Harden cleanup deletion, trap, and resource-unwinding contracts #221

Parent: #214

Train position: 7 of 26
Phase: P0 — Trustworthy runtime and release baseline

Problem

Cleanup helpers protect obvious paths but intermediate symlink substitution can redirect recursive deletion, hook ordering is not designed as stack unwinding, and later traps can replace cleanup dispatch. Framework-owned cleanup must be safe under failure, interruption, concurrency, and hostile filesystem changes.

Acceptance criteria

• Require framework-owned path proof or explicit unsafe opt-in before recursive deletion and reject broad roots, home, system, and shared temporary directories.
• Prevent intermediate symlink or rename substitution from redirecting cleanup outside the resource originally registered.
• Run resource cleanup in documented LIFO order, exactly once, across success, failure, INT, and TERM.
• Define how existing and later caller traps compose with the dispatcher without silently losing either handler.
• Preserve the primary exit status while isolating and reporting secondary cleanup failures.
• Add focused tests for symlink swaps, renamed parents, duplicate registration, nested resources, concurrent exit, signals, and trap replacement.

Dependencies

• None