Terminate owned subprocess trees

docs/internal/adapters.md

@@ -56,6 +56,12 @@ configured filesystem secrets before adapter initialization.
 - Constructor errors fail stage execution setup early.
 - Runtime adapter errors propagate to stage code and then manifest failure handling.
 - Subprocess adapters persist stage logs/generated configs through stage-managed paths.
+- Shared subprocess execution starts an owned process group on Linux/macOS or a
+  kill-on-close job object on Windows. Cancellation and deadlines request
+  termination, use a bounded forceful fallback, and wait for the leader before
+  returning. Unlogged stdout/stderr use direct null-device descriptors so a
+  descendant cannot retain an adapter pipe after its leader exits. Unsupported
+  platforms reject owned command execution.
 
 ## Implementation And Tests
 

docs/operations.md

@@ -139,6 +139,16 @@ temporary promotion tree because Narratio has no verified atomic no-replace
 directory primitive there. This is an extraction limitation, not a broader
 platform-support guarantee for every Narratio workflow.
 
+## External Command Lifecycle
+
+When an external command is cancelled or times out, Narratio terminates its
+owned descendants as well as the command itself. Cancellation first requests
+termination where the platform supports it, then force terminates after a
+bounded wait. A command is not considered finished until its leader has been
+reaped, and descendants that keep standard output or error open cannot keep
+the invocation blocked. Other operating systems fail closed rather than launch
+a command without tree ownership.
+
 Run-local diagnostics are:
 
 - `runs/{run_id}/extract/notarius.receipt.json`

docs/roadmap/implementation.md

@@ -23,7 +23,7 @@ All stages are pending when this plan is created.
 | 5 | Confine recursive cleanup and replace sentinel locks | RSK-003 | Completed |
 | 6 | Harden API-key file acquisition | RSK-010 | Completed |
 | 7 | Bound and verify external result acquisition | RSK-013, TST-007 | Completed |
-| 8 | Terminate owned subprocess trees | RSK-011 | Pending |
+| 8 | Terminate owned subprocess trees | RSK-011 | Completed |
 | 9 | Redact and cap subprocess diagnostics | RSK-012 | Pending |
 | 10 | Confine publish archive reads | COR-005 | Pending |
 | 11 | Make manifest and run identity singular | COR-001, TST-006 | Pending |