reaper: defer terminating task's active page-table root + kernel stack (ADR-034 Phase A)

Fixes the confirmed clean-exit triple-fault on x86_64 + riscv64: a dying
task freed the page-table root still loaded in its own CR3/satp before it
yielded, and zero-on-free (318c1cd) made that fatal — freeing the active
PML4 zeroes the kernel half and the next instruction triple-faults. The
self-referential set a task cannot free from its own running context — the
page-table root + intermediates and the kernel stack — is now captured by
value and freed later by a per-CPU reaper running in a clean context.

What:
  - New src/reaper.rs: `ReclaimItem` { root_phys, kstack_top } + a bounded
    per-CPU `ReclaimQueue` (`RECLAIM_QUEUE_CAPACITY` = MAX_TASKS, SCAFFOLDING-
    tagged: one slot per task slot makes overflow structurally impossible,
    ADR-034 §5) + `drain_local()`, which pops items and frees the root via
    `reclaim_process_page_tables` then the kernel stack via `dealloc`.
  - src/lib.rs: `pub mod reaper`; `PER_CPU_RECLAIM_QUEUE`
    (`[IrqSpinlock<ReclaimQueue>; MAX_CPUS]`) + `local_reclaim_queue()` for
    all three arches. IrqSpinlock (not plain Spinlock) because the pusher is
    a task in the Terminated-but-still-running state; isolated "Additional
    lock domain", never nested with a hierarchy lock.
  - src/microkernel/main.rs: `reaper::drain_local()` wired into all five
    per-CPU idle loops (BSP x86/aarch64 microkernel_loop, BSP riscv, and the
    three AP loops) — normal context, interrupts enabled, SCHEDULER not held.
  - src/process.rs: `destroy_process` no longer frees page tables inline; it
    returns `Option<u64>` (the root to defer), `#[must_use]`. VMA + heap +
    generation bump stay inline, unchanged. Stale-id test strengthened to
    assert the deferral return.
  - src/syscalls/dispatcher.rs (`handle_exit`): captures the kernel stack +
    transition-winner under SCHEDULER, captures the deferred root from
    destroy_process, then enqueues { root, kstack } under the per-CPU queue
    lock alone (every hierarchy lock released) immediately before the terminal
    yield. Enqueue-once is gated on winning the Running->Terminated
    transition; a full queue degrades to a logged bounded leak, never a panic
    or block. Safe to enqueue here: purge_task cleared current_task, so the
    timer ISR takes its no-switch path and the dying task is never
    involuntarily switched away before the item is durable.
  - src/memory/paging.rs (x86) + src/memory/mod.rs (non-x86): release-build
    active-root guard at the top of `reclaim_process_page_tables` — reads
    CR3 / satp / TTBR0 and refuses (frees nothing, audits, debug-asserts) if
    asked to free the active root. Defense-in-depth: post-Phase-A the reaper
    only ever frees roots the owner has yielded off, so a hit means a
    regression reintroduced the self-free.
  - src/audit/mod.rs: `AuditEventKind::ReapWouldFreeActiveRoot = 21` +
    builder — the runtime witness for the guard above. Purely additive (no
    exhaustive match over AuditEventKind exists outside the audit module).
  - src/loader/mod.rs: `KERNEL_STACK_SIZE` made `pub` (the reaper rebuilds
    the exact dealloc Layout); fixed a stale SAFETY comment (8192 -> 32768).
  - docs/ASSUMPTIONS.md: `RECLAIM_QUEUE_CAPACITY` SCAFFOLDING row.
  - tools/check-*-baseline.txt: line-number resyncs for entries my edits
    shifted + the descriptive "deferred" tokens inherent to a module about
    deferred reclamation (same treatment as the ADR-029/031/033 tokens). No
    new untagged bound and no new Convention-9 deferral. The two stale
    boot_modules.rs assumptions entries are preserved (their cleanup remains
    the separately-flagged Phase-0 item).

