machine-bridge-mcp 2.0.0 → 3.0.0-beta.102

package/docs/TESTING.md

@@ -4,82 +4,140 @@ The project treats transport, authorization, local authority, and state removal
 
 ## Required suites
 
+The resource profile suite also pins the live-release exception discovered under multi-project contention and tightened after both npm `script-shell` and mutable-checkout review. Only exact direct Node argv `node <activated-runtime-package>/scripts/release-oauth-canary.mjs --allow-live-oauth-canary` may receive the `release-control` light profile. The script operand must be absolute and canonicalize to the running package's own canary; `node scripts/release-oauth-canary.mjs ...`, copied workspace canaries, npm/pnpm lifecycle invocation, shell wrappers, missing/extra argv, and lookalike entrypoints never receive release-control identity. Production admission also requires the resolved Node executable to canonicalize to the daemon's own `process.execPath`, startup-injection/debug/TLS/key-log/threadpool/native-loader environment variables to be absent, and the cwd package/version plus canary source bytes to match the running package. Executable regressions cover a trusted first PATH Node, an explicit absolute runtime Node, relative PATH resolution from the child cwd, a shadowing first Node, missing/empty targets, `NODE_OPTIONS`, debug/TLS/key-log/threadpool/native-loader overrides, and deterministic Windows PATH/PATHEXT behavior. Runtime-entry regressions require the actual packaged canary path and reject a same-bytes canary under another workspace path. Prerelease activation regressions separately require the canary's executing package root to canonicalize to the package root containing activation `runtime_entry`, so a workspace/developer invocation cannot generate prerelease evidence even when its entry bytes match. For all release channels the source contract also requires the existing daemon-owner verifier with candidate `expectedVersion`, exact runtime `expectedEntryScript`, exact `expectedNodeExecutable`, exact daemon-lock `expectedNodeVersion`, `verified_service_daemon`, and startup-readiness checks, so stable canaries cannot be evidenced from a source checkout while a different packaged daemon is active. The canary source contract further requires the same clean environment, imports from the activated runtime package, `process.cwd()` as the candidate/evidence data root, exact single-flag argv, and empty `process.execArgv`; the entrypoint regression spawns a harmless Node CLI option and requires rejection before live state access. `--state-dir`/`--workspace` overrides fail before state access because evidence does not encode those identities. Mutable checkout modules therefore cannot execute under the light exception and unrecorded local-state selection cannot become release evidence. The npm CLI resolver used inside the canary has separate tests for lifecycle-path rejection, running-Node layouts, and the Homebrew Cellar/package-manager-prefix split. Arbitrary shell commands have no generic zero-resource bypass.
+
 ```sh
 npm run check:fast      # static, unit, contract, and architecture feedback
 npm run check:platform  # fast plan plus cross-platform behavior and real-machine tests
 npm run check           # complete suite; equivalent to check:full
 ```
 
-The explicit task lists live in `scripts/check-plan.mjs`. The fast plan retains static analysis, policy, architecture, contracts, and focused unit behavior. The platform plan adds process, service, browser/application, state, managed-job, cryptographic, and real-machine behavior tests needed on macOS and Windows. The full-only plan adds coverage, browser-broker integration, package/install, stdio, Worker/OAuth, and real-browser navigation suites. `npm run check` remains the authoritative complete gate.
+The explicit task lists live in `scripts/check-plan.mjs`. The fast plan retains static analysis, policy, architecture, contracts, and focused unit behavior. The platform plan adds process, service, browser/application, state, managed-job, cryptographic, and real-machine behavior tests needed on macOS and Windows. The full-only plan adds coverage, browser-broker integration, package/install, stdio, Worker/OAuth, and real-browser navigation suites. In particular, a green fast plan is not evidence that the npm tarball has correct 0644/0755 modes or installability; `package:test` builds the actual manifest and rejects unexpected packaged file modes, and the install suite validates the consumer artifact. `npm run check` remains the authoritative complete gate.
+
+Tests are verification inputs but are not npm tarball entries under the current `package.json.files` manifest. A test-only repository change therefore does not by itself change npm package bytes or require a synthetic package version; `release-impact:check` remains authoritative and still requires a version whenever `package.json`, `package-lock.json`, or any path selected by `package.json.files` changes. A source fix that requires a regression test is versioned because of its packaged source/documentation/metadata impact, not because `tests/` is implicitly shipped.
+
+On macOS, `scripts/run-checks.mjs` re-executes the complete fast/platform/full verification process under `/usr/bin/caffeinate -i` before it captures verification inputs. The internal `MBM_CHECK_IDLE_SLEEP_GUARD` marker prevents recursive wrapping. This establishes an idle-system-sleep assertion for the whole verification lifetime so a short child timeout cannot expire only because the machine entered Idle Sleep between dispatch and settlement. That verification-lifetime guard is distinct from production ownership: authorized, schema-valid relay handlers hold a shared `/usr/bin/caffeinate -i -w <daemon-pid>` assertion for their full execution lifetime; the default five-minute inactivity grace starts only after the last concurrent handler settles, and a new handler cancels pending release. A remote process session extends the same daemon assertion from successful resource admission through child settlement. A remote account managed-job runner independently holds `/usr/bin/caffeinate -i -w <runner-pid>` only after its runner claim is confirmed and persisted ownership identifies an account-backed job, then retains it through terminal persistence; local managed jobs do not acquire that remote-continuity assertion, and the remote runner protection survives daemon reconnect/replacement. Runtime shutdown terminates process sessions before releasing the daemon assertion. The production five-minute relay grace is fixed rather than depending on shell-only environment inheritance that launchd does not persist as service configuration. None of these mechanisms claims to defeat explicit sleep or lid-close sleep; those still invalidate the usefulness of a live-machine verification run.
 
 Successful child-task stdout/stderr is intentionally suppressed so a long green plan does not overwhelm an MCP response or hide the final status behind host truncation. Progress and timing remain visible. A failed task returns bounded head/tail diagnostics for both streams. Set `MBM_CHECK_VERBOSE=1` only when an operator explicitly needs live child output; verbose mode can be large and should be run through a process session when used remotely.
 
-The repository requires Node.js 26 and npm 12. `.node-version`, `.nvmrc`, `packageManager`, `devEngines`, and strict engine checks keep local and CI execution on the same baseline.
+Remote execution carrier limits are separate from the verification plan itself. `run_process`/`run_local_command`/`exec_command` cap one detached process step at 600 seconds, while a complete `check:full` can legitimately exceed that wall-clock budget when a real install or integration dependency is slow. An owner-authorized remote release verification that may cross 600 seconds must therefore submit `npm run check:full` as a detached `start_job` step with a larger explicit step timeout and inspect it with `read_job`; an ordinary local terminal run is unaffected. This does not widen any product foreground/process timeout—it prevents the verification carrier from becoming the narrower deadline than the suite being measured.
+
+The fast runner avoids a second npm process for package scripts that are exactly one simple `node ...` invocation and have no `pre<task>`/`post<task>` lifecycle hooks. It recreates the relevant npm lifecycle identity in the child environment; scripts containing shell syntax, lifecycle hooks, or non-Node commands still run through npm, so shell/package-manager semantics are not guessed. Parallel-safe fast tasks use a bounded worker pool that defaults to at most four workers and is further bounded by Node's `availableParallelism()`; `MBM_CHECK_CONCURRENCY` may explicitly select 1–16. Known process-heavy gates remain serial barriers. This preserves every fast-plan gate while removing repeated npm startup cost.
+
+Resource-admission regressions are first-class fast and critical-coverage gates. `resource-admission:test` covers Green/Yellow/Red pressure, absent optional pressure metrics, Linux `MemAvailable`/PSI parsing including default-reader/no-PSI behavior, soft-versus-hard free-disk headroom, startup-window reservations, adaptive quick sampling, five-second I/O evidence reuse, bounded recovery when the atomically replaced cross-process host-sample cache changes generation during secure pathname verification, fail-closed exhaustion for persistent generation churn, valid and invalid persistent request contracts, stale ownership, priority aging, protected-queue diagnostics including the privacy-safe `drain_active` fairness signal, ordinary fit-aware head-of-line bypass, protected drain for an aged feasible waiter, impossible-old-request bypass, and fixed CPU fan-out above the best-case launch window. The latter proves an eight-worker fixed request on an idle eight-core interactive host fails immediately and non-retryably as `cpu_request_exceeds_launch_window`, a seven-worker request remains admissible, the impossible waiter cannot reserve starvation drain, and no retry sleep occurs. It also covers literal-shell-cwd versus dynamic-cwd contention scope, false heavy classification from ordinary filename arguments, and referenced wait timeout/in-flight abort/already-aborted behavior. It further proves nested lease-envelope accounting: parent coverage, child excess delta, parallel sibling summation, parent-loss recovery to full child cost, recent-CPU delta, same-key ancestor-only exemption, same-key sibling serialization, ancestry-sampling fallback, and a real coordinator acquisition where the requesting process is the live parent lease owner. Process-lifecycle coverage binds a real isolated group, releases the caller-side handle while that group is still alive, requires the durable reservation to remain, then proves ordinary pruning removes it after the group exits. Async host-probe tests require Darwin pressure probes to launch concurrently and keep a timer runnable while their child commands are pending; ancestry-cache tests require concurrent callers to share one in-flight system-wide process scan. Script-classification regressions distinguish the actual executed entrypoint from later arguments: direct Node/Python coverage/verify roots and package-manager `check` scripts promote before fan-out, while interpreter module/eval modes and harmless scripts followed by heavy-looking filenames remain adaptive. Generic zero-resource admission is identity-bound: only the standard absolute executables enumerated by `resource-light-command.mjs` qualify, while the same `ps`/`uptime`/`sleep` basenames reached through PATH are adaptive. `stat`, `df`, `which`, `printf`, `wc`, search/traversal commands, caller-controlled Git, `find`, `open`, and `osascript` remain adaptive because filesystem behavior, input size, options, helpers, state mutation, or child execution can make them unbounded. Arbitrary zsh/bash/sh/PowerShell/cmd invocations never receive the generic light bypass, including payloads that only appear to call a trusted inner executable. Background-priority tests require POSIX heavy background roots to use one `nice +5` wrapper and leave interactive roots unchanged. Canonical project-key tests require fixed v1 golden vectors plus a real path and a symlink alias to derive the same contention key. `resource-build-root:test` covers Cargo/SwiftPM/Xcode path/job controls, explicit override preservation, macOS no-index behavior, canonical cache identity, and the transaction rule that build-root preparation failure releases an already-acquired lease. `coverage:test` executes the direct resource fixtures and enforces dedicated thresholds across admission, hierarchy/coordinator accounting, process ancestry, canonical project identity, policy, waiters, profile/shell parsing, host pressure, wait liveness, staging, build-root/process admission, and request validation. Its V8 merge preserves explicitly covered ranges while letting a missing child range inherit the nearest enclosing execution count, and an exact-generation digest fails the run if source/test content, file mode, or symlink topology changes while coverage is being collected. Architecture release contracts prevent those fixtures, merge semantics, generation guard, or core threshold keys from disappearing. Runtime/managed-job suites separately prove leases bind real process trees and release through close, cancellation, timeout, and detached-job cleanup. `full-access:test` uses an isolated resource coordinator, a synthetic healthy-host sampler, and an explicit ten-second process-admission budget for its internal `LocalRuntime`; its separate detached-job observation window remains five minutes. Settlement polling imports the production managed-job terminal classifier rather than maintaining a second status list, so recovered/expired/cancelled-before-start terminal states cannot become five-minute false hangs. `local-self-test` keeps process-admission behavior deterministic instead of inheriting shared-host pressure: its runtime fixture uses an isolated coordinator, a synthetic healthy-host sampler, and a ten-second resource-admission budget on both one-shot and process-session boundaries. Daemon-fixture child exit waits are independently bounded at thirty seconds, and each self-test phase emits start/completion markers so a hosted hang identifies its phase instead of waiting for an outer CI timeout. Managed-job CLI settlement polling and the stdio detached-job observation window use the same five-minute test-only ceiling because background runner admission can legitimately queue under machine-user pressure. Runtime/job command deadlines still start after admission, while ordinary production one-shot calls derive admission from 20% of their execution timeout with a two-second floor, ten-second ceiling, and never beyond the execution timeout. Owner-local process-session startup defaults to a ten-second cooperative wait; relay-origin `start_process` defaults to zero admission wait, performs one real admission decision, and returns retryable `unavailable` before spawn when pressure blocks it. Managed-job child step timeouts remain unchanged and start only after resource admission. The runner's separate pre-spawn admission wait is capped by the shared thirty-minute durable-delivery contract; `read_job.current_phase=resource_admission` distinguishes that state from child execution, local/owner completed-step reads expose `resource_admission_ms` alongside total `duration_ms` while delegated non-owner reads omit that machine-user scheduling timing, and the release-contract suite binds the phase transition, owner-only timing projection, plus lease cleanup if post-admission status persistence fails. `runtime-handlers:test` asserts that ordinary `LocalRuntime` composition leaves both process-service overrides unset so those dynamic defaults are not accidentally replaced by a constructor constant. The resource-executing runtime in `agent-context-test` likewise uses an isolated coordinator, synthetic healthy-host sampling, and a ten-second test-only resource-admission budget; an architecture release contract prevents that deterministic isolation or short-bounded override from being silently removed.
+The resource suite also injects hard-link/atomic-replace crash staging and requires exact-generation recovery. A still-live lease/waiter publisher must never be reclaimed; a transient publisher that completes during the fixed four-attempt staging-busy retry must let the reader continue, while a publisher that remains live after that budget still fails closed with the stable staging-busy classification. Process-admission coverage requires exhausted transaction/staging contention to project as retryable resource unavailability rather than an internal error. Its beta.60-compatible transaction-lock fixtures cover live legacy-directory/file owners, incomplete-owner grace, an owner that finishes publishing after stale observation, atomic empty-directory `rmdir` reclamation that leaves a late-published owner at canonical `transaction.lock`, and the rolling-only token-bearing quarantine restore path; a replacement lock injected immediately before restore must remain intact while the observed generation stays quarantined, never overwritten. Operation-budget regressions additionally require acquisition to stay within the caller's remaining admission budget while spawned-process lease bind/release may wait up to 30 seconds for ownership settlement. `managed-jobs:test` runs its destructive runner-kill scenarios inside a test-private coordinator/build root and deterministically holds that coordinator's transaction lock for 5.5 seconds during dead-runner recovery; the fixture itself gets 30 seconds to acquire the private lock before the measured hold begins, so scheduler delay cannot fail the setup before the old five-second product boundary is exercised. Recovery must then wait through that old internal deadline, run finally work exactly once after release, and remain successful both normally and under `NODE_V8_COVERAGE` instrumentation.
+
+JavaScript syntax validation likewise avoids a child-process storm: one Node VM-module parser process parses the complete dynamically discovered `.js`/`.mjs` surface, then the Unix shell wrapper receives one `sh -n` check. The parser subprocess is started with Node's VM-module flag only for parsing and does not evaluate or link repository modules. This keeps syntax coverage equivalent to a parse-only gate while avoiding hundreds of `node --check` process launches.
+
+Real process-tree fault injection should test the state transition, not consume minutes merely to reach it. Timeout fixtures therefore use short but scheduling-tolerant deadlines while still launching real descendants that ignore graceful termination and asserting forced cleanup, ownership checks, cancellation/recovery, and terminal persistence. Do not lengthen these fixture deadlines as a substitute for fixing readiness races; increase only the bounded readiness margin that has concrete cross-platform evidence. A lifecycle test that follows a public timeout must first wait within the production escalation budget for the previous tracker ownership to settle, then observe the new process as a tracker-count increase before terminating it; rejection observers are attached when the Promise is created so a fast signal cannot become an unhandled rejection. Security-critical session revocation/shutdown settlement waits keep their bounded deadline timer referenced, while ordinary output-observation waits remain unreferenced. Coverage fixtures must also avoid duplicate execution when a composite test already invokes the same subordinate suite.
+
+The repository and product runtime require Node.js 26 and npm 12. `.node-version`, `.nvmrc`, `packageManager`, strict published `engines`, CLI startup validation, doctor, and CI keep execution on that baseline. `devEngines.runtime` warns rather than aborting metadata-only Node 24 automation so Dependabot can update the lockfile; this is not runtime support.
 
