@volter/world-runtime 3.0.37 → 3.0.39

package/dist/src/runtime.js

@@ -1,3 +1,4 @@
+import { errorMessage } from "./error-message.js";
 import { materializeBrowserFiles, clearBrowserFiles } from "./browsers.js";
 import { claimEnvOutput, publishEnvOutput } from "./env-output.js";
 import { offSignal } from "./signals.js";
@@ -11,21 +12,25 @@ import { get as httpGet } from 'node:http';
 import { siblingScript } from "./sibling.js";
 import { commandLifetime, commandProcessGroup, CommandRetirementError } from "./command-lifetime.js";
 import { superviseWorldRun } from "./run-task.js";
-import { survivingOwnedGroups } from "./process-groups.js";
+import { processStarts, survivingOwnedGroups } from "./process-groups.js";
+import { spawnIdentity, signalOwnedProcess, signalChild, signalHeldChild, processBirth, childIdentity } from './process-signal.mjs';
+import { readGuestProcesses, releaseGuestProcesses } from './guest-processes.mjs';
 import { randomUUID, createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { isIP } from 'node:net';
 import { allocatePort } from "./tcp-port.js";
 import { constants as osConstants, hostname as osHostname } from 'node:os';
-import { accessSync, appendFileSync, chmodSync, closeSync, constants as fsConstants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync, existsSync } from 'node:fs';
+import { accessSync, appendFileSync, chmodSync, closeSync, constants as fsConstants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, writeSync, existsSync, fchmodSync, ftruncateSync } from 'node:fs';
 import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import { packFacts } from "./pack-facts.js";
+import { assertOwnedRealPath, ownedPath } from "./owned-path.js";
+import { isEnvironmentName } from "./schema.js";
 import { infraConnections, parseInfraDefinition } from "./pglite-backing.js";
 import { describeServiceEnd, readServiceEnd, serviceOutput } from "./service-exit.js";
 import { Socket } from 'node:net';
 import { getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
 import { loadWorldConfig } from "./configs.js";
-import { createWorldNetworkPolicy, WORLD_NETWORK_POLICY_ENV } from '@volter/world-core/network-policy';
+import { createWorldNetworkPolicy, parseWorldNetworkPolicy, normalizeWorldNetwork, intersectWorldNetwork, WORLD_NETWORK_POLICY_ENV } from '@volter/world-core/network-policy';
 import { overlayPackFactsFile, resolveServicePackage } from "./catalog.js";
 import { fakeEnvValue } from "./fixture-env.js";
 import { APP_URL_ENV, ISSUE_ENV_PREFIX, MINT_ENV } from "./schema.js";
@@ -34,7 +39,24 @@ import { inertInjectEnvWarnings } from "./inject-map.js";
 import { activeVendorMap, ensureCa, hostHasRawEgress, opensslAvailable, proxyEnvFor, startRedirectProxy, tearDownCa } from "./redirect-proxy.js";
 import { CaTrustError, sessionTrustEnv } from "./ca-trust.js";
 import { checkedOwner, CONSUMER_HEARTBEAT_MS, createConsumer, refreshConsumer, releaseConsumer, removeConsumerRecord, worldConsumers } from "./consumers.js";
-import { assertLifecycleStartable, beginWorldLifecycle, handoffWorldLifecycle, recordWorldLifecycleEvent, releaseWorldLifecycle, retainWorldLifecycleForCleanup, hasWorldLifecycle, isWorldLifecycleRunning, lifecycleLogPath, releaseAbandonedWorldLifecycle } from "./lifecycle-record.js";
+import { assertLifecycleStartable, beginWorldLifecycle, handoffWorldLifecycle, recordWorldLifecycleEvent, releaseWorldLifecycle, retainWorldLifecycleForCleanup, hasWorldLifecycle, isWorldLifecycleRunning, lifecycleLogPath, releaseAbandonedWorldLifecycle, exitedWorldLifecyclePids } from "./lifecycle-record.js";
+// Births captured at actual spawn; retries never remeasure a retained PID.
+const spawnedIdentities = new Map();
+const spawnedChildren = new Map();
+function retainSpawn(child) {
+    if (!child.pid)
+        return Promise.resolve(undefined);
+    const pid = child.pid;
+    spawnedChildren.set(pid, child);
+    return childIdentity(child).then(identity => {
+        if (identity && spawnedChildren.get(pid) === child)
+            spawnedIdentities.set(pid, identity);
+        return identity;
+    });
+}
+function heldStarts() {
+    return Object.fromEntries([...spawnedIdentities].map(([pid, identity]) => [pid, identity.start]));
+}
 /** The latest `limit` bytes of a service log, reaching into its one rotation (`<log>.1`) when the current file is
  *  shorter: a readiness line printed just before a rotation is still found, and a poll never reads 64 MiB files. */
 function readServiceText(log, limit = 4 * 1024 * 1024) {
@@ -62,8 +84,8 @@ export function worldEventsPath(logs) {
  *  its output straight to `log` (capped, time-marked), its start and end are recorded there and in the World's events
  *  file, and it is handed a directory of its own for the log files it writes itself (VOLTER_WORLD_SERVICE_LOG_DIR).
  *  `ended` settles when the recorder exits, right after the service ends and its exit record is written. */
-function spawnRecorded(serviceId, command, args, cwd, env, log) {
-    const logDir = `${log.replace(/\.log$/, '')}.d`;
+function spawnRecorded(serviceId, command, args, cwd, env, log, boot) {
+    const logDir = ownedPath(dirname(log), `${basename(log).replace(/\.log$/, '')}.d`);
     mkdirSync(logDir, { recursive: true, mode: 0o700 });
     const out = openPrivateLog(log, 'a'); // the service's output and the recorder's records, appended
     const recorderEnv = { ...env, VOLTER_WORLD_SERVICE_ID: serviceId, VOLTER_WORLD_SERVICE_LOG: log,
@@ -78,9 +100,16 @@ function spawnRecorded(serviceId, command, args, cwd, env, log) {
         detached: true,
         stdio: ['ignore', out, out],
     });
-    closeSync(out);
     const ended = new Promise((resolveEnded) => { child.once('exit', () => resolveEnded()); child.once('error', () => resolveEnded()); });
-    return { child, ended };
+    const identity = retainSpawn(child);
+    if (child.pid) {
+        boot.pids.add(child.pid);
+        boot.handles.set(child.pid, child);
+    }
+    child.once('error', error => boot.fail(error));
+    boot.recordPids();
+    closeSync(out);
+    return { child, ended, identity };
 }
 /** A startup wait that fails as soon as the service ends, with the service's own account of its end (exit code or
  *  signal, last output) instead of a timeout that names neither. */
@@ -266,7 +295,8 @@ export function clockFile(root, name) {
     return join(instanceDir(root, name), 'clock');
 }
 export function instanceDir(root, name) {
-    return join(worldBaseDir(root), name);
+    assertSafeWorldName(name);
+    return ownedPath(worldBaseDir(root), name);
 }
 function instanceFile(root, name) {
     return join(instanceDir(root, name), 'instance.json');
@@ -279,10 +309,12 @@ function foregroundRunFile(root, name) {
  * a dot-prefixed sibling: world names must start with an alphanumeric, so `.locks` can never
  * collide with (or be wiped as) a world's instance dir. */
 function instanceLockFile(root, name) {
-    return join(worldBaseDir(root), '.locks', `${name}.lock`);
+    assertSafeWorldName(name);
+    return ownedPath(ownedPath(worldBaseDir(root), '.locks'), `${name}.lock`);
 }
 function stoppingFile(root, name) {
-    return join(worldBaseDir(root), '.locks', `${name}.stop.json`);
+    assertSafeWorldName(name);
+    return ownedPath(ownedPath(worldBaseDir(root), '.locks'), `${name}.stop.json`);
 }
 const SHARE_CLAIM_STALE_MS = 60_000;
 const SHARE_CLAIM_HEARTBEAT_MS = 5_000;
@@ -292,7 +324,8 @@ const SHARE_CLAIM_HEARTBEAT_MS = 5_000;
 // heartbeat, a REAL instant refreshed by the holder (a world's frozen clock cannot measure
 // liveness; this is host physics, not world time). Nothing here reads a process table.
 function sharingClaimFile(root, name) {
-    return join(worldBaseDir(root), '.locks', `${name}.share.json`);
+    assertSafeWorldName(name);
+    return ownedPath(ownedPath(worldBaseDir(root), '.locks'), `${name}.share.json`);
 }
 function readSharingClaim(path) {
     if (!existsSync(path))
@@ -409,15 +442,15 @@ function prepareBootForDown(root, name) {
             || !Number.isFinite(Date.parse(claim.at)))
             throw new Error('invalid boot claim');
     }
-    catch {
-        throw new Error(`World "${name}" has unreadable boot ownership; instance and lifecycle retained`);
+    catch (error) {
+        throw new Error(`World "${name}" has unreadable boot ownership; instance and lifecycle retained`, { cause: error });
     }
     try {
         process.kill(claim.pid, 0);
     }
     catch (error) {
         if (error.code !== 'ESRCH') {
-            throw new Error(`World "${name}" boot owner is uninspectable; instance and lifecycle retained`);
+            throw new Error(`World "${name}" boot owner is uninspectable; instance and lifecycle retained`, { cause: error });
         }
         rmSync(path); // the recorded booter cannot publish anything after this point
         return;
@@ -538,22 +571,163 @@ export function withoutVaultSignIn(env) {
  * the parent's, or the parent's when it declares none. Routing needs no rule: the parent's twin addresses pass through,
  * so a vendor the inner World does not twin reaches the parent's twin of it.
  */
-function networkOf(name, own, parentEnv = process.env) {
+function networkOf(name, own, recorded, parentEnv = process.env) {
     const serialized = parentEnv[WORLD_NETWORK_POLICY_ENV];
     let ceiling;
     if (serialized !== undefined) {
-        // an unreadable parent policy closes the child entirely, as it closes the parent
+        // An unreadable parent policy closes the child, including opaque transport permission.
