key, val in keys(event.fields), values(event.fields)) {
+                    if (key == "pid" || key == "kind") continue
+                    fields[key] = JV(val)
+                }
+                log->emit("tune", JV(fields))
+            }
+            return
+        }
+        // both the tuner's marker and the exchange client's "sidecar applied" marker license the
+        // immediate exit-3 relaunch - the process restarts to stamp fresh winners
+        if (find(message, "restart to apply the winners") >= 0) {
+            tune_restart_seen = true
+        }
+        if (regex_search(jit_dll_re, message).x >= 0) {
+            jit_dlls |> push(regex_group(jit_dll_re, 1, message))
+        }
+        var moved = stages->advance(stage, message, now())
+        if (moved != null) {
+            var fields : table<string; JsonValue?>
+            fields["pid"] = JV(child_pid)
+            for (key, val in keys(moved as _object), values(moved as _object)) {
+                fields[key] = val
+            }
+            log->emit("stage", JV(fields))
+        }
+        log->emit("child", JV((pid = child_pid, message = message)))
+    }
+
+    def private drain_child() {
+        if (!stdout_open) return
+        stdout_open = unsafe(process_drain(child) $(line) {
+            on_child_line(line)
+        })
+    }
+
+    def private poll_health(t : float) {
+        if (cfg.no_health) {
+            if (recovery_pending && t - started_at >= min(cfg.stable_seconds, 10.0)) {
+                notify("{cfg.name} recovered", "Process is running (pid {child_pid})", false)
+                log->emit("recovered", JV((pid = child_pid)))
+                recovery_pending = false
+            }
+            return
+        }
+        if (t < next_health) return
+        let healthy = health_ok(cfg.health_url)
+        let healthy_int = healthy ? 1 : 0
+        // transitions, not every poll: a cold start is minutes of `ok:false` the stage events
+        // say better, a steady run is hours of `ok:true`; the heartbeat keeps a quiet run observable
+        if (healthy_int != last_health) {
+            var fields <- {"pid" => JV(child_pid), "ok" => JV(healthy)}
+            if (last_health >= 0) {
+                fields["was"] = JV(last_health == 1)
+                fields["after_s"] = JV(round_to(t - last_health_change, 1))
+            }
+            if (!healthy && !empty(stage.name)) {
+                fields["stage"] = JV(stage.name)
+            }
+            log->emit("health", JV(fields))
+            last_health = healthy_int
+            last_health_change = t
+            next_heartbeat = t + HEALTH_HEARTBEAT_SECONDS
+        } elif (healthy && t >= next_heartbeat) {
+            log->emit("health_heartbeat", JV((pid = child_pid, ok = true, healthy_for_s = round(t - last_health_change))))
+            next_heartbeat = t + HEALTH_HEARTBEAT_SECONDS
+        }
+        if (healthy && recovery_pending) {
+            notify("{cfg.name} recovered", "Server is healthy (pid {child_pid})", false)
+            log->emit("recovered", JV((pid = child_pid)))
+            recovery_pending = false
+        }
+        next_health = t + max(cfg.health_interval, 1.0)
+    }
+
+    def private send_stop_request() {
+        if (!empty(cfg.stop_file)) {
+            mkdir_p(dir_name(cfg.stop_file))
+            fwrite(cfg.stop_file, "stop\n")
+            log->emit("stop_file_requested", JV((path = cfg.stop_file)))
+        } elif (cfg.no_shutdown) {
+            unsafe(process_terminate(child))
+            terminate_sent_at = now()
+            log->emit("terminate_requested")
+        } else {
+            request_shutdown(cfg.shutdown_url, log)
+        }
+        shutdown_sent = true
+        shutdown_requested_at = now()
+    }
+
+    def private backoff(uptime : float) : float {
+        failures = uptime >= cfg.stable_seconds ? 0 : failures + 1
+        return min(pow(2.0, float(min(failures, 6))), cfg.max_restart_delay)
+    }
+
+    //! Classify an exit: 0 ends supervision, 3 with the marker relaunches at once, 3 without it
+    //! is a tuner abort and backs off, 4 relaunches at once, anything else is a crash.
+    def private on_child_exit(return_code : int) {
+        let uptime = now() - started_at
+        log->emit("child_exited", JV((pid = child_pid, code = return_code, uptime_seconds = uptime)))
+        unsafe(close_process(child))
+        child = null
+        let script_mode = empty(cfg.program)
+        if (stopping) {
+            finish(0)
+            return
+        }
+        if (return_code == 0) {
+            log->emit("intentional_shutdown")
+            finish(0)
+            return
+        }
+        if (script_mode && return_code == TUNE_RESTART_EXIT && tune_restart_seen) {
+            log->emit("tune_bootstrap_complete")
+            failures = 0
+            restart_at = now()
+            return
+        }
+        if (script_mode && return_code == TUNE_RESTART_EXIT) {
+            let delay = backoff(uptime)
+            log->emit("tune_incomplete", JV((uptime_seconds = uptime, restart_delay_seconds = delay)))
+            restart_at = now() + delay
+            return
+        }
+        if (return_code == CONFIG_RESTART_EXIT) {
+            log->emit("config_restart_relaunch")
+            failures = 0
+            restart_at = now()
+            return
+        }
+        let wer = latest_wer_report(started_clock)
+        let dump = dump_type == 1 ? wait_for_recent_dump(cfg.dump_dir, child_exe_name, started_clock, 15.0) : ""
+        let delay = backoff(uptime)
+        log->emit("crash", JV((code = return_code, uptime_seconds = uptime, restart_delay_seconds = delay,
+            wer = wer, dump = dump)))
+        var bundle = ""
+        if (!cfg.no_crash_bundle) {
+            bundle = collect_crash_bundle(cfg, command, child_pid, return_code, started_iso, wer, dump, jit_dlls)
+            log->emit("crash_bundle", JV((path = bundle)))
+        }
+        var body = "Exit {return_code}; restarting in {int(delay)}s"
+        body += empty(dump) ? "\nNo minidump produced" : "\nDump: {dump}"
+        if (!empty(bundle)) {
+            body += "\nBundle: {bundle}"
+        }
+        notify("{cfg.name} crashed", body, true)
+        recovery_pending = true
+        restart_at = now() + delay
+    }
+
+    //! Runs only once the child is gone - reaped by on_child_exit, never spawned, or left behind
+    //! as unkillable; the stop ladder in tick() is what ends a live child.
+    def private finish(code : int) {
+        // only clear the pid file if it is still ours: a second watchdog that took the slot
+        // owns it now, and deleting its claim would let a third start alongside it
+        if (self_pid != 0 && fexist(cfg.pid_file)) {
+            var text : string
+            fopen(cfg.pid_file, "rb") $(f) {
+                if (f != null) {
+                    text = fread(f)
+                }
+            }
+            if (strip(text) == "{self_pid}") {
+                remove(cfg.pid_file)
+            }
+        }
+        unlink_stop_file()
+        log->emit("watchdog_stopped")
+        finished = true
+        result = code
+    }
+
+    //! One supervision step, at most one tick long. True once supervision has ended; `result`
+    //! then carries the exit code.
+    def tick() : bool {
+        if (finished) return true
+        if (child == null) {
+            if (stopping) {
+                finish(0)
+                return true
+            }
+            if (now() < restart_at) {
+                sleep(TICK_MS)
+                return false
+            }
+            if (!spawn()) {
+                finish(2)
+                return true
+            }
+            return false
+        }
+        drain_child()
+        let t = now()
+        if (stopping && !shutdown_sent) {
+            send_stop_request()
+        }
+        // a stop is a ladder with an end: the request, terminate once the stop timeout passes,
+        // kill ten seconds later, and ten seconds after that the child is left behind - a child
+        // that ignores every signal must not hold the supervisor forever
+        if (stopping && shutdown_sent) {
+            if (terminate_sent_at < 0.0) {
+                if (t - shutdown_requested_at > cfg.stop_timeout) {
+                    unsafe(process_terminate(child))
+                    terminate_sent_at = t
+                    log->emit("terminate_requested", JV((after_s = round_to(t - shutdown_requested_at, 1))))
+                }
+            } elif (kill_sent_at < 0.0) {
+                if (t - terminate_sent_at > 10.0) {
+                    unsafe(process_kill(child))
+                    kill_sent_at = t
+                    log->emit("kill_requested")
+                }
+            } elif (t - kill_sent_at > 10.0) {
+                log->emit("child_unkillable", JV((pid = child_pid)))
+                child = null
+                finish(1)
+                return true
+            }
+        }
+        poll_health(t)
+        let rc = unsafe(process_poll(child))
+        if (rc == process_running) {
+            sleep(TICK_MS)
+            return false
+        }
+        drain_child()
+        on_child_exit(rc)
+        return finished
+    }
+
+    //! Run ticks until supervision ends; the exit code.
+    def run() : int {
+        while (!tick()) {
+        }
+        return result
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// the program: configuration, the dump policy, the single-instance guard, then supervision
+
+//! Everything before the loop. Returns the supervisor to drive, or null with `exit_code` set
+//! when the program is done (help, --install-local-dumps, a refused start).
+def private wants_help(args : array<string>) : bool {
+    for (arg in args) {
+        if (arg == "--") return false
+        if (arg == "--help" || arg == "-h") return true
+    }
+    return false
+}
+
+def public watchdog_start(args : array<string>; program_dir : string; self_pid : int; var exit_code : int&) : Supervisor? {
+    exit_code = 0
+    if (wants_help(args)) {
+        print_help(get_command_info(type<WatchdogConfig>), "watchdog")
+        print("Everything after -- goes to the supervised program.\n")
+        return null
+    }
+    var resolved <- resolve_config(args, program_dir)
+    if (!empty(resolved.error)) {
+        print("{resolved.error}\n")
+        exit_code = 2
+        return null
+    }
+    var cfg <- resolved.cfg
+    var log = new Emitter(cfg.log)
+    let command <- child_command(cfg)
+    let child_exe_name = base_name(command[0])
+    if (cfg.install_local_dumps) {
+        let error = install_windows_local_dumps(child_exe_name, cfg.dump_dir, cfg.dump_count)
+        if (!empty(error)) {
+            log->emit("wer_install_failed", JV((executable = child_exe_name, dump_dir = cfg.dump_dir, error = error)))
+            notify("{cfg.name} dump setup failed", "Run the LocalDumps install from an elevated terminal: {error}", true)
+            exit_code = 2
+            return null
+        }
+        log->emit("wer_installed", JV((executable = child_exe_name, dump_dir = cfg.dump_dir,
+            dump_type = "minidump", dump_count = max(cfg.dump_count, 1))))
+        return null
+    }
+    let policy = windows_local_dump_config(child_exe_name)
+    if (!empty(policy.folder)) {
+        cfg.dump_dir = policy.folder
+    }
+    if (policy.dump_type == 1) {
+        log->emit("wer_ready", JV((executable = child_exe_name, dump_dir = cfg.dump_dir, dump_type = "minidump")))
+    } else {
+        let reason = policy.dump_type < 0 ? "not configured" : "unsafe dump type {policy.dump_type}"
+        log->emit("wer_not_ready", JV((executable = child_exe_name, dump_dir = cfg.dump_dir, reason = reason)))
+        if (cfg.require_dumps) {
+            notify("{cfg.name} watchdog not started", "WER normal minidumps are {reason}; run --install-local-dumps elevated", true)
+            exit_code = 2
+            return null
+        }
+    }
+    // two watchdogs mean two children fighting over one port; the pid file records, and protects
+    if (self_pid != 0) {
+        var prior = 0
+        if (fexist(cfg.pid_file)) {
+            var text : string
+            fopen(cfg.pid_file, "rb") $(f) {
+                if (f != null) {
+                    text = fread(f)
+                }
+            }
+            prior = to_int(strip(text))
+        }
+        if (prior != 0 && prior != self_pid && unsafe(process_alive(prior))) {
+            log->emit("watchdog_already_running", JV((pid = prior, pid_file = cfg.pid_file)))
+            print("watchdog: {cfg.name} is already supervised by pid {prior} (per {cfg.pid_file}). Stop it first, or delete the pid file if it is stale.\n")
+            exit_code = 2
+            return null
+        }
+        mkdir_p(dir_name(cfg.pid_file))
+        fwrite(cfg.pid_file, "{self_pid}")
+    }
+    var sup = new Supervisor(cfg, log, command, self_pid)
+    sup.dump_type = policy.dump_type
+    log->emit("watchdog_started", JV((pid = self_pid, command = JV(command), cwd = cfg.cwd)))
+    return sup
+}
+
+//! The whole program for a host that owns nothing else: configure, supervise until the child
+//! shuts down or the supervisor is told to, return the exit code.
