Ghost Reaping

This sprint had one narrow job: make the lock path and the actual exclusive owner stop diverging during release and acquire races. That was an appropriate first slice because no later owner record can be trusted if two contenders can look at different lock targets. Its gate and review stayed green, so the boundary held without forcing a redesign.

After exclusivity existed, this sprint could focus only on what the owner record means. The brief made a clean contract for callers: ask the ownership query and do not perform bare pid checks elsewhere. The sprint passed through the gate and review cleanly, which let later registry and remove code rely on the query rather than repeat liveness logic.

This sprint put the verified-owner query at the first destructive boundary. It was scoped to refusal and override semantics, leaving roster cleanup and stop-before-remove behavior for later work. The sprint itself stayed green, but the milestone review found the remaining remove entry point that still bypassed the check, so the run carried that gap forward explicitly.

This sprint was the storage contract for process cleanup. It did not try to kill anything; it only required every Gantry-owned subprocess group to be recorded before the caller moved past spawn. That made the work self-contained for a fresh agent and gave later sprints a replayable source of truth.

With launch records in place, this sprint could define what it means to act on them safely. The brief centered on identity and run-association checks, bounded graceful termination, forced cleanup, and appended reap records. It passed cleanly, so later exit and stop paths could call one verified reaper rather than maintain per-spawn cleanup code.

This sprint moved the reaper onto engine shutdown paths and the aborted-run hang class. The work was larger because it had to cover success, abort, signal shutdown, timeouts, and error returns without letting an ignored graceful signal block forever. Its boundary held through review and gate, making clean engine exit a caller-visible contract for later commands.

This sprint carried the investigation that could not be reduced to code plumbing alone. Its brief required executable or written evidence about sandboxed and unsandboxed parent-death behavior, while preserving the roster as the authoritative safety mechanism. The gate went red after review and needed a fix, which fits the task: the brittle part was proving the backstop without overstating what it guarantees.

This sprint had the riskiest interface boundary in the final milestone: a new operator command had to reach the live owner through the attach-control channel and stop resumably. The run facts show repeated attempts around this unit, including review errors and a replan error before it settled. That stress belongs here because the sprint was defining transport, correlation, and engine wind-down semantics that every later stop case would inherit.

Once the live transport existed, this sprint completed the result vocabulary rather than reopening the transport. Its brief made cleanup truth the contract: a stop outcome could not say success while child process cleanup was partial or failed. The clean boundary was that later dead-owner and remove work would consume the same shape, so this agent only had to finish the live-owner truth model.

This sprint extended stop from live-owner communication to offline cleanup when the owner was gone. The brief was sharply scoped around the roster: verify each surviving group, reap what still belongs to the run, and report the same outcome vocabulary as the live path. It stayed green because the previous sprints had already provided both the reaper and the result shape.

This sprint returned to the deletion gap noted after the first milestone and made remove consume the shared stop operation. Its slice was destructive-command policy: refuse live-owned runs by default, run cleanup before deletion, and require explicit process-safety override when survivors remain. The run stayed green because stop semantics were already defined and could be reused instead of restated.

This sprint made the safety model observable while keeping discovery read-only. Its brief required human and machine-readable status to show owner identity, surviving tracked processes, cleanup status, and stop guidance without signalling anything. The gate went red and then fixed, locating the difficulty in renderer parity and non-destructive reporting rather than in the underlying reaper.

The final sprint prevented the incident class from recurring after operators had a cleanup path. Its brief was intentionally narrow: detect starts under managed worktree ancestry or from a Gantry-launched agent environment, fail before the engine starts, and document a scoped override. That made it independent of stop internals, and it finished without further stress.