@logicseek/hello-cc 1.0.5 → 1.1.0-rc.3

package/scripts/regression.mjs

@@ -17,6 +17,11 @@ import WebSocket from 'ws';
 import { inspectProcessIdentity, compareProcessIdentity } from '../lib/process/identity.mjs';
 import { redactSecrets } from '../lib/shared/redact.mjs';
 import { applyBufferPlan, planBufferFiles } from '../lib/runtime/buffer-gc.mjs';
+import { readOwnedReentryOutputAtDeadline, readReentryTrace } from './shim-reentry-probe.mjs';
+import { createCookieExpiryWindow } from './regression-cookie-expiry.mjs';
+import { waitForTerminalMarker, terminalMarkerFailureDiagnostic } from './regression-terminal-marker.mjs';
+import { fixtureFetch as fetch } from './regression-http-transport.mjs';
+import { parseShutdownDiagnostics } from '../lib/web/shutdown-diagnostics.mjs';
 
 const repoRoot = path.resolve(import.meta.dirname, '..');
 const hccBin = path.join(repoRoot, 'bin', 'hcc.mjs');
@@ -29,6 +34,10 @@ const tmuxSession = `hcc-reg-${process.pid}`;
 const tmuxSocketName = `hcc-reg-${testId}`.replace(/[^A-Za-z0-9_-]/g, '-');
 const secondProjectRoot = path.join(root, 'second-project');
 const TERMINAL_WEBSOCKET_TIMEOUT_MS = 15_000;
+const COOKIE_WEBSOCKET_SNAPSHOT_TIMEOUT_MS = 5_000;
+// now() uses whole seconds: TTL=1 may leave only 1ms before expiry. Reserve
+// the existing snapshot budget plus clock quantization/setup margin first.
+const COOKIE_EXPIRY_FIXTURE_TTL_SEC = Math.ceil(COOKIE_WEBSOCKET_SNAPSHOT_TIMEOUT_MS / 1000) + 2;
 const realHome = process.env.HOME || os.homedir();
 const realRegistryFile = path.join(realHome, '.hello-cc', 'projects.json');
 let realTmuxBin = '';
@@ -41,10 +50,13 @@ let currentStage = 'startup';
 let lastStopDiagnostic = null;
 const diagnosticSecrets = new Set();
 const fixtureFailures = new WeakSet();
+const fixtureCommandFailures = new WeakMap();
+const fixtureHttpFailures = new WeakMap();
 const managedTmuxSessions = new Set();
 
 const env = {
   ...process.env,
+  NODE_NO_WARNINGS: '1',
   HOME: home,
   PATH: `${fakeBin}${path.delimiter}${process.env.PATH || ''}`,
   SHELL: '/bin/bash'
@@ -53,6 +65,7 @@ for (const key of Object.keys(env)) {
   if (key.startsWith('HCC_')) delete env[key];
 }
 if (process.env.HCC_REGRESSION_DEBUG === '1') env.HCC_DEBUG = '1';
+env.HCC_SHUTDOWN_DIAGNOSTICS = '1';
 delete env.TMUX;
 delete env.TMUX_PANE;
 
@@ -61,8 +74,8 @@ function log(message) {
   process.stdout.write(`${message}\n`);
 }
 
-function fail(message) {
-  const error = fixtureFailureError(message);
+function fail(message, commandResult = null, diagnosticOperation = null) {
+  const error = fixtureFailureError(message, commandResult, diagnosticOperation);
   if (process.env.GITHUB_ACTIONS === 'true') {
     const escaped = fixtureDiagnosticText({ stage: currentStage, failure: fixtureFailureDiagnostic(error) }, diagnosticSecrets)
       .replace(/%/g, '%25')
@@ -73,25 +86,91 @@ function fail(message) {
   throw error;
 }
 
-export function fixtureFailureError(message) {
+export function fixtureFailureError(message, commandResult = null, diagnosticOperation = null) {
   const error = new Error(String(message));
   Object.defineProperty(error, 'fixtureStack', {
     value: Object.freeze(new Error('fixture failure').stack.split('\n').slice(1, 7))
   });
   fixtureFailures.add(error);
+  const command = fixtureCommandResult(commandResult, diagnosticOperation);
+  if (command) fixtureCommandFailures.set(error, command);
   return error;
 }
 
 export function fixtureFailureDiagnostic(error) {
   const names = ['Error', 'TypeError', 'RangeError', 'SyntaxError', 'AssertionError', 'AbortError'];
+  const terminalMarker = terminalMarkerFailureDiagnostic(error);
   return {
     name: names.includes(error?.name) ? error.name : 'Error',
     stack: fixtureFailures.has(error)
       ? error.fixtureStack
-      : new Error('regression failure handler').stack.split('\n').slice(1, 7)
+      : new Error('regression failure handler').stack.split('\n').slice(1, 7),
+    ...(fixtureCommandFailures.has(error) ? { command: fixtureCommandFailures.get(error) } : {}),
+    ...(fixtureHttpFailures.has(error) ? { http: fixtureHttpFailures.get(error) } : {}),
+    ...(terminalMarker ? { terminalMarker } : {})
   };
 }
 
+function fixtureHttpRoute(route) {
+  if (typeof route !== 'string') return null;
+  const pathname = route.split(/[?#]/, 1)[0];
+  if (['/', '/api/projects', '/api/runtime', '/api/runtime/gc-buffers', '/api/detected',
+    '/api/sessions', '/api/sessions/attach', '/api/resumable',
+    '/assets/web/browser/core.mjs', '/assets/web/ui-agent-start.mjs'].includes(pathname)) return pathname;
+  const action = pathname.match(/^\/api\/peers\/[^/?#]+\/actions\/(status|state|inbox|heartbeat|task-next|task-takeover|lock-acquire)$/);
+  if (action) return `/api/peers/:peer/actions/${action[1]}`;
+  const session = pathname.match(/^\/api\/sessions\/[^/?#]+\/(input|stop)$/);
+  if (session) return `/api/sessions/:peer/${session[1]}`;
+  if (/^\/api\/detected\/[^/?#]+\/msg$/.test(pathname)) return '/api/detected/:peer/msg';
+  return null;
+}
+
+function fixtureHttpCallFrames() {
+  // Capture our call site before invoking fetch. Never parse the thrown error's
+  // stack, whose text can contain URLs, request data or third-party messages.
+  const capture = {};
+  Error.captureStackTrace(capture, withFixtureHttpDiagnostic);
+  const source = pathToFileURL(path.join(repoRoot, 'scripts', 'regression.mjs')).href;
+  const location = new RegExp(`(?:^|[ (])${source.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}:(\\d+):(\\d+)\\)?$`);
+  return Object.freeze(String(capture.stack).split('\n').flatMap((frame) => {
+    const match = frame.match(location);
+    if (!match) return [];
+    return [Object.freeze({ file: 'scripts/regression.mjs', line: Number(match[1]), column: Number(match[2]) })];
+  }).slice(0, 6));
+}
+
+function fixtureHttpNetworkCode(error) {
+  const allowed = ['ECONNRESET', 'ECONNREFUSED', 'EHOSTUNREACH', 'ENETUNREACH', 'ENOTFOUND',
+    'EAI_AGAIN', 'ETIMEDOUT', 'UND_ERR_CONNECT_TIMEOUT', 'UND_ERR_HEADERS_TIMEOUT',
+    'UND_ERR_BODY_TIMEOUT', 'UND_ERR_SOCKET'];
+  // Reading data descriptors avoids evaluating arbitrary error/cause getters.
+  try {
+    const direct = Object.getOwnPropertyDescriptor(error, 'code')?.value;
+    const cause = Object.getOwnPropertyDescriptor(error, 'cause')?.value;
+    const nested = cause && Object.getOwnPropertyDescriptor(cause, 'code')?.value;
+    return allowed.includes(direct) ? direct : allowed.includes(nested) ? nested : null;
+  } catch { return null; }
+}
+
+export async function withFixtureHttpDiagnostic(route, options, request) {
+  const method = options?.method ?? 'GET';
+  const context = {
+    method: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'].includes(method) ? method : null,
+    route: fixtureHttpRoute(route),
+    callFrames: fixtureHttpCallFrames()
+  };
+  const started = performance.now();
+  try {
+    return await request();
+  } catch (error) {
+    if (error && (typeof error === 'object' || typeof error === 'function') && !fixtureHttpFailures.has(error)) {
+      fixtureHttpFailures.set(error, Object.freeze({ ...context,
+        code: fixtureHttpNetworkCode(error), elapsedMs: Math.max(0, Math.round(performance.now() - started)) }));
+    }
+    throw error;
+  }
+}
+
 export function fixtureDiagnosticText(value, secrets = []) {
   function scrub(text) {
     for (const secret of secrets) {
@@ -129,7 +208,9 @@ export function observeFixtureOwner(owner, { inspect = inspectProcessIdentity, p
   }
   details.birthHash = crypto.createHash('sha256').update(observed.identity.startToken).digest('hex');
   details.commandHash = observed.identity.commandHash;
-  if (compareProcessIdentity(owner, observed.identity) === 'dead') return { ...details, state: 'exited', reason: 'pid_reused' };
+  const comparison = compareProcessIdentity(owner, observed.identity);
+  if (comparison === 'dead') return { ...details, state: 'exited', reason: 'pid_reused' };
+  if (comparison !== 'live') return { ...details, state: 'unknown', reason: 'identity_incompatible' };
   if (owner.commandHash !== observed.identity.commandHash) return { ...details, state: 'unknown', reason: 'command_changed' };
   return { ...details, state: 'same-owner', reason: 'identity_match' };
 }
@@ -158,62 +239,88 @@ export async function waitForFixtureOwnerExit(owner, timeoutMs, {
   }
 }
 
