Thank you, that answers the core question. We will design around simultaneous custodian loss as an external-only residual, with custodians the workload cannot signal or control. One follow-up: our custody clients subscribe only to NOTIFY_FORK, NOTIFY_EXEC and NOTIFY_EXIT on an es_new_descendants_client. If descendants generate events faster than the client drains them, can the system terminate a notification-only client? Or does it only drop messages, observable as gaps in seq_num / global_seq_num? We treat any gap as a failed verification, so drops are acceptable to us, but termination for load would let the monitored workload remove a custodian.