Merge remote-tracking branch 'origin/main' into fix/windows-setup-marker-runtime-root

A snapshot whose identity could not be read at apply time failed the
rollback match the same way a replaced target does, and the operator was
told the target had been replaced. Both still leave the object alone;
the message now says which one happened. Reported by CodeRabbit.

internal/acp/agent.go

@@ -962,25 +962,16 @@ func toolCallEvent(call agent.ToolCall) sessions.AppendEventInput {
 	}
 }
 
-// toolResultEvent persists a tool result through the ONE session contract every
-// writer shares, agent.ToolResultSessionPayload.
-//
-// This used to spell its own payload and wrote result.Output. After the
-// output/notice split that field is the UNDECORATED text, and nothing else in
-// the payload carried the enforcement notices, so the disclosure was dropped at
-// the moment of persisting. The live tool_call_update for the same result had
-// shown it (toolResultContent reads ModelOutput), and then session/load
-// replayed the call with the sandbox's narrowing gone. Fixing only the live
-// translation could not reach this: the text was already lost on disk.
-//
-// The session store is shared with the TUI and headless exec, so the same
-// payload is also what lets a TUI resume of an ACP-written session draw the
-// notice as card furniture, from the typed field and the undecorated body.
-// Reported by @jatmn.
 func toolResultEvent(result agent.ToolResult) sessions.AppendEventInput {
 	return sessions.AppendEventInput{
-		Type:    sessions.EventToolResult,
-		Payload: agent.ToolResultSessionPayload(result),
+		Type: sessions.EventToolResult,
+		Payload: map[string]any{
+			"toolCallId":   result.ToolCallID,
+			"name":         result.Name,
+			"status":       result.Status,
+			"output":       result.Output,
+			"changedFiles": append([]string(nil), result.ChangedFiles...),
+		},
 	}
 }
 
@@ -1153,14 +1144,13 @@ func replayToolUpdate(event sessions.Event) *ToolCallUpdate {
 		return nil
 	}
 	var payload struct {
-		Name               string   `json:"name"`
-		ToolCallID         string   `json:"toolCallId"`
-		ID                 string   `json:"id"`
-		Arguments          string   `json:"arguments"`
-		Status             string   `json:"status"`
-		Output             string   `json:"output"`
-		ChangedFiles       []string `json:"changedFiles"`
-		EnforcementNotices []string `json:"enforcementNotices"`
+		Name         string   `json:"name"`
+		ToolCallID   string   `json:"toolCallId"`
+		ID           string   `json:"id"`
+		Arguments    string   `json:"arguments"`
+		Status       string   `json:"status"`
+		Output       string   `json:"output"`
+		ChangedFiles []string `json:"changedFiles"`
 	}
 	if json.Unmarshal(raw, &payload) != nil {
 		return nil
@@ -1180,27 +1170,12 @@ func replayToolUpdate(event sessions.Event) *ToolCallUpdate {
 	if status == "" {
 		status = tools.StatusOK
 	}
-	// THE DISCLOSURE IS RESTORED AS WHAT IT WAS: typed notices beside undecorated
-	// text, so toolCallResult composes it the way it did live and the client
-	// sees it exactly once. The stored output already has the notices composed
-	// in (that is the shared contract, because output is the provider-facing
-	// text), so handing it to ModelOutput together with the typed field would
-	// draw the disclosure twice, and dropping the typed field would make this
-	// reader depend on every writer having decorated the text. Taking the
-	// notices back off the front covers both: a record whose output was never
-	// decorated comes through unchanged and still gets its notice.
-	//
-	// displayPreview is deliberately not read. It is the card body for a
-	// terminal, and the ACP wire has no card: the live update sends the model
-	// text, so a replay that sent the preview instead would not match it.
-	notices := append([]string(nil), payload.EnforcementNotices...)
 	upd := toolCallResult(agent.ToolResult{
-		ToolCallID:         id,
-		Name:               payload.Name,
-		Status:             status,
-		Output:             tools.WithoutEnforcementNotices(payload.Output, notices),
-		EnforcementNotices: notices,
-		ChangedFiles:       append([]string(nil), payload.ChangedFiles...),
+		ToolCallID:   id,
+		Name:         payload.Name,
+		Status:       status,
+		Output:       payload.Output,
+		ChangedFiles: append([]string(nil), payload.ChangedFiles...),
 	})
 	return &upd
 }

