pinokiod 8.2.9 → 8.2.11

package/test/anywhere.test.js

@@ -1,16 +1,17 @@
 const assert = require('node:assert/strict')
 const test = require('node:test')
-const http = require('node:http')
 const os = require('node:os')
 const fs = require('node:fs')
 const path = require('node:path')
 
 const { buildServeConfig, describeServeConfig, sameServeConfig } = require('../kernel/anywhere/serve')
-const { assignPorts } = require('../kernel/anywhere/ports')
-const { LocalAPI } = require('../kernel/anywhere/localapi')
+const { assignPorts, loadPortMap, savePortMap } = require('../kernel/anywhere/ports')
+const vm = require('node:vm')
 const Anywhere = require('../kernel/anywhere')
-const { spawn } = require('node:child_process')
+const TailscaleCLI = require('../kernel/anywhere/cli')
 const Tailscaled = require('../kernel/bin/tailscaled')
+const { spawn } = require('node:child_process')
+const { once, EventEmitter } = require('node:events')
 const Setup = require('../kernel/bin/setup')
 
 test('serve config maps pinokiod to 443 and each app to its stable remote port', () => {
@@ -53,87 +54,49 @@ test('stable ports are allocated once, lowest free first, and never move', () =>
 test('anywhere preset requires tailscaled but not caddy', () => {
   const preset = Setup.anywhere({})
   const names = preset.requirements.map((r) => r.name)
-  assert.ok(names.includes('tailscaled'))
+  assert.deepEqual(names, ['conda', 'tailscaled'])
+  assert.deepEqual(preset.conda_requirements, ['tailscaled', 'tailscale'])
   assert.ok(!names.includes('caddy'))
   assert.ok(preset.conda_requirements.includes('tailscaled'))
   assert.ok(!preset.conda_requirements.includes('caddy'))
 })
 
-test('tailscaled bin module pins 1.104.1 and checks the installed version', async () => {
-  const mod = new Tailscaled()
-  assert.equal(mod.cmd(), 'tailscaled=1.104.1')
-  mod.kernel = {
-    platform: 'darwin',
-    bin: {
-      installed: { conda: new Set(['tailscaled']), conda_versions: { tailscaled: '1.104.1' } },
-      path: (...segments) => segments.join('/'),
-    },
+test('tailscaled checks both package versions, binary versions and missing executables', async () => {
+  const files = new Map()
+  const calls = []
+  const context = { module: { exports: {} }, console, require(name) {
+    if (name === 'fs') return { promises: { stat: async (file) => {
+      if (!files.has(file)) throw new Error('missing binary')
+      return { mtimeMs: 1, size: 1 }
+    } } }
+    if (name === 'child_process') return { execFile(file, args, options, done) {
+      calls.push([file, args, options])
+      done(null, files.get(file), '')
+    } }
+    if (name === 'util') return { promisify: (fn) => (...args) => new Promise((resolve, reject) => {
+      fn(...args, (error, stdout) => error ? reject(error) : resolve({ stdout }))
+    }) }
+    return require(name)
+  } }
+  vm.runInNewContext(fs.readFileSync(require.resolve('../kernel/bin/tailscaled'), 'utf8'), context)
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    const mod = new context.module.exports()
+    mod.kernel = { platform, bin: { path: (...parts) => path.join('/managed', ...parts),
+      installed: { conda: new Set(['tailscaled', 'tailscale']), conda_versions: { tailscaled: '1.104.1', tailscale: '1.104.1' } } } }
+    assert.equal(mod.cmd(), 'tailscaled=1.104.1 tailscale=1.104.1')
+    files.clear()
+    files.set(mod.binPath(), '1.104.1\n')
+    assert.equal(await mod.installed(), false, 'missing CLI fails setup')
+    files.set(mod.cliPath(), '1.104.1\n')
+    assert.equal(await mod.installed(), true)
+    mod.kernel.bin.installed.conda_versions.tailscale = '1.102.2'
+    assert.equal(await mod.installed(), false, 'mismatched CLI package fails setup')
+    mod.kernel.bin.installed.conda_versions.tailscale = '1.104.1'
+    mod.verified.clear()
+    files.set(mod.cliPath(), '1.102.2\n')
+    assert.equal(await mod.installed(), false, 'binary version is verified independently')
   }
-  assert.equal(await mod.installed(), true)
-  assert.equal(mod.binPath(), 'miniforge/bin/tailscaled')
-  mod.kernel.bin.installed.conda_versions.tailscaled = '1.98.5'
-  assert.equal(await mod.installed(), false, 'older than 1.104 (no --windows-mode=dev) is not accepted')
-  mod.kernel.bin.installed.conda = new Set()
-  assert.equal(await mod.installed(), false)
-  mod.kernel.platform = 'win32'
-  assert.equal(mod.binPath(), 'miniforge/Library/bin/tailscaled.exe')
-})
-
-function withMockDaemon(handler, fn) {
-  const socketPath = path.join(os.tmpdir(), `pk-ts-test-${process.pid}-${Date.now()}.sock`)
-  const server = http.createServer(handler)
-  return new Promise((resolve, reject) => {
-    server.listen(socketPath, async () => {
-      try {
-        resolve(await fn(socketPath))
-      } catch (e) {
-        reject(e)
-      } finally {
-        server.close()
-        fs.rmSync(socketPath, { force: true })
-      }
-    })
-  })
-}
-
-test('LocalAPI client talks plain HTTP over the socket with the Sec-Tailscale header', { skip: process.platform === 'win32' }, async () => {
-  const seen = []
-  await withMockDaemon((req, res) => {
-    let body = ''
-    req.on('data', (c) => body += c)
-    req.on('end', () => {
-      seen.push({ method: req.method, url: req.url, sec: req.headers['sec-tailscale'], ifMatch: req.headers['if-match'], body })
-      if (req.url === '/localapi/v0/status') {
-        res.setHeader('Content-Type', 'application/json')
-        res.end(JSON.stringify({ BackendState: 'Running', Self: { DNSName: 'pinokio.tail1.ts.net.' } }))
-      } else if (req.url === '/localapi/v0/serve-config' && req.method === 'GET') {
-        res.setHeader('Etag', 'abc')
-        res.end('null')
-      } else if (req.url === '/localapi/v0/serve-config' && req.method === 'POST') {
-        res.statusCode = 200
-        res.end()
-      } else if (req.url === '/localapi/v0/login-interactive') {
-        res.statusCode = 204
-        res.end()
-      } else {
-        res.statusCode = 404
-        res.end('nope')
-      }
-    })
-  }, async (socketPath) => {
-    const api = new LocalAPI({ socketPath })
-    const status = await api.status()
-    assert.equal(status.BackendState, 'Running')
-    const { etag } = await api.serveConfig()
-    assert.equal(etag, 'abc')
-    await api.setServeConfig({ TCP: {} }, etag)
-    await api.loginInteractive()
-    await assert.rejects(() => api.expect('GET', '/missing'), /404/)
-  })
-  const post = seen.find((s) => s.method === 'POST' && s.url === '/localapi/v0/serve-config')
-  assert.equal(post.sec, 'localapi')
-  assert.equal(post.ifMatch, 'abc')
-  assert.equal(post.body, JSON.stringify({ TCP: {} }))
+  assert.ok(calls.every(([, args, options]) => args[0] === '--version' && options.shell === false))
 })
 
 function fakeKernel(tmp, { installed = true } = {}) {
@@ -146,11 +109,73 @@ function fakeKernel(tmp, { installed = true } = {}) {
     memory: { local: {} },
     bin: {
       path: (...segments) => path.join(tmp, 'bin', ...segments),
-      mod: { tailscaled: { installed: async () => installed, binPath: () => path.join(tmp, 'bin', 'tailscaled') } },
+      mod: { tailscaled: { installed: async () => installed, binPath: () => path.join(tmp, 'bin', 'tailscaled'), cliPath: () => path.join(tmp, 'bin', 'tailscale') } },
     },
   }
 }
 