-function fixtureErrorPayload(output) {
-  const lines = String(output || '').split(/\r?\n/);
-  let start = null, standalone = false, quoted = false, escaped = false;
-  const stack = [];
-  for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
-    const line = lines[lineIndex];
-    for (let offset = 0; offset < line.length; offset += 1) {
-      const char = line[offset];
-      if (start === null) {
-        if (char !== '{' && char !== '[') continue;
-        start = lineIndex;
-        standalone = line.slice(0, offset).trim() === '';
-      }
-      if (quoted) {
-        if (escaped) escaped = false;
-        else if (char === '\\') escaped = true;
-        else if (char === '"') quoted = false;
-        continue;
-      }
-      if (char === '"') quoted = true;
-      else if (char === '{' || char === '[') stack.push(char);
-      else if (char === '}' || char === ']') {
-        if (stack.pop() !== (char === '}' ? '{' : '[')) return null;
-        if (stack.length) continue;
-        // Consume arrays and prefixed JSON blocks as a unit, so their nested
-        // objects can never masquerade as independent CLI error documents.
-        if (standalone && line.slice(offset + 1).trim() === '') {
-          try {
-            const parsed = JSON.parse(lines.slice(start, lineIndex + 1).join('\n'));
-            if (parsed && !Array.isArray(parsed) && parsed.error &&
-                typeof parsed.error === 'object' && !Array.isArray(parsed.error)) return parsed;
-          } catch {}
-        }
-        start = null;
-      }
-    }
-  }
-  return null;
-}
-
-export function fixtureDownResult(result) {
-  // Public --json failures share stderr with Node warnings. Accept only whole
-  // independent JSON objects; ordinary output never enters the diagnostic.
-  const payload = fixtureErrorPayload(result.stdout) || fixtureErrorPayload(result.stderr);
+function fixtureCliFailurePayload(output) {
+  if (typeof output !== 'string' || Buffer.byteLength(output) > 64 * 1024) return null;
+  const text = output.trim();
+  const parse = value => {
+    try {
+      const payload = JSON.parse(value);
+      return payload?.ok === false && !Array.isArray(payload) && payload.error && typeof payload.error === 'object' &&
+        !Array.isArray(payload.error) ? payload : null;
+    } catch { return null; }
+  };
+  const direct = parse(text);
+  if (direct) return direct;
+  // Node warnings can precede or follow the CLI's complete JSON document.
+  // Strip only bounded, recognized edge lines; never scan arbitrary logs for
+  // inner objects, which could turn a nested error into the CLI failure.
+  const lines = text.split(/\r?\n/);
+  let first = 0, last = lines.length, warningLines = 0, warningBytes = 0;
+  const warning = line =>
+    /^\(node:\d+\) (?:\[[A-Z][A-Z0-9_]*\] )?(?:[A-Za-z]+Warning|Warning):/.test(line) ||
+    /^\(Use (?:`node --trace-(?:warnings|deprecation) \.\.\.`|node --trace-(?:warnings|deprecation)(?: \.\.\.)?) to show where the warning was created\)$/.test(line);
+  const strip = line => {
+    const trimmed = line.trim();
+    if (trimmed && !warning(trimmed)) return false;
+    if (trimmed) warningLines += 1;
+    warningBytes += Buffer.byteLength(line) + 1;
+    return true;
+  };
+  while (first < last && strip(lines[first])) first += 1;
+  while (first < last && strip(lines[last - 1])) last -= 1;
+  if (warningLines > 8 || warningBytes > 4096) return null;
+  return parse(lines.slice(first, last).join('\n'));
+}
+
+function fixtureCliResultParts(result) {
+  // --json failures are written with console.error; stdout is retained as a
+  // compatibility fallback for fixtures. Raw output never enters diagnostics.
+  const stderrFailure = fixtureCliFailurePayload(result.stderr);
+  const stdoutFailure = fixtureCliFailurePayload(result.stdout);
+  const payload = stderrFailure || stdoutFailure;
   const extra = payload?.error?.extra || payload?.error || {};
   const code = payload?.error?.code || result.error?.code;
-  const numeric = ['pid', 'elapsedMs', 'timeoutMs'];
-  return {
+  const diagnostic = {
     status: Number.isSafeInteger(result.status) ? result.status : null,
-    signal: /^SIG[A-Z0-9]{1,12}$/.test(result.signal || '') ? result.signal : null,
+    signal: typeof result.signal === 'string' && Object.hasOwn(os.constants.signals, result.signal) ? result.signal : null,
     code: typeof code === 'string' && /^[A-Z][A-Z0-9_]{0,79}$/.test(code) ? code : null,
-    extra: Object.fromEntries(numeric.filter(key => typeof extra[key] === 'number' &&
-      Number.isFinite(extra[key]) && extra[key] >= 0).map(key => [key, extra[key]]))
+    source: stderrFailure ? 'stderr' : stdoutFailure ? 'stdout' : result.error?.code ? 'spawn' : null,
+    stdoutBytes: typeof result.stdout === 'string' ? Buffer.byteLength(result.stdout) : 0,
+    stderrBytes: typeof result.stderr === 'string' ? Buffer.byteLength(result.stderr) : 0
+  };
+  return { diagnostic, extra };
+}
+
+export function fixtureDownResult(result) {
+  const { diagnostic, extra } = fixtureCliResultParts(result);
+  const numeric = ['pid', 'elapsedMs', 'timeoutMs', 'stopElapsedMs', 'confirmationMs'];
+  return {
+    ...diagnostic,
+    extra: {
+      ...Object.fromEntries(numeric.filter(key => typeof extra[key] === 'number' &&
+        Number.isFinite(extra[key]) && extra[key] >= 0).map(key => [key, extra[key]])),
+      ...(['live', 'dead', 'unknown'].includes(extra.state) ? { state: extra.state } : {}),
+      ...(['evidence_unavailable', 'exit_unconfirmed', 'pointer_cleanup_failed', 'pointer_changed'].includes(extra.stopPhase)
+        ? { stopPhase: extra.stopPhase } : {})
+    }
   };
 }
 
+function fixtureCommandResult(result, operation) {
+  // Only this explicit fixture operation opts in. Never copy command arguments,
+  // error messages, output, URLs or peer identifiers into public annotations.
+  if (operation !== 'broadcast' || !result || typeof result !== 'object') return null;
+  const { diagnostic, extra } = fixtureCliResultParts(result);
+  const context = Object.fromEntries(['elapsedMs', 'timeoutMs'].filter(key =>
+    Number.isSafeInteger(extra[key]) && extra[key] >= 0).map(key => [key, extra[key]]));
+  if (Number.isSafeInteger(extra.status) && extra.status >= 100 && extra.status <= 599) context.status = extra.status;
+  if (extra.method === 'GET' || extra.method === 'POST') context.method = extra.method;
+  const route = typeof extra.path === 'string' ? extra.path.split(/[?#]/, 1)[0] : '';
+  if (route === '/api/sessions') context.path = route;
+  else if (/^\/api\/sessions\/[^/?#]+\/input$/.test(route)) context.path = '/api/sessions/:peer/input';
+  return Object.freeze({ operation, ...diagnostic, extra: Object.freeze(context) });
+}
+
 export function fixtureStopEnvironment(base) {
   const local = { ...base, HCC_RUNTIME_LOCAL_ONLY: '1' };
   delete local.HCC_RUNTIME_URL;
@@ -239,6 +346,13 @@ function rememberRuntimePid(pid) {
 function collectRuntimeDiagnostic(extra = {}) {
   const diagnostic = { stage: currentStage, pid: runtimePid,
     owner: observeFixtureOwner(runtimeOwner), pointerExists: fs.existsSync(path.join(root, '.hello-cc', 'runtime.json')), ...extra };
+  let logFd;
+  try {
+    logFd = fs.openSync(path.join(root, '.hello-cc', 'web.log'), 'r');
+    const size = fs.fstatSync(logFd).size, bytes = Buffer.alloc(Math.min(size, 65536));
+    fs.readSync(logFd, bytes, 0, bytes.length, Math.max(0, size - bytes.length));
+    diagnostic.shutdownPhases = parseShutdownDiagnostics(bytes.toString('utf8'), runtimePid);
+  } catch {} finally { if (logFd !== undefined) fs.closeSync(logFd); }
   try {
     const db = new DatabaseSync(path.join(root, '.hello-cc', 'mesh.db'), { readOnly: true, timeout: 200 });
     try { diagnostic.events = db.prepare('SELECT id, type FROM events ORDER BY id DESC LIMIT 12').all(); }
@@ -260,6 +374,10 @@ function canonicalPath(value) {
   catch { return path.resolve(value); }
 }
 
+export function isRegressionEntry(entry = process.argv[1], filename = import.meta.filename) {
+  return Boolean(entry) && canonicalPath(entry) === canonicalPath(filename);
+}
+
 function samePath(a, b) {
   return canonicalPath(a) === canonicalPath(b);
 }
@@ -296,7 +414,7 @@ function run(command, args, options = {}) {
   });
   if (result.status !== 0) {
     const output = [result.stdout, result.stderr].filter(Boolean).join('\n').trim();
-    fail(`${commandText(command, args)} failed${output ? `\n${output}` : ''}`);
+    fail(`${commandText(command, args)} failed${output ? `\n${output}` : ''}`, result, options.diagnosticOperation);
   }
   return result.stdout || '';
 }
@@ -1601,11 +1719,13 @@ function currentRuntimeUrl(route, params = {}) {
   return runtimeUrl(currentRuntime(), route, params);
 }
 
