P0-#5: EAGLE watchdog — degrade to plain decode, never a silent hang

[leyten]

Mitigation-first fix for the 2026-07-14 residential-tail EAGLE hang (launch blocker P0-#5). Root cause is still unknown — this ladder makes every EAGLE-implicated stall class end in worst case slower, or a clean fast fail — never a silent hang, on the deployment path (python -m shard.coordinate → coordinate_pipe → libp2p transport).

The ladder (each layer covers a class the others cannot):

• L1 — draft-budget watchdog (coordinator): the serial EAGLE draft chain is coordinator-local compute no socket timeout sees — a slow/wedged drafter crawled forever while still streaming. An eagle-routed draft step over M25_DRAFT_BUDGET_S (default 1.0s ≈ 80× healthy; first step exempt; 2 consecutive breaches; cumulative guard) flips the job to n-gram-only in place: flag-latch on HybridDrafter (no object swap — the pending request/fetch pairing survives), pipelining restored, zero wire changes.
• M1 — tail ret stall bound: the return socket was untimed; one send wedged against a dead/blocked return path parked the tail inside sendall — unable to select, re-accept, or see a reset. The whole warm ring hung behind it (strongest root-cause candidate; the CPU fake ring never reproduced it because loopback has infinite bandwidth). M25_RET_STALL_S (default 180s) is a per-progress bound — the libp2p transport sends per-sendmsg call, so it means zero bytes accepted for 180s; a slow-but-draining residential uplink never trips it (sendall total-deadline semantics were verified empirically and rejected). Trip → the existing _ret_send EDGE absorb: drop ret, keep predecessor+KV, stale until the next coordinator.
• eagle:0 on the reset wire: a degraded coordinator now silences aux ring-wide (every stage attach site honors the session flag) — the degraded arm equals the proven-good plain ring on the wire, not just coordinator-side. Old builds interop unchanged (absent field = launch env).
• L2 — one degraded retry (shard.coordinate): an EDGE fault while EAGLE was armed → close + re-dial (mandatory: the tail only goes stale on a fresh hello_return; a plain reset on old sockets eats a late in-flight reply as its ack), resume committed tokens under the same settlement nonce, same delta state (no dup/gap; receipts sweep exactly once). EAGLE/TREE stay off for the process (sticky; a daemon restart re-arms from env); SHARD_JOB_DONE carries degraded. JobRejected never retries; a failed retry bails rc=1 for a clean daemon restart.
• L3 — job stall backstop: no progress (reply/commit/redial; prefill replies count — a 75MB aux chunk on a thin uplink is legitimately slow) for M25_JOB_STALL_S (auto = job timeout + 60s) → best-effort FATAL + unconditional os._exit(1) → daemon restart + fail-closed complete. Covers what nothing socket-level can: a drafter wedged inside torch/CUDA, a stuck send. The kill is exception-proof and lock-bypass-proof (adversarial-verify D1).

Verification: design panel (adversarial correctness + test design) before build; independent adversarial verify pass after (1 confirmed defect, fixed in the last commit; all other attack lines held). 22 new tests across 4 files, incl. a real-os._exit subprocess proof, losslessness/nonce/receipt continuity across the retry, and the real serve() tail surviving a wedged return channel. Full suite 584 passed, 1 skipped.

Known-accepted (documented, not built): attempt-1 EAGLE prefill on a thin-uplink tail stays legally slow until the first fault (fp8 prefill aux / admission-gating EAGLE by tail uplink = post-mitigation levers). Daemon-side escalation (restart coordinator with M25_EAGLE=0 after a stall-kill) = small c0mpute follow-up. Note: S.M25_EAGLE armed with a non-extend drafter now pipelines at full depth (was pinned to 1); no test pinned the old behavior and the new semantics are the intended ones.

Next: controlled-ring validation — tc-throttled tail uplink, master arm (expect the wedge) vs this branch (expect degrade + survive).