         try {
-            ceiling = JSON.parse(serialized).egress ?? [];
+            ceiling = networkPermission(parseWorldNetworkPolicy(JSON.parse(serialized)));
         }
         catch {
-            ceiling = [];
+            ceiling = { egress: [] };
         }
     }
-    if (own === undefined && ceiling === undefined)
+    let network = own;
+    for (const limit of [recorded, ceiling])
+        if (limit !== undefined)
+            network = network === undefined ? limit : intersectWorldNetwork(network, limit);
+    if (network === undefined)
         return undefined;
-    const egress = own === undefined ? ceiling : ceiling === undefined ? own.egress : own.egress.filter((origin) => ceiling.includes(origin));
-    return { [WORLD_NETWORK_POLICY_ENV]: JSON.stringify(createWorldNetworkPolicy(name, { egress: [...egress] })) };
+    return { [WORLD_NETWORK_POLICY_ENV]: JSON.stringify(createWorldNetworkPolicy(name, network)) };
+}
+/** Strip the publication envelope before combining permissions (the config shape admits only these keys). */
+function networkPermission(policy) {
+    return { egress: policy.egress, phase: policy.phase, passthrough: policy.passthrough };
+}
+/** The boot permission, never a fallback to a mutable config. */
+export function recordedWorldNetwork(instance) {
+    try {
+        if (!Object.hasOwn(instance, 'networkCeiling'))
+            throw new Error();
+        const published = instance.env?.[WORLD_NETWORK_POLICY_ENV];
+        const bound = published === undefined ? undefined : parseWorldNetworkPolicy(JSON.parse(published));
+        if (bound && bound.world !== instance.name)
+            throw new Error();
+        const saved = instance.networkCeiling === 'unrestricted' ? undefined : normalizeWorldNetwork(instance.networkCeiling);
+        const permission = bound === undefined ? undefined : networkPermission(bound);
+        return saved === undefined ? permission : permission === undefined ? saved : intersectWorldNetwork(saved, permission);
+    }
+    catch {
+        throw new Error(`World boot record is incomplete or invalid: ${instanceFile(instance.root, instance.name)}`);
+    }
+}
+/** An absent stored ceiling is derived from this World's own config and retained bound environment. */
+function ceilingFromConfig(record, config) {
+    let ceiling = record.mode === 'sealed' ? { egress: [] } : config.network;
+    const published = record.env?.[WORLD_NETWORK_POLICY_ENV];
+    if (published !== undefined) {
+        const bound = parseWorldNetworkPolicy(JSON.parse(published));
+        if (bound.world !== record.name)
+            throw new Error();
+        const permission = networkPermission(bound);
+        ceiling = ceiling === undefined ? permission : intersectWorldNetwork(ceiling, permission);
+    }
+    return ceiling === undefined ? 'unrestricted' : normalizeWorldNetwork(ceiling);
+}
+/** A stopped receipt checks byte consistency before fields are read; it is not authentication. */
+export function readWorldBootRecord(name, root) {
+    return withFileLock(instanceLockFile(root, name), () => readWorldBootRecordLocked(name, root));
+}
+/** Ordinary reading completes derivable metadata and its receipt together under the instance lock. */
+function readWorldBootRecordLocked(name, root) {
+    const path = instanceFile(root, name);
+    const raw = getActiveWorldStore().read(path);
+    if (raw === null)
+        throw new Error(`World instance not found: ${name}`);
+    try {
+        const receiptPath = join(instanceDir(root, name), 'stopped.json');
+        const stopped = existsSync(receiptPath);
+        const receipt = stopped ? JSON.parse(readFileSync(receiptPath, 'utf8')) : undefined;
+        if (stopped && (receipt.instanceHash !== createHash('sha256').update(raw).digest('hex')
+            || typeof receipt.stoppedAt !== 'string' || !Number.isFinite(Date.parse(receipt.stoppedAt))))
+            throw new Error();
+        const record = JSON.parse(raw);
+        if (record.name !== name || typeof record.root !== 'string' || resolve(record.root) !== resolve(root)
+            || typeof record.createdAt !== 'string' || !Number.isFinite(Date.parse(record.createdAt))
+            || typeof record.config !== 'string' || !record.config || typeof record.configPath !== 'string' || !record.configPath
+            || !record.env || record.env.VOLTER_WORLD !== name || record.env.VOLTER_WORLD_MODE !== record.mode
+            || !record.dirs || record.dirs.instance !== instanceDir(root, name)
+            || record.dirs.data !== join(instanceDir(root, name), 'data') || record.dirs.logs !== join(instanceDir(root, name), 'logs')
+            || typeof record.envFile !== 'string' || !record.envFile || record.pidsFile !== join(instanceDir(root, name), 'pids')
+            || !record.services || typeof record.services !== 'object' || Array.isArray(record.services))
+            throw new Error();
+        assertMode(record.mode);
+        if (!stopped && !isWorldLifecycleRunning(root, name, record.createdAt))
+            throw new Error();
+        let completed = false;
+        if (!Object.hasOwn(record, 'instance')) {
+            record.instance = randomUUID();
+            completed = true;
+        }
+        if (typeof record.instance !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(record.instance))
+            throw new Error();
+        const needsConfig = !Object.hasOwn(record, 'networkCeiling')
+            || Object.values(record.services).some(service => service && !Object.hasOwn(service, 'branchState'));
+        const config = needsConfig ? loadWorldConfig(record.configPath, root).config : undefined;
+        if (config && config.id !== record.config)
+            throw new Error();
+        if (!Object.hasOwn(record, 'networkCeiling')) {
+            record.networkCeiling = ceilingFromConfig(record, config);
+            completed = true;
+        }
+        if (!Object.hasOwn(record, 'bootOwner')) {
+            if (!record.lifecycle && !record.resources)
+                throw new Error();
+            record.bootOwner = record.lifecycle?.owner ?? record.resources?.owner ?? null;
+            completed = true;
+        }
+        if (!(record.bootOwner === null || typeof record.bootOwner === 'string'))
+            throw new Error();
+        checkedOwner(record.bootOwner ?? undefined);
+        if (!record.lifecycle) {
+            record.lifecycle = { log: lifecycleLogPath(root, name), ...(record.bootOwner === null ? {} : { owner: record.bootOwner }) };
+            completed = true;
+        }
+        if (!Object.hasOwn(record.lifecycle, 'log')) {
+            record.lifecycle.log = lifecycleLogPath(root, name);
+            completed = true;
+        }
+        if (!Object.hasOwn(record.lifecycle, 'owner') && record.bootOwner !== null) {
+            record.lifecycle.owner = record.bootOwner;
+            completed = true;
+        }
+        if (record.lifecycle.log !== lifecycleLogPath(root, name) || (record.lifecycle.owner ?? null) !== record.bootOwner)
+            throw new Error();
+        if (!Object.hasOwn(record, 'bootServices')) {
+            record.bootServices = Object.keys(record.services);
+            completed = true;
+        }
+        if (!Array.isArray(record.bootServices) || record.bootServices.some(id => typeof id !== 'string')
+            || new Set(record.bootServices).size !== record.bootServices.length
+            || record.bootServices.length !== Object.keys(record.services).length
+            || record.bootServices.some(id => !Object.hasOwn(record.services, id)))
+            throw new Error();
+        for (const [id, service] of Object.entries(record.services)) {
+            if (!service || service.id !== id || !Array.isArray(service.command) || typeof service.type !== 'string')
+                throw new Error();
+            if (!Object.hasOwn(service, 'branchState')) {
+                const declared = config.services.find(item => item.id === id);
+                if (!declared)
+                    throw new Error();
+                service.branchState = declared.branchState ?? 'supported';
+                completed = true;
+            }
+            if (!['supported', 'unsupported'].includes(service.branchState ?? ''))
+                throw new Error();
+        }
+        recordedWorldNetwork(record);
+        if (completed) {
+            saveWorldInstance(record);
+            if (stopped)
+                writeTextAtomic(receiptPath, JSON.stringify({ ...receipt,
+                    instanceHash: createHash('sha256').update(readFileSync(path, 'utf8')).digest('hex') }) + '\n');
+        }
+        return record;
+    }
+    catch {
+        throw new Error(`World boot record is incomplete or invalid: ${path}`);
+    }
 }
 export function admittedEnv(strip, env = process.env) {
     const out = {};
@@ -665,23 +839,15 @@ async function waitForTcp(port, timeoutMs = 15_000, abort) {
 }
 function readPids(path) {
     const held = getActiveWorldStore().read(path);
-    if (held === null)
-        return [];
-    return held
-        .split(/\r?\n/)
-        .map((line) => Number(line.trim()))
-        .filter((pid) => Number.isInteger(pid) && pid > 0);
+    const guests = readGuestProcesses(dirname(path)).map(receipt => receipt.record.pid);
+    return [...new Set([...(held ?? '')
+                .split(/\r?\n/)
+                .map((line) => Number(line.trim()))
+                .filter((pid) => Number.isInteger(pid) && pid > 0), ...guests])];
 }
 function livePids(pids) {
-    return pids.filter((pid) => {
-        try {
-            process.kill(pid, 0);
-            return true;
-        }
-        catch (error) {
-            return error.code !== 'ESRCH';
-        }
-    });
+    // A recorded leader may have exited while its detached descendants still run.
+    return survivingOwnedGroups(pids);
 }
 function tunnelPids(instance) {
     return Object.values(instance.services)
@@ -702,13 +868,13 @@ function openPrivateLog(path, flags) {
 /** Record `pids` as the World's. `fresh` are the processes this very call has spawned: only their start times are
  *  measured anew; every other pid keeps the start time recorded when it was spawned (re-measuring it would bless
  *  whatever process holds that number now). */
-function writeOwnedPids(root, name, pids, fresh = []) {
+function writeOwnedPids(root, name, pids, fresh = [], births = heldStarts()) {
     const path = join(instanceDir(root, name), 'pids');
     withFileLock(`${instanceLockFile(root, name)}.pids`, () => {
         const retained = undeadPids(readPids(path));
         const merged = [...new Set([...retained, ...pids].filter(pid => Number.isInteger(pid) && pid > 0))];
         writeTextAtomic(path, `${merged.join('\n')}\n`);
-        recordIdentities(root, name, merged, fresh);
+        recordIdentities(root, name, merged, fresh, births);
     });
 }
 // ---- which process a recorded pid names -------------------------------------------------------------------------
@@ -718,54 +884,42 @@ function writeOwnedPids(root, name, pids, fresh = []) {
 function identityPath(root, name) {
     return join(instanceDir(root, name), 'pids.identity');
 }
-/** Each running pid's start time; a pid with no process is absent. Printed in one fixed zone and locale, so the same
- *  process reads the same whoever asks (`lstart` otherwise follows the caller's TZ and language). One `ps` per pid:
- *  given two or more pids, macOS `ps -p` walks the whole process table (measured 2026-09-30 on Darwin 25.4, 944
- *  processes: `/usr/bin/time -p ps -o pid=,lstart= -p 1,$$` 0.14–0.35 s, `… -p 1` 0.00 s), which every `status`
- *  paid. */
-function processStarts(pids) {
-    const starts = new Map();
-    if (!pids.length || process.platform === 'win32')
-        return starts;
-    if (process.platform === 'linux' && existsSync('/proc/self/stat')) {
-        // Linux: the start tick since boot (field 22), which a wall-clock step does not move (lstart would).
-        for (const pid of pids) {
-            try {
-                const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
-                starts.set(pid, `tick ${stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19]}`);
-            }
-            catch { /* no process */ }
-        }
-        return starts;
-    }
-    const env = { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' };
-    for (const pid of pids) {
-        const result = spawnSync('ps', ['-o', 'pid=,lstart=', '-p', String(pid)], { windowsHide: true, encoding: 'utf8', timeout: 1000, killSignal: 'SIGKILL', env });
-        const match = /^\s*(\d+)\s+(.+?)\s*$/.exec((result.stdout ?? '').trim());
-        if (match && Number(match[1]) === pid)
-            starts.set(pid, match[2]);
-    }
-    return starts;
-}
 function readIdentities(root, name) {
+    let known = {};
     try {
-        return JSON.parse(getActiveWorldStore().read(identityPath(root, name)) ?? '{}');
-    }
-    catch {
-        return {};
+        const value = JSON.parse(getActiveWorldStore().read(identityPath(root, name)) ?? '{}');
+        if (value && typeof value === 'object' && !Array.isArray(value))
+            known = Object.fromEntries(Object.entries(value).filter(([pid, start]) => Number.isInteger(Number(pid)) && Number(pid) > 0 && typeof start === 'string' && start.length > 0));
+    }
+    catch { /* Guest receipts below remain independently authoritative. */ }
+    const births = new Map();
+    for (const { record } of readGuestProcesses(instanceDir(root, name))) {
+        if (births.has(record.pid) && births.get(record.pid) !== record.start)
+            throw new Error('Conflicting guest spawn identities; ownership retained');
+        births.set(record.pid, record.start);
+    }
+    for (const [pid, start] of births) {
+        if (start)
+            known[pid] = start;
+        else
+            delete known[pid];
     }
+    return known;
 }
-function recordIdentities(root, name, pids, fresh = []) {
+function recordIdentities(root, name, pids, fresh = [], births = heldStarts()) {
     try {
         // A pid the World has just spawned is measured anew, whatever an older record says of that number.
-        const known = readIdentities(root, name), starts = processStarts(pids.filter((pid) => known[pid] === undefined || fresh.includes(pid)));
-        for (const pid of fresh)
-            if (starts.has(pid))
+        const known = readIdentities(root, name);
+        for (const pid of fresh) {
+            if (births[pid] !== undefined)
+                known[pid] = births[pid];
+            else
                 delete known[pid];
-        const kept = Object.fromEntries(pids.flatMap((pid) => { const start = known[pid] ?? starts.get(pid); return start ? [[String(pid), start]] : []; }));
+        }
+        const kept = Object.fromEntries(pids.flatMap(pid => known[pid] === undefined ? [] : [[String(pid), known[pid]]]));
         writeTextAtomic(identityPath(root, name), JSON.stringify(kept));
     }
-    catch { /* without a record a pid is trusted as before */ }
+    catch { /* without a record signalling refuses and lifecycle evidence is retained */ }
 }
 /** Recorded pids whose running process started at another time than recorded: the number now names another
  *  program. An unrecorded pid, and a pid with no process, are never in this list. */
@@ -902,12 +1056,14 @@ function getByJsonPath(value, jsonPath) {
     }
     return current;
 }
+class ExternalCommandUnavailableError extends Error {
+}
 async function runExternalCommand(command, cwd, serviceId, phase, env = process.env, abort, timeoutMs = 60_000) {
     const [bin, ...args] = ownCommand(command);
     if (!bin)
         throw new Error(`External service "${serviceId}": ${phase} command is empty`);
     if (!commandExists(bin))
-        throw new Error(`External service "${serviceId}": \`${bin}\` not found on PATH (the ${phase} command's tool is not installed)`);
+        throw new ExternalCommandUnavailableError(`External service "${serviceId}": \`${bin}\` not found on PATH (the ${phase} command's tool is not installed)`);
     abort?.throwIfAborted();
     const child = spawn(bin, args, { windowsHide: true, cwd, env, detached: commandProcessGroup, stdio: ['ignore', 'pipe', 'pipe'] });
     const lifetime = commandLifetime(child, abort, true);
@@ -930,10 +1086,15 @@ async function runExternalCommand(command, cwd, serviceId, phase, env = process.
