refactor(subprocess): the dispose ladder moves to its one consumer

SubprocessHandle loses dispose(graces) and SubprocessDisposeGraces: the
stdin-EOF→SIGTERM→SIGKILL sequence is teardown POLICY encoding one
consumer's cooperation shape, not process vocabulary — the seam keeps
kill/terminate/waitForExit, and waitForExit(signal?) is the quiescence
probe a consumer ladder needs. dsh-subagent-acp owns disposeAcpChild()
over those public verbs (tier tests move into its suite; a never-exits
stub pins the fail-loud path); dsh-subprocess-local sheds the ladder,
its deadline import, and the dsh-timeout dependency. Every future
backend now owes four verbs and no teardown policy. New bilingual
ladder-ownership Agent Note records the decision; catalogs regenerated.

docs/cordis-catalog/services.md

@@ -1567,7 +1567,7 @@ Implementations must honor these semantics:
 
 - spawn returns immediately with a live handle; `done` resolves at process close with exit facts and rejects only for spawn-level failures.
 - Collect-mode readers are offset-based and non-consuming, so independent readers never consume one another's output; lossy reads report truncation and the spill file holding the complete stream when one exists. Piped streams are handed to the caller raw and never buffered here.
-- SubprocessHandle.kill signals without escalation, SubprocessHandle.terminate (and the spec's abort signal) escalates SIGTERM→grace→SIGKILL, and SubprocessHandle.dispose runs the cooperative EOF-first ladder — all tree-scoped on every platform.
+- SubprocessHandle.kill signals without escalation, and SubprocessHandle.terminate (and the spec's abort signal) escalates SIGTERM→grace→SIGKILL — both tree-scoped on every platform. SubprocessHandle.waitForExit observes whole-tree liveness, so a consumer-owned teardown ladder can hold each tier on real quiescence.
 - Disposal of the service terminates all still-running managed processes and awaits their exit.
 
 ```ts cordis-catalog
@@ -1582,7 +1582,7 @@ abstract spawn(spec: SubprocessSpawnSpec): SubprocessHandle
 
 Types: [SubprocessHandle](../core-data-structures/subprocess.md) · [SubprocessSpawnSpec](../core-data-structures/subprocess.md)
 
-Source: [`packages/subprocess/subprocess/src/index.ts:112`](../../packages/subprocess/subprocess/src/index.ts)
+Source: [`packages/subprocess/subprocess/src/index.ts:111`](../../packages/subprocess/subprocess/src/index.ts)
 
 ## `ctx.systemPrompt` — `SystemPrompt`
 

docs/core-data-structures/subprocess.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write
-subprocess.md: cdd4507c7d37f47ca243ddf38114f5aa6b6f3ad1
-subprocess.zh.md: 78325c3255c42ed591bbd98fdbdb4fdfcba48202
+subprocess.md: 810f74b6512c846e138670aa6c3ad1c8be577366
+subprocess.zh.md: 8e6aca436a2a7a14ec4ab1da9b9d4f848918a9dc

docs/core-data-structures/subprocess.md

@@ -132,7 +132,7 @@ interface SubprocessSpawnSpec {
 
 ## Handles: streams, readers, and tree-scoped termination
 
-A spawn returns a live handle immediately. Collect-mode readers take whole-stream byte offsets and never consume, so independent readers cannot steal one another's deltas; piped streams belong to the caller. Termination is tree-scoped on every platform: `kill(signal)` sends one signal Node-style, `terminate()` escalates SIGTERM→grace→SIGKILL, `waitForExit()` observes the whole tree, and `dispose(graces)` runs the cooperative stdin-EOF→SIGTERM→SIGKILL ladder out-of-process children need.
+A spawn returns a live handle immediately. Collect-mode readers take whole-stream byte offsets and never consume, so independent readers cannot steal one another's deltas; piped streams belong to the caller. Termination is tree-scoped on every platform: `kill(signal)` sends one signal Node-style, `terminate()` escalates SIGTERM→grace→SIGKILL, and `waitForExit()` observes the whole tree — enough for a consumer to build its own teardown ladder (the ACP backend's stdin-EOF-first `disposeAcpChild` is the template).
 
