Rename product, namespaces, libraries, paths, and assets from Orion/orion
to Onion/onion across the tree. TCP stack-shutdown magic is now ONIO
(0x4F4E494F) to match the corrected branding.
Root fix stays: elevate with PTRACE_AUTHID only. Rename away from
set_ucred_to_debugger so the API cannot imply DEBUG_AUTHID. Remove
pt_attach ECHILD poll loops and multi-attempt toolbox inject — those
were workarounds, not the cause. Keep a single waitpid(WUNTRACED) after
PT_ATTACH.
Merge the three pt/elfldr clones (bootstrapper, libNineS, unpacker) into a
single liborion_elfldr with one authid policy (elevate once at inject entry,
never per ptrace). Wire consumers through shared headers; drop dead unpacker
loader sources. Route shellui if_exists through orion/platform and daemon
ShellUI/BigApp pid lookup through orion_proc. Document the layout and audit
status in docs/arch.md and docs/architecture-audit.md.
Move util cheats orchestration to C++ (CheatService, Repository, Applier,
IMemoryBackend, ICheatParser factory for json/shn/mc4 with ShnExt C adapter).
Drop the obsolete RELOAD_CHEATS UI/IPC path; reloads use file-signature hot
reload only. Document util cheats architecture under docs/util_arch.
Hexwell