Why: ADR-034 (ratified 62c59ba). The active-root self-free is the
triple-fault Tier C boot-smoke surfaced; the kernel stack ("can't free the
stack you're running on") was a standing leak with the same root cause. One
mechanism closes both.

Out of scope:
  - Task-slot leak (HV1): Phase B — TaskId generation + TaskExitRing +
    WaitTask rewrite + H5 co-fix. The slot is intentionally not deferred here.
  - The dedicated per-CPU reaper *task* vehicle: Phase A drains from the
    existing idle loops, which is the exact normal-context the ADR requires;
    building a ring-0 kernel-task trampoline now is new arch-specific unsafe
    of the same triple-fault class we are fixing, for no Phase-A correctness
    gain (overflow is structurally impossible; slots leak in Phase A anyway).
    The v1-shape drain_local() is reused verbatim by any future vehicle;
    promotion is deferred to ADR-034's latency trigger.
  - STATUS.md (kernel-stack-leak known-issue resolution, subsystem-row sync):
    flagged for separate application to respect the parallel-session boundary
    and the index-isolation gate.

Verification:
  - make check-all: x86_64 + aarch64 + riscv64 build cleanly.
  - cargo test --lib: 892 passed, 0 failed.
  - check-assumptions / check-deferrals / check-unsafe-coverage /
    check-boot-panics: all pass (0 new). clippy: no new warnings, no
    missing_safety_doc error.
  - Boot before/after (x86_64, make run-quiet): the pre-fix tree HANGS at
    `[FDE-MOUNT] ... skipping FDE unlock` (run-quiet exit 2) — fde-mount's
    boot-time `sys::exit` frees the active PML4 and triple-faults. The
    post-fix tree sails past that exact point to `CambiOS Shell v0.1`
    (exit 0). Only difference between the trees is this change.

Staged files:
  docs/ASSUMPTIONS.md
  src/audit/mod.rs
  src/lib.rs
  src/loader/mod.rs
  src/memory/mod.rs
  src/memory/paging.rs
  src/microkernel/main.rs
  src/process.rs
  src/reaper.rs
  src/syscalls/dispatcher.rs
  tools/check-assumptions-baseline.txt
  tools/check-deferrals-baseline.txt

