A dead-man's switch that watches itself. An agent runs; a watchdog holds bounds and a heartbeat timeout. Let the metric drift past the band, or stall the heartbeat, and the watchdog trips — freezing the system to a safe state rather than letting it run wrong.
The trip condition is a checkable predicate, evaluated every frame: |metric| > bound OR (t − last_heartbeat) > timeout ⇒ FREEZE. This is real, boring, load-bearing engineering — hardware watchdog timers, runtime invariant monitors, liveness dead-man switches. When it trips it reports which clause fired. Nothing subtle: a bound and a clock.
The drifting metric is a synthetic random walk, and 'inject fault' scripts the breach — a stand-in for whatever real signal (loss spike, invariant violation, silence) you'd wire in. The 'safe state' here is just a freeze; a real one is domain-specific.
A watchdog freeze is the honest end SKYNET keeps insisting on: it does not fix anything, it stops — trading a wrong-but-running system for a frozen one with the fault named. Freeze ≠ finish: re-arming is a new decision, not a repair.