every SIGTERM GPF'd at libc.so.6+0x50f. core symbolization (operator) showed the fault is a worker thread inside glibc locale parsing (strtold_l), with all ~2,800 backend threads alive and ~1,066 mid-getaddrinfo — glibc's exit-time teardown frees shared libc state (locale data) while live threads still use it. main() now runs the former body as runRelay() (defers intact — event-log flush in DiskPersist.deinit + pg disconnect still happen), then issues the raw exit_group(2) syscall instead of returning into glibc exit(3). exit_group kills all threads atomically in-kernel: no teardown runs, nothing can fault. deliberately not std.process.exit — under link_libc it calls libc exit(3), the exact teardown we're avoiding. operator's reconnect-stop idea is unnecessary with exit_group (atomic kill). builds clean (native + x86_64-linux-gnu ReleaseSafe), tests green. teardown-path change → needs an operator canary/restart to confirm no SIGILL + event-log seq continuity (flush ran). analysis in docs/shutdown-gpf-analysis.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>