+def public watchdog_main(args : array<string>; program_dir : string; self_pid : int) : int {
+    var code = 0
+    var sup = watchdog_start(args, program_dir, self_pid, code)
+    if (sup == null) return code
+    let rc = sup->run()
+    unsafe {
+        delete sup
+    }
+    return rc
+}
diff --git a/utils/watchdog/watchdog.py b/utils/watchdog/watchdog.py
deleted file mode 100644
index 732278c2b4..0000000000
--- a/utils/watchdog/watchdog.py
+++ /dev/null
@@ -1,1890 +0,0 @@
-#!/usr/bin/env python3
-"""Supervise dasllama-server under JIT, or a standalone program such as Cadmus.
-
-The first untuned invocation exits with code 3 after writing the tune sidecar —
-downloaded from the sidecar exchange when a verified match exists, else minted
-by the local tuner; both print a "restart to apply the winners" marker and are
-relaunched immediately. Exit 4 is a config restart (the control page saved a new
-config and asked for a relaunch) and is also relaunched immediately. Exit 0 is an
-intentional shutdown. Other exits are reported, notified, and restarted with
-bounded exponential backoff. Standalone programs can use a stop-file handshake
-to finish their current update and run shutdown before exiting.
-
-During a tune the tray menu can stop the race at the next kernel boundary (the
-DAS_TUNE_CONTROL file): adopt an offered unverified sidecar instead, or serve
-untuned for the rest of the session. @tune and @sidecar events from the child
-fold into STATE, which the tooltip, menu, and control plugin all read.
-"""
-from __future__ import annotations
-
-import argparse
-import ctypes
-import ctypes.wintypes as wt
-import importlib.util
-import json
-import logging
-from logging.handlers import RotatingFileHandler
-import os
-from pathlib import Path
-import re
-import shutil
-import signal
-import subprocess
-import sys
-import threading
-import time
-import webbrowser
-from urllib.error import URLError
-from urllib.parse import unquote, urlsplit
-from urllib.request import Request, urlopen
-
-
-IS_WINDOWS = os.name == "nt"
-SCRIPT_DIR = Path(__file__).resolve().parent
-SOURCE_REPO_ROOT = SCRIPT_DIR.parent.parent
-# In a deployed bundle the watchdog sits beside what it supervises, so the bundle dir is the right
-# default. In-repo it lives in utils/watchdog/ next to nothing runnable, so those runs pass --cwd.
-DEFAULT_CWD = SCRIPT_DIR
-TUNE_RESTART_EXIT = 3
-CONFIG_RESTART_EXIT = 4
-# Per-program wiring shipped beside watchdog.py by `daspkg release`. Every key sets the DEFAULT for
-# the flag of the same name, so an explicit flag still wins. Absent config = discovery (below).
-CONFIG_NAME = "watchdog.json"
-# Optional per-program control surface (the dictation bot's settings page, say). Supervision stays
-# generic; anything that knows about a specific program's config lives in this sibling module.
-CONTROL_MODULE = "watchdog_control.py"
-CONFIG_PATH_KEYS = frozenset(
-    {"program", "daslang", "script", "cwd", "log", "pid_file", "stop_file",
-     "dump_dir", "crash_dir", "jit_dir", "control_page"}
-)
-# How often to restate "still healthy" once health has settled. Health is otherwise logged only on
-# transition, so this is the only proof-of-life in a long quiet run.
-HEALTH_HEARTBEAT_SECONDS = 300.0
-JIT_ARTIFACT_SUFFIXES = {".dll", ".exp", ".lib", ".map", ".o", ".obj", ".pdb"}
-WER_LOCAL_DUMPS = r"SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps"
-
-
-# Supervision state, published for the control plugin (which runs on HTTP threads) to read.
-STATE_LOCK = threading.Lock()
-STATE: dict[str, object] = {
-    "watchdog_started_at": time.time(),
-    "child_pid": 0,
-    "child_started_at": 0.0,
-    "child_exit_code": None,
-    "restart_delay": 0.0,
-    "stage": None,
-    # Health as the tray/control surfaces see it: None = not yet known (booting), then the
-    # last health_ok verdict. serving_since anchors the "healthy for" display.
-    "healthy": None,
-    "serving_since": 0.0,
-    # Progress of an in-flight tune, folded from llvm_tune's @tune events. Counters only —
-    # nothing here is an estimate, because the tuner cannot know how long it has left.
-    "tune": {},
-    # The exchange story of the current child, folded from dasllama's @sidecar events:
-    # state (lookup/none/offer/applied) + the pending-submit offer. Drives the tray menu.
-    "sidecar": {},
-}
-
-
-def set_state(**fields: object) -> None:
-    with STATE_LOCK:
-        STATE.update(fields)
-
-
-def read_state() -> dict[str, object]:
-    with STATE_LOCK:
-        return dict(STATE)
-
-
-def find_daslang() -> Path:
-    # dasllama-server is JIT-only (per-box [tune]/[llvm_code] kernels), so the watchdog always
-    # runs `daslang -jit main.das`, never a baked exe. Prefer a daslang inside a deployed JIT
-    # bundle (bin/Release beside this script — the layout getDasRoot() resolves the bundle from),
-    # then the source-repo build tree, then bare name on PATH.
-    rel = (
-        "bin/Release/daslang.exe",
-        "bin/daslang.exe",
-        "bin/Release/daslang",
-        "bin/daslang",
-        "build/daslang",
-    )
-    for root in (SCRIPT_DIR, SOURCE_REPO_ROOT):
-        for name in rel:
-            candidate = root / name
-            if candidate.is_file():
-                return candidate
-    return Path("daslang.exe" if IS_WINDOWS else "daslang")
-
-
-def resolve_from(path: Path, base: Path) -> Path:
-    if path.is_absolute():
-        return path.resolve()
-    return (base / path).resolve()
-
-
-def make_logger(path: Path, name: str = "watchdog") -> logging.Logger:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    logger = logging.getLogger(f"{name}-watchdog")
-    logger.setLevel(logging.INFO)
-    logger.handlers.clear()
-    formatter = logging.Formatter("%(message)s")
-    rotating = RotatingFileHandler(
-        path, maxBytes=20 * 1024 * 1024, backupCount=5, encoding="utf-8"
-    )
-    rotating.setFormatter(formatter)
-    logger.addHandler(rotating)
-    console = logging.StreamHandler(sys.stdout)
-    console.setFormatter(formatter)
-    logger.addHandler(console)
-    return logger
-
-
-def emit(logger: logging.Logger, event: str, **fields) -> None:
-    payload = {
-        "ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
-        "event": event,
-        **fields,
-    }
-    logger.info(json.dumps(payload, ensure_ascii=False, separators=(",", ":")))
-
-
-def windows_balloon(title: str, message: str, error: bool = False) -> None:
-    """Show a dependency-free notification in the interactive Windows session."""
-    if not IS_WINDOWS:
-        return
-    icon = "Error" if error else "Info"
-    safe_title = title.replace("'", "''")
-    safe_message = message.replace("'", "''")
-    script = (
-        "Add-Type -AssemblyName System.Windows.Forms;"
-        "Add-Type -AssemblyName System.Drawing;"
-        "$n=New-Object System.Windows.Forms.NotifyIcon;"
-        f"$n.Icon=[System.Drawing.SystemIcons]::{icon};"
-        "$n.Visible=$true;"
-        f"$n.ShowBalloonTip(10000,'{safe_title}','{safe_message}',"
-        f"[System.Windows.Forms.ToolTipIcon]::{icon});"
-        "Start-Sleep -Seconds 11;"
-        "$n.Dispose()"
-    )
-    creationflags = getattr(subprocess, "CREATE_NO_WINDOW", 0)
-    try:
-        subprocess.Popen(
-            ["powershell.exe", "-NoProfile", "-NonInteractive", "-Command", script],
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-            creationflags=creationflags,
-        )
-    except OSError:
-        pass
-
-
-def notify(title: str, message: str, error: bool = False) -> None:
-    """Best-effort desktop notification: Windows balloon, macOS Notification Center via
-    osascript, Linux notify-send. A no-op where none of those exist — same never-fatal
-    contract as the tray."""
-    if IS_WINDOWS:
-        windows_balloon(title, message, error)
-        return
-    if sys.platform == "darwin":
-        # The strings land inside double quotes in AppleScript source; a raw newline would
-        # end the -e one-liner, so fold multi-line balloon bodies onto one line.
-        safe_title = title.replace("\\", "\\\\").replace('"', '\\"')
-        safe_message = message.replace("\\", "\\\\").replace('"', '\\"').replace("\n", " — ")
-        script = f'display notification "{safe_message}" with title "{safe_title}"'
-        command = ["osascript", "-e", script]
-    elif shutil.which("notify-send"):
-        urgency = "critical" if error else "normal"
-        command = ["notify-send", "-u", urgency, "-a", "watchdog", title, message]
-    else:
-        return
-    try:
-        helper = subprocess.Popen(command, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
-    except OSError:
-        return
-    # Reap the short-lived helper so it never sits as a POSIX zombie between notifications.