-function runtimeFetch(route, options = {}, params = {}) {
-  const runtime = currentRuntime();
-  const headers = { ...(options.headers || {}), 'X-HCC-API-Version': '2' };
-  if (runtime.token) headers.Authorization = `Bearer ${runtime.token}`;
-  return fetch(runtimeUrl(runtime, route, params), { ...options, headers });
+export function runtimeFetch(route, options = {}, params = {}) {
+  return withFixtureHttpDiagnostic(route, options, () => {
+    const runtime = currentRuntime();
+    const headers = { ...(options.headers || {}), 'X-HCC-API-Version': '2' };
+    if (runtime.token) headers.Authorization = `Bearer ${runtime.token}`;
+    return fetch(runtimeUrl(runtime, route, params), { ...options, headers });
+  });
 }
 
 function directTlsRequest(runtime, route, options = {}) {
@@ -1613,6 +1733,7 @@ function directTlsRequest(runtime, route, options = {}) {
   const body = options.body === undefined || options.body === null ? null : String(options.body);
   return new Promise((resolve, reject) => {
     const req = https.request({
+      agent: false,
       method: options.method || 'GET',
       hostname: url.hostname,
       port: url.port || 443,
@@ -1700,17 +1821,37 @@ async function waitForFile(file, expected, label = file) {
   ensureFile(file, expected);
 }
 
-async function waitForFileContent(file, expected, label = file) {
-  const deadline = Date.now() + 10000;
+async function waitForFileContent(file, expected, label = file, { diagnostics = null, ownedReentryOutput = false } = {}) {
+  const startedAt = Date.now();
+  const deadline = startedAt + 10000;
   let actual = '(missing)';
+  let lastReadAt = null;
   while (Date.now() < deadline) {
     if (fs.existsSync(file)) {
+      lastReadAt = Date.now();
       actual = fs.readFileSync(file, 'utf8').trim();
       if (actual === expected) break;
     }
     await sleep(100);
   }
+  let finalObservation = null;
+  if (actual !== expected && ownedReentryOutput) {
+    finalObservation = readOwnedReentryOutputAtDeadline(file, expected, deadline, Date.now());
+    if (finalObservation.matched) actual = expected;
+  }
   if (actual !== expected) {
+    if (diagnostics) {
+      const detail = JSON.stringify({ ...diagnostics(), wait: {
+        started_at_ms: startedAt, deadline_ms: deadline, last_read_at_ms: lastReadAt,
+        final_observation: finalObservation
+      } });
+      if (process.env.GITHUB_ACTIONS === 'true') {
+        const escaped = detail.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+        process.stderr.write(`::error title=Shim regression diagnostic::${escaped}\n`);
+      } else {
+        process.stderr.write(`Shim regression diagnostic: ${detail}\n`);
+      }
+    }
     fail(`timed out waiting for ${label}\nexpected: ${expected}\nactual: ${actual}`);
   }
   ensureFile(file, expected);
@@ -1751,9 +1892,9 @@ function assertHtmlCsp(response, html, label) {
     ? "default-src 'self'; " +
       `script-src 'self' 'nonce-${nonce}'; ` +
       "style-src 'self' 'unsafe-inline'; " +
-      "img-src 'self' data:; " +
+      "img-src 'self' data: blob:; " +
       "connect-src 'self' ws: wss:; " +
-      "object-src 'none'; base-uri 'none'; frame-ancestors 'none'"
+      "object-src 'none'; base-uri 'none'; frame-ancestors 'none'; frame-src 'self' blob:"
     : '';
   if (!nonce || policy !== expected) {
     fail(`${label} missing complete nonce CSP: ${policy || '(missing)'}`);
@@ -1775,34 +1916,10 @@ async function waitForProcessExit(pid, label, timeoutMs = 5000) {
 }
 
 async function expectWebSocketMarker(peer, marker) {
-  await new Promise((resolve, reject) => {
-    let sawSnapshot = false;
-    let sawMarker = false;
-    const ws = trackTerminalControl(new WebSocket(runtimeWsUrl(peer), runtimeWsOptions()));
-    const timer = setTimeout(() => {
-      try { ws.terminate(); } catch {}
-      reject(new Error(`${peer} websocket timeout`));
-    }, TERMINAL_WEBSOCKET_TIMEOUT_MS);
-    ws.on('message', (raw) => {
-      const msg = JSON.parse(String(raw));
-      if (msg.type === 'snapshot') {
-        sawSnapshot = true;
-        claimTerminalControl(ws).then(() => ws.send(JSON.stringify({
-          type: 'input', data: `echo ${marker}\r`, action_token: ws.hccActionToken,
-          epoch: ws.hccControl.epoch
-        }))).catch(reject);
-      }
-      if (['snapshot', 'data', 'replace'].includes(msg.type) && String(msg.data || '').includes(marker)) {
-        sawMarker = true;
-      }
-      if (sawSnapshot && sawMarker) {
-        clearTimeout(timer);
-        releaseTerminalControl(ws);
-        ws.close();
-        resolve();
-      }
-    });
-    ws.on('error', (err) => { clearTimeout(timer); reject(err); });
+  const ws = trackTerminalControl(new WebSocket(runtimeWsUrl(peer), runtimeWsOptions()));
+  await waitForTerminalMarker(ws, marker, {
+    claim: signal => claimTerminalControl(ws, { signal }),
+    release: () => releaseTerminalControl(ws), timeoutMs: TERMINAL_WEBSOCKET_TIMEOUT_MS
   });
 }
 
@@ -1812,31 +1929,44 @@ function trackTerminalControl(ws) {
   ws.on('message', (raw) => {
     let message;
     try { message = JSON.parse(String(raw)); } catch { return; }
+    if (!message || typeof message !== 'object') return;
     if (message.action_token) ws.hccActionToken = message.action_token;
     if (message.control) ws.hccControl = message.control;
   });
   return ws;
 }
 
-async function claimTerminalControl(ws) {
+export async function claimTerminalControl(ws, { signal } = {}) {
+  const aborted = () => Object.assign(new Error('terminal control claim aborted'), { code: 'TERMINAL_CONTROL_ABORTED' });
+  if (signal?.aborted) throw aborted();
   if (ws.hccControl?.can_control) return ws.hccControl;
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => finish(new Error('terminal control claim timeout')), 5000);
+    let settled = false;
     const finish = (error = null) => {
+      if (settled) return;
+      settled = true;
       clearTimeout(timer);
       ws.off('message', onMessage);
+      signal?.removeEventListener('abort', onAbort);
       if (error) reject(error);
       else resolve(ws.hccControl);
     };
     const onMessage = (raw) => {
+      if (settled) return;
       let message;
       try { message = JSON.parse(String(raw)); } catch { return; }
+      if (!message || typeof message !== 'object') return;
       if (message.type === 'error') finish(new Error(`terminal control claim failed: ${JSON.stringify(message.error)}`));
       else if (message.type === 'control' && message.control?.can_control) finish();
     };
+    const onAbort = () => finish(aborted());
     ws.on('message', onMessage);
-    ws.send(JSON.stringify({ type: 'control', action: 'claim', action_token: ws.hccActionToken,
-      epoch: ws.hccControl?.epoch, force: true }));
+    signal?.addEventListener('abort', onAbort, { once: true });
+    try {
+      ws.send(JSON.stringify({ type: 'control', action: 'claim', action_token: ws.hccActionToken,
+        epoch: ws.hccControl?.epoch, force: true }));
+    } catch (error) { finish(error); }
   });
 }
 
@@ -1949,24 +2079,60 @@ async function fetchTerminalSnapshot(peer, params = {}) {
   });
 }
 
-async function issueBrowserSessionCookie() {
+function browserSessionCookie(setCookie, endpoint, { expired = false } = {}) {
+  const url = new URL(endpoint);
+  const protocol = url.protocol.slice(0, -1);
+  const effectivePort = url.port || (protocol === 'https' ? '443' : '80');
+  const expectedName = `hcc_sid_v2_${protocol}_${effectivePort}`;
+  const match = String(setCookie).match(/^([^=;\s]+)=([^;]*)/);
+  if (!match || match[1] !== expectedName || (expired ? match[2] !== '' : !match[2])) {
+    fail(`browser session cookie did not match endpoint scope ${expectedName} (expired=${expired})`);
+  }
+  return { name: match[1], sid: match[2], cookie: `${match[1]}=${match[2]}` };
+}
+
+async function selectCookieProject(baseUrl, cookie, projectRoot = root, {
+  signal, origin = new URL(baseUrl).origin, headers = {}
+} = {}) {
+  const url = new URL('/api/projects/select', baseUrl);
+  url.searchParams.set('root', projectRoot);
+  const response = await fetch(url, {
+    method: 'POST',
+    headers: {
+      ...headers,
+      Cookie: cookie,
+      Origin: origin,
+      'X-HCC-API-Version': '2'
+    },
+    signal
+  });
+  const selected = await response.json();
+  if (!response.ok || !selected.project_identity) {
+    fail(`cookie project selection failed: status=${response.status} body=${JSON.stringify(selected)}`);
+  }
+  return selected.project_identity;
+}
+
+async function issueBrowserSessionCookie({ signal, selectProject = true } = {}) {
   const runtime = currentRuntime();
   const baseUrl = runtime.base_url || `http://127.0.0.1:${port}`;
   const response = await fetch(new URL('/login', baseUrl), {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ token: runtime.token || '' }),
+    signal,
     redirect: 'manual'
   });
   const setCookie = response.headers.get('set-cookie') || '';
-  const sid = setCookie.match(/hcc_sid=([^;]+)/)?.[1] || '';
-  if (response.status !== 302 || !sid) {
-    fail(`browser session login failed: status=${response.status} cookie=${setCookie}`);
+  if (response.status !== 302) {
+    fail(`browser session login failed: status=${response.status}`);
   }
-  return { baseUrl, origin: new URL(baseUrl).origin, sid };
+  const auth = browserSessionCookie(setCookie, baseUrl);
+  const projectIdentity = selectProject ? await selectCookieProject(baseUrl, auth.cookie, root, { signal }) : null;
+  return { baseUrl, origin: new URL(baseUrl).origin, ...auth, projectIdentity };
 }
 
