@volter/world-runtime 3.0.37 → 3.0.39

package/src/runtime.ts

@@ -1,3 +1,4 @@
+import { errorMessage } from './error-message.ts';
 import { materializeBrowserFiles, clearBrowserFiles } from './browsers.ts';
 import { claimEnvOutput, publishEnvOutput } from './env-output.ts';
 import { offSignal } from './signals.ts';
@@ -11,21 +12,27 @@ import { get as httpGet, type ClientRequest } from 'node:http';
 import { siblingScript } from './sibling.ts';
 import { commandLifetime, commandProcessGroup, CommandRetirementError } from './command-lifetime.ts';
 import { superviseWorldRun } from './run-task.ts';
-import { survivingOwnedGroups } from './process-groups.ts';
+import { processStarts, survivingOwnedGroups } from './process-groups.ts';
+import { spawnIdentity, signalOwnedProcess, signalChild, signalHeldChild, processBirth, childIdentity } from './process-signal.mjs';
+import type { SpawnIdentity } from './process-receipt.ts';
+import { readGuestProcesses, releaseGuestProcesses } from './guest-processes.mjs';
+
 import { randomUUID, createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { isIP } from 'node:net';
 import { allocatePort } from './tcp-port.ts';
 import { constants as osConstants, hostname as osHostname } from 'node:os';
-import { accessSync, appendFileSync, chmodSync, closeSync, constants as fsConstants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, writeSync, existsSync } from 'node:fs';
+import { accessSync, appendFileSync, chmodSync, closeSync, constants as fsConstants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, writeSync, existsSync, fchmodSync, ftruncateSync } from 'node:fs';
 import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import { packFacts } from './pack-facts.ts';
+import { assertOwnedRealPath, ownedPath } from './owned-path.ts';
+import { isEnvironmentName } from './schema.ts';
 import { infraConnections, parseInfraDefinition } from './pglite-backing.ts';
 import { describeServiceEnd, readServiceEnd, serviceOutput } from './service-exit.ts';
 import { Socket } from 'node:net';
 import { getActiveWorldStore, withFileLock, stateDirName, PROTOCOL_VERSION, PROTOCOL_MAJOR, protocolStanding, WORLD_BOOT_PATH, WORLD_DATA_ENV, WORLD_ENV_NAMES_ENV } from '@volter/world-core/runtime';
 import { loadWorldConfig } from './configs.ts';
-import { createWorldNetworkPolicy, WORLD_NETWORK_POLICY_ENV } from '@volter/world-core/network-policy';
+import { createWorldNetworkPolicy, parseWorldNetworkPolicy, normalizeWorldNetwork, intersectWorldNetwork, type WorldNetwork, WORLD_NETWORK_POLICY_ENV } from '@volter/world-core/network-policy';
 import { overlayPackFactsFile, resolveServicePackage } from './catalog.ts';
 import { fakeEnvValue } from './fixture-env.ts';
 import { APP_URL_ENV, ISSUE_ENV_PREFIX, MINT_ENV } from './schema.ts';
@@ -35,7 +42,23 @@ import { activeVendorMap, ensureCa, hostHasRawEgress, opensslAvailable, proxyEnv
 import { CaTrustError, sessionTrustEnv, type CaTrustInputs } from './ca-trust.ts';
 import type { WorldConfig, WorldExternalReadyWhen, WorldInstance, WorldIsolation, WorldMode, WorldRunOutcome, WorldRunRecord, WorldServiceConfig, WorldServiceInstance } from './schema.ts';
 import { checkedOwner, CONSUMER_HEARTBEAT_MS, createConsumer, refreshConsumer, releaseConsumer, removeConsumerRecord, worldConsumers } from './consumers.ts';
-import { assertLifecycleStartable, beginWorldLifecycle, handoffWorldLifecycle, recordWorldLifecycleEvent, releaseWorldLifecycle, retainWorldLifecycleForCleanup, hasWorldLifecycle, isWorldLifecycleRunning, lifecycleLogPath, releaseAbandonedWorldLifecycle } from './lifecycle-record.ts';
+import { assertLifecycleStartable, beginWorldLifecycle, handoffWorldLifecycle, recordWorldLifecycleEvent, releaseWorldLifecycle, retainWorldLifecycleForCleanup, hasWorldLifecycle, isWorldLifecycleRunning, lifecycleLogPath, releaseAbandonedWorldLifecycle, exitedWorldLifecyclePids } from './lifecycle-record.ts';
+
+// Births captured at actual spawn; retries never remeasure a retained PID.
+const spawnedIdentities = new Map<number, SpawnIdentity>();
+const spawnedChildren = new Map<number, ReturnType<typeof spawn>>();
+function retainSpawn(child: ReturnType<typeof spawn>): Promise<SpawnIdentity | undefined> {
+  if (!child.pid) return Promise.resolve(undefined);
+  const pid = child.pid;
+  spawnedChildren.set(pid, child);
+  return childIdentity(child).then(identity => {
+    if (identity && spawnedChildren.get(pid) === child) spawnedIdentities.set(pid, identity);
+    return identity;
+  });
+}
+function heldStarts(): Record<string, string | undefined> {
+  return Object.fromEntries([...spawnedIdentities].map(([pid, identity]) => [pid, identity.start]));
+}
 
 /** The latest `limit` bytes of a service log, reaching into its one rotation (`<log>.1`) when the current file is
  *  shorter: a readiness line printed just before a rotation is still found, and a poll never reads 64 MiB files. */
@@ -62,8 +85,8 @@ export function worldEventsPath(logs: string): string {
  *  its output straight to `log` (capped, time-marked), its start and end are recorded there and in the World's events
  *  file, and it is handed a directory of its own for the log files it writes itself (VOLTER_WORLD_SERVICE_LOG_DIR).
  *  `ended` settles when the recorder exits, right after the service ends and its exit record is written. */
-function spawnRecorded(serviceId: string, command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv, log: string): { child: ReturnType<typeof spawn>; ended: Promise<void> } {
-  const logDir = `${log.replace(/\.log$/, '')}.d`;
+function spawnRecorded(serviceId: string, command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv, log: string, boot: BootContext): { child: ReturnType<typeof spawn>; ended: Promise<void>; identity: Promise<SpawnIdentity | undefined> } {
+  const logDir = ownedPath(dirname(log), `${basename(log).replace(/\.log$/, '')}.d`);
   mkdirSync(logDir, { recursive: true, mode: 0o700 });
   const out = openPrivateLog(log, 'a'); // the service's output and the recorder's records, appended
   const recorderEnv: NodeJS.ProcessEnv = { ...env, VOLTER_WORLD_SERVICE_ID: serviceId, VOLTER_WORLD_SERVICE_LOG: log,
@@ -75,9 +98,13 @@ function spawnRecorded(serviceId: string, command: string, args: string[], cwd:
     detached: true,
     stdio: ['ignore', out, out],
   });
-  closeSync(out);
   const ended = new Promise<void>((resolveEnded) => { child.once('exit', () => resolveEnded()); child.once('error', () => resolveEnded()); });
-  return { child, ended };
+  const identity = retainSpawn(child);
+  if (child.pid) { boot.pids.add(child.pid); boot.handles.set(child.pid, child); }
+  child.once('error', error => boot.fail(error));
+  boot.recordPids();
+  closeSync(out);
+  return { child, ended, identity };
 }
 
 /** A startup wait that fails as soon as the service ends, with the service's own account of its end (exit code or
@@ -218,6 +245,8 @@ export type UpWorldOptions = {
    *  episodes survive the boot; logs and the pid file start clean. Never the default: `up` starts
    *  clean, and the world dir is the reproducible story. */
   keepState?: boolean;
+  /** A branch's base permission: intersects both the config and the launching process. */
+  networkCeiling?: WorldNetwork;
 };
 
 export type ShareWorldOptions = {
@@ -249,6 +278,8 @@ export type WorldDoctorReport = {
 };
 
 export type RunWorldOptions = UpWorldOptions & {
+  /** the command's working directory: the caller's, as `attach` runs its command (default: the World's root) */
+  cwd?: string;
   keep?: boolean;
   verbose?: boolean;
 };
@@ -290,7 +321,8 @@ export function clockFile(root: string, name: string): string {
 }
 
 export function instanceDir(root: string, name: string): string {
-  return join(worldBaseDir(root), name);
+  assertSafeWorldName(name);
+  return ownedPath(worldBaseDir(root), name);
 }
 
 function instanceFile(root: string, name: string): string {
@@ -306,11 +338,13 @@ function foregroundRunFile(root: string, name: string): string {
  * a dot-prefixed sibling: world names must start with an alphanumeric, so `.locks` can never
  * collide with (or be wiped as) a world's instance dir. */
 function instanceLockFile(root: string, name: string): string {
-  return join(worldBaseDir(root), '.locks', `${name}.lock`);
+  assertSafeWorldName(name);
+  return ownedPath(ownedPath(worldBaseDir(root), '.locks'), `${name}.lock`);
 }
 
 function stoppingFile(root: string, name: string): string {
-  return join(worldBaseDir(root), '.locks', `${name}.stop.json`);
+  assertSafeWorldName(name);
+  return ownedPath(ownedPath(worldBaseDir(root), '.locks'), `${name}.stop.json`);
 }
 
 const SHARE_CLAIM_STALE_MS = 60_000;
@@ -332,7 +366,8 @@ export type SharingClaim = {
 // liveness; this is host physics, not world time). Nothing here reads a process table.
 
 function sharingClaimFile(root: string, name: string): string {
-  return join(worldBaseDir(root), '.locks', `${name}.share.json`);
+  assertSafeWorldName(name);
+  return ownedPath(ownedPath(worldBaseDir(root), '.locks'), `${name}.share.json`);
 }
 
 function readSharingClaim(path: string): SharingClaim | undefined {
@@ -443,13 +478,13 @@ function prepareBootForDown(root: string, name: string): void {
     claim = JSON.parse(readFileSync(path, 'utf8')) as BootingClaim;
     if (!claim || !Number.isInteger(claim.pid) || claim.pid <= 0 || typeof claim.at !== 'string'
       || !Number.isFinite(Date.parse(claim.at))) throw new Error('invalid boot claim');
-  } catch {
-    throw new Error(`World "${name}" has unreadable boot ownership; instance and lifecycle retained`);
+  } catch (error) {
+    throw new Error(`World "${name}" has unreadable boot ownership; instance and lifecycle retained`, { cause: error });
   }
   try { process.kill(claim.pid, 0); }
   catch (error) {
     if ((error as NodeJS.ErrnoException).code !== 'ESRCH') {
-      throw new Error(`World "${name}" boot owner is uninspectable; instance and lifecycle retained`);
+      throw new Error(`World "${name}" boot owner is uninspectable; instance and lifecycle retained`, { cause: error });
     }
     rmSync(path); // the recorded booter cannot publish anything after this point
     return;
@@ -488,7 +523,7 @@ function proxyEnvFile(root: string, name: string): string {
   return join(instanceDir(root, name), 'proxy-env.json');
 }
 
-type ProxyState = { pid: number; url: string; caCertPath: string; guestUrl?: string };
+type ProxyState = { pid: number; birth?: string; url: string; caCertPath: string; guestUrl?: string };
 