     const timer = setTimeout(() => { failure = new Error(`command timed out after ${timeoutMs}ms`); lifetime.cancel('SIGTERM'); }, timeoutMs);
     try {
         const result = await lifetime.finish();
-        if (failure)
-            throw new Error(`External service "${serviceId}": ${phase} command failed to run (${failure.message})`);
-        if (result.code !== 0 || lifetime.forwarded)
-            throw new Error(`External service "${serviceId}": ${phase} command exited ${result.code ?? 'null'}\n${stdout}${stderr}`);
+        if (failure) {
+            const ErrorKind = ['ENOENT', 'ENOEXEC', 'EACCES'].includes(failure.code ?? '') ? ExternalCommandUnavailableError : Error;
+            throw new ErrorKind(`External service "${serviceId}": ${phase} command failed to run (${errorMessage(failure)})`);
+        }
+        if (result.code !== 0 || lifetime.forwarded) {
+            const parserRefusal = /unknown (?:shorthand flag|flag|option|command)|unrecognized (?:option|argument)|command not found|no such file or directory/iu.test(`${stdout}${stderr}`);
+            const ErrorKind = !lifetime.forwarded && ([126, 127].includes(result.code ?? -1) || (result.code === 125 && parserRefusal)) ? ExternalCommandUnavailableError : Error;
+            throw new ErrorKind(`External service "${serviceId}": ${phase} command exited ${result.code ?? 'null'}\n${stdout}${stderr}`);
+        }
         return { stdout, stderr };
     }
     finally {
@@ -990,8 +1151,8 @@ async function runExternalUp(command, cwd, serviceId, env, logPath, abort) {
     return chunks.join('');
 }
 /** Whether an external `up` is this runtime's own managed-infrastructure tool (`volter-world-infra up`, which `init`
- *  names), with nothing on PATH answering the name: the phase then runs in this process (infra.ts) instead of in a
- *  child. The services it starts (the PGlite host, the redis and MongoDB twins) are then children of the process that
+ *  names): the phase runs in this process (infra.ts) instead of in a
+ *  child. The services it starts (the PGlite host, the redis twin and mongod) are then children of the process that
  *  owns the World's lifetime, as every service recorder is, not of a tool that exits once they serve. Where a child
  *  does not outlive its parent (a browser tab's process layer, measured 2026-09-28: a detached, unref'd listener
  *  ended with the process that spawned it), the PGlite host ended the moment `volter-world-infra up` returned and
@@ -1055,7 +1216,7 @@ async function awaitReadiness(ready, logPath, cwd, serviceId, env = process.env,
             catch (error) {
                 if (error instanceof CommandRetirementError)
                     throw error;
-                lastError = String(error);
+                lastError = errorMessage(error);
             }
         }
         else if (ready.httpUrl !== undefined) {
@@ -1066,7 +1227,7 @@ async function awaitReadiness(ready, logPath, cwd, serviceId, env = process.env,
                 lastError = `HTTP ${response.status}`;
             }
             catch (error) {
-                lastError = error instanceof Error ? error.message : String(error);
+                lastError = errorMessage(error);
             }
         }
         else if (ready.stdoutMatch !== undefined) {
@@ -1079,12 +1240,9 @@ async function awaitReadiness(ready, logPath, cwd, serviceId, env = process.env,
     }
     throw new Error(`Service "${serviceId}": readiness probe timed out after ${timeoutMs}ms (${lastError || 'no probe matched'})`);
 }
-async function startExternalService(service, paths, worldEnv, stripEnv, boot) {
-    const external = service.external;
-    if (!external)
-        throw new Error(`External service "${service.id}" is missing its external config`);
-    const log = join(paths.logs, `${service.id}.log`);
-    const cwd = service.cwd ? resolve(paths.root, service.cwd) : paths.root;
+/** The environment an external service and its replacement infrastructure hosts run in. Shared with branching,
+ *  so both use the boot's admission, service overrides, lifecycle context and control-plane egress rules. */
+export function externalServiceEnv(service, paths, worldEnv, stripEnv) {
     // External commands see the accumulated world env (process.env + earlier services' discovered/
     // injected vars), so a later external can consume an earlier service's connection info.
     const env = {
@@ -1092,11 +1250,20 @@ async function startExternalService(service, paths, worldEnv, stripEnv, boot) {
         ...worldEnv,
         ...(service.env ?? {}),
         VOLTER_WORLD_SERVICE_ID: service.id,
-        VOLTER_WORLD_SERVICE_LOG: log,
+        VOLTER_WORLD_SERVICE_LOG: ownedPath(paths.logs, `${service.id}.log`),
     };
     if (service.controlPlane)
         for (const key of CONTROL_PLANE_EGRESS_ENV)
             delete env[key];
+    return env;
+}
+async function startExternalService(service, paths, worldEnv, stripEnv, boot) {
+    const external = service.external;
+    if (!external)
+        throw new Error(`External service "${service.id}" is missing its external config`);
+    const log = ownedPath(paths.logs, `${service.id}.log`);
+    const cwd = service.cwd ? resolve(paths.root, service.cwd) : paths.root;
+    const env = externalServiceEnv(service, paths, worldEnv, stripEnv);
     // 1. up — start the self-managed stack, STREAMING its output to the service log (no 1MB cap).
     if (!external.up[0] || !commandExists(external.up[0])) {
         throw new Error(`External service "${service.id}": \`${external.up[0] ?? ''}\` not found on PATH (the up command's tool is not installed)`);
@@ -1131,7 +1298,7 @@ async function startExternalService(service, paths, worldEnv, stripEnv, boot) {
                     jsonCache[source] = JSON.parse(raw);
                 }
                 catch (error) {
-                    throw new Error(`External service "${service.id}": discover "${mapping.as}" expected JSON from ${source} output but parse failed (${error instanceof Error ? error.message : String(error)})\nOutput: ${raw.slice(0, 500)}`);
+                    throw new Error(`External service "${service.id}": discover "${mapping.as}" expected JSON from ${source} output but parse failed (${errorMessage(error)})\nOutput: ${raw.slice(0, 500)}`);
                 }
             }
             const found = getByJsonPath(jsonCache[source], mapping.jsonPath);
@@ -1157,10 +1324,16 @@ async function startExternalService(service, paths, worldEnv, stripEnv, boot) {
         external: { down: [...external.down], cwd, discoveredEnv: injected },
     };
 }
-function trackBootingChild(child, boot) {
+async function trackBootingChild(child, boot, birth) {
     if (!child.pid)
         return;
     boot.pids.add(child.pid);
+    boot.handles.set(child.pid, child);
+    boot.recordPids(); // durable numeric uncertainty precedes the async birth capture
+    const identity = await birth;
+    if (!identity?.start)
+        throw new Error('Service birth capture failed; retiring held child');
+    boot.identities[child.pid] = identity.start;
     boot.recordPids();
 }
 async function startService(config, service, worldEnv, paths, allocatedPorts, boot) {
@@ -1169,7 +1342,7 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
     if (!service.command)
         throw new Error(`Service "${service.id}" must define command`);
     const port = service.port === undefined || service.port === 'auto' ? await allocatePort(allocatedPorts) : service.port;
-    const serviceDataDir = join(paths.data, service.id);
+    const serviceDataDir = ownedPath(paths.data, service.id);
     mkdirSync(serviceDataDir, { recursive: true });
     // R17 — the lockfile holds on the spawn path too: a twin that runs a checkout's CLI
     // is checked against its pin and its protocol standing before it is spawned.
@@ -1189,7 +1362,7 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
         args.push(service.portArg ?? '--port', String(port));
     if (service.rootArg !== false)
         args.push(service.rootArg ?? '--root', serviceDataDir);
-    const log = join(paths.logs, `${service.id}.log`);
+    const log = ownedPath(paths.logs, `${service.id}.log`);
     const env = serviceProcessEnv(config, service, worldEnv, port);
     const cwd = service.cwd ? resolve(paths.root, service.cwd) : paths.root;
     // Augment NODE_OPTIONS with declared extra preloads, so a service can add an app-local preload
@@ -1203,10 +1376,10 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
     // The service runs under the service recorder, which outlives it to write its end into its own log: `up`
     // returns once the World is ready, so nothing else is left to see a service stop.
     env.VOLTER_WORLD_BOOT_ID = boot.bootId;
-    const { child, ended } = spawnRecorded(service.id, service.command, args, cwd, env, log);
+    const { child, ended, identity } = spawnRecorded(service.id, service.command, args, cwd, env, log, boot);
     child.once('error', error => boot.fail(error));
     child.unref();
-    trackBootingChild(child, boot);
+    await trackBootingChild(child, boot, identity);
     // Track an early exit. allocatePort() is TOCTOU (it closes its probe listener before the
     // child binds), so if another/stale process already holds `port`, the child gets EADDRINUSE
     // and dies — but waitForTcp would then see the OTHER process answering and the world would
@@ -1221,22 +1394,22 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
     // swapping, a docker build beside the boot) a heavy service takes longer than the 15s default
     // to answer on its port, and failing it there wastes the whole boot.
     const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
-    await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the service', log).catch((error) => {
+    await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the service', log).catch(async (error) => {
         if (undeadPids([child.pid]).length)
             recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
         try {
-            process.kill(-child.pid, 'SIGTERM');
+            await signalHeldChild(child, 'SIGTERM', true, identity);
         }
         catch {
             // best effort cleanup
         }
-        throw new Error(`Service "${service.id}" failed to start: ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
+        throw new Error(`Service "${service.id}" failed to start: ${errorMessage(error)}\nLog: ${log}`);
     });
-    await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log, true).catch((error) => {
+    await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log, true).catch(async (error) => {
         if (undeadPids([child.pid]).length)
             recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
         try {
-            process.kill(-child.pid, 'SIGTERM');
+            await signalHeldChild(child, 'SIGTERM', true, identity);
         }
         catch { /* best effort cleanup */ }
         throw error;
@@ -1250,14 +1423,14 @@ async function startService(config, service, worldEnv, paths, allocatedPorts, bo
     // Optional readiness probe beyond TCP (httpUrl/command/stdoutMatch): a process can bind its port
     // before it is actually serving, so this makes `up` wait until the service truly responds.
     if (service.ready && service.ready !== 'tcp') {
-        await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch((error) => {
+        await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
             if (undeadPids([child.pid]).length)
                 recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
             try {
-                process.kill(-child.pid, 'SIGTERM');
+                await signalHeldChild(child, 'SIGTERM', true, identity);
             }
             catch { /* best effort cleanup */ }
-            throw new Error(`Service "${service.id}" failed its readiness probe: ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
+            throw new Error(`Service "${service.id}" failed its readiness probe: ${errorMessage(error)}\nLog: ${log}`);
         });
     }
     return {
@@ -1422,7 +1595,8 @@ const ISSUE_TIMEOUT_MS = 15_000;
  *  asked for one and each pending name of that service is set to it. A twin that answers no credential, or has no
  *  door, leaves the names unset and says so, rather than handing the application a fixture the twin would refuse. */
 async function issueCredentials(service, started, env, pending, unissued) {
-    const wanted = [...pending].filter(([, id]) => id === service.id).map(([name]) => name);
+    const direct = new Set([...pending].filter(([, id]) => id === `${service.id}@direct`).map(([name]) => name));
+    const wanted = [...pending].filter(([name, id]) => id === service.id || direct.has(name)).map(([name]) => name);
     if (wanted.length === 0)
         return;
     for (const name of wanted)
@@ -1444,30 +1618,114 @@ async function issueCredentials(service, started, env, pending, unissued) {
         const answer = (await res.json());
         for (const name of wanted) {
             const spec = door.fill[name] ?? '';
-            // `file:<field>`: a credential the application reads from a file (Google's GOOGLE_APPLICATION_CREDENTIALS), written
-            // beside the World's instance file, the name set to its path
-            const field = spec.startsWith('file:') ? spec.slice('file:'.length) : spec;
-            const value = answer[field];
-            if (spec.startsWith('file:')) {
+            if (spec.startsWith('directory:') || spec.startsWith('file:')) {
+                if (direct.has(name))
+                    throw new Error(`cannot give ${name}'s filesystem credential a direct URL`);
+                if (!isEnvironmentName(name) || !/^[a-z0-9][a-z0-9._-]*$/.test(service.id))
+                    throw new Error('Invalid credential destination name');
+                if (!env.VOLTER_WORLD_INSTANCE)
+                    throw new Error('World credential custody is unknown');
+                const instance = realpathSync(dirname(env.VOLTER_WORLD_INSTANCE));
+                const custody = ownedPath(instance, 'credentials');
+                const artifact = `${service.id}-${name.toLowerCase()}`;
+                const isDirectory = spec.startsWith('directory:');
+                const field = spec.slice(spec.indexOf(':') + 1), value = answer[field];
                 if (value === undefined || value === null)
                     throw new Error(`answered no ${field}`);
-                // beside the World's instance and nowhere else: a credential file in the application's checkout could be committed
-                if (!env.VOLTER_WORLD_INSTANCE)
-                    throw new Error(`cannot write ${name}'s credential file: the World's instance is unknown`);
-                const dir = join(dirname(env.VOLTER_WORLD_INSTANCE), 'credentials');
-                mkdirSync(dir, { recursive: true, mode: 0o700 });
-                const path = join(dir, `${service.id}-${name.toLowerCase()}.json`);
-                writeFileSync(path, typeof value === 'string' ? value : `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-                env[name] = path;
+                if (isDirectory && (typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length === 0))
+                    throw new Error('Invalid credential directory');
+                const entries = isDirectory ? Object.entries(value) : [[`${artifact}.json`, value]];
+                const files = entries.map(([file, contents]) => {
+                    if (isDirectory && (!file || file.includes('\\') || file.split('/').some(part => !/^[A-Za-z0-9._-]+$/.test(part) || part === '.' || part === '..')))