-    threading.Thread(target=helper.wait, name="notify-reaper", daemon=True).start()
-
-
-class PROCESS_MEMORY_COUNTERS_EX(ctypes.Structure):
-    _fields_ = [
-        ("cb", wt.DWORD),
-        ("PageFaultCount", wt.DWORD),
-        ("PeakWorkingSetSize", ctypes.c_size_t),
-        ("WorkingSetSize", ctypes.c_size_t),
-        ("QuotaPeakPagedPoolUsage", ctypes.c_size_t),
-        ("QuotaPagedPoolUsage", ctypes.c_size_t),
-        ("QuotaPeakNonPagedPoolUsage", ctypes.c_size_t),
-        ("QuotaNonPagedPoolUsage", ctypes.c_size_t),
-        ("PagefileUsage", ctypes.c_size_t),
-        ("PeakPagefileUsage", ctypes.c_size_t),
-        ("PrivateUsage", ctypes.c_size_t),
-    ]
-
-
-class FILETIME(ctypes.Structure):
-    _fields_ = [("low", wt.DWORD), ("high", wt.DWORD)]
-
-    def ticks(self) -> int:
-        return (int(self.high) << 32) | int(self.low)
-
-
-class THREADENTRY32(ctypes.Structure):
-    _fields_ = [
-        ("dwSize", wt.DWORD),
-        ("cntUsage", wt.DWORD),
-        ("th32ThreadID", wt.DWORD),
-        ("th32OwnerProcessID", wt.DWORD),
-        ("tpBasePri", wt.LONG),
-        ("tpDeltaPri", wt.LONG),
-        ("dwFlags", wt.DWORD),
-    ]
-
-
-def windows_thread_count(pid: int) -> int | None:
-    if not IS_WINDOWS:
-        return None
-    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
-    kernel32.CreateToolhelp32Snapshot.argtypes = [wt.DWORD, wt.DWORD]
-    kernel32.CreateToolhelp32Snapshot.restype = wt.HANDLE
-    kernel32.Thread32First.argtypes = [wt.HANDLE, ctypes.POINTER(THREADENTRY32)]
-    kernel32.Thread32First.restype = wt.BOOL
-    kernel32.Thread32Next.argtypes = [wt.HANDLE, ctypes.POINTER(THREADENTRY32)]
-    kernel32.Thread32Next.restype = wt.BOOL
-    kernel32.CloseHandle.argtypes = [wt.HANDLE]
-    kernel32.CloseHandle.restype = wt.BOOL
-    snapshot = kernel32.CreateToolhelp32Snapshot(0x00000004, 0)
-    invalid = ctypes.c_void_p(-1).value
-    if snapshot == invalid:
-        return None
-    entry = THREADENTRY32()
-    entry.dwSize = ctypes.sizeof(entry)
-    count = 0
-    try:
-        ok = kernel32.Thread32First(snapshot, ctypes.byref(entry))
-        while ok:
-            if entry.th32OwnerProcessID == pid:
-                count += 1
-            ok = kernel32.Thread32Next(snapshot, ctypes.byref(entry))
-    finally:
-        kernel32.CloseHandle(snapshot)
-    return count
-
-
-def windows_process_metrics(pid: int) -> dict[str, int | float] | None:
-    if not IS_WINDOWS:
-        return None
-    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
-    psapi = ctypes.WinDLL("psapi", use_last_error=True)
-    kernel32.OpenProcess.argtypes = [wt.DWORD, wt.BOOL, wt.DWORD]
-    kernel32.OpenProcess.restype = wt.HANDLE
-    kernel32.CloseHandle.argtypes = [wt.HANDLE]
-    kernel32.CloseHandle.restype = wt.BOOL
-    kernel32.GetProcessHandleCount.argtypes = [wt.HANDLE, ctypes.POINTER(wt.DWORD)]
-    kernel32.GetProcessHandleCount.restype = wt.BOOL
-    kernel32.GetProcessTimes.argtypes = [
-        wt.HANDLE,
-        ctypes.POINTER(FILETIME),
-        ctypes.POINTER(FILETIME),
-        ctypes.POINTER(FILETIME),
-        ctypes.POINTER(FILETIME),
-    ]
-    kernel32.GetProcessTimes.restype = wt.BOOL
-    psapi.GetProcessMemoryInfo.argtypes = [
-        wt.HANDLE,
-        ctypes.POINTER(PROCESS_MEMORY_COUNTERS_EX),
-        wt.DWORD,
-    ]
-    psapi.GetProcessMemoryInfo.restype = wt.BOOL
-    handle = kernel32.OpenProcess(0x1000 | 0x0010, False, pid)
-    if not handle:
-        return None
-    try:
-        memory = PROCESS_MEMORY_COUNTERS_EX()
-        memory.cb = ctypes.sizeof(memory)
-        if not psapi.GetProcessMemoryInfo(
-            handle, ctypes.byref(memory), ctypes.sizeof(memory)
-        ):
-            return None
-        handles = wt.DWORD()
-        kernel32.GetProcessHandleCount(handle, ctypes.byref(handles))
-        created = FILETIME()
-        exited = FILETIME()
-        kernel = FILETIME()
-        user = FILETIME()
-        kernel32.GetProcessTimes(
-            handle,
-            ctypes.byref(created),
-            ctypes.byref(exited),
-            ctypes.byref(kernel),
-            ctypes.byref(user),
-        )
-        return {
-            "working_set": int(memory.WorkingSetSize),
-            "peak_working_set": int(memory.PeakWorkingSetSize),
-            "private_bytes": int(memory.PrivateUsage),
-            "peak_pagefile": int(memory.PeakPagefileUsage),
-            "page_faults": int(memory.PageFaultCount),
-            "handles": int(handles.value),
-            "threads": windows_thread_count(pid) or 0,
-            "cpu_seconds": (kernel.ticks() + user.ticks()) / 10_000_000.0,
-        }
-    finally:
-        kernel32.CloseHandle(handle)
-
-
-def latest_wer_report(started_at: float) -> str | None:
-    if not IS_WINDOWS:
-        return None
-    root = Path(os.environ.get("ProgramData", r"C:\ProgramData")) / "Microsoft/Windows/WER"
-    candidates: list[Path] = []
-    for directory in (root / "ReportArchive", root / "ReportQueue"):
-        if not directory.is_dir():
-            continue
-        try:
-            for path in directory.glob("AppCrash_*"):
-                if path.stat().st_mtime >= started_at - 5.0:
-                    candidates.append(path)
-        except OSError:
-            continue
-    if not candidates:
-        return None
-    return str(max(candidates, key=lambda path: path.stat().st_mtime))
-
-
-def windows_local_dump_config(exe_name: str) -> tuple[int | None, Path | None]:
-    """Return the effective WER dump type/folder for an executable."""
-    if not IS_WINDOWS:
-        return None, None
-    import winreg
-
-    for subkey, app_specific in (
-        (f"{WER_LOCAL_DUMPS}\\{exe_name}", True),
-        (WER_LOCAL_DUMPS, False),
-    ):
-        try:
-            with winreg.OpenKey(
-                winreg.HKEY_LOCAL_MACHINE,
-                subkey,
-                0,
-                winreg.KEY_READ | winreg.KEY_WOW64_64KEY,
-            ) as key:
-                # A root LocalDumps key that only contains application subkeys is not a global
-                # policy. Treat it as configured only when it carries at least one policy value.
-                if not app_specific:
-                    policy_value = False
-                    for name in ("DumpFolder", "DumpCount", "DumpType", "CustomDumpFlags"):
-                        try:
-                            winreg.QueryValueEx(key, name)
-                            policy_value = True
-                            break
-                        except FileNotFoundError:
-                            pass
-                    if not policy_value:
-                        continue
-                try:
-                    dump_type = int(winreg.QueryValueEx(key, "DumpType")[0])
-                except FileNotFoundError:
-                    dump_type = 1
-                try:
-                    folder_text = str(winreg.QueryValueEx(key, "DumpFolder")[0])
-                    folder = Path(os.path.expandvars(folder_text))
-                except FileNotFoundError:
-                    folder = Path(os.environ["LOCALAPPDATA"]) / "CrashDumps"
-                return dump_type, folder
-        except FileNotFoundError:
-            continue
-        except OSError:
-            return None, None
-    return None, None
-
-
-def install_windows_local_dumps(exe_name: str, dump_dir: Path, count: int) -> None:
-    """Install an application-specific normal-minidump policy (requires elevation)."""
-    if not IS_WINDOWS:
-        raise OSError("WER LocalDumps is available only on Windows")
-    import winreg
-
-    dump_dir = dump_dir.resolve()
-    dump_dir.mkdir(parents=True, exist_ok=True)
-    subkey = f"{WER_LOCAL_DUMPS}\\{exe_name}"
-    with winreg.CreateKeyEx(
-        winreg.HKEY_LOCAL_MACHINE,
-        subkey,
-        0,
-        winreg.KEY_SET_VALUE | winreg.KEY_WOW64_64KEY,
-    ) as key:
-        winreg.SetValueEx(key, "DumpFolder", 0, winreg.REG_EXPAND_SZ, str(dump_dir))
-        winreg.SetValueEx(key, "DumpCount", 0, winreg.REG_DWORD, max(count, 1))
-        winreg.SetValueEx(key, "DumpType", 0, winreg.REG_DWORD, 1)
-
-
-def wait_for_recent_dump(
-    dump_dir: Path,
-    exe_name: str,
-    started_at: float,
-    timeout: float = 15.0,
-) -> Path | None:
-    """Wait for WER to finish publishing the newest dump for this child."""
-    deadline = time.monotonic() + timeout
-    exe_prefix = exe_name.lower()
-    while time.monotonic() < deadline:
-        candidates: list[Path] = []
-        try:
-            for path in dump_dir.glob("*.dmp"):
-                if path.name.lower().startswith(exe_prefix) and path.stat().st_mtime >= started_at - 5.0:
-                    candidates.append(path)
-        except OSError:
-            candidates = []
-        if candidates:
-            newest = max(candidates, key=lambda path: path.stat().st_mtime)
-            try:
-                with newest.open("rb"):
-                    pass
-                return newest
-            except OSError:
-                pass
-        time.sleep(0.25)
-    return None
-
-
-def prune_crash_bundles(root: Path, name: str, keep: int) -> None:
-    if keep <= 0 or not root.is_dir():
-        return
-    bundles = sorted(
-        (path for path in root.glob(f"{name}-*") if path.is_dir()),
-        key=lambda path: path.stat().st_mtime,
-        reverse=True,
-    )
-    for path in bundles[keep:]:
-        shutil.rmtree(path, ignore_errors=True)
-
-
-def collect_crash_bundle(
-    args: argparse.Namespace,
-    command: list[str],
-    child_pid: int,
-    return_code: int,
-    started_at: float,
-    wer_report: str | None,
-    dump_path: Path | None,
-    jit_dlls: set[Path],
-) -> Path:
-    stamp = time.strftime("%Y%m%d-%H%M%S")
-    root = args.crash_dir.resolve()
-    bundle = root / f"{args.name}-{stamp}-pid{child_pid}"
-    bundle.mkdir(parents=True, exist_ok=False)
-    program_artifacts: list[Path] = []
-    if args.program is not None:
-        for source in (
-            args.program,
-            args.program.with_suffix(".map"),
-            args.program.with_suffix(".pdb"),
-        ):
-            if source.is_file():
-                program_artifacts.append(source)
-    metadata = {
-        "timestamp": time.strftime("%Y-%m-%dT%H:%M:%S%z"),
-        "pid": child_pid,
-        "exit_code": return_code,
-        "exit_code_hex": f"0x{return_code & 0xFFFFFFFF:08X}",
-        "started_at": started_at,
-        "command": command,
-        "cwd": str(args.cwd.resolve()),
-        "wer_report": wer_report or "",
-        "dump": dump_path.name if dump_path is not None else "",
-        "jit_dlls": [str(path) for path in sorted(jit_dlls)],
-        "program_artifacts": [path.name for path in program_artifacts],
-    }
-    (bundle / "crash.json").write_text(
-        json.dumps(metadata, indent=2, ensure_ascii=False) + "\n",
-        encoding="utf-8",
-    )
-    if args.log.is_file():
-        shutil.copy2(args.log, bundle / args.log.name)
-    if dump_path is not None and dump_path.is_file():
-        shutil.copy2(dump_path, bundle / dump_path.name)
-    for source in program_artifacts:
-        shutil.copy2(source, bundle / source.name)
-    tune_file = (
-        args.program.with_suffix(".tune.json")
-        if args.program is not None
-        else args.script.with_suffix(".tune.json")
-    )
-    if tune_file.is_file():
-        shutil.copy2(tune_file, bundle / tune_file.name)
-    jit_dir = args.jit_dir.resolve()
-    if jit_dir.is_dir():
-        artifact_root = bundle / "jitted_scripts"
-        resolved_dlls: set[Path] = set()
-        for path in jit_dlls:
-            source = path if path.is_absolute() else args.cwd / path
-            source = source.resolve()
-            try:
-                source.relative_to(jit_dir)
-            except ValueError:
-                continue
-            if source.is_file():
-                resolved_dlls.add(source)
-        if not resolved_dlls:
-            cached = [path for path in jit_dir.rglob("*.dll") if path.is_file()]
-            if cached:
-                resolved_dlls.add(max(cached, key=lambda path: path.stat().st_mtime))
-        for dll in resolved_dlls:
-            for suffix in JIT_ARTIFACT_SUFFIXES:
-                source = dll.with_suffix(suffix)
-                if not source.is_file():
-                    continue
-                target = artifact_root / source.relative_to(jit_dir)
-                target.parent.mkdir(parents=True, exist_ok=True)
-                shutil.copy2(source, target)
-    prune_crash_bundles(root, args.name, args.crash_bundles)
-    return bundle
-
-
-def health_ok(url: str) -> bool:
-    try:
-        with urlopen(url, timeout=2.0) as response:
-            return 200 <= response.status < 300
-    except (OSError, URLError):
-        return False
-
-
-def request_shutdown(url: str, logger: logging.Logger) -> None:
-    try:
-        request = Request(url, data=b"", method="POST")
-        with urlopen(request, timeout=5.0) as response:
-            emit(logger, "shutdown_requested", status=response.status)
-    except (OSError, URLError) as error:
-        emit(logger, "shutdown_request_failed", error=str(error))
-
-
-# Startup is several minutes of work with no single progress signal, and a cold start after a JIT
-# cache invalidation re-tunes every kernel family. Without these the log is only `health ok:false`
-# repeated for the whole window, which says the server is down but never what it is doing.