 function readProxyState(root: string, name: string): ProxyState | null {
   const file = proxyStateFile(root, name);
@@ -583,16 +618,127 @@ export function withoutVaultSignIn<T extends Record<string, string | undefined>>
  * the parent's, or the parent's when it declares none. Routing needs no rule: the parent's twin addresses pass through,
  * so a vendor the inner World does not twin reaches the parent's twin of it.
  */
-function networkOf(name: string, own: { egress: readonly string[] } | undefined, parentEnv: NodeJS.ProcessEnv = process.env): Record<string, string> | undefined {
+function networkOf(name: string, own: WorldNetwork | undefined, recorded: WorldNetwork | undefined, parentEnv: NodeJS.ProcessEnv = process.env): Record<string, string> | undefined {
   const serialized = parentEnv[WORLD_NETWORK_POLICY_ENV];
-  let ceiling: readonly string[] | undefined;
+  let ceiling: WorldNetwork | undefined;
   if (serialized !== undefined) {
-    // an unreadable parent policy closes the child entirely, as it closes the parent
-    try { ceiling = (JSON.parse(serialized) as { egress?: string[] }).egress ?? []; } catch { ceiling = []; }
+    // An unreadable parent policy closes the child, including opaque transport permission.
+    try { ceiling = networkPermission(parseWorldNetworkPolicy(JSON.parse(serialized))); } catch { ceiling = { egress: [] }; }
+  }
+  let network = own;
+  for (const limit of [recorded, ceiling]) if (limit !== undefined) network = network === undefined ? limit : intersectWorldNetwork(network, limit);
+  if (network === undefined) return undefined;
+  return { [WORLD_NETWORK_POLICY_ENV]: JSON.stringify(createWorldNetworkPolicy(name, network)) };
+}
+
+/** Strip the publication envelope before combining permissions (the config shape admits only these keys). */
+function networkPermission(policy: WorldNetwork): WorldNetwork {
+  return { egress: policy.egress, phase: policy.phase, passthrough: policy.passthrough };
+}
+
+/** The boot permission, never a fallback to a mutable config. */
+export function recordedWorldNetwork(instance: WorldInstance): WorldNetwork | undefined {
+  try {
+    if (!Object.hasOwn(instance, 'networkCeiling')) throw new Error();
+    const published = instance.env?.[WORLD_NETWORK_POLICY_ENV];
+    const bound = published === undefined ? undefined : parseWorldNetworkPolicy(JSON.parse(published));
+    if (bound && bound.world !== instance.name) throw new Error();
+    const saved = instance.networkCeiling === 'unrestricted' ? undefined : normalizeWorldNetwork(instance.networkCeiling);
+    const permission = bound === undefined ? undefined : networkPermission(bound);
+    return saved === undefined ? permission : permission === undefined ? saved : intersectWorldNetwork(saved, permission);
+  } catch { throw new Error(`World boot record is incomplete or invalid: ${instanceFile(instance.root, instance.name)}`); }
+}
+
+/** An absent stored ceiling is derived from this World's own config and retained bound environment. */
+function ceilingFromConfig(record: WorldInstance, config: WorldConfig): WorldNetwork | 'unrestricted' {
+  let ceiling = record.mode === 'sealed' ? { egress: [] } : config.network;
+  const published = record.env?.[WORLD_NETWORK_POLICY_ENV];
+  if (published !== undefined) {
+    const bound = parseWorldNetworkPolicy(JSON.parse(published));
+    if (bound.world !== record.name) throw new Error();
+    const permission = networkPermission(bound);
+    ceiling = ceiling === undefined ? permission : intersectWorldNetwork(ceiling, permission);
   }
-  if (own === undefined && ceiling === undefined) return undefined;
-  const egress = own === undefined ? ceiling! : ceiling === undefined ? own.egress : own.egress.filter((origin) => ceiling!.includes(origin));
-  return { [WORLD_NETWORK_POLICY_ENV]: JSON.stringify(createWorldNetworkPolicy(name, { egress: [...egress] })) };
+  return ceiling === undefined ? 'unrestricted' : normalizeWorldNetwork(ceiling);
+}
+
+/** A stopped receipt checks byte consistency before fields are read; it is not authentication. */
+export function readWorldBootRecord(name: string, root: string): WorldInstance {
+  return withFileLock(instanceLockFile(root, name), () => readWorldBootRecordLocked(name, root));
+}
+
+/** Ordinary reading completes derivable metadata and its receipt together under the instance lock. */
+function readWorldBootRecordLocked(name: string, root: string): WorldInstance {
+  const path = instanceFile(root, name);
+  const raw = getActiveWorldStore().read(path);
+  if (raw === null) throw new Error(`World instance not found: ${name}`);
+  try {
+    const receiptPath = join(instanceDir(root, name), 'stopped.json');
+    const stopped = existsSync(receiptPath);
+    const receipt = stopped ? JSON.parse(readFileSync(receiptPath, 'utf8')) : undefined;
+    if (stopped && (receipt.instanceHash !== createHash('sha256').update(raw).digest('hex')
+      || typeof receipt.stoppedAt !== 'string' || !Number.isFinite(Date.parse(receipt.stoppedAt)))) throw new Error();
+    const record = JSON.parse(raw) as WorldInstance;
+    if (record.name !== name || typeof record.root !== 'string' || resolve(record.root) !== resolve(root)
+      || typeof record.createdAt !== 'string' || !Number.isFinite(Date.parse(record.createdAt))
+      || typeof record.config !== 'string' || !record.config || typeof record.configPath !== 'string' || !record.configPath
+      || !record.env || record.env.VOLTER_WORLD !== name || record.env.VOLTER_WORLD_MODE !== record.mode
+      || !record.dirs || record.dirs.instance !== instanceDir(root, name)
+      || record.dirs.data !== join(instanceDir(root, name), 'data') || record.dirs.logs !== join(instanceDir(root, name), 'logs')
+      || typeof record.envFile !== 'string' || !record.envFile || record.pidsFile !== join(instanceDir(root, name), 'pids')
+      || !record.services || typeof record.services !== 'object' || Array.isArray(record.services)) throw new Error();
+    assertMode(record.mode);
+    if (!stopped && !isWorldLifecycleRunning(root, name, record.createdAt)) throw new Error();
+    let completed = false;
+    if (!Object.hasOwn(record, 'instance')) { record.instance = randomUUID(); completed = true; }
+    if (typeof record.instance !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(record.instance)) throw new Error();
+    const needsConfig = !Object.hasOwn(record, 'networkCeiling')
+      || Object.values(record.services).some(service => service && !Object.hasOwn(service, 'branchState'));
+    const config = needsConfig ? loadWorldConfig(record.configPath, root).config : undefined;
+    if (config && config.id !== record.config) throw new Error();
+    if (!Object.hasOwn(record, 'networkCeiling')) {
+      record.networkCeiling = ceilingFromConfig(record, config!);
+      completed = true;
+    }
+    if (!Object.hasOwn(record, 'bootOwner')) {
+      if (!record.lifecycle && !record.resources) throw new Error();
+      record.bootOwner = record.lifecycle?.owner ?? record.resources?.owner ?? null;
+      completed = true;
+    }
+    if (!(record.bootOwner === null || typeof record.bootOwner === 'string')) throw new Error();
+    checkedOwner(record.bootOwner ?? undefined);
+    if (!record.lifecycle) {
+      record.lifecycle = { log: lifecycleLogPath(root, name), ...(record.bootOwner === null ? {} : { owner: record.bootOwner }) };
+      completed = true;
+    }
+    if (!Object.hasOwn(record.lifecycle, 'log')) { record.lifecycle.log = lifecycleLogPath(root, name); completed = true; }
+    if (!Object.hasOwn(record.lifecycle, 'owner') && record.bootOwner !== null) { record.lifecycle.owner = record.bootOwner; completed = true; }
+    if (record.lifecycle.log !== lifecycleLogPath(root, name) || (record.lifecycle.owner ?? null) !== record.bootOwner) throw new Error();
+    if (!Object.hasOwn(record, 'bootServices')) {
+      record.bootServices = Object.keys(record.services);
+      completed = true;
+    }
+    if (!Array.isArray(record.bootServices) || record.bootServices.some(id => typeof id !== 'string')
+      || new Set(record.bootServices).size !== record.bootServices.length
+      || record.bootServices.length !== Object.keys(record.services).length
+      || record.bootServices.some(id => !Object.hasOwn(record.services, id))) throw new Error();
+    for (const [id, service] of Object.entries(record.services)) {
+      if (!service || service.id !== id || !Array.isArray(service.command) || typeof service.type !== 'string') throw new Error();
+      if (!Object.hasOwn(service, 'branchState')) {
+        const declared = config!.services.find(item => item.id === id);
+        if (!declared) throw new Error();
+        service.branchState = declared.branchState ?? 'supported'; completed = true;
+      }
+      if (!['supported', 'unsupported'].includes(service.branchState ?? '')) throw new Error();
+    }
+    recordedWorldNetwork(record);
+    if (completed) {
+      saveWorldInstance(record);
+      if (stopped) writeTextAtomic(receiptPath, JSON.stringify({ ...receipt,
+        instanceHash: createHash('sha256').update(readFileSync(path, 'utf8')).digest('hex') }) + '\n');
+    }
+    return record;
+  } catch { throw new Error(`World boot record is incomplete or invalid: ${path}`); }
 }
 
 export function admittedEnv(strip: string[] | undefined, env: NodeJS.ProcessEnv = process.env): Record<string, string> {
@@ -690,22 +836,16 @@ async function waitForTcp(port: number, timeoutMs = 15_000, abort?: AbortSignal)
 
 function readPids(path: string): number[] {
   const held = getActiveWorldStore().read(path);
-  if (held === null) return [];
-  return held
+  const guests = readGuestProcesses(dirname(path)).map(receipt => receipt.record.pid);
+  return [...new Set([...(held ?? '')
     .split(/\r?\n/)
     .map((line) => Number(line.trim()))
-    .filter((pid) => Number.isInteger(pid) && pid > 0);
+    .filter((pid) => Number.isInteger(pid) && pid > 0), ...guests])];
 }
 
 function livePids(pids: number[]): number[] {
-  return pids.filter((pid) => {
-    try {
-      process.kill(pid, 0);
-      return true;
-    } catch (error) {
-      return (error as NodeJS.ErrnoException).code !== 'ESRCH';
-    }
-  });
+  // A recorded leader may have exited while its detached descendants still run.
+  return survivingOwnedGroups(pids);
 }
 
 function tunnelPids(instance: WorldInstance): number[] {
@@ -730,13 +870,13 @@ function openPrivateLog(path: string, flags: 'a' | 'w'): number {
 /** Record `pids` as the World's. `fresh` are the processes this very call has spawned: only their start times are
  *  measured anew; every other pid keeps the start time recorded when it was spawned (re-measuring it would bless
  *  whatever process holds that number now). */
-function writeOwnedPids(root: string, name: string, pids: number[], fresh: number[] = []): void {
+function writeOwnedPids(root: string, name: string, pids: number[], fresh: number[] = [], births = heldStarts()): void {
   const path = join(instanceDir(root, name), 'pids');
   withFileLock(`${instanceLockFile(root, name)}.pids`, () => {
     const retained = undeadPids(readPids(path));
     const merged = [...new Set([...retained, ...pids].filter(pid => Number.isInteger(pid) && pid > 0))];
     writeTextAtomic(path, `${merged.join('\n')}\n`);
-    recordIdentities(root, name, merged, fresh);
+    recordIdentities(root, name, merged, fresh, births);
   });
 }
 
@@ -747,40 +887,31 @@ function writeOwnedPids(root: string, name: string, pids: number[], fresh: numbe
 function identityPath(root: string, name: string): string {
   return join(instanceDir(root, name), 'pids.identity');
 }
-/** Each running pid's start time; a pid with no process is absent. Printed in one fixed zone and locale, so the same
- *  process reads the same whoever asks (`lstart` otherwise follows the caller's TZ and language). One `ps` per pid:
- *  given two or more pids, macOS `ps -p` walks the whole process table (measured 2026-09-30 on Darwin 25.4, 944
- *  processes: `/usr/bin/time -p ps -o pid=,lstart= -p 1,$$` 0.14–0.35 s, `… -p 1` 0.00 s), which every `status`
- *  paid. */
-function processStarts(pids: number[]): Map<number, string> {
-  const starts = new Map<number, string>();
-  if (!pids.length || process.platform === 'win32') return starts;
-  if (process.platform === 'linux' && existsSync('/proc/self/stat')) {
-    // Linux: the start tick since boot (field 22), which a wall-clock step does not move (lstart would).
-    for (const pid of pids) {
-      try { const stat = readFileSync(`/proc/${pid}/stat`, 'utf8'); starts.set(pid, `tick ${stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19]}`); } catch { /* no process */ }
-    }
-    return starts;
-  }
-  const env = { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' };
-  for (const pid of pids) {
-    const result = spawnSync('ps', ['-o', 'pid=,lstart=', '-p', String(pid)], { windowsHide: true, encoding: 'utf8', timeout: 1000, killSignal: 'SIGKILL', env });
-    const match = /^\s*(\d+)\s+(.+?)\s*$/.exec((result.stdout ?? '').trim());
-    if (match && Number(match[1]) === pid) starts.set(pid, match[2]!);
-  }
-  return starts;
-}
 function readIdentities(root: string, name: string): Record<string, string> {
-  try { return JSON.parse(getActiveWorldStore().read(identityPath(root, name)) ?? '{}') as Record<string, string>; } catch { return {}; }
+  let known: Record<string, string> = {};
+  try {
+    const value = JSON.parse(getActiveWorldStore().read(identityPath(root, name)) ?? '{}');
+    if (value && typeof value === 'object' && !Array.isArray(value)) known = Object.fromEntries(Object.entries(value).filter(([pid, start]) => Number.isInteger(Number(pid)) && Number(pid) > 0 && typeof start === 'string' && start.length > 0)) as Record<string, string>;
+  } catch { /* Guest receipts below remain independently authoritative. */ }
+  const births = new Map<number, string | undefined>();
+  for (const { record } of readGuestProcesses(instanceDir(root, name))) {
+    if (births.has(record.pid) && births.get(record.pid) !== record.start) throw new Error('Conflicting guest spawn identities; ownership retained');
+    births.set(record.pid, record.start);
+  }
+  for (const [pid, start] of births) { if (start) known[pid] = start; else delete known[pid]; }
+  return known;
 }
-function recordIdentities(root: string, name: string, pids: number[], fresh: number[] = []): void {
+function recordIdentities(root: string, name: string, pids: number[], fresh: number[] = [], births = heldStarts()): void {
   try {
     // A pid the World has just spawned is measured anew, whatever an older record says of that number.
-    const known = readIdentities(root, name), starts = processStarts(pids.filter((pid) => known[pid] === undefined || fresh.includes(pid)));
-    for (const pid of fresh) if (starts.has(pid)) delete known[pid];
-    const kept = Object.fromEntries(pids.flatMap((pid) => { const start = known[pid] ?? starts.get(pid); return start ? [[String(pid), start]] : []; }));
+    const known = readIdentities(root, name);
+    for (const pid of fresh) {
+      if (births[pid] !== undefined) known[pid] = births[pid]!;
+      else delete known[pid];
+    }
+    const kept = Object.fromEntries(pids.flatMap(pid => known[pid] === undefined ? [] : [[String(pid), known[pid]]]));
     writeTextAtomic(identityPath(root, name), JSON.stringify(kept));
-  } catch { /* without a record a pid is trusted as before */ }
+  } catch { /* without a record signalling refuses and lifecycle evidence is retained */ }
 }
 /** Recorded pids whose running process started at another time than recorded: the number now names another
  *  program. An unrecorded pid, and a pid with no process, are never in this list. */
@@ -906,13 +1037,15 @@ function getByJsonPath(value: unknown, jsonPath: string): unknown {
   return current;
 }
 