internal/acp/enforcement_notice_persist_test.go

@@ -1,195 +0,0 @@
-package acp
-
-import (
-	"context"
-	"encoding/json"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/sessions"
-	"github.com/Twigpine/zero/internal/tools"
-	"github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-const persistedNotice = "least-privilege notice: read access was narrowed"
-
-func mustRawPayload(t *testing.T, payload map[string]any) json.RawMessage {
-	t.Helper()
-	encoded, err := json.Marshal(payload)
-	if err != nil {
-		t.Fatal(err)
-	}
-	return encoded
-}
-
-func toolUpdateText(update ToolCallUpdate) string {
-	var text strings.Builder
-	for _, part := range update.Content {
-		if part.Content != nil {
-			text.WriteString(part.Content.Text)
-		}
-	}
-	return text.String()
-}
-
-// nextToolResultUpdate returns the next tool_call_update, skipping the
-// tool_call that announces it.
-func nextToolResultUpdate(t *testing.T, ctx context.Context, updates <-chan ToolCallUpdate, stage string) ToolCallUpdate {
-	t.Helper()
-	for {
-		select {
-		case update := <-updates:
-			if update.SessionUpdate == UpdateToolCallUpdate {
-				return update
-			}
-		case <-ctx.Done():
-			t.Fatalf("%s: the tool result update never arrived", stage)
-		}
-	}
-}
-
-// A DISCLOSURE SHOWN LIVE HAS TO SURVIVE BEING WRITTEN DOWN.
-//
-// enforcement_notice_test.go pins the live translation: toolResultContent reads
-// ModelOutput, so a connected ACP client sees the sandbox's narrowing. That was
-// the only half fixed. The turn also persists each result, and the persisted
-// payload was spelled by hand in this package with result.Output, which after
-// the output/notice split is the undecorated text, and with no notices field at
-// all. The disclosure was gone from disk, so session/load replayed a sandboxed
-// command as if nothing had constrained it.
-//
-// This runs a real turn, so the result reaches the store through the same
-// OnToolResult callback production uses, then loads the session in a fresh
-// agent and reads the replayed update. It fails if only translate.go is fixed,
-// which is the state it was written against. Reported by @jatmn.
-func TestACPReloadedToolResultCarriesTheEnforcementNoticeOnce(t *testing.T) {
-	for _, tc := range []struct {
-		name   string
-		output string
-	}{
-		{name: "a command with output", output: "the command output"},
-		// An enforced command that printed nothing still has a disclosure, and
-		// an empty body is where a reader that falls back to the decorated text
-		// draws it twice.
-		{name: "a command that printed nothing", output: ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			deps := testDeps(t)
-			deps.RunAgent = func(_ context.Context, _ string, _ zeroruntime.Provider, opts agent.Options) (agent.Result, error) {
-				call := agent.ToolCall{ID: "call-sandboxed", Name: "bash", Arguments: `{"command":"ls"}`}
-				opts.OnToolCall(call)
-				opts.OnToolResult(agent.ToolResult{
-					ToolCallID:         call.ID,
-					Name:               call.Name,
-					Status:             tools.StatusOK,
-					Output:             tc.output,
-					EnforcementNotices: []string{persistedNotice},
-				})
-				return agent.Result{FinalAnswer: "done"}, nil
-			}
-			workspace := t.TempDir()
-			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			defer cancel()
-
-			live := newHarness(t, deps)
-			var created NewSessionResult
-			if err := live.client.Call(ctx, MethodSessionNew, NewSessionParams{Cwd: workspace, McpServers: []McpServer{}}, &created); err != nil {
-				t.Fatalf("session/new: %v", err)
-			}
-			if err := live.client.Call(ctx, MethodSessionPrompt, PromptParams{SessionID: created.SessionID, Prompt: []ContentBlock{TextBlock("list the files")}}, &PromptResult{}); err != nil {
-				t.Fatalf("session/prompt: %v", err)
-			}
-			liveText := toolUpdateText(nextToolResultUpdate(t, ctx, live.tools, "live"))
-			if count := strings.Count(liveText, persistedNotice); count != 1 {
-				t.Fatalf("premise: the live update carries the notice %d times, want 1:\n%s", count, liveText)
-			}
-			live.stop()
-
-			loader := newHarness(t, deps)
-			defer loader.stop()
-			if err := loader.client.Call(ctx, MethodSessionLoad, LoadSessionParams{SessionID: created.SessionID, Cwd: workspace, McpServers: []McpServer{}}, &LoadSessionResult{}); err != nil {
-				t.Fatalf("session/load: %v", err)
-			}
-			replayed := toolUpdateText(nextToolResultUpdate(t, ctx, loader.tools, "replay"))
-			if count := strings.Count(replayed, persistedNotice); count != 1 {
-				t.Errorf("the replayed result carries the notice %d times, want exactly 1:\n%s", count, replayed)
-			}
-			if replayed != liveText {
-				t.Errorf("the replayed result does not match what the client saw live\nlive:     %q\nreplayed: %q", liveText, replayed)
-			}
-		})
-	}
-}
-
-// THE ACP WRITER IS THE SHARED CONTRACT, NOT A COPY OF IT. The session store is
-// the one the TUI and headless exec also write to and resume from, so a payload
-// spelled here by hand is a third representation waiting to drift. It already
-// had: it was the only writer with no notices and no undecorated body.
-func TestToolResultEventIsTheSharedSessionPayload(t *testing.T) {
-	result := agent.ToolResult{
-		ToolCallID:         "call-1",
-		Name:               "bash",
-		Status:             tools.StatusOK,
-		Output:             "the command output",
-		EnforcementNotices: []string{persistedNotice},
-		ChangedFiles:       []string{"a.go"},
-	}
-	event := toolResultEvent(result)
-	if event.Type != sessions.EventToolResult {
-		t.Fatalf("event type = %q", event.Type)
-	}
-	if want := agent.ToolResultSessionPayload(result); !reflect.DeepEqual(event.Payload, want) {
-		t.Fatalf("the ACP payload is not the shared one\n got: %#v\nwant: %#v", event.Payload, want)
-	}
-	payload, ok := event.Payload.(map[string]any)
-	if !ok {
-		t.Fatalf("payload is %T", event.Payload)
-	}
-	if notices, _ := payload["enforcementNotices"].([]string); len(notices) != 1 || notices[0] != persistedNotice {
-		t.Errorf("typed notices were not persisted: %#v", payload["enforcementNotices"])
-	}
-	if body, present := payload["displayPreview"]; !present || body != "the command output" {
-		t.Errorf("the undecorated body was not persisted: %#v (present=%v)", body, present)
-	}
-}
-
-// A record can reach the reader in either shape, and both have to come out as
-// one disclosure: output with the notices already composed in, which is what
-// every current writer stores, and output left undecorated beside the typed
-// field, which a reader must not answer by dropping the notice.
-func TestReplayedToolResultComposesTheNoticeOnceForEitherStoredShape(t *testing.T) {
-	for _, tc := range []struct {
-		name   string
-		output string
-		want   string
-	}{
-		{name: "output stored decorated", output: persistedNotice + "\n\nthe command output", want: persistedNotice + "\n\nthe command output"},
-		{name: "output stored undecorated", output: "the command output", want: persistedNotice + "\n\nthe command output"},
-		{name: "decorated and otherwise empty", output: persistedNotice, want: persistedNotice},
-		{name: "undecorated and empty", output: "", want: persistedNotice},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			update := replayToolUpdate(sessions.Event{Type: sessions.EventToolResult, Payload: mustRawPayload(t, map[string]any{
-				"toolCallId": "call-1", "name": "bash", "status": "ok",
-				"output": tc.output, "enforcementNotices": []string{persistedNotice},
-			})})
-			if update == nil {
-				t.Fatal("the stored result was not replayed")
-			}
-			if got := toolUpdateText(*update); got != tc.want {
-				t.Errorf("replayed text = %q, want %q", got, tc.want)
-			}
-		})
-	}
-
-	// And a stored result with no notices is replayed as it was written.
-	plain := replayToolUpdate(sessions.Event{Type: sessions.EventToolResult, Payload: mustRawPayload(t, map[string]any{
-		"toolCallId": "call-2", "name": "bash", "status": "ok", "output": "plain output",
-	})})
-	if plain == nil || toolUpdateText(*plain) != "plain output" {
-		t.Errorf("an ordinary stored result changed on replay: %+v", plain)
-	}
-}

internal/acp/enforcement_notice_test.go

@@ -1,65 +0,0 @@
-package acp
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// AN ACP CLIENT MUST SEE THE DISCLOSURE THE TUI SEES.
-//
-// agent.ToolResult stores the UNDECORATED model text alongside the typed
-// enforcement notices; ModelOutput is what composes them. Reading .Output
-// directly compiles and looks right, and silently drops the notice for every
-// ACP client, which is the one surface with no other way to learn the sandbox
-// narrowed what the command could do.
-func TestToolResultContentCarriesTheEnforcementNotice(t *testing.T) {
-	const notice = "least-privilege notice: read access was narrowed"
-	result := agent.ToolResult{
-		Name:               "bash",
-		Status:             tools.StatusOK,
-		Output:             "the command output",
-		EnforcementNotices: []string{notice},
-	}
-
-	content := toolResultContent(result)
-	if len(content) == 0 {
-		t.Fatal("no content produced for a successful tool result")
-	}
-	var text strings.Builder
-	for _, part := range content {
-		if part.Content != nil {
-			text.WriteString(part.Content.Text)
-		}
-	}
-	got := text.String()
-
-	if count := strings.Count(got, notice); count != 1 {
-		t.Errorf("the notice appears %d times, want exactly 1:\n%s", count, got)
-	}
-	if !strings.Contains(got, "the command output") {
-		t.Errorf("the underlying output was lost:\n%s", got)
-	}
-}
-
-// And a result with no notice is unchanged, so the accessor is not adding
-// anything to ordinary output.
-func TestToolResultContentLeavesAnOrdinaryResultAlone(t *testing.T) {
-	result := agent.ToolResult{
-		Name:   "bash",
-		Status: tools.StatusOK,
-		Output: "plain output",
-	}
-	content := toolResultContent(result)
-	if len(content) == 0 {
-		t.Fatal("no content produced")
-	}
-	if content[0].Content == nil {
-		t.Fatal("content block missing")
-	}
-	if got := content[0].Content.Text; got != "plain output" {
-		t.Errorf("ordinary output = %q, want it untouched", got)
-	}
-}

internal/acp/translate.go

@@ -248,11 +248,7 @@ func toolCallResult(result agent.ToolResult) ToolCallUpdate {
 
 func toolResultContent(result agent.ToolResult) []ToolCallContent {
 	content := make([]ToolCallContent, 0, 1+len(result.FileDiffs))
-	// ModelOutput, not the raw field. agent.ToolResult stores the undecorated
-	// model text alongside the typed enforcement notices, and the accessor is
-	// what composes the two; reading Output directly sends an ACP client the
-	// output with the disclosure missing.
-	text := strings.TrimRight(result.ModelOutput(), "\n")
+	text := strings.TrimRight(result.Output, "\n")
 	if text == "" {
 		text = result.Display.Summary
 	}