-#
-# Ranked and monotonic: a tune codegens each kernel variant, so the JIT lines fire hundreds of times
-# mid-tune and would otherwise flap the stage back and forth once a second. Only a forward move is
-# reported. `tune_restart` is the one legitimate rewind — the process restarts to apply the winners
-# — so it resets the rank and the sequence starts over.
-STARTUP_STAGES: list[tuple[str, int, str]] = [
-    ("jit_cached",      1, r"LLVM JIT: DLL cache hit"),
-    ("jit_codegen",     1, r"LLVM JIT: DLL cache miss, codegen for"),
-    ("jit_linked",      2, r"Library .+ linked - ok"),
-    ("exchange_lookup", 3, r"exchange: scope .+ looking up a sidecar"),
-    ("tuning",          4, r"llvm_tune: tuning scope"),
-    # both the tuner's marker and the exchange client's "sidecar applied" marker end in this
-    # phrase, and both mean the same thing: the process restarts to stamp fresh winners
-    ("tune_restart",    5, r"restart to apply the winners"),
-    ("model_load",      6, r"dasLLAMA: prepared image mapped"),
-    ("asr_init",        7, r"starting \d+ asynchronous ASR worker"),
-    ("ready",           8, r"listening on http"),
-]
-TUNE_RESTART_RANK = 5
-
-
-def detect_stage(message: str) -> tuple[str, int] | None:
-    for name, rank, pattern in STARTUP_STAGES:
-        if re.search(pattern, message):
-            return name, rank
-    return None
-
-
-def advance_stage(stage: dict[str, object], message: str, now: float) -> dict[str, object] | None:
-    """Return the fields to log for a forward stage move, or None. Mutates `stage` on a move.
-
-    Split out so it can be replayed against a real startup log — the rank/reset rule is the part
-    that is easy to get wrong, and a naive version flaps once per kernel variant during a tune.
-    """
-    found = detect_stage(message)
-    if found is None:
-        return None
-    name, rank = found
-    if rank <= int(stage.get("rank", 0)):
-        return None
-    fields: dict[str, object] = {"stage": name}
-    if stage.get("name") is not None:
-        fields["after"] = stage["name"]
-        began = stage.get("since")
-        if isinstance(began, float):
-            fields["elapsed_s"] = round(now - began, 1)
-    stage["name"] = name
-    # The restart re-runs codegen from scratch, so let the sequence replay.
-    stage["rank"] = 0 if rank == TUNE_RESTART_RANK else rank
-    stage["since"] = now
-    return fields
-
-
-# llvm_tune emits structured progress as `@tune <kind> k=v ...` lines, and dasllama's exchange
-# client emits `@sidecar <kind> k=v ...` on the same contract. A supervised child never owns a
-# terminal, so it forwards these instead of drawing a bar — that is exactly what makes them ours
-# to consume. Values never contain spaces (the emitters' contract), so a plain split is enough.
-TUNE_EVENT_PREFIX = "@tune "
-SIDECAR_EVENT_PREFIX = "@sidecar "
-
-# Balloons are announce-once per distinct sidecar sha, across restarts: an untuned noise-loop
-# re-emits the same `offer`/`pending_submit` on every boot, and a balloon per restart (each a
-# fresh 11 s PowerShell process on Windows) is pure spam. Persist across children in the process.
-_BALLOONED: set[str] = set()
-
-# First-contact consent (GDPR): the exchange client reports `@sidecar consent state=needed`
-# when no choice is recorded and no terminal can ask; this dialog is the supervised-session
-# answer surface. PLACEHOLDER wording — Gaijin legal owns the final text; keep in sync with
-# EXCHANGE_CONSENT_NOTICE in modules/dasLLAMA/dasllama/dasllama_exchange.das.
-CONSENT_TITLE = "dasLLAMA — tuning preset exchange"
-CONSENT_TEXT = (
-    "dasLLAMA can download a ready performance-tuning preset (a \"sidecar\") for this "
-    "machine from dasllama.io, instead of spending ~12 minutes tuning locally.\n\n"
-    "The request sends only your hardware class — platform, CPU model and OS build. "
-    "No serial numbers, user names or other personal data; no cookies. Sharing your own "
-    "tuning results back is always confirmed separately.\n\n"
-    "Details: https://legal.gaijin.net/privacypolicy"
-)
-
-
-def show_consent_dialog() -> bool | None:
-    """Blocking native Accept/Decline dialog. True/False = the user's choice; None = no
-    dialog surface here (headless Linux), it failed, or the user walked away (timeout /
-    closed it) — None must leave the question open, never count as either answer."""
-    if IS_WINDOWS:
-        # MessageBoxW offers fixed captions, so the text maps them: Yes = Accept, No = Decline.
-        MB_YESNO, MB_ICONINFORMATION, MB_TOPMOST = 0x04, 0x40, 0x00040000
-        IDYES, IDNO = 6, 7
-        try:
-            r = ctypes.windll.user32.MessageBoxW(
-                0, CONSENT_TEXT + "\n\nYes = Accept, No = Decline", CONSENT_TITLE,
-                MB_YESNO | MB_ICONINFORMATION | MB_TOPMOST)
-        except OSError:
-            return None
-        return True if r == IDYES else False if r == IDNO else None
-    if sys.platform == "darwin":
-        safe_text = CONSENT_TEXT.replace("\\", "\\\\").replace('"', '\\"').replace("\n", "\\n")
-        safe_title = CONSENT_TITLE.replace("\\", "\\\\").replace('"', '\\"')
-        script = (
-            f'display dialog "{safe_text}" with title "{safe_title}" '
-            'buttons {"Decline", "Accept"} default button "Accept" '
-            "with icon note giving up after 3600"
-        )
-        try:
-            out = subprocess.run(
-                ["osascript", "-e", script],
-                capture_output=True, text=True, timeout=3700, check=False,
-            ).stdout
-        except (OSError, subprocess.TimeoutExpired):
-            return None
-        if "gave up:true" in out:
-            return None
-        if "button returned:Accept" in out:
-            return True
-        if "button returned:Decline" in out:
-            return False
-        return None  # Escape/closed — the question stays open
-    return None
-
-
-def handle_consent_needed(args: argparse.Namespace, logger: logging.Logger,
-                          consent_path_quoted: str) -> None:
-    """Ask via the native dialog on a worker thread and record the answer into the consent
-    file the exchange client named (url-encoded in the event — values cannot carry spaces).
-    Accept while a tune is racing rides the existing stop rail: abort at the next kernel
-    boundary, relaunch clean, and the fresh boot runs the (now consented) exchange lookup."""
-    path_text = unquote(consent_path_quoted)
-    if not path_text:
-        return
-
-    def worker() -> None:
-        answer = show_consent_dialog()
-        if answer is None:
-            notify(f"{args.name}: enable the tuning-preset exchange?",
-                   "Open the control page to choose")
-            return
-        try:
-            Path(path_text).write_text("accepted\n" if answer else "declined\n",
-                                       encoding="ascii")
-        except OSError as exc:
-            emit(logger, "consent_write_failed", path=path_text, error=str(exc))
-            return
-        emit(logger, "consent_recorded", accepted=answer, path=path_text)
-        if answer and tune_in_flight():
-            request_tune_stop(args, logger, "consent")
-
-    threading.Thread(target=worker, name="consent-dialog", daemon=True).start()
-
-
-def parse_child_event(message: str, prefix: str) -> tuple[str, dict[str, str]] | None:
-    """Return (kind, fields) for a `<prefix><kind> k=v ...` line, or None. Never raises."""
-    if not message.startswith(prefix):
-        return None
-    parts = message[len(prefix):].split()
-    if not parts:
-        return None
-    fields = {}
-    for token in parts[1:]:
-        key, sep, value = token.partition("=")
-        if sep:
-            fields[key] = value
-    return parts[0], fields
-
-
-def apply_tune_event(tune: dict[str, object], kind: str, fields: dict[str, str]) -> None:
-    """Fold one progress event into the published tune state. Counters only; no prediction."""
-    def as_int(key: str) -> int:
-        try:
-            return int(fields.get(key, ""))
-        except ValueError:
-            return 0
-    if kind == "plan":
-        tune.clear()
-        tune.update(scope=fields.get("scope", ""), done=0, total=as_int("total"))
-    elif kind == "begin":
-        tune.update(kernel=fields.get("name", ""), round=0, rounds=as_int("total"),
-                    phase="", live=0)
-    elif kind == "step":
-        tune.update(round=as_int("i"), phase=fields.get("phase", ""), live=as_int("live"))
-    elif kind == "end":
-        # the per-round fields describe an in-flight kernel; leaving them set between kernels
-        # publishes an incoherent state (round=47 against rounds=0) that a status page renders
-        tune["done"] = int(tune.get("done", 0)) + 1
-        tune.update(round=0, rounds=0, phase="", live=0)
-    elif kind == "abort":
-        # a supervisor interrupt stopped the tune at a kernel boundary; drop the "total" that
-        # drives the "minting N/M" display so the status stops claiming a tune is in flight
-        tune.clear()
-        tune.update(aborted=True, at=fields.get("at", ""))
-
-
-def apply_sidecar_event(sidecar: dict[str, object], kind: str, fields: dict[str, str]) -> None:
-    """Fold one exchange event into the published sidecar state. `offer` persists through a
-    tune (the tray menu's adopt action reads it); `pending_submit` rides beside the state and
-    clears on `submitted`. A fresh `lookup` starts the story over."""
-    if kind == "lookup":
-        sidecar.clear()
-        sidecar["state"] = "lookup"
-    elif kind == "none":
-        sidecar.update(state="none", reason=fields.get("reason", ""))
-    elif kind == "offer":
-        sidecar.update(state="offer", sha=fields.get("sha", ""),
-                       tier=fields.get("tier", ""), count=fields.get("count", ""))
-    elif kind == "apply":
-        sidecar.update(state="applied", sha=fields.get("sha", ""),
-                       tier=fields.get("tier", ""), verified=fields.get("verified", ""))
-    elif kind == "pending_submit":
-        sidecar["pending_submit"] = fields.get("sha", "")
-    elif kind == "submitted":
-        sidecar.pop("pending_submit", None)
-        sidecar["submitted"] = fields.get("sha", "")
-    elif kind == "consent":
-        # "needed" while unanswered, then "accepted"/"declined" from whichever surface records it
-        sidecar["consent"] = fields.get("state", "")
-
-
-def stream_child(
-    proc: subprocess.Popen[str],
-    logger: logging.Logger,
-    tune_restart_seen: threading.Event,
-    jit_dlls: set[Path],
-    stage: dict[str, object],
-    name: str,
-    wd_args: argparse.Namespace,
-) -> None:
-    assert proc.stdout is not None
-    # Per child, and published immediately: the tune-bootstrap restart is the normal first-run
-    # path, and the relaunched child emits no tune events at all. Without clearing here, the
-    # control page would keep showing the finished tune's counters for the rest of the run.