+class ExternalCommandUnavailableError extends Error {}
+
 async function runExternalCommand(
   command: string[], cwd: string, serviceId: string, phase: string,
   env: NodeJS.ProcessEnv = process.env, abort?: AbortSignal, timeoutMs = 60_000,
 ): Promise<{ stdout: string; stderr: string }> {
   const [bin, ...args] = ownCommand(command);
   if (!bin) throw new Error(`External service "${serviceId}": ${phase} command is empty`);
-  if (!commandExists(bin)) throw new Error(`External service "${serviceId}": \`${bin}\` not found on PATH (the ${phase} command's tool is not installed)`);
+  if (!commandExists(bin)) throw new ExternalCommandUnavailableError(`External service "${serviceId}": \`${bin}\` not found on PATH (the ${phase} command's tool is not installed)`);
   abort?.throwIfAborted();
   const child = spawn(bin, args, { windowsHide: true, cwd, env, detached: commandProcessGroup, stdio: ['ignore', 'pipe', 'pipe'] });
   const lifetime = commandLifetime(child, abort, true);
@@ -927,8 +1060,15 @@ async function runExternalCommand(
   const timer = setTimeout(() => { failure = new Error(`command timed out after ${timeoutMs}ms`); lifetime.cancel('SIGTERM'); }, timeoutMs);
   try {
     const result = await lifetime.finish();
-    if (failure) throw new Error(`External service "${serviceId}": ${phase} command failed to run (${failure.message})`);
-    if (result.code !== 0 || lifetime.forwarded) throw new Error(`External service "${serviceId}": ${phase} command exited ${result.code ?? 'null'}\n${stdout}${stderr}`);
+    if (failure) {
+      const ErrorKind = ['ENOENT', 'ENOEXEC', 'EACCES'].includes((failure as NodeJS.ErrnoException).code ?? '') ? ExternalCommandUnavailableError : Error;
+      throw new ErrorKind(`External service "${serviceId}": ${phase} command failed to run (${errorMessage(failure)})`);
+    }
+    if (result.code !== 0 || lifetime.forwarded) {
+      const parserRefusal = /unknown (?:shorthand flag|flag|option|command)|unrecognized (?:option|argument)|command not found|no such file or directory/iu.test(`${stdout}${stderr}`);
+      const ErrorKind = !lifetime.forwarded && ([126, 127].includes(result.code ?? -1) || (result.code === 125 && parserRefusal)) ? ExternalCommandUnavailableError : Error;
+      throw new ErrorKind(`External service "${serviceId}": ${phase} command exited ${result.code ?? 'null'}\n${stdout}${stderr}`);
+    }
     return { stdout, stderr };
   } finally { clearTimeout(timer); }
 }
@@ -981,8 +1121,8 @@ async function runExternalUp(
 }
 
 /** Whether an external `up` is this runtime's own managed-infrastructure tool (`volter-world-infra up`, which `init`
- *  names), with nothing on PATH answering the name: the phase then runs in this process (infra.ts) instead of in a
- *  child. The services it starts (the PGlite host, the redis and MongoDB twins) are then children of the process that
+ *  names): the phase runs in this process (infra.ts) instead of in a
+ *  child. The services it starts (the PGlite host, the redis twin and mongod) are then children of the process that
  *  owns the World's lifetime, as every service recorder is, not of a tool that exits once they serve. Where a child
  *  does not outlive its parent (a browser tab's process layer, measured 2026-09-28: a detached, unref'd listener
  *  ended with the process that spawned it), the PGlite host ended the moment `volter-world-infra up` returned and
@@ -1047,14 +1187,14 @@ async function awaitReadiness(
         throw new Error(`Service "${serviceId}": readiness command \`${ready.command}\` not found on PATH`);
       }
       try { await runExternalCommand([ready.command, ...(ready.args ?? [])], cwd, serviceId, 'readiness', env, abort, Math.max(1, timeoutMs - (Date.now() - started))); return; }
-      catch (error) { if (error instanceof CommandRetirementError) throw error; lastError = String(error); }
+      catch (error) { if (error instanceof CommandRetirementError) throw error; lastError = errorMessage(error); }
     } else if (ready.httpUrl !== undefined) {
       try {
         const response = await fetch(ready.httpUrl, { signal: AbortSignal.any([AbortSignal.timeout(Math.max(1, timeoutMs - (Date.now() - started))), ...(abort ? [abort] : [])]) });
         if (response.status >= 200 && response.status < 400) return;
         lastError = `HTTP ${response.status}`;
       } catch (error) {
-        lastError = error instanceof Error ? error.message : String(error);
+        lastError = errorMessage(error);
       }
     } else if (ready.stdoutMatch !== undefined) {
       const text = serviceOutput(readServiceText(logPath));
@@ -1066,17 +1206,14 @@ async function awaitReadiness(
   throw new Error(`Service "${serviceId}": readiness probe timed out after ${timeoutMs}ms (${lastError || 'no probe matched'})`);
 }
 
-async function startExternalService(
+/** The environment an external service and its replacement infrastructure hosts run in. Shared with branching,
+ *  so both use the boot's admission, service overrides, lifecycle context and control-plane egress rules. */
+export function externalServiceEnv(
   service: WorldServiceConfig,
-  paths: { root: string; logs: string },
+  paths: { logs: string },
   worldEnv: Record<string, string>,
   stripEnv?: string[],
-  boot?: BootContext,
-): Promise<WorldServiceInstance> {
-  const external = service.external;
-  if (!external) throw new Error(`External service "${service.id}" is missing its external config`);
-  const log = join(paths.logs, `${service.id}.log`);
-  const cwd = service.cwd ? resolve(paths.root, service.cwd) : paths.root;
+): NodeJS.ProcessEnv {
   // External commands see the accumulated world env (process.env + earlier services' discovered/
   // injected vars), so a later external can consume an earlier service's connection info.
   const env: NodeJS.ProcessEnv = {
@@ -1084,10 +1221,26 @@ async function startExternalService(
     ...worldEnv,
     ...(service.env ?? {}),
     VOLTER_WORLD_SERVICE_ID: service.id,
-    VOLTER_WORLD_SERVICE_LOG: log,
+    VOLTER_WORLD_SERVICE_LOG: ownedPath(paths.logs, `${service.id}.log`),
   };
   if (service.controlPlane) for (const key of CONTROL_PLANE_EGRESS_ENV) delete env[key];
 
+  return env;
+}
+
+async function startExternalService(
+  service: WorldServiceConfig,
+  paths: { root: string; logs: string },
+  worldEnv: Record<string, string>,
+  stripEnv?: string[],
+  boot?: BootContext,
+): Promise<WorldServiceInstance> {
+  const external = service.external;
+  if (!external) throw new Error(`External service "${service.id}" is missing its external config`);
+  const log = ownedPath(paths.logs, `${service.id}.log`);
+  const cwd = service.cwd ? resolve(paths.root, service.cwd) : paths.root;
+  const env = externalServiceEnv(service, paths, worldEnv, stripEnv);
+
   // 1. up — start the self-managed stack, STREAMING its output to the service log (no 1MB cap).
   if (!external.up[0] || !commandExists(external.up[0])) {
     throw new Error(`External service "${service.id}": \`${external.up[0] ?? ''}\` not found on PATH (the up command's tool is not installed)`);
@@ -1124,7 +1277,7 @@ async function startExternalService(
         try {
           jsonCache[source] = JSON.parse(raw) as unknown;
         } catch (error) {
-          throw new Error(`External service "${service.id}": discover "${mapping.as}" expected JSON from ${source} output but parse failed (${error instanceof Error ? error.message : String(error)})\nOutput: ${raw.slice(0, 500)}`);
+          throw new Error(`External service "${service.id}": discover "${mapping.as}" expected JSON from ${source} output but parse failed (${errorMessage(error)})\nOutput: ${raw.slice(0, 500)}`);
         }
       }
       const found = getByJsonPath(jsonCache[source], mapping.jsonPath);
@@ -1157,12 +1310,18 @@ type BootContext = {
   signal: AbortSignal;
   fail: (error: Error) => void;
   pids: Set<number>;
+  identities: Record<string, string | undefined>;
+  handles: Map<number, ReturnType<typeof spawn>>;
   external: (service: WorldServiceInstance) => void;
   recordPids: () => void;
 };
-function trackBootingChild(child: { pid?: number }, boot: BootContext): void {
+async function trackBootingChild(child: ReturnType<typeof spawn>, boot: BootContext, birth: Promise<SpawnIdentity | undefined>): Promise<void> {
   if (!child.pid) return;
-  boot.pids.add(child.pid);
+  boot.pids.add(child.pid); boot.handles.set(child.pid, child);
+  boot.recordPids(); // durable numeric uncertainty precedes the async birth capture
+  const identity = await birth;
+  if (!identity?.start) throw new Error('Service birth capture failed; retiring held child');
+  boot.identities[child.pid] = identity.start;
   boot.recordPids();
 }
 
@@ -1177,7 +1336,7 @@ async function startService(
   if (service.type === 'external') return startExternalService(service, paths, worldEnv, config.stripEnv, boot);
   if (!service.command) throw new Error(`Service "${service.id}" must define command`);
   const port = service.port === undefined || service.port === 'auto' ? await allocatePort(allocatedPorts) : service.port;
-  const serviceDataDir = join(paths.data, service.id);
+  const serviceDataDir = ownedPath(paths.data, service.id);
   mkdirSync(serviceDataDir, { recursive: true });
   // R17 — the lockfile holds on the spawn path too: a twin that runs a checkout's CLI
   // is checked against its pin and its protocol standing before it is spawned.
@@ -1194,7 +1353,7 @@ async function startService(
   if (service.portArg !== false) args.push(service.portArg ?? '--port', String(port));
   if (service.rootArg !== false) args.push(service.rootArg ?? '--root', serviceDataDir);
 
-  const log = join(paths.logs, `${service.id}.log`);
+  const log = ownedPath(paths.logs, `${service.id}.log`);
   const env = serviceProcessEnv(config, service, worldEnv, port);
   const cwd = service.cwd ? resolve(paths.root, service.cwd) : paths.root;
 
@@ -1209,10 +1368,10 @@ async function startService(
   // The service runs under the service recorder, which outlives it to write its end into its own log: `up`
   // returns once the World is ready, so nothing else is left to see a service stop.
   env.VOLTER_WORLD_BOOT_ID = boot.bootId;
-  const { child, ended } = spawnRecorded(service.id, service.command, args, cwd, env, log);
+  const { child, ended, identity } = spawnRecorded(service.id, service.command, args, cwd, env, log, boot);
   child.once('error', error => boot.fail(error));
   child.unref();
-  trackBootingChild(child, boot);
+  await trackBootingChild(child, boot, identity);
 
   // Track an early exit. allocatePort() is TOCTOU (it closes its probe listener before the
   // child binds), so if another/stale process already holds `port`, the child gets EADDRINUSE
@@ -1229,19 +1388,19 @@ async function startService(
   // swapping, a docker build beside the boot) a heavy service takes longer than the 15s default
   // to answer on its port, and failing it there wastes the whole boot.
   const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
-  await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the service', log).catch((error) => {
+  await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the service', log).catch(async (error) => {
     if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
     try {
-      process.kill(-child.pid!, 'SIGTERM');
+      await signalHeldChild(child, 'SIGTERM', true, identity);
     } catch {
       // best effort cleanup
     }
-    throw new Error(`Service "${service.id}" failed to start: ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
+    throw new Error(`Service "${service.id}" failed to start: ${errorMessage(error)}\nLog: ${log}`);
   });
 
-  await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log, true).catch((error) => {
+  await confirmOwnPort(port, boot, ended, (service.type ?? 'twin') === 'twin', `Service "${service.id}"`, log, true).catch(async (error) => {
     if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
-    try { process.kill(-child.pid!, 'SIGTERM'); } catch { /* best effort cleanup */ }
+    try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
     throw error;
   });
   if (exitState.value !== null) {
@@ -1257,10 +1416,10 @@ async function startService(
   // Optional readiness probe beyond TCP (httpUrl/command/stdoutMatch): a process can bind its port
   // before it is actually serving, so this makes `up` wait until the service truly responds.
   if (service.ready && service.ready !== 'tcp') {
-    await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready as Exclude<typeof service.ready, 'tcp' | undefined>, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch((error) => {
+    await untilReadyOrEnded((abort) => awaitReadiness(resolveReadyProbe(service.ready as Exclude<typeof service.ready, 'tcp' | undefined>, { host, port, url }), log, cwd, service.id, env, abort), ended, boot, 'the service', log).catch(async (error) => {
       if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
-      try { process.kill(-child.pid!, 'SIGTERM'); } catch { /* best effort cleanup */ }
-      throw new Error(`Service "${service.id}" failed its readiness probe: ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
+      try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
+      throw new Error(`Service "${service.id}" failed its readiness probe: ${errorMessage(error)}\nLog: ${log}`);
     });
   }
 
