[mtwilliams]

Ortex.run/3 adds finite :timeout deadlines and monitored ownership for bounded or explicitly controlled calls. Timeout raises Ortex.TimeoutError, requests native termination, and bounds caller wait. Caller death cancels the worker. An executing NIF retains resources until cooperative native termination completes; a kernel may hold the session longer than the caller deadline. Unbounded calls without a control keep the synchronous path.

A watcher owns the worker and monitors its caller. Reply aliases suppress late results, monitor/reply messages are cleaned up, and worker errors retain their original stack. Completed/validation-failed workers do not cancel unrelated legitimate attempts using a reused or mismatched control. Control preparation uses dirty CPU independently of inference's dirty I/O mutex waits. Telemetry records deadline/mode and timeout exceptions in the caller span.

Validation: 216 checks passed on runtimes 1.17.3 and 1.24.4, including actual loop deadlines, caller death, queued deadlines, post-cancel inference, worker resource/exception ownership, reuse during an active attempt, and late-result/monitor races. Two optional ResNet checks excluded. Pool/environment regressions, formatting, and warnings-as-errors compile passed. Stacked on #27; fork only. Task commit unsigned because the signing agent cancels requests.

Required follow-up in the stack: #31 reserves ownership before worker/deadline creation, preventing a duplicate call from cancelling the legitimate original attempt before native entry. Review/merge the complete stack together.