-    tune: dict[str, object] = {}
-    sidecar: dict[str, object] = {}
-    set_state(tune={}, sidecar={})
-    for line in proc.stdout:
-        message = line.rstrip("\r\n")
-        event = parse_child_event(message, TUNE_EVENT_PREFIX)
-        if event is not None:
-            kind, fields = event
-            apply_tune_event(tune, kind, fields)
-            # A tune is hundreds of steps; publish every one for the control page but log only
-            # the kernel boundaries, or the log becomes the flood these events exist to replace.
-            set_state(tune=dict(tune))
-            if kind in ("plan", "end", "abort"):
-                # the child's stdout is arbitrary bytes, so a line could carry a field named
-                # like one of emit()'s own: "pid"/"kind" would be a duplicate kwarg (TypeError,
-                # killing this daemon thread and with it stage detection AND tune_restart_seen),
-                # "ts"/"event" would silently shadow the log envelope
-                safe = {k: v for k, v in fields.items()
-                        if k not in ("pid", "kind", "ts", "event")}
-                emit(logger, "tune", pid=proc.pid, kind=kind, **safe)
-            continue
-        event = parse_child_event(message, SIDECAR_EVENT_PREFIX)
-        if event is not None:
-            kind, fields = event
-            apply_sidecar_event(sidecar, kind, fields)
-            set_state(sidecar=dict(sidecar))
-            safe = {k: v for k, v in fields.items()
-                    if k not in ("pid", "kind", "ts", "event")}
-            emit(logger, "sidecar", pid=proc.pid, kind=kind, **safe)
-            # Balloons announce a DECISION the user can make; they never carry the action
-            # (a PowerShell balloon cannot) — the tray menu and the control page do. Announce
-            # once per distinct sha (a noise-abort loop re-emits the same offer every boot).
-            if kind == "consent" and fields.get("state") == "needed":
-                # once per consent file for the watchdog's lifetime — an unanswered dialog
-                # re-emits `needed` on every restart of the noise/untuned boot loop
-                consent_key = "consent:" + fields.get("path", "")
-                if consent_key not in _BALLOONED:
-                    _BALLOONED.add(consent_key)
-                    handle_consent_needed(wd_args, logger, fields.get("path", ""))
-                continue
-            sha = fields.get("sha", "")
-            balloon_key = f"{kind}:{sha}"
-            if kind in ("offer", "pending_submit") and balloon_key not in _BALLOONED:
-                _BALLOONED.add(balloon_key)
-                if kind == "offer":
-                    notify(f"{name}: unverified sidecar available",
-                           "The tray menu can adopt it instead of finishing the tune")
-                else:
-                    notify(f"{name}: share this box's tune?",
-                           "Open the control page to submit it to the exchange")
-            continue
-        # both the tuner's marker and the exchange client's "sidecar applied" marker license
-        # the immediate exit-3 relaunch — the process restarts to stamp fresh winners
-        if "restart to apply the winners" in message:
-            tune_restart_seen.set()
-        match = re.search(
-            r"LLVM JIT: DLL cache (?:hit |miss, codegen for )(.+\.dll)$",
-            message,
-        )
-        if match is not None:
-            jit_dlls.add(Path(match.group(1)))
-        moved = advance_stage(stage, message, time.monotonic())
-        if moved is not None:
-            emit(logger, "stage", pid=proc.pid, **moved)
-            set_state(stage=moved["stage"])
-        emit(logger, "child", pid=proc.pid, message=message)
-
-
-def start_control_plugin(script_dir: Path, logger: logging.Logger, args: argparse.Namespace):
-    """Start the sibling control module if the program ships one. It must expose
-    start(logger, args). A control surface that fails to load is reported and skipped, never
-    fatal — keeping the program alive outranks being able to reconfigure it."""
-    path = script_dir / CONTROL_MODULE
-    if not path.is_file():
-        return None
-    try:
-        spec = importlib.util.spec_from_file_location("watchdog_control", path)
-        module = importlib.util.module_from_spec(spec)
-        # Injected before exec so the plugin can reuse emit() and friends. Sharing the host beats
-        # re-declaring emit in every plugin, where the log envelope would drift.
-        module.host = sys.modules[__name__]
-        spec.loader.exec_module(module)
-        handle = module.start(logger, args)
-    except Exception as exc:  # noqa: BLE001 - a broken plugin must not take supervision down
-        emit(logger, "control_failed", path=str(path), error=repr(exc))
-        return None
-    emit(logger, "control_started", path=str(path))
-    return handle
-
-
-def tray_default_url(health_url: object) -> str | None:
-    """The page a bare left-click opens when --tray-url is not set: the health URL's origin.
-    For dasllama-server that is the control page (http://127.0.0.1:8080/). Defensive on type:
-    watchdog.json values reach args via set_defaults with no argparse coercion, and a null
-    health_url must degrade to no-link, not break the never-fatal tray contract."""
-    if not isinstance(health_url, str) or not health_url:
-        return None
-    parts = urlsplit(health_url)
-    if not parts.scheme or not parts.netloc:
-        return None
-    return f"{parts.scheme}://{parts.netloc}/"
-
-
-def load_tray_image(script_dir: Path, cwd: Path, name: str):
-    """Brand mark if the bundle ships one (tray.ico / tray.png beside watchdog.py or in the
-    bundle dir), else a generated placeholder so --tray works before the mark exists."""
-    from PIL import Image, ImageDraw
-    for candidate in ("tray.ico", "tray.png"):
-        for base in (script_dir, cwd):
-            path = base / candidate
-            if path.is_file():
-                # copy + close: Image.open keeps the file handle for the image's lifetime,
-                # and the tray icon lives as long as the watchdog — on Windows that open
-                # handle would block deploy-jit from replacing tray.ico in a live bundle.
-                with Image.open(path) as img:
-                    return img.copy()
-    size = 64
-    image = Image.new("RGBA", (size, size), (0, 0, 0, 0))
-    draw = ImageDraw.Draw(image)
-    draw.rounded_rectangle((4, 4, size - 4, size - 4), radius=14, fill=(232, 89, 12, 255))
-    initial = (name[:1] or "?").upper()
-    # The PIL default bitmap font is ~10px no matter the canvas — invisible at tray
-    # scale. Use a system truetype at real size; fall back to a bare glyphless square.
-    from PIL import ImageFont
-    font = None
-    for candidate in ("segoeuib.ttf", "arialbd.ttf", "DejaVuSans-Bold.ttf",
-                      "Arial Bold.ttf", "Helvetica.ttc"):
-        try:
-            font = ImageFont.truetype(candidate, 42)
-            break
-        except OSError:
-            continue
-    if font is not None:
-        draw.text((size / 2, size / 2 - 2), initial, fill=(255, 255, 255, 255),
-                  anchor="mm", font=font)
-    return image
-
-
-# Status badge geometry from the design spec (forge project, consumers/dasllama-mark),
-# in 64-unit space: a transparent "moat" circle knocks the base image out behind the badge
-# so it reads on any taskbar shade, then the badge draws in the bottom-right corner.
-# Shapes differ per state on purpose — color-blind users get geometry, not just hue.
-TRAY_MOAT = (49.0, 49.0, 16.5)  # cx, cy, r
-TRAY_BADGES = {
-    "amber": ("triangle", (242, 183, 61, 255)),  # working: booting / minting kernels
-    "red": ("square", (217, 109, 79, 255)),      # trouble: unhealthy / crash-backoff
-}
-
-# Plain-language startup stages for the tray line — the raw stage names stay in the logs,
-# but a user watching the tooltip gets what the wait IS, not compiler jargon.
-STAGE_LABELS = {
-    "jit_codegen": "compiling this box's kernels (first start takes minutes)",
-    "jit_linked": "kernels compiled",
-    "exchange_lookup": "checking the tune exchange",
-    "tuning": "tuning this box",
-    "model_load": "loading the model",
-    "ready": "first health check pending",
-}
-
-
-def badge_tray_image(base, state: str):
-    """A copy of `base` wearing the status badge for `state`; None for unknown states.
-    The plain base IS the serving state — a badge is always a signal, never decoration."""
-    spec = TRAY_BADGES.get(state)
-    if spec is None:
-        return None
-    from PIL import Image, ImageChops, ImageDraw
-    shape, color = spec
-    image = base.convert("RGBA")
-    if image is base:
-        image = base.copy()
-    u = min(image.size) / 64.0
-    cx, cy, r = TRAY_MOAT
-    moat = Image.new("L", image.size, 255)
-    ImageDraw.Draw(moat).ellipse(
-        [(cx - r) * u, (cy - r) * u, (cx + r) * u, (cy + r) * u], fill=0
-    )
-    image.putalpha(ImageChops.multiply(image.getchannel("A"), moat))
-    draw = ImageDraw.Draw(image)
-    if shape == "triangle":
-        draw.polygon(
-            [(49.0 * u, 35.5 * u), (62.5 * u, 59.2 * u), (35.5 * u, 59.2 * u)], fill=color
-        )
-    else:
-        draw.rounded_rectangle(
-            [37.5 * u, 37.5 * u, 60.5 * u, 60.5 * u], radius=1.5 * u, fill=color
-        )
-    return image
-
-
-def pid_alive(pid: int) -> bool:
-    """Best-effort liveness for the single-instance guard. On Windows os.kill(pid, 0)
-    TERMINATES the target (TerminateProcess with exit code 0), so probe through the same
-    OpenProcess rail the memory metrics use; POSIX gets the classic signal-0 idiom."""
-    if pid <= 0:
-        return False
-    if IS_WINDOWS:
-        return windows_process_metrics(pid) is not None
-    try:
-        os.kill(pid, 0)
-    except PermissionError:
-        return True
-    except OSError:
-        return False
-    return True
-
-
-def tray_state() -> tuple[str, str]:
-    """(status line, coarse icon state) from the same STATE the control plugin sees. The
-    status line is one line of truth for the tooltip and the menu's status row — counters
-    only, no prediction, same rule as the tune fold. Coarse states: "amber" = working,
-    "red" = trouble, "base" = serving (the plain mark)."""
-    s = read_state()
-    if not s.get("child_pid"):
-        delay = float(s.get("restart_delay") or 0.0)
-        code = s.get("child_exit_code")
-        if delay > 0:
-            return f"restarting in {delay:.0f}s (exit {code})", "red"
-        return "stopped", "red"
-    tune = s.get("tune") or {}
-    if isinstance(tune, dict) and tune.get("total"):
-        done, total = tune.get("done", 0), tune.get("total", 0)
-        kernel = tune.get("kernel") or ""
-        rounds = int(tune.get("rounds") or 0)
-        detail = f" — {kernel} {tune.get('round', 0)}/{rounds}" if kernel and rounds else \
-             (f" — {kernel}" if kernel else "")
-        return f"minting kernels {done}/{total}{detail}", "amber"
-    healthy = s.get("healthy")
-    if healthy is True:
-        since = float(s.get("serving_since") or 0.0)
-        up = time.time() - since if since else 0.0
-        hours, mins = int(up // 3600), int(up % 3600 // 60)
-        line = f"serving · healthy {hours}h{mins:02d}m" if hours else f"serving · healthy {mins}m"
-        if s.get("tuning_disabled"):
-            line += " · tuning off"   # a 'run untuned' hold is active — visible, and revocable in the menu
-        return line, "base"
-    stage = s.get("stage")
-    # "unhealthy" is reserved for a server that SERVED and then stopped answering — a cold
-    # JIT start is minutes of failed health polls, and framing that as ill sends users
-    # hunting for a problem.
-    has_served = float(s.get("serving_since") or 0.0) > 0.0
-    if healthy is False and has_served:
-        return (f"unhealthy ({stage})" if stage else "unhealthy"), "red"
-    label = STAGE_LABELS.get(stage, stage)
-    return (f"starting up — {label}" if label else "starting up"), "amber"
-
-
-def tray_status() -> str:
-    return tray_state()[0]
-
-
-def tune_control_path(args: argparse.Namespace) -> Path:
-    """The stop file the tuner polls at kernel-family boundaries (DAS_TUNE_CONTROL). Lives in
-    the logs dir — always writable, never inside the supervised bundle's sources."""