-async function cookieRuntimeFetch(route, auth, options = {}, params = {}) {
+export async function cookieRuntimeFetch(route, auth, options = {}, params = {}) {
   const url = new URL(route, auth.baseUrl);
   for (const [key, value] of Object.entries(params)) {
     if (value !== undefined && value !== null) url.searchParams.set(key, String(value));
@@ -1974,9 +2140,10 @@ async function cookieRuntimeFetch(route, auth, options = {}, params = {}) {
   return fetch(url, {
     ...options,
     headers: {
-      Cookie: `hcc_sid=${auth.sid}`,
+      Cookie: auth.cookie,
       Origin: auth.origin,
       'X-HCC-API-Version': '2',
+      ...(auth.projectIdentity ? { 'X-HCC-Root-Identity': auth.projectIdentity } : {}),
       ...(options.headers || {})
     }
   });
@@ -1990,8 +2157,9 @@ async function cookieRuntimeFetchWithoutOrigin(route, auth, options = {}, params
   return fetch(url, {
     ...options,
     headers: {
-      Cookie: `hcc_sid=${auth.sid}`,
+      Cookie: auth.cookie,
       'X-HCC-API-Version': '2',
+      ...(auth.projectIdentity ? { 'X-HCC-Root-Identity': auth.projectIdentity } : {}),
       ...(options.headers || {})
     }
   });
@@ -2017,9 +2185,10 @@ async function expectSocketMarkerAfter(ws, marker, action) {
   });
 }
 
-async function openCookieTerminalWebSocket(peer, sid, params = {}) {
+async function openCookieTerminalWebSocket(peer, cookie, params = {}, selectedProjectIdentity = null) {
   const runtime = currentRuntime();
   const baseUrl = runtime.base_url || `http://127.0.0.1:${port}`;
+  const projectIdentity = selectedProjectIdentity || await selectCookieProject(baseUrl, cookie, params.root || root);
   const url = new URL(`/ws/terminal/${encodeURIComponent(peer)}`, baseUrl);
   url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
   url.searchParams.set('api_version', '2');
@@ -2030,8 +2199,9 @@ async function openCookieTerminalWebSocket(peer, sid, params = {}) {
     let settled = false;
     const ws = trackTerminalControl(new WebSocket(url, {
       headers: {
-        Cookie: `hcc_sid=${sid}`,
-        Origin: new URL(baseUrl).origin
+        Cookie: cookie,
+        Origin: new URL(baseUrl).origin,
+        'X-HCC-Root-Identity': projectIdentity
       }
     }));
     const timer = setTimeout(() => {
@@ -2039,7 +2209,7 @@ async function openCookieTerminalWebSocket(peer, sid, params = {}) {
       settled = true;
       try { ws.terminate(); } catch {}
       reject(new Error(`${peer} cookie websocket snapshot timeout`));
-    }, 5000);
+    }, COOKIE_WEBSOCKET_SNAPSHOT_TIMEOUT_MS);
     const rejectBeforeSnapshot = (err) => {
       if (settled) return;
       settled = true;
@@ -2071,12 +2241,12 @@ async function assertLogoutClosesCookieWebSocket(peer, params = {}) {
     redirect: 'manual'
   });
   const setCookie = login.headers.get('set-cookie') || '';
-  const sid = setCookie.match(/hcc_sid=([^;]+)/)?.[1] || '';
-  if (login.status !== 302 || !sid) {
-    fail(`cookie websocket login failed: status=${login.status} cookie=${setCookie}`);
+  if (login.status !== 302) {
+    fail(`cookie websocket login failed: status=${login.status}`);
   }
+  const auth = browserSessionCookie(setCookie, baseUrl);
 
-  const ws = await openCookieTerminalWebSocket(peer, sid, params);
+  const ws = await openCookieTerminalWebSocket(peer, auth.cookie, params);
   try {
     const closed = new Promise((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error(`${peer} cookie websocket logout close timeout`)), 5000);
@@ -2093,7 +2263,7 @@ async function assertLogoutClosesCookieWebSocket(peer, params = {}) {
       fetch(new URL('/logout', baseUrl), {
         method: 'POST',
         headers: {
-          Cookie: `hcc_sid=${sid}`,
+          Cookie: auth.cookie,
           Origin: origin
         }
       }),
@@ -2102,11 +2272,12 @@ async function assertLogoutClosesCookieWebSocket(peer, params = {}) {
     if (logout.status !== 204 || !(logout.headers.get('set-cookie') || '').includes('Max-Age=0')) {
       fail(`cookie websocket logout did not expire its session: status=${logout.status}`);
     }
+    browserSessionCookie(logout.headers.get('set-cookie') || '', baseUrl, { expired: true });
     if (closeResult.code !== 4001 || ws.readyState !== WebSocket.CLOSED) {
       fail(`cookie websocket logout did not close the established socket with 4001:\n${JSON.stringify({ closeResult, readyState: ws.readyState }, null, 2)}`);
     }
     const revoked = await fetch(new URL('/api/runtime', baseUrl), {
-      headers: { Cookie: `hcc_sid=${sid}`, 'X-HCC-API-Version': '2' }
+      headers: { Cookie: auth.cookie, 'X-HCC-API-Version': '2' }
     });
     if (revoked.status !== 401) {
       fail(`cookie websocket logout left the old cookie authorized: ${revoked.status}`);
@@ -2120,7 +2291,7 @@ async function assertLogoutClosesCookieWebSocket(peer, params = {}) {
 
 async function assertEvictionClosesCookieWebSocket(peer, params = {}) {
   const auth = await issueBrowserSessionCookie();
-  const ws = await openCookieTerminalWebSocket(peer, auth.sid, params);
+  const ws = await openCookieTerminalWebSocket(peer, auth.cookie, params, auth.projectIdentity);
   try {
     const closed = new Promise((resolve, reject) => {
       const timer = setTimeout(() => reject(new Error(`${peer} cookie websocket eviction close timeout`)), 10000);
@@ -2134,14 +2305,14 @@ async function assertEvictionClosesCookieWebSocket(peer, params = {}) {
       });
     });
     for (let offset = 0; offset < 256; offset += 32) {
-      await Promise.all(Array.from({ length: 32 }, () => issueBrowserSessionCookie()));
+      await Promise.all(Array.from({ length: 32 }, () => issueBrowserSessionCookie({ selectProject: false })));
     }
     const closeResult = await closed;
     if (closeResult.code !== 4001 || !closeResult.reason.includes('session limit reached')) {
       fail(`cookie websocket eviction did not close with 4001:\n${JSON.stringify(closeResult, null, 2)}`);
     }
     const revoked = await fetch(new URL('/api/runtime', auth.baseUrl), {
-      headers: { Cookie: `hcc_sid=${auth.sid}`, 'X-HCC-API-Version': '2' }
+      headers: { Cookie: auth.cookie, 'X-HCC-API-Version': '2' }
     });
     if (revoked.status !== 401) fail(`evicted cookie remained authorized: ${revoked.status}`);
   } finally {
@@ -2621,7 +2792,7 @@ async function assertShimIgnoresGlobalRuntime(generateShim) {
       started_at: Math.floor(Date.now() / 1000),
       global_runtime: true
     };
-    fs.writeFileSync(path.join(fakeHome, '.hello-cc', 'runtime.json'), JSON.stringify(globalRuntime, null, 2));
+    fs.writeFileSync(path.join(fakeHome, '.hello-cc', 'runtime.json'), JSON.stringify(globalRuntime, null, 2), { mode: 0o600 });
 
     const hccWrapper = path.join(testDir, 'hcc-wrapper');
     fs.writeFileSync(hccWrapper, `#!/usr/bin/env bash\nexec ${sh(process.execPath)} ${sh(hccBin)} "$@"\n`, { mode: 0o755 });
@@ -2731,7 +2902,7 @@ async function cookieSessionExpiryWorkflow() {
     env: {
       ...env,
       HCC_REGRESSION_TEST: '1',
-      HCC_REGRESSION_WEB_SESSION_TTL_SEC: '1'
+      HCC_REGRESSION_WEB_SESSION_TTL_SEC: String(COOKIE_EXPIRY_FIXTURE_TTL_SEC)
     }
   });
   try {
@@ -2757,40 +2928,56 @@ async function cookieSessionExpiryWorkflow() {
     }
 
     const auth = await issueBrowserSessionCookie();
-    ws = await openCookieTerminalWebSocket(expirySessionId, auth.sid, { root });
+    ws = await openCookieTerminalWebSocket(expirySessionId, auth.cookie, { root }, auth.projectIdentity);
     if (!ws.hccActionToken) fail('short-TTL cookie terminal snapshot omitted its action token');
-    const closed = new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error('expired cookie websocket close timeout')), 5000);
+    const expiryWindow = createCookieExpiryWindow(COOKIE_EXPIRY_FIXTURE_TTL_SEC * 1000);
+    // Listen before waiting so spontaneous expiry is retained. Start the close
+    // deadline only after expiry, and defer rejection to avoid an unhandled
+    // error while this fixture is still waiting for the cookie to expire.
+    const closed = new Promise(resolve => {
       ws.once('close', (code, reason) => {
-        clearTimeout(timer);
         resolve({ code, reason: String(reason || '') });
       });
-      ws.once('error', (err) => {
-        clearTimeout(timer);
-        reject(err);
-      });
+      ws.once('error', error => resolve({ error }));
     });
 