 The suite includes:
 
 - package-impact classification derived from the npm package manifest, allowing repository-only GitHub workflow maintenance without weakening version requirements for shipped content;
-- interactive candidate acceptance hashing, including owner-authorized in-place Worker deployment plus agent-operated candidate verification, exact tarball SHA-1/SHA-512 matching, descriptor-first no-follow reads, path-identity/symlink regressions, acceptance-record exclusion from the package, legacy 1.2.8 marker compatibility, and invalidation after any packaged-byte change;
-- one-shot process output preview/continuation, completed-session paging, bounded nonzero-exit details, UTF-8-safe head/tail diagnostics, compact local/Worker MCP text mirrors, and quiet-success/bounded-failure verification-runner behavior;
+- final-consumer package verification that packs the actual tarball, stages those exact bytes inside a canonicalized fixture root (including macOS `/var`/`/private/var` alias coverage), performs an ordinary install including optional production dependencies, requires a zero-vulnerability production audit, validates a zero-problem installed dependency tree, and generates a CycloneDX SBOM whose root and every component have one unique closed dependency entry; the source-workspace audit and SBOM are not accepted as substitutes;
+- hardened npm bootstrap coverage for exact npm/undici/brace-expansion tarballs, SHA-512 mismatch rejection, package-identity replacement, non-symlink critical paths, tamper-triggered reconstruction, ephemeral release sessions, propagation of operational verification failures without deletion, and download fault injection where ETIMEDOUT then HTTP 503 retries to byte-identical success with 750/1500 ms backoff while certificate/policy failures and HTTP 302 remain single-attempt failures;
+- managed-job boundary coverage for lossless BigInt filesystem identity, descriptor-pinned POSIX directory resolution that tolerates child-entry ctime churn, canonical contained job directories, symlink escape, before/after/canonical identity change, unsafe numeric identity rejection, same-inode file-generation change, exact-generation whole-directory retirement through quarantine-and-verify semantics, an internal retired namespace that cannot match the public managed-job ID grammar, crash-left retired-generation discovery/reclamation, exact-cardinality privacy-bounded retired-state projection, wrong-generation and wrong-type retired entries that remain integrity blockers, abnormal retired state that still consumes the hard retained-state capacity, uninstall-time cleanup of a valid retired generation without weakening active-job refusal, coarse uninstall diagnostics that omit encoded filesystem identity, atomic cancellation markers, malformed/symlinked/hard-linked marker rejection, storage-error propagation, runner-claim inspection failure, malformed runner-owner retention during pruning/inventory, four-attempt recovery from atomic status-generation churn with fail-closed exhaustion, and prevention of post-cancellation main-step continuation;
+- private Wrangler toolchain lifecycle coverage for exact packaged manifest/lock bytes, owner-only storage, concurrent initialization, tamper-triggered reinstall, exact Wrangler/undici/sharp versions, zero-vulnerability audit, registry signatures, and bounded audit refresh;
+- local candidate acceptance hashing through ephemeral hardened npm, including owner-authorized in-place Worker deployment plus agent-operated candidate verification, exact tarball SHA-1/SHA-512 matching, descriptor-first no-follow reads, path-identity/symlink regressions, acceptance-record exclusion from the package, one current acceptance confirmation workflow, unconditional promotion-content digest verification, and invalidation after any packaged-byte change;
+- exact publication-channel identity: private accepted-candidate staging, GitHub REST SHA-256 and release-metadata convergence, npm dry-run name/version/SHA-1/SRI validation, script-disabled exact-tarball upload, exact preexisting-object idempotency, upload-error reconciliation, unresolved-outcome refusal, registry-install/soak digest convergence, trusted git/gh resolution with absolute-path HTTP/1.1 handling and hard deadlines, global-prefix preservation, and post-success cleanup warnings that do not fabricate failure;
+- one-shot process output preview/continuation, completed-session paging, bounded nonzero-exit details, UTF-8-safe head/tail diagnostics, shared monotonic process-tree ownership budgets, direct-child-exit descendant escalation, stale-identity SIGKILL rejection, compact local/Worker MCP text mirrors, quiet-success/bounded-failure verification-runner behavior, and runtime-diagnostic attribution that distinguishes pre-response host uncertainty, true local spawn failure, and a successfully spawned nested command whose child exit/output identifies downstream target authorization;
 - GitHub backlog enforcement that paginates all open issues and pull requests, permits only the current branch PR, and requires standard closing keywords for every open issue before a guarded push;
 - release-impact enforcement requiring a new package version and CHANGELOG section for release-relevant changes;
+- strict dev/beta/rc/stable channel parsing and npm dist-tag enforcement;
+- persistent candidate relay/service handoff ordering; pre-download deployment authorization; rollback-baseline read before hardened npm disposal; install-only disposable-prefix use; canonical contained runtime-pruning with symlink-ancestor denial and cleanup-before-record ordering; machine-service-before-startup lock acquisition and release; persistent activation execution-surface gating that accepts an ordinary local terminal or durable managed job but rejects daemon-owned foreground/process-session surfaces before live mutation; POSIX, XDG, and Windows separation of the ordinary profile state root from the machine-service control root; service-stop, ambiguous provider-state, and pre-mutation foreground/daemon-owner refusal; pending/committed machine-owner transactions; missing, corrupt, mismatched, and partial owner state; token-protected one-way daemon readiness; release activation skipping first-run initial-owner provisioning on both ordinary preparation and the single same-identity repair while general startup keeps provisioning enabled; first-attempt device-authentication rejection; exactly one same-name/same-identity repair deployment; ten-start bounded exponential convergence; exact-version/entrypoint pre-remote provider restoration; separation of strict normal start from raw provider recovery; post-remote compatible-service daemon/Worker convergence; recovered success only after foreground readiness plus exact service convergence; a post-deployment `authentication_failed`/`unauthorized` preparation failure that forward-recovers the exact service but remains nonzero because foreground readiness was not observed; non-converging provider recovery that preserves both the primary authentication error and exact daemon state; and aggregated cleanup/restoration failures;
+- owner-only local and registry prerelease activation records;
+- npm/GitHub prerelease metadata validation, minimum soak timing, blocking-issue rejection, and stable-promotion content/file-mode identity;
 - release-state diagnostics distinguishing missing local/remote version tags from tags that point to the wrong commit, plus a release-CI gate that rejects missing, pending, failed, pull-request-only, stale, or wrong-commit runs;
+- GitHub publication ownership: missing confirmation, non-TTY/background invocation, concurrent live owner, stale lock reclamation, and lock release after success/failure; remote tag/Release mutation remains outside ordinary automated tests;
 - generated Cloudflare Worker types under ignored `.wrangler/` state and strict TypeScript checking, including unused-local and unused-parameter rejection; packaging rejects generated declarations;
 - Conventional Commit title validation, shared Markdown escaping regression coverage, and generated MCP tool-reference drift detection;
+- phase-labelled local self-tests with scheduler-tolerant process/CLI success-path and convergence budgets, while explicit timeout/cancellation fixtures retain short deadlines, so failures identify the runtime, state, daemon takeover, CLI, service, shell, or Worker-source boundary;
 - direct tests for shared project-metadata reads, strict integer normalization, plain-record classification, and canonical profile/Worker/job/lock inventory;
 - recursive syntax validation for every JavaScript file under the shipped/runtime/test roots plus the shell wrapper;
 - shared tool-catalog schema, annotation, and profile-inventory checks;
-- default working-agreement injection without user files, bounded automatic project metadata, script-body non-disclosure, user-global opt-out, repository opt-out rejection, global `model_instructions_file` injection in stdio/remote initialization, hierarchical precedence, `.agents/skills` and `.codex/skills` compatibility discovery, live project/skill rescanning and fingerprints, automatic task ranking/loading with English inflection normalization, bounded Chinese/English intent aliases, capability-name weighting, and selected-skill instruction loading; automatic `package.*` commands with English/Chinese workflow-intent matching and Windows command-shim execution, explicit command override/removal, direct argv handling, timeout ceilings, runtime-keyed routing-telemetry privacy, and execution-profile denial;
+- default working-agreement injection without user files, bounded automatic project metadata, script-body non-disclosure, user-global opt-out, repository opt-out rejection, global `model_instructions_file` injection through explicit stdio/remote context calls, hierarchical precedence, `.agents/skills` and `.codex/skills` discovery, live project/skill rescanning and fingerprints, conditional static-context omission through `known_refresh_fingerprint`, automatic task ranking/loading with English inflection normalization, bounded Chinese/English intent aliases, capability-name weighting, and selected-skill instruction loading; automatic `package.*` commands with English/Chinese workflow-intent matching and Windows command-shim execution, explicit command override/removal, direct argv handling, timeout ceilings, bilingual set-level route regression across Bash, commands, sessions, jobs, files/Git, browser, applications, resources, and diagnostics, effective-role filtering of application/browser/shell metadata, route ambiguity/fallback bounds, runtime-keyed routing-telemetry privacy, and execution-profile denial;
 - concurrent complete-before-visible lock claims, atomic replacement under active readers, malformed-lock grace, snapshot/token-safe reclamation, absolute-age expiry, PID-reuse detection, bounded startup-lock waiting, and wall-clock rollback injection proving duration deadlines remain monotonic;
+- managed-job timeout-tree fixtures with an explicit descendant-PID readiness checkpoint before timeout and cleanup assertions, preventing scheduler delay from being misclassified as a missing cleanup target;
+- managed-job non-timing approval, resource validation/redaction, output, discard, and cleanup/recovery steps with a named 120-second success budget; the aggregate-output proof uses four steps with a 600-second observer, while the managed-job tree fixture uses a 180-second timeout and 150-second descendant-readiness window; timeout/tree-kill and cancellation remain independent semantic tests;
+- deterministic child-settlement coverage for delayed `exit`/`close` delivery, including POSIX zombie detection and recovery of the real exit code without weakening genuine timeout/tree-kill semantics;
+- ordinary managed-job terminal observation uses 480 seconds, exceeding the longest three-phase 3×120-second fixture plan plus startup margin without changing production timeout semantics;
+- managed-job CLI list/inspect/submit/read success and rejection fixtures with a distinct 120-second subprocess budget plus structured status/signal/error diagnostics; explicit job-step timeout and cancellation contracts remain independently short;
+- local-self managed-job CLI subprocesses explicitly clear `NODE_V8_COVERAGE`; the top-level local-self remains instrumented, while dedicated CLI-entrypoint and managed-job fixtures provide the gated module evidence without recursive profiler startup;
+- shell timeout-tree fixtures with a separate descendant-PID readiness checkpoint and a monotonic exit poll bounded by the production SIGTERM grace plus pre-escalation and final ownership-observation budgets, while a distinct 50 ms fixture preserves direct timeout classification coverage;
+- direct argv isolation success coverage with a named 30-second process budget, separate from short timeout fixtures, so scheduler delay cannot masquerade as shell interpretation or process-tracking failure;
+- maintenance-lock contention with an explicit child-ready checkpoint and parent-controlled release handshake, including pipe-close cleanup, rather than a short time-based holder that can expire before delayed assertions execute;
+- atomic exclusive-file creation with four simultaneously released Node processes, proving exactly one complete winner and only expected `EEXIST` losers without using a twelve-process cold-start stress test as a proxy for correctness;