-    return args.log.parent / f"{args.name}.tune-stop"
-
-
-def tune_in_flight() -> bool:
-    s = read_state()
-    if not s.get("child_pid"):
-        return False
-    tune = s.get("tune")
-    return isinstance(tune, dict) and bool(tune.get("total"))
-
-
-def sidecar_state() -> dict[str, object]:
-    s = read_state().get("sidecar")
-    return s if isinstance(s, dict) else {}
-
-
-def take_tune_stop() -> dict[str, object] | None:
-    with STATE_LOCK:
-        action = STATE.pop("tune_stop", None)
-    return action if isinstance(action, dict) else None
-
-
-def take_resume_tuning() -> bool:
-    with STATE_LOCK:
-        return bool(STATE.pop("resume_tuning", None))
-
-
-def request_resume_tuning(args: argparse.Namespace, logger: logging.Logger) -> None:
-    """Tray action: undo a 'run untuned' hold so the next start tunes normally again."""
-    set_state(resume_tuning=True)
-    emit(logger, "tuning_resume_requested")
-    notify(f"{args.name}: tuning re-enabled", "The next start will tune this box normally")
-
-
-def request_tune_stop(args: argparse.Namespace, logger: logging.Logger, mode: str) -> None:
-    """Tray action: stop the in-flight tune at the next kernel boundary (the race in flight
-    always completes). `use_sidecar` arms a ONE-SHOT unverified-accept relaunch — precise
-    consent that must never outlive this click; `untuned` makes fallback stamps sticky for
-    the rest of this watchdog session (revocable via 'Resume tuning'), so a later crash-restart
-    cannot surprise the box with a ~12-minute tune."""
-    if mode == "use_sidecar":
-        action: dict[str, object] = {
-            "mode": mode, "env": {"DASLLAMA_EXCHANGE_ACCEPT": "any"}, "sticky": False}
-    elif mode == "consent":
-        # consent just granted mid-tune: stop the race, relaunch clean — the fresh boot's
-        # resolver reads the recorded consent and runs the normal (verified-only) lookup
-        action = {"mode": mode, "env": {}, "sticky": False}
-    else:
-        action = {"mode": mode, "env": {"DAS_TUNE_POLICY": "fallback"}, "sticky": True}
-    # Arm STATE BEFORE writing the file: the supervision loop unlinks the control file and then
-    # take_tune_stop()s at each spawn — if the file were written first, that unlink could delete
-    # it and the take miss the action, letting a fresh child tune for the full ~12 minutes.
-    set_state(tune_stop=action)
-    path = tune_control_path(args)
-    try:
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text("stop\n", encoding="ascii")
-    except OSError as exc:
-        # the file only interrupts the IN-FLIGHT tune; the armed policy still governs the
-        # relaunch, so a failed write still stops the box tuning on the next start
-        emit(logger, "tune_stop_failed", mode=mode, error=str(exc))
-    emit(logger, "tune_stop_requested", mode=mode, path=str(path))
-    notify(f"{args.name}: stopping the tune",
-           "The measurement in flight finishes first; the tune stops at the next kernel")
-
-
-def tray_tick(icon, name: str) -> None:
-    """Refresh the tray from live state. Called from the supervision loop's 0.25s tick; writes
-    only on change so the shell isn't spammed with updates."""
-    if icon is None:
-        return
-    # Menu refresh runs on EVERY platform. pystray bakes each item's visible/enabled at build
-    # time and does NOT re-evaluate them when the menu opens, so this update_menu() on a STATE
-    # transition is the ONLY thing that makes the dynamic exchange items appear/disappear. The
-    # key must include every STATE field an item's predicate reads (healthy, tuning_disabled),
-    # or that item never refreshes. Wrapped so a backend that rejects a cross-thread rebuild
-    # (macOS AppKit off the main thread) degrades to a no-op rather than taking supervision down.
-    sc = sidecar_state()
-    st = read_state()
-    menu_key = (tune_in_flight(), str(sc.get("state") or ""), bool(sc.get("pending_submit")),
-                st.get("healthy") is True, bool(st.get("tuning_disabled")))
-    if getattr(icon, "_das_last_menu_key", None) != menu_key:
-        try:
-            icon.update_menu()
-            icon._das_last_menu_key = menu_key
-        except Exception:  # noqa: BLE001
-            pass
-    # Tooltip + icon image go through NOTIFYICONDATA-style writes; AppKit serves only the main
-    # thread and darwin runs this tick on a worker, so skip those there.
-    if sys.platform == "darwin":
-        return
-    status, coarse = tray_state()
-    title = f"{name} — {status}"
-    if getattr(icon, "_das_last_title", None) != title:
-        try:
-            icon.title = title
-            icon._das_last_title = title
-        except Exception:  # noqa: BLE001 - a dead tray must not touch supervision
-            pass
-    states = getattr(icon, "_das_states", None)
-    if states and getattr(icon, "_das_last_state", None) != coarse:
-        image = states.get(coarse)
-        if image is not None:
-            try:
-                icon.icon = image
-                icon._das_last_state = coarse
-            except Exception:  # noqa: BLE001
-                pass
-
-
-def build_tray_icon(args: argparse.Namespace, logger: logging.Logger, stopping: threading.Event):
-    """Build the tray icon without running its loop: a live status line (tooltip + first menu
-    row), an "Open" item enabled only while the service is actually healthy, and "Shutdown"
-    routed into the same stopping Event the signal handlers set. Never fatal — a desktop
-    nicety must not take supervision down. Returns None when the tray is off or cannot exist."""
-    if not args.tray:
-        return None
-    try:
-        import pystray
-    except ImportError as exc:
-        emit(logger, "tray_unavailable", reason=str(exc), hint="pip install pystray pillow")
-        return None
-    url = args.tray_url if isinstance(args.tray_url, str) and args.tray_url else None
-    if url is None:
-        url = tray_default_url(args.health_url)
-
-    def on_open(_icon, _item) -> None:
-        # Callback runs on the tray backend's thread; an escaped exception can take the
-        # icon loop down. Same never-fatal rule as everywhere else in the tray.
-        try:
-            webbrowser.open(url)
-        except Exception as exc:  # noqa: BLE001
-            emit(logger, "tray_open_failed", reason=repr(exc))
-
-    def on_shutdown(_icon, _item) -> None:
-        emit(logger, "tray_shutdown_requested")
-        stopping.set()
-
-    def on_use_sidecar(_icon, _item) -> None:
-        request_tune_stop(args, logger, "use_sidecar")
-
-    def on_run_untuned(_icon, _item) -> None:
-        request_tune_stop(args, logger, "untuned")
-
-    def on_resume_tuning(_icon, _item) -> None:
-        request_resume_tuning(args, logger)
-
-    def on_share(_icon, _item) -> None:
-        try:
-            webbrowser.open(f"{url}#exchange")
-        except Exception as exc:  # noqa: BLE001
-            emit(logger, "tray_open_failed", reason=repr(exc))
-
-    # Menu item visible/enabled are baked when the menu is BUILT — pystray does not re-evaluate
-    # them on open — so tray_tick's update_menu() on a STATE transition is what refreshes them,
-    # and its menu_key must name every STATE field these predicates read. The menu is a pure
-    # function of STATE. "Open" greys out until health is green. The exchange rows exist only
-    # while their action is real: adopting needs a live tune AND an offer; sharing needs a
-    # pending submit; "Resume tuning" only while a run-untuned hold is active.
-    items = [pystray.MenuItem(lambda item: tray_status(), None, enabled=False)]
-    if url:
-        items.append(pystray.MenuItem(
-            f"Open {args.name}",
-            on_open,
-            default=True,
-            enabled=lambda item: read_state().get("healthy") is True,
-        ))
-    items.append(pystray.MenuItem(
-        "Use available sidecar instead (stops tuning)",
-        on_use_sidecar,
-        visible=lambda item: tune_in_flight() and sidecar_state().get("state") == "offer",
-    ))
-    items.append(pystray.MenuItem(
-        "Stop tuning, run untuned",
-        on_run_untuned,
-        visible=lambda item: tune_in_flight(),
-    ))
-    items.append(pystray.MenuItem(
-        "Resume tuning",
-        on_resume_tuning,
-        visible=lambda item: bool(read_state().get("tuning_disabled")),
-    ))
-    if url:
-        items.append(pystray.MenuItem(
-            "Share this box's tune…",
-            on_share,
-            # needs the control page, so it also needs the server up
-            visible=lambda item: (bool(sidecar_state().get("pending_submit"))
-                                  and read_state().get("healthy") is True),
-        ))
-    items.append(pystray.MenuItem("Shutdown", on_shutdown))
-    try:
-        image = load_tray_image(SCRIPT_DIR, args.cwd, args.name)
-        icon = pystray.Icon(
-            args.name,
-            image,
-            title=f"{args.name} — starting up",
-            menu=pystray.Menu(*items),
-        )
-        # Pre-composited status variants; tray_tick swaps between them as the coarse
-        # state moves. Composited at runtime so every deployment's icon (or even the
-        # generated placeholder) gets status for free — no per-state asset shipping.
-        icon._das_states = {
-            "base": image,
-            "amber": badge_tray_image(image, "amber"),
-            "red": badge_tray_image(image, "red"),
-        }
-    except Exception as exc:  # noqa: BLE001 - no tray host, headless X, broken backend
-        emit(logger, "tray_unavailable", reason=repr(exc))
-        return None
-    icon._das_url = url or ""
-    return icon
-
-
-def start_tray(args: argparse.Namespace, logger: logging.Logger, stopping: threading.Event):
-    """Detached tray for platforms whose backend tolerates a background loop (Windows, Linux).
-    macOS goes through run_with_darwin_tray instead — AppKit serves only the main thread."""
-    icon = build_tray_icon(args, logger, stopping)
-    if icon is None:
-        return None
-    try:
-        icon.run_detached()
-    except Exception as exc:  # noqa: BLE001
-        emit(logger, "tray_unavailable", reason=repr(exc))
-        return None
-    emit(logger, "tray_started", url=icon._das_url)
-    return icon
-
-
-def stop_tray(icon, logger: logging.Logger) -> None:
-    if icon is None:
-        return
-    try:
-        icon.stop()
-    except Exception as exc:  # noqa: BLE001 - teardown must not mask the real exit path
-        emit(logger, "tray_stop_failed", reason=repr(exc))
-
-
-def run_with_darwin_tray(
-    args: argparse.Namespace,
-    logger: logging.Logger,
-    stopping: threading.Event,
-    command: list[str],
-    child_exe_name: str,
-    dump_type: int | None,
-) -> int:
-    """macOS inversion: AppKit serves only the process's main thread, so supervision moves to
-    a worker and the tray runloop keeps main. Supervision ending — tray Shutdown, child exit 0,
-    crash-out — stops the icon, which returns icon.run() and lets main exit with the worker's
-    code. While the runloop owns main, Ctrl-C is serviced only when it yields to Python, so
-    the tray's Shutdown item is the reliable stop on macOS."""
-    icon = build_tray_icon(args, logger, stopping)
-    if icon is None:
-        return supervise(args, logger, stopping, None, command, child_exe_name, dump_type)
-    result = [2]
-
-    def worker() -> None:
-        try:
-            result[0] = supervise(args, logger, stopping, icon, command, child_exe_name, dump_type)
-        finally:
-            stop_tray(icon, logger)
-
-    thread = threading.Thread(target=worker, name="supervision")
-
-    def setup(icon_) -> None:
-        icon_.visible = True
-        emit(logger, "tray_started", url=icon._das_url, main_thread=True)
-        thread.start()
-
-    try:
-        icon.run(setup=setup)
-    except Exception as exc:  # noqa: BLE001 - ssh session with no WindowServer, broken backend
-        emit(logger, "tray_unavailable", reason=repr(exc))
-        # pystray runs setup on its own thread concurrently with the loop, so supervision may
-        # already be live even though the loop died; only a never-started run falls back here.
