docs: teardown-unification design proposal

[ryanbreen]

PROPOSAL — awaiting operator ratification

This is a design-only proposal. No implementation has been performed and no runtime evidence is
claimed anywhere in the document — every build/QEMU/Parallels statement is a gate to be run, not a
result already obtained. It publishes the synthesized teardown-unification design for the operator to
ratify, adjust, or reject before any code lands.

Thesis

Senders mark; victims exit themselves; reapers own corpses; retirement is proof-gated.

No path ever tears down a process that is executing somewhere else. A killer's entire job is to record
an intent and kick a CPU. The victim performs its own teardown, on its own stack, in ordinary kernel
context, with no lock held for anything slow. Physical release happens only after a fenced two-epoch
grace and a positive proof that no CPU, no scheduler cache, and no live row still names the resource.

The design was produced by a three-way panel (design A: minimal-incremental / Opus; design B:
Linux-fidelity / Codex Sol; design C: invariant-first / Codex Sol) plus two adversarial judge passes,
archived for the record under docs/planning/teardown-unification/panel/design-{A,B,C}.md. The ruling:
B wins the architecture, A wins the phase plan, C wins the proof machinery — B's Linux-fidelity
state machine, re-sequenced under A's shippability discipline (spine first, every phase strictly
better, no dormant code), with C's proof machinery grafted wholesale and C's ExitPending state
(the mechanism that killed the earlier "grave" branch at r20) explicitly rejected.

Full design: docs/planning/teardown-unification/DESIGN.md
Phase-by-phase implementation plan: docs/planning/teardown-unification/PLAN.md

Phase list (13 phases / 13 PRs, each ≤~230 changed lines / ≤5 production files, each independently shippable)

0. Teardown observability + call-site ratchet (no behaviour change)
1. Retirement fence + RootProof blocker taxonomy (behaviour-preserving hardening)
2. SPINE-1: SIGKILL stops eager-freeing — closes SIGKILL teardown bypasses the hardened exit path #491's live UAF
3. exec detach + clone/exec admission (CLONE_VM group seal + exec-time thread_group_id/inherited_cr3 detach #471 part 1)
4. Kernel-stack ownership parity for all three creation paths
5. Runtime init designation, identity only (Designated-init runtime flag + panic-on-init-exit #464 part 1 — no fatal behaviour yet)
6. Exactly-once ledger: durable work bits + first status
7. FD closure leaves the PM lock
8. Victim-owned do_exit_current, normal exit as first consumer
9. Killable-wait contract, one family per PR (9a/9b/9c)
10. Request-only scheduler termination + group-scope cutover (SIGKILL teardown bypasses the hardened exit path #491 complete, CLONE_VM group seal + exec-time thread_group_id/inherited_cr3 detach #471 part 2)
11. Fatal-signal and fault convergence (the last direct terminate callers)
12. Init death policy (Designated-init runtime flag + panic-on-init-exit #464 part 2 — separate PR by construction)

Open questions (operator decisions only — see DESIGN.md §7 for full detail)

• OQ-1 Init death policy: protected-init (EPERM on user-originated signals to init) vs. treat
  authorized SIGKILL(1) as deliberate shutdown; OQ-1b stop-the-world SMP broadcast, in this round or not.
• OQ-2 Reserve PID 1 for the explicit init constructor, start ordinary allocation at 2? (recommended yes)
• OQ-3 Confirm exit(2) = member scope, exit_group/SIGKILL/fatal signal/fatal fault = thread-group scope.
• OQ-4 Tier-1 approval to route kernel/src/syscall/time.rs's raw TTBR0 writer through the constrained helper.
• OQ-5 Tier-2 approval for an exception-return boundary hook (aarch64) — without this the design stops at Phase 7.
• OQ-6 Bounded reclaim worker: this round or deferred with Idle-path CoW-walk latency under IRQ mask in schedule_from_kernel drain #448/Fault-exit deferred drain is unbounded under IRQ mask #492? (recommended deferred)
• OQ-7 Scope cuts: confirm group-wide exec cull, children-mirror removal/subreaper selection, nonleader PID transplant are all out of this round.
• OQ-8 Accept 13 phases/13 PRs, or batch adjacent phases for larger review surface per PR?
• OQ-9 x86_64 rollout: land shared semantics now with no SMP proof, or gate victim-owned path to aarch64 only?

Scope

Spine: #491. Also addresses #464, #471. Acknowledges and does not foreclose #448, #492, #493.

Next step

Operator reviews DESIGN.md/PLAN.md, answers OQ-1 through OQ-9, and the phase-0 PR is opened against
this ratified plan.