-    await sleep(1200);
+    // A probe-only cookie is issued after the target cookie. Observing its
+    // expiry must not revoke the target socket before its input guard runs.
+    const probeAuth = await expiryWindow.prepare(signal => issueBrowserSessionCookie({ signal }));
+    // Cookie expiry uses the server's wall clock, which can advance more slowly
+    // than this fixture's timer. Observe real expiry within the original total
+    // TTL + close budget before sending input on this same socket.
+    await expiryWindow.waitForHttpExpiry(signal =>
+      cookieRuntimeFetch('/api/runtime', probeAuth, { signal }));
+    if (ws.readyState !== WebSocket.OPEN) fail('target cookie websocket closed before the expired-input check');
     ws.send(JSON.stringify({
       type: 'input',
       data: `echo ${marker}\r`,
       action_token: ws.hccActionToken,
       epoch: ws.hccControl.epoch
     }));
-    const closeResult = await closed;
-    if (closeResult.code !== 4001 || !closeResult.reason.includes('session expired')) {
-      fail(`expired cookie websocket did not close with 4001/session expired:\n${JSON.stringify(closeResult, null, 2)}`);
-    }
-
+    let closeError = null;
+    const closeResult = await expiryWindow.waitForClose(closed).catch(error => {
+      closeError = error; return null;
+    });
+    // Inspect the HTTP and input boundaries even if the close observation
+    // times out; a missing close event must not hide accepted terminal input.
     const expiredHttp = await cookieRuntimeFetch('/api/runtime', auth);
+    const snapshot = await fetchTerminalSnapshot(expirySessionId, { root });
+    const inputRejected = !snapshot.includes(marker);
     if (expiredHttp.status !== 401) {
       fail(`expired browser cookie remained authorized over HTTP: ${expiredHttp.status}`);
     }
-    const snapshot = await fetchTerminalSnapshot(expirySessionId, { root });
-    if (snapshot.includes(marker)) {
+    if (!inputRejected) {
       fail(`expired browser cookie executed terminal input after expiry:\n${snapshot}`);
     }
+    if (closeError) {
+      fail(`expired cookie websocket close failed: code=${closeError.code || 'CLOSE_FAILED'} httpStatus=${expiredHttp.status} inputRejected=${inputRejected}`);
+    }
+    if (closeResult.error) throw closeResult.error;
+    if (closeResult.code !== 4001 || !closeResult.reason.includes('session expired')) {
+      fail(`expired cookie websocket did not close with 4001/session expired:\n${JSON.stringify(closeResult, null, 2)}`);
+    }
   } finally {
     if (ws && ws.readyState !== WebSocket.CLOSED) {
       try { ws.terminate(); } catch {}
@@ -2829,8 +3016,8 @@ async function webSecretRedactionWorkflow() {
       body: JSON.stringify({ token: secret }),
       redirect: 'manual'
     });
-    const sid = (login.headers.get('set-cookie') || '').match(/hcc_sid=([^;]+)/)?.[1] || '';
-    if (login.status !== 302 || !sid) fail(`redaction login failed with status ${login.status}`);
+    if (login.status !== 302) fail(`redaction login failed with status ${login.status}`);
+    const auth = browserSessionCookie(login.headers.get('set-cookie') || '', runtime.base_url);
 
     const create = await runtimeFetch('/api/sessions', {
       method: 'POST',
@@ -2844,7 +3031,7 @@ async function webSecretRedactionWorkflow() {
       })
     }, { root });
     if (!create.ok) fail(`redaction PTY create failed with status ${create.status}`);
-    terminalWs = await openCookieTerminalWebSocket(sessionId, sid, { root });
+    terminalWs = await openCookieTerminalWebSocket(sessionId, auth.cookie, { root });
     terminalWs.send(JSON.stringify({ type: 'resize', cols: 90, rows: 28,
       action_token: terminalWs.hccActionToken, epoch: terminalWs.hccControl.epoch }));
 
@@ -2861,7 +3048,7 @@ async function webSecretRedactionWorkflow() {
 
     const invalidCookie = await fetch(new URL('/api/runtime', runtime.base_url), {
       headers: {
-        Cookie: `hcc_sid=${secret}`,
+        Cookie: `${auth.name}=${secret}`,
         'X-HCC-API-Version': '2'
       }
     });
@@ -2940,12 +3127,15 @@ async function assertWebWrapperParentSurvives() {
   }
 }
 
-async function stopRuntime() {
+async function stopRuntime({ peerStops = [] } = {}) {
   if (!runtimePid) return;
   const owner = runtimeOwner;
   const before = observeFixtureOwner(owner);
+  const downStarted = performance.now();
   const down = fixtureDownResult(stopFixtureCli());
-  lastStopDiagnostic = { before, down, stack: new Error('stopRuntime').stack.split('\n').slice(1, 7), signals: [] };
+  const downDurationMs = Math.round(performance.now() - downStarted);
+  const afterDown = observeFixtureOwner(owner);
+  lastStopDiagnostic = { before, down, downDurationMs, afterDown, peerStops, stack: new Error('stopRuntime').stack.split('\n').slice(1, 7), signals: [] };
   try {
     await waitForFixtureOwnerExit(owner, 5000);
   } catch (err) {
@@ -3174,14 +3364,14 @@ async function setupRegression() {
     { headers: { Accept: 'text/html' } }
   );
   const directTlsSetCookie = String(directTlsExchange.headers['set-cookie']?.[0] || '');
-  const directTlsSid = directTlsSetCookie.match(/hcc_sid=([^;]+)/)?.[1] || '';
-  if (directTlsExchange.status !== 302 || !directTlsSid || !directTlsSetCookie.includes('Secure')) {
-    fail(`direct TLS login did not issue a Secure cookie: status=${directTlsExchange.status} cookie=${directTlsSetCookie}`);
+  if (directTlsExchange.status !== 302 || !directTlsSetCookie.includes('Secure')) {
+    fail(`direct TLS login did not issue a Secure cookie: status=${directTlsExchange.status}`);
   }
+  const directTlsAuth = browserSessionCookie(directTlsSetCookie, directTlsRuntime.base_url);
   const directTlsLogout = await directTlsRequest(directTlsRuntime, '/logout', {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${directTlsSid}`,
+      Cookie: directTlsAuth.cookie,
       Origin: new URL(directTlsRuntime.base_url).origin
     }
   });
@@ -3189,8 +3379,9 @@ async function setupRegression() {
   if (directTlsLogout.status !== 204 ||
       !directTlsLogoutCookie.includes('Max-Age=0') ||
       !directTlsLogoutCookie.includes('Secure')) {
-    fail(`direct TLS logout did not expire a Secure cookie: status=${directTlsLogout.status} cookie=${directTlsLogoutCookie}`);
+    fail(`direct TLS logout did not expire a Secure cookie: status=${directTlsLogout.status}`);
   }
+  browserSessionCookie(directTlsLogoutCookie, directTlsRuntime.base_url, { expired: true });
   await stopRuntime();
 
   await assertWebWrapperParentSurvives();
@@ -3298,26 +3489,28 @@ async function setupRegression() {
   });
   if (exchange.status !== 302) fail(`browser-nav ?token did not exchange to a cookie redirect: ${exchange.status}`);
   const setCookie = exchange.headers.get('set-cookie') || '';
-  if (!setCookie.includes('hcc_sid=') || !setCookie.includes('HttpOnly') || !setCookie.includes('SameSite=Lax')) {
-    fail(`exchange did not set an HttpOnly SameSite cookie: ${setCookie}`);
-  }
-  if (setCookie.includes('Secure')) fail(`plaintext LAN exchange issued a Secure cookie: ${setCookie}`);
-  const sidMatch = setCookie.match(/hcc_sid=([^;]+)/);
-  if (!sidMatch) fail(`exchange did not return a session id: ${setCookie}`);
-  const sid = sidMatch[1];
-  // (b) API with the session cookie → 200
-  const withCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: `hcc_sid=${sid}`, 'X-HCC-API-Version': '2' } });
+  if (!setCookie.includes('HttpOnly') || !setCookie.includes('SameSite=Lax')) {
+    fail('exchange did not set an HttpOnly SameSite cookie');
+  }
+  if (setCookie.includes('Secure')) fail('plaintext LAN exchange issued a Secure cookie');
+  const browserAuth = browserSessionCookie(setCookie, baseUrl);
+  // (b) API with the session cookie and explicitly selected project → 200
+  const cookieProjectIdentity = await selectCookieProject(baseUrl, browserAuth.cookie);
+  const withCookie = await fetch(`${baseUrl}/api/runtime`, {
+    headers: { Cookie: browserAuth.cookie, 'X-HCC-API-Version': '2', 'X-HCC-Root-Identity': cookieProjectIdentity }
+  });
   if (!withCookie.ok) fail(`API with session cookie required auth: ${withCookie.status}`);
   // (c) API with a bogus session cookie → 401
-  const bogusCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: 'hcc_sid=bogus', 'X-HCC-API-Version': '2' } });
+  const bogusCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: `${browserAuth.name}=bogus`, 'X-HCC-API-Version': '2' } });
   if (bogusCookie.status !== 401) fail(`API with bogus session cookie did not 401: ${bogusCookie.status}`);
   // (d) cookie-authenticated writes require an exact same-origin Origin header.
   const crossOriginCookieWrite = await fetch(`${baseUrl}/api/csrf-probe`, {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${sid}`,
+      Cookie: browserAuth.cookie,
       Origin: `http://127.0.0.1:${port + 1}`,
       'X-HCC-API-Version': '2',
+      'X-HCC-Root-Identity': cookieProjectIdentity,
       'Content-Type': 'application/json'
     },
     body: '{}'
@@ -3332,9 +3525,10 @@ async function setupRegression() {
   const sameOriginCookieWrite = await fetch(`${baseUrl}/api/csrf-probe`, {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${sid}`,
+      Cookie: browserAuth.cookie,
       Origin: new URL(baseUrl).origin,
       'X-HCC-API-Version': '2',
+      'X-HCC-Root-Identity': cookieProjectIdentity,
       'Content-Type': 'application/json'
     },
     body: '{}'
@@ -3359,23 +3553,25 @@ async function setupRegression() {
     body: JSON.stringify({ token: cookieToken }),
     redirect: 'manual'
   });
-  if (loginPost.status !== 302 || !(loginPost.headers.get('set-cookie') || '').includes('hcc_sid=')) {
+  if (loginPost.status !== 302) {
     fail(`POST /login did not issue a session cookie: ${loginPost.status}`);
   }
+  browserSessionCookie(loginPost.headers.get('set-cookie') || '', baseUrl);
 