-        if not thread.is_alive():
-            return supervise(args, logger, stopping, None, command, child_exe_name, dump_type)
-    thread.join()
-    return result[0]
-
-
-def load_config(script_dir: Path) -> dict[str, object]:
-    """Read watchdog.json beside this script. Missing is fine; malformed is fatal."""
-    path = script_dir / CONFIG_NAME
-    if not path.is_file():
-        return {}
-    try:
-        data = json.loads(path.read_text(encoding="utf-8"))
-    except OSError as exc:
-        raise SystemExit(f"watchdog: cannot read {path}: {exc}")
-    except ValueError as exc:
-        raise SystemExit(f"watchdog: {path} is not valid JSON: {exc}")
-    if not isinstance(data, dict):
-        raise SystemExit(f"watchdog: {path} must hold a JSON object, got {type(data).__name__}")
-    return data
-
-
-def apply_config(parser: argparse.ArgumentParser, config: dict[str, object], where: Path) -> None:
-    """Fold config into the parser's defaults. An unknown key is fatal: silently ignoring a typo
-    would supervise the program with wrong wiring and nothing would say so."""
-    if not config:
-        return
-    valid = set(vars(parser.parse_args([])))
-    unknown = sorted(set(config) - valid)
-    if unknown:
-        raise SystemExit(
-            f"watchdog: {where} has unknown key(s): {', '.join(unknown)}\n"
-            f"  known keys: {', '.join(sorted(valid - {'server_args'}))}"
-        )
-    # set_defaults bypasses each action's type=, so path-valued keys convert here.
-    resolved = {k: (Path(str(v)) if k in CONFIG_PATH_KEYS and v is not None else v)
-                for k, v in config.items()}
-    parser.set_defaults(**resolved)
-
-
-def discover_target(script_dir: Path) -> dict[str, object]:
-    """Infer what to supervise from the bundle layout, so a deployed `python watchdog.py` with no
-    config and no flags just runs. Ambiguity is reported, never guessed."""
-    script = script_dir / "main.das"
-    daslang = script_dir / "bin/Release/daslang.exe"
-    if script.is_file() and daslang.is_file():
-        return {"script": script, "daslang": daslang}
-    exes = sorted(p for p in script_dir.glob("*.exe") if p.is_file())
-    if len(exes) == 1:
-        return {"program": exes[0], "name": exes[0].stem}
-    if len(exes) > 1:
-        raise SystemExit(
-            f"watchdog: {script_dir} holds {len(exes)} executables "
-            f"({', '.join(p.name for p in exes)}); pick one with --program or {CONFIG_NAME}"
-        )
-    raise SystemExit(
-        f"watchdog: nothing to supervise in {script_dir} — expected a single *.exe, or "
-        f"main.das beside bin/Release/daslang.exe. Use --program/--script or ship {CONFIG_NAME}."
-    )
-
-
-def parse_cli() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description=__doc__)
-    # None means "derive from the discovered program"; see resolve_identity.
-    parser.add_argument("--name", default=None)
-    parser.add_argument(
-        "--program",
-        type=Path,
-        help="Run this standalone program instead of daslang -jit <script>; relative paths use --cwd",
-    )
-    parser.add_argument("--daslang", type=Path, default=None)
-    parser.add_argument("--script", type=Path, default=None)
-    parser.add_argument("--cwd", type=Path, default=DEFAULT_CWD)
-    parser.add_argument("--log", type=Path, default=None)
-    parser.add_argument("--pid-file", type=Path, default=None)
-    parser.add_argument("--health-url", default="http://127.0.0.1:8080/v1/models")
-    parser.add_argument("--shutdown-url", default="http://127.0.0.1:8080/shutdown")
-    parser.add_argument("--no-health", action="store_true")
-    parser.add_argument("--no-shutdown", action="store_true")
-    parser.add_argument(
-        "--stop-file",
-        type=Path,
-        help="Create this file to request a lifecycle-safe standalone shutdown",
-    )
-    parser.add_argument("--stop-env", default="CADMUS_STOP_FILE")
-    parser.add_argument("--stop-timeout", type=float, default=1200.0)
-    parser.add_argument("--memory-interval", type=float, default=60.0)
-    parser.add_argument("--health-interval", type=float, default=5.0)
-    parser.add_argument("--stable-seconds", type=float, default=300.0)
-    parser.add_argument("--max-restart-delay", type=float, default=60.0)
-    parser.add_argument(
-        "--jit-stack",
-        action="store_true",
-        help="Pass pre-compile -jit-stack to daslang so every generated call has a logical stack frame",
-    )
-    parser.add_argument(
-        "--dump-dir",
-        type=Path,
-        default=Path("logs/dumps"),
-        help="Expected WER LocalDumps output folder",
-    )
-    parser.add_argument(
-        "--install-local-dumps",
-        action="store_true",
-        help="Install an app-specific WER normal-minidump policy and exit (Windows, elevated)",
-    )
-    parser.add_argument("--dump-count", type=int, default=10)
-    parser.add_argument(
-        "--require-dumps",
-        action="store_true",
-        help="Refuse to start unless an app-specific/global WER normal-minidump policy is active",
-    )
-    parser.add_argument(
-        "--crash-dir",
-        type=Path,
-        default=Path("logs/crashes"),
-        help="Crash bundle destination",
-    )
-    parser.add_argument("--crash-bundles", type=int, default=10)
-    parser.add_argument(
-        "--jit-dir",
-        type=Path,
-        default=Path(".jitted_scripts"),
-        help="JIT artifact cache copied into each crash bundle",
-    )
-    parser.add_argument("--no-crash-bundle", action="store_true")
-    parser.add_argument(
-        "--tray",
-        action="store_true",
-        help="Show a system-tray icon (open the service page / shutdown) for desktop runs",
-    )
-    parser.add_argument(
-        "--tray-url",
-        default=None,
-        help="Page the tray opens on click; defaults to the --health-url origin",
-    )
-    parser.add_argument("server_args", nargs=argparse.REMAINDER)
-    apply_config(parser, load_config(SCRIPT_DIR), SCRIPT_DIR / CONFIG_NAME)
-    args = parser.parse_args()
-    if args.server_args[:1] == ["--"]:
-        args.server_args = args.server_args[1:]
-    resolve_identity(args)
-    return args
-
-
-def resolve_identity(args: argparse.Namespace) -> None:
-    """Fill in whatever neither the CLI nor watchdog.json pinned down: what to run, and the
-    name that the log, pid file and notifications are keyed on."""
-    if args.program is None and args.script is None:
-        for key, value in discover_target(args.cwd.resolve()).items():
-            if getattr(args, key) is None:
-                setattr(args, key, value)
-    if args.name is None:
-        # An executable names itself; a script is almost always main.das, so the bundle directory
-        # is the meaningful identity there.
-        args.name = (
-            Path(args.program).stem if args.program is not None else args.cwd.resolve().name
-        )
-    if args.daslang is None:
-        args.daslang = find_daslang()
-    if args.log is None:
-        args.log = Path(f"logs/{args.name}-watchdog.log")
-    if args.pid_file is None:
-        args.pid_file = Path(f"logs/{args.name}-watchdog.pid")
-
-
-def main() -> int:
-    args = parse_cli()
-    args.cwd = args.cwd.resolve()
-    args.log = resolve_from(args.log, args.cwd)
-    args.pid_file = resolve_from(args.pid_file, args.cwd)
-    if args.script is not None:
-        args.script = resolve_from(args.script, args.cwd)
-    args.dump_dir = resolve_from(args.dump_dir, args.cwd)
-    args.crash_dir = resolve_from(args.crash_dir, args.cwd)
-    args.jit_dir = resolve_from(args.jit_dir, args.cwd)
-    if args.program is not None:
-        args.program = resolve_from(args.program, args.cwd)
-    if args.stop_file is not None:
-        args.stop_file = resolve_from(args.stop_file, args.cwd)
-    logger = make_logger(args.log, args.name)
-    start_control_plugin(SCRIPT_DIR, logger, args)
-    daslang_candidate = resolve_from(args.daslang, args.cwd)
-    daslang = daslang_candidate if daslang_candidate.is_file() else args.daslang
-    if args.program is not None:
-        command = [str(args.program)]
-    else:
-        command = [str(daslang), "-jit"]
-        if args.jit_stack:
-            command.append("-jit-stack")
-        command.extend((str(args.script), "--"))
-    command.extend(args.server_args)
-    child_exe_name = Path(command[0]).name
-
-    if args.install_local_dumps:
-        try:
-            install_windows_local_dumps(child_exe_name, args.dump_dir, args.dump_count)
-        except OSError as error:
-            emit(
-                logger,
-                "wer_install_failed",
-                executable=child_exe_name,
-                dump_dir=str(args.dump_dir),
-                error=str(error),
-            )
-            notify(
-                f"{args.name} dump setup failed",
-                f"Run the LocalDumps install from an elevated terminal: {error}",
-                True,
-            )
-            return 2
-        emit(
-            logger,
-            "wer_installed",
-            executable=child_exe_name,
-            dump_dir=str(args.dump_dir),
-            dump_type="minidump",
-            dump_count=max(args.dump_count, 1),
-        )
-        return 0
-
-    dump_type, configured_dump_dir = windows_local_dump_config(child_exe_name)
-    if configured_dump_dir is not None:
-        args.dump_dir = configured_dump_dir
-    if dump_type == 1:
-        emit(
-            logger,
-            "wer_ready",
-            executable=child_exe_name,
-            dump_dir=str(args.dump_dir),
-            dump_type="minidump",
-        )
-    else:
-        reason = "not configured" if dump_type is None else f"unsafe dump type {dump_type}"
-        emit(
-            logger,
-            "wer_not_ready",
-            executable=child_exe_name,
-            dump_dir=str(args.dump_dir),
-            reason=reason,
-        )
-        if args.require_dumps:
-            notify(
-                f"{args.name} watchdog not started",
-                f"WER normal minidumps are {reason}; run --install-local-dumps elevated",
-                True,
-            )
-            return 2
-
-    # Single-instance guard: two watchdogs mean two children fighting over the same port —
-    # the loser crash-loops invisibly. The pid file records; this makes it also protect.
-    prior = 0
-    try:
-        prior = int(args.pid_file.read_text(encoding="ascii").strip())
-    except (OSError, ValueError):
-        prior = 0
-    if prior and prior != os.getpid() and pid_alive(prior):
-        emit(logger, "watchdog_already_running", pid=prior, pid_file=str(args.pid_file))
-        print(
-            f"watchdog: {args.name} is already supervised by pid {prior} "
-            f"(per {args.pid_file}). Stop it first (tray Shutdown / Ctrl-C), "
-            f"or delete the pid file if it is stale."
-        )
-        return 2
-
-    args.pid_file.parent.mkdir(parents=True, exist_ok=True)
-    args.pid_file.write_text(str(os.getpid()), encoding="ascii")
-    stopping = threading.Event()
-
-    def stop_handler(_signum, _frame) -> None:
-        stopping.set()
-
-    signal.signal(signal.SIGINT, stop_handler)
-    signal.signal(signal.SIGTERM, stop_handler)
-    if args.tray and sys.platform == "darwin":
-        return run_with_darwin_tray(args, logger, stopping, command, child_exe_name, dump_type)
-    tray_icon = start_tray(args, logger, stopping)
-    try:
-        return supervise(args, logger, stopping, tray_icon, command, child_exe_name, dump_type)
-    finally:
-        stop_tray(tray_icon, logger)
-
-
-def supervise(
-    args: argparse.Namespace,
-    logger: logging.Logger,
-    stopping: threading.Event,
-    tray_icon,
-    command: list[str],
-    child_exe_name: str,
-    dump_type: int | None,
-) -> int:
-    """The supervision loop proper: spawn, stream, health-poll, classify exits, restart with
-    backoff. Runs on the main thread everywhere except macOS-with-tray, where
-    run_with_darwin_tray gives main to AppKit and runs this on a worker. The caller that
-    started the tray owns stopping it."""
