Record exception-safe GPU daemon ownership

Advance the active and durable checkpoints to 69825d0 and clarify that every
spawned managed daemon enters the named reaper before connection or handshake
work can fail.

docs/active-work.md

@@ -57,8 +57,9 @@ If it does not, stop and repair the remote/fetch configuration.
 - Portable branch: `githubsucks/gpu-invocation`
 - Pull request: **#141 OPEN — do not merge without explicit user approval.**
 - Base: `githubsucks/main` @ `96d0bae`; protocol remains v19.
-- Implementation checkpoints: `82355ca` (first implementation-review fixes)
+- Implementation checkpoints: `69825d0` (exception-safe immediate reaper
-  atop `6fd5834`; approved framing began at `821835b` and is now Revision 5.
+  ownership) atop `82355ca` (first implementation-review fixes) and
+  `6fd5834`; approved framing began at `821835b` and is now Revision 5.
 - State: all six implementation-review findings are resolved, all 18
   acceptance criteria complete, and the PR awaits another user review. Public
   path is additive `pmacs --gpu [--socket NAME|PATH]`; bare `pmacs [FILE]`

docs/agent-handoff.md

@@ -24,8 +24,8 @@ commands, read `docs/active-work.md` immediately after this file.
   `ThemeFacts`, v17 = `FontFacts`, v18 = `StatuslineSegments`, v19 = terminal
   frames/events).
 - **One-command GPU invocation is implemented on OPEN PR #141, not yet on
-  `main`** (`gpu-invocation`, implementation-review checkpoint `82355ca`,
+  `main`** (`gpu-invocation`, final implementation-review checkpoint
-  framing Revision 5). The additive public path is
+  `69825d0`, framing Revision 5). The additive public path is
   `pmacs --gpu [--socket NAME|PATH]`; bare `pmacs [FILE]` remains the TUI.
   Root owns the CRDT gate, socket resolution, sibling-regular-file GPU
   discovery/PATH fallback, and GPU outcome. The separate `pmacs-gpu` binary

docs/gpu-invocation-framing.md

@@ -646,10 +646,10 @@ Vterm probe continues to cover offscreen wgpu.
   users to `pmacs --gpu`; help labels raw-socket attach as advanced.
 - `pmacs-gpu/src/attach.rs` owns connect-or-start policy, the five-second /
   50-ms retry window, socket-type protection, daemon process-group isolation,
-  and the named child-reaper thread. A spawned child stays owned by the
+  and the named child-reaper thread. Every successful spawn is handed to the
-  connector until it is handed to that reaper, and daemon stdio is null. The
+  reaper before any later connection or handshake operation can fail, and
-  first successful protocol connection wins; protocol/capability failures
+  daemon stdio is null. The first successful protocol connection wins;
-  never authorize replacement.
+  protocol/capability failures never authorize replacement.
 - `--headless-managed-probe SOCKET REPORT DAEMON_EXE` drives the production
   managed connector, writes atomic `phase=ready` / `phase=complete` reports,
   holds on stdin, and exposes disconnect plus daemon-reaper observations.