   // (h) logout revokes the opaque session and expires the browser cookie.
   const logout = await fetch(`${baseUrl}/logout`, {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${sid}`,
+      Cookie: browserAuth.cookie,
       Origin: new URL(baseUrl).origin
     }
   });
   const logoutCookie = logout.headers.get('set-cookie') || '';
-  if (logout.status !== 204 || !logoutCookie.includes('hcc_sid=') || !logoutCookie.includes('Max-Age=0')) {
-    fail(`logout did not revoke and expire the session cookie: status=${logout.status} cookie=${logoutCookie}`);
+  if (logout.status !== 204 || !logoutCookie.includes('Max-Age=0')) {
+    fail(`logout did not revoke and expire the session cookie: status=${logout.status}`);
   }
-  const revokedCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: `hcc_sid=${sid}`, 'X-HCC-API-Version': '2' } });
+  browserSessionCookie(logoutCookie, baseUrl, { expired: true });
+  const revokedCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: browserAuth.cookie, 'X-HCC-API-Version': '2' } });
   if (revokedCookie.status !== 401) fail(`logout left the old session cookie authorized: ${revokedCookie.status}`);
 
   // (i) trusted loopback reverse-proxy headers mark issued and expired cookies
@@ -3404,14 +3600,24 @@ async function setupRegression() {
     redirect: 'manual'
   });
   const proxySetCookie = proxyExchange.headers.get('set-cookie') || '';
-  const proxySid = proxySetCookie.match(/hcc_sid=([^;]+)/)?.[1] || '';
-  if (proxyExchange.status !== 302 || !proxySid || !proxySetCookie.includes('Secure')) {
-    fail(`trusted proxy login did not issue a Secure cookie: status=${proxyExchange.status} cookie=${proxySetCookie}`);
+  if (proxyExchange.status !== 302 || !proxySetCookie.includes('Secure')) {
+    fail(`trusted proxy login did not issue a Secure cookie: status=${proxyExchange.status}`);
   }
+  const proxyAuth = browserSessionCookie(proxySetCookie, proxyOrigin);
+  const proxyProjectIdentity = await selectCookieProject(baseUrl, proxyAuth.cookie, root, {
+    origin: proxyOrigin, headers: proxyHeaders
+  });
+  const withProxyCookie = await fetch(`${baseUrl}/api/runtime`, {
+    headers: {
+      ...proxyHeaders, Cookie: proxyAuth.cookie, 'X-HCC-API-Version': '2',
+      'X-HCC-Root-Identity': proxyProjectIdentity
+    }
+  });
+  if (!withProxyCookie.ok) fail(`trusted proxy API rejected its session cookie: ${withProxyCookie.status}`);
   const proxyLogout = await fetch(`${baseUrl}/logout`, {
     method: 'POST',
     headers: {
-      Cookie: `hcc_sid=${proxySid}`,
+      Cookie: proxyAuth.cookie,
       Origin: proxyOrigin,
       'X-Forwarded-Host': 'public.example.test:9443',
       'X-Forwarded-Proto': 'https'
@@ -3419,9 +3625,12 @@ async function setupRegression() {
   });
   const proxyLogoutCookie = proxyLogout.headers.get('set-cookie') || '';
   if (proxyLogout.status !== 204 || !proxyLogoutCookie.includes('Max-Age=0') || !proxyLogoutCookie.includes('Secure')) {
-    fail(`trusted proxy logout did not expire a Secure cookie: status=${proxyLogout.status} cookie=${proxyLogoutCookie}`);
+    fail(`trusted proxy logout did not expire a Secure cookie: status=${proxyLogout.status}`);
   }
-  const revokedProxyCookie = await fetch(`${baseUrl}/api/runtime`, { headers: { Cookie: `hcc_sid=${proxySid}`, 'X-HCC-API-Version': '2' } });
+  browserSessionCookie(proxyLogoutCookie, proxyOrigin, { expired: true });
+  const revokedProxyCookie = await fetch(`${baseUrl}/api/runtime`, {
+    headers: { ...proxyHeaders, Cookie: proxyAuth.cookie, 'X-HCC-API-Version': '2' }
+  });
   if (revokedProxyCookie.status !== 401) fail(`trusted proxy logout left the old cookie authorized: ${revokedProxyCookie.status}`);
 
   // A forwarded authority other than the pinned public origin is untrusted.
@@ -3436,7 +3645,7 @@ async function setupRegression() {
   });
   const defaultPortProxySetCookie = defaultPortProxyExchange.headers.get('set-cookie') || '';
   if (defaultPortProxyExchange.status !== 403 || defaultPortProxySetCookie) {
-    fail(`unpinned proxy authority received a session: status=${defaultPortProxyExchange.status} cookie=${defaultPortProxySetCookie}`);
+    fail(`unpinned proxy authority received a session: status=${defaultPortProxyExchange.status} setCookie=${Boolean(defaultPortProxySetCookie)}`);
   }
   const unpinnedProxyLogin = await fetch(`${baseUrl}/login`, {
     method: 'POST',
@@ -3461,7 +3670,7 @@ async function setupRegression() {
     });
     const spoofedLanCookie = spoofedLanExchange.headers.get('set-cookie') || '';
     if (spoofedLanExchange.status !== 403 || spoofedLanCookie) {
-      fail(`non-loopback forwarded spoof received a session: status=${spoofedLanExchange.status} cookie=${spoofedLanCookie}`);
+      fail(`non-loopback forwarded spoof received a session: status=${spoofedLanExchange.status} setCookie=${Boolean(spoofedLanCookie)}`);
     }
   } else {
     log('non-loopback forwarded spoof: no non-loopback IPv4 interface; focused boundary coverage retained');
@@ -4606,16 +4815,24 @@ async function multiProjectWebWorkflow() {
     fail(`detected API did not return liveness metadata:\n${JSON.stringify(detectedJson, null, 2)}`);
   }
 
-  const htmlResponse = await fetch(currentRuntimeUrl('/'));
-  const html = await htmlResponse.text();
-  const startForm = html.match(/<form\b[^>]*\bid="startForm"[^>]*>[\s\S]*?<\/form>/)?.[0];
-  if (!startForm) fail('web form missing startForm');
-  // Approval details may display the working directory. The simplified launch
-  // form must still derive it from the selected project instead of an input.
-  if (startForm.includes('Working directory') || /<input\b[^>]*(?:id|name)="(?:cwd|workdir)"/.test(startForm)) {
-    fail('web launch form still exposes Working directory');
-  }
-  for (const forbidden of ['Alias optional', 'Role tag', 'Command<input', 'commandbar', 'lineInput', 'Send text to active terminal']) {
+  const htmlResponse = await withFixtureHttpDiagnostic('/', {}, () => fetch(currentRuntimeUrl('/')));
+  const pageHtml = await htmlResponse.text();
+  if (!pageHtml.includes('type="module" src="/assets/web/browser/core.mjs"')) fail('web page missing ESM bootstrap');
+  const moduleSources = [];
+  for (const asset of ['browser/core.mjs', 'ui-agent-start.mjs']) {
+    const response = await runtimeFetch('/assets/web/' + asset);
+    if (!response.ok || !response.headers.get('content-type')?.includes('javascript')) fail('web ESM asset did not load: ' + asset);
+    moduleSources.push(await response.text());
+  }
+  const html = pageHtml + '\n' + moduleSources.join('\n');
+  const startFormHtml = html.match(/<form\b[^>]*\bid="startForm"[^>]*>[\s\S]*?<\/form>/)?.[0];
+  if (!startFormHtml) fail('web form missing simplified session form');
+  // A current-directory label in an approval or session details is valid;
+  // obsolete creation inputs must be checked inside the creation form.
+  for (const forbidden of ['Alias optional', 'Role tag', 'Command<input']) {
+    if (startFormHtml.includes(forbidden)) fail(`web form still exposes ${forbidden}`);
+  }
+  for (const forbidden of ['commandbar', 'lineInput', 'Send text to active terminal']) {
     if (html.includes(forbidden)) fail(`web form still exposes ${forbidden}`);
   }
   for (const expected of [
@@ -4623,6 +4840,7 @@ async function multiProjectWebWorkflow() {
     'id="projectPath"',
     'id="addProjectBtn"',
     'id="startForm"',
+    'id="agentCwd"',
     'id="kind"',
     'id="sessionKindFilter"',
     'id="sessions"'
@@ -4666,7 +4884,7 @@ async function multiProjectWebWorkflow() {
       !html.includes("fetch('/logout', { method: 'POST', headers })")) {
     fail('web UI missing logout control or session revocation request');
   }
-  if (!html.includes('id="startMode"') || !html.includes('id="resumeArg"') || !html.includes('syncStartModeOptions') || !html.includes("mode === 'resume'")) {
+  if (!html.includes('id="startMode"') || !html.includes('id="resumeArg"') || !html.includes('syncStartModeOptions') || !html.includes("mode.value === 'resume'")) {
     fail('web form missing provider resume controls');
   }
   for (const expected of [
@@ -4921,7 +5139,7 @@ async function multiProjectWebWorkflow() {
     fail(`same-origin cookie administrator create failed or leaked its action token:\n${JSON.stringify(cookieCreated, null, 2)}`);
   }
 