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: riccajason

docs/ASSUMPTIONS.md

@@ -78,6 +78,7 @@ These are the ones that will need to grow as the system matures. They are correc
 |---|---|---|---|---|
 | `MAX_TASKS` (per CPU) | 256 | [src/scheduler/mod.rs:126](../src/scheduler/mod.rs#L126), [src/lib.rs:157](../src/lib.rs#L157) | Heap-allocated, per-CPU. Originally raised from 32 to support multi-core workloads. | Current workloads sit far below 256. Revisit when a single CPU is regularly seeing >100 active tasks, or when AI inference services start spawning per-request worker tasks. |
 | `REPLY_ENDPOINT` (size) | 256 | [src/lib.rs](../src/lib.rs) | `[AtomicU32; 256]` — one slot per process, indexed by `ProcessId::slot()`. Stores the first endpoint each process registered; `handle_write` uses it as the `from` field of outgoing messages so receivers can route replies via `msg.from_endpoint()`. Sized to match `MAX_TASKS`; 1 KiB in `.bss`. Landed in Phase 4b to fix the pid-slot-as-reply-address bug that broke all service-reply paths. | Process/task slot model changes (e.g., slot count goes above 256, or multi-endpoint-per-process routing becomes a real feature rather than implicitly "first wins"). |
+| `RECLAIM_QUEUE_CAPACITY` (per CPU) | 256 (= `MAX_TASKS`) | [src/reaper.rs:66](../src/reaper.rs#L66) | Depth of each per-CPU deferred-reclaim queue ([ADR-034 § Decision 5](adr/034-deferred-task-resource-reclamation.md)). One slot per per-CPU task slot makes overflow structurally impossible: a CPU can hold at most `MAX_TASKS` Terminated-but-unreaped tasks at once (a slot cannot be reused until reaped), so a queue this deep always accepts the death path's push — the path never panics, blocks, or frees inline. Tracks `MAX_TASKS`, not an independent guess. Memory cost: 256 × 16 B = 4 KiB per CPU, × `MAX_CPUS` = 1 MiB zero-init `.bss` fleet-wide. | `MAX_TASKS` changes (keep them equal), or a design ever lets one CPU hold more than `MAX_TASKS` pending reclaims (it cannot today). Per-CPU high-watermark >25% under any test workload is the ADR-034 Open-Problems trigger to revisit reaper throughput, not this bound. |
 | `MAX_CPUS` | 256 | [src/lib.rs:91](../src/lib.rs#L91), [src/arch/x86_64/percpu.rs:23](../src/arch/x86_64/percpu.rs#L23), [src/arch/aarch64/percpu.rs:23](../src/arch/aarch64/percpu.rs#L23), [src/arch/aarch64/gic.rs:30](../src/arch/aarch64/gic.rs#L30) | Matches xAPIC 8-bit APIC ID space; statically-sized per-CPU arrays. | x2APIC support (32-bit IDs) or > 256-core targets. Not a v1 concern. |
 | `MAX_ENDPOINTS` | 32 | [src/ipc/mod.rs:22](../src/ipc/mod.rs#L22) | Historically matched `MAX_PROCESSES` (one endpoint per service). Sharded IPC has one shard per endpoint; static array. | `MAX_PROCESSES` is gone as of Phase 3.2a — the process table now scales with tier policy. This endpoint cap should eventually move too (tie it to `config::num_slots()` or a new `MAX_ENDPOINTS_PER_SLOT * num_slots()` computation). First Phase 3 service that needs >32 endpoints is the trigger. |
 | `MAX_CAPS_PER_PROCESS` (per-process capability table) | 64 (16 under `cfg(kani)`) | [src/ipc/capability.rs:133](../src/ipc/capability.rs#L133) | Bounded set for verification; cache-line-friendly linear scan. Bumped 32 → 64 at A-v.d.3 in lockstep with `MAX_ENDPOINTS` (the boot manifest grants one cap per endpoint, so the two must match or trailing endpoints silently fail their grant — the original fde-mount=32 IPC bug). `verification/capability-proofs` references this const directly. Under `cfg(kani)` it shrinks to 16: P3.7 symbolically fills a full table and `grant`'s per-call scan makes that ~O(N²), so at 64 the CBMC formula exhausts CI-runner memory (the first Tier B GitHub Actions run OOM'd). The proven "full table rejects further grants" property is size-independent, so 16 proves the same guarantee — same technique as `MAX_FRAMES`'s `cfg(kani)` shrink. | The policy service holds one capability per service it mediates, the audit consumer holds one per producer; 64 will get tight when those land at scale. |

src/audit/mod.rs

@@ -100,6 +100,16 @@ pub enum AuditEventKind {
     /// - `arg0`: kind discriminant (0 = Close, 1 = Revoke)
     /// - `arg1`: number of pages freed
     ChannelTeardownCompleted = 20,
+    /// Defense-in-depth witness (ADR-034 §3): `reclaim_process_page_tables`
+    /// was asked to free a page-table root that is *still this CPU's active
+    /// CR3/satp/TTBR0*. Post-Phase-A the reaper only frees roots the owning
+    /// task has yielded off, so this never fires in correct operation —
+    /// emitting it means a regression reintroduced the active-root self-free.
+    /// The reclaim refuses (frees nothing) in both build profiles; a
+    /// `debug_assert!` additionally fast-fails dev builds.
+    /// - `subject_pid`: 0 (kernel-context event)
+    /// - `arg0`: the active root physical address the free was refused for
+    ReapWouldFreeActiveRoot = 21,
 }
 
 /// ARCHITECTURAL: `cluster_revoked` event's `arg2` discriminant for
@@ -643,6 +653,30 @@ impl RawAuditEvent {
         )
     }
 