 ```ts type-equiv
 /**
@@ -177,15 +177,6 @@ interface SubprocessHandle {
    * @returns `true` when the tree exited, `false` when the signal aborted first.
    */
   waitForExit(signal?: AbortSignal): Promise<boolean>
-  /**
-   * Tear the child down to quiescence, resolving only after exit: close stdin
-   * (when this handle owns a piped one) and allow cooperative flush for
-   * `eofGraceMs`, then SIGTERM with a `graceMs` window (POSIX), then forced
-   * tree termination with a final bounded `graceMs` wait.
-   * @param graces - the ladder's two windows, from the consumer's Config.
-   * @throws when the child still has not exited `graceMs` after the forced tier.
-   */
-  dispose(graces: SubprocessDisposeGraces): Promise<void>
 }
 ```
 
@@ -233,31 +224,6 @@ interface SubprocessCollectedOutputs {
 }
 ```
 
-```ts type-equiv
-/**
- * The two grace periods of the cooperative dispose ladder
- * ({@link SubprocessHandle.dispose}). Consumers carry them as defaulted,
- * validated Config fields, so teardown timing is deployment-tunable and this
- * seam hardcodes nothing.
- */
-interface SubprocessDisposeGraces {
-  /**
-   * Tier-1 window (ms): after stdin EOF, how long the child gets to quiesce
-   * ON ITS OWN — flush durable state, tear down its own descendants — before
-   * escalation to platform termination. Usually WIDER than
-   * {@link SubprocessDisposeGraces.graceMs}: a cooperative child's EOF-driven
-   * teardown may itself wait on a signal-trapping grandchild plus a final
-   * flush.
-   */
-  eofGraceMs: number
-  /**
-   * Termination confirmation window (ms): POSIX applies it after `SIGTERM`
-   * and again after `SIGKILL`; Windows applies it after the forced tree
-   * termination.
-   */
-  graceMs: number
-}
-```
 
 ## Outcomes carry exit facts only
 

docs/core-data-structures/subprocess.zh.md

@@ -132,7 +132,7 @@ interface SubprocessSpawnSpec {
 
 ## 句柄：流、读取器与以进程树为范围的终止
 
-spawn 会立即返回一个实时句柄。收集模式的读取器接受全流字节偏移量且从不消费，因此独立的读取器不会抢走彼此的增量；管道化的流归调用方所有。终止在每个平台上都以进程树为范围：`kill(signal)` 以 Node 风格只发送一个信号，`terminate()` 执行 SIGTERM→宽限期→SIGKILL 升级，`waitForExit()` 观察整棵进程树，`dispose(graces)` 运行进程外子进程所需的协作式 stdin EOF→SIGTERM→SIGKILL 阶梯。
+spawn 会立即返回一个实时句柄。收集模式的读取器接受全流字节偏移量且从不消费，因此独立的读取器不会抢走彼此的增量；管道化的流归调用方所有。终止在每个平台上都以进程树为范围：`kill(signal)` 以 Node 风格只发送一个信号，`terminate()` 执行 SIGTERM→宽限期→SIGKILL 升级，`waitForExit()` 观察整棵进程树——这足以让消费方构建自己的拆卸阶梯（ACP 后端以 stdin EOF 打头的 `disposeAcpChild` 即是模板）。
 
 ```ts type-equiv
 /**
@@ -177,15 +177,6 @@ interface SubprocessHandle {
    * @returns `true` when the tree exited, `false` when the signal aborted first.
    */
   waitForExit(signal?: AbortSignal): Promise<boolean>
-  /**
-   * Tear the child down to quiescence, resolving only after exit: close stdin
-   * (when this handle owns a piped one) and allow cooperative flush for
-   * `eofGraceMs`, then SIGTERM with a `graceMs` window (POSIX), then forced
-   * tree termination with a final bounded `graceMs` wait.
-   * @param graces - the ladder's two windows, from the consumer's Config.
-   * @throws when the child still has not exited `graceMs` after the forced tier.
-   */
-  dispose(graces: SubprocessDisposeGraces): Promise<void>
 }
 ```
 
@@ -233,31 +224,6 @@ interface SubprocessCollectedOutputs {
 }
 ```
 
-```ts type-equiv
-/**
- * The two grace periods of the cooperative dispose ladder
- * ({@link SubprocessHandle.dispose}). Consumers carry them as defaulted,
- * validated Config fields, so teardown timing is deployment-tunable and this
- * seam hardcodes nothing.
- */
-interface SubprocessDisposeGraces {
-  /**
-   * Tier-1 window (ms): after stdin EOF, how long the child gets to quiesce
-   * ON ITS OWN — flush durable state, tear down its own descendants — before
-   * escalation to platform termination. Usually WIDER than
-   * {@link SubprocessDisposeGraces.graceMs}: a cooperative child's EOF-driven
-   * teardown may itself wait on a signal-trapping grandchild plus a final
-   * flush.
-   */
-  eofGraceMs: number
-  /**
-   * Termination confirmation window (ms): POSIX applies it after `SIGTERM`
-   * and again after `SIGKILL`; Windows applies it after the forced tree
-   * termination.
-   */
-  graceMs: number
-}
-```
 
 ## 结果只承载退出事实