 - foreground takeover of active and orphaned background daemons with current service-lock metadata, foreground-process protection, bounded final lock-handoff retry, actual-PID exit waiting, POSIX non-escalating timeout behavior, Windows verified-daemon stop semantics, daemon lock mode/version/process-start metadata, launchd service-target semantics, and silent idempotent duplicate service starts; daemon fixture subprocesses intentionally do not inherit V8 coverage because their purpose is ownership timing rather than code measurement;
-- fail-closed service lifecycle ordering for provider-stop, all-workspace daemon-stop, and definition removal, including platform/daemon/removal failure injection and normalized macOS/systemd/Windows results; Windows coverage reproduces an inline `/TR` command above 262 characters, proves the short launcher action remains bounded, verifies least-privilege logon registration, restart/log routing, language-independent `Ready`/`Running` observation, and state-observed stop/removal despite localized nonzero command output;
+- fail-closed service lifecycle ordering for provider-stop, all-workspace daemon-stop, and definition removal, including platform/daemon/removal failure injection and normalized macOS/systemd/Windows results; launchd coverage distinguishes exit 113 missing-service evidence from arbitrary nonzero `launchctl print` failure, rejects failed-query stdout as status evidence, and requires an inactive service to be unloaded from the launchd domain before stop/removal succeeds; systemd coverage keeps unrecognized, transitioning, maintenance, and installed-but-unknown provider states non-boolean so runtime/start/restart mutation cannot treat ambiguity as inactivity, while explicit inactive/failed and confirmed missing states remain actionable; CLI status coverage preserves that uncertainty as `effective_active: null` rather than coercing it to false; service-PATH coverage reproduces two nested npm run-script prefixes plus a stale prior candidate runtime and proves the current Node/runtime and inherited user tools remain while npm-private and inactive-runtime entries are removed; Windows coverage reproduces an inline `/TR` command above 262 characters, proves the short launcher action remains bounded, verifies least-privilege logon registration, restart/log routing, language-independent `Ready`/`Running` observation, and state-observed stop/removal despite localized nonzero command output;
+- release candidate runtime coverage that keeps local-candidate browser setup on one stable owner-only `release-channels/browser-extension` path, proves cross-version manifest-last publication, stale-file cleanup, source-symlink rejection, candidate-runtime-only path routing, and live-convergence → stable-extension publication → inactive-runtime prune → activation-evidence ordering;
+- full-verification receipt coverage that proves candidate preparation may reuse only a recent exact-generation full result, while source/version/runtime drift, malformed evidence, expiry, or a newly started full run invalidates reuse; architecture and critical coverage require the candidate path to consume this receipt instead of silently restoring a duplicate complete-suite invocation;
+- agent-context registered-command integration uses a test-private resource coordinator with a short bounded wait so unrelated machine-user heavy jobs cannot consume the full runner's entire per-task timeout; machine-global fairness, aging, and cross-process contention remain exercised in the dedicated resource-admission tests;
+- full-access diagnostics likewise isolate their process-execution coordinator from machine-user admission fairness, keeping the real filesystem/process/shell/environment/SSH/sudo/managed-job capability probes while preventing unrelated heavy jobs from turning that capability test into a five-minute wait;
+- capability tests that are not themselves resource-policy tests inject a healthy synthetic host sampler into their private coordinator. This keeps process/shell assertions deterministic even when the real Mac is under Red pressure, while resource-admission tests separately cover actual host sampling, Green/Yellow/Red decisions, wait fairness, and failure behavior;
 - private service-environment capture/load coverage for exact allowlisting, value bounds and control-character rejection, non-proxy secret exclusion, runtime-value precedence, Windows case-insensitive replacement, explicit empty-value clearing, and preservation across a later environment-free startup;
-- machine-level browser-broker ownership/client proxying, authenticated extension origin/subprotocol, non-cacheable local pairing, pairing-token non-disclosure, resource-backed upload routing, broker result redaction, pre-registered runtime-handshake listeners, bounded socket/HTTP waits, direct loopback health despite hostile environment-proxy settings, stop-during-start generation invalidation, frozen-wall-clock browser deadline coverage, installed-application discovery caching, and name-based task matching;
-- Worker health direct/proxy routing through a real local HTTP CONNECT proxy, `NO_PROXY` bypass, exact `workers.dev` origin/name validation, redirect rejection, body/deadline bounds, error classification, bounded propagation retry, and invalid proxy fail-fast behavior without endpoint or credential disclosure;
-- Worker deployment ambiguity/idempotency: a successful Wrangler result followed by health timeout persists the fingerprint, a second start performs no upload, an actual process restart and disk-state reload still performs no upload, definitive stale-version evidence redeploys under the same name, accidental name changes are rejected, forced replacements clear current endpoint state, and prior names remain in uninstall inventory;
+- machine-level browser-broker ownership/client proxying, role-separated one-time HMAC extension/runtime proofs, server-proof-before-WebSocket credential protection, internal-header-only challenge issuance, replay/expiry rejection, removed bearer authentication rejection, canonical extension origin, token-free public pairing, short-lived pairing grants verified again by the extension before persistence/repair, resource-backed upload routing, broker result redaction, pre-registered runtime-handshake listeners, bounded socket/HTTP waits, direct loopback health despite hostile environment-proxy settings, stop-during-start generation invalidation, frozen-wall-clock browser deadline coverage, installed-application discovery caching, per-root warning projection, capability-resolution degradation reporting, and name-based task matching;
+- Worker health direct/proxy routing through a real local HTTP CONNECT proxy, `NO_PROXY` bypass, exact `workers.dev` origin/name validation, redirect rejection, body/deadline bounds, error classification, an extended bounded post-deployment propagation window, and invalid proxy fail-fast behavior without endpoint or credential disclosure;
+- OAuth browser navigation with dedicated process-group cleanup, bounded TERM-to-KILL escalation, explicit local-server shutdown, profile removal retries, and primary-plus-cleanup error aggregation;
+- Worker deployment ambiguity/idempotency and v5 source identity: required source/config presence, bounded no-follow reads, symlink/hard-link/special-file rejection, length-framed file-count/path/byte hashing that distinguishes prior concatenation-collision cases; a successful Wrangler result followed by health timeout persists the fingerprint, a matching current-version fingerprint receives the full propagation budget and never uploads again without explicit `--force-worker`, an actual process restart and disk-state reload still performs no upload, definitive stale or unversioned evidence redeploys under the same name, accidental name changes are rejected, forced replacements clear current endpoint state, and prior names remain in uninstall inventory;
 - relay environment-proxy direct/bypass/agent selection, unsupported proxy rejection, fail-fast invalid configuration, and route observability without endpoint or credential disclosure;
 - canonical path and symbolic-link escape tests;
 - relative-path privacy and error-path redaction tests;
-- atomic create/update, optimistic hash, exact edit, and patch transaction tests;
+- atomic create/update, optimistic hash, exact edit, and patch transaction tests, including shared Windows/macOS resolved-path identity, Darwin case-alias collision rejection, no-overwrite patch target publication, late-target `EEXIST`, post-rename source-generation revalidation before update/move/delete settlement, reuse of that same quarantine/no-overwrite path by `edit_file` and `write_file` with `expected_sha256`, deterministic mutation injection inside the preflight-to-rename window, primary-plus-cleanup causal errors, committed-but-artifact-cleanup warnings, per-resolved-path mutation coordination that serializes same-file edits, allows unrelated files to proceed concurrently, reserves all paths of a multi-file transaction before waiting, and releases reservations only after callbacks settle;
+- `server_info` full/summary projection tests across local stdio and current Worker JSON calls; compact responses must preserve authority/readiness/capacity/deadline state, omit cold-path identity/OAuth/tool-list/observability fields, and remain materially smaller than the corresponding full fixture; the daemon-status projector separately covers connected/disconnected and summary/full readiness/liveness fields, while architecture caps `src/worker/index.ts` at 830 lines;
+- late-cancellation settlement tests: once a handler has entered work that cannot be safely interrupted and then returns success, the executor must preserve that success and record one completed outcome rather than retroactively reporting cancellation; relay-side owner cancellation remains independently responsible for suppressing unwanted delivery;
+- shared owner-state/exclusive-file fault injection: a callback failure combined with lock release/ownership failure must preserve the callback as the first `AggregateError` cause; exclusive creation must never delete an existing `EEXIST` target, pre-commit staging cleanup preserves primary-first causes, Worker-secret setup must remove a hidden secret-bearing staging artifact before deployment, and repository architecture also requires `engine-strict=true`, `save-exact=true`, and exact root dependency semvers;
+- lossless filesystem-identity tests distinguish adjacent device/inode values above `2^53`, reject unsafe Number metadata, reject the same device/inode with a different exact `ctimeNs` generation, verify descriptor/path mismatches fail closed, and bind secure reads, process/managed-job locks, owner-file removal, Worker-secret cleanup, audit cache identity, and SSH-key snapshots/staging-link publication to the shared BigInt identity boundary; Worker-secret tests separately prove the identity snapshot is refreshed after the intentional chmod before callback/cleanup;
+- managed-job directory boundary tests require POSIX directory pinning to use `O_NOFOLLOW | O_DIRECTORY` with an explicit private `0o700` mode argument, while descriptor/path/canonical device+inode identity remains stable across legitimate child-entry ctime changes;
 - patch ambiguity, canonical collision, rollback, move, and delete tests;
 - UTF-8 and binary handling;
 - image content formatting;
-- nested Git repository detection and helper suppression;
+- nested Git repository detection plus authority-first Git metadata discovery: `.git` directories, bounded no-follow gitdir/commondir pointers, object stores, recursive alternates, refs/logs/info/index metadata, and restricted-principal metadata-tree descendants are checked before any Git subprocess starts; real linked-worktree, external-alternate, and descendant-link fixtures prove that confined structured Git fails before process launch;
+- explicit effective-policy versus daemon-ceiling fields in local/remote `project_overview`, with its Git root supplied by the same `GitService` discovery boundary as status/diff/log/show rather than a second raw Git probe, plus compatibility fallback for older daemon snapshots;
+- `project_overview` default/full compatibility plus compact local, ordinary Worker, and durable-replay projection: remote summary must request full daemon state, apply account authority before projection, omit account IDs/exact tool arrays/routing fingerprints/top-level paths and sizes, preserve policy/count/route/name/type semantics, and stay within absolute and high-cardinality growth budgets;
+- bounded `list_dir` metadata and `search_text` file-I/O fan-out: peak concurrency is capped at 16, settled results are consumed in source order, `max_files`/`max_matches` accounting matches the serial algorithm, cancellation is observed around prefetched work, and errors after an already-satisfied stop cannot leak into the result while consumed errors remain exact;
+- fixed internal command execution with validated argv, no shell, isolated HOME/temp/cache, bounded output/deadlines, and ordinary cancellation/process tracking while arbitrary delegated process tools remain sandbox-gated; implementation-owned environment overrides are exact-value allowlisted and reject loader/startup variables or altered Git safety toggles before spawn;
 - author-email privacy in `git_log`;
 - isolated command HOME/temp/cache behavior;
-- one-shot timeout, descendant process-group/tree termination including descendants that ignore graceful shutdown after the direct child has already exited, cancellation, and process-session interaction;
-- layered fixed runtime diagnostics for filesystem, direct process, shell, managed-job storage, and resource availability; machine-readable execution guardrails that must keep CPU, memory, and network isolation marked unenforced unless an actual OS boundary is added;
