runtime(coro): add handle-free terminal executor close

[cpunion]

Summary

• add a handle-free ActionTerminalExecutorClose after the last physical coroutine frame has already been destroyed
• settle durable sources, acknowledge requests, and seal the executor before handing target shutdown to the adapter
• retain only the logical terminal commit kind, clear the freed root pointer, and hide stale destroy actions behind a scheduler-owned close marker
• confirm strong target join entirely from stable driver/P state, then final-scan, retire, unbind, and commit normal or panic terminal state inside the core
• make executorMode publication last and never return a physical or synthetic destroy handle to the adapter
• document the implemented last-G boundary and the remaining production target work

Exactly-once protocol

The first llvm.coro.destroy remains the only physical destroy. Once the core seals the executor it replaces P.action with ActionTerminalExecutorClose, whose Handle is nil. The driver stores only ActionDestroy or ActionPanicDestroy as a logical kind; it does not retain the freed LLVM handle, and g.root is cleared before the close marker is published.

After the target strongly unregisters and joins the complete ingress shim, ConfirmTerminalExecutorClose(driver) reconstructs P and G from stable scheduler state. It performs the post-join source scan, confirms and retires the executor generation, unbinds with executorMode last, and uses a core-private stable sentinel only for the synchronous terminal state commit. The only returned actions are ActionComplete or ActionPanicComplete.

Validation

• go test ./runtime/internal/coro
• go test -race -shuffle=on -count=30 ./runtime/internal/coro
• go test -race -run 'TerminalClose|ExecutorDriver' -count=100 ./runtime/internal/coro
• go vet ./runtime/internal/coro and runtime adapter vet
• host and js/wasm production-adapter named-source tests
• Go cross-compilation for js/wasm, wasip1/wasm, linux/arm, and linux/riscv64
• LLGo current-source package build of runtime/internal/coro
• deterministic coverage for normal terminal, initial panic, ancestor panic, stale destroy rejection, producer join pinning, duplicate confirm, and 300 Request-versus-terminal-close races

Scope

This closes the empty-ready/wait last-G core transition. The production target join dispatcher and retained-doorbell backends are not wired yet; runtime/internal/runtime/coroRunActions recognizes the action and intentionally fails closed. Command-main return with ready children and fatal panic with peers still require the separate idle/generic executor-close teardown.

Stacked on #26.

[gemini-code-assist]

Code Review

This pull request implements the ExecutorDriver (Phase 17/18) to manage executor and wait registries, enabling handle-free terminal close handoffs for the scheduler. Key changes include updating the P structure to support executor binding, modifying RequestSchedule and PollReady to integrate with the new driver, and adding robust lifecycle tests. Additionally, a CheckIndexRange function is implemented in the native e2e test drivers. I have one suggestion to improve test consistency by explicitly checking terminal.Handle in TestExecutorDriverTerminalCloseRequestRace.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.