+                        throw new Error('Invalid World-owned path');
+                    return { path: ownedPath(custody, isDirectory ? `${artifact}/${file}` : file), contents };
+                });
+                const directories = new Set([custody]);
+                for (const { path } of files) {
+                    let parent = dirname(path);
+                    while (parent !== custody) {
+                        directories.add(parent);
+                        parent = dirname(parent);
+                    }
+                    const stat = lstatSync(path, { throwIfNoEntry: false });
+                    if (stat && (!stat.isFile() || stat.nlink !== 1))
+                        throw new Error('Invalid World-owned path');
+                }
+                // Validate every destination and parent before creating or changing any custody artifact.
+                for (const dir of directories) {
+                    ownedPath(instance, relative(instance, dir));
+                    const stat = lstatSync(dir, { throwIfNoEntry: false });
+                    if (stat && !stat.isDirectory())
+                        throw new Error('Invalid World-owned path');
+                }
+                for (const dir of [...directories].sort((a, b) => a.length - b.length)) {
+                    if (!existsSync(dir))
+                        mkdirSync(dir, { mode: 0o700 });
+                    assertOwnedRealPath(custody, dir);
+                    chmodSync(dir, 0o700);
+                }
+                for (const { path, contents } of files) {
+                    ownedPath(custody, relative(custody, path));
+                    assertOwnedRealPath(custody, dirname(path));
+                    const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_NOFOLLOW, 0o600);
+                    let opened;
+                    try {
+                        const stat = fstatSync(fd);
+                        if (!stat.isFile() || stat.nlink !== 1)
+                            throw new Error('Invalid World-owned path');
+                        opened = stat;
+                        fchmodSync(fd, 0o600);
+                        assertOwnedRealPath(custody, dirname(path));
+                        ftruncateSync(fd, 0);
+                        writeFileSync(fd, typeof contents === 'string' ? contents : `${JSON.stringify(contents, null, 2)}\n`);
+                    }
+                    finally {
+                        closeSync(fd);
+                        let realFile;
+                        try {
+                            realFile = realpathSync(path);
+                            const current = statSync(realFile);
+                            if (!opened || current.dev !== opened.dev || current.ino !== opened.ino)
+                                throw new Error('Invalid World-owned path');
+                            assertOwnedRealPath(custody, realFile);
+                        }
+                        catch (error) {
+                            // Remove only the file whose descriptor we opened; a raced replacement is not ours to delete.
+                            const current = realFile ? lstatSync(realFile, { throwIfNoEntry: false }) : undefined;
+                            if (opened && current?.dev === opened.dev && current.ino === opened.ino)
+                                rmSync(realFile, { force: true });
+                            throw error;
+                        }
+                    }
+                }
+                env[name] = isDirectory ? ownedPath(custody, artifact) : files[0].path;
                 continue;
             }
+            const field = spec;
+            const value = answer[field];
             if (typeof value !== 'string')
                 throw new Error(`answered no ${field}`);
-            env[name] = value;
+            if (direct.has(name)) {
+                const issued = new URL(value);
+                if (!['http:', 'https:'].includes(issued.protocol))
+                    throw new Error(`cannot route ${name}'s non-HTTP URL directly`);
+                const endpoint = new URL(started.url);
+                issued.protocol = endpoint.protocol;
+                issued.host = endpoint.host;
+                env[name] = issued.toString();
+            }
+            else
+                env[name] = value;
+        }
+        if (started.url) {
+            const endpoint = new URL(started.url);
+            Object.assign(env, resolveServiceEnvTemplates(service.injectEnvTemplates, {
+                host: endpoint.hostname, port: Number(endpoint.port || (endpoint.protocol === 'https:' ? 443 : 80)), url: started.url,
+            }));
         }
     }
     catch (error) {
-        process.stderr.write(`volter-world: ${service.id} did not issue ${wanted.join(', ')} (${error instanceof Error ? error.message : String(error)}); left unset\n`);
+        process.stderr.write(`volter-world: ${service.id} did not issue ${wanted.join(', ')} (${errorMessage(error)}); left unset\n`);
         for (const name of wanted) {
             delete env[name];
             unissued.add(name);
@@ -1528,7 +1786,7 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
     const allocated = [];
     for (const service of colocated) {
         const port = service.port === undefined || service.port === 'auto' ? await allocatePort(allocatedPorts) : service.port;
-        const serviceDataDir = join(paths.data, service.id);
+        const serviceDataDir = ownedPath(paths.data, service.id);
         mkdirSync(serviceDataDir, { recursive: true });
         // Relative module paths resolve from the world root (import() inside the host would
         // otherwise resolve them against the runtime's own source directory).
@@ -1557,10 +1815,10 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
     dropUnissued(env);
     env.VOLTER_WORLD_BOOT_ID = boot.bootId;
     // Under the same exit recorder as a process service, so the host's end (and every twin it holds) is in host.log.
-    const { child, ended } = spawnRecorded('host', process.execPath, args, paths.root, env, log);
+    const { child, ended, identity } = spawnRecorded('host', process.execPath, args, paths.root, env, log, boot);
     child.once('error', error => boot.fail(error));
     child.unref();
-    trackBootingChild(child, boot);
+    await trackBootingChild(child, boot, identity);
     const exitState = { value: null };
     child.on('exit', (code, signal) => {
         exitState.value = { code, signal };
@@ -1596,25 +1854,25 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
         }
         catch {
             return 0;
-        } }), ended, boot, 'the co-located host', log).catch((error) => {
+        } }), ended, boot, 'the co-located host', log).catch(async (error) => {
             if (undeadPids([child.pid]).length)
                 recordWorldStop([log], 'world.service.stop', 'up (host startup incomplete)', 'SIGTERM');
             try {
-                process.kill(-child.pid, 'SIGTERM');
+                await signalHeldChild(child, 'SIGTERM', true, identity);
             }
             catch { /* best effort cleanup */ }
-            throw new Error(`Co-located host failed to complete startup (isolation=${isolation}): ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
+            throw new Error(`Co-located host failed to complete startup (isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
         });
         await parallelStartup(allocated, async ({ service, port }) => {
             const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
-            await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch((error) => {
+            await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch(async (error) => {
                 if (undeadPids([child.pid]).length)
                     recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
                 try {
-                    process.kill(-child.pid, 'SIGTERM');
+                    await signalHeldChild(child, 'SIGTERM', true, identity);
                 }
                 catch { /* best effort cleanup */ }
-                throw new Error(`Co-located twin "${service.id}" failed to start (host isolation=${isolation}): ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
+                throw new Error(`Co-located twin "${service.id}" failed to start (host isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
             });
         });
         // The host's receipt (this boot, every requested port) is published only
@@ -1624,11 +1882,11 @@ async function startColocatedServices(config, colocated, isolation, worldEnv, pa
         // answers with another boot's identity is still refused.
         const hostSettle = Promise.resolve('alive');
         await parallelStartup(allocated, async ({ service, port }) => {
-            await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log, true, hostSettle).catch((error) => {
+            await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log, true, hostSettle).catch(async (error) => {
                 if (undeadPids([child.pid]).length)
                     recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
                 try {
-                    process.kill(-child.pid, 'SIGTERM');
+                    await signalHeldChild(child, 'SIGTERM', true, identity);
                 }
                 catch { /* best effort cleanup */ }
                 throw error;
@@ -1701,6 +1959,7 @@ export async function upWorld(configId, options = {}, abort) {
     const envFile = resolve(root, options.envFile ?? join(instance, 'world.env'));
     const instanceFile = join(instance, 'instance.json');
     let carriedOrigin;
+    let carriedNetwork = options.networkCeiling;
     // the outputs this root's Worlds published: a branch and its base share the app's env file (whichever is current
     // writes it), so a file any of them last wrote is the World's own, never a custody file
     const siblings = existsSync(worldBaseDir(root)) ? readdirSync(worldBaseDir(root)).filter((world) => world !== name && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(world)) : [];
@@ -1723,6 +1982,7 @@ export async function upWorld(configId, options = {}, abort) {
     let resourcesClaimed = false;
     let cleanupUncertain = false;
     const createdAt = new Date().toISOString();
+    const instanceToken = randomUUID();
     // Claim the instance dir under the kernel's cross-process file lock (TWIN-36). Without it,
     // two concurrent `upWorld` calls on one name can both observe "no live pids", both rmSync the
     // dir, and one clobbers the other's freshly-spawned services (orphaned processes + a corrupt
@@ -1754,23 +2014,50 @@ export async function upWorld(configId, options = {}, abort) {
             }
             if (!options.keepState)
                 assertWorldStateRemovable(root, instance);
-            // A legacy record can have been removed by an older reader while its external effects
-            // remain. Require a receipt for the exact prior instance, not merely absent claims/PIDs.
+            // Verified teardown is independent of record shape. A fresh boot discards incomplete metadata.
             if (existsSync(instanceFile)) {
+                let prior;
+                if (options.keepState)
+                    prior = readWorldBootRecordLocked(name, root);
                 const priorRaw = readFileSync(instanceFile, 'utf8');
-                const prior = JSON.parse(priorRaw);
                 const receiptPath = join(instance, 'stopped.json');
                 const receipt = existsSync(receiptPath) ? JSON.parse(readFileSync(receiptPath, 'utf8')) : undefined;
-                if (prior.name !== name || resolve(prior.root) !== root || !receipt
-                    || receipt.instanceHash !== createHash('sha256').update(priorRaw).digest('hex')
+                if (!receipt || receipt.instanceHash !== createHash('sha256').update(priorRaw).digest('hex')
                     || !Number.isFinite(Date.parse(receipt.stoppedAt))) {
                     throw new Error(`World "${name}" has no verified teardown receipt for its prior instance; use its owning runtime to complete cleanup before replacement`);
                 }
+                if (!prior) {
+                    try {
+                        prior = JSON.parse(priorRaw);
+                    }
+                    catch { /* fresh boot needs no retained shape */ }
+                }
+                if (prior) {
+                    // A readable ceiling remains useful even when unrelated metadata is incomplete.
+                    try {
+                        const permissionRecord = { ...prior, name, root };
+                        if (!Object.hasOwn(permissionRecord, 'networkCeiling')) {
+                            let storedConfig = loaded.config;
+                            try {
+                                storedConfig = loadWorldConfig(prior.configPath, root).config;
+                            }
+                            catch { /* fresh boot can discard missing config metadata */ }
+                            permissionRecord.networkCeiling = ceilingFromConfig(permissionRecord, storedConfig);
+                        }
+                        const ceiling = recordedWorldNetwork(permissionRecord);
+                        if (ceiling !== undefined)
+                            carriedNetwork = carriedNetwork === undefined ? ceiling : intersectWorldNetwork(carriedNetwork, ceiling);
+                    }
+                    catch {
+                        if (options.keepState)
+                            throw new Error(`World boot record is incomplete or invalid: ${instanceFile}`);
+                    }
+                }
                 // the origin belongs to the World, not to its running state (git: a remote outlives every checkout): an up of the
                 // same config carries the one the last left while world.json's `origin` remote still names it (`remote remove`
                 // ends it there; an instance under another World's config, a runtime branch, has only its own record); its cursors
                 // only when its state (the mirror they count) is kept, as reset drops them
-                if (prior.origin && prior.config === loaded.config.id && (name !== loaded.config.id || namesOrigin(loaded.config.remotes?.origin, prior.origin, root))) {
+                if (prior?.origin && typeof prior.origin.url === 'string' && typeof prior.origin.namespace === 'string' && prior.config === loaded.config.id && (name !== loaded.config.id || namesOrigin(loaded.config.remotes?.origin, prior.origin, root))) {
                     carriedOrigin = options.keepState ? prior.origin
                         : { url: prior.origin.url, namespace: prior.origin.namespace, ...(prior.origin.clonedAt ? { clonedAt: prior.origin.clonedAt } : {}) };
                 }
@@ -1781,7 +2068,7 @@ export async function upWorld(configId, options = {}, abort) {
             retainWorldLifecycleForCleanup(root, name);
             // The last run's logs survive this boot as logs/previous (one generation): the record of a crash must outlive the
             // restart that usually follows it. Moved aside before the wipe and back in after it.
-            const previousLogs = join(dirname(instance), `.${name}.previous-logs`); // dot-prefixed: bookkeeping, never listed as a World
+            const previousLogs = ownedPath(dirname(instance), `.${name}.previous-logs`); // dot-prefixed: bookkeeping, never listed as a World
             if (existsSync(previousLogs) && !existsSync(logs)) {
                 mkdirSync(instance, { recursive: true });
                 renameSync(previousLogs, logs);
@@ -1829,8 +2116,7 @@ export async function upWorld(configId, options = {}, abort) {
                 releaseWorldLifecycle(root, name);
             }
             catch (release) {
-                if (error instanceof Error)
-                    error.message += `; releasing the World's claim failed too: ${release instanceof Error ? release.message : String(release)}`;
+                throw new AggregateError([error, release], 'World claim and release failed');
             }
         }
         throw error;
@@ -1840,8 +2126,14 @@ export async function upWorld(configId, options = {}, abort) {
     // "already running" guard; on failure the world never came up, so the next upWorld must be
     // allowed to claim. Removing the marker is safe — only THIS call's marker can exist at this
     // point (a foreign live claim made the claim section above throw before this try).