-- local resource CLI registration, permission checks, dynamic reload, state-path redaction, and content non-disclosure;
+- one-shot timeout, descendant process-group/tree termination including descendants that ignore graceful shutdown after the direct child has already exited, post-`SIGTERM` ownership refresh, one shared monotonic budget across full and targeted ownership probes, observation deadlines derived from the exported graceful-termination and ownership-budget constants with bounded scheduling margin, a real uncooperative-child regression proving hard `spawnSync` timeout termination, synchronous smoke/self-test timeout hard termination, targeted PID identity fallback when full process-table inspection is unavailable, empty-snapshot fail-closed behavior, exact start-time/PID-reuse denial, deterministic `close`/post-`exit` fallback races, child-`error`-before-`close` fault injection proving tracker/resource ownership is retained until real lifecycle settlement, the same error-before-close contract for internal fixed executables, managed-job terminal persistence and runner exit, repeated leak checks, cancellation, and process-session interaction;
+- layered fixed runtime diagnostics for filesystem, direct process, shell, managed-job storage, and resource availability, with a separate bounded 30-second process/shell health budget rather than reuse of user-command or short timeout-test deadlines; machine-readable execution guardrails that must keep CPU, memory, and network isolation marked unenforced unless an actual OS boundary is added;
+- bounded structured Git behavior: real repositories prove staged-only commit semantics, hook/signing suppression, stdin message isolation, empty-index/UTF-8 bounds, refusal of in-progress merge/rebase/cherry-pick/revert/bisect/sequencer state before staged-tree plumbing, compare-and-swap refusal after a concurrent ref update, acceptance of Git-valid uncommon refs, literal treatment of path names that resemble pathspec magic, strict log framing before optional author-email projection, rejection of config include/filter/order-file/partial-clone expansion, and metadata-root authorization before mutation; ordinary status/diff/log/show retain bounded deadlines after the same filesystem-first discovery;
+- local resource CLI registration, permission checks, dynamic reload, state-path redaction, content non-disclosure, and the extracted runtime-resource boundary for bounded binary/UTF-8 reads plus generation authorization;
 - real Ed25519 and RSA generation, idempotent reuse, public/private correspondence, mode enforcement, incomplete/mismatched/symlink rejection, and private-content non-disclosure;
 - real-machine canonical-full sandbox acceptance for outside-workspace I/O, direct/shell execution, full environment inheritance, SSH prerequisites, temporary authorized-key writing, and detached cleanup without external state changes;
 - deterministic injected atomic-replace failures, sustained transient Windows sharing contention beyond the old retry budget, bounded exponential delay selection, and repeated Windows full-sandbox runs;
 - canonical named-profile repair and full-only tool exposure parity between local and Worker policy filters;
-- managed-job staging/local approval/cancel-before-start, detachment, job-scoped temporary files, resource hash verification/redaction, discard capture, finally execution, descendant-tree escalation, token/snapshot-safe transition locks, runner process identity, spawn-without-PID rejection, asynchronous runner-error observability, plan scrubbing, PID-reuse-safe dead-runner recovery, and rejection of numeric-only runner records;
-- daemon/startup locking, successfully-read corrupt-JSON recovery, and explicit propagation/preservation of oversized, symbolic-link, permission, and I/O failures;
-- guarded state-root removal, unsafe state-root/workspace overlap rejection before creation, all-profile lock/daemon scanning, strict current-schema validation, corrupt-JSON isolation, and policy-origin persistence;
+- managed-job non-executing staging, rejection of the removed terminal promotion path, cancel-before-start, trusted direct start, detachment, job-scoped temporary files, resource hash verification/redaction, discard capture, finally execution, descendant-tree escalation, token/snapshot-safe transition locks, runner process identity, spawn-without-PID rejection, asynchronous runner-error observability, child-error ownership retained until close/exit settlement, fatal-runner refusal to overwrite unreadable state or act before confirming its runner claim, recovery-bootstrap refusal to write terminal evidence until recovery-lock handoff succeeds, plan scrubbing, PID-reuse-safe dead-runner recovery, and rejection of numeric-only runner records; a wrong-type recovery-lock fixture proves bootstrap failure leaves `interrupted` status/plan intact with no terminal result, while the runner's 30-second handoff budget prevents scheduler delay from being misclassified as permanent recovery failure; staged-expiry regressions additionally prove that a held transition lock defers expiry, expiry uses the shared result-first terminal contract, an unpersisted result remains diagnosable through status without a second failing result read, an eight-day abandoned draft begins seven-day terminal retention from its actual expiry `finished_at`, and terminal cleanup never removes transition/recovery lock files by pathname; a runner-current fixture writes a terminal result ahead of terminal status and requires `read_job` to return one coherent terminal projection rather than mixing active and terminal generations; idempotent replay separately proves result-first terminal evidence is reconciled before any queued-runner relaunch and that only a real missing status is treated as absence; targeted authority-revocation tests require any durable-job cancellation conflict to block acknowledgement until a later retry succeeds, prove that every local execution category is still attempted when a process-session revocation fails, and prove that internal safety cancellation still works after the daemon policy narrows enough to deny the public `cancel_job` tool;
+- daemon/startup, owner-state, managed-job transition/recovery, and runner-owner locking: successfully read corrupt JSON follows only its bounded malformed/stale policy, while oversized, symbolic-link, permission, I/O, descriptor, and identity failures propagate and preserve the existing lock/job state;
+- guarded state-root removal, unsafe state-root/workspace overlap rejection before creation, all-profile lock/daemon/job scanning with only `ENOENT` treated as absence, rejection of symbolic-link profile/job inventory roots plus unknown/wrong-type children of the reserved `profiles/` namespace, strict current-schema validation, corrupt-JSON isolation, and policy-origin persistence; current-CLI containment canonicalizes both the state root and entrypoint through one path family, with a platform-independent `node:path.win32` fixture proving that ordinary `D:\\...` versus extended/native `\\\\?\\D:\\...` roots do not constitute valid containment evidence until both operands use the same namespace; the dedicated `state-root-retirement:test` proves exact-generation rename/revalidate/delete, POSIX descriptor-pinned protection against remove/recreate inode ABA across quarantine rename, a second descriptor-identity check after full moved-root verification that preserves a replacement installed during that traversal, crash-residue recovery, replacement-generation preservation, verification-failure quarantine retention and later safe recovery, malformed/wrong-type/mismatched reserved residue retention, and symbolic-link `profiles/` refusal;
 - no filename-based sensitive-file denial under unrestricted policy;
-- log redaction, control-character handling, message/field bounds, suppression of both successful and failed per-tool events outside debug, service warning-level configuration, current-schema reset, and bounded tail trimming;
-- deterministic relay connection lifecycle coverage for transport construction/error/deadline, pre-handshake `welcome` validation, separate `hello_ack` authentication and `ready_ack` end-to-end readiness, session-bound probe return, pre-ready tool rejection, premature-ready rejection, identity/version mismatch, retryable Worker hello/readiness errors, fatal protocol errors, autonomous outage-reminder backoff, handshake/readiness/heartbeat timeout, brief-outage suppression, sustained-outage escalation, recovery summaries, and supersession;
-- shared no-follow bounded-file reads for normal files, over-limit data, directories, and symbolic links;
+- shared local/Worker free-form log redaction, sensitive content under non-sensitive Worker keys, null-prototype structured-field projection that preserves `__proto__`/`constructor` as ordinary sanitized data, immutable local/Worker structured metadata, control-character handling, message/field bounds, suppression of both successful and failed per-tool events outside debug, bounded Worker route-class error logging, routine deployment endpoint/name omission, service warning-level configuration, JSON-mode parity across event and direct logger methods with timestamp/stream/redaction assertions, current-schema reset, bounded tail trimming, and preservation of both daemon logs when an existing schema marker cannot be read safely;
+- deterministic relay connection lifecycle coverage for transport construction/error/deadline, failed `hello` delivery, pre-handshake `welcome` validation, separate `hello_ack` authentication and `ready_ack` end-to-end readiness, session-bound probe return and probe-delivery races, pre-ready tool rejection, premature-ready rejection, identity/version mismatch, retryable Worker hello/readiness/transport/liveness errors, retryable close-only transport/liveness delivery, preservation of a specific timeout classification when a late generic error arrives, fatal unknown protocol errors, autonomous outage-reminder backoff, handshake/readiness deadlines, a five-second protocol-level transport probe, fresh protocol Pong survival, ten-second inbound-silence termination with a fifteen-second probe-plus-timeout detection upper bound while the daemon is scheduling-responsive, preservation of the separate twenty-five-second application heartbeat and seventy-five-second application-silence timeout even while protocol Pong remains healthy, short-stall recovery grace, preservation of fresh inbound traffic immediately after a long local pause, stale-socket reconnect only when that long pause is followed by continued transport silence, brief-outage suppression, sustained-outage escalation, recovery summaries including pre-close inbound-silence evidence, supersession, and explicit stop-before-first-readiness settlement so the initial `start()` Promise cannot remain pending after shutdown;
+- shared no-follow bounded-file reads plus present-path inspection where only `ENOENT` means absence for security/persistence evidence; EIO/EACCES injection covers pairing, service environment, service owner, global config, activation/soak records, and conformance checkout state. Optional project metadata separately proves BigInt path/descriptor identity mismatch rejects before reading bytes, descriptor cleanup, bounded byte-limit validation, and conservative omission of unsupported discovery data. Normal files, over-limit data, directories, symbolic links, and multiple-hard-link denial remain covered; typed file-mutation regressions cover create-only collisions, stale SHA-256 preconditions, missing/ambiguous edit text, malformed/stale patches, transactional rollback, Worker preservation, stdio projection, and path/content/hash non-disclosure;
 - owner-only directory enforcement rejecting final symlinks, failing closed on POSIX chmod errors, verifying `0700`, and retaining Windows portability; Worker temporary-secret lifecycle coverage for process-start-bound names, valid stale-owner reclamation, ambiguous-owner retention, `0600` mode, deletion failures, and simultaneous deployment/cleanup failures;
 - SARIF security-gate behavior for unknown findings, exact accepted rule/path matches, path mismatch rejection, rationale quality, and exception expiry;
-- deterministic property tests over hostile browser-protocol byte strings, canonical/custom policy combinations, argv bounds/NULs, and a real direct process proving shell metacharacters remain literal argv;