+    /// `REAP_WOULD_FREE_ACTIVE_ROOT`: defense-in-depth witness that a
+    /// page-table reclaim was refused because the root is the active
+    /// CR3/satp/TTBR0 (ADR-034 §3). Kernel-context event (no subject pid).
+    ///
+    /// - `arg0`: the active root physical address the free was refused for
+    pub fn reap_would_free_active_root(
+        active_root_phys: u64,
+        timestamp: u64,
+        sequence: u32,
+    ) -> Self {
+        Self::build(
+            AuditEventKind::ReapWouldFreeActiveRoot,
+            0,
+            sequence,
+            timestamp,
+            0,
+            0,
+            active_root_phys,
+            0,
+            0,
+            0,
+        )
+    }
+
     /// `POLICY_QUERY`: when the policy service is consulted (sampled).
     ///
     /// - `subject_pid`: the process being queried about

src/lib.rs

@@ -33,6 +33,7 @@ pub mod arch;
 pub mod loader;
 pub mod syscalls;
 pub mod process;
+pub mod reaper;
 pub mod acpi;
 pub mod fs;
 pub mod crypto;
@@ -724,6 +725,44 @@ pub fn local_frame_cache() -> &'static Spinlock<FrameCache> {
     &PER_CPU_FRAME_CACHE[cpu_id]
 }
 
+/// Per-CPU deferred-reclaim queues (ADR-034 §3). Each CPU owns
+/// `PER_CPU_RECLAIM_QUEUE[cpu_id]`. A dying task's death path pushes its
+/// `{ page-table root, kernel stack }` here (under this lock alone — never
+/// nested with a hierarchy lock); the per-CPU idle-loop reaper
+/// (`reaper::drain_local`) pops and frees them from a clean context.
+///
+/// `IrqSpinlock`, not a plain `Spinlock`, because the pusher is a task in the
+/// `Terminated`-but-still-running state: disabling interrupts across the brief
+/// push removes any question of a timer-ISR or idle-drain reentrancy on this
+/// CPU's queue while the push is in flight. Isolated "Additional lock domain"
+/// (like `PER_CPU_FRAME_CACHE`) — see CLAUDE.md § Lock Ordering.
+pub static PER_CPU_RECLAIM_QUEUE: [IrqSpinlock<reaper::ReclaimQueue>; MAX_CPUS] =
+    [const { IrqSpinlock::new(reaper::ReclaimQueue::new()) }; MAX_CPUS];
+
+/// Get the current CPU's deferred-reclaim queue lock.
+#[cfg(target_arch = "x86_64")]
+pub fn local_reclaim_queue() -> &'static IrqSpinlock<reaper::ReclaimQueue> {
+    // SAFETY: GS base initialized at boot; cpu_id is a pure read.
+    let cpu_id = unsafe { arch::x86_64::percpu::current_percpu().cpu_id() } as usize;
+    &PER_CPU_RECLAIM_QUEUE[cpu_id]
+}
+
+/// Get the current CPU's deferred-reclaim queue lock (AArch64).
+#[cfg(target_arch = "aarch64")]
+pub fn local_reclaim_queue() -> &'static IrqSpinlock<reaper::ReclaimQueue> {
+    // SAFETY: TPIDR_EL1 initialized at boot; cpu_id is a pure read.
+    let cpu_id = unsafe { arch::aarch64::percpu::current_percpu().cpu_id() } as usize;
+    &PER_CPU_RECLAIM_QUEUE[cpu_id]
+}
+
+/// Get the current hart's deferred-reclaim queue lock (RISC-V).
+#[cfg(target_arch = "riscv64")]
+pub fn local_reclaim_queue() -> &'static IrqSpinlock<reaper::ReclaimQueue> {
+    // SAFETY: `tp` initialized at boot; cpu_id is a pure read.
+    let cpu_id = unsafe { arch::riscv64::percpu::current_percpu().cpu_id() } as usize;
+    &PER_CPU_RECLAIM_QUEUE[cpu_id]
+}
+
 /// Allocate a physical frame, preferring the local CPU's cache.
 ///
 /// Fast path (no global lock): pop from per-CPU cache.