+function runningStatus() {
+  return { BackendState: 'Running', Self: { DNSName: 'pinokio.tail1.ts.net.' }, CertDomains: ['pinokio.tail1.ts.net'] }
+}
+
+for (const method of ['writeFile', 'rename']) {
+  test(`failed ${method} preserves Anywhere settings, cache and port assignments`, async (t) => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-save-'))
+    t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true, hostname: 'keep-name' })
+    await savePortMap(anywhere.portMapPath(), { comfy: 43000 })
+    const files = [anywhere.configPath(), anywhere.portMapPath()]
+    const before = files.map((file) => fs.readFileSync(file, 'utf8'))
+    const original = fs.promises[method]
+    const code = method === 'writeFile' ? 'ENOSPC' : 'EACCES'
+    t.mock.method(fs.promises, method, async function (...args) {
+      const target = method === 'rename' ? args[1] : args[0]
+      if (files.some((file) => target === file || String(target).startsWith(`${file}.`))) {
+        if (method === 'writeFile') await original.call(this, target, '{"partial":')
+        throw Object.assign(new Error('injected save failure'), { code })
+      }
+      return original.apply(this, args)
+    })
+    await assert.rejects(anywhere.saveConfig({ enabled: false, hostname: 'lost-name' }), { code })
+    await assert.rejects(savePortMap(files[1], { comfy: 43000, other: 43001 }), { code })
+    assert.deepEqual(files.map((file) => fs.readFileSync(file, 'utf8')), before)
+    assert.equal(await anywhere.enabled(), true)
+    assert.equal(await anywhere.hostname(), 'keep-name')
+    assert.deepEqual(await loadPortMap(files[1]), { comfy: 43000 })
+    assert.deepEqual(fs.readdirSync(anywhere.dir()).sort(), ['config.json', 'ports.json'])
+  })
+}
+
+test('failed first Anywhere save leaves no partial config or enabled cache', async (t) => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-save-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  const anywhere = new Anywhere(fakeKernel(tmp))
+  t.mock.method(fs.promises, 'writeFile', async () => {
+    throw Object.assign(new Error('disk full'), { code: 'ENOSPC' })
+  })
+  await assert.rejects(anywhere.saveConfig({ enabled: true }), { code: 'ENOSPC' })
+  assert.equal(await anywhere.enabled(), false)
+  assert.equal(await anywhere.configured(), false)
+  assert.deepEqual(fs.readdirSync(anywhere.dir()), [])
+})
+
+test('Anywhere replacements persist settings and stable ports for a fresh reader', async (t) => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-save-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  const kernel = fakeKernel(tmp)
+  const anywhere = new Anywhere(kernel)
+  await anywhere.saveConfig({ enabled: true, hostname: 'keep-name' })
+  await anywhere.saveConfig({ enabled: false })
+  await savePortMap(anywhere.portMapPath(), { comfy: 43000 })
+  await savePortMap(anywhere.portMapPath(), { comfy: 43000, other: 43001 })
+  const fresh = new Anywhere(kernel)
+  assert.equal(await fresh.enabled(), false)
+  assert.equal(await fresh.hostname(), 'keep-name')
+  assert.deepEqual(await loadPortMap(fresh.portMapPath()), { comfy: 43000, other: 43001 })
+  assert.deepEqual(fs.readdirSync(anywhere.dir()).sort(), ['config.json', 'ports.json'])
+})
+
 test('anywhere snapshot walks setup -> off -> login -> https -> ready', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
   try {
@@ -165,27 +190,31 @@ test('anywhere snapshot walks setup -> off -> login -> https -> ready', async ()
     assert.equal(await anywhere.configured(), true)
     assert.equal(JSON.parse(fs.readFileSync(path.join(tmp, 'anywhere', 'config.json'), 'utf8')).enabled, true)
 
-    // stub the daemon
+    // Stub a verified owned daemon.
+    anywhere.readPid = () => 123
     let status = { BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/abc', Self: {}, Peer: null, User: null }
     let loginRequests = 0
     let pushed = null
-    anywhere.pid = 123
+    let applied = null
     anywhere.api = {
       status: async () => status,
-      loginInteractive: async () => { loginRequests += 1 },
+      up: (update) => { loginRequests += 1; update({ AuthURL: status.AuthURL }); return new Promise(() => {}) },
       queryFeature: async () => ({ Complete: false, Text: 'approve', URL: 'https://login.tailscale.com/f/serve?node=1' }),
-      serveConfig: async () => ({ config: null, etag: 'e1' }),
-      setServeConfig: async (config) => { pushed = config },
+      serveConfig: async () => applied,
+      setServeConfig: async (config) => { pushed = applied = config; return applied },
     }
     let snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'starting', 'the first poll does not wait for asynchronous login ownership inspection')
+    await new Promise(setImmediate)
+    snap = await anywhere.snapshot()
     assert.equal(snap.phase, 'login')
     assert.equal(snap.loginUrl, 'https://login.tailscale.com/a/abc')
-    assert.equal(loginRequests, 0, 'uses the AuthURL the daemon already has')
+    assert.equal(loginRequests, 1, 'owns one CLI login flow')
 
     anywhere.lastStatusAt = 0
     status = { BackendState: 'NeedsLogin', AuthURL: '', Self: {}, Peer: null, User: null }
     snap = await anywhere.snapshot()
-    assert.equal(loginRequests, 1, 'asks the daemon for a login URL when it has none')
+    assert.equal(loginRequests, 1, 'polling does not duplicate the pending CLI login')
 
     anywhere.lastStatusAt = 0
     status = {
@@ -237,8 +266,8 @@ test('anywhere snapshot walks setup -> off -> login -> https -> ready', async ()
       assert.equal(rewritten[2].href, '/files/api/comfy')
       assert.equal(rewritten[3].href, 'https://example.com:7860/')
     }
-    // sync pushes once, then only on changes
-    assert.equal(await anywhere.sync(), true)
+    // The ready snapshot already verified the routes; unchanged syncs do not write.
+    assert.equal(await anywhere.sync(), false)
     assert.deepEqual(Object.keys(pushed.TCP), ['443', '43000'])
     pushed = null
     assert.equal(await anywhere.sync(), false)
@@ -262,6 +291,77 @@ test('anywhere snapshot walks setup -> off -> login -> https -> ready', async ()
   }
 })
 