+- deterministic property tests over hostile browser-protocol byte strings, canonical/custom policy combinations, argv bounds/NULs, and a real direct process proving shell metacharacters remain literal argv; timeout-alignment tests prove remote process tools require a caller-held `idempotency_key`, reserve only a 10-second durable-acceptance budget plus the separate Worker settlement margin, and keep their detached one-step execution budget independently capped at 600 seconds. Cached schemas that omit the new recovery key fail as normal no-side-effect tool results with refresh guidance, while over-limit and malformed durable timeouts still fail before dispatch. Worker pending-call regressions also reject non-finite, non-positive, non-integer, and over-contract operation/reconnect delays before timer/alarm state mutates; local relay-envelope tests reject malformed call IDs, tool-name shapes, authorization field types, missing/string/negative timeouts, and over-contract timeouts instead of coercing them. Ordinary daemon tools default to 20 seconds plus the separate Worker settlement margin, ordinary configurable browser/application tools default to 20 seconds, compound `computer_observe`/`computer_act` default to 30 seconds, all configurable browser/application tools remain explicitly capped at 45 seconds, relay-origin `start_process` has a 10-second execution budget, `read_process` remote polls are capped at five seconds, detached/rebound calls cannot extend their original absolute deadline, and owner-local registered commands retain their local manifest budget. Computer Use regressions additionally prove that application observation consumes one end-to-end screenshot/Accessibility/window-revalidation deadline and that action preflight/dispatch/verification/post-observation consume one action deadline without reclassifying a deadline exhaustion as stale/unavailable. Runtime infrastructure regressions prove the macOS remote-activity idle-sleep guard uses fixed non-shell `/usr/bin/caffeinate -i -w <daemon-pid>`, renews one bounded timer without duplicate children, releases after inactivity, and remains disabled off macOS. Runtime self-tests additionally prove the daemon independently rejects relay durable execution without the recovery credential, remote process acceptance returns a recoverable `job_id`, the job outlives the completed MCP call, the Worker's 600-second durable execution field survives the daemon's narrower local foreground-schema defense without widening local request-scoped calls, operator execution preserves the delegated workspace sandbox without gaining owner-only `start_job`, and durable results are retrievable through `read_job`. Worker integration deliberately withholds one daemon acceptance result until the settlement deadline, verifies the Worker sends cancellation for that transient call, and then proves the MCP error still carries the original `idempotency_key` plus the exact same-key replay action instead of losing recovery context; process-tree tests also assert Darwin uses a target-PGID `ps` query, preserve the global inspection budget, and repeatedly prove anti-`SIGTERM` descendants exit after foreground timeout;
+- service/activation recovery tests prove an ambiguous launchd `bootout` against an initially active service preserves `restore_required` even when unload cannot be verified, and persistent activation retries previous-provider start/bootstrap until the exact prior service runtime is verified ready instead of abandoning recovery after one transient start failure. Candidate installation now also proves owner state remains pending through service start and exact daemon/Worker verification, commit occurs only after convergence, a recovered start commits only after recovery convergence, owner-commit failure stops the verified provider, and repeated convergence failure stops an uncommitted active candidate. The activation regression preserves the original `autostart_stop_failed` error after successful rollback and aggregates primary plus rollback failures when recovery cannot converge;
 - prototype-shaped command, action, role, profile, form-field, keyboard, and resource names proving that inherited object properties are never interpreted as dispatch or authority; current-schema malformed OAuth roles are repaired to disabled reviewer accounts with credential revocation;
 - canonical Worker deployment URL extraction proving unrelated `/mcp`, `/healthz`, path-bearing, and wrong-name URLs cannot be persisted as upload evidence;
 - byte-exact UTF-8 DOM-source truncation across emoji and Chinese partial-code-point boundaries, including equality between the reported byte count and the encoded returned source;
-- independently injected service CLI status/install/start/stop/uninstall/remove paths, including provider failure, no selected workspace, no deployed Worker, aliases, and default output/exit adapters;
+- independently injected service CLI status/install/start/stop/restart/uninstall/remove paths, including provider failure, no selected workspace, no deployed Worker, aliases, default output/exit adapters, active restart provider invocation, old-PID rejection, replacement-readiness evidence, machine-service serialization of delayed automatic autostart installation, identity-bound launchd/systemd definition removal, and Windows launcher cleanup that preserves a replacement or a definition that appeared after an initially absent snapshot;
 - CLI parsing, policy profiles, and client configuration boundaries;
-- live stdio MCP initialization with session instructions, capability resolution, discovery, calls, rich content, sessions, cancellation, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
-- P-256 daemon identity generation, signed WebSocket preflight, one-time transactional nonce consumption, challenge transcript binding, wrong-key/tamper/expiry/replay rejection, and prevention of unauthenticated candidate churn;
-- local operation-risk classification and catalog-wide review coverage; authenticated-owner direct execution; account/client-bound compound capability leases for delegated accounts; ordinary workspace automation; external-sensitive path composition; sensitive/persistence writes; symbolic-link ancestor and patch-move destination canonicalization; browser-session/application-control plus data-export composition; process/job continuation; scoped/full approval; cross-process daemon/CLI mutation serialization; expiry/revocation; owner-only persistence; and malformed-record rejection;
-- signed account-administration requests with origin/method/path/body/time/nonce binding, transactional one-time nonce consumption, legacy bearer rejection, nonce replay rejection, and malformed nonce-state fail-closed behavior;
-- live local Worker OAuth registration, the unauthenticated `resource_metadata` challenge, protected-resource and authorization-server discovery, Streamable transport metadata, consent, URL-constructed `303` callbacks including the ChatGPT and hosted Claude redirect URIs with encoded state, PKCE, `offline_access`, form-encoded authorization-code and refresh-token exchanges, fifteen-minute access tokens, refresh-family idle/absolute limits, bounded consumed-token/revoked-family replay state, record-level schema validation, access/refresh rotation, stale refresh replay rejection with whole-family access/refresh revocation, account-version refresh revocation, authorization-code replay rejection, pending-registration throttling that excludes already authorized DCR clients, exact built-in ChatGPT/Grok browser origins, additive custom origins, unrelated-origin preflight rejection, no CORS response sharing for unrelated or opaque origins, opaque-origin authorization-form routing, exact per-request redirect-origin CSP with narrowly scoped Microsoft regional-consent and final Copilot Studio handoff exceptions, accessible credential-error rendering, protocol negotiation, HMAC-bound MCP session issuance, two-session same-id concurrency, sessionless same-id independence, session-scoped cancellation isolation, same-session duplicate rejection, daemon-backed session bootstrap, dynamic tool advertisement, rich content, candidate/probing/ready transitions, invalid readiness-result rejection, incumbent preservation until verified handover, daemon replacement, cancellation, malformed daemon JSON/non-object rejection, duplicate hello rejection, and unknown-message closure. The metadata/refresh contract is the path used by Claude DCR and Copilot Studio Dynamic discovery. The same integration runs an `editor` account against a canonical `full` daemon and proves that `server_info` and remote `project_overview` report effective `edit` authority while retaining the full daemon ceiling only in explicitly scoped fields.
+- installed-package zero-argument startup with an isolated HOME/state/workspace and a service-manager trap, proving the smoke test reaches the controlled Wrangler boundary without querying, stopping, or replacing the operator's machine-global launchd/systemd/Scheduled Task service;
+- live stdio MCP `2026-07-28` per-request metadata, static discovery, explicit `session_bootstrap`/capability resolution, calls, rich content, request cancellation, removed-`initialize` upgrade guidance, managed-job acceptance, and a detached job/finally phase that survives stdio shutdown;
+- P-256 root generation, root-certified ephemeral session issuance, macOS trust-broker source/binary cache binding, owner-only/single-link reuse, tamper-triggered rebuild and signature checks, signed WebSocket preflight, one-time transactional nonce consumption, challenge transcript binding, wrong-root/session/tamper/expiry/replay rejection, and prevention of unauthenticated candidate churn;
+- request-scoped effective authority and catalog-wide risk review; non-escalatable reviewer/editor/operator ceilings; authenticated-owner direct execution; control-plane root denial; external and sensitive path composition; persistence-target rejection; symbolic-link ancestor and patch-move canonicalization; owner-only browser/application/data-export and persistent-plan effects; account/client/refresh-family ownership of processes, output sessions, and jobs; delegated sandbox fail-closed behavior; previous-format lease non-consumption; and malformed-record rejection;
+- root-certified ephemeral P-256 account-administration requests with origin/method/path/body/key/time/nonce binding, transactional one-time nonce consumption, removal of the long-lived administration secret, certificate/signature/body tamper rejection, nonce replay rejection, malformed nonce-state fail-closed behavior, one-megabyte response bounds, immediate oversized-response cancellation, and strict successful JSON-object validation;
+- live local Worker OAuth registration and authorization metadata; PKCE, DCR, refresh rotation/replay, account/client/family revocation, DPoP, actual `/mcp` Origin checks, bounded CORS/CSP, exact callback handling, and bounded OAuth persistence; native MCP `2026-07-28` per-request `_meta`, open-JSON structural budgets, bounded `subscriptions/listen` validation plus an empty-supported-set acknowledgement/correlated graceful completion when the server advertises no change notifications, strict dual-media `Accept` quality values, mirrored header/body validation, `server/discover`, result identity, cache hints, same-token/same-request-ID concurrency, role-hidden/unknown/schema `-32602` non-dispatch, credential-free private cancellation (including public-header forgery and DPoP replay controls), and request-scoped streaming. The same integration separately covers remote-HTTP stateless initialization compatibility for `2025-06-18` and `2025-11-25`: bounded `initialize`, `notifications/initialized`, `ping`, `tools/list`, and `tools/call` only, current-controller tool dispatch, rejection of `Mcp-Session-Id`, no replay/session persistence, and rejection of all other removed methods. It also covers hosted timeout projection (20-second ordinary default plus five-second settlement, 20-second configurable foreground default with a 45-second explicit maximum, 10-second process-session startup, 10-second durable-process acceptance, 600-second durable execution maximum, and five-second process poll), maximum-only stale-schema compatibility for both `timeout_seconds` and `read_process.wait_ms`, same-daemon transient call rebinding without extending the original operation deadline, layered global/subject rate-limit identity, daemon candidate/probing/ready replacement, malformed daemon messages, rich content, account-role projection, and stable catalog behavior before/during/after daemon availability.
 - local runtime proof that one blocked tool handler does not serialize an independent handler, plus relay fault injection proving an undeliverable terminal result interrupts the ambiguous socket and enters reconnect backoff.
-- a real headless-Chrome OAuth navigation regression with four cases: `form-action 'self'` blocks the first cross-origin callback, allowing only the registered callback blocks the regional redirect, allowing the registered and regional callbacks blocks the final Copilot Studio redirect, and the complete policy preserves `code` and `state` through all three cross-origin hops. Linux CI fails if Chrome is unavailable; other environments skip only this browser executable check while retaining the Worker CSP assertions.
+- a real headless-Chrome OAuth navigation regression with bounded browser startup, DevTools discovery, WebSocket connection, and per-command deadlines, covering four cases: `form-action 'self'` blocks the first cross-origin callback, allowing only the registered callback blocks the regional redirect, allowing the registered and regional callbacks blocks the final Copilot Studio redirect, and the complete policy preserves `code` and `state` through all three cross-origin hops. Linux CI fails if Chrome is unavailable; other environments skip only this browser executable check while retaining the Worker CSP assertions.
+
+`npm run ssh-key:test` exercises Ed25519/RSA generation, private-file permissions, public/private matching, validation-before-permission-normalization for invalid/mismatched existing pairs, symbolic-link denial, generation-bound descriptor chmod, no-replace hard-link installation, source-cleanup failure compensation, target replacement after link, partial pair installation, fresh state reload after the startup lock, registry conflicts/capacity, identity-bound two-file rollback after state-write failure, replacement preservation, and primary-before-cleanup failure causality. Private key bytes and internal rollback identities must never appear in the public result.
 