internal/agent/after_tool_notice_test.go

@@ -1,160 +0,0 @@
-package agent
-
-import (
-	"context"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/execution"
-	"github.com/Twigpine/zero/internal/hooks"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// The tool's own disclosure and the afterTool hook's are the SAME STRING, which
-// is the real case: both come from the fixed Windows deny_read warning, so a hook
-// running under the same token shape as the tool it follows reports exactly what
-// the tool reported.
-const sharedEnforcementNotice = "least-privilege notice"
-
-const afterToolChatter = "vet-found-nothing"
-
-// sharedNoticeHookPreparer runs a hook that prints ordinary output and carries
-// the same enforcement notice the tool carries.
-type sharedNoticeHookPreparer struct{}
-
-func (sharedNoticeHookPreparer) PrepareExecution(_ context.Context, _ execution.Request) (execution.PreparedCommand, error) {
-	var command *exec.Cmd
-	if runtime.GOOS == "windows" {
-		command = exec.Command("cmd.exe", "/c", "echo "+afterToolChatter)
-	} else {
-		command = exec.Command("/bin/sh", "-c", "echo "+afterToolChatter)
-	}
-	return execution.PreparedCommand{
-		Command:     command,
-		Enforcement: execution.Enforcement{Notices: []string{sharedEnforcementNotice}},
-	}, nil
-}
-
-func afterToolNoticeDispatcher(t *testing.T) *hooks.Dispatcher {
-	t.Helper()
-	audit, err := hooks.NewAuditStore(hooks.AuditStoreOptions{AuditPath: filepath.Join(t.TempDir(), "audit.jsonl")})
-	if err != nil {
-		t.Fatalf("NewAuditStore: %v", err)
-	}
-	return hooks.NewDispatcher(hooks.DispatcherOptions{
-		Config: hooks.Config{
-			Enabled: true,
-			Hooks: []hooks.Definition{
-				{ID: "zero.after-tool", Event: hooks.EventAfterTool, Matcher: "notice_projection", Command: "vet", Enabled: true},
-			},
-		},
-		Audit:     audit,
-		Cwd:       t.TempDir(),
-		Execution: execution.NewRunner(sharedNoticeHookPreparer{}),
-	})
-}
-
-// ONE DISCLOSURE, ONE DELIVERY, FROM EITHER HOOK PHASE.
-//
-// beforeTool was moved onto the typed EnforcementNotices slice and afterTool was
-// left folding its notices into the prose feedback. Both halves then wrote the
-// same fact: the typed slice, which every surface composes through ModelOutput
-// and HumanDisplay, and the "Hook output:" block appended to the body. Since the
-// two carry the identical fixed string, the model saw the disclosure twice and a
-// bash or exec card showed it in the amber furniture and again in the body.
-//
-// Half a symmetry is its own defect, and this is the composition that catches it:
-// a tool that reports a notice, followed by an afterTool hook that reports the
-// same one.
-func TestAnAfterToolNoticeIsDeliveredOnce(t *testing.T) {
-	registry := tools.NewRegistry()
-	registry.Register(noticeProjectionTool{})
-
-	result, err := executeToolCall(context.Background(), registry, ToolCall{
-		ID: "call-1", Name: "notice_projection", Arguments: `{}`,
-	}, PermissionModeAuto, Options{Cwd: t.TempDir(), Hooks: afterToolNoticeDispatcher(t)})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-
-	// SETUP: the hook really ran, or the silence below is the silence of a hook
-	// that never executed.
-	if !strings.Contains(result.ModelOutput(), afterToolChatter) {
-		t.Fatalf("SETUP INVALID: the afterTool hook's own output never arrived, so nothing here is under test:\n%s", result.ModelOutput())
-	}
-
-	if got := strings.Count(result.ModelOutput(), sharedEnforcementNotice); got != 1 {
-		t.Errorf("the disclosure reached the model %d times, want once:\n%s", got, result.ModelOutput())
-	}
-	if got := strings.Count(strings.Join(result.EnforcementNotices, "\n"), sharedEnforcementNotice); got != 1 {
-		t.Errorf("the typed slice carries the disclosure %d times, want once: %v", got, result.EnforcementNotices)
-	}
-	// The body must not carry it at all: the surfaces draw it from the slice, so a
-	// copy in the body is what renders it twice.
-	if strings.Contains(result.BaseModelOutput(), sharedEnforcementNotice) {
-		t.Errorf("the disclosure is in the result body as well as the typed slice:\n%s", result.BaseModelOutput())
-	}
-	if strings.Count(result.HumanDisplay().Summary, sharedEnforcementNotice) != 1 {
-		t.Errorf("the card summary shows the disclosure %d times, want once:\n%s",
-			strings.Count(result.HumanDisplay().Summary, sharedEnforcementNotice), result.HumanDisplay().Summary)
-	}
-}
-
-// And an afterTool hook that discloses something the tool did not still gets
-// through, on the typed channel rather than as prose.
-func TestAnAfterToolNoticeReachesTheTypedSlice(t *testing.T) {
-	registry := tools.NewRegistry()
-	registry.Register(quietTool{})
-
-	result, err := executeToolCall(context.Background(), registry, ToolCall{
-		ID: "call-1", Name: "quiet_tool", Arguments: `{}`,
-	}, PermissionModeAuto, Options{Cwd: t.TempDir(), Hooks: quietToolAfterHookDispatcher(t)})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if !strings.Contains(result.ModelOutput(), afterToolChatter) {
-		t.Fatalf("SETUP INVALID: the afterTool hook never ran:\n%s", result.ModelOutput())
-	}
-	if len(result.EnforcementNotices) != 1 || result.EnforcementNotices[0] != sharedEnforcementNotice {
-		t.Errorf("an afterTool hook's disclosure did not reach the typed slice, so no card renders it: %v", result.EnforcementNotices)
-	}
-	if strings.Contains(result.BaseModelOutput(), sharedEnforcementNotice) {
-		t.Errorf("the disclosure travelled as prose in the body instead:\n%s", result.BaseModelOutput())
-	}
-}
-
-// quietTool carries no enforcement notice of its own.
-type quietTool struct{}
-
-func (quietTool) Name() string             { return "quiet_tool" }
-func (quietTool) Description() string      { return "test tool with no enforcement notice" }
-func (quietTool) Parameters() tools.Schema { return tools.Schema{Type: "object"} }
-func (quietTool) Safety() tools.Safety {
-	return tools.Safety{SideEffect: tools.SideEffectRead, Permission: tools.PermissionAllow}
-}
-
-func (quietTool) Run(ctx context.Context, args map[string]any) tools.Result {
-	return tools.Result{Status: tools.StatusOK, Output: "the command output"}
-}
-
-func quietToolAfterHookDispatcher(t *testing.T) *hooks.Dispatcher {
-	t.Helper()
-	audit, err := hooks.NewAuditStore(hooks.AuditStoreOptions{AuditPath: filepath.Join(t.TempDir(), "audit.jsonl")})
-	if err != nil {
-		t.Fatalf("NewAuditStore: %v", err)
-	}
-	return hooks.NewDispatcher(hooks.DispatcherOptions{
-		Config: hooks.Config{
-			Enabled: true,
-			Hooks: []hooks.Definition{
-				{ID: "zero.after-tool", Event: hooks.EventAfterTool, Matcher: "quiet_tool", Command: "vet", Enabled: true},
-			},
-		},
-		Audit:     audit,
-		Cwd:       t.TempDir(),
-		Execution: execution.NewRunner(sharedNoticeHookPreparer{}),
-	})
-}

