inbox-wake: silent Monitor death documented but unmonitored

[michael-wojcik]

Background

The inbox-wake mechanism (shipped in #603) deliberately rejects an in-session watchdog because cron-fire-kills-Monitor (PREPARE-phase H1 finding for #591). The current design accepts that a silently-dead Monitor degrades the wake mechanism to "no wake" until the next SessionStart re-arms.

Documented in skill body `commands/watch-inbox.md` §Failure Modes ("Silent Monitor death").

Issue

The degradation is graceful (falls back to baseline InboxPoller — pre-#591 status quo) but invisible. The lead has no in-session signal that the Monitor died.

Why we deferred

• Same-co-killing-Monitor issue (any in-session watchdog kills the Monitor it watches per H1)
• Periodic liveness probe is a watchdog by another name
• SessionStart re-arms cleanly on next session

Possible future paths

1. Wait for platform to offer a non-co-killing watchdog primitive (out-of-process check that doesn't fire turns in the lead's session)
2. Implement a lightweight liveness probe that doesn't fork the Monitor's session — e.g., a separate Bash background task that pings STATE_FILE atime/mtime on a slow cadence, but that itself becomes a watchdog
3. Accept as documented limitation indefinitely

Source

Blind-round architectural review of PR #603 (Apr 2026). Architect flagged as FUTURE; user directed to file as tracking issue rather than address in #603.