src/loader/mod.rs

@@ -42,7 +42,11 @@ use core::mem::size_of;
 /// observed usage and costs MAX_TASKS × 32 KiB ≈ 8 MiB of kernel memory.
 /// Replace when: per-kstack guard-page mapping lands (then this becomes a
 /// HARDWARE-bounded value driven by the page-fault report, not a guess).
-const KERNEL_STACK_SIZE: usize = 32 * 1024;
+///
+/// `pub` so `reaper::free_kernel_stack` can reconstruct the exact `Layout`
+/// when freeing a terminated task's stack (ADR-034 Phase A) — the deferred
+/// free must use the same size this allocation used.
+pub const KERNEL_STACK_SIZE: usize = 32 * 1024;
 
 /// SCAFFOLDING: default user stack 16 pages (64 KiB).
 /// Why: conservative default that fits all current services.
@@ -690,7 +694,7 @@ pub fn load_elf_process(
     let kstack_layout = Layout::from_size_align(KERNEL_STACK_SIZE, 16)
         .map_err(|_| LoaderError::KernelStackAllocationFailed)?;
 
-    // SAFETY: Layout is valid (KERNEL_STACK_SIZE=8192, align=16).
+    // SAFETY: Layout is valid (KERNEL_STACK_SIZE=32768, align=16).
     let kstack_base = unsafe { alloc(kstack_layout) };
     if kstack_base.is_null() {
         return Err(LoaderError::KernelStackAllocationFailed);

src/memory/mod.rs

@@ -443,6 +443,35 @@ pub mod paging {
             return 0;
         }
 
+        // ADR-034 §3 release-build active-root guard. Freeing the L0 root that
+        // is still this hart's active satp / this CPU's active TTBR0 unmaps the
+        // running address space (the confirmed triple-fault on RISC-V; on
+        // AArch64 it would brick the TTBR0 regime). Post-Phase-A the reaper
+        // only frees roots the owning task has yielded off, so a hit here means
+        // a regression reintroduced the active-root self-free. Refuse (free
+        // nothing) in BOTH build profiles. See x86_64 `paging.rs` for the full
+        // rationale.
+        #[cfg(not(test))]
+        {
+            // SAFETY: HHDM is set and a valid root exists by the time any
+            // process page table is reclaimed; reading the root register
+            // (satp / TTBR0_EL1) is a pure read.
+            let active = unsafe { ap::active_root() };
+            if active == l0_phys {
+                crate::audit::emit(crate::audit::RawAuditEvent::reap_would_free_active_root(
+                    l0_phys,
+                    crate::audit::now(),
+                    0,
+                ));
+                debug_assert!(
+                    false,
+                    "reclaim_process_page_tables called on the active root {:#x}",
+                    l0_phys
+                );
+                return 0;
+            }
+        }
+
         let mut freed = 0usize;
 
         // SAFETY: l0_phys is a valid L0 page table from

src/memory/paging.rs

@@ -292,6 +292,35 @@ pub fn reclaim_process_page_tables(
         return 0;
     }
 
+    // ADR-034 §3 release-build active-root guard. Freeing the PML4 that is
+    // still this CPU's active CR3 unmaps the running address space — the
+    // next TLB miss faults on an unmapped #PF handler → #DF → triple fault
+    // (the confirmed bug this whole mechanism exists to prevent). Post-Phase-A
+    // the reaper only frees roots the owning task has yielded off, so a hit
+    // here means a regression reintroduced the active-root self-free. Refuse
+    // (free nothing) in BOTH build profiles; the read is invisible cost on a
+    // path that only runs at teardown. `debug_assert!` adds dev fast-fail.
+    #[cfg(not(test))]
+    {
+        let cr3: u64;
+        // SAFETY: reading CR3 is a pure, ring-0-legal read; no memory touched.
+        unsafe { core::arch::asm!("mov {}, cr3", out(reg) cr3, options(nostack, nomem)); }
+        // CR3 bits[51:12] hold the PML4 base; mask off PCD/PWT/PCID low bits.
+        if (cr3 & 0x000F_FFFF_FFFF_F000) == pml4_phys {
+            crate::audit::emit(crate::audit::RawAuditEvent::reap_would_free_active_root(
+                pml4_phys,
+                crate::audit::now(),
+                0,
+            ));
+            debug_assert!(
+                false,
+                "reclaim_process_page_tables called on the active CR3 root {:#x}",
+                pml4_phys
+            );
+            return 0;
+        }
+    }
+
     let hhdm = crate::hhdm_offset();
     let mut freed = 0usize;
 