internal/agent/before_tool_delivery_test.go

@@ -1,210 +0,0 @@
-package agent
-
-import (
-	"context"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/execution"
-	"github.com/Twigpine/zero/internal/hooks"
-	"github.com/Twigpine/zero/internal/tools"
-	zeroruntime "github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-const beforeToolNotice = "denyRead is configured, so the write jail is not confining writes"
-
-// beforeToolChatter is what a hook prints for its own reasons. It must never
-// reach the model: main is silent for a successful hook, and a hook that logs is
-// not asking to be heard by anything but the operator's terminal.
-const beforeToolChatter = "hook-ran-and-logged-this"
-
-// noticeHookPreparer plans the hook command with an enforcement notice attached,
-// the way the sandbox does for a command it weakened. The prepared child prints
-// ordinary output as well, so one run carries both kinds of text and the
-// delivery decision has to tell them apart.
-type noticeHookPreparer struct{}
-
-func (noticeHookPreparer) PrepareExecution(_ context.Context, _ execution.Request) (execution.PreparedCommand, error) {
-	var command *exec.Cmd
-	if runtime.GOOS == "windows" {
-		command = exec.Command("cmd.exe", "/c", "echo "+beforeToolChatter)
-	} else {
-		command = exec.Command("/bin/sh", "-c", "echo "+beforeToolChatter)
-	}
-	return execution.PreparedCommand{
-		Command:     command,
-		Enforcement: execution.Enforcement{Notices: []string{beforeToolNotice}},
-	}, nil
-}
-
-func beforeToolDispatcher(t *testing.T, event hooks.Event, exitCode int) *hooks.Dispatcher {
-	t.Helper()
-	audit, err := hooks.NewAuditStore(hooks.AuditStoreOptions{AuditPath: filepath.Join(t.TempDir(), "audit.jsonl")})
-	if err != nil {
-		t.Fatalf("NewAuditStore: %v", err)
-	}
-	return hooks.NewDispatcher(hooks.DispatcherOptions{
-		Config: hooks.Config{
-			Enabled: true,
-			Hooks: []hooks.Definition{
-				{ID: "zero.before-tool", Event: event, Matcher: "read_file", Command: "hook", Enabled: true},
-			},
-		},
-		Audit:     audit,
-		Cwd:       t.TempDir(),
-		Execution: execution.NewRunner(noticeHookPreparer{}),
-	})
-}
-
-func readFileRunOptions(t *testing.T, dispatcher *hooks.Dispatcher) (Options, *mockProvider, string) {
-	t.Helper()
-	root := t.TempDir()
-	if err := os.WriteFile(filepath.Join(root, "notes.txt"), []byte("hello"), 0o644); err != nil {
-		t.Fatalf("write notes.txt: %v", err)
-	}
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewReadFileTool(root))
-	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{
-			{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "call-1", ToolName: "read_file"},
-			{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "call-1", ArgumentsFragment: `{"path":"notes.txt"}`},
-			{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "call-1"},
-			{Type: zeroruntime.StreamEventDone},
-		},
-		{
-			{Type: zeroruntime.StreamEventText, Content: "read it"},
-			{Type: zeroruntime.StreamEventDone},
-		},
-	}}
-	return Options{
-		SessionID:    "session-hook",
-		Cwd:          root,
-		Registry:     registry,
-		ProviderName: "test-provider",
-		Model:        "test-model",
-		Hooks:        dispatcher,
-		MaxTurns:     2,
-	}, provider, root
-}
-
-// countRequestsContaining reports how many provider requests carry needle, so a
-// notice delivered twice is distinguishable from one delivered once.
-func countRequestsContaining(requests []zeroruntime.CompletionRequest, needle string) int {
-	total := 0
-	for _, request := range requests {
-		for _, message := range request.Messages {
-			if strings.Contains(message.Content, needle) {
-				total++
-			}
-		}
-	}
-	return total
-}
-
-// THE NOTICE CROSSES TO THE MODEL. THE HOOK'S OWN OUTPUT DOES NOT.
-//
-// executeToolCall used to read the beforeTool outcome only when Blocked was
-// true, so a hook that ran under the weakened DenyRead token said so to nobody.
-// Delivering DispatchOutcome.Messages fixed that and overshot: hookMessage folds
-// the notice together with the hook's ordinary stdout, so every successful
-// hook's routine logging became a standing input channel into the next model
-// request, which is not what main does.
-//
-// One hook run produces both kinds of text here, because the bug is exactly a
-// failure to tell them apart. Asserted on what the PROVIDER received, since that
-// is the boundary that matters; a unit test on the joining helper cannot see
-// which slice the loop passes it.
-func TestSuccessfulBeforeToolHookDeliversItsNoticeAndNotItsOutput(t *testing.T) {
-	options, provider, _ := readFileRunOptions(t, beforeToolDispatcher(t, hooks.EventBeforeTool, 0))
-	if _, err := Run(context.Background(), "read the notes", provider, options); err != nil {
-		t.Fatalf("Run: %v", err)
-	}
-
-	// The tool ran, so this is the successful-hook path rather than a blocked
-	// call that never reached the tool.
-	if !someRequestContains(provider.requests, "hello") {
-		t.Fatal("SETUP INVALID: the tool result never reached the model, so nothing was delivered to check")
-	}
-	// And the hook really did run and really did print, or the silence asserted
-	// below would be the silence of a hook that never executed.
-	if !someRequestContains(provider.requests, beforeToolNotice) {
-		t.Fatal("the enforcement notice never reached the model, so a hook could run under the weakened token and say so to nobody")
-	}
-	if got := countRequestsContaining(provider.requests, beforeToolNotice); got != 1 {
-		t.Errorf("the notice reached the model %d times, want exactly once", got)
-	}
-	if someRequestContains(provider.requests, beforeToolChatter) {
-		t.Error("the hook's ordinary output reached the model; main is silent for a successful hook and routine logging must not become model input")
-	}
-}
-
-// A VETO MUST NOT SWALLOW A NOTICE FROM A HOOK THAT ALREADY RAN.
-//
-// Dispatch runs hooks in order and returns at the first veto. The successful
-// hook ahead of it may already have run under the weakened token, and that is a
-// fact about something that happened. The veto result used to be built from the
-// blocking hook's Reason alone, so the earlier disclosure existed only in the
-// audit record.
-func TestABlockedCallStillCarriesTheEarlierHooksNotice(t *testing.T) {
-	audit, err := hooks.NewAuditStore(hooks.AuditStoreOptions{AuditPath: filepath.Join(t.TempDir(), "audit.jsonl")})
-	if err != nil {
-		t.Fatalf("NewAuditStore: %v", err)
-	}
-	dispatcher := hooks.NewDispatcher(hooks.DispatcherOptions{
-		Config: hooks.Config{
-			Enabled: true,
-			Hooks: []hooks.Definition{
-				{ID: "zero.first", Event: hooks.EventBeforeTool, Matcher: "read_file", Command: "hook", Enabled: true},
-				{ID: "zero.veto", Event: hooks.EventBeforeTool, Matcher: "read_file", Command: "veto", Enabled: true},
-			},
-		},
-		Audit:     audit,
-		Cwd:       t.TempDir(),
-		Execution: execution.NewRunner(vetoSecondPreparer{}),
-	})
-	options, provider, _ := readFileRunOptions(t, dispatcher)
-	if _, err := Run(context.Background(), "read the notes", provider, options); err != nil {
-		t.Fatalf("Run: %v", err)
-	}
-
-	// SETUP: the second hook really did veto, or this is the ordinary path.
-	if !someRequestContains(provider.requests, "was blocked by hook") {
-		t.Fatal("SETUP INVALID: the call was not blocked, so the veto path is not under test")
-	}
-	if !someRequestContains(provider.requests, beforeToolNotice) {
-		t.Error("the veto result dropped the notice from the hook that had already run under the weakened token")
-	}
-	if got := countRequestsContaining(provider.requests, beforeToolNotice); got != 1 {
-		t.Errorf("the notice reached the model %d times, want exactly once", got)
-	}
-	if someRequestContains(provider.requests, beforeToolChatter) {
-		t.Error("the vetoed result carried the earlier hook's ordinary output")
-	}
-}
-
-// vetoSecondPreparer runs the first hook successfully with a notice and makes
-// the second one exit non-zero, which is a veto for a blocking event.
-type vetoSecondPreparer struct{}
-
-func (vetoSecondPreparer) PrepareExecution(_ context.Context, request execution.Request) (execution.PreparedCommand, error) {
-	script := "echo " + beforeToolChatter
-	notices := []string{beforeToolNotice}
-	if request.Command.Name == "veto" {
-		script = "exit 2"
-		notices = nil
-	}
-	var command *exec.Cmd
-	if runtime.GOOS == "windows" {
-		command = exec.Command("cmd.exe", "/c", script)
-	} else {
-		command = exec.Command("/bin/sh", "-c", script)
-	}
-	return execution.PreparedCommand{
-		Command:     command,
-		Enforcement: execution.Enforcement{Notices: notices},
-	}, nil
-}

