probe_worktree and record_retention will be reused by the natural-exit path (#82); kill's behavior is unchanged.