-  const cookieAdminWs = await openCookieTerminalWebSocket(cookieAdminId, cookieAdmin.sid, { root });
+  const cookieAdminWs = await openCookieTerminalWebSocket(cookieAdminId, cookieAdmin.cookie, { root }, cookieAdmin.projectIdentity);
   try {
     if (!cookieAdminWs.hccActionToken) fail('cookie administrator terminal snapshot omitted its action token');
     const inputRoute = `/api/sessions/${encodeURIComponent(cookieAdminId)}/input`;
@@ -5733,7 +5951,7 @@ async function bufferGcArbitrationWorkflow() {
 
   const liveId = `gc-live-external-${testId}`;
   const liveFiles = ['out', 'in', 'resize', 'meta'].map((suffix) => path.join(rootBufs, `${liveId}.${suffix}`));
-  for (const file of liveFiles.slice(0, 3)) fs.writeFileSync(file, file.endsWith('.out') ? 'live\n' : '');
+  for (const file of liveFiles.slice(0, 3)) fs.writeFileSync(file, file.endsWith('.out') ? 'live\n' : '', { mode: 0o600 });
   const identity = inspectProcessIdentity(process.pid).identity;
   fs.writeFileSync(liveFiles[3], JSON.stringify({
     id: liveId,
@@ -5747,7 +5965,7 @@ async function bufferGcArbitrationWorkflow() {
     wrapper_identity: identity,
     cols: 120,
     rows: 40
-  }));
+  }), { mode: 0o600 });
   await waitFor(async () => {
     const data = await (await runtimeFetch('/api/sessions', {}, { root })).json();
     return (data.sessions || []).some((session) => session.id === liveId);
@@ -5756,8 +5974,8 @@ async function bufferGcArbitrationWorkflow() {
 
   const legacyId = `gc-legacy-${testId}`;
   const legacyFiles = ['out', 'in', 'resize', 'meta'].map((suffix) => path.join(rootBufs, `${legacyId}.${suffix}`));
-  for (const file of legacyFiles.slice(0, 3)) fs.writeFileSync(file, '');
-  fs.writeFileSync(legacyFiles[3], JSON.stringify({ id: legacyId, pid: process.pid, wrapper_pid: process.pid }));
+  for (const file of legacyFiles.slice(0, 3)) fs.writeFileSync(file, '', { mode: 0o600 });
+  fs.writeFileSync(legacyFiles[3], JSON.stringify({ id: legacyId, pid: process.pid, wrapper_pid: process.pid }), { mode: 0o600 });
   for (const file of legacyFiles) fs.utimesSync(file, oldTime, oldTime);
   await waitFor(async () => {
     const data = await (await runtimeFetch('/api/sessions', {}, { root })).json();
@@ -5767,7 +5985,7 @@ async function bufferGcArbitrationWorkflow() {
   const siblingLiveId = `gc-sibling-external-${testId}`;
   const siblingLiveFiles = ['out', 'in', 'resize', 'meta']
     .map((suffix) => path.join(siblingBufs, `${siblingLiveId}.${suffix}`));
-  for (const file of siblingLiveFiles.slice(0, 3)) fs.writeFileSync(file, '');
+  for (const file of siblingLiveFiles.slice(0, 3)) fs.writeFileSync(file, '', { mode: 0o600 });
   fs.writeFileSync(siblingLiveFiles[3], JSON.stringify({
     id: siblingLiveId,
     kind: 'shell',
@@ -5780,7 +5998,7 @@ async function bufferGcArbitrationWorkflow() {
     wrapper_identity: identity,
     cols: 120,
     rows: 40
-  }));
+  }), { mode: 0o600 });
   await waitFor(async () => {
     const data = await (await runtimeFetch('/api/sessions', {}, { root: secondProjectRoot })).json();
     return (data.sessions || []).some((session) => session.id === siblingLiveId);
@@ -6079,7 +6297,7 @@ async function bufferGcArbitrationWorkflow() {
         base_url: server?.baseUrl || 'http://127.0.0.1:1',
         token: 'regression-token'
       };
-      fs.writeFileSync(path.join(isolatedRoot, '.hello-cc', 'runtime.json'), JSON.stringify(pointer));
+      fs.writeFileSync(path.join(isolatedRoot, '.hello-cc', 'runtime.json'), JSON.stringify(pointer), { mode: 0o600 });
       const gc = run(process.execPath, [hccBin, '--root', isolatedRoot, '--json', 'gc', '--older-than', '0', '--yes'], { env: isolatedEnv });
       const payload = JSON.parse(gc);
       if (!fs.existsSync(orphan) || Number(payload.data?.deferred_buf_files || 0) < 1) {
@@ -6437,13 +6655,53 @@ async function shimTmuxWorkflow() {
     cwd: root,
     env: { ...shimEnv, HCC_REG_VALUE: 'shim-second' }
   });
-  parsePane(restarted);
+  const restartedPane = parsePane(restarted);
   const secondEnvFile = path.join(outDir, 'shim-env-second');
   hcc(['inject', peer, `printf '%s\\n' "$HCC_REG_VALUE" > ${secondEnvFile}`]);
   await waitForFile(secondEnvFile, 'shim-second', 'shim env restart');
   const reentryFile = path.join(outDir, 'shim-reentry');
-  hcc(['inject', peer, `HCC_FAKE_STAY_ALIVE=0 HCC_REG_VALUE=shim-third ${sh(shim)} --resume shim-regression-session > ${sh(reentryFile)} 2>&1`]);
-  await waitForFileContent(reentryFile, 'fake-claude --resume shim-regression-session', 'shim tmux pane re-entry');
+  const reentryTrace = path.join(outDir, 'shim-reentry-stages');
+  const reentryStatus = path.join(outDir, 'shim-reentry-status');
+  const reentryProvider = path.join(outDir, 'shim-reentry-provider');
+  const reentryProbe = pathToFileURL(path.join(repoRoot, 'scripts', 'shim-reentry-probe.mjs')).href;
+  const reentryEventId = withMeshDb(db => db.prepare('SELECT MAX(id) AS id FROM events').get().id || 0);
+  const reentryStarted = Date.now();
+  hcc(['inject', peer, `printf 'started\\n' > ${sh(reentryStatus)}; HCC_FAKE_STAY_ALIVE=0 HCC_REG_VALUE=shim-third HCC_FAKE_LOG=${sh(reentryProvider)} HCC_REGRESSION_REENTRY_TRACE=${sh(reentryTrace)} HCC_REGRESSION_REENTRY_BIN=${sh(hccBin)} NODE_OPTIONS="\${NODE_OPTIONS:+\${NODE_OPTIONS} }"${sh(`--import=${reentryProbe}`)} ${sh(shim)} --resume shim-regression-session > ${sh(reentryFile)} 2>&1; printf '%s\\n' "$?" >> ${sh(reentryStatus)}`]);
+  await waitForFileContent(reentryFile, 'fake-claude --resume shim-regression-session', 'shim tmux pane re-entry', {
+    ownedReentryOutput: true,
+    diagnostics: () => {
+      // Query only this fixture's pane and fixed event types. Full terminal
+      // captures, process arguments, request bodies and environment are excluded.
+      const paneResult = spawnSync('tmux', ['display-message', '-p', '-t', restartedPane,
+        '#{pane_id}|#{pane_dead}|#{pane_current_command}'], {
+        env, encoding: 'utf8', timeout: 1000, maxBuffer: 1024, stdio: ['ignore', 'pipe', 'ignore']
+      });
+      const paneParts = (paneResult.stdout || '').trim().split('|');
+      const pane = {
+        found: paneResult.status === 0 && /^%\d+$/.test(paneParts[0] || ''),
+        dead: paneParts[1] === '1',
+        command: /^[A-Za-z0-9_.-]{1,40}$/.test(paneParts[2] || '') ? paneParts[2] : 'unknown'
+      };
+      let status = [];
+      try { status = fs.readFileSync(reentryStatus, 'utf8').slice(0, 32).trim().split('\n'); } catch {}
+      let events = [];
+      let db;
+      try {
+        db = new DatabaseSync(path.join(root, '.hello-cc', 'mesh.db'), { timeout: 250, readOnly: true });
+        events = db.prepare(`SELECT type, created_at FROM events WHERE id > ? AND actor = ?
+          AND type IN ('peer.attach.requested', 'tmux.session.attached', 'tmux.session.detached', 'tmux.session.exited')
+          ORDER BY id DESC LIMIT 8`).all(reentryEventId, peer);
+      } catch { events = [{ state: 'unavailable' }]; }
+      finally { if (db) db.close(); }
+      return {
+        elapsed_ms: Date.now() - reentryStarted,
+        shell_started: status[0] === 'started',
+        shell_exit: /^\d{1,3}$/.test(status[1] || '') ? Number(status[1]) : null,
+        provider_entered: fs.existsSync(reentryProvider),
+        pane, stages: readReentryTrace(reentryTrace), events
+      };
+    }
+  });
   hcc(['peer', 'stop', peer]);
 
   const exitedResume = 'shim-exited-session';
@@ -6563,15 +6821,18 @@ async function askBroadcastWorkflow() {
   }
   await waitForFile(dispatchFile, 'DISPATCH_OK', 'task dispatch injection');
   const broadcastFile = path.join(outDir, 'broadcast-ok');
-  hcc(['broadcast', `echo BROADCAST_OK > ${broadcastFile}`, '--from', 'human', '--inject']);
+  hccJson(['broadcast', `echo BROADCAST_OK > ${broadcastFile}`, '--from', 'human', '--inject'], { diagnosticOperation: 'broadcast' });
   await waitForFile(broadcastFile, 'BROADCAST_OK', 'broadcast injection');
 }
 
