RUN-009 starts two independent tools-dev hosts, SIGKILLs only the first canonical receipt PIDs, observes the real 90-second lease while the survivor heartbeats, and checks no automatic retry, stale-token rejection, and one manual replacement. Guard and root/e2e typechecks pass; live acceptance pending.