src/microkernel/main.rs

@@ -907,6 +907,9 @@ unsafe extern "C" fn kmain_riscv64(hart_id: u64, dtb_phys: u64) -> ! {
     // another task, the trap vector's `mv sp, a0 ; sret` swaps out
     // this stack; we resume here when the scheduler picks idle again.
     loop {
+        // ADR-034 §3: reclaim exited tasks' page-table roots + kernel stacks
+        // from this hart's deferred-reclaim queue, in normal context.
+        cambios_core::reaper::drain_local();
         // SAFETY: wfi is always legal in S-mode. On a hart with SIE
         // set, it blocks until the next interrupt (timer or external)
         // fires, at which point control re-enters the trap vector.
@@ -1037,6 +1040,8 @@ unsafe extern "C" fn kmain_riscv64_ap(cpu_index: u64, hart_id: u64) -> ! {
     // SAFETY: trap vector installed; PerCpu/timer/scheduler all live.
     unsafe { cambios_core::arch::riscv64::trap::enable_interrupts(); }
     loop {
+        // ADR-034 §3: drain this hart's deferred-reclaim queue.
+        cambios_core::reaper::drain_local();
         // SAFETY: wfi is always legal in S-mode with SIE set.
         unsafe { core::arch::asm!("wfi", options(nostack, nomem, preserves_flags)); }
     }
@@ -2186,6 +2191,8 @@ unsafe extern "C" fn ap_entry(cpu: &limine::mp::Cpu) -> ! {
     x86_64::instructions::interrupts::enable();
 
     loop {
+        // ADR-034 §3: drain this CPU's deferred-reclaim queue.
+        cambios_core::reaper::drain_local();
         hlt();
     }
 }
@@ -2275,6 +2282,8 @@ unsafe extern "C" fn ap_entry(cpu: &limine::mp::Cpu) -> ! {
     }
 
     loop {
+        // ADR-034 §3: drain this CPU's deferred-reclaim queue.
+        cambios_core::reaper::drain_local();
         cambios_core::wfi();
     }
 }
@@ -2637,6 +2646,12 @@ fn microkernel_loop() -> ! {
         // (internally throttled to once per BALANCE_INTERVAL_TICKS)
         cambios_core::try_load_balance();
 
+        // ADR-034 §3: drain this CPU's deferred-reclaim queue — free the
+        // page-table roots + kernel stacks of tasks that exited on this CPU,
+        // now that they have yielded off them. Normal context, no hierarchy
+        // lock held: the safe place to take FRAME_ALLOCATOR + free.
+        cambios_core::reaper::drain_local();
+
         // Halt/wait CPU until next interrupt (timer, keyboard, etc.)
         #[cfg(target_arch = "x86_64")]
         hlt();