-    failures = 0
-    recovery_pending = False
-    stop_file = args.stop_file
-    child: subprocess.Popen[str] | None = None
-    child_env = os.environ.copy()
-    if stop_file is not None:
-        child_env[args.stop_env] = str(stop_file)
-    # daslang children get the tune-control channel: during a tune there is no HTTP (the
-    # server binds its port at stage "ready", the tune runs at stage "tuning"), so the tray's
-    # stop-the-tune actions write this file and the tuner polls it at kernel boundaries.
-    control_file: Path | None = None
-    if args.program is None:
-        control_file = tune_control_path(args)
-        child_env["DAS_TUNE_CONTROL"] = str(control_file)
-    emit(logger, "watchdog_started", pid=os.getpid(), command=command, cwd=str(args.cwd))
-
-    try:
-        while not stopping.is_set():
-            if stop_file is not None:
-                try:
-                    stop_file.unlink()
-                except FileNotFoundError:
-                    pass
-            if control_file is not None:
-                # a consumed (or stale) stop request must never kill the NEXT tune
-                try:
-                    control_file.unlink()
-                except FileNotFoundError:
-                    pass
-            # a "resume tuning" request (tray item, or reconciled by a config restart) clears the
-            # sticky untuned hold so the next start tunes normally again
-            if take_resume_tuning():
-                set_state(sticky_env=None, tuning_disabled=False)
-                emit(logger, "tuning_resumed")
-            # per-spawn env: base + the persistent sticky hold (run-untuned, in STATE so it is
-            # revocable) + a one-shot action (adopt-the-sidecar, consumed here and gone)
-            spawn_env = dict(child_env)
-            sticky = read_state().get("sticky_env")
-            if isinstance(sticky, dict):
-                spawn_env.update(sticky)
-            action = take_tune_stop()
-            if action is not None:
-                spawn_env.update(action.get("env") or {})
-                if action.get("sticky"):
-                    set_state(sticky_env=dict(action.get("env") or {}), tuning_disabled=True)
-                emit(logger, "tune_stop_consumed", mode=str(action.get("mode", "")))
-            started_at = time.time()
-            creationflags = getattr(subprocess, "CREATE_NEW_PROCESS_GROUP", 0) if IS_WINDOWS else 0
-            try:
-                child = subprocess.Popen(
-                    command,
-                    cwd=args.cwd,
-                    stdout=subprocess.PIPE,
-                    stderr=subprocess.STDOUT,
-                    text=True,
-                    encoding="utf-8",
-                    errors="replace",
-                    bufsize=1,
-                    creationflags=creationflags,
-                    env=spawn_env,
-                )
-            except OSError as error:
-                emit(logger, "spawn_failed", error=str(error))
-                notify(f"{args.name} watchdog", f"Could not start child: {error}", True)
-                return 2
-
-            emit(logger, "child_started", pid=child.pid)
-            set_state(child_pid=child.pid, child_started_at=started_at,
-                      child_exit_code=None, restart_delay=0.0, stage=None,
-                      healthy=None, serving_since=0.0)
-            tune_restart_seen = threading.Event()
-            jit_dlls: set[Path] = set()
-            stage: dict[str, object] = {"name": None, "rank": 0, "since": time.monotonic()}
-            output = threading.Thread(
-                target=stream_child,
-                args=(child, logger, tune_restart_seen, jit_dlls, stage, args.name, args),
-                daemon=True,
-            )
-            output.start()
-            next_memory = time.monotonic()
-            next_health = time.monotonic()
-            last_health: bool | None = None
-            last_health_change = time.monotonic()
-            next_heartbeat = time.monotonic() + HEALTH_HEARTBEAT_SECONDS
-            shutdown_sent = False
-            shutdown_requested_at = 0.0
-            while child.poll() is None:
-                now = time.monotonic()
-                if stopping.is_set() and not shutdown_sent:
-                    if stop_file is not None:
-                        stop_file.parent.mkdir(parents=True, exist_ok=True)
-                        stop_file.write_text("stop\n", encoding="ascii")
-                        emit(logger, "stop_file_requested", path=str(stop_file))
-                    elif args.no_shutdown:
-                        child.terminate()
-                        emit(logger, "terminate_requested")
-                    else:
-                        request_shutdown(args.shutdown_url, logger)
-                    shutdown_sent = True
-                    shutdown_requested_at = time.monotonic()
-                if (stopping.is_set() and shutdown_sent and
-                        time.monotonic() - shutdown_requested_at > args.stop_timeout):
-                    child.terminate()
-                if now >= next_memory:
-                    metrics = windows_process_metrics(child.pid)
-                    if metrics is not None:
-                        emit(logger, "memory", pid=child.pid, **metrics)
-                    next_memory = now + max(args.memory_interval, 1.0)
-                if not args.no_health and now >= next_health:
-                    healthy = health_ok(args.health_url)
-                    # Log transitions, not every poll. A cold start is minutes of `ok:false` that
-                    # says nothing the `stage` events do not say better; a steady-state run is
-                    # hours of `ok:true`. Both drown the events that matter. The periodic
-                    # heartbeat keeps "still alive and healthy" observable at a readable rate.
-                    if healthy != last_health:
-                        fields: dict[str, object] = {"pid": child.pid, "ok": healthy}
-                        if last_health is not None:
-                            fields["was"] = last_health
-                            fields["after_s"] = round(now - last_health_change, 1)
-                        if not healthy and stage.get("name") is not None:
-                            fields["stage"] = stage["name"]
-                        emit(logger, "health", **fields)
-                        last_health = healthy
-                        last_health_change = now
-                        next_heartbeat = now + HEALTH_HEARTBEAT_SECONDS
-                        set_state(healthy=healthy)
-                        if healthy:
-                            set_state(serving_since=time.time())
-                    elif healthy and now >= next_heartbeat:
-                        emit(logger, "health_heartbeat", pid=child.pid,
-                             ok=True, healthy_for_s=round(now - last_health_change))
-                        next_heartbeat = now + HEALTH_HEARTBEAT_SECONDS
-                    if healthy and recovery_pending:
-                        notify(f"{args.name} recovered", f"Server is healthy (pid {child.pid})")
-                        emit(logger, "recovered", pid=child.pid)
-                        recovery_pending = False
-                    next_health = now + max(args.health_interval, 1.0)
-                elif (args.no_health and recovery_pending and
-                      time.time() - started_at >= min(args.stable_seconds, 10.0)):
-                    notify(f"{args.name} recovered", f"Process is running (pid {child.pid})")
-                    emit(logger, "recovered", pid=child.pid)
-                    recovery_pending = False
-                tray_tick(tray_icon, args.name)
-                time.sleep(0.25)
-
-            child_pid = child.pid
-            return_code = child.wait()
-            output.join(timeout=2.0)
-            uptime = time.time() - started_at
-            emit(logger, "child_exited", pid=child_pid, code=return_code, uptime_seconds=uptime)
-            set_state(child_pid=0, child_exit_code=return_code)
-            tray_tick(tray_icon, args.name)
-            child = None
-            if stopping.is_set():
-                return 0
-            if return_code == 0:
-                emit(logger, "intentional_shutdown")
-                return 0
-            if (args.program is None and return_code == TUNE_RESTART_EXIT and
-                    tune_restart_seen.is_set()):
-                emit(logger, "tune_bootstrap_complete")
-                if take_tune_stop() is not None:
-                    # the tune finished before the stop landed — nothing to stop, and the
-                    # armed policy must not leak into a boot that no longer needs it
-                    emit(logger, "tune_stop_obsolete")
-                failures = 0
-                continue
-            if args.program is None and return_code == TUNE_RESTART_EXIT:
-                if read_state().get("tune_stop") is not None:
-                    # the user stopped this tune from the tray; relaunch immediately — the
-                    # spawn consumes the armed policy (adopt the sidecar / serve untuned)
-                    emit(logger, "tune_stopped_by_request")
-                    failures = 0
-                    continue
-                # Exit 3 WITHOUT the restart marker: the tuner aborted before writing winners
-                # (llvm_tune's noise gate found the box too loud to trust measurements). Not a
-                # crash — no bundle, no balloon — but backoff still applies: an immediate
-                # relaunch on a still-noisy box just aborts again.
-                failures = 0 if uptime >= args.stable_seconds else failures + 1
-                delay = min(2.0 ** min(failures, 6), args.max_restart_delay)
-                emit(logger, "tune_incomplete", uptime_seconds=uptime,
-                     restart_delay_seconds=delay)
-                set_state(restart_delay=delay, healthy=None)
-                tray_tick(tray_icon, args.name)
-                stopping.wait(delay)
-                continue
-            if return_code == CONFIG_RESTART_EXIT:
-                # a config restart is the user actively reconfiguring — and a control-page
-                # re-tune rides this exit, so clear any sticky untuned hold that would otherwise
-                # inject DAS_TUNE_POLICY=fallback and silently defeat the re-tune
-                if read_state().get("sticky_env") is not None:
-                    set_state(sticky_env=None, tuning_disabled=False)
-                    emit(logger, "tuning_resumed", reason="config_restart")
-                emit(logger, "config_restart_relaunch")
-                failures = 0
-                continue
-
-            wer = latest_wer_report(started_at)
-            dump_path = (
-                wait_for_recent_dump(args.dump_dir, child_exe_name, started_at)
-                if dump_type == 1
-                else None
-            )
-            failures = 0 if uptime >= args.stable_seconds else failures + 1
-            delay = min(2.0 ** min(failures, 6), args.max_restart_delay)
-            emit(
-                logger,
-                "crash",
-                code=return_code,
-                uptime_seconds=uptime,
-                restart_delay_seconds=delay,
-                wer=wer or "",
-                dump=str(dump_path) if dump_path is not None else "",
-            )
-            set_state(restart_delay=delay, healthy=None)
-            tray_tick(tray_icon, args.name)
-            bundle_path: Path | None = None
-            if not args.no_crash_bundle:
-                try:
-                    bundle_path = collect_crash_bundle(
-                        args,
-                        command,
-                        child_pid,
-                        return_code,
-                        started_at,
-                        wer,
-                        dump_path,
-                        jit_dlls,
-                    )
-                    emit(logger, "crash_bundle", path=str(bundle_path))
-                except OSError as error:
-                    emit(logger, "crash_bundle_failed", error=str(error))
-            notify(
-                f"{args.name} crashed",
-                f"Exit {return_code}; restarting in {delay:.0f}s"
-                + (f"\nDump: {dump_path}" if dump_path is not None else "\nNo minidump produced")
-                + (f"\nBundle: {bundle_path}" if bundle_path is not None else ""),
-                True,
-            )
-            recovery_pending = True
-            stopping.wait(delay)
-    finally:
-        if child is not None and child.poll() is None:
-            child.terminate()
-            try:
-                child.wait(timeout=10.0)
-            except subprocess.TimeoutExpired:
-                child.kill()
-                child.wait(timeout=10.0)
-        try:
-            # Only clear the file if it is still ours. A second watchdog that took over the slot
-            # owns it now, and deleting its claim would let a third start alongside it.
-            if args.pid_file.read_text(encoding="ascii").strip() == str(os.getpid()):
-                args.pid_file.unlink()
-        except OSError:
-            pass
-        if stop_file is not None:
-            try:
-                stop_file.unlink()
-            except OSError:
-                pass
-        if control_file is not None:
-            try:
-                control_file.unlink()
-            except OSError:
-                pass
-        emit(logger, "watchdog_stopped")
-
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())