feat(lib): lib/supervise — observer-native supervision (#409)

[InauguralPhysicist]

What

A supervisor over the #408 cooperative task layer that, beyond BEAM-style crash-restart, also catches the silently wedged worker — alive, not crashed, never timing out, but no longer making progress — a signal BEAM structurally cannot see (its processes carry no free per-value trajectory measurement). This generalizes the EigenOS window-manager red-title pattern.

Model

Share-nothing messages are unnecessary here — cooperative tasks share the module-global heap on one thread:

• workers publish raw progress with heartbeat of [slot, value];
• the supervisor samples each alive worker every tick and feeds a bounded signature (1.5 + v % 8 — never a raw counter, which hits the Observer predicates classify entropy(value), not value — blind to value-oscillation in flat-entropy regions #294 flat-entropy blind spot) into that slot's observer trajectory. Sampling on the supervisor side is the crux: a frozen worker stops heart-beating, so only the poller keeps adding the now-constant samples that read stable;
• a normal return is done; a raise is caught by the wrapper as crashed, so a supervised crash never fails the process (task: unjoined task death prints error but process exits 0 #493);
• wedged (alive + stable after a warm-up window) and crashed workers restart from their spec, each up to a per-worker restart-intensity cap.

API: supervisor_new / supervise of [sup, fn, slot] / supervise_step / supervise_run of [sup, max_ticks]. Deterministic by construction. Eight slots (a list element has no observer trajectory, #262, so the signals need named scalars).

Verification

• examples/supervisor_tree.eigs — a 3-worker pool where one wedges mid-run and is detected + restarted; byte-identical across runs.
• tests/test_supervise.eigs (6 asserts): wedged-detected-and-restarted-exactly-once, healthy-never-restarted, wedged-recovers; crash-restart (exit 0, not fatal); restart-intensity cap honored.
• Full suite green release AND ASan (detect_leaks=1): 2703/2703, 0 failed, no leak-tally increase (task kill/respawn is leak-clean).

Forcing-function gap surfaced (not worked around)

A task cannot learn its own id (no task_self), so the BEAM-style message-link supervision variant the issue sketches isn't expressible — the shared-heap model is used instead (idiomatic for this runtime). Filed as #526.

Docs

• docs/STDLIB.md: lib/supervise.eigs section (satisfies the discoverability gate).
• CHANGELOG.md: entry under [Unreleased] → Added.

Closes #409

🤖 Generated with Claude Code