internal/agent/before_tool_rich_preview_test.go

@@ -1,129 +0,0 @@
-package agent
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/execution"
-	"github.com/Twigpine/zero/internal/hooks"
-	"github.com/Twigpine/zero/internal/tools"
-	zeroruntime "github.com/Twigpine/zero/internal/zeroruntime"
-)
-
-// editMatchingDispatcher is beforeToolDispatcher for the edit tool, so the same
-// notice-and-chatter hook runs ahead of a call whose result carries a diff.
-func editMatchingDispatcher(t *testing.T) *hooks.Dispatcher {
-	t.Helper()
-	audit, err := hooks.NewAuditStore(hooks.AuditStoreOptions{AuditPath: filepath.Join(t.TempDir(), "audit.jsonl")})
-	if err != nil {
-		t.Fatalf("NewAuditStore: %v", err)
-	}
-	return hooks.NewDispatcher(hooks.DispatcherOptions{
-		Config: hooks.Config{
-			Enabled: true,
-			Hooks: []hooks.Definition{
-				{ID: "zero.before-tool", Event: hooks.EventBeforeTool, Matcher: "edit_file", Command: "hook", Enabled: true},
-			},
-		},
-		Audit:     audit,
-		Cwd:       t.TempDir(),
-		Execution: execution.NewRunner(noticeHookPreparer{}),
-	})
-}
-
-// editFileRunOptions is readFileRunOptions for a tool whose result carries a
-// rich preview, which is the case the disclosure went missing on.
-func editFileRunOptions(t *testing.T, dispatcher *hooks.Dispatcher, onResult func(ToolResult)) (Options, *mockProvider) {
-	t.Helper()
-	root := t.TempDir()
-	if err := os.WriteFile(filepath.Join(root, "x.go"), []byte("package main\n\nconst answer = 41\n"), 0o644); err != nil {
-		t.Fatalf("write x.go: %v", err)
-	}
-	registry := tools.NewRegistry()
-	registry.Register(tools.NewScopedEditFileTool(root, nil))
-	provider := &mockProvider{turns: [][]zeroruntime.StreamEvent{
-		{
-			{Type: zeroruntime.StreamEventToolCallStart, ToolCallID: "call-1", ToolName: "edit_file"},
-			{Type: zeroruntime.StreamEventToolCallDelta, ToolCallID: "call-1", ArgumentsFragment: `{"path":"x.go","old_string":"41","new_string":"42"}`},
-			{Type: zeroruntime.StreamEventToolCallEnd, ToolCallID: "call-1"},
-			{Type: zeroruntime.StreamEventDone},
-		},
-		{
-			{Type: zeroruntime.StreamEventText, Content: "edited it"},
-			{Type: zeroruntime.StreamEventDone},
-		},
-	}}
-	return Options{
-		SessionID:      "session-hook-edit",
-		Cwd:            root,
-		Registry:       registry,
-		ProviderName:   "test-provider",
-		Model:          "test-model",
-		Hooks:          dispatcher,
-		OnToolResult:   onResult,
-		PermissionMode: PermissionModeUnsafe,
-		MaxTurns:       2,
-	}, provider
-}
-
-// THE NOTICE HAS TO SURVIVE A RESULT WHOSE BODY IS A DIFF.
-//
-// This is the boundary the component suites left between them. The delivery test
-// above proves a beforeTool notice reaches the provider with read_file, whose
-// body is its output. The card tests prove a card renders a notice when the
-// result already carries one typed. Neither composed the two, and in between them
-// the notice was being folded into result.Output as hook prose.
-//
-// For an edit or a write that is exactly where it disappears: the card builds its
-// body from Display.Preview rather than Output, and draws enforcement furniture
-// only from the typed slice, so the operator saw the diff and no disclosure at
-// all, live and restored, while the model saw the disclosure. A notice about a
-// weakened token was hidden on precisely the results where something was written.
-func TestABeforeToolNoticeSurvivesARichPreviewResult(t *testing.T) {
-	dispatcher := editMatchingDispatcher(t)
-
-	var results []ToolResult
-	options, provider := editFileRunOptions(t, dispatcher, func(result ToolResult) {
-		results = append(results, result)
-	})
-	if _, err := Run(context.Background(), "bump the answer", provider, options); err != nil {
-		t.Fatalf("Run: %v", err)
-	}
-
-	if len(results) != 1 {
-		t.Fatalf("SETUP INVALID: %d tool results, want the one edit", len(results))
-	}
-	result := results[0]
-	if result.Status != tools.StatusOK {
-		t.Fatalf("SETUP INVALID: the edit failed, so this is not the successful rich-preview path: %s", result.Output)
-	}
-	preview := result.BaseDisplay().Preview
-	if !strings.Contains(preview, "42") {
-		t.Fatalf("SETUP INVALID: the result carries no diff preview, which is the whole case under test: %q", preview)
-	}
-
-	// TYPED, which is what every interactive surface reads.
-	if len(result.EnforcementNotices) != 1 || result.EnforcementNotices[0] != beforeToolNotice {
-		t.Errorf("the hook's disclosure did not reach the typed field, so the card and the restored card show the diff and no disclosure: %v", result.EnforcementNotices)
-	}
-	// AND NOT IN THE BODY AS WELL. Decoration has one owner per surface; carrying
-	// it in both places renders it twice wherever the surface draws the slice.
-	if strings.Contains(result.BaseModelOutput(), beforeToolNotice) {
-		t.Errorf("the disclosure is in the result body as well as the typed field:\n%s", result.BaseModelOutput())
-	}
-	// The diff itself stays a parseable diff.
-	if strings.Contains(preview, beforeToolNotice) {
-		t.Errorf("the disclosure was glued onto the diff:\n%s", preview)
-	}
-
-	// And the model still sees it, exactly once, with none of the hook's chatter.
-	if got := countRequestsContaining(provider.requests, beforeToolNotice); got != 1 {
-		t.Errorf("the notice reached the model %d times, want exactly once", got)
-	}
-	if someRequestContains(provider.requests, beforeToolChatter) {
-		t.Error("the hook's ordinary output reached the model")
-	}
-}

