Closes the cleanup gaps found in review (latent today; bites under load/crashes). Sandbox containers (cm-sandbox / cm-runtime): - label every sandbox `clawmates.sandbox={agent|browser}` at create - SandboxDriver::list_managed(kind) (Docker label filter + K8s label selector) - SandboxManager::reconcile_orphans(ttl) + spawn_reaper: removes engine containers no live handle owns (ZERO = all) - boot reconciliation (every pre-existing sandbox is an orphan from a dead process) + periodic reaper (5m interval / 10m TTL) - SIGTERM graceful drain: serve().with_graceful_shutdown → shutdown() both managers so a redeploy can't leak; destroy errors now logged not swallowed DB expiry/retention (cm-db cleanup.rs + cm-api cleanup_sweeper, hourly): - expire auth_sessions + oauth_states past expires_at (security) - prune sent outbox(7d), run_events(14d), routine_runs(30d), terminal topology_runs(90d), consumed execution_grants(7d) Compose: volume-init restart "no" → on-failure:5 (retry instead of wedging boot). Co-Authored-By: Claude Opus 4.8 <[email protected]>