@@ -1406,7 +1565,8 @@ const ISSUE_TIMEOUT_MS = 15_000;
  *  asked for one and each pending name of that service is set to it. A twin that answers no credential, or has no
  *  door, leaves the names unset and says so, rather than handing the application a fixture the twin would refuse. */
 async function issueCredentials(service: WorldServiceConfig, started: WorldServiceInstance, env: Record<string, string>, pending: Map<string, string>, unissued: Set<string>): Promise<void> {
-  const wanted = [...pending].filter(([, id]) => id === service.id).map(([name]) => name);
+  const direct = new Set([...pending].filter(([, id]) => id === `${service.id}@direct`).map(([name]) => name));
+  const wanted = [...pending].filter(([name, id]) => id === service.id || direct.has(name)).map(([name]) => name);
   if (wanted.length === 0) return;
   for (const name of wanted) pending.delete(name);
   // the pack's door as it stands now (a door the pack fixed since the World was made reaches it), else the saved copy
@@ -1420,26 +1580,92 @@ async function issueCredentials(service: WorldServiceConfig, started: WorldServi
     const answer = (await res.json()) as Record<string, unknown>;
     for (const name of wanted) {
       const spec = door.fill[name] ?? '';
-      // `file:<field>`: a credential the application reads from a file (Google's GOOGLE_APPLICATION_CREDENTIALS), written
-      // beside the World's instance file, the name set to its path
-      const field = spec.startsWith('file:') ? spec.slice('file:'.length) : spec;
-      const value = answer[field];
-      if (spec.startsWith('file:')) {
+      if (spec.startsWith('directory:') || spec.startsWith('file:')) {
+        if (direct.has(name)) throw new Error(`cannot give ${name}'s filesystem credential a direct URL`);
+        if (!isEnvironmentName(name) || !/^[a-z0-9][a-z0-9._-]*$/.test(service.id)) throw new Error('Invalid credential destination name');
+        if (!env.VOLTER_WORLD_INSTANCE) throw new Error('World credential custody is unknown');
+        const instance = realpathSync(dirname(env.VOLTER_WORLD_INSTANCE));
+        const custody = ownedPath(instance, 'credentials');
+        const artifact = `${service.id}-${name.toLowerCase()}`;
+        const isDirectory = spec.startsWith('directory:');
+        const field = spec.slice(spec.indexOf(':') + 1), value = answer[field];
         if (value === undefined || value === null) throw new Error(`answered no ${field}`);
-        // beside the World's instance and nowhere else: a credential file in the application's checkout could be committed
-        if (!env.VOLTER_WORLD_INSTANCE) throw new Error(`cannot write ${name}'s credential file: the World's instance is unknown`);
-        const dir = join(dirname(env.VOLTER_WORLD_INSTANCE), 'credentials');
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-        const path = join(dir, `${service.id}-${name.toLowerCase()}.json`);
-        writeFileSync(path, typeof value === 'string' ? value : `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
-        env[name] = path;
+        if (isDirectory && (typeof value !== 'object' || Array.isArray(value) || Object.keys(value).length === 0)) throw new Error('Invalid credential directory');
+        const entries = isDirectory ? Object.entries(value as Record<string, unknown>) : [[`${artifact}.json`, value] as const];
+        const files = entries.map(([file, contents]) => {
+          if (isDirectory && (!file || file.includes('\\') || file.split('/').some(part => !/^[A-Za-z0-9._-]+$/.test(part) || part === '.' || part === '..'))) throw new Error('Invalid World-owned path');
+          return { path: ownedPath(custody, isDirectory ? `${artifact}/${file}` : file), contents };
+        });
+        const directories = new Set([custody]);
+        for (const { path } of files) {
+          let parent = dirname(path);
+          while (parent !== custody) { directories.add(parent); parent = dirname(parent); }
+          const stat = lstatSync(path, { throwIfNoEntry: false });
+          if (stat && (!stat.isFile() || stat.nlink !== 1)) throw new Error('Invalid World-owned path');
+        }
+        // Validate every destination and parent before creating or changing any custody artifact.
+        for (const dir of directories) {
+          ownedPath(instance, relative(instance, dir));
+          const stat = lstatSync(dir, { throwIfNoEntry: false });
+          if (stat && !stat.isDirectory()) throw new Error('Invalid World-owned path');
+        }
+        for (const dir of [...directories].sort((a, b) => a.length - b.length)) {
+          if (!existsSync(dir)) mkdirSync(dir, { mode: 0o700 });
+          assertOwnedRealPath(custody, dir);
+          chmodSync(dir, 0o700);
+        }
+        for (const { path, contents } of files) {
+          ownedPath(custody, relative(custody, path));
+          assertOwnedRealPath(custody, dirname(path));
+          const fd = openSync(path, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_NOFOLLOW, 0o600);
+          let opened: ReturnType<typeof fstatSync> | undefined;
+          try {
+            const stat = fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1) throw new Error('Invalid World-owned path');
+            opened = stat;
+            fchmodSync(fd, 0o600);
+            assertOwnedRealPath(custody, dirname(path));
+            ftruncateSync(fd, 0);
+            writeFileSync(fd, typeof contents === 'string' ? contents : `${JSON.stringify(contents, null, 2)}\n`);
+          } finally {
+            closeSync(fd);
+            let realFile: string | undefined;
+            try {
+              realFile = realpathSync(path);
+              const current = statSync(realFile);
+              if (!opened || current.dev !== opened.dev || current.ino !== opened.ino) throw new Error('Invalid World-owned path');
+              assertOwnedRealPath(custody, realFile);
+            } catch (error) {
+              // Remove only the file whose descriptor we opened; a raced replacement is not ours to delete.
+              const current = realFile ? lstatSync(realFile, { throwIfNoEntry: false }) : undefined;
+              if (opened && current?.dev === opened.dev && current.ino === opened.ino) rmSync(realFile!, { force: true });
+              throw error;
+            }
+          }
+        }
+        env[name] = isDirectory ? ownedPath(custody, artifact) : files[0]!.path;
         continue;
       }
+      const field = spec;
+      const value = answer[field];
       if (typeof value !== 'string') throw new Error(`answered no ${field}`);
-      env[name] = value;
+      if (direct.has(name)) {
+        const issued = new URL(value);
+        if (!['http:', 'https:'].includes(issued.protocol)) throw new Error(`cannot route ${name}'s non-HTTP URL directly`);
+        const endpoint = new URL(started.url);
+        issued.protocol = endpoint.protocol;
+        issued.host = endpoint.host;
+        env[name] = issued.toString();
+      } else env[name] = value;
+    }
+    if (started.url) {
+      const endpoint = new URL(started.url);
+      Object.assign(env, resolveServiceEnvTemplates(service.injectEnvTemplates, {
+        host: endpoint.hostname, port: Number(endpoint.port || (endpoint.protocol === 'https:' ? 443 : 80)), url: started.url,
+      }));
     }
   } catch (error) {
-    process.stderr.write(`volter-world: ${service.id} did not issue ${wanted.join(', ')} (${error instanceof Error ? error.message : String(error)}); left unset\n`);
+    process.stderr.write(`volter-world: ${service.id} did not issue ${wanted.join(', ')} (${errorMessage(error)}); left unset\n`);
     for (const name of wanted) { delete env[name]; unissued.add(name); }
   }
 }
@@ -1502,7 +1728,7 @@ async function startColocatedServices(
   const allocated: Array<{ service: WorldServiceConfig; port: number; mounted: MountedPackage; sides: Awaited<ReturnType<typeof sidePortsFor>> }> = [];
   for (const service of colocated) {
     const port = service.port === undefined || service.port === 'auto' ? await allocatePort(allocatedPorts) : service.port;
-    const serviceDataDir = join(paths.data, service.id);
+    const serviceDataDir = ownedPath(paths.data, service.id);
     mkdirSync(serviceDataDir, { recursive: true });
     // Relative module paths resolve from the world root (import() inside the host would
     // otherwise resolve them against the runtime's own source directory).
@@ -1529,10 +1755,10 @@ async function startColocatedServices(
   dropUnissued(env);
   env.VOLTER_WORLD_BOOT_ID = boot.bootId;
   // Under the same exit recorder as a process service, so the host's end (and every twin it holds) is in host.log.
-  const { child, ended } = spawnRecorded('host', process.execPath, args, paths.root, env, log);
+  const { child, ended, identity } = spawnRecorded('host', process.execPath, args, paths.root, env, log, boot);
   child.once('error', error => boot.fail(error));
   child.unref();
-  trackBootingChild(child, boot);
+  await trackBootingChild(child, boot, identity);
 
   const exitState: { value: { code: number | null; signal: NodeJS.Signals | null } | null } = { value: null };
   child.on('exit', (code, signal) => {
@@ -1565,17 +1791,17 @@ async function startColocatedServices(
   });
   const ready = (async (): Promise<void> => {
     const hostTimeoutMs = allocated.reduce((timeout, { service }) => Math.max(timeout, typeof service.ready === 'object' ? service.ready.timeoutMs ?? 15_000 : 15_000), 15_000);
-    await untilReadyOrEnded((abort) => waitForHostReady(readyFile, boot.bootId, new Map(allocated.map(({ service, port }) => [service.id, port])), hostTimeoutMs, abort, () => { try { return statSync(log).size; } catch { return 0; } }), ended, boot, 'the co-located host', log).catch((error) => {
+    await untilReadyOrEnded((abort) => waitForHostReady(readyFile, boot.bootId, new Map(allocated.map(({ service, port }) => [service.id, port])), hostTimeoutMs, abort, () => { try { return statSync(log).size; } catch { return 0; } }), ended, boot, 'the co-located host', log).catch(async (error) => {
       if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (host startup incomplete)', 'SIGTERM');
-      try { process.kill(-child.pid!, 'SIGTERM'); } catch { /* best effort cleanup */ }
-      throw new Error(`Co-located host failed to complete startup (isolation=${isolation}): ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
+      try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
+      throw new Error(`Co-located host failed to complete startup (isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
     });
     await parallelStartup(allocated, async ({ service, port }) => {
       const bindTimeoutMs = typeof service.ready === 'object' && service.ready.timeoutMs !== undefined ? Math.max(service.ready.timeoutMs, 15_000) : 15_000;
-      await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch((error) => {
+      await untilReadyOrEnded((abort) => waitForTcp(port, bindTimeoutMs, abort), ended, boot, 'the co-located host', log).catch(async (error) => {
         if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (startup failed)', 'SIGTERM');
-        try { process.kill(-child.pid!, 'SIGTERM'); } catch { /* best effort cleanup */ }
-        throw new Error(`Co-located twin "${service.id}" failed to start (host isolation=${isolation}): ${error instanceof Error ? error.message : String(error)}\nLog: ${log}`);
+        try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
+        throw new Error(`Co-located twin "${service.id}" failed to start (host isolation=${isolation}): ${errorMessage(error)}\nLog: ${log}`);
       });
     });
     // The host's receipt (this boot, every requested port) is published only
@@ -1585,9 +1811,9 @@ async function startColocatedServices(
     // answers with another boot's identity is still refused.
     const hostSettle = Promise.resolve('alive' as const);
     await parallelStartup(allocated, async ({ service, port }) => {
-      await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log, true, hostSettle).catch((error) => {
+      await confirmOwnPort(port, boot, ended, true, `Co-located twin "${service.id}"`, log, true, hostSettle).catch(async (error) => {
         if (undeadPids([child.pid!]).length) recordWorldStop([log], 'world.service.stop', 'up (port not its own)', 'SIGTERM');
-        try { process.kill(-child.pid!, 'SIGTERM'); } catch { /* best effort cleanup */ }
+        try { await signalHeldChild(child, 'SIGTERM', true, identity); } catch { /* best effort cleanup */ }
         throw error;
       });
     });
@@ -1659,6 +1885,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
   const envFile = resolve(root, options.envFile ?? join(instance, 'world.env'));
   const instanceFile = join(instance, 'instance.json');
   let carriedOrigin: WorldInstance['origin'] | undefined;
+  let carriedNetwork = options.networkCeiling;
   // the outputs this root's Worlds published: a branch and its base share the app's env file (whichever is current
   // writes it), so a file any of them last wrote is the World's own, never a custody file
   const siblings = existsSync(worldBaseDir(root)) ? readdirSync(worldBaseDir(root)).filter((world) => world !== name && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(world)) : [];
@@ -1677,6 +1904,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
   let resourcesClaimed = false;
   let cleanupUncertain = false;
   const createdAt = new Date().toISOString();
+  const instanceToken = randomUUID();
 
   // Claim the instance dir under the kernel's cross-process file lock (TWIN-36). Without it,
   // two concurrent `upWorld` calls on one name can both observe "no live pids", both rmSync the
@@ -1709,23 +1937,36 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
         );
       }
       if (!options.keepState) assertWorldStateRemovable(root, instance);
-      // A legacy record can have been removed by an older reader while its external effects
-      // remain. Require a receipt for the exact prior instance, not merely absent claims/PIDs.
+      // Verified teardown is independent of record shape. A fresh boot discards incomplete metadata.
       if (existsSync(instanceFile)) {
+        let prior: WorldInstance | undefined;
+        if (options.keepState) prior = readWorldBootRecordLocked(name, root);
         const priorRaw = readFileSync(instanceFile, 'utf8');
-        const prior = JSON.parse(priorRaw) as WorldInstance;
         const receiptPath = join(instance, 'stopped.json');
         const receipt = existsSync(receiptPath) ? JSON.parse(readFileSync(receiptPath, 'utf8')) : undefined;
-        if (prior.name !== name || resolve(prior.root) !== root || !receipt
-          || receipt.instanceHash !== createHash('sha256').update(priorRaw).digest('hex')
+        if (!receipt || receipt.instanceHash !== createHash('sha256').update(priorRaw).digest('hex')
           || !Number.isFinite(Date.parse(receipt.stoppedAt))) {
           throw new Error(`World "${name}" has no verified teardown receipt for its prior instance; use its owning runtime to complete cleanup before replacement`);
         }
+        if (!prior) { try { prior = JSON.parse(priorRaw) as WorldInstance; } catch { /* fresh boot needs no retained shape */ } }
+        if (prior) {
+          // A readable ceiling remains useful even when unrelated metadata is incomplete.
+          try {
+            const permissionRecord = { ...prior, name, root };
+            if (!Object.hasOwn(permissionRecord, 'networkCeiling')) {
+              let storedConfig = loaded.config;
+              try { storedConfig = loadWorldConfig(prior.configPath, root).config; } catch { /* fresh boot can discard missing config metadata */ }
+              permissionRecord.networkCeiling = ceilingFromConfig(permissionRecord, storedConfig);
+            }
+            const ceiling = recordedWorldNetwork(permissionRecord);
+            if (ceiling !== undefined) carriedNetwork = carriedNetwork === undefined ? ceiling : intersectWorldNetwork(carriedNetwork, ceiling);
+          } catch { if (options.keepState) throw new Error(`World boot record is incomplete or invalid: ${instanceFile}`); }
+        }
         // the origin belongs to the World, not to its running state (git: a remote outlives every checkout): an up of the
         // same config carries the one the last left while world.json's `origin` remote still names it (`remote remove`
         // ends it there; an instance under another World's config, a runtime branch, has only its own record); its cursors
         // only when its state (the mirror they count) is kept, as reset drops them
-        if (prior.origin && prior.config === loaded.config.id && (name !== loaded.config.id || namesOrigin(loaded.config.remotes?.origin, prior.origin, root))) {
+        if (prior?.origin && typeof prior.origin.url === 'string' && typeof prior.origin.namespace === 'string' && prior.config === loaded.config.id && (name !== loaded.config.id || namesOrigin(loaded.config.remotes?.origin, prior.origin, root))) {
           carriedOrigin = options.keepState ? prior.origin
             : { url: prior.origin.url, namespace: prior.origin.namespace, ...(prior.origin.clonedAt ? { clonedAt: prior.origin.clonedAt } : {}) };
         }
@@ -1736,7 +1977,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       retainWorldLifecycleForCleanup(root, name);
       // The last run's logs survive this boot as logs/previous (one generation): the record of a crash must outlive the
       // restart that usually follows it. Moved aside before the wipe and back in after it.
-      const previousLogs = join(dirname(instance), `.${name}.previous-logs`); // dot-prefixed: bookkeeping, never listed as a World
+      const previousLogs = ownedPath(dirname(instance), `.${name}.previous-logs`); // dot-prefixed: bookkeeping, never listed as a World
       if (existsSync(previousLogs) && !existsSync(logs)) { mkdirSync(instance, { recursive: true }); renameSync(previousLogs, logs); } // an earlier failed claim's, back first
       rmSync(previousLogs, { recursive: true, force: true });
       if (existsSync(logs)) { rmSync(join(logs, 'previous'), { recursive: true, force: true }); renameSync(logs, previousLogs); }
@@ -1762,7 +2003,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
     // the failure that stopped the boot leads: a release that also fails is added to it, never put in its place
     if (resourcesClaimed) {
       try { releaseWorldLifecycle(root, name); }
-      catch (release) { if (error instanceof Error) error.message += `; releasing the World's claim failed too: ${release instanceof Error ? release.message : String(release)}`; }
+      catch (release) { throw new AggregateError([error, release], 'World claim and release failed'); }
     }
     throw error;
   }
@@ -1772,8 +2013,14 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
   // "already running" guard; on failure the world never came up, so the next upWorld must be
   // allowed to claim. Removing the marker is safe — only THIS call's marker can exist at this
   // point (a foreign live claim made the claim section above throw before this try).
+  let bootFailed = false;
+  let bootFailure: unknown;
   try {
     const services: Record<string, WorldServiceInstance> = {};
+    const recordService = (started: WorldServiceInstance) => {
+      const branchState = loaded.config.services.find(service => service.id === started.id)?.branchState;
+      services[started.id] = { ...started, branchState: branchState ?? 'supported' };
+    };
     const inheritedEnv = admittedEnv(loaded.config.stripEnv);
     const env: Record<string, string> = {
       ...(loaded.config.env ?? {}),
@@ -1784,10 +2031,11 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       // the world ref the dormant attach entry (`import '@volter/world-core/attach'`) arms the injector
       // on — what a Bun process, which ignores NODE_OPTIONS, reads to reach the twins inside `run`
       VOLTER_WORLD: name,
-      ...(networkOf(name, mode === 'sealed' ? { egress: [] } : loaded.config.network) ?? {}),
+      ...(networkOf(name, mode === 'sealed' ? { egress: [] } : loaded.config.network, carriedNetwork) ?? {}),
       VOLTER_WORLD_MODE: mode,
       VOLTER_WORLD_CONFIG: loaded.path,
       VOLTER_WORLD_INSTANCE: instanceFile,
+      VOLTER_WORLD_GUEST_RUNNER: new URL(import.meta.url.endsWith('.ts') ? './guest-runner.ts' : './guest-runner.js', import.meta.url).href,
       // every service's root is `<data>/<service id>`; the kernel finds another pack's store across them (A3, ownerStoreRoots)
       [WORLD_DATA_ENV]: data,
       // the live env file this `up` writes: what a service that runs apps elsewhere (world-machine's guest) carries there
@@ -1810,8 +2058,10 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
     writeProxyEnv(root, name, env);
 