internal/agent/enforcement_notice_projection_test.go

@@ -1,114 +0,0 @@
-package agent
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// noticeProjectionTool stands in for any sandboxed command tool: it reports the
-// enforcement disclosure the way the real ones do, through the sandbox metadata
-// key that finalizeToolOutcome promotes into the typed notice slice.
-type noticeProjectionTool struct{}
-
-func (noticeProjectionTool) Name() string             { return "notice_projection" }
-func (noticeProjectionTool) Description() string      { return "test tool carrying an enforcement notice" }
-func (noticeProjectionTool) Parameters() tools.Schema { return tools.Schema{Type: "object"} }
-func (noticeProjectionTool) Safety() tools.Safety {
-	return tools.Safety{SideEffect: tools.SideEffectRead, Permission: tools.PermissionAllow}
-}
-
-func (noticeProjectionTool) Run(ctx context.Context, args map[string]any) tools.Result {
-	return tools.Result{
-		Status:  tools.StatusOK,
-		Output:  "the command output",
-		Display: tools.Display{Summary: "the human summary"},
-		Meta:    map[string]string{"sandbox_notices": "least-privilege notice"},
-	}
-}
-
-// THE PROJECTION MUST CARRY ONE REPRESENTATION, NOT TWO.
-//
-// executeToolCall copies the typed notice slice into agent.ToolResult, so the
-// text fields it copies alongside must be the UNDECORATED base. Storing the
-// already-rendered text there instead leaves the same fact in two places with no
-// contract between them: it happens to render once today only because the
-// outcome arrives finalized and the agent accessor then reads Outcome.ModelView
-// rather than the stored field. Any result that reaches the accessor without a
-// finalized outcome renders the disclosure twice, and every raw reader of
-// .Output sees text that disagrees with Outcome.ModelView.
-func TestEnforcementNoticeIsStoredOnceAndRenderedOnce(t *testing.T) {
-	const notice = "least-privilege notice"
-
-	registry := tools.NewRegistry()
-	registry.Register(noticeProjectionTool{})
-
-	result, err := executeToolCall(context.Background(), registry, ToolCall{
-		ID: "call-1", Name: "notice_projection", Arguments: `{}`,
-	}, PermissionModeAuto, Options{Cwd: t.TempDir()})
-	if err != nil {
-		t.Fatalf("executeToolCall: %v", err)
-	}
-	if len(result.EnforcementNotices) == 0 {
-		t.Fatalf("the notice never reached the agent result: %#v", result)
-	}
-
-	// The stored fields are the canonical undecorated base, and they agree with
-	// the finalized outcome they were projected from.
-	if strings.Contains(result.Output, notice) {
-		t.Errorf("ToolResult.Output stores the rendered notice as well as the slice: %q", result.Output)
-	}
-	if strings.Contains(result.Display.Summary, notice) {
-		t.Errorf("ToolResult.Display.Summary stores the rendered notice as well as the slice: %q", result.Display.Summary)
-	}
-	if result.Output != result.Outcome.ModelView {
-		t.Errorf("stored output %q disagrees with the finalized model view %q", result.Output, result.Outcome.ModelView)
-	}
-	if result.Display.Summary != result.Outcome.HumanView.Summary {
-		t.Errorf("stored summary %q disagrees with the finalized human view %q", result.Display.Summary, result.Outcome.HumanView.Summary)
-	}
-
-	// And every consumer that renders goes through the accessors, which show the
-	// disclosure exactly once without hiding the output it is attached to.
-	// loop.go builds the provider transcript from ModelOutput; the CLI writer and
-	// the TUI cards use both accessors.
-	transcript := result.ModelOutput()
-	if got := strings.Count(transcript, notice); got != 1 {
-		t.Errorf("the transcript shows the notice %d times, want 1: %q", got, transcript)
-	}
-	if !strings.Contains(transcript, "the command output") {
-		t.Errorf("the transcript lost the command output: %q", transcript)
-	}
-	summary := result.HumanDisplay().Summary
-	if got := strings.Count(summary, notice); got != 1 {
-		t.Errorf("the human summary shows the notice %d times, want 1: %q", got, summary)
-	}
-	if !strings.Contains(summary, "the human summary") {
-		t.Errorf("the human summary lost the tool summary: %q", summary)
-	}
-}
-
-// A result that never crossed the registry has no finalized outcome, so the
-// accessor falls back to the stored field. That is the path on which a stored
-// rendering would double, and it is the reason the contract above is stated on
-// the stored fields rather than only on the accessors.
-func TestUnfinalizedResultStillRendersTheNoticeOnce(t *testing.T) {
-	const notice = "least-privilege notice"
-	result := ToolResult{
-		Status:             tools.StatusOK,
-		Output:             "the command output",
-		Display:            tools.Display{Summary: "the human summary"},
-		EnforcementNotices: []string{notice},
-	}
-	if result.Outcome.Finalized() {
-		t.Fatal("fixture is finalized; it no longer covers the fallback path")
-	}
-	if got := strings.Count(result.ModelOutput(), notice); got != 1 {
-		t.Errorf("ModelOutput shows the notice %d times, want 1: %q", got, result.ModelOutput())
-	}
-	if got := strings.Count(result.HumanDisplay().Summary, notice); got != 1 {
-		t.Errorf("HumanDisplay shows the notice %d times, want 1: %q", got, result.HumanDisplay().Summary)
-	}
-}

internal/agent/hook_wiring_test.go

@@ -84,102 +84,12 @@ func TestBlockedByHookResultFallsBackWhenReasonEmpty(t *testing.T) {
 	}
 }
 
-// THE BLOCKING HOOK'S OWN NOTICE IS A NOTICE, NOT PART OF THE VETO TEXT.
-//
-// It used to arrive folded into Reason, so it reached the model inside the error
-// message and never reached EnforcementNotices, which is what every surface
-// renders as the disclosure and what the session record keeps apart from the
-// body.
-func TestBlockedByHookResultCarriesTheBlockersNoticeOnTheTypedSlice(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-	out := blockedByHookResult(
-		ToolCall{ID: "c4", Name: "bash"},
-		hooks.DispatchOutcome{Blocked: true, BlockedBy: "policy", Reason: "policy violation", Notices: []string{notice}},
-	)
-	if len(out.EnforcementNotices) != 1 || out.EnforcementNotices[0] != notice {
-		t.Fatalf("EnforcementNotices = %#v, want the blocking hook's notice", out.EnforcementNotices)
-	}
-	if strings.Contains(out.Output, notice) {
-		t.Errorf("the notice is also inside the veto message, so it is said twice:\n%s", out.Output)
-	}
-	if got := strings.Count(out.ModelOutput(), notice); got != 1 {
-		t.Errorf("the model sees the notice %d times, want once:\n%s", got, out.ModelOutput())
-	}
-}
-
-// AN EARLIER HOOK'S NOTICE SURVIVES A REASON THAT QUOTES IT.
-//
-// The veto path used to drop every notice whose text appeared anywhere in the
-// blocking hook's reason, on the theory that the reason already carried it. A
-// blocking hook that printed the same sentence, for example by relaying another
-// tool's stderr, therefore removed an earlier hook's disclosure from the typed
-// slice.
-func TestBlockedByHookResultKeepsAnEarlierNoticeTheReasonQuotes(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-	out := blockedByHookResult(
-		ToolCall{ID: "c5", Name: "bash"},
-		hooks.DispatchOutcome{
-			Blocked:   true,
-			BlockedBy: "veto",
-			Reason:    "refusing: the last run reported \"" + notice + "\"",
-			Notices:   []string{notice},
-		},
-	)
-	if len(out.EnforcementNotices) != 1 || out.EnforcementNotices[0] != notice {
-		t.Fatalf("the earlier hook's notice was dropped because the veto quoted it: %#v", out.EnforcementNotices)
-	}
-}
-
 func TestDispatchHelpersAreNoopWithoutDispatcher(t *testing.T) {
 	options := Options{} // Hooks is nil
 	if _, blocked := dispatchBeforeTool(context.Background(), options, ToolCall{Name: "bash"}, nil); blocked {
 		t.Fatal("a nil dispatcher must never block a tool")
 	}
-	if feedback, notices := dispatchAfterTool(context.Background(), options, ToolCall{Name: "bash"}, nil, tools.Result{}); feedback != "" || notices != nil {
-		t.Fatalf("a nil dispatcher must yield no feedback and no notices, got %q and %v", feedback, notices)
-	}
-}
-
-// A SUCCESSFUL beforeTool HOOK'S NOTICE MUST STAY TYPED.
-//
-// executeToolCall used to read the beforeTool outcome only when Blocked was true,
-// so a hook that ran fine and produced an enforcement notice — for instance that
-// it ran under the weakened DenyRead token — put that notice in the audit record
-// and nowhere anybody could see it. The first fix delivered it as prose appended
-// to the result output, which reached the model and no interactive surface,
-// because those build their enforcement furniture from the typed slice.
-//
-// So the delivery is the typed field, and this pins the merge: the hook's notice
-// first, the tool's own after it, each exactly once, blanks contributing nothing.
-func TestBeforeToolNoticesMergeIntoTheTypedField(t *testing.T) {
-	const notice = "hook ran without WRITE_RESTRICTED because denyRead is configured"
-	const toolOwned = "the sandbox dropped the network capability for this call"
-
-	result := withAppliedHookNotices(ToolResult{Output: "ok"}, []string{notice}, nil)
-	if len(result.EnforcementNotices) != 1 || result.EnforcementNotices[0] != notice {
-		t.Fatalf("a successful beforeTool notice did not reach the typed field: %v", result.EnforcementNotices)
-	}
-	// AND NOT THE OUTPUT AS WELL, or every surface that renders the slice shows
-	// the disclosure twice.
-	if strings.Contains(result.Output, notice) {
-		t.Errorf("the notice was written into the output as well as the typed field: %q", result.Output)
-	}
-
-	// Both arrive, hook first, when the tool carries its own.
-	result = withAppliedHookNotices(ToolResult{EnforcementNotices: []string{toolOwned}}, []string{notice}, nil)
-	if len(result.EnforcementNotices) != 2 || result.EnforcementNotices[0] != notice || result.EnforcementNotices[1] != toolOwned {
-		t.Fatalf("the hook and tool notices did not merge in order: %v", result.EnforcementNotices)
-	}
-
-	// The same disclosure from both sides is carried once.
-	result = withAppliedHookNotices(ToolResult{EnforcementNotices: []string{notice}}, []string{notice}, nil)
-	if len(result.EnforcementNotices) != 1 {
-		t.Errorf("one disclosure reported by both the hook and the tool was carried %d times: %v", len(result.EnforcementNotices), result.EnforcementNotices)
-	}
-
-	// Blank notices contribute nothing, so a run with no hook output stays silent.
-	result = withAppliedHookNotices(ToolResult{}, []string{"", "   "}, nil)
-	if len(result.EnforcementNotices) != 0 {
-		t.Errorf("blank hook notices produced %v, want nothing", result.EnforcementNotices)
+	if feedback := dispatchAfterTool(context.Background(), options, ToolCall{Name: "bash"}, nil, tools.Result{}); feedback != "" {
+		t.Fatalf("a nil dispatcher must yield no feedback, got %q", feedback)
 	}
 }