 ## Opt-in live desktop and browser validation
 
-The normal suite uses deterministic mocks for macOS Accessibility and an authenticated in-process extension peer for browser routing. Browser contract tests cover acknowledged protocol readiness, provisional pairing commit/rollback boundaries, strict extension IDs and matching loopback ports, stale-extension rejection, compatible replacement without premature displacement, clean rejection of in-flight direct and proxied requests, keepalive handling, trusted-input replay prevention after partial dispatch, focus-safe screenshots, aggregate 64-frame/source/element budgets, bounded hostile DOM/text processing, contenteditable-secret suppression, partial-form failure reporting, stable refs, combined waits, and actionability failures. Before a release that changes local UI automation, run the macOS live smoke test on a machine where the invoking Node/terminal process has Accessibility permission:
+The normal suite uses deterministic mocks for macOS Accessibility and an authenticated in-process extension peer for browser routing. Browser contract tests cover acknowledged protocol readiness, provisional pairing commit/rollback boundaries, strict extension IDs and matching loopback ports, stale-extension rejection, compatible replacement without premature displacement, clean rejection of in-flight direct and proxied requests, keepalive handling, trusted-input replay prevention after partial dispatch, transport-send and malformed-response mutation uncertainty, fixed non-sensitive fallback reasons, privacy-safe public browser errors, an independent extension-side 32-operation ceiling, focus-safe screenshots, aggregate 64-frame/source/element budgets, bounded hostile DOM/text processing, contenteditable-secret suppression, partial-form failure reporting, stable refs, combined waits, and actionability failures. Computer Use tests additionally cover snapshot publication/one-shot consumption, 64-entry capacity, monotonic TTL/clock rollback, browser document/frame/semantic identity, screenshot-bound point/drag/scroll dispatch, application process-generation and owner-window identity, monotonic exact-value retention, structured unknown settlement, continuation/retry guidance, post-effect verification, cancellation boundaries, and result-budget compaction. The cheap DevTools input/observation, browser Computer Use, service-worker, and application-automation fixtures are part of the fast plan rather than waiting for full/platform verification. DevTools session coverage also forces a debugger command promise to never settle, requires the bounded command deadline to detach and release the same-tab queue for a subsequent observation, and separately proves a timed-out trusted Input command remains post-dispatch and non-fallback-safe rather than becoming replay authority. A synthetic 6 MiB application PNG proves the image is omitted before snapshot publication when base64/MCP framing would exceed the 7 MiB result boundary, while the semantic snapshot remains usable and pixel authority is revoked. `process-nonreplayable:test` separately proves fixed local UI helpers retain definite pre-spawn failures with a fixed public message that cannot echo a lower-layer exception, and become non-retryable unknown outcomes after process start. Before a release that changes local UI automation, run the macOS live smoke test on a machine where the invoking Node/terminal process has Accessibility permission:
 
 ```sh
 npm run app-automation:live-test
@@ -87,16 +145,39 @@ npm run app-automation:live-test
 
 It opens Calculator, activates it through the fixed JXA helper, verifies structured JSON output, inspects main-window Accessibility controls with menu recursion disabled, clicks the `One` control, and quits the application. It is intentionally excluded from CI because macOS TCC permission and a graphical login session are host state.
 
+The deterministic `macos-background-input:test` forces the macOS helper state machine on every CI host so payload validation, mutation settlement, probe caching, and helper-result projection stay cross-platform. Its exact compile-once cache-reuse assertion is POSIX/macOS-only because the production cache trust predicate requires POSIX executable mode bits; Windows cannot supply that permission evidence through `chmod`, so the Windows fixture must not reinterpret a synthetic cache file as a trusted macOS executable.
+
+Changes to the experimental snapshot-bound native macOS input path have a stronger opt-in fixture. It compiles a temporary owner-local AppKit application, proves that the fixture never becomes frontmost, then exercises Computer Use Accessibility state, exact private value readback, PID-scoped Unicode/special-key input, semantic focus, raw visual click, exact-once double-click/drag, and native scroll with visual effect confirmation. The command refuses to run unless both the explicit flag and experimental backend setting are present:
+
+```sh
+MBM_MACOS_BACKGROUND_VISUAL_BACKEND=skylight-experimental npm run macos-background-input:smoke -- --run
+```
+
+This smoke is intentionally absent from automatic CI and release preparation because it depends on a graphical macOS session plus Accessibility, Automation, Screen Recording, and private WindowServer/SkyLight availability. A failed probe must degrade to Accessibility/screenshot observation rather than silently enabling pixel input.
+
 For deterministic release validation, perform an isolated-profile smoke test with the packaged unpacked extension; a Playwright persistent Chromium context is acceptable only as that isolated harness. When the requirement is specifically to prove control of the user's ordinary browser, the user must load the same unpacked directory into that known daily Chromium profile; status can verify the extension version/protocol and that Machine Bridge did not launch a browser, but cannot infer profile identity. Then use a localhost no-store fixture in a newly created tab. Do not enumerate, read, or mutate unrelated existing tabs. In both modes, inspect and reuse refs, exercise waits/forms/trusted input/open Shadow DOM/screenshots, verify final live DOM, and close the fixture tab.
 
 
+`npm run control-plane-resilience:test` is the focused accident-regression gate. It exercises synchronous/asynchronous audit failures, cached-state invalidation after external alteration, count- and byte-bounded retention anchoring, POSIX/Windows process-tree fallbacks, escalation-supervisor exception isolation, mixed transient/durable Worker capacity, and the shared 30+2 / 14+2 control-plane admission contract. `npm run security-audit:test` additionally runs two independent audit workers against one owner-only state file and requires continuous sequence numbers with no lost events, covering the lock release/acquire race. Both are part of the fast plan rather than coverage-only evidence.
+
+- control-plane resilience under host pressure: local event-loop stalls versus genuine relay silence, fresh-heartbeat recovery grace, asynchronous process-group identity capture before `SIGTERM`, bounded post-signal revalidation, draining-process visibility after result settlement, two reserved diagnostic slots at both Worker and local layers under mixed transient/durable ordinary-call saturation, non-blocking audit dispatch, batched Worker persistence, queue/drop health, warning suppression, and privacy-safe audit projection;
+- relay outage diagnostics and recovery: application-proxy versus OS-network scope, timestamped close/outage/recovery fields, bounded authenticated hello projection and recovered ready-state semantics in `server_info.daemon.relay_transport`, fifteen-second maximum reconnect delay, the distinct five-second probe / ten-second transport-silence watchdog versus twenty-five-second heartbeat / seventy-five-second application watchdog, an executable invariant that the full fifteen-second probe-plus-timeout detection horizon for a scheduling-responsive daemon remains below the ordinary twenty-second hosted execution default, same-instance `resume_calls_ack.missing_ids` settlement that marks only daemon-proven non-delivery as retryable with `side_effects_started=false` while preserving active/unacknowledged ownership without replay, socket-generation-bound authentication proofs, specificity-preserving close causes including `relay_transport_timeout`, same-instance call continuation, structured aggregate `relay.calls.reconnect_expired` loss diagnostics, idempotent Worker cleanup across `error` plus `close`, scheduling-free candidate/readiness/liveness invalidation, post-detach deadline recomputation, concurrent cleanup deduplication plus failure retry, previous-ready-duration and `previous_ready_inbound_silence_ms` retention, retained asynchronous stale-socket cleanup with rejection containment, Worker application-heartbeat pong-before-alarm ordering, one explicit terminal-result alarm schedule, future-alarm suppression of durable prefix scans, missing/overdue-alarm recovery sweeps, transaction-scoped durable-call alarm coverage, event-time alarm write/read failure isolation, pong/welcome send failure, and `diagnose_runtime` relay history;
+- recoverable managed-job terminal commits under injected result/status/delete/confirmation failures, result-only terminal reconstruction, private runtime/plan scrubbing, 24-hour staged-plan expiry, and minimal/full runner-environment inheritance;
+- cross-process security-audit serialization, continuous hash-chain sequence, uninstall blocking for audit/authorization/job transition/recovery locks, workspace recovery-envelope validation, and symlink/multiple-hard-link rejection at owner state and operational logs;
+- browser fixed identity, role-separated credentials, one-way previous-state migration, socket replacement/reconnect/timer cleanup, duplicate request rejection, response-delivery failure, and read-only broker load projection;
+
 ## Critical-module coverage gate
 
-`npm run coverage:test` runs selected in-process and lightweight entrypoint fixtures under V8 coverage and enforces per-module function and branch baselines. The measured set includes policy, typed errors, call registration, execution middleware, lifecycle/observability, logging, Runtime/CLI orchestration, state persistence, relay lifecycle, managed-job lifecycle/runner/storage/projection, browser broker/direct-request/runtime-client routing and loopback upgrade handling, the independently injected service CLI adapter, Agent configuration/projection/skill discovery and bounded text reads, capability ranking, runtime path redaction, browser protocol/operation boundaries, runtime reporting/diagnostics/capability composition, and Worker OAuth state/authorization-page/pending/policy/error/JSON-RPC/WebSocket protocol modules. The full stdio and workerd OAuth/MCP integration still runs separately.
+Fast/security regressions also cover the exclusive-file publication window: the shared retry helper must settle a synthetic three-attempt `MBM_MULTIPLE_HARD_LINKS` transient on the fourth attempt and must throw a persistent condition on the fourth attempt; owner/process/managed-job/pairing/runner-claim architecture checks bind the only allowed consumers. Managed-job runner claims have a direct multiply-linked ownership rejection fixture.
 
-The gate deliberately reports each module rather than one aggregate percentage. New extracted pure/domain modules carry explicit branch floors, while the broad CLI entrypoint remains reported and locked independently. Worker pending calls and policy now have branch minima instead of function-only gates. A refactor may raise a threshold, but must not lower one merely to make CI green without an explicit audit explanation.
+`npm run coverage:test` runs selected in-process and lightweight entrypoint fixtures under V8 coverage and enforces per-module function and branch baselines. Secure-file identity-bound chmod/removal, SSH-key ownership transactions, service-definition snapshot/removal, managed-job whole-directory retirement, generation-bound state-root retirement, canonical recovered-activation evidence, the Computer Use kernel/observation/application-observation/recovery/snapshot store/result-budget path, browser Computer Use observation, macOS background input, browser post-dispatch settlement, and non-replayable fixed-process settlement are explicitly gated critical modules. The measured set includes policy, typed errors, call registration, bounded child-process settlement, execution middleware, lifecycle/observability, logging, Runtime/CLI orchestration, persistent candidate activation, state persistence, relay lifecycle, managed-job lifecycle/runner/storage/projection, browser broker/direct-request/runtime-client routing and loopback upgrade handling, the independently injected service CLI adapter, Agent configuration/projection/skill discovery and bounded text reads, capability ranking, runtime path redaction, browser protocol/operation boundaries, Computer Use snapshot/result settlement, runtime reporting/diagnostics/control-plane projection/capability composition, shared release-evidence and Worker/local call-capacity algebra, relay-heartbeat/process-tree/audit isolation, and Worker OAuth state/authorization-page/pending/policy/error/JSON-RPC/WebSocket protocol modules. The full stdio and workerd OAuth/MCP integration still runs separately.
 
-`npm run typecheck` combines strict Worker TypeScript with a focused `tsconfig.local.json` gate. High-risk JavaScript contracts opt in with `// @ts-check` and JSDoc types; the gate currently covers policy, call lifecycle, Agent configuration/path resolution, public projection, skill discovery, bounded Agent text reads, runtime path redaction, browser handshake parsing, capability ranking, monotonic deadlines, number/record normalization, and bounded metadata reads. `@ts-ignore`, implicit `any`, or unchecked parallel contract shapes are not accepted as migration shortcuts.
+Coverage belongs to the selected top-level fixtures. Concurrency, process-identity, and daemon-takeover helpers explicitly set `NODE_V8_COVERAGE` to an empty value: Node reinjects the parent coverage directory when the variable is merely deleted, which would start a profiler in every helper and distort both runtime and host load without improving the gated module evidence. Helper scripts assert this isolation where practical.
+Managed-job runners remain instrumented because their lifecycle modules are gated; only test-plan business steps clear coverage, preventing nested profiler startup from replacing the behavior the test is intended to observe. The suite also holds a queued status beyond the recovery grace period while a provisional runner claim is live, verifies that no recovery occurs, and checks that the child upgrades the one-time-token claim to an exact token-free process identity.
+
+The gate deliberately reports each module rather than one aggregate percentage. New extracted pure/domain modules carry explicit branch floors, while the broad CLI entrypoint remains reported and locked independently. The machine-service owner, owner-aware service runtime, and Windows convergence modules require 100% function coverage with high branch floors; runtime activation remains independently gated. Worker pending calls and policy have branch minima instead of function-only gates. A refactor may raise a threshold, but must not lower one merely to make CI green without an explicit audit explanation.
+
+`npm run typecheck` combines strict Worker TypeScript with a focused `tsconfig.local.json` gate. High-risk JavaScript contracts opt in with `// @ts-check` and JSDoc types; the gate currently covers policy, call lifecycle, Agent configuration/path resolution, public projection, skill discovery, bounded Agent text reads, runtime path redaction, browser handshake parsing, capability ranking, monotonic deadlines, number/record normalization, bounded metadata reads, canonical recovered-activation evidence, the machine-service owner transaction, owner-aware service convergence, Windows service convergence, child settlement, and process-tree ownership. `@ts-ignore`, implicit `any`, or unchecked parallel contract shapes are not accepted as migration shortcuts.
 
 ## Additional release checks
 
@@ -106,14 +187,18 @@ npm run worker:dry-run
 npm audit --audit-level=high
 npm audit --omit=dev --audit-level=high
 npm audit signatures
-npm sbom --sbom-format cyclonedx
+npm run sbom:test
 npm pack --dry-run
 npm run version:check
 npm run release-impact:check
 npm run release:acceptance:verify
 ```
 
