feat(dispatcher): enforce identity-safe lane GC

[zxkane]

Status

• Implementation prepared only.
• Production merge and rollout are blocked on at least 14 days of uncontaminated soak evidence accepted by the operator.
• Related to Lane-GC P8: GC enforcement flip — dry-run → kill after ≥2-week zero-false-positive soak (operator-gated) #384. This PR does not close Lane-GC P8: GC enforcement flip — dry-run → kill after ≥2-week zero-false-positive soak (operator-gated) #384 and does not claim production authorization.

Summary

• Make Linux lane GC default to kill while preserving explicit, box-wide, and platform fail-closed rollback paths.
• Bind delayed signaling to durable process identities, serialize PGID registration/reaping, and refuse unverifiable or not-yet-enrolled scope lanes.
• Bound lane-scoped Pass 3 process reads: collect eligible lane metadata first, enumerate each PID once, and keep the rule 3.2 live-sharer veto on a fresh protective snapshot.
• Fix elapsed_ms on date implementations that ignore %3N, and allow the shared/user-scope installer to onboard and heal existing projects without project-local skills.
• Persist one canonical state root across wrappers, schedulers, and liveness readers; document the audited rollout boundary and follow-up Lane-GC follow-up: enroll agent timeout path in systemd scope and prove full-wrapper reap #522.

Test Plan

• Design documented (docs/designs/lane-gc-p8-enforcement.md)
• Test cases documented (docs/test-cases/lane-gc-p8-enforcement.md)
• All 247 unit test scripts covered locally; the timeout-truncated tail completed in split runs
• P8 focused suite: 120 passed, 0 failed
• P4 GC regression suite: 131 passed, 0 failed
• Shared installer / execute-bit regressions: 31/21 passed, 0 failed
• Large-registry regression: 200 lanes x 40 PIDs reads argv/cwd 40 times, not 8,000
• Hermetic E2E and adapter conformance command group passed
• Spec Drift and provider-cutover guards passed
• Strict shell-idiom ratchet passed against origin/main
• ShellCheck and git diff --check passed
• Code simplification review passed
• Independent PR review findings addressed; second review found no remaining blockers
• CI checks pass for the current push
• Required soak evidence accepted
• Production rollout authorized

Operator checkpoint (2026-08-27)

• The prior main dry-run was stopped after exceeding 48 hours without completing; its last complete summary was 2026-08-25.
• The box-wide rollback remains active as ADT_GC_ENFORCE=0 (mode 0600). The timer now runs this PR candidate in dry-run mode.
• adt-gc.sh --doctor passes; the active backend is the sufficient PGID fallback.
• All five cron-managed projects pass the entry-point doctor and expose the post-P2 lane_mint/lane_install wiring.
• The first complete candidate run finished in 548 wall-clock seconds: would_kill_legacy_signature=0, unknown_class=0, killed=0; focused P8 tests remain 120/120 green.
• This starts a new uncontaminated candidate soak at 2026-08-27T09:30:44Z. The earliest 14-day eligibility point is 2026-09-10T09:30:44Z, contingent on continued zero legacy false positives, stable unknowns, and completed runs.

The PR remains draft and production rollout is not authorized.

[amazon-q-developer]

This PR adds critical safety improvements to the garbage collector, implementing durable process identity verification and comprehensive backend checks across all kill authorization sites. The changes follow proper fail-safe patterns (fail toward preserving processes rather than incorrectly killing them).

Key improvements verified:

• Guardian identity verification in rule 1.4 (prevents signaling recycled PIDs)
• Durable process identity checks added throughout Pass 2/3
• Backend verification guards (ensures only pgid-backend lanes are subject to delayed signals)
• Platform-aware mode selection with config file rollback mechanism
• Comprehensive identity verification before all kill operations

The implementation is defensive and thorough, with no blocking defects identified. All safety guards properly handle edge cases and TOCTOU race conditions.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.