internal/agent/loop.go

@@ -1467,31 +1467,10 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 	}
 
 	// beforeTool hooks may veto the call before it runs (a non-zero exit blocks).
-	//
-	// A SUCCESSFUL beforeTool HOOK STILL HAS SOMETHING TO SAY, BUT ONLY ITS NOTICE.
-	//
-	// Reading the outcome only when Blocked left the enforcement disclosure in the
-	// audit record and nowhere the model or the operator could see it: a hook could
-	// run under the weakened DenyRead token and say so to nobody.
-	//
-	// Notices, NOT Messages. Messages is presentation text that hookMessage builds
-	// by folding the notice together with the hook's ordinary stdout, so delivering
-	// it would put every successful hook's routine logging, large diagnostics, and
-	// whatever text a hook happened to process into the next model request. That is
-	// a behaviour change nobody asked for and a standing input channel. main is
-	// silent for successful hooks and stays silent here for everything except the
-	// disclosure. Carried to the tool result below, the same surface afterTool
-	// feedback already uses.
-	var beforeToolNotices []string
-	// Filled after the tool runs, and merged with beforeTool's at the one
-	// finalization below so both phases land on the same contract.
-	var afterToolNotices []string
 	if toolFound {
-		outcome, blocked := dispatchBeforeTool(ctx, options, call, args)
-		if blocked {
+		if outcome, blocked := dispatchBeforeTool(ctx, options, call, args); blocked {
 			return blockedByHookResult(call, outcome), nil
 		}
-		beforeToolNotices = outcome.Notices
 	}
 	args = shellExecutionArgsForApproval(call.Name, args, decisionAction, options)
 
@@ -1537,10 +1516,7 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 	})
 	if retryResult, directResult, retried, action, reason, prefix, abortErr := maybeRetryUnsandboxedAfterSandboxRestriction(ctx, registry, call, tool, args, result, permissionMode, options, progressCallback); retried || directResult != nil || abortErr != nil {
 		if directResult != nil {
-			// A denied, cancelled, or ungrantable retry still returns a result for a
-			// call whose beforeTool hook already ran. Without this the disclosure is
-			// produced and then dropped on the floor.
-			return withAppliedHookNotices(*directResult, beforeToolNotices, nil), abortErr
+			return *directResult, abortErr
 		}
 		result = retryResult
 		permissionGranted = true
@@ -1566,15 +1542,7 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 	// afterTool hooks run once the tool has executed; their output (e.g. a
 	// formatter or vet result) is surfaced back to the model on the result.
 	if toolFound {
-		// NEITHER PHASE'S NOTICES ARE FOLDED IN HERE. They are typed enforcement
-		// data on both sides now, and appending them as hook prose was what kept
-		// beforeTool's out of every surface that renders the typed slice, and what
-		// made afterTool's arrive twice once that slice was composed. Only the
-		// hook's own output, which is what an afterTool validator asked to say,
-		// still travels this way.
-		feedback, notices := dispatchAfterTool(ctx, options, call, args, result)
-		afterToolNotices = notices
-		if strings.TrimSpace(feedback) != "" {
+		if feedback := dispatchAfterTool(ctx, options, call, args, result); feedback != "" {
 			var didRedact bool
 			result.Output, didRedact = appendHookFeedback(result.Output, feedback)
 			if didRedact {
@@ -1601,32 +1569,28 @@ func executeToolCall(ctx context.Context, registry *tools.Registry, call ToolCal
 	// Secret scrubbing happens at the registry boundary (the single point both
 	// the agent loop and the MCP server pass through), so result.Output is
 	// already redacted here and result.Redacted reflects whether it changed.
-	//
-	// Wrapped in the same finalization every other return from a hooked call
-	// uses, so the normal path cannot drift away from the veto and retry paths.
-	return withAppliedHookNotices(ToolResult{
-		Risk:               executedRisk,
-		ToolCallID:         call.ID,
-		Name:               call.Name,
-		Status:             result.Status,
-		Output:             result.BaseModelOutput(),
-		Truncated:          result.Truncated,
-		Meta:               result.Meta,
-		EnforcementNotices: append([]string(nil), result.EnforcementNotices...),
-		Images:             result.Images,
-		Redacted:           result.Redacted,
-		ChangedFiles:       result.ChangedFiles,
-		FileDiffs:          result.FileDiffs,
-		ChangeSummaries:    result.ChangeSummaries,
-		Display:            result.BaseDisplay(),
-		Outcome:            result.Outcome,
-		LoadedTools:        loadedToolsFromResult(result.Meta),
+	return ToolResult{
+		Risk:            executedRisk,
+		ToolCallID:      call.ID,
+		Name:            call.Name,
+		Status:          result.Status,
+		Output:          result.ModelOutput(),
+		Truncated:       result.Truncated,
+		Meta:            result.Meta,
+		Images:          result.Images,
+		Redacted:        result.Redacted,
+		ChangedFiles:    result.ChangedFiles,
+		FileDiffs:       result.FileDiffs,
+		ChangeSummaries: result.ChangeSummaries,
+		Display:         result.HumanDisplay(),
+		Outcome:         result.Outcome,
+		LoadedTools:     loadedToolsFromResult(result.Meta),
 		// A tool may signal a mid-run model escalation by carrying the target id
 		// in Meta["escalate_to_model"]. Lift it into the typed loop-level field;
 		// the Run turn loop performs the actual provider switch. Empty for every
 		// ordinary tool result.
 		RequestedModel: result.Meta["escalate_to_model"],
-	}, beforeToolNotices, afterToolNotices), nil
+	}, nil
 }
 
 const sandboxNamespaceLimitedReason = "sandbox output is limited to the sandbox PID namespace; host/global state requires approval"
@@ -2010,9 +1974,9 @@ func dispatchBeforeTool(ctx context.Context, options Options, call ToolCall, arg
 // dispatchAfterTool runs configured afterTool hooks once a tool has executed and
 // returns any advisory output (e.g. a formatter or vet result) to surface back
 // to the model. afterTool hooks never block. A nil dispatcher is a no-op.
-func dispatchAfterTool(ctx context.Context, options Options, call ToolCall, args map[string]any, result tools.Result) (string, []string) {
+func dispatchAfterTool(ctx context.Context, options Options, call ToolCall, args map[string]any, result tools.Result) string {
 	if options.Hooks == nil || hooksSuppressed(options) {
-		return "", nil
+		return ""
 	}
 	outcome := options.Hooks.Dispatch(ctx, hooks.DispatchInput{
 		Event:      hooks.EventAfterTool,
@@ -2028,13 +1992,7 @@ func dispatchAfterTool(ctx context.Context, options Options, call ToolCall, args
 			"changedFiles": result.ChangedFiles,
 		},
 	})
-	// Both halves, because they have different destinations. The hook's own output
-	// is prose that belongs in the result body where an afterTool validator's
-	// findings have always gone; its enforcement notices are typed data that the
-	// caller merges into the result the same way beforeTool's are. Returning only
-	// the joined messages was what left afterTool on the old channel while
-	// beforeTool moved, and a notice reported by both then appeared twice.
-	return strings.TrimSpace(strings.Join(outcome.Messages, "\n")), outcome.Notices
+	return strings.TrimSpace(strings.Join(outcome.Messages, "\n"))
 }
 