+test('unchanged menus reuse confirmed routes and changed apps sync before publishing links', async t => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-menu-sync-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  const kernel = fakeKernel(tmp)
+  const local = kernel.memory.local
+  const comfy = path.join(tmp, 'api/comfy/start.js')
+  const forge = path.join(tmp, 'api/forge/start.js')
+  local[comfy] = { url: 'http://localhost:7860' }
+  const anywhere = new Anywhere(kernel)
+  anywhere.config = { enabled: true }
+  let applied = null, reads = 0, release
+  anywhere.readPid = () => 123
+  anywhere.api = {
+    status: async () => runningStatus(),
+    serveConfig: async () => { reads++; return applied },
+    setServeConfig: async desired => {
+      if (release) await release.promise
+      return (applied = desired)
+    },
+  }
+  await anywhere.sync()
+  reads = 0
+  for (let i = 0; i < 10; i++) {
+    const menu = await anywhere.rewriteMenu('pinokio.tail1.ts.net', [{ href: local[comfy].url }])
+    assert.equal(menu[0].href, 'https://pinokio.tail1.ts.net:43000/')
+  }
+  assert.equal(reads, 0, 'unchanged menu requests do not spawn more CLI reads')
+  await anywhere.sync()
+  assert.equal(reads, 1, 'the periodic refresh still checks the daemon')
+
+  local[forge] = { url: 'http://localhost:8188' }
+  const fresh = await anywhere.rewriteMenu('pinokio.tail1.ts.net', [{ href: local[forge].url }])
+  assert.equal(fresh[0].href, 'https://pinokio.tail1.ts.net:43001/')
+  delete local[forge]
+  await anywhere.rewriteMenu('pinokio.tail1.ts.net', [])
+  assert.equal(applied.TCP[43001], undefined)
+
+  local[comfy].url = 'http://localhost:7861'
+  release = {}
+  release.promise = new Promise(resolve => { release.resolve = resolve })
+  const sync = anywhere.sync()
+  await new Promise(setImmediate)
+  let published = false
+  const menu = anywhere.rewriteMenu('pinokio.tail1.ts.net', [{ href: local[comfy].url }])
+    .then(value => { published = true; return value })
+  await new Promise(setImmediate)
+  assert.equal(published, false, 'the new link waits for its pending route update')
+  release.resolve()
+  await sync
+  assert.equal((await menu)[0].href, 'https://pinokio.tail1.ts.net:43000/')
+})
+
+test('concurrent syncs share one follow-up pass and include the latest targets', async () => {
+  const anywhere = new Anywhere(fakeKernel(os.tmpdir()))
+  let release, target = 'old'
+  const pending = new Promise(resolve => { release = resolve })
+  const seen = []
+  anywhere.pushServeConfig = async () => {
+    seen.push(target)
+    if (seen.length === 1) await pending
+    return seen.length === 1
+  }
+  const calls = [anywhere.sync()]
+  target = 'new'
+  for (let i = 0; i < 7; i++) calls.push(anywhere.sync())
+  release()
+  assert.deepEqual(await Promise.all(calls), Array(8).fill(true))
+  assert.deepEqual(seen, ['old', 'new'])
+  assert.equal(anywhere.syncing, null)
+})
+
 test('anywhere uses dev mode flags on windows and a short socket path on long homes', () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
   try {
@@ -323,26 +423,58 @@ test('serve targets follow the Home Server router rules for an app\'s URL variab
   }
   const anywhere = new Anywhere(kernel)
   assert.deepEqual(anywhere.appTargets(), [   // `url` first, then the other keys alphabetically
-    { key: 'comfy', name: 'comfy', local: 7860 },
-    { key: 'api.comfy', name: 'comfy', local: 7861 },
-    { key: 'nocfg', name: 'nocfg', local: 8000 },
+    { key: 'comfy', name: 'comfy', local: 7860, origin: 'http://localhost:7860' },
+    { key: 'api.comfy', name: 'comfy', local: 7861, origin: 'http://127.0.0.1:7861' },
+    { key: 'nocfg', name: 'nocfg', local: 8000, origin: 'http://localhost:8000' },
   ])
 })
 
-test('a failed https feature query keeps the page in starting instead of showing an approval', async () => {
+test('Serve preserves upstream protocol and host, including changes on the same port', async t => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-origin-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  const kernel = fakeKernel(tmp)
+  const app = path.join(tmp, 'api/app/start.js')
+  const anywhere = new Anywhere(kernel)
+  anywhere.config = { enabled: true }
+  anywhere.lastStatus = runningStatus()
+  let applied = null
+  anywhere.readPid = () => 123
+  anywhere.api = {
+    status: async () => runningStatus(),
+    serveConfig: async () => applied,
+    setServeConfig: async desired => (applied = desired),
+  }
+  for (const [url, origin] of [
+    ['http://127.0.0.1:7860/ui/', 'http://127.0.0.1:7860'],
+    ['https://127.0.0.1:7860/ui/', 'https://127.0.0.1:7860'],
+    ['https://localhost:7860/ui/', 'https://localhost:7860'],
+    ['http://[::1]:7860/ui/', 'http://[::1]:7860'],
+    ['http://0.0.0.0:7860/ui/', 'http://127.0.0.1:7860'],
+  ]) {
+    kernel.memory.local[app] = { url }
+    await anywhere.rewriteMenu('pinokio.tail1.ts.net', [{ href: url }])
+    assert.equal(applied.Web['pinokio.tail1.ts.net:43000'].Handlers['/'].Proxy, origin)
+    assert.equal(describeServeConfig(applied, 'pinokio.tail1.ts.net')[1].local, 7860)
+    assert.equal(anywhere.targets[0].listen, 43000, 'the remote address stays stable')
+  }
+})
+
+test('a failed HTTPS query surfaces an error instead of looping in starting', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
   try {
     const anywhere = new Anywhere(fakeKernel(tmp))
     await anywhere.saveConfig({ enabled: true })
-    anywhere.pid = 123
     let feature = () => { throw new Error('503 no netmap') }
+    anywhere.readPid = () => 123
     anywhere.api = {
       status: async () => ({ BackendState: 'Running', CertDomains: null, Self: { DNSName: 'pinokio.tail1.ts.net.', UserID: 7 }, User: {}, Peer: null }),
       queryFeature: async () => feature(),
     }
     let snap = await anywhere.snapshot()
-    assert.equal(snap.phase, 'starting')
+    assert.equal(snap.phase, 'error')
+    assert.match(snap.error, /503 no netmap/)
     assert.equal(snap.approval, null)
+    anywhere.error = null
     feature = () => ({ Complete: false, Text: 'approve', URL: 'https://login.tailscale.com/f/serve?node=1' })
     anywhere.lastStatusAt = 0
     snap = await anywhere.snapshot()
@@ -360,31 +492,258 @@ function spawnIdle() {
   return { child, exited: (ms = 3000) => Promise.race([exited, new Promise((resolve) => setTimeout(() => resolve(false), ms))]) }
 }
 
-test('adopting a daemon left by a previous run recovers its pid from the pid file', async () => {
+test('a stored PID never authorizes signaling an unrelated process', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
   const idle = spawnIdle()
   try {
-    const kernel = fakeKernel(tmp)
-    const anywhere = new Anywhere(kernel)
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
     fs.mkdirSync(anywhere.stateDir(), { recursive: true })
-    const dead = spawnIdle(); dead.child.kill('SIGKILL'); await dead.exited()
-    fs.writeFileSync(anywhere.pidPath(), String(dead.child.pid))
-    assert.equal(anywhere.readPid(), null, 'a pid that no longer exists is ignored')
     fs.writeFileSync(anywhere.pidPath(), String(idle.child.pid))
-    await anywhere.saveConfig({ enabled: true })
+    let mutations = 0
     anywhere.api = {
-      ping: async () => true,
-      patchPrefs: async () => ({}),
-      status: async () => ({ BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/abc', Self: {}, User: null, Peer: null }),
+      cancel() {}, ping: async () => true, setPrefs: async () => { mutations++ },
+      status: async () => ({ BackendState: 'Running' }),
     }
-    await anywhere.start()
-    assert.equal(anywhere.pid, idle.child.pid)
+    await assert.rejects(() => anywhere.start(), /Cannot verify ownership/)
+    assert.equal(mutations, 0, 'an unverified daemon must not receive settings changes')
+    assert.equal(anywhere.child, null, 'does not adopt a child handle from disk')
+    assert.equal(await anywhere.readPid(), null)
+    await assert.rejects(() => anywhere.stop(), /Cannot verify ownership/)
+    anywhere.killSync()
+    process.kill(idle.child.pid, 0)
+    assert.equal(fs.readFileSync(anywhere.pidPath(), 'utf8'), String(idle.child.pid))
   } finally {
     idle.child.kill('SIGKILL')
     fs.rmSync(tmp, { recursive: true, force: true })
   }
 })
 