     const worldInstance: WorldInstance = {
-      name, config: loaded.config.id, configPath: loaded.path, root, createdAt, mode,
+      name, instance: instanceToken, config: loaded.config.id, configPath: loaded.path, root, createdAt, mode,
       dirs: { instance, logs, data }, services, env, envFile, pidsFile,
+      networkCeiling: env[WORLD_NETWORK_POLICY_ENV] === undefined ? 'unrestricted' : networkPermission(parseWorldNetworkPolicy(JSON.parse(env[WORLD_NETWORK_POLICY_ENV]!))),
+      bootServices: loaded.config.services.map(service => service.id), bootOwner: options.owner ?? null,
       ...(loaded.config.selection ? { selection: loaded.config.selection } : {}),
       ...(loaded.config.actors ? { actors: loaded.config.actors } : {}),
       ...(loaded.config.fixtures ? { fixtures: loaded.config.fixtures } : {}),
@@ -1832,9 +2082,9 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       abort?.removeEventListener('abort', onOwnerEnd);
     };
     const boot: BootContext = {
-      bootId: randomUUID(), signal: cancelled.signal, fail: error => cancelled.abort(error), pids: new Set(),
-      external: service => { services[service.id] = service; saveWorldInstance(worldInstance); },
-      recordPids: () => writeOwnedPids(root, name, [...boot.pids], [...boot.pids]),
+      bootId: instanceToken, signal: cancelled.signal, fail: error => cancelled.abort(error), pids: new Set(), identities: {}, handles: new Map(),
+      external: service => { recordService(service); saveWorldInstance(worldInstance); },
+      recordPids: () => writeOwnedPids(root, name, [...boot.pids], [...boot.pids], boot.identities),
     };
     const recordPidsSoFar = boot.recordPids;
     try {
@@ -1854,7 +2104,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
         const colocated = loaded.config.services.filter((service) => service.colocate && service.type !== 'external');
         const host = await startColocatedServices(loaded.config, colocated, isolation, env, { root, instance, logs, data }, allocatedPorts, boot);
         for (const started of host.services) {
-          services[started.id] = started;
+          recordService(started);
           Object.assign(env, started.env);
         }
         colocatedReady = async () => {
@@ -1902,7 +2152,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
         attemptProxy();
         boot.signal.throwIfAborted();
         const started = await startService(loaded.config, service, env, { root, instance, logs, data }, allocatedPorts, boot);
-        services[started.id] = started;
+        recordService(started);
         recordPidsSoFar();
         Object.assign(env, started.env);
         await issueCredentials(service, started, env, issuing, unissued);
@@ -1940,7 +2190,7 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
         try {
           return await shareWorldServices(name, { root, ...(options.share ?? {}) });
         } catch (error) {
-          await downWorld(name, root);
+          await downWorld(name, root, { expectedInstance: instanceToken });
           throw error;
         }
       }
@@ -1950,12 +2200,12 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
       detachBootSignals();
       // Rollback never lets its own failure replace the boot's: each step's error is added to the original.
       const rollbackErrors: string[] = [];
-      try { stopWorldProxy(root, name); } catch (proxyError) { rollbackErrors.push(`proxy stop failed: ${proxyError instanceof Error ? proxyError.message : String(proxyError)}`); }
+      try { await stopWorldProxy(root, name, boot.handles); } catch (proxyError) { rollbackErrors.push(`proxy stop failed: ${errorMessage(proxyError)}`); }
       const pids = [...new Set([...Object.values(services).map((service) => service.pid).filter(Boolean), ...boot.pids])];
       const rollbackAlive = undeadPids(Object.values(services).map((service) => service.pid).filter(Boolean));
       const rollbackLogs = Object.values(services).filter((service) => service.type !== 'external' && service.log && rollbackAlive.includes(service.pid)).map((service) => service.log);
       recordWorldStop(rollbackLogs, 'world.service.stop', 'boot rollback', 'SIGTERM');
-      signalPids(pids, 'SIGTERM');
+      await signalPids(pids, 'SIGTERM', boot.identities, boot.handles);
       // Stop any self-managed externals that DID come up, so a failed `up` never leaves a
       // half-running external stack behind. Best-effort: the original error is what we throw —
       // but a `down` that ITSELF fails must not be silent (the operator would have no hint that
@@ -1969,28 +2219,28 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
           try {
             await runExternalCommand(service.external.down, service.external.cwd, service.id, 'down', downEnv);
           } catch (downError) {
-            rollbackErrors.push(downError instanceof Error ? downError.message : String(downError));
+            rollbackErrors.push(errorMessage(downError));
           }
         }
       }
       // Same SIGTERM→SIGKILL contract as downWorld: a service that ignores SIGTERM must not
       // outlive a failed boot either. The poll exits as soon as everything is dead, so the
       // common case (services honor SIGTERM) adds no delay to the failure path.
-      const rollbackKilled = await killSurvivorsAfterGrace(pids, DOWN_GRACE_MS_DEFAULT);
+      const rollbackKilled = await killSurvivorsAfterGrace(pids, DOWN_GRACE_MS_DEFAULT, boot.identities, boot.handles);
       recordWorldStop(Object.values(services).filter((service) => rollbackKilled.includes(service.pid) && service.log).map((service) => service.log), 'world.service.killed', 'boot rollback', 'SIGKILL');
       const surviving = undeadPids(pids);
       if (surviving.length) rollbackErrors.push('owned processes remain alive or uncertain');
-      if (error instanceof CommandRetirementError) rollbackErrors.push((error as CommandRetirementError & { retirement?: string }).retirement ?? error.message);
+      if (error instanceof CommandRetirementError) rollbackErrors.push((error as CommandRetirementError & { retirement?: string }).retirement ?? errorMessage(error));
 
       if (rollbackErrors.length > 0) {
         cleanupUncertain = true;
         try { retainWorldLifecycleForCleanup(root, name); saveWorldInstance(worldInstance); }
-        catch (bookkeepingError) { rollbackErrors.push(`rollback bookkeeping failed: ${bookkeepingError instanceof Error ? bookkeepingError.message : String(bookkeepingError)}`); }
+        catch (bookkeepingError) { rollbackErrors.push(`rollback bookkeeping failed: ${errorMessage(bookkeepingError)}`); }
         const suffix = `\n(rollback incomplete — processes or an external stack may still be running: ${rollbackErrors.join('; ')})`;
         // Mutate rather than re-wrap: callers match on the ORIGINAL message (which must keep
         // leading) and the original stack/type stay intact.
         if (error instanceof Error) error.message += suffix;
-        else throw new Error(`${String(error)}${suffix}`);
+        else throw new Error(`${errorMessage(error)}${suffix}`);
       }
       if (rollbackErrors.length === 0) {
         // Publication failure must retain ownership. Prune requires both a receipt and release.
@@ -2002,28 +2252,38 @@ export async function upWorld(configId: string, options: UpWorldOptions = {}, ab
           releaseWorldLifecycle(root, name);
           cleanupUncertain = false;
         } catch (receiptError) {
-          const note = `\n(rollback stopped every process but could not publish its teardown receipt: ${receiptError instanceof Error ? receiptError.message : String(receiptError)}; lifecycle retained)`;
-          if (error instanceof Error) error.message += note; else throw new Error(`${String(error)}${note}`);
+          const note = `\n(rollback stopped every process but could not publish its teardown receipt: ${errorMessage(receiptError)}; lifecycle retained)`;
+          if (error instanceof Error) error.message += note; else throw new Error(`${errorMessage(error)}${note}`);
         }
       }
       throw error;
     }
 
   } catch (error) {
+    bootFailed = true;
+    bootFailure = error;
     if (resourcesClaimed) {
-      try { recordWorldLifecycleEvent(root, name, `boot failed: ${error instanceof Error ? error.message : String(error)}`); }
-      catch (diagnosticError) { process.stderr.write(`World "${name}": could not save boot failure: ${String(diagnosticError)}; original failure: ${String(error)}\n`); }
-      if (!cleanupUncertain) releaseWorldLifecycle(root, name);
+      try { recordWorldLifecycleEvent(root, name, `boot failed: ${errorMessage(error)}`); }
+      catch (diagnosticError) { process.stderr.write(`World "${name}": could not save boot failure: ${errorMessage(diagnosticError)}; original failure: ${errorMessage(error)}\n`); }
+      if (!cleanupUncertain) {
+        try { releaseWorldLifecycle(root, name); }
+        catch (release) { bootFailure = new AggregateError([error, release], 'World startup and lifecycle release failed'); }
+      }
     }
-    throw error;
+    throw bootFailure;
   } finally {
-    rmSync(bootingFile(root, name), { force: true });
+    try { rmSync(bootingFile(root, name), { force: true }); }
+    catch (cleanup) {
+      if (bootFailed) throw new AggregateError([bootFailure, cleanup], 'World startup and boot marker cleanup failed');
+      throw cleanup;
+    }
   }
 }
 
-async function teardownExternalServices(instance: WorldInstance): Promise<{ stopped: string[]; errors: string[] }> {
+async function teardownExternalServices(instance: WorldInstance): Promise<{ stopped: string[]; errors: string[]; unavailable: string[] }> {
   const stopped: string[] = [];
   const errors: string[] = [];
+  const unavailable: string[] = [];
   for (const service of Object.values(instance.services)) {
     if (service.type !== 'external') continue;
     if (!service.external || !Array.isArray(service.external.down) || !service.external.down.length
@@ -2036,10 +2296,12 @@ async function teardownExternalServices(instance: WorldInstance): Promise<{ stop
       await runExternalCommand(service.external.down, service.external.cwd, service.id, 'down', downEnv);
       stopped.push(service.id);
     } catch (error) {
-      errors.push(error instanceof Error ? error.message : String(error));
+      const message = errorMessage(error);
+      errors.push(message);
+      if (error instanceof ExternalCommandUnavailableError) unavailable.push(message);
     }
   }
-  return { stopped, errors };
+  return { stopped, errors, unavailable };
 }
 
 /** SIGTERM contract (documented in docs/concepts/worlds.md § Teardown): services get SIGTERM to their process
@@ -2050,18 +2312,16 @@ const DOWN_GRACE_MS_DEFAULT = 5_000;
 /** Signal each pid's process GROUP (services are spawned `detached`, so each pid is a group
  * leader), falling back to the single pid when the group signal fails. Returns the pids that
  * accepted the signal. */
-function signalPids(pids: number[], signal: NodeJS.Signals): number[] {
+async function signalPids(pids: number[], signal: NodeJS.Signals, identities: Record<string, string | undefined>, handles?: Map<number, ReturnType<typeof spawn>>): Promise<number[]> {
   const signalled: number[] = [];
   for (const pid of pids) {
+    if (!undeadPids([pid]).length) continue;
+    const identity = Object.hasOwn(identities, pid) ? { pid, start: identities[pid] } : undefined;
     try {
-      process.kill(-pid, signal);
-      signalled.push(pid);
-    } catch {
-      try {
-        process.kill(pid, signal);
-        signalled.push(pid);
-      } catch {}
-    }
+      const child = handles?.get(pid);
+      if (child ? await signalHeldChild(child, signal, true, Promise.resolve(identity))
+        : await signalOwnedProcess(identity, signal, true) || await signalOwnedProcess(identity, signal)) signalled.push(pid);
+    } catch (error) { process.stderr.write(`${errorMessage(error)}\n`); }
   }
   return signalled;
 }
@@ -2082,13 +2342,13 @@ const KILL_CONFIRM_MS = 2_000;
  * exactly like the SIGTERM was delivered, then a short bounded confirm-wait so survivors are
  * actually gone (not just signalled) by the time this returns. Returns the pids that needed
  * escalation. */
-async function killSurvivorsAfterGrace(pids: number[], graceMs: number): Promise<number[]> {
+async function killSurvivorsAfterGrace(pids: number[], graceMs: number, identities: Record<string, string | undefined>, handles?: Map<number, ReturnType<typeof spawn>>): Promise<number[]> {
   const deadline = Date.now() + graceMs;
   while (undeadPids(pids).length > 0 && Date.now() < deadline) {
     await new Promise((resolveWait) => setTimeout(resolveWait, 50));
   }
   const survivors = undeadPids(pids);
-  signalPids(survivors, 'SIGKILL');
+  await signalPids(survivors, 'SIGKILL', identities, handles);
   const confirmDeadline = Date.now() + KILL_CONFIRM_MS;
   while (undeadPids(survivors).length > 0 && Date.now() < confirmDeadline) {
     await new Promise((resolveWait) => setTimeout(resolveWait, 20));
@@ -2096,31 +2356,35 @@ async function killSurvivorsAfterGrace(pids: number[], graceMs: number): Promise
   return survivors;
 }
 
