Separate durable runner preservation from final process retirement. Bind
restart preservation to the public run identity and observed ancestry, and
drain every retained owner after the replacement controller shuts down.
Co-authored-by: Paperclip <noreply@paperclip.ing>
Keep direct-child fallback bounded when process inspection fails, preserve incomplete cleanup evidence, and select graceful owners from the delivery snapshot without signaling already-covered descendants again.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Dotta