-GitHub Actions uses the pinned Node 26/npm 12 baseline in three execution paths. Ubuntu runs `check:full` and verifies interactive candidate acceptance. macOS and Windows run `check:platform` plus the installed-package smoke test, preserving platform coverage without repeating every Worker, browser, and package integration fixture three times. A separate package-audit job scans reachable Git history, audits complete and production dependency graphs, verifies registry signatures and attestations, validates a CycloneDX SBOM under the runner temporary directory, repeats the isolated installation test, and performs a package dry run. Because Node 26 currently bundles npm 11, every npm execution job downloads the exact npm 12.0.1 tarball, rejects redirects, verifies its recorded SHA-512 SRI, and exposes that verified CLI through `GITHUB_PATH`. Separate pinned workflows validate governance titles, dependency changes, CodeQL, and OpenSSF Scorecard. Third-party Actions remain pinned to immutable commits, SARIF findings fail closed unless exactly reviewed, and source release creation requires successful push-triggered CI, CodeQL, Governance, and Scorecard runs for the exact `main` commit.
+`worker:types` and the release-only `worker:dry-run` run Wrangler through the shared bounded command lifecycle adapter rather than trusting process exit as the only completion signal. A clean zero exit remains authoritative; when the current Node/Wrangler combination prints a command-specific terminal completion marker but remains resident, the adapter grants a short natural-exit grace, terminates the completed CLI, and succeeds only if command-specific completion evidence is still valid. A pre-completion stall, nonzero exit, or inability to terminate remains a failure. The deterministic lifecycle regression covers all four states for both adapters, and `worker:types` additionally requires the newly generated declaration file.
+
+GitHub Actions uses the pinned Node 26/npm 12 baseline in three execution paths. Ubuntu runs `check:full` and verifies local candidate acceptance. macOS and Windows run `check:platform` plus the installed-package smoke test, preserving platform coverage without repeating every Worker, browser, and package integration fixture three times. A separate package-audit job scans reachable Git history, audits complete and production dependency graphs, verifies registry signatures and attestations, validates a CycloneDX SBOM under the runner temporary directory; the local/full gate independently runs `sbom:test` through the pinned npm CLI, repeats the isolated installation test, and performs a package dry run. Because Node 26 currently bundles npm 11, every npm execution job downloads the exact npm 12.0.1 tarball, rejects redirects, verifies its recorded SHA-512 SRI, and exposes that verified CLI through `GITHUB_PATH`. Separate pinned workflows validate governance titles, dependency changes, CodeQL, OpenSSF Scorecard, and the Workflow Policy Gate itself. The gate reads every workflow through bounded no-follow/single-link checks and fault-injects trigger, permission, Action pin, checkout-credential, timeout, concurrency, shell-interpolation, UTF-8, symlink, hard-link, and required-contract failures. Third-party Actions remain pinned to immutable commits, SARIF findings fail closed unless exactly reviewed, and source release creation requires successful push-triggered CI, CodeQL, Governance, Workflow Policy Gate, and Scorecard runs for the exact `main` commit.
+
+The repository-level `.gitattributes` forces executable workflow `.yml` and `.yaml` files to LF at checkout. `workflow-policy:test` asks Git for the effective `text` and `eol` attributes, so a missing or shadowed pattern fails before a Windows runner can silently materialize CRLF. `release-diagnostic:test` sends hostile CR/LF, terminal controls, token-like values, credential-bearing URLs, email addresses, and home paths through the release event boundary; the serialized JSON must parse back to the same two fields, contain no literal second line, retain the configured bound, and preserve redaction. Architecture tests inventory every top-level release failure sink and require JSON serialization at the final console boundary. The macOS trust test performs intentional tampering only through an `O_NOFOLLOW` descriptor that is validated with `fstat` and closed in `finally`.
 
 ## Test design rules
 
@@ -126,7 +211,8 @@ GitHub Actions uses the pinned Node 26/npm 12 baseline in three execution paths.
 - Every durable workflow needs disconnect, cancellation, cleanup-failure, dead-runner, and plan-scrubbing coverage.
 - Secret-bearing resource tests must assert absence of raw, path, base64, and hex forms from MCP-visible results.
 - Logs and public metadata should be tested for absence of sensitive fields, arguments, outputs, and routine success noise—not only presence of expected fields.
-- Cross-platform tests must avoid shell syntax, URL-path conversion, and executable-shim assumptions specific to one operating system.
+- Cross-platform tests must avoid shell syntax, URL-path conversion, and executable-shim assumptions specific to one operating system. A fixture that injects a logical platform such as `darwin` or `win32` must not silently treat the physical CI host's UID, file-mode, executable-bit, signal-delivery, path, or service-manager semantics as evidence for that injected platform; inject the required host capability explicitly or gate only the assertion that the physical host cannot prove.
+- Release-evidence privacy tests must inject private-looking but publication-safe paths/URLs/text and assert absence from every recovered-success projection and persisted record. Do not commit a real credential pattern merely to test redaction.
 
 ## Privacy hygiene
 
@@ -134,12 +220,37 @@ Run `npm run privacy:check` before committing and before packaging. Run and revi
 
 ## Package manifest
 
-`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts, credential-like file classes, and generated Worker type declarations, validates every packaged mode as `0644` or `0755`, and verifies that required runtime, script, browser-extension, privacy, governance, and release files are present. `npm run install:test` requires npm 12, installs the real tarball from a package-free directory into an isolated global prefix with the documented options, verifies the packaged npm engine requirement, rejects blocked-script warnings, confirms optional `fsevents` is absent, verifies `--version`, then runs the installed CLI with zero arguments from an isolated workspace/state root. A fake Wrangler JavaScript entrypoint terminates at a controlled deployment boundary, so the probe exercises startup without mutating a live account. Package testing is full-plan-only; installation smoke runs in the Ubuntu full plan, the macOS/Windows platform plan, and package audit.
+`npm run package:test` executes a real silent `npm pack --dry-run --json`, requires clean parseable JSON, rejects sensitive local artifacts, credential-like file classes, and generated Worker type declarations, validates every packaged mode as `0644` or `0755`, and verifies that required runtime, script, browser-extension, privacy, governance, and release files are present. Exact runtime install-script approvals are version-bound, so a Wrangler/workerd refresh must also update the reviewed allowlist when the resolved workerd build changes and must pass a clean npm install without blocked-script warnings. A Wrangler-only or Miniflare-only patch that retains the same workerd build must prove that the existing single exact approval still matches the lockfile. `npm run install:test` requires npm 12, installs the real tarball from a package-free directory into an isolated global prefix with the documented options, verifies the packaged npm engine requirement, rejects blocked-script warnings, confirms optional `fsevents` is absent, verifies `--version`, then runs the installed CLI with zero arguments from an isolated workspace/state root. Hardened bootstrap downloads distinguish a 60-second no-progress failure from a slow transfer that continues making progress, while retaining an independent absolute attempt ceiling; install smoke is therefore allowed to exceed one minute on a degraded registry path without treating sustained progress as a retryable stall. A fake Wrangler JavaScript entrypoint terminates at a controlled deployment boundary, so the probe exercises startup without mutating a live account. Package testing is full-plan-only; installation smoke runs in the Ubuntu full plan, the macOS/Windows platform plan, and package audit.
 