-/** Synchronous twin of `killSurvivorsAfterGrace` for callers (`unshareWorld`) that must stay
- * synchronous — same "poll until dead or grace expires, then SIGKILL survivors, then confirm they
- * are actually gone" contract, using an `Atomics.wait` backoff (already this file's pattern for
- * synchronous polling — see `ensureWorldProxy`) instead of `setTimeout`, since a sync function has
- * no event loop to yield to. */
-function killSurvivorsAfterGraceSync(pids: number[], graceMs: number): number[] {
-  const deadline = Date.now() + graceMs;
-  while (undeadPids(pids).length > 0 && Date.now() < deadline) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50);
-  }
-  const survivors = undeadPids(pids);
-  signalPids(survivors, 'SIGKILL');
+/** The same bounded, identity-checked retirement used by World down, for provider-owned groups.
+ * No caller may release a durable receipt when inspection or signal delivery is uncertain. */
+export async function retireOwnedProcessGroups(records: SpawnIdentity[], graceMs = DOWN_GRACE_MS_DEFAULT): Promise<void> {
+  const pids = [...new Set(records.map(record => record.pid))];
+  const identities = Object.fromEntries(records.map(record => [record.pid, record.start]));
+  await signalPids(pids, 'SIGCONT', identities);
+  await signalPids(pids, 'SIGTERM', identities);
+  await killSurvivorsAfterGrace(pids, graceMs, identities);
+  const remaining = undeadPids(pids);
+  if (remaining.length) throw new CommandRetirementError(`Guest process groups still alive or uninspectable: ${remaining.join(', ')}; ownership retained`);
+}
+
+/** The synchronous proxy starter can retire only its still-held child/group. Numeric
+ * recovery belongs to async downWorld, never to a blocking identity lookup. */
+function killHeldSurvivorsSync(child: ReturnType<typeof spawn>, graceMs: number): void {
+  if (!child.pid) return;
+  const pids = [child.pid], deadline = Date.now() + graceMs;
+  while (undeadPids(pids).length && Date.now() < deadline) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 50);
+  if (undeadPids(pids).length) signalChild(child, 'SIGKILL', true);
   const confirmDeadline = Date.now() + KILL_CONFIRM_MS;
-  while (undeadPids(survivors).length > 0 && Date.now() < confirmDeadline) {
-    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
-  }
-  return survivors;
+  while (undeadPids(pids).length && Date.now() < confirmDeadline) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 20);
 }
 
-/** Async solely for the SIGTERM→SIGKILL grace poll — everything else (proxy stop, SIGTERM,
- * external teardown) still runs in the first synchronous slice, so a legacy caller that fires
- * without awaiting gets exactly the old behavior plus the deferred escalation. A blocking
- * sleep-loop would keep the sync signature but stall the caller's event loop for up to the whole
- * grace; a detached watchdog child would escalate too but leak orphan processes — the await is
- * the honest shape (upWorld/runWorld/the CLI are already async). */
+/** Retirement awaits birth verification for recorded numbers and the SIGTERM→SIGKILL
+ * grace/confirmation polls. Callers await downWorld before releasing ownership or purging
+ * instance state; held children can receive their initial signal without a birth lookup.
+ * External teardown and proxy retirement are joined in that same lifecycle.
+ * A blocking sleep-loop would stall the caller's event loop through the grace, and a detached
+ * watchdog would leave an unjoined process; lifecycle owners await retirement instead. */
 /**
  * Delete a world's instance dir entirely — the `--purge` half of `down` (TWIN-45 dev/02b): no
  * twin data (per-service `data/<id>`, logs, instance.json) survives past teardown. Plain `rm`,
@@ -2156,20 +2420,27 @@ class WorldConsumersActiveError extends Error {}
 export async function downWorld(
   name: string,
   root = process.cwd(),
-  options: { graceMs?: number; purge?: boolean; expectedCreatedAt?: string } = {},
-): Promise<{ name: string; stopped: number[]; escalated: number[]; externalStopped: string[]; externalErrors: string[]; notSignalled?: string[]; purged?: string }> {
+  options: { graceMs?: number; purge?: boolean; expectedInstance?: string } = {},
+): Promise<{ name: string; stopped: number[]; escalated: number[]; externalStopped: string[]; externalErrors: string[]; externalAbandoned?: string[]; notSignalled?: string[]; purged?: string }> {
+  if (Object.hasOwn(options, 'expectedCreatedAt')) throw new Error('World teardown requires expectedInstance from the original boot');
   assertSafeWorldName(name);
   const resolvedRoot = resolve(root);
   const token = randomUUID();
   // Like boot's claim: a short synchronous lock protects an async lifecycle transition.
   // Do not hold a filesystem lock while external shutdown or the grace period waits.
   withFileLock(instanceLockFile(resolvedRoot, name), () => withFileLock(`${sharingClaimFile(resolvedRoot, name)}.lock`, () => {
+    if (options.expectedInstance !== undefined) {
+      try {
+        const raw = getActiveWorldStore().read(instanceFile(resolvedRoot, name));
+        const recorded = raw === null ? undefined : JSON.parse(raw);
+        if (recorded?.name !== name || typeof recorded.root !== 'string' || resolve(recorded.root) !== resolvedRoot
+          || typeof options.expectedInstance !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(options.expectedInstance)
+          || recorded.instance !== options.expectedInstance) throw new Error();
+      } catch { throw new Error(`World ownership mismatch: ${name}`); }
+    }
     assertProxyOwnershipResolved(resolvedRoot, name);
     const prior = existsSync(instanceFile(resolvedRoot, name)) ? readWorldInstance(name, resolvedRoot, true) : undefined;
     if (prior?.resources && !prior.lifecycle) throw new Error(`World "${name}" belongs to a legacy runtime; use its pinned runtime for teardown before migration`);
-    if (options.expectedCreatedAt !== undefined && readWorldInstance(name, resolvedRoot, true).createdAt !== options.expectedCreatedAt) {
-      throw new Error(`World "${name}" generation changed; teardown refused`);
-    }
     if (options.purge) assertWorldStateRemovable(resolvedRoot, instanceDir(resolvedRoot, name));
     prepareBootForDown(resolvedRoot, name);
     if (liveBootingClaim(stoppingFile(resolvedRoot, name))) throw new Error(`World "${name}" is already being stopped`);
@@ -2200,7 +2471,7 @@ async function downWorldClaimed(
   name: string,
   root: string,
   options: { graceMs?: number; purge?: boolean },
-): Promise<{ name: string; stopped: number[]; escalated: number[]; externalStopped: string[]; externalErrors: string[]; notSignalled?: string[]; purged?: string }> {
+): Promise<{ name: string; stopped: number[]; escalated: number[]; externalStopped: string[]; externalErrors: string[]; externalAbandoned?: string[]; notSignalled?: string[]; purged?: string }> {
   assertSafeWorldName(name);
   const resolvedRoot = resolve(root);
   const dir = instanceDir(resolvedRoot, name);
@@ -2217,6 +2488,7 @@ async function downWorldClaimed(
   } catch {
     instance = undefined;
   }
+  readGuestProcesses(dir, instance?.instance); // missing World metadata never erases guest ownership
   // Nothing to tear down when the metadata is gone and every process the lifecycle recorded has exited.
   if (!instance && before === undefined && releaseAbandonedWorldLifecycle(resolvedRoot, name)) {
     return { name, stopped: [], escalated: [], externalStopped: [], externalErrors: [] };
@@ -2225,28 +2497,36 @@ async function downWorldClaimed(
     return { name, stopped: [], escalated: [], externalStopped: [],
       externalErrors: ['World instance or external teardown metadata missing or unreadable; cleanup refused; lifecycle evidence retained'] };
   }
-  const proxyPid = readProxyState(resolvedRoot, name)?.pid;
-  stopWorldProxy(resolvedRoot, name);
+  const proxyState = readProxyState(resolvedRoot, name);
+  const proxyPid = proxyState?.pid;
+  await stopWorldProxy(resolvedRoot, name, spawnedChildren);
   const foregroundPid = instance?.lastRun?.state !== 'completed' ? instance?.lastRun?.consumerPid : undefined;
   const holderPid = instance?.lifecycle?.holderPid ?? instance?.resources?.holderPid;
   const recordedPids = [...new Set([...readPids(pidsFile), ...(foregroundPid ? [foregroundPid] : []), ...(proxyPid ? [proxyPid] : [])])].filter(pid => pid !== holderPid);
-  const foreign = foreignPids(resolvedRoot, name, recordedPids);
+  const identities = readIdentities(resolvedRoot, name);
+  if (proxyState?.birth) identities[proxyState.pid] = proxyState.birth;
+  const foreign = (await Promise.all(recordedPids.map(async pid => {
+    const now = identities[pid] ? await processBirth(pid) : undefined;
+    return now && now !== identities[pid] ? { pid, recorded: identities[pid]!, now } : undefined;
+  }))).filter((entry): entry is { pid: number; recorded: string; now: string } => !!entry);
   const pids = recordedPids.filter((pid) => !foreign.some((entry) => entry.pid === pid));
   const processServices = Object.values(instance?.services ?? {}).filter((service) => service.type !== 'external' && service.log);
   // Only a service still alive is stopped by this `down`; a dead one's end was not the World's.
   const stillAlive = undeadPids(processServices.map((service) => service.pid).filter((pid) => pids.includes(pid)));
   recordWorldStop(processServices.filter((service) => stillAlive.includes(service.pid)).map((service) => service.log), 'world.service.stop', 'down', 'SIGTERM');
-  const stopped = signalPids(pids, 'SIGTERM');
+  const stopped = await signalPids(pids, 'SIGTERM', identities, spawnedChildren);
 
   // Stop self-managed externals via their declared `down` command. A missing instance is
   // safe only without retained lifecycle ownership, checked before any signals above.
   let externalStopped: string[] = [];
   let externalErrors: string[] = [];
+  let unavailable: string[] = [];
   try {
     if (!instance) throw new Error('World instance unavailable');
     const result = await teardownExternalServices(instance);
     externalStopped = result.stopped;
     externalErrors = result.errors;
+    unavailable = result.unavailable;
   } catch {
     // no instance.json (never fully came up) — only owned processes needed stopping.
     if (before !== undefined) externalErrors.push('World instance or external teardown metadata unreadable; cleanup refused');
@@ -2255,12 +2535,18 @@ async function downWorldClaimed(
   // Escalate AFTER the external teardown so externals never wait on the grace, and
   // poll the full pids list rather than `stopped`: a pid whose SIGTERM errored is almost always
   // already dead, and livePids() re-checks anyway.
-  const escalated = await killSurvivorsAfterGrace(pids, options.graceMs ?? DOWN_GRACE_MS_DEFAULT);
+  const escalated = await killSurvivorsAfterGrace(pids, options.graceMs ?? DOWN_GRACE_MS_DEFAULT, identities, spawnedChildren);
   recordWorldStop(processServices.filter((service) => escalated.includes(service.pid)).map((service) => service.log), 'world.service.killed', 'down', 'SIGKILL');
+  // A launch which had already entered its spawn seam may publish while TERM is delivered.
+  // Once services/agents retire, join every late receipt before certifying this generation stopped.
+  const lateGuests = readGuestProcesses(dir, instance?.instance).filter(receipt => !pids.includes(receipt.record.pid));
+  try { await retireOwnedProcessGroups(lateGuests.map(receipt => receipt.record), options.graceMs ?? DOWN_GRACE_MS_DEFAULT); }
+  catch (error) { externalErrors.push(errorMessage(error)); }
+  pids.push(...lateGuests.map(receipt => receipt.record.pid));
   if (holderPid && !externalErrors.length && !undeadPids(pids).length) {
     pids.push(holderPid);
-    stopped.push(...signalPids([holderPid], 'SIGTERM'));
-    escalated.push(...await killSurvivorsAfterGrace([holderPid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT));
+    stopped.push(...await signalPids([holderPid], 'SIGTERM', identities, spawnedChildren));
+    escalated.push(...await killSurvivorsAfterGrace([holderPid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT, identities, spawnedChildren));
   }
 