+    let bootFailed = false;
+    let bootFailure;
     try {
         const services = {};
+        const recordService = (started) => {
+            const branchState = loaded.config.services.find(service => service.id === started.id)?.branchState;
+            services[started.id] = { ...started, branchState: branchState ?? 'supported' };
+        };
         const inheritedEnv = admittedEnv(loaded.config.stripEnv);
         const env = {
             ...(loaded.config.env ?? {}),
@@ -1852,10 +2144,11 @@ export async function upWorld(configId, options = {}, abort) {
             // the world ref the dormant attach entry (`import '@volter/world-core/attach'`) arms the injector
             // on — what a Bun process, which ignores NODE_OPTIONS, reads to reach the twins inside `run`
             VOLTER_WORLD: name,
-            ...(networkOf(name, mode === 'sealed' ? { egress: [] } : loaded.config.network) ?? {}),
+            ...(networkOf(name, mode === 'sealed' ? { egress: [] } : loaded.config.network, carriedNetwork) ?? {}),
             VOLTER_WORLD_MODE: mode,
             VOLTER_WORLD_CONFIG: loaded.path,
             VOLTER_WORLD_INSTANCE: instanceFile,
+            VOLTER_WORLD_GUEST_RUNNER: new URL(import.meta.url.endsWith('.ts') ? './guest-runner.ts' : './guest-runner.js', import.meta.url).href,
             // every service's root is `<data>/<service id>`; the kernel finds another pack's store across them (A3, ownerStoreRoots)
             [WORLD_DATA_ENV]: data,
             // the live env file this `up` writes: what a service that runs apps elsewhere (world-machine's guest) carries there
@@ -1877,8 +2170,10 @@ export async function upWorld(configId, options = {}, abort) {
         const unissued = new Set();
         writeProxyEnv(root, name, env);
         const worldInstance = {
-            name, config: loaded.config.id, configPath: loaded.path, root, createdAt, mode,
+            name, instance: instanceToken, config: loaded.config.id, configPath: loaded.path, root, createdAt, mode,
             dirs: { instance, logs, data }, services, env, envFile, pidsFile,
+            networkCeiling: env[WORLD_NETWORK_POLICY_ENV] === undefined ? 'unrestricted' : networkPermission(parseWorldNetworkPolicy(JSON.parse(env[WORLD_NETWORK_POLICY_ENV]))),
+            bootServices: loaded.config.services.map(service => service.id), bootOwner: options.owner ?? null,
             ...(loaded.config.selection ? { selection: loaded.config.selection } : {}),
             ...(loaded.config.actors ? { actors: loaded.config.actors } : {}),
             ...(loaded.config.fixtures ? { fixtures: loaded.config.fixtures } : {}),
@@ -1902,9 +2197,9 @@ export async function upWorld(configId, options = {}, abort) {
             abort?.removeEventListener('abort', onOwnerEnd);
         };
         const boot = {
-            bootId: randomUUID(), signal: cancelled.signal, fail: error => cancelled.abort(error), pids: new Set(),
-            external: service => { services[service.id] = service; saveWorldInstance(worldInstance); },
-            recordPids: () => writeOwnedPids(root, name, [...boot.pids], [...boot.pids]),
+            bootId: instanceToken, signal: cancelled.signal, fail: error => cancelled.abort(error), pids: new Set(), identities: {}, handles: new Map(),
+            external: service => { recordService(service); saveWorldInstance(worldInstance); },
+            recordPids: () => writeOwnedPids(root, name, [...boot.pids], [...boot.pids], boot.identities),
         };
         const recordPidsSoFar = boot.recordPids;
         try {
@@ -1924,7 +2219,7 @@ export async function upWorld(configId, options = {}, abort) {
                 const colocated = loaded.config.services.filter((service) => service.colocate && service.type !== 'external');
                 const host = await startColocatedServices(loaded.config, colocated, isolation, env, { root, instance, logs, data }, allocatedPorts, boot);
                 for (const started of host.services) {
-                    services[started.id] = started;
+                    recordService(started);
                     Object.assign(env, started.env);
                 }
                 colocatedReady = async () => {
@@ -1978,7 +2273,7 @@ export async function upWorld(configId, options = {}, abort) {
                 attemptProxy();
                 boot.signal.throwIfAborted();
                 const started = await startService(loaded.config, service, env, { root, instance, logs, data }, allocatedPorts, boot);
-                services[started.id] = started;
+                recordService(started);
                 recordPidsSoFar();
                 Object.assign(env, started.env);
                 await issueCredentials(service, started, env, issuing, unissued);
@@ -2022,7 +2317,7 @@ export async function upWorld(configId, options = {}, abort) {
                     return await shareWorldServices(name, { root, ...(options.share ?? {}) });
                 }
                 catch (error) {
-                    await downWorld(name, root);
+                    await downWorld(name, root, { expectedInstance: instanceToken });
                     throw error;
                 }
             }
@@ -2034,16 +2329,16 @@ export async function upWorld(configId, options = {}, abort) {
             // Rollback never lets its own failure replace the boot's: each step's error is added to the original.
             const rollbackErrors = [];
             try {
-                stopWorldProxy(root, name);
+                await stopWorldProxy(root, name, boot.handles);
             }
             catch (proxyError) {
-                rollbackErrors.push(`proxy stop failed: ${proxyError instanceof Error ? proxyError.message : String(proxyError)}`);
+                rollbackErrors.push(`proxy stop failed: ${errorMessage(proxyError)}`);
             }
             const pids = [...new Set([...Object.values(services).map((service) => service.pid).filter(Boolean), ...boot.pids])];
             const rollbackAlive = undeadPids(Object.values(services).map((service) => service.pid).filter(Boolean));
             const rollbackLogs = Object.values(services).filter((service) => service.type !== 'external' && service.log && rollbackAlive.includes(service.pid)).map((service) => service.log);
             recordWorldStop(rollbackLogs, 'world.service.stop', 'boot rollback', 'SIGTERM');
-            signalPids(pids, 'SIGTERM');
+            await signalPids(pids, 'SIGTERM', boot.identities, boot.handles);
             // Stop any self-managed externals that DID come up, so a failed `up` never leaves a
             // half-running external stack behind. Best-effort: the original error is what we throw —
             // but a `down` that ITSELF fails must not be silent (the operator would have no hint that
@@ -2058,20 +2353,20 @@ export async function upWorld(configId, options = {}, abort) {
                         await runExternalCommand(service.external.down, service.external.cwd, service.id, 'down', downEnv);
                     }
                     catch (downError) {
-                        rollbackErrors.push(downError instanceof Error ? downError.message : String(downError));
+                        rollbackErrors.push(errorMessage(downError));
                     }
                 }
             }
             // Same SIGTERM→SIGKILL contract as downWorld: a service that ignores SIGTERM must not
             // outlive a failed boot either. The poll exits as soon as everything is dead, so the
             // common case (services honor SIGTERM) adds no delay to the failure path.
-            const rollbackKilled = await killSurvivorsAfterGrace(pids, DOWN_GRACE_MS_DEFAULT);
+            const rollbackKilled = await killSurvivorsAfterGrace(pids, DOWN_GRACE_MS_DEFAULT, boot.identities, boot.handles);
             recordWorldStop(Object.values(services).filter((service) => rollbackKilled.includes(service.pid) && service.log).map((service) => service.log), 'world.service.killed', 'boot rollback', 'SIGKILL');
             const surviving = undeadPids(pids);
             if (surviving.length)
                 rollbackErrors.push('owned processes remain alive or uncertain');
             if (error instanceof CommandRetirementError)
-                rollbackErrors.push(error.retirement ?? error.message);
+                rollbackErrors.push(error.retirement ?? errorMessage(error));
             if (rollbackErrors.length > 0) {
                 cleanupUncertain = true;
                 try {
@@ -2079,7 +2374,7 @@ export async function upWorld(configId, options = {}, abort) {
                     saveWorldInstance(worldInstance);
                 }
                 catch (bookkeepingError) {
-                    rollbackErrors.push(`rollback bookkeeping failed: ${bookkeepingError instanceof Error ? bookkeepingError.message : String(bookkeepingError)}`);
+                    rollbackErrors.push(`rollback bookkeeping failed: ${errorMessage(bookkeepingError)}`);
                 }
                 const suffix = `\n(rollback incomplete — processes or an external stack may still be running: ${rollbackErrors.join('; ')})`;
                 // Mutate rather than re-wrap: callers match on the ORIGINAL message (which must keep
@@ -2087,7 +2382,7 @@ export async function upWorld(configId, options = {}, abort) {
                 if (error instanceof Error)
                     error.message += suffix;
                 else
-                    throw new Error(`${String(error)}${suffix}`);
+                    throw new Error(`${errorMessage(error)}${suffix}`);
             }
             if (rollbackErrors.length === 0) {
                 // Publication failure must retain ownership. Prune requires both a receipt and release.
@@ -2100,36 +2395,52 @@ export async function upWorld(configId, options = {}, abort) {
                     cleanupUncertain = false;
                 }
                 catch (receiptError) {
-                    const note = `\n(rollback stopped every process but could not publish its teardown receipt: ${receiptError instanceof Error ? receiptError.message : String(receiptError)}; lifecycle retained)`;
+                    const note = `\n(rollback stopped every process but could not publish its teardown receipt: ${errorMessage(receiptError)}; lifecycle retained)`;
                     if (error instanceof Error)
                         error.message += note;
                     else
-                        throw new Error(`${String(error)}${note}`);
+                        throw new Error(`${errorMessage(error)}${note}`);
                 }
             }
             throw error;
         }
     }
     catch (error) {
+        bootFailed = true;
+        bootFailure = error;
         if (resourcesClaimed) {
             try {
-                recordWorldLifecycleEvent(root, name, `boot failed: ${error instanceof Error ? error.message : String(error)}`);
+                recordWorldLifecycleEvent(root, name, `boot failed: ${errorMessage(error)}`);
             }
             catch (diagnosticError) {
-                process.stderr.write(`World "${name}": could not save boot failure: ${String(diagnosticError)}; original failure: ${String(error)}\n`);
+                process.stderr.write(`World "${name}": could not save boot failure: ${errorMessage(diagnosticError)}; original failure: ${errorMessage(error)}\n`);
+            }
+            if (!cleanupUncertain) {
+                try {
+                    releaseWorldLifecycle(root, name);
+                }
+                catch (release) {
+                    bootFailure = new AggregateError([error, release], 'World startup and lifecycle release failed');
+                }
             }
-            if (!cleanupUncertain)
-                releaseWorldLifecycle(root, name);
         }
-        throw error;
+        throw bootFailure;
     }
     finally {
-        rmSync(bootingFile(root, name), { force: true });
+        try {
+            rmSync(bootingFile(root, name), { force: true });
+        }
+        catch (cleanup) {
+            if (bootFailed)
+                throw new AggregateError([bootFailure, cleanup], 'World startup and boot marker cleanup failed');
+            throw cleanup;
+        }
     }
 }
 async function teardownExternalServices(instance) {
     const stopped = [];
     const errors = [];
+    const unavailable = [];
     for (const service of Object.values(instance.services)) {
         if (service.type !== 'external')
             continue;
@@ -2144,10 +2455,13 @@ async function teardownExternalServices(instance) {
             stopped.push(service.id);
         }
         catch (error) {
-            errors.push(error instanceof Error ? error.message : String(error));
+            const message = errorMessage(error);
+            errors.push(message);
+            if (error instanceof ExternalCommandUnavailableError)
+                unavailable.push(message);
         }
     }
-    return { stopped, errors };
+    return { stopped, errors, unavailable };
 }
 /** SIGTERM contract (documented in docs/concepts/worlds.md § Teardown): services get SIGTERM to their process
  * GROUP, then `downWorld` waits up to this grace for them to exit before SIGKILLing survivors.