src/process.rs

@@ -992,33 +992,48 @@ impl ProcessTable {
     /// Kernel stack deallocation is deferred to a separate cleanup
     /// pass (bounded leak, requires scheduler-level deferred-free
     /// mechanism). See STATUS.md.
+    /// Reclaim a terminating process's inline-freeable resources and return
+    /// the page-table root to be freed **later** by the per-CPU reaper.
+    ///
+    /// VMA-tracked frames and the heap are freed inline here. The page-table
+    /// root (PML4 / satp L0 / TTBR0 L0) is **not** — it is the dying task's
+    /// *active* root, and freeing it inline unmaps the running address space
+    /// (the confirmed triple-fault, ADR-034 Context). Instead the root is
+    /// returned so the caller can hand it to `reaper::drain_local`, which
+    /// frees it from a clean context after the task has yielded off it.
+    ///
+    /// Returns `Some(root_phys)` for a process with a per-process page table,
+    /// `None` for a kernel task (`cr3 == 0`) or a stale / unknown / unoccupied
+    /// `process_id` (nothing to defer).
+    #[must_use = "the returned page-table root must be enqueued for the reaper, \
+                  or it leaks"]
     pub fn destroy_process(
         &mut self,
         process_id: ProcessId,
         frame_alloc: &mut FrameAllocator,
-    ) {
+    ) -> Option<u64> {
         let idx = process_id.slot() as usize;
         if idx >= self.processes.len() {
-            return;
+            return None;
         }
         // Reject a stale `process_id`: destroying by slot alone would let a
         // stale id reap the slot's *current* occupant (and bump its
         // generation), a confused-deputy that revokes a live process.
         if self.generations[idx] != process_id.generation() {
-            return;
+            return None;
         }
         if let Some(mut desc) = self.processes[idx].take() {
             // Step 1: Reclaim VMA-tracked user-space regions.
             // Unmaps pages from the process page table and frees
-            // physical frames. Must precede page table reclaim.
+            // physical frames. Must precede page table reclaim, and runs
+            // while the page table is still intact (and still the dying
+            // task's active root).
             let _vma_count = desc.reclaim_user_vmas(frame_alloc);
 
-            // Step 2: Reclaim page table frames (PML4 + intermediates).
-            // Only for processes with a per-process page table (cr3 != 0).
-            #[cfg(not(test))]
-            if desc.cr3 != 0 {
-                paging::reclaim_process_page_tables(desc.cr3, frame_alloc);
-            }
+            // Step 2: Page-table frames (root + intermediates) are NOT freed
+            // here — see the doc comment. Capture the root for the reaper.
+            // `None` when cr3 == 0 (kernel task, no per-process table).
+            let deferred_root = if desc.cr3 != 0 { Some(desc.cr3) } else { None };
 
             // Step 3: Reclaim the heap region.
             let _ = desc.reclaim_heap(frame_alloc);
@@ -1027,6 +1042,10 @@ impl ProcessTable {
             // slot gets a distinct ProcessId. Wrapping is intentional —
             // u32 gives ~4 billion reuses per slot before wrap.
             self.generations[idx] = self.generations[idx].wrapping_add(1);
+
+            deferred_root
+        } else {
+            None
         }
     }
 
@@ -1522,18 +1541,28 @@ mod tests {
         table.generations[0] = 5;
         let mut fa = FrameAllocator::new();
 
-        // A stale id (generation 4) must not reap the live occupant (gen 5).
+        // A stale id (generation 4) must not reap the live occupant (gen 5),
+        // and must defer no page-table root.
         let stale = ProcessId::new(0, 4);
-        table.destroy_process(stale, &mut fa);
+        assert_eq!(
+            table.destroy_process(stale, &mut fa),
+            None,
+            "stale id must defer nothing"
+        );
         assert!(
             table.processes[0].is_some(),
             "stale id reaped the live occupant"
         );
         assert_eq!(table.generations[0], 5, "stale destroy must not bump gen");
 
-        // The current id destroys it and bumps the generation.
+        // The current id destroys it, bumps the generation, and returns the
+        // page-table root for the reaper to free (ADR-034 Phase A).
         let current = ProcessId::new(0, 5);
-        table.destroy_process(current, &mut fa);
+        assert_eq!(
+            table.destroy_process(current, &mut fa),
+            Some(0x2000_0000),
+            "destroy must defer the descriptor's cr3 root"
+        );
         assert!(table.processes[0].is_none());
         assert_eq!(table.generations[0], 6);
     }