 async function downGcPackWorkflow() {
   log('[9/13] down/gc/pack');
-  hccMaybe(['peer', 'stop', 'shell-a']);
-  hccMaybe(['peer', 'stop', 'shell-b']);
-  await stopRuntime();
+  const peerStops = ['shell-a', 'shell-b'].map(peer => {
+    const started = performance.now();
+    const result = fixtureDownResult(hccMaybe(['--json', 'peer', 'stop', peer]));
+    return { ...result, durationMs: Math.round(performance.now() - started) };
+  });
+  await stopRuntime({ peerStops });
   await waitFor(() => !fs.existsSync(path.join(root, '.hello-cc', 'runtime.json')), 'runtime cleanup', 5000);
   hcc(['gc', '--older-than', '0', '--yes']);
   const pack = JSON.parse(run('npm', ['pack', '--dry-run', '--json']));
@@ -6820,7 +7081,7 @@ async function syntaxAndHelp() {
   const integrationShimScriptSource = fs.readFileSync(path.join(repoRoot, 'lib', 'integrations', 'shims', 'script.mjs'), 'utf8');
   const shellPathSource = fs.readFileSync(path.join(repoRoot, 'lib', 'shell-path.mjs'), 'utf8');
   const webPeerActionsSource = fs.readFileSync(path.join(repoRoot, 'lib', 'web', 'peer-actions.mjs'), 'utf8');
-  const webUiTemplateSource = fs.readFileSync(path.join(repoRoot, 'lib', 'web', 'ui-template.mjs'), 'utf8');
+  const webUiTemplateSource = ['ui-template.mjs', 'browser/core.mjs'].map(name => fs.readFileSync(path.join(repoRoot, 'lib', 'web', name), 'utf8')).join('\n');
   const tmuxSafetySource = fs.readFileSync(path.join(repoRoot, 'lib', 'core', 'peers', 'tmux-safety.mjs'), 'utf8');
   // cmdWeb moved whole to lib/web/runtime-main.mjs; subsystem modules extend it
   const cmdWebSource = [
@@ -6884,15 +7145,15 @@ async function syntaxAndHelp() {
     'sameResolvedPath(global.root, ctx.root)',
     'sameResolvedPath(global.db, ctx.dbPath)',
     'async function stopOrphanWebRuntimes(',
-    'await stopOrphanWebRuntimes(ctx, existing.pid || null);',
-    'await stopOrphanWebRuntimes(ctx);'
+    'await stopOrphanWebRuntimes(boundCtx, existing.pid || null);',
+    'await stopOrphanWebRuntimes(boundCtx);'
   ]) {
     if (!webStartupSource.includes(expected)) fail(`web startup guard missing: ${expected}`);
   }
   for (const expected of [
     'function listTmuxPanesOnce()',
     'let autoAttachScanInFlight = false;',
-    'if (autoAttachScanInFlight) return;',
+    'if (isStopping() || autoAttachScanInFlight) return;',
     'const paneByPid = new Map();',
     'const attached = attachedTmuxState(ctx, db);',
     'function killOldTmuxForRebind(',
@@ -7252,7 +7513,7 @@ async function syntaxAndHelp() {
       !hccSource.includes("} from '../web/http.mjs'") ||
       !hccSource.includes("import * as webUiTemplate from '../web/ui-template.mjs'") ||
       !hccSource.includes('const VERSION = PACKAGE_META.version') ||
-      !hccSource.includes('writeGuidanceForRoot(ctx.root)')) {
+      !hccSource.includes('writeGuidanceForRoot(ctx.root, { expectedSnapshot: ctx.initialRootIdentity })')) {
     fail('CLI still has duplicated package metadata, cli args, DB schema helpers, CLI runtime helpers, coordination state helpers, format helpers, runtime paths/state helpers, runtime client helpers, project context helpers, handoff helpers, timeline helpers, task liveness helpers, automation helpers, state render helpers, help text helpers, message store helpers, task store helpers, task CLI helpers, session launch helpers, provider command helpers, peer binding helpers, tmux helpers, lock helpers, team planning helpers, peer identity helpers, project registry helpers, web runtime/HTTP/UI helpers, or guidance wiring');
   }
   for (const expected of [
@@ -7740,7 +8001,7 @@ async function syntaxAndHelp() {
       fail('runtime state clearRuntime did not remove the reused-pid global pointer');
     }
 
-    fs.writeFileSync(globalRuntimeFile, '{bad');
+    fs.writeFileSync(globalRuntimeFile, '{bad', { mode: 0o600 });
     if (runtimeState.readGlobalRuntimeFile() !== null) {
       fail('runtime state readGlobalRuntimeFile did not reject invalid JSON');
     }
@@ -9688,7 +9949,7 @@ async function syntaxAndHelp() {
     process.env.HOME = tlsHome;
     const webTls = await import(path.join(repoRoot, 'lib', 'web', 'tls.mjs'));
     tlsCredentials = webTls.ensureSelfSignedCert();
-    const tlsDir = path.join(tlsHome, '.hello-cc', 'tls');
+    const tlsDir = path.join(fs.realpathSync(tlsHome), '.hello-cc', 'tls');
     const currentPointerPath = path.join(tlsDir, 'current.json');
     const currentGeneration = JSON.parse(fs.readFileSync(currentPointerPath, 'utf8')).generation;
     const generationNames = {
@@ -9724,27 +9985,28 @@ async function syntaxAndHelp() {
     }
     const originalTlsCert = tlsCredentials.cert;
     const originalTlsCertPath = tlsCredentials.certPath;
-    const originalReadFileSync = fs.readFileSync;
-    let pointerReads = 0;
+    const originalLstatSync = fs.lstatSync;
+    let pointerChecks = 0;
     let pointerSwitchedBeforeDelete = false;
-    fs.readFileSync = (file, ...args) => {
+    fs.lstatSync = (file, ...args) => {
       if (path.resolve(String(file)) === path.resolve(currentPointerPath)) {
-        pointerReads += 1;
-        // Read 1 validates the old current; read 2 starts cleanup; read 3 is
-        // the deletion-time TOCTOU guard for the stale switched-current row.
-        if (pointerReads === 3) {
+        pointerChecks += 1;
+        // The private reader lstat-checks before and after each descriptor
+        // read. Checks 1-2 validate the old current; 3-4 start cleanup; check
+        // 5 is the deletion-time guard for the stale switched-current row.
+        if (pointerChecks === 5) {
           const nextPointerPath = path.join(tlsDir, `.current-regression-${testId}.tmp`);
           fs.writeFileSync(nextPointerPath, `${JSON.stringify({ generation: generationNames.switchedCurrent })}\n`, { mode: 0o600 });
           fs.renameSync(nextPointerPath, currentPointerPath);
           pointerSwitchedBeforeDelete = true;
         }
       }
-      return originalReadFileSync(file, ...args);
+      return originalLstatSync(file, ...args);
     };
     try {
       tlsCredentials = webTls.ensureSelfSignedCert();
     } finally {
-      fs.readFileSync = originalReadFileSync;
+      fs.lstatSync = originalLstatSync;
     }
     const publishedGeneration = JSON.parse(fs.readFileSync(currentPointerPath, 'utf8')).generation;
     const remainingGenerations = fs.readdirSync(tlsDir, { withFileTypes: true })
@@ -9760,14 +10022,14 @@ async function syntaxAndHelp() {
     ].sort();
     if (tlsCredentials.cert !== originalTlsCert ||
         tlsCredentials.certPath !== originalTlsCertPath ||
-        !pointerSwitchedBeforeDelete || pointerReads < 4 ||
+        !pointerSwitchedBeforeDelete || pointerChecks < 6 ||
         publishedGeneration !== generationNames.switchedCurrent ||
         !fs.existsSync(path.join(tlsDir, generationNames.initialCurrent, '.published')) ||
         !fs.existsSync(path.join(tlsDir, generationNames.switchedCurrent, '.published')) ||
         !fs.existsSync(path.join(tlsDir, generationNames.activeCreating, '.creating')) ||
         fs.existsSync(path.join(tlsDir, generationNames.deadCreating)) ||
         JSON.stringify(remainingGenerations) !== JSON.stringify(expectedRemainingGenerations)) {
-      fail(`TLS generation cleanup violated current/previous/candidate lifecycle protection:\n${JSON.stringify({ generationNames, pointerReads, pointerSwitchedBeforeDelete, publishedGeneration, remainingGenerations }, null, 2)}`);
+      fail(`TLS generation cleanup violated current/previous/candidate lifecycle protection:\n${JSON.stringify({ generationNames, pointerChecks, pointerSwitchedBeforeDelete, publishedGeneration, remainingGenerations }, null, 2)}`);
     }
   } finally {
     if (savedTlsHome === undefined) delete process.env.HOME;
@@ -10328,9 +10590,9 @@ async function processEvidenceWorkflow() {
   const legacyProcess = spawn('sleep', ['30'], { stdio: 'ignore' });
   const legacyFiles = ['out', 'in', 'resize', 'meta']
     .map((suffix) => path.join(externalDir, `${legacyExternalId}.${suffix}`));
-  fs.writeFileSync(legacyFiles[0], 'legacy external\n');
-  fs.writeFileSync(legacyFiles[1], '');
-  fs.writeFileSync(legacyFiles[2], '');
+  fs.writeFileSync(legacyFiles[0], 'legacy external\n', { mode: 0o600 });
+  fs.writeFileSync(legacyFiles[1], '', { mode: 0o600 });
+  fs.writeFileSync(legacyFiles[2], '', { mode: 0o600 });
   fs.writeFileSync(legacyFiles[3], JSON.stringify({
     id: legacyExternalId,
     kind: 'shell',
@@ -10341,7 +10603,7 @@ async function processEvidenceWorkflow() {
     wrapper_pid: legacyProcess.pid,
     cols: 120,
     rows: 40
-  }));
+  }), { mode: 0o600 });
   await waitFor(async () => {
     const data = await (await runtimeFetch('/api/sessions', {}, { root })).json();
     return (data.sessions || []).some((session) => session.id === legacyExternalId);
@@ -11387,7 +11649,7 @@ async function main() {
   log('FULL_REGRESSION_OK');
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === import.meta.filename) main().catch((err) => {
+if (isRegressionEntry()) main().catch((err) => {
   const failure = fixtureFailureDiagnostic(err);
   const diagnostic = collectRuntimeDiagnostic({ failure, stop: lastStopDiagnostic });
   process.stderr.write(`[regression failure diagnostic] ${diagnostic}\n`);