   // Finalization belongs to this exact generation, not just the reusable name. A new up may
@@ -2278,20 +2564,36 @@ async function downWorldClaimed(
       externalErrors.push('Proxy or sharing lifecycle changed during teardown; cleanup refused');
       return result;
     }
-    const surviving = undeadPids(pids);
+    const guestReceipts = readGuestProcesses(dir, instance?.instance);
+    const surviving = undeadPids([...pids, ...guestReceipts.map(receipt => receipt.record.pid)]);
     if (surviving.length) externalErrors.push(`World processes still alive or uninspectable after teardown: ${surviving.join(', ')}; cleanup refused`);
+    if (guestReceipts.some(receipt => foreign.some(entry => entry.pid === receipt.record.pid))) externalErrors.push('Guest spawn identity changed; receipt retained and cleanup refused');
+    let externalAbandoned: string[] | undefined;
+    if (options.purge && instance && externalErrors.length && externalErrors.length === unavailable.length && !foreign.length) {
+      const inventory = exitedWorldLifecyclePids(resolvedRoot, name, instance.createdAt);
+      if (inventory && !undeadPids([...pids, ...inventory, ...(holderPid ? [holderPid] : [])]).length) {
+        const consumers = worldConsumers(resolvedRoot, name);
+        if (!consumers.warnings.length && consumers.consumers.every(c => c.state === 'exited')) {
+          externalAbandoned = [...externalErrors];
+          recordWorldLifecycleEvent(resolvedRoot, name, `explicit purge surrendered state; unavailable backend not certified stopped:\n${externalAbandoned.join('\n')}`);
+          externalErrors.splice(0);
+        }
+      }
+    }
     if (externalErrors.length) return result;
+    releaseGuestProcesses(guestReceipts);
     rmSync(pidsFile, { force: true });
     if (before) {
       writeTextAtomic(join(dir, 'stopped.json'), `${JSON.stringify({
         instanceHash: createHash('sha256').update(before).digest('hex'), stoppedAt: new Date().toISOString(),
+        ...(externalAbandoned ? { externalAbandoned } : {}),
       })}\n`);
     }
-    releaseWorldLifecycle(resolvedRoot, name);
+    releaseWorldLifecycle(resolvedRoot, name, externalAbandoned ? 'recorded processes exited; explicit purge surrendered state; ownership released' : undefined);
     if (!options.purge) return result;
     const purged = purgeInstanceDir(resolvedRoot, name);
     if (purged && instance) clearBrowserFiles(instance.dirs.data, resolvedRoot);
-    return { ...result, purged };
+    return { ...result, ...(externalAbandoned ? { externalAbandoned } : {}), purged };
   }));
 }
 
@@ -2397,7 +2699,7 @@ function worldCleanupEntry(name: string, root: string): WorldCleanupEntry {
       return { ...entry, reason: 'invalid or outdated teardown receipt' };
     }
     try { assertWorldStateRemovable(root, path); }
-    catch (error) { return { ...entry, reason: error instanceof Error ? error.message : 'Branch ancestry unreadable; retained' }; }
+    catch (error) { return { ...entry, reason: errorMessage(error) }; }
     return { ...entry, eligible: true, reason: 'successfully stopped; disposable instance data only', stoppedAt: receipt.stoppedAt, logicalBytes: logicalTreeBytes(path) };
   } catch (error) {
     // Do not print malformed metadata: it can contain env secrets.
@@ -2434,7 +2736,7 @@ export function pruneWorlds(options: { root?: string; name?: string; apply?: boo
 function worldServiceControlRoot(name: string, service: string, root = process.cwd()): string {
   const instance = readWorldInstance(name, resolve(root));
   if (!instance.services[service]) throw new Error(`World ${name} has no service "${service}"`);
-  return join(instance.dirs.data, service);
+  return ownedPath(instance.dirs.data, service);
 }
 
 function worldServiceStateService(controlRoot: string, requestedService: string): string {
@@ -2526,7 +2828,7 @@ async function waitForPublicUrl(child: ReturnType<typeof spawn>, logPath: string
   });
   child.once('error', (error) => {
     exited = true;
-    exitSummary = error.message;
+    exitSummary = errorMessage(error);
   });
 
   const started = Date.now();
@@ -2558,17 +2860,17 @@ function commandExists(command: string): boolean {
   return OWN_COMMANDS[command] !== undefined || onPath(command);
 }
 
-/** A lifecycle command naming this runtime's own bin (`volter-world-infra`, which `init` names in every managed
- *  infrastructure's lifecycle) runs this runtime's own script with the executable running it, when nothing on PATH
- *  answers the name: a bare `volter-world down` (no runner that put node_modules/.bin on PATH) failed "not found on
- *  PATH" and left the infrastructure up. Only the name is mapped — no directory joins PATH — and a same-named
- *  command on PATH still wins, as before. */
+/** Built-in lifecycle names belong to the executing runtime. PATH may contain another
+ * checkout's package-manager bin links; an operator override names an explicit executable path. */
 const OWN_COMMANDS: Record<string, string> = { 'volter-world-infra': 'infra-cli' };
 export function ownCommand(command: string[]): string[] {
   const [bin, ...args] = command;
   const stem = bin === undefined ? undefined : OWN_COMMANDS[bin];
-  if (stem === undefined || onPath(bin!)) return command;
-  return [process.execPath, siblingScript(import.meta.url, stem), ...args];
+  if (stem === undefined) return command;
+  const script = siblingScript(import.meta.url, stem);
+  const loader = typeof (globalThis as { Bun?: unknown }).Bun === 'undefined' && script.endsWith('.ts')
+    ? ['--experimental-transform-types', '--no-warnings'] : [];
+  return [process.execPath, ...loader, script, ...args];
 }
 
 /** A command answers when it names an executable: a path is checked as a file (what `which` does with a path),
@@ -2716,7 +3018,7 @@ async function shareWorldReserved(name: string, options: ShareWorldOptions): Pro
   }
 
   const tunnel = shareCommand(options, service.url);
-  const log = join(instance.dirs.logs, `${serviceId}.tunnel.log`);
+  const log = ownedPath(instance.dirs.logs, `${serviceId}.tunnel.log`);
   // Each spawned tunnel owns one log generation. Truncating before spawn prevents a repeated
   // share from accepting the previous process's URL handshake as the new process's endpoint.
   const out = openPrivateLog(log, 'w');
@@ -2726,12 +3028,18 @@ async function shareWorldReserved(name: string, options: ShareWorldOptions): Pro
     detached: true,
     stdio: ['ignore', out, out],
   });
-  closeSync(out);
+  const birth = retainSpawn(child);
+  const identities: Record<string, string | undefined> = {};
+  const handles = new Map(child.pid ? [[child.pid, child]] : []);
 
   let publicUrl: string;
   let publicVerification: WorldServiceInstance['publicVerification'];
   let pidsWritten = false;
   try {
+    closeSync(out);
+    const identity = await birth;
+    if (!identity?.start) throw new Error('Tunnel birth capture failed; retiring held child');
+    identities[identity.pid] = identity.start;
     publicUrl = await waitForPublicUrl(child, log, options.timeoutMs ?? 20_000, tunnel.provider === 'cloudflare-quick');
     if (options.verifyPath !== false) {
       publicVerification = await verifyPublicUrl(publicUrl, options.verifyPath ?? '/health', options.timeoutMs ?? 90_000);
@@ -2764,8 +3072,8 @@ async function shareWorldReserved(name: string, options: ShareWorldOptions): Pro
     // gives owned services (a cloudflared that ignores SIGTERM must not keep serving after a
     // failed/rejected `share`).
     if (child.pid) {
-      signalPids([child.pid], 'SIGTERM');
-      await killSurvivorsAfterGrace([child.pid], DOWN_GRACE_MS_DEFAULT);
+      await signalPids([child.pid], 'SIGTERM', identities, handles);
+      await killSurvivorsAfterGrace([child.pid], DOWN_GRACE_MS_DEFAULT, identities, handles);
     }
     const cleanupProblems: string[] = [];
     if (child.pid && undeadPids([child.pid]).length > 0) cleanupProblems.push(`tunnel pid ${child.pid} survived cleanup`);
@@ -2774,10 +3082,10 @@ async function shareWorldReserved(name: string, options: ShareWorldOptions): Pro
     // file intact; this compensates the one successful write in a two-file persistence attempt.
     if (pidsWritten) {
       try { writePidsFromInstance(instance); }
-      catch (restoreError) { cleanupProblems.push(`could not restore pids file: ${restoreError instanceof Error ? restoreError.message : String(restoreError)}`); }
+      catch (restoreError) { cleanupProblems.push(`could not restore pids file: ${errorMessage(restoreError)}`); }
     }
     if (cleanupProblems.length > 0) {
-      throw new Error(`${error instanceof Error ? error.message : String(error)}; share cleanup incomplete: ${cleanupProblems.join('; ')}`, { cause: error });
+      throw new Error(`${errorMessage(error)}; share cleanup incomplete: ${cleanupProblems.join('; ')}`, { cause: error });
     }
     throw error;
   }
@@ -2832,11 +3140,9 @@ export async function shareWorldServices(name: string, options: ShareWorldServic
  * services — SIGTERM, confirm dead (escalating to SIGKILL past the grace), and only THEN erase the
  * tunnel facts/pids. A best-effort SIGTERM with no confirmation can leave a `cloudflared` that
  * ignores SIGTERM serving the public URL forever while instance.json (and the pids file) say
- * nothing is shared — the exact "half-shared" state docs/concepts/worlds.md promises cannot exist. Stays
- * synchronous (via `killSurvivorsAfterGraceSync`) to match the existing signature/call sites
- * (the CLI does not await it). Returns the instance plus the tunnel pids that needed escalating,
+ * nothing is shared — the exact "half-shared" state docs/concepts/worlds.md promises cannot exist. Retirement awaits asynchronous birth verification. Returns the instance plus the tunnel pids that needed escalating,
  * for callers that want to report it. */
-export function unshareWorld(name: string, options: { root?: string; service?: string; graceMs?: number } = {}): WorldInstance & { escalated: number[] } {
+export async function unshareWorld(name: string, options: { root?: string; service?: string; graceMs?: number } = {}): Promise<WorldInstance & { escalated: number[] }> {
   const root = resolve(options.root ?? process.cwd());
   const instance = readWorldInstance(name, root);
   const serviceIds = options.service ? [options.service] : Object.keys(instance.services);
@@ -2847,12 +3153,13 @@ export function unshareWorld(name: string, options: { root?: string; service?: s
     if (!service) throw new Error(`World "${name}" has no service "${serviceId}"`);
     if (service.tunnel?.pid) {
       const pid = service.tunnel.pid;
-      signalPids([pid], 'SIGTERM');
-      const survivors = killSurvivorsAfterGraceSync([pid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT);
+      const identities = readIdentities(root, name);
+      await signalPids([pid], 'SIGTERM', identities);
+      const survivors = await killSurvivorsAfterGrace([pid], options.graceMs ?? DOWN_GRACE_MS_DEFAULT, identities);
       if (survivors.length > 0) escalated.push(...survivors);
       // `undeadPids` (not the raw `livePids`) is the right "confirmed dead" test here: a zombie
-      // (exited but unreaped — likely since we just polled it synchronously via `Atomics.wait`,
-      // which blocks the event loop that would otherwise let this process auto-reap its child) still
+      // (exited but unreaped, possibly awaiting its parent's reap) still
+      // occupies a process-table entry and
       // answers `kill(pid, 0)` yet is dead for every practical purpose — see `survivingOwnedGroups`' own
       // comment. Using plain `livePids` here would treat every zombie as "still shared".
       if (undeadPids([pid]).length > 0) {
@@ -2908,7 +3215,7 @@ async function probeExternalOnce(
       if (response.status >= 200 && response.status < 400) return { ok: true, message: `probe ok (HTTP ${response.status})` };
       return { ok: false, message: `probe returned HTTP ${response.status}` };
     } catch (error) {
-      return { ok: false, message: `probe failed: ${error instanceof Error ? error.message : String(error)}` };
+      return { ok: false, message: `probe failed: ${errorMessage(error)}` };
     }
   }
   if (ready.stdoutMatch !== undefined) {
@@ -2935,7 +3242,7 @@ export async function doctorWorld(name: string, options: { root?: string; verify
     instance = readWorldInstance(name, root);
     checks.push({ id: 'instance', ok: true, message: `instance=${instanceFile(root, name)}` });
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
+    const message = errorMessage(error);
     return { name, ok: false, checks: [{ id: 'instance', ok: false, message }] };
   }
 
@@ -2993,7 +3300,7 @@ export async function doctorWorld(name: string, options: { root?: string; verify
           await runExternalCommand(configuredExternal.status, probeCwd, service.id, 'doctor-probe', probeEnv);
           checks.push({ id: `service:${service.id}:external`, ok: true, message: `${discoveredMessage}; probe ok (status)` });
         } catch (error) {
-          checks.push({ id: `service:${service.id}:external`, ok: false, message: `${discoveredMessage}; probe failed: ${error instanceof Error ? error.message : String(error)}` });
+          checks.push({ id: `service:${service.id}:external`, ok: false, message: `${discoveredMessage}; probe failed: ${errorMessage(error)}` });
         }
       } else {
         checks.push({ id: `service:${service.id}:external`, ok: true, message: `${discoveredMessage}; no probe declared — health unknown` });
@@ -3035,7 +3342,7 @@ export async function doctorWorld(name: string, options: { root?: string; verify
       checks.push({
         id: `service:${service.id}:tcp`,
         ok: false,
-        message: error instanceof Error ? error.message : String(error),
+        message: errorMessage(error),
       });
     }
     if (service.tunnel || service.publicUrl) {
@@ -3064,7 +3371,7 @@ export async function doctorWorld(name: string, options: { root?: string; verify
           checks.push({
             id: `service:${service.id}:public-health`,
             ok: false,
-            message: error instanceof Error ? error.message : String(error),
+            message: errorMessage(error),
           });
         }
       }
@@ -3155,7 +3462,7 @@ export async function runWorldOwned(configId: string, command: string[], options
   let failed = false;
   let retired = true;
   try {
-    outcome = await runWithWorldEnvLogged(instance.name, command, instance.root, { abort, verbose: options.verbose });
+    outcome = await runWithWorldEnvLogged(instance.name, command, instance.root, { cwd: options.cwd, abort, verbose: options.verbose });
     instance.lastRun = outcome;
     saveWorldInstance(instance);
   } catch (error) {
@@ -3169,7 +3476,7 @@ export async function runWorldOwned(configId: string, command: string[], options
   if (!options.keep && retired) {
     try { await finishTaskWorld(instance); }
     catch (error) {
-      if (failed) throw new AggregateError([failure, error], `World execution and cleanup failed: ${String(failure)}; ${String(error)}`);
+      if (failed) throw new AggregateError([failure, error], `World execution and cleanup failed: ${errorMessage(failure)}; ${errorMessage(error)}`);
       throw error;
     }
   }
@@ -3182,7 +3489,7 @@ async function finishTaskWorld(instance: WorldInstance): Promise<void> {
   let uncertainSince: number | undefined;
   for (;;) {
     try {
-      const result = await downWorld(instance.name, instance.root, { expectedCreatedAt: instance.createdAt });
+      const result = await downWorld(instance.name, instance.root, { expectedInstance: instance.instance });
       if (result.externalErrors.length) {
         const message = `World "${instance.name}" cleanup incomplete: ${result.externalErrors.join('; ')}. Reservation and diagnostics retained.`;
         // The caller that would have read this on stderr may be gone; the lifecycle log keeps it.
@@ -3245,7 +3552,7 @@ function worldAttachedCommandEnv(name: string, root: string, verbose = false): {
     } else if (sealed && hostHasRawEgress()) throw new Error(`world "${name}" requires its network policy proxy: attachment proxy is unavailable; refusing to run the command`);
   } catch (error) {
     if (error instanceof CaTrustError) throw error;
-    if (sealed && hostHasRawEgress()) throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing to run the command (${error instanceof Error ? error.message : String(error)})`);
+    if (sealed && hostHasRawEgress()) throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing to run the command (${errorMessage(error)})`);
     // Keep env-only redirect if the ambient proxy cannot start.
   }
   return { instance: status, env: withAppUrl(name, root, { ...baseEnv, ...proxyEnv, VOLTER_WORLD: name,
@@ -3279,7 +3586,10 @@ export function runWithWorldEnv(name: string, command: string[], root = process.
       env: { ...attached.env, ...(options.env ?? {}) },
       stdio: 'inherit',
     });
-    const forward = (signal: NodeJS.Signals) => { if (child.exitCode === null && child.signalCode === null) child.kill(signal); };
+    const forward = (signal: NodeJS.Signals) => {
+      try { if (child.pid && child.exitCode === null && child.signalCode === null) signalChild(child, signal); }
+      catch (error) { process.stderr.write(`${errorMessage(error)}\n`); }
+    };
     process.on('SIGINT', forward);
     process.on('SIGTERM', forward);
     child.once('error', () => { offSignal('SIGINT', forward); offSignal('SIGTERM', forward); resolveExit(1); });
@@ -3421,7 +3731,7 @@ async function runWithWorldEnvLogged(name: string, command: string[], root: stri
   try {
     attached = worldAttachedCommandEnv(name, root, options.verbose);
   } catch (cause) {
-    return finish(1, undefined, cause instanceof Error ? cause.message : String(cause));
+    return finish(1, undefined, errorMessage(cause));
   }
 