@@ -2156,19 +2470,20 @@ const DOWN_GRACE_MS_DEFAULT = 5_000;
 /** Signal each pid's process GROUP (services are spawned `detached`, so each pid is a group
  * leader), falling back to the single pid when the group signal fails. Returns the pids that
  * accepted the signal. */
-function signalPids(pids, signal) {
+async function signalPids(pids, signal, identities, handles) {
     const signalled = [];
     for (const pid of pids) {
+        if (!undeadPids([pid]).length)
+            continue;
+        const identity = Object.hasOwn(identities, pid) ? { pid, start: identities[pid] } : undefined;
         try {
-            process.kill(-pid, signal);
-            signalled.push(pid);
-        }
-        catch {
-            try {
-                process.kill(pid, signal);
+            const child = handles?.get(pid);
+            if (child ? await signalHeldChild(child, signal, true, Promise.resolve(identity))
+                : await signalOwnedProcess(identity, signal, true) || await signalOwnedProcess(identity, signal))
                 signalled.push(pid);
-            }
-            catch { }
+        }
+        catch (error) {
+            process.stderr.write(`${errorMessage(error)}\n`);
         }
     }
     return signalled;
@@ -2187,43 +2502,51 @@ const KILL_CONFIRM_MS = 2_000;
  * exactly like the SIGTERM was delivered, then a short bounded confirm-wait so survivors are
  * actually gone (not just signalled) by the time this returns. Returns the pids that needed
  * escalation. */
-async function killSurvivorsAfterGrace(pids, graceMs) {
+async function killSurvivorsAfterGrace(pids, graceMs, identities, handles) {
     const deadline = Date.now() + graceMs;
     while (undeadPids(pids).length > 0 && Date.now() < deadline) {
         await new Promise((resolveWait) => setTimeout(resolveWait, 50));
     }
     const survivors = undeadPids(pids);
-    signalPids(survivors, 'SIGKILL');
+    await signalPids(survivors, 'SIGKILL', identities, handles);
     const confirmDeadline = Date.now() + KILL_CONFIRM_MS;
     while (undeadPids(survivors).length > 0 && Date.now() < confirmDeadline) {
         await new Promise((resolveWait) => setTimeout(resolveWait, 20));
     }
     return survivors;
 }
-/** Synchronous twin of `killSurvivorsAfterGrace` for callers (`unshareWorld`) that must stay
- * synchronous — same "poll until dead or grace expires, then SIGKILL survivors, then confirm they
- * are actually gone" contract, using an `Atomics.wait` backoff (already this file's pattern for
- * synchronous polling — see `ensureWorldProxy`) instead of `setTimeout`, since a sync function has
- * no event loop to yield to. */
-function killSurvivorsAfterGraceSync(pids, graceMs) {
-    const deadline = Date.now() + graceMs;
-    while (undeadPids(pids).length > 0 && Date.now() < deadline) {
+/** The same bounded, identity-checked retirement used by World down, for provider-owned groups.
+ * No caller may release a durable receipt when inspection or signal delivery is uncertain. */
+export async function retireOwnedProcessGroups(records, graceMs = DOWN_GRACE_MS_DEFAULT) {
+    const pids = [...new Set(records.map(record => record.pid))];
+    const identities = Object.fromEntries(records.map(record => [record.pid, record.start]));
+    await signalPids(pids, 'SIGCONT', identities);
+    await signalPids(pids, 'SIGTERM', identities);
+    await killSurvivorsAfterGrace(pids, graceMs, identities);
+    const remaining = undeadPids(pids);
+    if (remaining.length)
+        throw new CommandRetirementError(`Guest process groups still alive or uninspectable: ${remaining.join(', ')}; ownership retained`);
+}
+/** The synchronous proxy starter can retire only its still-held child/group. Numeric
+ * recovery belongs to async downWorld, never to a blocking identity lookup. */
+function killHeldSurvivorsSync(child, graceMs) {
+    if (!child.pid)
+        return;
+    const pids = [child.pid], deadline = Date.now() + graceMs;
+    while (undeadPids(pids).length && Date.now() < deadline)
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50);
-    }
-    const survivors = undeadPids(pids);
-    signalPids(survivors, 'SIGKILL');
+    if (undeadPids(pids).length)
+        signalChild(child, 'SIGKILL', true);
     const confirmDeadline = Date.now() + KILL_CONFIRM_MS;
-    while (undeadPids(survivors).length > 0 && Date.now() < confirmDeadline) {
+    while (undeadPids(pids).length && Date.now() < confirmDeadline)
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
-    }
-    return survivors;
 }
-/** Async solely for the SIGTERM→SIGKILL grace poll — everything else (proxy stop, SIGTERM,
- * external teardown) still runs in the first synchronous slice, so a legacy caller that fires
- * without awaiting gets exactly the old behavior plus the deferred escalation. A blocking
- * sleep-loop would keep the sync signature but stall the caller's event loop for up to the whole
- * grace; a detached watchdog child would escalate too but leak orphan processes — the await is
- * the honest shape (upWorld/runWorld/the CLI are already async). */
+/** Retirement awaits birth verification for recorded numbers and the SIGTERM→SIGKILL
+ * grace/confirmation polls. Callers await downWorld before releasing ownership or purging
+ * instance state; held children can receive their initial signal without a birth lookup.
+ * External teardown and proxy retirement are joined in that same lifecycle.
+ * A blocking sleep-loop would stall the caller's event loop through the grace, and a detached
+ * watchdog would leave an unjoined process; lifecycle owners await retirement instead. */
 /**
  * Delete a world's instance dir entirely — the `--purge` half of `down` (TWIN-45 dev/02b): no
  * twin data (per-service `data/<id>`, logs, instance.json) survives past teardown. Plain `rm`,
@@ -2256,19 +2579,31 @@ function purgeInstanceDir(root, name) {
 class WorldConsumersActiveError extends Error {
 }
 export async function downWorld(name, root = process.cwd(), options = {}) {
+    if (Object.hasOwn(options, 'expectedCreatedAt'))
+        throw new Error('World teardown requires expectedInstance from the original boot');
     assertSafeWorldName(name);
     const resolvedRoot = resolve(root);
     const token = randomUUID();
     // Like boot's claim: a short synchronous lock protects an async lifecycle transition.
     // Do not hold a filesystem lock while external shutdown or the grace period waits.
     withFileLock(instanceLockFile(resolvedRoot, name), () => withFileLock(`${sharingClaimFile(resolvedRoot, name)}.lock`, () => {
+        if (options.expectedInstance !== undefined) {
+            try {
+                const raw = getActiveWorldStore().read(instanceFile(resolvedRoot, name));
+                const recorded = raw === null ? undefined : JSON.parse(raw);
+                if (recorded?.name !== name || typeof recorded.root !== 'string' || resolve(recorded.root) !== resolvedRoot
+                    || typeof options.expectedInstance !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(options.expectedInstance)
+                    || recorded.instance !== options.expectedInstance)
+                    throw new Error();
+            }
+            catch {
+                throw new Error(`World ownership mismatch: ${name}`);
+            }
+        }
         assertProxyOwnershipResolved(resolvedRoot, name);
         const prior = existsSync(instanceFile(resolvedRoot, name)) ? readWorldInstance(name, resolvedRoot, true) : undefined;
         if (prior?.resources && !prior.lifecycle)
             throw new Error(`World "${name}" belongs to a legacy runtime; use its pinned runtime for teardown before migration`);
-        if (options.expectedCreatedAt !== undefined && readWorldInstance(name, resolvedRoot, true).createdAt !== options.expectedCreatedAt) {
-            throw new Error(`World "${name}" generation changed; teardown refused`);
-        }
         if (options.purge)
             assertWorldStateRemovable(resolvedRoot, instanceDir(resolvedRoot, name));
         prepareBootForDown(resolvedRoot, name);
@@ -2318,6 +2653,7 @@ async function downWorldClaimed(name, root, options) {
     catch {
         instance = undefined;
     }
+    readGuestProcesses(dir, instance?.instance); // missing World metadata never erases guest ownership
     // Nothing to tear down when the metadata is gone and every process the lifecycle recorded has exited.
     if (!instance && before === undefined && releaseAbandonedWorldLifecycle(resolvedRoot, name)) {
         return { name, stopped: [], escalated: [], externalStopped: [], externalErrors: [] };
@@ -2326,28 +2662,37 @@ async function downWorldClaimed(name, root, options) {
         return { name, stopped: [], escalated: [], externalStopped: [],
             externalErrors: ['World instance or external teardown metadata missing or unreadable; cleanup refused; lifecycle evidence retained'] };
     }
-    const proxyPid = readProxyState(resolvedRoot, name)?.pid;
-    stopWorldProxy(resolvedRoot, name);
+    const proxyState = readProxyState(resolvedRoot, name);
+    const proxyPid = proxyState?.pid;
+    await stopWorldProxy(resolvedRoot, name, spawnedChildren);
     const foregroundPid = instance?.lastRun?.state !== 'completed' ? instance?.lastRun?.consumerPid : undefined;
     const holderPid = instance?.lifecycle?.holderPid ?? instance?.resources?.holderPid;
     const recordedPids = [...new Set([...readPids(pidsFile), ...(foregroundPid ? [foregroundPid] : []), ...(proxyPid ? [proxyPid] : [])])].filter(pid => pid !== holderPid);
-    const foreign = foreignPids(resolvedRoot, name, recordedPids);
+    const identities = readIdentities(resolvedRoot, name);
+    if (proxyState?.birth)
+        identities[proxyState.pid] = proxyState.birth;
+    const foreign = (await Promise.all(recordedPids.map(async (pid) => {
+        const now = identities[pid] ? await processBirth(pid) : undefined;
+        return now && now !== identities[pid] ? { pid, recorded: identities[pid], now } : undefined;
+    }))).filter((entry) => !!entry);
     const pids = recordedPids.filter((pid) => !foreign.some((entry) => entry.pid === pid));
     const processServices = Object.values(instance?.services ?? {}).filter((service) => service.type !== 'external' && service.log);
     // Only a service still alive is stopped by this `down`; a dead one's end was not the World's.
     const stillAlive = undeadPids(processServices.map((service) => service.pid).filter((pid) => pids.includes(pid)));
     recordWorldStop(processServices.filter((service) => stillAlive.includes(service.pid)).map((service) => service.log), 'world.service.stop', 'down', 'SIGTERM');
-    const stopped = signalPids(pids, 'SIGTERM');
+    const stopped = await signalPids(pids, 'SIGTERM', identities, spawnedChildren);
     // Stop self-managed externals via their declared `down` command. A missing instance is
     // safe only without retained lifecycle ownership, checked before any signals above.
     let externalStopped = [];
     let externalErrors = [];
+    let unavailable = [];
     try {
         if (!instance)
             throw new Error('World instance unavailable');
         const result = await teardownExternalServices(instance);
         externalStopped = result.stopped;
         externalErrors = result.errors;
+        unavailable = result.unavailable;
     }
     catch {
         // no instance.json (never fully came up) — only owned processes needed stopping.
@@ -2357,12 +2702,22 @@ async function downWorldClaimed(name, root, options) {
     // Escalate AFTER the external teardown so externals never wait on the grace, and
     // poll the full pids list rather than `stopped`: a pid whose SIGTERM errored is almost always
     // already dead, and livePids() re-checks anyway.
-    const escalated = await killSurvivorsAfterGrace(pids, options.graceMs ?? DOWN_GRACE_MS_DEFAULT);
+    const escalated = await killSurvivorsAfterGrace(pids, options.graceMs ?? DOWN_GRACE_MS_DEFAULT, identities, spawnedChildren);
     recordWorldStop(processServices.filter((service) => escalated.includes(service.pid)).map((service) => service.log), 'world.service.killed', 'down', 'SIGKILL');
+    // A launch which had already entered its spawn seam may publish while TERM is delivered.
+    // Once services/agents retire, join every late receipt before certifying this generation stopped.
+    const lateGuests = readGuestProcesses(dir, instance?.instance).filter(receipt => !pids.includes(receipt.record.pid));
+    try {
+        await retireOwnedProcessGroups(lateGuests.map(receipt => receipt.record), options.graceMs ?? DOWN_GRACE_MS_DEFAULT);
+    }
+    catch (error) {
+        externalErrors.push(errorMessage(error));
+    }
+    pids.push(...lateGuests.map(receipt => receipt.record.pid));
     if (holderPid && !externalErrors.length && !undeadPids(pids).length) {
         pids.push(holderPid);
-        stopped.push(...signalPids([holderPid], 'SIGTERM'));
-        escalated.push(...await killSurvivorsAfterGrace([holderPid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT));
+        stopped.push(...await signalPids([holderPid], 'SIGTERM', identities, spawnedChildren));
+        escalated.push(...await killSurvivorsAfterGrace([holderPid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT, identities, spawnedChildren));
     }
     // Finalization belongs to this exact generation, not just the reusable name. A new up may
     // win once the old PIDs exit; never erase its PID file, lifecycle or instance directory.