+test('a responding daemon requires a verified PID or a live owned child', async t => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-adopt-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  for (const platform of ['win32', 'darwin', 'linux']) {
+    for (const owner of ['missing', 'verified', 'child']) {
+      const kernel = fakeKernel(path.join(tmp, platform, owner))
+      kernel.platform = platform
+      const anywhere = new Anywhere(kernel)
+      anywhere.config = { enabled: true }
+      if (owner === 'child') anywhere.child = { pid: 123, exitCode: null }
+      anywhere.readPid = () => owner === 'verified' ? 123 : null
+      let mutations = 0
+      anywhere.api = { cancel() {}, ping: async () => true,
+        setPrefs: async () => { mutations++ }, status: async () => runningStatus() }
+      if (owner === 'missing') await assert.rejects(anywhere.start(), /Cannot verify ownership/)
+      else assert.equal(await anywhere.start(), true)
+      assert.equal(mutations, owner === 'missing' ? 0 : 1)
+    }
+  }
+})
+
+test('unverified daemons cannot receive logout, login, approval or Serve changes', async t => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-unowned-control-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  for (const platform of ['win32', 'darwin', 'linux']) {
+    const kernel = fakeKernel(path.join(tmp, platform))
+    kernel.platform = platform
+    const anywhere = new Anywhere(kernel)
+    anywhere.config = { enabled: true }
+    anywhere.readPid = () => null
+    const mutations = []
+    anywhere.api = {
+      cancel() {}, ping: async () => true, status: async () => runningStatus(),
+      setPrefs: async () => { mutations.push('prefs') },
+      logout: async () => { mutations.push('logout') },
+      up: async () => { mutations.push('login') },
+      queryFeature: async () => { mutations.push('approval'); return { Complete: true } },
+      serveConfig: async () => null,
+      setServeConfig: async config => { mutations.push('serve'); return config },
+    }
+    await assert.rejects(anywhere.start(), /Cannot verify ownership/)
+    await assert.rejects(anywhere.logout(), /Cannot verify ownership/)
+    anywhere.error = null
+    anywhere.requestLogin()
+    await anywhere.login.promise
+    assert.match(anywhere.error, /Cannot verify ownership/)
+    anywhere.error = null
+    for (const backend of ['NeedsLogin', 'Stopped', 'Running']) {
+      anywhere.lastStatus = null
+      anywhere.api.status = async () => ({ ...runningStatus(), BackendState: backend, CertDomains: null })
+      await assert.rejects(anywhere.snapshot(), /Cannot verify ownership/)
+    }
+    anywhere.api.status = async () => runningStatus()
+    await assert.rejects(anywhere.sync(), /Cannot verify ownership/)
+    assert.deepEqual(mutations, [])
+  }
+})
+
+test('status cannot control an unowned daemon while autostart is checking installation', async t => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-autostart-owner-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  const kernel = fakeKernel(tmp)
+  const anywhere = new Anywhere(kernel)
+  anywhere.config = { enabled: true }
+  anywhere.readPid = () => null
+  let entered, release, checks = 0, writes = 0
+  const checking = new Promise(resolve => { entered = resolve })
+  const pending = new Promise(resolve => { release = resolve })
+  kernel.bin.mod.tailscaled.installed = () => ++checks === 1 ? (entered(), pending) : Promise.resolve(true)
+  anywhere.api = {
+    cancel() {}, ping: async () => true, status: async () => runningStatus(),
+    serveConfig: async () => null, setServeConfig: async config => { writes++; return config },
+  }
+  const startup = anywhere.autostart().catch(error => error)
+  await checking
+  try {
+    assert.equal((await anywhere.snapshot()).phase, 'starting')
+    assert.equal(writes, 0)
+  } finally { release(true) }
+  assert.match((await startup).message, /Cannot verify ownership/)
+})
+
+test('Stop drains autostart installation checks before a home change', async t => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-autostart-stop-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  const kernel = fakeKernel(path.join(tmp, 'old'))
+  kernel.path = (...parts) => path.join(kernel.homedir, ...parts)
+  const anywhere = new Anywhere(kernel)
+  await anywhere.saveConfig({ enabled: true, hostname: 'old-home' })
+  let entered, release
+  const checking = new Promise(resolve => { entered = resolve })
+  kernel.bin.mod.tailscaled.installed = () => new Promise(resolve => { release = resolve; entered() })
+  anywhere.readPid = () => null
+  anywhere.api = { cancel() {}, ping: async () => false,
+    setPrefs: async () => assert.fail('cancelled startup must not change daemon preferences') }
+  anywhere.waitForDaemon = async () => assert.fail('cancelled startup must not spawn a daemon')
+  const startup = anywhere.autostart()
+  await checking
+  let stopped = false
+  const stop = anywhere.stop().then(() => { stopped = true })
+  await new Promise(setImmediate)
+  assert.equal(stopped, false, 'the installation check is part of the pending startup')
+  release(true)
+  assert.equal(await startup, false)
+  await stop
+  assert.equal(anywhere.child, null)
+  kernel.homedir = path.join(tmp, 'new')
+  anywhere.config = null
+  await anywhere.saveConfig({ enabled: false, hostname: 'new-home' })
+  assert.equal(anywhere.child, null)
+  assert.equal(fs.existsSync(anywhere.pidPath()), false)
+})
+
+test('a late status response after Off cannot start an HTTPS approval query', async t => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-status-stop-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  const anywhere = new Anywhere(fakeKernel(tmp))
+  await anywhere.saveConfig({ enabled: true })
+  let owned = true, entered, release, queries = 0
+  const checking = new Promise(resolve => { entered = resolve })
+  const status = new Promise(resolve => { release = resolve })
+  anywhere.readPid = () => owned ? 123 : null
+  anywhere.api = { cancel() { owned = false }, ping: async () => false,
+    status() { entered(); return status },
+    queryFeature: async () => { queries++; return { Complete: false } } }
+  const pending = anywhere.snapshot()
+  await checking
+  await anywhere.disable()
+  release({ ...runningStatus(), CertDomains: null })
+  const snapshot = await pending
+  assert.equal(snapshot.phase, 'off')
+  assert.equal(snapshot.enabled, false)
+  assert.equal(queries, 0)
+  assert.equal(anywhere.api, null, 'the late request must not recreate a CLI client')
+})
+
+test('status replies from a stopped client cannot control or overwrite a later session', async t => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-status-session-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  for (const failure of [false, true]) {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    anywhere.config = { enabled: true }
+    let release, reject, entered, owned = true
+    const checking = new Promise(resolve => { entered = resolve })
+    const status = new Promise((resolve, fail) => { release = resolve; reject = fail })
+    anywhere.readPid = () => owned ? 123 : null
+    anywhere.api = { cancel() { owned = false }, ping: async () => false,
+      status() { entered(); return status } }
+    const pending = anywhere.snapshot()
+    await checking
+    await anywhere.stop()
+    // A home change or re-enable may have already installed a different client.
+    anywhere.api = { queryFeature: async () => assert.fail('stale status must not act on the later session') }
+    const fresh = { BackendState: 'Stopped' }
+    anywhere.lastStatus = fresh
+    anywhere.lastStatusAt = Date.now()
+    if (failure) reject(new Error('old client failed'))
+    else release({ ...runningStatus(), CertDomains: null })
+    await pending
+    assert.equal(anywhere.lastStatus, fresh)
+    assert.equal(anywhere.error, null)
+  }
+})
+
+test('Stop drains pending ownership checks without starting login or approval afterward', async t => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-owner-stop-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  for (const operation of ['login', 'approval']) {
+    const anywhere = new Anywhere(fakeKernel(path.join(tmp, operation)))
+    await anywhere.saveConfig({ enabled: true })
+    let release, reads = 0, controls = 0, enteredStop
+    const stopping = new Promise(resolve => { enteredStop = resolve })
+    anywhere.readPid = () => ++reads === 1 ? new Promise(resolve => { release = resolve }) : null
+    anywhere.api = { cancel() { enteredStop() }, ping: async () => false,
+      up: async () => { controls++ }, queryFeature: async () => { controls++; return { Complete: false } } }
+    let pending
+    if (operation === 'login') {
+      anywhere.requestLogin()
+      pending = anywhere.login.promise
+    } else pending = anywhere.httpsFeature({ ...runningStatus(), CertDomains: null })
+    let stopped = false
+    const stop = anywhere.disable().then(() => { stopped = true })
+    await stopping
+    assert.equal(stopped, false, operation)
+    release(123)
+    await Promise.all([pending, stop])
+    assert.equal(controls, 0, operation)
+    assert.equal(anywhere.api, null)
+  }
+})
+
+for (const adopted of [false, true]) {
+  test(`Stop waits for ${adopted ? 'an adopted' : 'its owned'} process after endpoint closure`, {
+    skip: process.platform === 'win32' && 'requires a POSIX SIGTERM handler', timeout: 10000,
+  }, async () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-stop-exit-'))
+    const closed = path.join(tmp, 'closed')
+    const child = spawn(process.execPath, ['-e', `
+      const fs = require('node:fs')
+      process.on('SIGTERM', () => {
+        fs.writeFileSync(process.argv[1], '')
+        setTimeout(() => process.exit(0), 300)
+      })
+      process.stdout.write('ready')
+      setInterval(() => {}, 1000)
+    `, closed], { stdio: ['ignore', 'pipe', 'ignore'] })
+    const exited = once(child, 'exit')
+    try {
+      await once(child.stdout, 'data')
+      const anywhere = new Anywhere(fakeKernel(tmp))
+      if (!adopted) anywhere.child = child
+      anywhere.readPid = () => child.exitCode === null ? child.pid : null
+      anywhere.api = { cancel() {}, ping: async () => !fs.existsSync(closed) }
+      fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+      fs.writeFileSync(anywhere.pidPath(), String(child.pid))
+      await anywhere.stop()
+      assert.equal(child.exitCode, 0, 'endpoint absence alone must not complete Stop')
+      assert.equal(fs.existsSync(anywhere.pidPath()), false)
+    } finally {
+      if (child.exitCode === null) child.kill('SIGKILL')
+      await exited
+      fs.rmSync(tmp, { recursive: true, force: true })
+    }
+  })
+}
 
