Record and expose how every process ends (M17.2)

The kernel records an ExitReason at all three death sites — clean exit,
fault (classified by vector), and process_kill — into a bounded ring
before the exit notification posts, so a supervisor's query never races
the notice. process_exit_reason is gated by the same supervisor check as
kill; runtime.process.exitReason is the stable interface. This is the
input restart policy reads (docs/process-lifecycle.md iron rule 2).

docs/m17-m18-plan.md

@@ -32,7 +32,9 @@ only when its definition of green holds.
 - [x] **M17.1** — kernel releases claims/MSI on death (claims: `releaseAllOwnedBy`
       in the reap; MSI was already swept by `irq.releaseOwner`; `claim-release`
       test; suite 49/49)
-- [ ] **M17.2** — exit reasons
+- [x] **M17.2** — exit reasons (`ExitReason` recorded at exit/fault/kill before
+      the notification; `process_exit_reason` supervisor-gated;
+      `runtime.process.exitReason`; kernel + ring-3 assertions; suite 49/49)
 - [ ] **M17.3** — published exit events + VFS subscriber
 - [ ] **M17.4** — signals, timer notifications, `runtime.process`, the service harness
 - [ ] **merge** `feat/process-lifecycle` → main, push

docs/process-lifecycle.md

@@ -245,13 +245,16 @@ pub fn stop(id: u32, deadline_ms: u64) void { ... }
 /// process_enumerate.
 pub fn subscribeExits(endpoint: usize) bool { ... }
 
-/// How a process ended — from the exit notification. What restart policy reads.
-pub const ExitReason = enum {
+/// How a process ended — queried after the exit notification (the kernel records
+/// it first, so the two never race). What restart policy reads. (Built in M17.2.)
+pub const ExitReason = enum(u8) {
     exited, // returned from main / clean exit
-    aborted, // abort() — deliberate self-termination (SIGABRT's ghost)
+    aborted, // abort() — deliberate self-termination (SIGABRT's ghost; reserved)
     segmentation_fault, // SIGSEGV's ghost
     illegal_instruction, // SIGILL's ghost
     arithmetic_fault, // SIGFPE's ghost
+    protection_fault, // general protection fault
+    fault, // any other CPU exception
     killed, // process_kill
 };
 ```

docs/process-management.md

@@ -101,8 +101,12 @@ the architecture layer calls up into `tick`.
   again — the cleanup half of [process-lifecycle.md](process-lifecycle.md)'s iron
   rule 1. The `claim-release` test proves the kill → release → re-claim cycle.
 - Kernel stacks of dead tasks are leaked, as on every exit path (no reaper yet).
-- There is no exit *status* in the notification, only the id; a supervisor that
-  needs the code can grow a wait-style call later.
+- ~~There is no exit status in the notification~~ Closed (M17.2): the kernel
+  records how every process ends — exited, a fault class, or killed — before it
+  posts the exit notification, and the supervisor reads it with
+  `process_exit_reason` (`runtime.process.exitReason`). This is the input to
+  restart policy ([process-lifecycle.md](process-lifecycle.md)); an exit *code*
+  for the clean case can still ride alongside later.
 - Enumerate writes through the caller's raw pointer under the bring-up trust
   model, like `device_enumerate` (an unmapped page is a self-DoS, not an
   isolation break).