@@ -2379,24 +2734,41 @@ async function downWorldClaimed(name, root, options) {
             externalErrors.push('Proxy or sharing lifecycle changed during teardown; cleanup refused');
             return result;
         }
-        const surviving = undeadPids(pids);
+        const guestReceipts = readGuestProcesses(dir, instance?.instance);
+        const surviving = undeadPids([...pids, ...guestReceipts.map(receipt => receipt.record.pid)]);
         if (surviving.length)
             externalErrors.push(`World processes still alive or uninspectable after teardown: ${surviving.join(', ')}; cleanup refused`);
+        if (guestReceipts.some(receipt => foreign.some(entry => entry.pid === receipt.record.pid)))
+            externalErrors.push('Guest spawn identity changed; receipt retained and cleanup refused');
+        let externalAbandoned;
+        if (options.purge && instance && externalErrors.length && externalErrors.length === unavailable.length && !foreign.length) {
+            const inventory = exitedWorldLifecyclePids(resolvedRoot, name, instance.createdAt);
+            if (inventory && !undeadPids([...pids, ...inventory, ...(holderPid ? [holderPid] : [])]).length) {
+                const consumers = worldConsumers(resolvedRoot, name);
+                if (!consumers.warnings.length && consumers.consumers.every(c => c.state === 'exited')) {
+                    externalAbandoned = [...externalErrors];
+                    recordWorldLifecycleEvent(resolvedRoot, name, `explicit purge surrendered state; unavailable backend not certified stopped:\n${externalAbandoned.join('\n')}`);
+                    externalErrors.splice(0);
+                }
+            }
+        }
         if (externalErrors.length)
             return result;
+        releaseGuestProcesses(guestReceipts);
         rmSync(pidsFile, { force: true });
         if (before) {
             writeTextAtomic(join(dir, 'stopped.json'), `${JSON.stringify({
                 instanceHash: createHash('sha256').update(before).digest('hex'), stoppedAt: new Date().toISOString(),
+                ...(externalAbandoned ? { externalAbandoned } : {}),
             })}\n`);
         }
-        releaseWorldLifecycle(resolvedRoot, name);
+        releaseWorldLifecycle(resolvedRoot, name, externalAbandoned ? 'recorded processes exited; explicit purge surrendered state; ownership released' : undefined);
         if (!options.purge)
             return result;
         const purged = purgeInstanceDir(resolvedRoot, name);
         if (purged && instance)
             clearBrowserFiles(instance.dirs.data, resolvedRoot);
-        return { ...result, purged };
+        return { ...result, ...(externalAbandoned ? { externalAbandoned } : {}), purged };
     }));
 }
 export function statusWorld(name, root = process.cwd(), options = {}) {
@@ -2499,7 +2871,7 @@ function worldCleanupEntry(name, root) {
             assertWorldStateRemovable(root, path);
         }
         catch (error) {
-            return { ...entry, reason: error instanceof Error ? error.message : 'Branch ancestry unreadable; retained' };
+            return { ...entry, reason: errorMessage(error) };
         }
         return { ...entry, eligible: true, reason: 'successfully stopped; disposable instance data only', stoppedAt: receipt.stoppedAt, logicalBytes: logicalTreeBytes(path) };
     }
@@ -2540,7 +2912,7 @@ function worldServiceControlRoot(name, service, root = process.cwd()) {
     const instance = readWorldInstance(name, resolve(root));
     if (!instance.services[service])
         throw new Error(`World ${name} has no service "${service}"`);
-    return join(instance.dirs.data, service);
+    return ownedPath(instance.dirs.data, service);
 }
 function worldServiceStateService(controlRoot, requestedService) {
     const stateRoot = join(controlRoot, stateDirName(), 'world');
@@ -2639,7 +3011,7 @@ async function waitForPublicUrl(child, logPath, timeoutMs, requireTryCloudflare)
     });
     child.once('error', (error) => {
         exited = true;
-        exitSummary = error.message;
+        exitSummary = errorMessage(error);
     });
     const started = Date.now();
     while (Date.now() - started < timeoutMs) {
@@ -2671,18 +3043,18 @@ function commandExists(command) {
     // Pass the live env so PATH reflects the current process (some runtimes snapshot env otherwise).
     return OWN_COMMANDS[command] !== undefined || onPath(command);
 }
-/** A lifecycle command naming this runtime's own bin (`volter-world-infra`, which `init` names in every managed
- *  infrastructure's lifecycle) runs this runtime's own script with the executable running it, when nothing on PATH
- *  answers the name: a bare `volter-world down` (no runner that put node_modules/.bin on PATH) failed "not found on
- *  PATH" and left the infrastructure up. Only the name is mapped — no directory joins PATH — and a same-named
- *  command on PATH still wins, as before. */
+/** Built-in lifecycle names belong to the executing runtime. PATH may contain another
+ * checkout's package-manager bin links; an operator override names an explicit executable path. */
 const OWN_COMMANDS = { 'volter-world-infra': 'infra-cli' };
 export function ownCommand(command) {
     const [bin, ...args] = command;
     const stem = bin === undefined ? undefined : OWN_COMMANDS[bin];
-    if (stem === undefined || onPath(bin))
+    if (stem === undefined)
         return command;
-    return [process.execPath, siblingScript(import.meta.url, stem), ...args];
+    const script = siblingScript(import.meta.url, stem);
+    const loader = typeof globalThis.Bun === 'undefined' && script.endsWith('.ts')
+        ? ['--experimental-transform-types', '--no-warnings'] : [];
+    return [process.execPath, ...loader, script, ...args];
 }
 /** A command answers when it names an executable: a path is checked as a file (what `which` does with a path),
  *  never by spawning `which`. `ownCommand` hands this the running executable's own path (process.execPath), and a
@@ -2828,7 +3200,7 @@ async function shareWorldReserved(name, options) {
         throw new Error(`World "${name}" service "${serviceId}" has no local URL to share (external/self-managed services are not assigned one)`);
     }
     const tunnel = shareCommand(options, service.url);
-    const log = join(instance.dirs.logs, `${serviceId}.tunnel.log`);
+    const log = ownedPath(instance.dirs.logs, `${serviceId}.tunnel.log`);
     // Each spawned tunnel owns one log generation. Truncating before spawn prevents a repeated
     // share from accepting the previous process's URL handshake as the new process's endpoint.
     const out = openPrivateLog(log, 'w');
@@ -2838,11 +3210,18 @@ async function shareWorldReserved(name, options) {
         detached: true,
         stdio: ['ignore', out, out],
     });
-    closeSync(out);
+    const birth = retainSpawn(child);
+    const identities = {};
+    const handles = new Map(child.pid ? [[child.pid, child]] : []);
     let publicUrl;
     let publicVerification;
     let pidsWritten = false;
     try {
+        closeSync(out);
+        const identity = await birth;
+        if (!identity?.start)
+            throw new Error('Tunnel birth capture failed; retiring held child');
+        identities[identity.pid] = identity.start;
         publicUrl = await waitForPublicUrl(child, log, options.timeoutMs ?? 20_000, tunnel.provider === 'cloudflare-quick');
         if (options.verifyPath !== false) {
             publicVerification = await verifyPublicUrl(publicUrl, options.verifyPath ?? '/health', options.timeoutMs ?? 90_000);
@@ -2877,8 +3256,8 @@ async function shareWorldReserved(name, options) {
         // gives owned services (a cloudflared that ignores SIGTERM must not keep serving after a
         // failed/rejected `share`).
         if (child.pid) {
-            signalPids([child.pid], 'SIGTERM');
-            await killSurvivorsAfterGrace([child.pid], DOWN_GRACE_MS_DEFAULT);
+            await signalPids([child.pid], 'SIGTERM', identities, handles);
+            await killSurvivorsAfterGrace([child.pid], DOWN_GRACE_MS_DEFAULT, identities, handles);
         }
         const cleanupProblems = [];
         if (child.pid && undeadPids([child.pid]).length > 0)
@@ -2891,11 +3270,11 @@ async function shareWorldReserved(name, options) {
                 writePidsFromInstance(instance);
             }
             catch (restoreError) {
-                cleanupProblems.push(`could not restore pids file: ${restoreError instanceof Error ? restoreError.message : String(restoreError)}`);
+                cleanupProblems.push(`could not restore pids file: ${errorMessage(restoreError)}`);
             }
         }
         if (cleanupProblems.length > 0) {
-            throw new Error(`${error instanceof Error ? error.message : String(error)}; share cleanup incomplete: ${cleanupProblems.join('; ')}`, { cause: error });
+            throw new Error(`${errorMessage(error)}; share cleanup incomplete: ${cleanupProblems.join('; ')}`, { cause: error });
         }
         throw error;
     }
@@ -2944,11 +3323,9 @@ export async function shareWorldServices(name, options = {}) {
  * services — SIGTERM, confirm dead (escalating to SIGKILL past the grace), and only THEN erase the
  * tunnel facts/pids. A best-effort SIGTERM with no confirmation can leave a `cloudflared` that
  * ignores SIGTERM serving the public URL forever while instance.json (and the pids file) say
- * nothing is shared — the exact "half-shared" state docs/concepts/worlds.md promises cannot exist. Stays
- * synchronous (via `killSurvivorsAfterGraceSync`) to match the existing signature/call sites
- * (the CLI does not await it). Returns the instance plus the tunnel pids that needed escalating,
+ * nothing is shared — the exact "half-shared" state docs/concepts/worlds.md promises cannot exist. Retirement awaits asynchronous birth verification. Returns the instance plus the tunnel pids that needed escalating,
  * for callers that want to report it. */
-export function unshareWorld(name, options = {}) {
+export async function unshareWorld(name, options = {}) {
     const root = resolve(options.root ?? process.cwd());
     const instance = readWorldInstance(name, root);
     const serviceIds = options.service ? [options.service] : Object.keys(instance.services);
@@ -2960,13 +3337,14 @@ export function unshareWorld(name, options = {}) {
             throw new Error(`World "${name}" has no service "${serviceId}"`);
         if (service.tunnel?.pid) {
             const pid = service.tunnel.pid;
-            signalPids([pid], 'SIGTERM');
-            const survivors = killSurvivorsAfterGraceSync([pid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT);
+            const identities = readIdentities(root, name);
+            await signalPids([pid], 'SIGTERM', identities);
+            const survivors = await killSurvivorsAfterGrace([pid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT, identities);
             if (survivors.length > 0)
                 escalated.push(...survivors);
             // `undeadPids` (not the raw `livePids`) is the right "confirmed dead" test here: a zombie
-            // (exited but unreaped — likely since we just polled it synchronously via `Atomics.wait`,
-            // which blocks the event loop that would otherwise let this process auto-reap its child) still
+            // (exited but unreaped, possibly awaiting its parent's reap) still
+            // occupies a process-table entry and
             // answers `kill(pid, 0)` yet is dead for every practical purpose — see `survivingOwnedGroups`' own
             // comment. Using plain `livePids` here would treat every zombie as "still shared".
             if (undeadPids([pid]).length > 0) {
@@ -3018,7 +3396,7 @@ async function probeExternalOnce(ready, cwd, env, logPath) {
             return { ok: false, message: `probe returned HTTP ${response.status}` };
         }
         catch (error) {
-            return { ok: false, message: `probe failed: ${error instanceof Error ? error.message : String(error)}` };
+            return { ok: false, message: `probe failed: ${errorMessage(error)}` };
         }
     }
     if (ready.stdoutMatch !== undefined) {
@@ -3046,7 +3424,7 @@ export async function doctorWorld(name, options = {}) {
         checks.push({ id: 'instance', ok: true, message: `instance=${instanceFile(root, name)}` });
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
+        const message = errorMessage(error);
         return { name, ok: false, checks: [{ id: 'instance', ok: false, message }] };
     }
     checks.push({ id: 'env-file', ok: existsSync(instance.envFile), message: instance.envFile });
@@ -3100,7 +3478,7 @@ export async function doctorWorld(name, options = {}) {
                     checks.push({ id: `service:${service.id}:external`, ok: true, message: `${discoveredMessage}; probe ok (status)` });
                 }
                 catch (error) {
-                    checks.push({ id: `service:${service.id}:external`, ok: false, message: `${discoveredMessage}; probe failed: ${error instanceof Error ? error.message : String(error)}` });
+                    checks.push({ id: `service:${service.id}:external`, ok: false, message: `${discoveredMessage}; probe failed: ${errorMessage(error)}` });
                 }
             }
             else {
@@ -3143,7 +3521,7 @@ export async function doctorWorld(name, options = {}) {
             checks.push({
                 id: `service:${service.id}:tcp`,
                 ok: false,
-                message: error instanceof Error ? error.message : String(error),
+                message: errorMessage(error),
             });
         }
         if (service.tunnel || service.publicUrl) {
@@ -3173,7 +3551,7 @@ export async function doctorWorld(name, options = {}) {
                     checks.push({
                         id: `service:${service.id}:public-health`,
                         ok: false,
-                        message: error instanceof Error ? error.message : String(error),
+                        message: errorMessage(error),
                     });
                 }
             }
@@ -3263,7 +3641,7 @@ export async function runWorldOwned(configId, command, options, abort) {
     let failed = false;
     let retired = true;
     try {
-        outcome = await runWithWorldEnvLogged(instance.name, command, instance.root, { abort, verbose: options.verbose });
+        outcome = await runWithWorldEnvLogged(instance.name, command, instance.root, { cwd: options.cwd, abort, verbose: options.verbose });
         instance.lastRun = outcome;
         saveWorldInstance(instance);
     }
@@ -3284,7 +3662,7 @@ export async function runWorldOwned(configId, command, options, abort) {
         }
         catch (error) {
             if (failed)
-                throw new AggregateError([failure, error], `World execution and cleanup failed: ${String(failure)}; ${String(error)}`);
+                throw new AggregateError([failure, error], `World execution and cleanup failed: ${errorMessage(failure)}; ${errorMessage(error)}`);
             throw error;
         }
     }
@@ -3297,7 +3675,7 @@ async function finishTaskWorld(instance) {
     let uncertainSince;
     for (;;) {
         try {
-            const result = await downWorld(instance.name, instance.root, { expectedCreatedAt: instance.createdAt });
+            const result = await downWorld(instance.name, instance.root, { expectedInstance: instance.instance });
             if (result.externalErrors.length) {
                 const message = `World "${instance.name}" cleanup incomplete: ${result.externalErrors.join('; ')}. Reservation and diagnostics retained.`;
                 // The caller that would have read this on stderr may be gone; the lifecycle log keeps it.
