Publish exit events to subscribers; the VFS releases dead clients' handles (M17.3)

process_subscribe adds an endpoint to a bounded, ref-counted subscriber
table; every death posts the same badge encoding a supervisor's exit
notification uses, equally late, so subscribers observe a fully-released
child. A dying subscriber's own subscriptions are removed first — it never
hears about itself. The VFS is the first subscriber: open handles now
record their owner and are swept when the owner dies, because a service
must never depend on clients cleaning up after themselves
(docs/process-lifecycle.md). Proven by the vfs-client-death scenario.

system/kernel/process.zig

@@ -201,6 +201,7 @@ fn system_call(state: *architecture.CpuState) void {
         .process_enumerate => systemProcessEnumerate(state),
         .process_kill => systemProcessKill(state),
         .process_exit_reason => systemProcessExitReason(state),
+        .process_subscribe => systemProcessSubscribe(state),
         _ => fail(state),
     }
 }
@@ -574,6 +575,16 @@ fn releaseTaskResourcesLocked(t: *scheduler.Task) void {
     recordExitLocked(t);
     irq.releaseOwner(t.id);
     devices_broker.releaseAllOwnedBy(t.id);
+    // A dead subscriber's own subscriptions go first: it must not hear about
+    // itself, and the slots' endpoint references drop with it.
+    for (&exit_subscribers) |*slot| {
+        if (slot.*) |subscriber| {
+            if (subscriber.owner == t.id) {
+                ipc.dropRef(subscriber.endpoint);
+                slot.* = null;
+            }
+        }
+    }
     if (t.ipc_client) |client| {
         t.ipc_client = null;
         client.ipc_status = -ipc.EPEER;
@@ -583,6 +594,12 @@ fn releaseTaskResourcesLocked(t: *scheduler.Task) void {
     scheduler.removeFromWaitQueueLocked(t);
     scheduler.forgetIpcClientLocked(t);
     ipc.closeHandles(t);
+    // Publish the exit to every subscriber (docs/process-lifecycle.md): the same
+    // badge encoding as the supervisor's notification, and equally late, so a
+    // subscriber also observes a fully-released child.
+    for (&exit_subscribers) |*slot| {
+        if (slot.*) |subscriber| ipc.notifyLocked(subscriber.endpoint, abi.notify_exit_bit | t.id);
+    }
     if (t.exit_endpoint) |raw| {
         const endpoint: *ipc.Endpoint = @ptrCast(@alignCast(raw));
         t.exit_endpoint = null;
@@ -690,6 +707,34 @@ pub fn exitReasonOf(caller_id: u32, target_id: u32) i64 {
     return -ipc.ESRCH;
 }
 
+/// The published exit events' subscribers (docs/process-lifecycle.md "Who learns
+/// of a death"): stateful services — the VFS's file handles, input's
+/// subscriptions — that must release what a dead client held and cannot learn it
+/// any other way (a client that simply never calls again looks like silence).
+/// Bounded like every kernel table; each entry holds its own endpoint reference.
+const exit_subscriber_capacity = 8;
+const ExitSubscriber = struct { endpoint: *ipc.Endpoint, owner: u32 };
+var exit_subscribers: [exit_subscriber_capacity]?ExitSubscriber = .{null} ** exit_subscriber_capacity;
+
+/// process_subscribe(endpoint): subscribe the caller's endpoint to published exit
+/// events. Ungated, like process_enumerate — what is running (and dying) is not a
+/// secret between cooperating processes. -ENOSPC when the table is full.
+fn systemProcessSubscribe(state: *architecture.CpuState) void {
+    const t = scheduler.current();
+    if (t.aspace == 0) return fail(state);
+    const endpoint = ipc.resolveHandle(t, architecture.systemCallArg(state, 0)) orelse return failErr(state, ipc.EBADF);
+    const flags = sync.enter();
+    defer sync.leave(flags);
+    for (&exit_subscribers) |*slot| {
+        if (slot.* == null) {
+            endpoint.refcount += 1; // the slot's own reference, dropped on unsubscribe-by-death
+            slot.* = .{ .endpoint = endpoint, .owner = t.id };
+            return architecture.setSystemCallResult(state, 0);
+        }
+    }
+    failErr(state, ipc.ENOSPC);
+}
+
 fn systemProcessExitReason(state: *architecture.CpuState) void {
     const t = scheduler.current();
     if (t.aspace == 0) return fail(state);