 test('a daemon that cannot be spawned reports the cause at once instead of waiting 20 s', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
@@ -403,41 +762,602 @@ test('a daemon that cannot be spawned reports the cause at once instead of waiti
   }
 })
 
-test('sign-out resets the login state, and a link the server rejected is replaced instead of shown', async () => {
+for (const operation of ['writeFileSync', 'rmSync']) {
+  test(`PID ${operation} failure is handled without leaving an unmanaged child or throwing from exit`, async t => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-pid-io-'))
+    t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+    const child = new EventEmitter()
+    child.pid = 123
+    child.exitCode = null
+    let killed = false
+    child.kill = () => { killed = true }
+    const failure = Object.assign(new Error(`PID ${operation} failed`), { code: operation === 'writeFileSync' ? 'ENOSPC' : 'EACCES' })
+    const fixtureFs = Object.create(fs)
+    fixtureFs[operation] = (file, ...args) => {
+      if (file.endsWith('tailscaled.pid')) throw failure
+      return fs[operation](file, ...args)
+    }
+    const filename = require.resolve('../kernel/anywhere')
+    const baseRequire = require('node:module').createRequire(filename)
+    const context = { module: { exports: {} }, console, process, Buffer, URL, setTimeout,
+      require(name) {
+        if (name === 'fs') return fixtureFs
+        if (name === 'child_process') return { spawn: () => child }
+        return baseRequire(name)
+      } }
+    vm.runInNewContext(fs.readFileSync(filename, 'utf8'), context)
+    const anywhere = new context.module.exports(fakeKernel(tmp))
+    anywhere.config = { enabled: true }
+    anywhere.api = { cancel() {}, ping: async () => false, setPrefs: async () => {}, status: async () => runningStatus() }
+    anywhere.waitForDaemon = async () => true
+    if (operation === 'writeFileSync') {
+      await assert.rejects(anywhere.start(), error => error === failure)
+      assert.equal(killed, true)
+    } else await anywhere.start()
+    assert.equal(child.listenerCount('error'), 1)
+    assert.doesNotThrow(() => child.emit('exit', null, 'SIGTERM'))
+    assert.equal(anywhere.child, null)
+    assert.match(anywhere.error, new RegExp(failure.message))
+    if (operation === 'rmSync') assert.equal(fs.readFileSync(anywhere.pidPath(), 'utf8'), '123')
+  })
+}
+
+test('logout and rejected links are handled by one CLI flow, with a fresh retry', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-anywhere-'))
   try {
     const anywhere = new Anywhere(fakeKernel(tmp))
     await anywhere.saveConfig({ enabled: true })
-    anywhere.pid = 123
+    anywhere.readPid = () => 123
     const calls = []
-    let status = { BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/dead', Self: {}, User: null, Peer: null,
-      Health: ['You are logged out. The last login error was: register request: http 410: auth path not found'] }
     anywhere.api = {
-      status: async () => status,
+      cancel() { calls.push('cancel') },
+      ping: async () => true, setPrefs: async () => {},
+      status: async () => ({ BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/stale' }),
       logout: async () => { calls.push('logout') },
-      patchPrefs: async (p) => { calls.push('prefs:' + (p.LoggedOut === false ? 'login' : 'other')); return {} },
-      start: async () => { calls.push('start') },
-      loginInteractive: async () => { calls.push('login-interactive') },
+      up: (update, force) => {
+        calls.push(force ? 'up:force' : 'up')
+        if (!force) return Promise.reject(new Error('login expired'))
+        update({ AuthURL: 'https://login.tailscale.com/a/fresh' })
+        return new Promise(() => {})
+      },
     }
     await anywhere.logout()
-    assert.deepEqual(calls, ['logout', 'prefs:login', 'start'], 'sign-out: logout, then back to logged-in prefs, then reset')
+    await anywhere.login.promise
+    assert.deepEqual(calls, ['cancel', 'logout', 'up'])
+    for (let i = 0; i < 3; i++) assert.equal((await anywhere.snapshot()).phase, 'error')
+    assert.equal(calls.filter((call) => call === 'up').length, 1, 'no automatic login loop after rejection')
+    await anywhere.start()
+    const snap = await anywhere.snapshot()
+    assert.equal(snap.phase, 'login')
+    assert.equal(snap.loginUrl, 'https://login.tailscale.com/a/fresh')
+    assert.ok(calls.includes('up:force'))
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
 
-    calls.length = 0
-    let snap = await anywhere.snapshot()
-    assert.equal(snap.loginUrl, null, 'the rejected link is not offered')
-    assert.equal(snap.phase, 'starting')
-    assert.deepEqual(calls, ['start', 'login-interactive'], 'a rejected link triggers a reset and a fresh request')
+test('control failures preserve live-daemon records and logs on every platform', async () => {
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    for (const cause of ['401', '403', 'busy', 'reset', 'timeout']) {
+      const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-error-'))
+      try {
+        const kernel = fakeKernel(tmp)
+        kernel.platform = platform
+        const anywhere = new Anywhere(kernel)
+        await anywhere.saveConfig({ enabled: true })
+        fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+        const files = [anywhere.pidPath(), anywhere.logPath(), anywhere.portMapPath(), anywhere.stateDir('tailscaled.state')]
+        for (const file of files) fs.writeFileSync(file, 'preserve me')
+        anywhere.api = { cancel() {}, ping: async () => { throw new Error(cause) } }
+        await assert.rejects(() => anywhere.autostart(), new RegExp(cause))
+        assert.equal((await anywhere.snapshot()).phase, 'error')
+        assert.equal(anywhere.child, null)
+        for (const file of files) assert.equal(fs.readFileSync(file, 'utf8'), 'preserve me')
+      } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+    }
+  }
+})
+
+test('saved Off neither probes the daemon nor removes its records', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-off-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: false })
+    fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+    fs.writeFileSync(anywhere.pidPath(), '123')
+    anywhere.api = new Proxy({}, { get() { throw new Error('off must not control the daemon') } })
+    assert.equal(await anywhere.autostart(), false)
+    assert.equal(fs.readFileSync(anywhere.pidPath(), 'utf8'), '123')
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
 