@@ -3373,7 +3751,7 @@ function worldAttachedCommandEnv(name, root, verbose = false) {
         if (error instanceof CaTrustError)
             throw error;
         if (sealed && hostHasRawEgress())
-            throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing to run the command (${error instanceof Error ? error.message : String(error)})`);
+            throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing to run the command (${errorMessage(error)})`);
         // Keep env-only redirect if the ambient proxy cannot start.
     }
     return { instance: status, env: withAppUrl(name, root, { ...baseEnv, ...proxyEnv, VOLTER_WORLD: name,
@@ -3410,8 +3788,15 @@ export function runWithWorldEnv(name, command, root = process.cwd(), options = {
             env: { ...attached.env, ...(options.env ?? {}) },
             stdio: 'inherit',
         });
-        const forward = (signal) => { if (child.exitCode === null && child.signalCode === null)
-            child.kill(signal); };
+        const forward = (signal) => {
+            try {
+                if (child.pid && child.exitCode === null && child.signalCode === null)
+                    signalChild(child, signal);
+            }
+            catch (error) {
+                process.stderr.write(`${errorMessage(error)}\n`);
+            }
+        };
         process.on('SIGINT', forward);
         process.on('SIGTERM', forward);
         child.once('error', () => { offSignal('SIGINT', forward); offSignal('SIGTERM', forward); resolveExit(1); });
@@ -3584,7 +3969,7 @@ async function runWithWorldEnvLogged(name, command, root, options = {}) {
         attached = worldAttachedCommandEnv(name, root, options.verbose);
     }
     catch (cause) {
-        return finish(1, undefined, cause instanceof Error ? cause.message : String(cause));
+        return finish(1, undefined, errorMessage(cause));
     }
     return await new Promise((resolveOutcome, rejectOutcome) => {
         let spawnError;
@@ -3598,7 +3983,7 @@ async function runWithWorldEnvLogged(name, command, root, options = {}) {
             });
         }
         catch (cause) {
-            resolveOutcome(finish(1, undefined, cause instanceof Error ? cause.message : String(cause)));
+            resolveOutcome(finish(1, undefined, errorMessage(cause)));
             return;
         }
         const lifetime = commandLifetime(child, options.abort);
@@ -3608,7 +3993,7 @@ async function runWithWorldEnvLogged(name, command, root, options = {}) {
                 writeSync(logFd, chunk);
             }
             catch (error) {
-                spawnError = String(error);
+                spawnError = errorMessage(error);
                 lifetime.cancel('SIGTERM');
             }
         });
@@ -3618,12 +4003,12 @@ async function runWithWorldEnvLogged(name, command, root, options = {}) {
                 writeSync(logFd, chunk);
             }
             catch (error) {
-                spawnError = String(error);
+                spawnError = errorMessage(error);
                 lifetime.cancel('SIGTERM');
             }
         });
         child.once('error', (cause) => {
-            spawnError = cause.message;
+            spawnError = errorMessage(cause);
         });
         const activeRecord = {
             state: 'running',
@@ -3636,7 +4021,7 @@ async function runWithWorldEnvLogged(name, command, root, options = {}) {
             writeTextAtomic(foregroundRunFile(instance.root, instance.name), `${JSON.stringify(activeRecord, null, 2)}\n`);
         }
         catch (error) {
-            spawnError = String(error);
+            spawnError = errorMessage(error);
             lifetime.cancel('SIGTERM');
         }
         void lifetime.finish().then(({ code, signal }) => {
@@ -3690,8 +4075,8 @@ export async function shellWorld(name, root = process.cwd()) {
             if (error instanceof CaTrustError)
                 throw error;
             if (sealed)
-                throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing to open a shell (${error instanceof Error ? error.message : String(error)})`);
-            process.stderr.write(`world '${name}': ambient TLS proxy unavailable (${error instanceof Error ? error.message : String(error)}); falling back to env-only redirect.\n`);
+                throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing to open a shell (${errorMessage(error)})`);
+            process.stderr.write(`world '${name}': ambient TLS proxy unavailable (${errorMessage(error)}); falling back to env-only redirect.\n`);
         }
     }
     else {
@@ -3746,17 +4131,7 @@ function currentProxyState(root, name) {
         return null;
     if (existing.guestUrl)
         return existing;
-    try {
-        process.kill(existing.pid, 'SIGTERM');
-    }
-    catch { /* gone already */ }
-    for (let i = 0; i < 50 && isAlive(existing.pid); i += 1)
-        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
-    try {
-        rmSync(proxyStateFile(root, name), { force: true });
-    }
-    catch { /* ignore */ }
-    return null;
+    throw new Error('World proxy lacks its guest listener; stop this World before restarting its proxy');
 }
 function ensureWorldProxyUnlocked(name, root, caller) {
     const resolvedRoot = resolve(root);
@@ -3814,16 +4189,36 @@ function startProxyDaemonOwned(name, root, caCertPath, envFile, boot, caller = p
             child = spawn(process.execPath, [proxyDaemonEntry(), name, '--root', root, ...(envFile ? [`--env-file=${envFile}`] : [])], { windowsHide: true,
                 cwd: root, env: process.env, detached: true, stdio: ['ignore', proxyOut, proxyOut],
             });
+            if (child.pid) {
+                spawnedChildren.set(child.pid, child);
+                if (boot) {
+                    boot.pids.add(child.pid);
+                    boot.handles.set(child.pid, child);
+                }
+            }
         }
         finally {
             closeSync(proxyOut);
         }
     }
     catch (error) {
+        if (child?.pid) {
+            try {
+                signalChild(child, 'SIGTERM', true);
+                killHeldSurvivorsSync(child, DOWN_GRACE_MS_DEFAULT);
+                if (undeadPids([child.pid]).length)
+                    throw new CommandRetirementError('Proxy retirement unconfirmed; startup intent retained');
+            }
+            catch (cleanup) {
+                throw new AggregateError([error, cleanup], 'Proxy spawn/descriptor close and retirement failed');
+            }
+        }
         try {
             rmSync(marker, { force: true });
         }
-        catch { /* the spawn's failure is the one to report */ } // no child was returned by spawn
+        catch (cleanup) {
+            throw new AggregateError([error, cleanup], 'Proxy spawn and intent cleanup failed');
+        }
         throw error;
     }
     child.on('error', () => { }); // a failed spawn can emit after this synchronous operation throws
@@ -3832,20 +4227,23 @@ function startProxyDaemonOwned(name, root, caCertPath, envFile, boot, caller = p
         rmSync(marker, { force: true });
         throw new Error(`World "${name}": ambient proxy process did not start`);
     }
-    boot?.pids.add(pid); // before any fallible filesystem operation
+    if (boot) {
+        boot.pids.add(pid);
+        boot.handles.set(pid, child);
+    } // before any fallible filesystem operation
     child.unref();
     let retirementAttempted = false;
     const retire = () => {
         retirementAttempted = true;
-        signalPids([pid], 'SIGTERM');
-        killSurvivorsAfterGraceSync([pid], DOWN_GRACE_MS_DEFAULT);
+        signalChild(child, 'SIGTERM', true);
+        killHeldSurvivorsSync(child, DOWN_GRACE_MS_DEFAULT);
         if (undeadPids([pid]).length) {
             const error = new CommandRetirementError(`World "${name}": proxy process ${pid} retirement is unconfirmed; ownership retained`);
             try {
                 retainWorldLifecycleForCleanup(root, name);
             }
             catch (cause) {
-                error.message += `; claim update failed: ${String(cause)}`;
+                error.message += `; claim update failed: ${errorMessage(cause)}`;
             }
             throw error;
         }
@@ -3859,12 +4257,21 @@ function startProxyDaemonOwned(name, root, caCertPath, envFile, boot, caller = p
             boot.recordPids();
         else
             writeOwnedPids(root, name, [pid], [pid]);
-        rmSync(marker, { force: true }); // canonical ownership is now durable
         const deadlineMs = proxyDaemonDeadlineMs();
         const deadline = Date.now() + deadlineMs;
         while (Date.now() < deadline) {
             const state = readProxyState(root, name);
             if (state?.pid === pid) {
+                if (!state.birth)
+                    throw new Error('Proxy birth token missing; retiring held child');
+                spawnedIdentities.set(pid, { pid, start: state.birth });
+                if (boot) {
+                    boot.identities[pid] = state.birth;
+                    boot.recordPids();
+                }
+                else
+                    writeOwnedPids(root, name, [pid], [pid]);
+                rmSync(marker, { force: true }); // both numeric ownership and birth are durable
                 if (!boot)
                     handoffWorldLifecycle(root, name, readPids(join(instanceDir(root, name), 'pids')));
                 return { url: state.url, caCertPath: state.caCertPath, env: proxyEnvFor(state.url, state.caCertPath, caller, state.guestUrl) };
@@ -3888,14 +4295,13 @@ function startProxyDaemonOwned(name, root, caCertPath, envFile, boot, caller = p
                 retire();
             }
             catch (retirement) {
-                const cause = error instanceof Error ? error.message : String(error);
+                const cause = errorMessage(error);
                 if (retirement instanceof CommandRetirementError) {
-                    Object.assign(retirement, { retirement: retirement.message, cause: error });
-                    retirement.message = `${cause}; ${retirement.message}`;
+                    Object.assign(retirement, { retirement: errorMessage(retirement), cause: error });
+                    retirement.message = `${cause}; ${errorMessage(retirement)}`;
                     throw retirement;
                 }
-                if (error instanceof Error)
-                    error.message += `; retiring the proxy failed too: ${retirement instanceof Error ? retirement.message : String(retirement)}`;
+                throw new AggregateError([error, retirement], 'Proxy startup and retirement failed');
             }
         }
         throw error;
@@ -3931,8 +4337,13 @@ export async function runProxyDaemon(name, root = process.cwd(), envFile) {
         env = { ...admittedEnv(stripEnvOf(status.env)), ...status.env };
     }
     const proxy = await startRedirectProxy({ env, envLoader, tlsDir: tlsDir(resolvedRoot, name), note: (line) => process.stderr.write(`${line}\n`) });
-    const state = { pid: process.pid, url: proxy.url, caCertPath: proxy.caCertPath, guestUrl: proxy.guestUrl };
-    writeFileSync(proxyStateFile(resolvedRoot, name), JSON.stringify(state));
+    const identity = await spawnIdentity(process.pid);
+    if (!identity.start) {
+        await proxy.close();
+        throw new Error('Proxy birth capture failed');
+    }
+    const state = { pid: process.pid, birth: identity.start, url: proxy.url, caCertPath: proxy.caCertPath, guestUrl: proxy.guestUrl };
+    writeTextAtomic(proxyStateFile(resolvedRoot, name), JSON.stringify(state));
     // Not a recorded service, so it records its own start and end in the World's events (a crash included; a SIGKILL
     // leaves none, which doctor's proxy check then names).
     const events = worldEventsPath(join(instanceDir(resolvedRoot, name), 'logs'));
@@ -3960,13 +4371,19 @@ export async function runProxyDaemon(name, root = process.cwd(), envFile) {
 }
 /** Stop a world's ambient-redirect proxy daemon (if any) and drop its session CA. Best-effort —
  * called from `downWorld` so the trusted CA never outlives the world. */
-function stopWorldProxy(root, name) {
+async function stopWorldProxy(root, name, handles) {
     const state = readProxyState(root, name);
     if (state && isAlive(state.pid)) {
-        try {
-            process.kill(state.pid, 'SIGTERM');
+        const identities = readIdentities(root, name);
+        const identity = { pid: state.pid, start: state.birth ?? identities[state.pid] };
+        const child = handles?.get(state.pid);
+        if (child)
+            await signalHeldChild(child, 'SIGTERM', false, Promise.resolve(identity));
+        else {
+            if (!state.birth && !Object.hasOwn(identities, state.pid))
+                throw new Error('Proxy spawn identity missing; retirement refused; ownership retained');
+            await signalOwnedProcess(identity, 'SIGTERM');
         }
-        catch { /* ignore */ }
     }
     try {
         rmSync(proxyStateFile(root, name), { force: true });
@@ -4016,7 +4433,7 @@ export function activateScript(name, root = process.cwd()) {
         if (error instanceof CaTrustError)
             throw error;
         if (sealed && hostHasRawEgress())
-            throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing activation (${error instanceof Error ? error.message : String(error)})`);
+            throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing activation (${errorMessage(error)})`);
         // openssl missing or daemon failed — keep env-only redirect; never fabricate proxy success.
     }
     env = withAppUrl(name, root, env);