Freeze the process; it can't destroy its own evidence

A school uses SIGSTOP to pause thirty games at the bell. You use it because something in a container is uploading at 2am and you don't yet know what.

kill ends the process, its memory, its open sockets, its chance to explain itself. Instead: POST /api/v1/system/processes/freeze with the pid and include_descendants: true. The parent is signalled first, so a forked child can't slip out. The tree stops mid-syscall. It cannot finish the upload. It cannot rm its own script.

Now you read. GET /api/v1/system/ports shows what it was connected to. The files journal shows what it wrote. Snapshots capture disk, not memory, so the freeze is the only thing holding the live half. Snapshot the disk, then unfreeze or kill on your terms.

The bell pauses a game. The same signal pauses a suspect.