Module reaper 

The lease reaper (ARCHITECTURE.md §6). Ticks every minute inside the daemon (so lease expiry is a system guarantee across reboots via launchd keep-alive). Each tick:

1. reaps every overdue instance — unless an operation holds its lock (§2: an operation that outlives its whole lease finishes first) or a prior failure’s backoff has not elapsed;
2. records each failed reap with backoff and surfaces it (the reap_attempts row status/list read — silence is not success, invariant 4);
3. garbage-collects tombstones past the 7-day window (D14): the instance row (FK cascade cleans leases/locks/checkpoints) and the instance’s logs dir.

Teardown is the same verified path down uses. The daemon must not depend on stackless-local (a cycle — local depends on the daemon), so the reaper does not call the engine in-process; it spawns the CLI (current_exe down <name> --json), which holds the op lock correctly and is literally the down verb. Exit code zero is a successful reap.

Functions

run

Run the reaper until the process exits. Opens the store fresh each tick (short-lived; the store is multi-process-safe rusqlite).

tick_once

Re-exported so the daemon’s startup pass can run one immediate reap on boot/wake (the §6 “reaps overdue leases immediately on start”).