   return await new Promise<WorldRunOutcome>((resolveOutcome, rejectOutcome) => {
@@ -3435,21 +3745,21 @@ async function runWithWorldEnvLogged(name: string, command: string[], root: stri
         detached: commandProcessGroup,
       });
     } catch (cause) {
-      resolveOutcome(finish(1, undefined, cause instanceof Error ? cause.message : String(cause)));
+      resolveOutcome(finish(1, undefined, errorMessage(cause)));
       return;
     }
 
     const lifetime = commandLifetime(child, options.abort);
     child.stdout.on('data', (chunk: Buffer) => {
       try { process.stdout.write(chunk); writeSync(logFd, chunk); }
-      catch (error) { spawnError = String(error); lifetime.cancel('SIGTERM'); }
+      catch (error) { spawnError = errorMessage(error); lifetime.cancel('SIGTERM'); }
     });
     child.stderr.on('data', (chunk: Buffer) => {
       try { process.stderr.write(chunk); writeSync(logFd, chunk); }
-      catch (error) { spawnError = String(error); lifetime.cancel('SIGTERM'); }
+      catch (error) { spawnError = errorMessage(error); lifetime.cancel('SIGTERM'); }
     });
     child.once('error', (cause) => {
-      spawnError = cause.message;
+      spawnError = errorMessage(cause);
     });
     const activeRecord: WorldRunRecord = {
       state: 'running',
@@ -3459,7 +3769,7 @@ async function runWithWorldEnvLogged(name: string, command: string[], root: stri
       log,
     };
     try { writeTextAtomic(foregroundRunFile(instance.root, instance.name), `${JSON.stringify(activeRecord, null, 2)}\n`); }
-    catch (error) { spawnError = String(error); lifetime.cancel('SIGTERM'); }
+    catch (error) { spawnError = errorMessage(error); lifetime.cancel('SIGTERM'); }
     void lifetime.finish().then(({ code, signal }) => {
       const effectiveSignal = signal ?? lifetime.forwarded;
       const exitCode = effectiveSignal ? signalExitCode(effectiveSignal) : (code ?? 1);
@@ -3504,8 +3814,8 @@ export async function shellWorld(name: string, root = process.cwd()): Promise<nu
       process.stderr.write(`world '${name}' active in a subshell — vendor calls hit the twins (ambient proxy ${proxy.url}). type 'exit' to leave.\n`);
     } catch (error) {
       if (error instanceof CaTrustError) throw error;
-      if (sealed) throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing to open a shell (${error instanceof Error ? error.message : String(error)})`);
-      process.stderr.write(`world '${name}': ambient TLS proxy unavailable (${error instanceof Error ? error.message : String(error)}); falling back to env-only redirect.\n`);
+      if (sealed) throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing to open a shell (${errorMessage(error)})`);
+      process.stderr.write(`world '${name}': ambient TLS proxy unavailable (${errorMessage(error)}); falling back to env-only redirect.\n`);
     }
   } else {
     if (sealed) throw new Error(`world "${name}" requires its network policy proxy: openssl is unavailable; refusing to open a shell`);
@@ -3554,10 +3864,7 @@ function currentProxyState(root: string, name: string): ProxyState | null {
   const existing = readProxyState(root, name);
   if (!existing || !isAlive(existing.pid)) return null;
   if (existing.guestUrl) return existing;
-  try { process.kill(existing.pid, 'SIGTERM'); } catch { /* gone already */ }
-  for (let i = 0; i < 50 && isAlive(existing.pid); i += 1) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 100);
-  try { rmSync(proxyStateFile(root, name), { force: true }); } catch { /* ignore */ }
-  return null;
+  throw new Error('World proxy lacks its guest listener; stop this World before restarting its proxy');
 }
 
 function ensureWorldProxyUnlocked(name: string, root: string, caller: CaTrustInputs): { url: string; caCertPath: string; env: Record<string, string> } | null {
@@ -3608,9 +3915,20 @@ function startProxyDaemonOwned(name: string, root: string, caCertPath: string, e
       child = spawn(process.execPath, [proxyDaemonEntry(), name, '--root', root, ...(envFile ? [`--env-file=${envFile}`] : [])], { windowsHide: true,
         cwd: root, env: process.env, detached: true, stdio: ['ignore', proxyOut, proxyOut],
       });
+      if (child.pid) {
+        spawnedChildren.set(child.pid, child);
+        if (boot) { boot.pids.add(child.pid); boot.handles.set(child.pid, child); }
+      }
     } finally { closeSync(proxyOut); }
   } catch (error) {
-    try { rmSync(marker, { force: true }); } catch { /* the spawn's failure is the one to report */ } // no child was returned by spawn
+    if (child!?.pid) {
+      try {
+        signalChild(child!, 'SIGTERM', true);
+        killHeldSurvivorsSync(child!, DOWN_GRACE_MS_DEFAULT);
+        if (undeadPids([child!.pid!]).length) throw new CommandRetirementError('Proxy retirement unconfirmed; startup intent retained');
+      } catch (cleanup) { throw new AggregateError([error, cleanup], 'Proxy spawn/descriptor close and retirement failed'); }
+    }
+    try { rmSync(marker, { force: true }); } catch (cleanup) { throw new AggregateError([error, cleanup], 'Proxy spawn and intent cleanup failed'); }
     throw error;
   }
   child.on('error', () => {}); // a failed spawn can emit after this synchronous operation throws
@@ -3619,16 +3937,16 @@ function startProxyDaemonOwned(name: string, root: string, caCertPath: string, e
     rmSync(marker, { force: true });
     throw new Error(`World "${name}": ambient proxy process did not start`);
   }
-  boot?.pids.add(pid); // before any fallible filesystem operation
+  if (boot) { boot.pids.add(pid); boot.handles.set(pid, child); } // before any fallible filesystem operation
   child.unref();
   let retirementAttempted = false;
   const retire = () => {
     retirementAttempted = true;
-    signalPids([pid], 'SIGTERM');
-    killSurvivorsAfterGraceSync([pid], DOWN_GRACE_MS_DEFAULT);
+    signalChild(child, 'SIGTERM', true);
+    killHeldSurvivorsSync(child, DOWN_GRACE_MS_DEFAULT);
     if (undeadPids([pid]).length) {
       const error = new CommandRetirementError(`World "${name}": proxy process ${pid} retirement is unconfirmed; ownership retained`);
-      try { retainWorldLifecycleForCleanup(root, name); } catch (cause) { error.message += `; claim update failed: ${String(cause)}`; }
+      try { retainWorldLifecycleForCleanup(root, name); } catch (cause) { error.message += `; claim update failed: ${errorMessage(cause)}`; }
       throw error;
     }
     // Publication can happen during the grace period. Erase only this retired child's state.
@@ -3638,12 +3956,16 @@ function startProxyDaemonOwned(name: string, root: string, caCertPath: string, e
   try {
     if (boot) boot.recordPids();
     else writeOwnedPids(root, name, [pid], [pid]);
-    rmSync(marker, { force: true }); // canonical ownership is now durable
     const deadlineMs = proxyDaemonDeadlineMs();
     const deadline = Date.now() + deadlineMs;
     while (Date.now() < deadline) {
       const state = readProxyState(root, name);
       if (state?.pid === pid) {
+        if (!state.birth) throw new Error('Proxy birth token missing; retiring held child');
+        spawnedIdentities.set(pid, { pid, start: state.birth });
+        if (boot) { boot.identities[pid] = state.birth; boot.recordPids(); }
+        else writeOwnedPids(root, name, [pid], [pid]);
+        rmSync(marker, { force: true }); // both numeric ownership and birth are durable
         if (!boot) handoffWorldLifecycle(root, name, readPids(join(instanceDir(root, name), 'pids')));
         return { url: state.url, caCertPath: state.caCertPath, env: proxyEnvFor(state.url, state.caCertPath, caller, state.guestUrl) };
       }
@@ -3661,13 +3983,13 @@ function startProxyDaemonOwned(name: string, root: string, caCertPath: string, e
       // a retirement error is still what is thrown (its type keeps the survivor's ownership), with the cause it hid leading its
       // message; any other cleanup failure is added to the original, which is thrown
       try { retire(); } catch (retirement) {
-        const cause = error instanceof Error ? error.message : String(error);
+        const cause = errorMessage(error);
         if (retirement instanceof CommandRetirementError) {
-          Object.assign(retirement, { retirement: retirement.message, cause: error });
-          retirement.message = `${cause}; ${retirement.message}`;
+          Object.assign(retirement, { retirement: errorMessage(retirement), cause: error });
+          retirement.message = `${cause}; ${errorMessage(retirement)}`;
           throw retirement;
         }
-        if (error instanceof Error) error.message += `; retiring the proxy failed too: ${retirement instanceof Error ? retirement.message : String(retirement)}`;
+        throw new AggregateError([error, retirement], 'Proxy startup and retirement failed');
       }
     }
     throw error;
@@ -3703,8 +4025,10 @@ export async function runProxyDaemon(name: string, root = process.cwd(), envFile
     env = { ...admittedEnv(stripEnvOf(status.env)), ...status.env };
   }
   const proxy = await startRedirectProxy({ env, envLoader, tlsDir: tlsDir(resolvedRoot, name), note: (line) => process.stderr.write(`${line}\n`) });
-  const state: ProxyState = { pid: process.pid, url: proxy.url, caCertPath: proxy.caCertPath, guestUrl: proxy.guestUrl };
-  writeFileSync(proxyStateFile(resolvedRoot, name), JSON.stringify(state));
+  const identity = await spawnIdentity(process.pid);
+  if (!identity.start) { await proxy.close(); throw new Error('Proxy birth capture failed'); }
+  const state: ProxyState = { pid: process.pid, birth: identity.start, url: proxy.url, caCertPath: proxy.caCertPath, guestUrl: proxy.guestUrl };
+  writeTextAtomic(proxyStateFile(resolvedRoot, name), JSON.stringify(state));
   // Not a recorded service, so it records its own start and end in the World's events (a crash included; a SIGKILL
   // leaves none, which doctor's proxy check then names).
   const events = worldEventsPath(join(instanceDir(resolvedRoot, name), 'logs'));
@@ -3724,10 +4048,17 @@ export async function runProxyDaemon(name: string, root = process.cwd(), envFile
 
 /** Stop a world's ambient-redirect proxy daemon (if any) and drop its session CA. Best-effort —
  * called from `downWorld` so the trusted CA never outlives the world. */
-function stopWorldProxy(root: string, name: string): void {
+async function stopWorldProxy(root: string, name: string, handles?: Map<number, ReturnType<typeof spawn>>): Promise<void> {
   const state = readProxyState(root, name);
   if (state && isAlive(state.pid)) {
-    try { process.kill(state.pid, 'SIGTERM'); } catch { /* ignore */ }
+    const identities = readIdentities(root, name);
+    const identity = { pid: state.pid, start: state.birth ?? identities[state.pid] };
+    const child = handles?.get(state.pid);
+    if (child) await signalHeldChild(child, 'SIGTERM', false, Promise.resolve(identity));
+    else {
+      if (!state.birth && !Object.hasOwn(identities, state.pid)) throw new Error('Proxy spawn identity missing; retirement refused; ownership retained');
+      await signalOwnedProcess(identity, 'SIGTERM');
+    }
   }
   try { rmSync(proxyStateFile(root, name), { force: true }); } catch { /* ignore */ }
   try { rmSync(proxyEnvFile(root, name), { force: true }); } catch { /* ignore */ }
@@ -3766,7 +4097,7 @@ export function activateScript(name: string, root = process.cwd()): string {
     } else if (sealed && hostHasRawEgress()) throw new Error('attachment proxy is unavailable');
   } catch (error) {
     if (error instanceof CaTrustError) throw error;
-    if (sealed && hostHasRawEgress()) throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing activation (${error instanceof Error ? error.message : String(error)})`);
+    if (sealed && hostHasRawEgress()) throw new Error(`world "${name}" requires its network policy proxy: attachment proxy failed; refusing activation (${errorMessage(error)})`);
     // openssl missing or daemon failed — keep env-only redirect; never fabricate proxy success.
   }
   env = withAppUrl(name, root, env);