-    // after the reset the daemon keeps a stale "last login error: ... context canceled" line; that is not a rejection
+test('stopping during a pending start prevents a later spawn', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-stop-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    let release
+    let probing
+    const probeStarted = new Promise((resolve) => { probing = resolve })
+    anywhere.api = {
+      cancel() {},
+      ping: () => { probing(); return new Promise((resolve) => { release = resolve }) },
+    }
+    const starting = anywhere.start()
+    await probeStarted
+    const stopping = anywhere.stop()
+    anywhere.api.ping = async () => false
+    release(false)
+    await Promise.all([starting, stopping])
+    assert.equal(anywhere.child, null)
+    assert.equal(fs.existsSync(anywhere.logPath()), false)
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
+
+test('PID ownership checks require the exact private daemon command on each platform', async () => {
+  const source = fs.readFileSync(require.resolve('../kernel/anywhere'), 'utf8')
+  const baseRequire = require('node:module').createRequire(require.resolve('../kernel/anywhere'))
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-owner-'))
+  try {
+    for (const platform of ['darwin', 'win32', 'linux']) {
+      let command
+      const signals = []
+      const context = { module: { exports: {} }, console, URL, Buffer, setTimeout,
+        process: { ...process, kill(pid, signal) { signals.push(signal) } },
+        require(name) {
+          if (name === 'child_process') return { spawn, execFileSync: () => command,
+            execFile: (file, args, options, done) => done(null, command) }
+          return baseRequire(name)
+        },
+      }
+      vm.runInNewContext(source, context)
+      const kernel = fakeKernel(path.join(tmp, 'home with spaces é'))
+      kernel.platform = platform
+      const anywhere = new context.module.exports(kernel)
+      fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+      const expected = [anywhere.binPath(), ...anywhere.daemonArgs()].join(' ')
+      fs.writeFileSync(anywhere.pidPath(), '123')
+      command = platform === 'win32' ? '"' + anywhere.binPath().toUpperCase() + '" ' + anywhere.daemonArgs().join(' ') : expected
+      assert.equal(await anywhere.readPid(), 123, platform)
+      assert.equal(anywhere.readPidSync(), 123, platform)
+      for (const wrong of [expected.replace('tailscaled', 'unrelated'), expected + ' --other-state', expected.replace(anywhere.socketPath(), anywhere.socketPath() + '.wrong')]) {
+        command = wrong
+        assert.equal(await anywhere.readPid(), null, platform)
+        assert.equal(anywhere.readPidSync(), null, platform)
+        anywhere.killSync()
+        assert.ok(!signals.includes('SIGKILL'), 'no wrong-process signal')
+      }
+    }
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
+
+test('adopted-daemon status inspection leaves the event loop responsive on every platform', async t => {
+  const source = fs.readFileSync(require.resolve('../kernel/anywhere'), 'utf8')
+  const baseRequire = require('node:module').createRequire(require.resolve('../kernel/anywhere'))
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-async-owner-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    let release, first = true, command, statusReads = 0
+    const context = { module: { exports: {} }, console, URL, Buffer, setTimeout,
+      process: { ...process, kill() {} }, require(name) {
+        if (name === 'child_process') return { spawn,
+          execFileSync() { assert.fail('request paths must not run synchronous process inspection') },
+          execFile(file, args, options, done) {
+            assert.equal(options.shell, false)
+            assert.equal(options.timeout, 2000)
+            assert.equal(file, platform === 'win32' ? 'powershell.exe' : '/bin/ps')
+            if (first) { first = false; release = () => done(null, command) }
+            else done(null, command)
+          } }
+        return baseRequire(name)
+      } }
+    vm.runInNewContext(source, context)
+    const kernel = fakeKernel(path.join(tmp, platform))
+    kernel.platform = platform
+    const anywhere = new context.module.exports(kernel)
+    await anywhere.saveConfig({ enabled: true })
+    fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+    fs.writeFileSync(anywhere.pidPath(), '123')
+    command = [anywhere.binPath(), ...anywhere.daemonArgs()].join(' ')
+    anywhere.api = { status: async () => { statusReads++; return runningStatus() },
+      serveConfig: async () => buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', serverPort: 42000 }) }
+    const pending = anywhere.snapshot()
+    await new Promise(resolve => setTimeout(resolve, 10))
+    assert.equal(typeof release, 'function')
+    assert.equal(statusReads, 0, 'the status call waits for ownership while other work continues')
+    release()
+    assert.equal((await pending).phase, 'ready')
+  }
+})
+
+test('a daemon exiting during process inspection is absent; live inspection failures still propagate', async t => {
+  const source = fs.readFileSync(require.resolve('../kernel/anywhere'), 'utf8')
+  const baseRequire = require('node:module').createRequire(require.resolve('../kernel/anywhere'))
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-exit-inspect-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    for (const disappeared of [true, false]) {
+      let inspected = false
+      const failure = Object.assign(new Error('inspection failed'), { code: 1 })
+      const context = { module: { exports: {} }, console, URL, Buffer, setTimeout,
+        process: { ...process, kill(pid, signal) {
+          assert.equal(signal, 0, 'the existence probe never signals the process')
+          if (inspected && disappeared) throw Object.assign(new Error('gone'), { code: 'ESRCH' })
+        } }, require(name) {
+          if (name === 'child_process') return { execFile(file, args, options, done) {
+            inspected = true
+            done(failure)
+          } }
+          return baseRequire(name)
+        } }
+      vm.runInNewContext(source, context)
+      const kernel = fakeKernel(path.join(tmp, platform))
+      kernel.platform = platform
+      const anywhere = new context.module.exports(kernel)
+      fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+      fs.writeFileSync(anywhere.pidPath(), '123')
+      if (disappeared) assert.equal(await anywhere.readPid(), null)
+      else await assert.rejects(anywhere.readPid(), error => error === failure)
+    }
+  }
+})
+
+test('invalid port maps remain intact and failed saves cannot become ready', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-map-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    for (const text of ['invalid JSON', '[]', 'null']) {
+      fs.writeFileSync(anywhere.portMapPath(), text)
+      await assert.rejects(() => loadPortMap(anywhere.portMapPath()))
+      assert.equal(fs.readFileSync(anywhere.portMapPath(), 'utf8'), text)
+    }
+    fs.rmSync(anywhere.portMapPath())
+    fs.mkdirSync(anywhere.portMapPath())
+    anywhere.portMap = {}
+    anywhere.kernel.memory.local = { [path.join(tmp, 'api/comfy/start.js')]: { url: 'http://127.0.0.1:7860' } }
+    await assert.rejects(() => anywhere.refreshTargets())
+    assert.deepEqual(anywhere.portMap, {}, 'failed persistence does not cache an unsaved assignment')
+    fs.rmSync(anywhere.portMapPath(), { recursive: true })
+    await anywhere.refreshTargets()
+    assert.equal(JSON.parse(fs.readFileSync(anywhere.portMapPath(), 'utf8')).comfy, 43000)
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
+
+test('first home selection skips Stop when there is no previous home', async () => {
+  const Kernel = require('../kernel')
+  const reached = new Error('reached existing initialization')