-`npm run lint` uses ESLint as a semantic JavaScript correctness gate rather than a style formatter. It covers the Node CLI/runtime, repository scripts, tests, and packaged browser extension and rejects undefined identifiers in function bodies that `node --check` cannot detect. A dedicated lint-gate self-test proves that both Node and browser configurations reject a synthetic undefined binding while accepting the service-worker `importScripts` global. A focused `shell:test` requires Wrangler to run through the current Node executable and its package JavaScript entrypoint rather than a `.cmd` or shell shim. Architecture tests require `shell:test`, `lint:test`, `lint`, and `install:test` to remain in the complete check pipeline and reject non-exact direct dependency ranges.
+`npm run lint` uses ESLint as a semantic JavaScript correctness gate rather than a style formatter. It covers the Node CLI/runtime, shared runtime contracts, repository scripts, tests, and packaged browser extension and rejects undefined identifiers in function bodies that `node --check` cannot detect. `syntax-check.mjs` scans the same shared JavaScript root rather than leaving cross-runtime modules outside parser coverage. A dedicated lint-gate self-test proves that local Node, shared runtime, and browser configurations reject a synthetic undefined binding while accepting the service-worker `importScripts` global, and also requires unused imports to be rejected on the shared surface. A focused `shell:test` requires Wrangler to run through the current Node executable and its package JavaScript entrypoint rather than a `.cmd` or shell shim. Architecture tests require `shell:test`, `lint:test`, `lint`, and `install:test` to remain in the complete check pipeline and reject non-exact direct dependency ranges.
 
-The stdio integration test also sends an oversized line, verifies bounded rejection, and confirms that the next valid request is still processed.
+The stdio integration test also sends an oversized line, verifies bounded rejection, and confirms that the next valid request is still processed. Worker request-body tests use pull-counted streams and require immediate `ReadableStream.cancel()` after a declared or observed limit violation, proving that byte retention and execution work are both bounded.
 
 ## Architecture and documentation regression checks
 
-`npm run architecture:test` runs independent module-boundary, repository-hygiene, browser/security-structure, and release/documentation-contract checks. It validates the explicit fast/full check plans, local import graph, domain/adapter direction, module headroom budgets, immutable workflow references, package-script targets, documentation links, publication inventory, and selected security-shape invariants. These source-shape checks are deliberately supplementary: behavior, denial, race, and fault-injection tests remain authoritative for semantic guarantees. Tests must not depend on a fixed CI job count when the actual invariant is that every npm job uses the same verified bootstrap.
+`npm run architecture:test` runs independent module-boundary, repository-hygiene, browser/security-structure, and release/documentation-contract checks. It validates the explicit fast/full check plans, local import graph, domain/adapter direction, module headroom budgets, immutable workflow references, package-script targets, documentation links, publication inventory, and selected security-shape invariants. Critical coverage thresholds include every extracted OAuth refresh, token issuance, stream subscription, static metadata/routing, quota guard, edge logger, filesystem-state module, system-route classifier, and remote timeout/catalog projection. These source-shape checks are deliberately supplementary: behavior, denial, race, and fault-injection tests remain authoritative for semantic guarantees. Tests must not depend on a fixed CI job count when the actual invariant is that every npm job uses the same verified bootstrap.
+## MCP delivery and conformance coverage
+
+`npm run mcp-protocol:test` exercises the MCP `2026-07-28` shared contract: per-request version/capability metadata, discovery/cache/result metadata, bounded open-JSON validation, subscription filters, and result projection. The shared protocol module exports no executable older-version branch. `npm run mcp-controller:test` then covers current request dispatch, role-visible tool/schema validation, request-scoped SSE, subscription acknowledgement/completion, removed-method rejection, structured tool failures, and private cancellation-control consumption without any initialization/session/replay state.
+
+`npm run mcp-response-proxy:test` is the deterministic transport-ownership proof. It drives both public response-body cancellation and `Request.signal` abort against a synthetic Durable Object fetcher, requires exactly one random request-scoped stream capability, proves caller-supplied internal capability headers are replaced, binds cancel to the direct request's capability, closes the public stream after queued data drains, and proves the credential-free cancel control carries neither Authorization nor DPoP. This test is authoritative for proxy callback semantics because local Wrangler/workerd does not reliably surface a raw client TCP close as a Worker request-abort callback. A release candidate must still exercise real stream-close cancellation on the deployed edge.
+
+`npm run worker-runtime-infrastructure:test` covers transient pending-call ownership/rebind/expiry, result-owner versus late-ownerless versus stale-channel settlement, current-only runtime alarms, current CORS/header boundaries, stateful burst limiting, gateway failures, separate daemon-execution/Worker-settlement deadlines, channel isolation, output/log maintenance, and privacy-safe observability. New-call daemon recovery is exercised independently from already-dispatched same-daemon rebind: a ready channel returns immediately; a brief recovery wakes bounded waiters; timeout and client abort remove waiter state; the shared fifteen-second new-call recovery budget is deducted from the same absolute execution/settlement envelope rather than added in front of it; a call whose remaining execution window is consumed by recovery fails retryably before dispatch; malformed elapsed values cannot enlarge the budget. Pending-call regressions separately prove same-instance `resume_calls_ack.missing_ids` settlement: a daemon-proven non-delivery may preserve the original pending record for one same-ID transport redelivery, while a record without a safe redelivery path keeps the retryable no-side-effect fallback. The redelivery callback cannot reset the original operation deadline. A dedicated ready-dispatch regression requires an already-ready daemon to consume zero recovery budget while a real recovery reports only its measured interval. Capacity fixtures combine 29 already-detached ordinary pending calls with reconnect waiters, require the thirtieth ordinary slot to fill but not exceed ordinary capacity, preserve the two `diagnose_runtime`/`list_roots` reserved-control slots, and reject the next call at the shared 32-call ceiling. The same fixture verifies that owner `server_info` preserves the dispatched `active` count while reporting pre-dispatch waiters and combined ordinary/reserved capacity totals, and that delegated projections continue hiding global activity. It explicitly requires removed `Mcp-Session-Id` and `Last-Event-ID` browser preflights to fail and contains no persisted MCP delivery/session store. The separate initialization-compatibility module is stateless and therefore does not alter those runtime-storage invariants.
+
+`npm run worker:integration-test` exercises the real local Wrangler/OAuth/daemon path with native MCP `2026-07-28` plus the declared remote-HTTP stateless initialization compatibility dates `2025-06-18` and `2025-11-25`. It proves native stateless discovery/calls/current header-body validation/no session minting/non-resumable SSE framing, and independently proves that compatibility initialize/ping/tools requests never create `Mcp-Session-Id`, replay, recovery GET, or persisted delivery state. Relay coverage includes normal WSS rebinding, signed HTTPS fallback, an asymmetric black hole where the Worker still believes the old WSS is ready, invalid takeover preconditions that must not retire that healthy WSS, WSS → HTTPS → WSS ownership transfer, lost HTTP response deduplication, and same-ID transparent redelivery only after post-readiness `resume_calls_ack.missing_ids` proves the same daemon never owned the call. The integration requires redelivery to preserve tool/arguments/call ID, reduce rather than extend `timeout_ms`, and settle the original MCP request exactly once. Raw local TCP-close cancellation is not treated as emulator proof; the deterministic proxy test and deployed-edge candidate check cover that boundary. When `MBM_OFFICIAL_CONFORMANCE_CHECKOUT` and `MBM_OFFICIAL_CONFORMANCE_SCENARIOS` are set, integration also drives the pinned official MCP conformance checkout through a test-only loopback proxy that injects the already-created short-lived test bearer token. The production OAuth endpoint is unchanged, the alpha conformance package is not added to the dependency graph, and `tests/mcp-conformance-baseline.yml` contains only check-scoped exclusions for capabilities the production server intentionally does not advertise. A new unrelated failure or a stale expected-failure entry fails the run. The checkout must be a real directory with a committed lockfile and installed dependencies; missing or cleaned checkouts fail before Worker startup rather than surfacing as an ambiguous spawn error. Treat the alpha runner as an external audit tool: record its exact commit, inspect its own `npm audit` result, run it only against the loopback proxy, and remove the checkout afterward.
+
+`npm run tool-arguments:test` compiles all tool schemas under the bounded JSON Schema 2020-12 subset and covers type, range, length, array, object, pattern, enum, conditional/composition, unsupported dialect/keyword, external `$ref`, depth, node-count, issue-count, and value-redaction behavior. Worker and stdio integration additionally prove malformed calls are rejected before daemon/local side effects.
+
+Every candidate closeout requires fresh fast and full plans after the final packaged-source change; an earlier green run from another prerelease or pre-documentation tree is not terminal evidence.
+
+### Request-scoped delivery regressions
+
+`mcp-controller:test`, `mcp-response-proxy:test`, `worker-runtime-infrastructure:test`, and Worker integration jointly prevent client-visible session/replay state from returning. They require bounded in-memory pending-call admission, current per-request metadata, deterministic response-reader/request-abort cancellation, unguessable internal cancellation capabilities, same-daemon transient rebind, absence of persisted MCP delivery budgets, and negative coverage for removed session/recovery headers. `ci-bootstrap:test` separately executes the hardened npm bootstrap in a synthetic fresh checkout with no `node_modules`, proving that pre-install proxy validation is reachable without package imports.
+
+### Beta.58 independent security regressions
+
+The browser suite covers the final bootstrap and already-paired authentication contracts end to end: process-owned ephemeral pairing listener, fragment stripping before extension messaging, init-HMAC-before-pending-allocation, server proof before WebSocket upgrade, one-time proof consumption, replay idempotence, current schema-2 persisted-state validation, and fail-closed previous-owner pairing migration. `browser-broker-auth:test`, `browser-pairing-content:test`, `browser-pairing-launch:test`, `browser-cli-pairing:test`, `browser-service-worker:test`, `browser-identity:test`, and `browser-bridge:test` are all in the fast plan. The CLI pairing regression specifically requires `browser setup` to open the same ephemeral fragment bootstrap used by the MCP pair action while keeping its printed `pairing_url` sanitized, and requires opener failure to close the listener.
+
+Browser page-action timing also has an explicit background-throttling regression. The page-automation fixture disables renderer `setTimeout` while exposing the packaged extension timing-message shape, then requires a geometry-checked DOM click to settle without dropping deterministic scroll/stable-box/pointer-hit validation. `browser-service-worker:test` pins the other half of that boundary: only the current extension sender may request an internal delay, and the request must be an exact integer from 1 through 250 ms. This prevents hidden/background renderer timer throttling from turning an otherwise completed action into a broker timeout without weakening the conservative mutation-settlement rules.
+
+Worker security tests cover signed account-admin bodies with both declared and chunked oversize inputs, including zero pulls for declared oversize and cancellation after the streaming limit. Runtime-infrastructure tests cap internal MCP descriptor and terminal HTTP JSON materialization. Managed-job tests reject malformed or over-limit resource registries and explicit invalid approval-field types rather than accepting normalized defaults.