Wedged heavy-maintenance child holds the lease indefinitely — no stall timeout or release

Context

Ada's REM consolidation-liveness watchdog fired 2026-07-22T08:09Z: last successful REM cycle 01:41:07Z, ~6.5h stale, undigested sessions 10 → 22 and growing. Live log forensics (this session) isolated the mechanism: the pre-restart orchestrator (PID 2298) started a session-summarization child at 02:34:04Z that never logged completion; the orchestrator then went silent for 5.5h until its 08:08Z restart. While wedged, the child held the heavy-maintenance lease, and every deferrable lane starved behind it: Deferring REM sleep graph extraction, Deferring knowledge base sync, Deferring github workflow sync, Deferring message concept harvest (orchestrator.log).

The Problem

A wedged heavy-maintenance child holds the lease indefinitely. There is no stall detection, no timeout, and no lease release on the child level: the scheduler cannot distinguish "legitimately long run" from "wedged at 99% CPU / dead", so one stuck child converts into a full maintenance-plane outage that only a watchdog threshold (6h, REM) or a human restart notices. The summarization child itself is fine when it runs (the restarted instance's child is actively progressing at 99% CPU) — the defect is the missing containment around it.

The Architectural Reality

• The orchestrator's heavy-maintenance lease serializes maintenance lanes; deferral is by design (bootFreshness=designed-deferral in the watchdog's own verdict).
• The REM watchdog (rem-consolidation-liveness-watchdog) proves lane-level liveness monitoring exists — but it observes the DEFERRED lane, not the lease HOLDER. Nothing watches the holder.
• #15681 (Iris's WriteGuard TTL) is the analogous hardening in the NL write-lock domain: same "held-until-release needs a TTL" shape, different lock.

The Fix

1. A lease-holder liveness contract for heavy-maintenance children: heartbeat or bounded runtime per child; on stall, terminate the child, release the lease, and surface the event (log + health surface) instead of silently holding.
2. On termination, preserve resume semantics: the next scheduled run continues the backlog rather than restarting from a corrupted marker (the pending-summary count must not be left half-updated).
3. Emit a stall receipt naming the wedged child, lease age, and the lanes that were deferred — so the next 6.5h stall is a 30-minute detection.

Acceptance Criteria

• A heavy-maintenance child exceeding its liveness bound is terminated with lease release and a surfaced event (witness: simulated wedge → recovery without orchestrator restart)
• Resume semantics: the follow-up run drains the remaining backlog (no lost or double-processed markers)
• The stall receipt names holder, lease age, and deferred lanes
• REM and the other deferrable lanes resume without manual intervention after a contained wedge

Out of Scope

• The deferral-fairness/pending-drain question (companion ticket, linked below)
• LM Studio / summarization quality itself
• WriteGuard NL locks (#15681)

Related

• #15681 (analogous TTL hardening, NL domain)
• Companion: pending-summary drain + deferral fairness (to be linked on creation)
• Watchdog evidence: orchestrator.log 2026-07-22T08:09:15Z; Ada's A2A 08:09Z

Live latest-open sweep: checked latest 25 open issues at 2026-07-22T08:25Z; #15681 is adjacent-domain, not a duplicate. A2A in-flight sweep: lane-intent broadcast this session; no competing claim.

Origin Session ID: 72c8c42d-f18a-408c-97c8-aeb1f82dd276

Retrieval Hint: "heavy maintenance lease wedged child stall timeout session summarization REM deferral containment"