+  const kernel = {
+    homedir: undefined, path: Kernel.prototype.path,
+    store: { get: () => '/new/home' },
+    disposeVault: async () => { throw reached },
+  }
+  kernel.anywhere = new Anywhere(kernel)
+  await assert.rejects(() => Kernel.prototype.init.call(kernel, {}), (error) => error === reached)
+})
+
+test('peer refresh proceeds during an Anywhere sync without queuing more syncs', async () => {
+  const Kernel = require('../kernel')
+  for (const fail of [false, true]) {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-peer-refresh-'))
+    const kernel = fakeKernel(tmp)
+    let announced = 0, calls = 0, release
+    const pending = new Promise((resolve) => { release = resolve })
+    kernel.peer = {
+      check: async () => {}, current_host: async () => ({}),
+      notify_refresh: async () => {}, announce: () => { announced += 1 },
+    }
+    kernel.ensureRouterMode = async () => {}
+    const anywhere = kernel.anywhere = new Anywhere(kernel)
+    anywhere.config = { enabled: true }
+    anywhere.readPid = () => 123
+    anywhere.portMap = {}
+    anywhere.lastStatus = runningStatus()
+    anywhere.lastStatusAt = Date.now()
+    anywhere.api = { serveConfig: async () => {
+      calls += 1
+      await pending
+      if (fail) throw new Error('Serve unavailable')
+      return buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', serverPort: 42000 })
+    } }
+    const refresh = Kernel.prototype.refresh.call(kernel)
+    try {
+      await new Promise(setImmediate)
+      assert.equal(announced, 1, 'peer notifications must not wait for Tailscale')
+      await Kernel.prototype.refresh.call(kernel)
+      assert.equal(announced, 2)
+      assert.equal(calls, 1, 'the pending sync must not accumulate more work')
+    } finally {
+      release()
+      await refresh
+      if (anywhere.syncing) await anywhere.syncing
+      fs.rmSync(tmp, { recursive: true, force: true })
+    }
+    assert.equal(anywhere.lastServeError, fail ? 'Serve unavailable' : null)
+  }
+})
+
+test('home changes stop Anywhere against the old home and preserve it on failure', async () => {
+  const Kernel = require('../kernel')
+  for (const failStop of [true, false]) {
+    const failure = new Error('stop test before the rest of initialization')
+    const calls = []
+    const ready = Promise.resolve()
+    const kernel = {
+      homedir: '/old/home', sysReady: ready, store: { get: () => '/new/home' },
+      anywhere: { stop: async () => {
+        assert.equal(kernel.homedir, '/old/home')
+        calls.push('stop')
+        if (failStop) throw failure
+      } },
+      disposeVault: async () => { calls.push('dispose'); throw failure },
+    }
+    await assert.rejects(() => Kernel.prototype.init.call(kernel, {}), (error) => error === failure)
+    assert.equal(kernel.homedir, '/old/home')
+    if (failStop) assert.equal(kernel.sysReady, ready)
+    assert.deepEqual(calls, failStop ? ['stop'] : ['stop', 'dispose'])
+  }
+})
+
+test('an unowned daemon does not block kernel re-init or lose its records', async t => {
+  const Kernel = require('../kernel')
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-init-unowned-'))
+  t.after(() => fs.rmSync(tmp, { recursive: true, force: true }))
+  t.mock.method(console, 'warn', () => {})
+  const kernel = fakeKernel(tmp)
+  const anywhere = kernel.anywhere = new Anywhere(kernel)
+  const reached = new Error('reached existing initialization')
+  kernel.store = { get: () => '/new/home' }
+  kernel.disposeVault = async () => { throw reached }
+  anywhere.readPid = () => null
+  let cancelled = 0
+  anywhere.api = { cancel() { cancelled++ }, ping: async () => true }
+  fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+  const files = [anywhere.pidPath(), anywhere.logPath(), anywhere.stateDir('tailscaled.state')]
+  for (const file of files) fs.writeFileSync(file, 'preserve')
+  await assert.rejects(Kernel.prototype.init.call(kernel, {}), error => error === reached)
+  assert.equal(cancelled, 1)
+  assert.equal(kernel.homedir, tmp)
+  for (const file of files) assert.equal(fs.readFileSync(file, 'utf8'), 'preserve')
+  for (const code of ['EACCES', 'ETIMEDOUT']) {
+    const failure = Object.assign(new Error('owned stop failed'), { code })
+    anywhere.stop = async () => { throw failure }
+    await assert.rejects(Kernel.prototype.init.call(kernel, {}), error => error === failure)
+  }
+})
+
+test('a completed login allows a later stopped backend to resume', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-resume-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.readPid = () => 123
+    let status = runningStatus(), ups = 0
+    anywhere.api = {
+      status: async () => status,
+      up: async () => { ups++; status = runningStatus() },
+      serveConfig: async () => buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', serverPort: 42000 }),
+    }
+    anywhere.requestLogin()
+    await anywhere.login.promise
+    status = { ...runningStatus(), BackendState: 'Stopped' }
+    assert.equal((await anywhere.snapshot()).phase, 'starting')
     anywhere.lastStatusAt = 0
-    calls.length = 0
-    status = { BackendState: 'NeedsLogin', AuthURL: 'https://login.tailscale.com/a/fresh', Self: {}, User: null, Peer: null,
-      Health: ['You are logged out. The last login error was: fetch control key: Get "https://controlplane.tailscale.com/key?v=148": context canceled'] }
-    snap = await anywhere.snapshot()
-    assert.equal(snap.loginUrl, 'https://login.tailscale.com/a/fresh', 'a fresh link is offered as is')
-    assert.equal(snap.phase, 'login')
-    assert.deepEqual(calls, [], 'no reset loop on a stale error line')
-  } finally {
-    fs.rmSync(tmp, { recursive: true, force: true })
+    assert.equal((await anywhere.snapshot()).phase, 'ready')
+    assert.equal(ups, 2)
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
+
+test('logout while Off does not start another login', async () => {
+  const anywhere = new Anywhere(fakeKernel(os.tmpdir()))
+  anywhere.config = { enabled: false }
+  anywhere.readPid = () => 123
+  let logouts = 0, logins = 0
+  anywhere.api = { cancel() {}, logout: async () => { logouts++ }, up: async () => { logins++ } }
+  await anywhere.logout()
+  assert.equal(logouts, 1)
+  assert.equal(logins, 0)
+  assert.equal(anywhere.login, null)
+})
+
+test('readiness requires a running backend and confirmed routes after sync', async () => {
+  for (const failure of ['control error', 'stopped backend', 'skipped sync']) {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-ready-'))
+    try {
+      const anywhere = new Anywhere(fakeKernel(tmp))
+      await anywhere.saveConfig({ enabled: true })
+      anywhere.readPid = () => 123
+      let reads = 0
+      anywhere.api = { status: async () => {
+        if (++reads === 1) return runningStatus()
+        if (failure === 'control error') throw new Error('control unavailable during sync')
+        return { ...runningStatus(), BackendState: 'Stopped' }
+      } }
+      if (failure === 'stopped backend') anywhere.lastServe = buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', serverPort: 42000 })
+      anywhere.httpsFeature = async () => {
+        anywhere.lastStatusAt = 0
+        if (failure === 'skipped sync') anywhere.stopping = Promise.resolve()
+        return { Complete: true }
+      }
+      const snapshot = await anywhere.snapshot()
+      assert.equal(snapshot.phase, failure === 'skipped sync' ? 'starting' : 'error', failure)
+      if (failure !== 'skipped sync') assert.match(snapshot.error, failure === 'control error' ? /control unavailable/ : /Routes are not confirmed/)
+    } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+  }
+})
+
+test('a failed stop stays visible while disabled and a successful retry clears it', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-stop-error-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+    fs.writeFileSync(anywhere.pidPath(), '123')
+    fs.writeFileSync(anywhere.logPath(), 'preserve log')
+    anywhere.readPid = () => null
+    anywhere.api = { cancel() {}, ping: async () => { throw new Error('pipe access denied') } }
+    await assert.rejects(() => anywhere.disable(), /pipe access denied/)
+    for (let i = 0; i < 2; i++) {
+      const snapshot = await anywhere.snapshot()
+      assert.equal(snapshot.enabled, false)
+      assert.equal(snapshot.phase, 'error')
+      assert.match(snapshot.error, /pipe access denied/)
+    }
+    assert.equal(fs.readFileSync(anywhere.pidPath(), 'utf8'), '123')
+    assert.equal(fs.readFileSync(anywhere.logPath(), 'utf8'), 'preserve log')
+    anywhere.api.ping = async () => false
+    await anywhere.stop()
+    assert.equal((await anywhere.snapshot()).phase, 'off')
+    assert.equal(anywhere.error, null)
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
+
+test('ownership-inspection failures cannot spawn a daemon or overwrite its records', async () => {
+  const source = fs.readFileSync(require.resolve('../kernel/anywhere'), 'utf8')
+  const baseRequire = require('node:module').createRequire(require.resolve('../kernel/anywhere'))
+  for (const platform of ['darwin', 'win32', 'linux']) {
+    for (const code of ['ETIMEDOUT', 'EACCES', 'ENOENT']) {
+      const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-inspect-'))
+      try {
+        const failure = Object.assign(new Error('process inspection failed'), { code })
+        let spawns = 0
+        const context = { module: { exports: {} }, console, URL, Buffer, setTimeout,
+          process: { ...process, kill() {} },
+          require(name) {
+            if (name === 'child_process') return {
+              execFileSync() { throw failure },
+              execFile(file, args, options, done) { done(failure) },
+              spawn() { spawns++; throw new Error('must not spawn') },
+            }
+            return baseRequire(name)
+          },
+        }
+        vm.runInNewContext(source, context)
+        const kernel = fakeKernel(tmp)
+        kernel.platform = platform
+        const anywhere = new context.module.exports(kernel)
+        await anywhere.saveConfig({ enabled: true })
+        fs.mkdirSync(anywhere.stateDir(), { recursive: true })
+        fs.writeFileSync(anywhere.pidPath(), '123')
+        fs.writeFileSync(anywhere.logPath(), 'preserve log')
+        for (const alive of [false, true]) {
+          anywhere.api = { cancel() {}, ping: async () => alive }
+          await assert.rejects(() => anywhere.start(), (error) => error === failure)
+        }
+        assert.equal(spawns, 0)
+        assert.equal(fs.readFileSync(anywhere.pidPath(), 'utf8'), '123')
+        assert.equal(fs.readFileSync(anywhere.logPath(), 'utf8'), 'preserve log')
+      } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+    }
+  }
+})
+
+test('uninstall aborts when stopping fails and removes packages only after success', async () => {
+  const mod = new Tailscaled()
+  const order = []
+  mod.kernel = {
+    anywhere: { stop: async () => { throw new Error('cannot verify ownership') } },
+    bin: { exec: async ({ message }) => { order.push(message) } },
   }
+  await assert.rejects(() => mod.uninstall({}, () => {}), /cannot verify ownership/)
+  assert.deepEqual(order, [])
+  mod.kernel.anywhere.stop = async () => { order.push('stop') }
+  await mod.uninstall({}, () => {})
+  assert.deepEqual(order, ['stop', 'conda remove -y tailscaled tailscale'])
+})
+
+test('a changed Serve update reuses the initial read and confirms its result', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-reads-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.readPid = () => 123
+    const desired = buildServeConfig({ dnsName: 'pinokio.tail1.ts.net', serverPort: 42000 })
+    let reads = 0, writes = 0, applied = null
+    anywhere.api = {
+      status: async () => runningStatus(),
+      serveConfig: async () => { reads++; return applied },
+      run: async () => { writes++; applied = desired },
+      setServeConfig(...args) { return TailscaleCLI.prototype.setServeConfig.call(this, ...args) },
+    }
+    assert.equal(await anywhere.sync(), true)
+    assert.equal(reads, 2, 'one initial read and one confirmation read')
+    assert.equal(writes, 1)
+    assert.equal(await anywhere.sync(), false)
+    assert.equal(reads, 3, 'unchanged routes need only one additional read')
+    assert.equal(writes, 1)
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
+
+test('the first failed status response includes the actual cause', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-status-error-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.readPid = () => 123
+    anywhere.api = { status: async () => { throw new Error('status access denied') } }
+    const snapshot = await anywhere.snapshot()
+    assert.equal(snapshot.phase, 'error')
+    assert.equal(snapshot.error, 'status access denied')
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
+
+test('concurrent status requests share a pending HTTPS approval query', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-approval-query-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    anywhere.readPid = () => 123
+    let calls = 0, release
+    const pendingQuery = new Promise((resolve) => { release = resolve })
+    anywhere.api = {
+      status: async () => ({ ...runningStatus(), CertDomains: null }),
+      queryFeature: () => { calls++; return pendingQuery },
+    }
+    const pending = Promise.all(Array.from({ length: 4 }, () => anywhere.snapshot()))
+    await new Promise(setImmediate)
+    assert.equal(calls, 1)
+    const url = 'https://login.tailscale.com/f/serve?node=1'
+    release({ Complete: false, URL: url })
+    for (const snapshot of await pending) {
+      assert.equal(snapshot.phase, 'https')
+      assert.equal(snapshot.approval.url, url)
+    }
+    assert.equal((await anywhere.snapshot()).approval.url, url)
+    assert.equal(calls, 1, 'completed queries remain cached')
+    anywhere.featureAt = 0
+    anywhere.api.queryFeature = async () => ({ Complete: false, URL: url + '&fresh=1' })
+    assert.equal((await anywhere.snapshot()).approval.url, url + '&fresh=1', 'an expired cache can query again')
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
+})
+
+test('cancelling a pending HTTPS approval during Stop keeps the result Off', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'pk-approval-stop-'))
+  try {
+    const anywhere = new Anywhere(fakeKernel(tmp))
+    await anywhere.saveConfig({ enabled: true })
+    let rejectQuery
+    const pendingQuery = new Promise((_, reject) => { rejectQuery = reject })
+    let owned = true
+    anywhere.readPid = () => owned ? 123 : null
+    anywhere.api = {
+      status: async () => ({ ...runningStatus(), CertDomains: null }),
+      queryFeature: () => pendingQuery,
+      ping: async () => false,
+      cancel() { owned = false; setImmediate(() => rejectQuery(Object.assign(new Error('query cancelled'), { cancelled: true }))) },
+    }
+    const pending = anywhere.snapshot()
+    await new Promise(setImmediate)
+    await anywhere.disable()
+    await pending
+    const snapshot = await anywhere.snapshot()
+    assert.equal(snapshot.phase, 'off')
+    assert.equal(snapshot.error, null)
+    assert.equal(JSON.parse(fs.readFileSync(anywhere.configPath(), 'utf8')).enabled, false)
+    await anywhere.saveConfig({ enabled: true })
+    owned = true
+    anywhere.api = {
+      status: async () => ({ ...runningStatus(), CertDomains: null }),
+      queryFeature: async () => ({ Complete: false, URL: 'https://login.tailscale.com/f/fresh' }),
+    }
+    assert.equal((await anywhere.snapshot()).approval.url, 'https://login.tailscale.com/f/fresh')
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }) }
 })