 // dispatchSessionStart runs configured sessionStart hooks once before the first
@@ -2098,7 +2056,7 @@ func blockedByHookResult(call ToolCall, outcome hooks.DispatchOutcome) ToolResul
 		reason = "blocked by a beforeTool hook"
 	}
 	message := fmt.Sprintf("Error: %q was blocked by hook %q: %s", call.Name, outcome.BlockedBy, reason)
-	result := ToolResult{
+	return ToolResult{
 		ToolCallID:   call.ID,
 		Name:         call.Name,
 		Status:       tools.StatusError,
@@ -2106,124 +2064,12 @@ func blockedByHookResult(call ToolCall, outcome hooks.DispatchOutcome) ToolResul
 		Redacted:     redacted,
 		DenialReason: DenialHookBlocked,
 	}
-	// Dispatch runs hooks in order and stops at the first veto, so an earlier hook
-	// may already have run under a weakened token before this one said no. Its
-	// notice describes something that happened and has to survive the veto, and so
-	// does the blocking hook's own.
-	//
-	// ALL OF THEM, FROM THE TYPED SLICE. Reason carries the hook's words only, so
-	// nothing here is said twice and nothing has to be filtered out. The filter
-	// this replaced matched notices against the reason text, and dropped an
-	// earlier hook's disclosure whenever the blocking hook's output quoted it.
-	return withAppliedHookNotices(result, outcome.Notices, nil)
-}
-
-// withAppliedHookNotices is the single place a hook enforcement notice
-// reaches a tool result on a path that does NOT run afterTool.
-//
-// The normal tail joins the notices with the afterTool feedback and delivers
-// both at once. Two other exits return a result for a call whose hook already
-// ran: a later hook's veto, and a denied, cancelled, or ungrantable unsandboxed
-// retry. Routing all three through one function is what keeps "the hook ran
-// under this token" from depending on which exit the call happened to take.
-//
-// NO REBUDGET HERE, AND THAT IS LOAD-BEARING ON WHAT MAY PASS THROUGH. The
-// normal tail appends and then calls Registry.RebudgetAfterHook, because what it
-// appends is afterTool feedback: hook stdout, which a hook can make arbitrarily
-// large. These notices cannot be: they are CommandPlan.Notes, which only this
-// package's own fixed sentences may fill (none does today; #1006 refuses the
-// denyRead trade the last one described), and nothing hook-authored reaches
-// this slice: DispatchOutcome.Messages is where
-// hook output lives, and the capture site deliberately does not read it.
-//
-// So if anything ever widens what is delivered here to include text a hook or a
-// tool can size, this needs the rebudget step as well, which means converting
-// through tools.Result the way the tail does rather than editing Output in
-// place. Do not widen it without that.
-// withAppliedHookNotices carries a hook's disclosures onto the result as TYPED
-// enforcement notices, and is the single finalization point every return path
-// from a hooked call goes through.
-//
-// BOTH PHASES, because half a symmetry is its own defect. beforeTool was moved
-// onto the typed slice while afterTool was left folding its notices into the
-// prose feedback, and since the two carry the identical fixed string, a
-// disclosure reported by both then reached the model twice: once from the typed
-// prepend every surface composes, once inside the hook feedback in the body. A
-// bash or exec card showed it in the furniture and again in the body.
-//
-// It used to fold them into result.Output as prose. That reached the provider,
-// which reads the output, and reached nothing else. Every interactive surface
-// builds its enforcement furniture from the typed slice, and for an edit or a
-// write the card shows Display.Preview instead of Output, so the disclosure was
-// absent from the live card in both its collapsed and expanded states and from
-// the session payload that restores them. A notice about a weakened token was
-// therefore shown to the model and hidden from the operator, on exactly the
-// results where something was written.
-//
-// Typed here, the canonical accessors compose it per surface, the same way a
-// tool's own notices already work. Nothing is written into Output as well:
-// decoration has one owner per surface or the disclosure appears twice.
-// Hook notices lead, in run order, with the tool's own after them: dedupe makes
-// the ordering moot for the duplicate case that motivated this, and for distinct
-// disclosures it keeps the shape the tool-owned notices already had.
-func withAppliedHookNotices(result ToolResult, before []string, after []string) ToolResult {
-	hookNotices := before
-	if len(after) > 0 {
-		hookNotices = append(append([]string(nil), before...), after...)
-	}
-	merged, didRedact := mergeEnforcementNotices(hookNotices, result.EnforcementNotices)
-	result.EnforcementNotices = merged
-	if didRedact {
-		result.Redacted = true
-	}
-	return result
-}
-
-// mergeEnforcementNotices puts the hook disclosures ahead of the
-// tool's own and drops exact repeats, so a surface rendering the slice shows
-// each disclosure exactly once.
-//
-// Hook notices are third-party text arriving on an intercepted path that bypasses
-// the registry's redaction boundary, so they are scrubbed here the way
-// appendHookFeedback scrubbed them while they travelled as prose. The bool
-// reports whether scrubbing changed anything, so Redacted keeps matching the
-// registry's contract.
-func mergeEnforcementNotices(before []string, own []string) ([]string, bool) {
-	if len(before) == 0 && len(own) == 0 {
-		return nil, false
-	}
-	merged := make([]string, 0, len(before)+len(own))
-	seen := make(map[string]struct{}, len(before)+len(own))
-	redacted := false
-	for index, notice := range append(append([]string(nil), before...), own...) {
-		if index < len(before) {
-			scrubbed := redaction.RedactString(notice, redaction.Options{})
-			redacted = redacted || scrubbed != notice
-			notice = scrubbed
-		}
-		if strings.TrimSpace(notice) == "" {
-			continue
-		}
-		if _, already := seen[notice]; already {
-			continue
-		}
-		seen[notice] = struct{}{}
-		merged = append(merged, notice)
-	}
-	if len(merged) == 0 {
-		return nil, redacted
-	}
-	return merged, redacted
 }
 
 // appendHookFeedback appends afterTool hook output to a tool result's output,
 // scrubbed for secrets like every other string crossing the tool boundary. The
 // returned bool reports whether scrubbing changed the feedback, so the caller can
 // set ToolResult.Redacted to match the registry's redaction contract.
-// The joiner that folded beforeTool notices in with the afterTool feedback is
-// gone. Sending a typed enforcement notice out as hook prose was the defect, not
-// the delivery: see withAppliedHookNotices. afterTool feedback still arrives here
-// on its own, which is all this path was ever meant to carry.
 func appendHookFeedback(output string, feedback string) (string, bool) {
 	scrubbed := redaction.RedactString(feedback, redaction.Options{})
 	redacted := scrubbed != feedback
@@ -2358,19 +2204,18 @@ func askUserFallbackResult(ctx context.Context, registry *tools.Registry, call T
 			Cwd:               options.Cwd,
 		})
 		return ToolResult{
-			ToolCallID:         call.ID,
-			Name:               call.Name,
-			Status:             result.Status,
-			Output:             result.BaseModelOutput(),
-			Truncated:          result.Truncated,
-			Meta:               result.Meta,
-			EnforcementNotices: append([]string(nil), result.EnforcementNotices...),
-			Redacted:           result.Redacted,
-			ChangedFiles:       result.ChangedFiles,
-			FileDiffs:          result.FileDiffs,
-			ChangeSummaries:    result.ChangeSummaries,
-			Display:            result.BaseDisplay(),
-			Outcome:            result.Outcome,
+			ToolCallID:      call.ID,
+			Name:            call.Name,
+			Status:          result.Status,
+			Output:          result.ModelOutput(),
+			Truncated:       result.Truncated,
+			Meta:            result.Meta,
+			Redacted:        result.Redacted,
+			ChangedFiles:    result.ChangedFiles,
+			FileDiffs:       result.FileDiffs,
+			ChangeSummaries: result.ChangeSummaries,
+			Display:         result.HumanDisplay(),
+			Outcome:         result.Outcome,
 		}
 	}
 	return ToolResult{

internal/agent/session_payload.go

@@ -1,84 +0,0 @@
-package agent
-
-import (
-	"strings"
-
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// CardBody is the card body source: the rich card-only Display.Preview (a
-// code/diff preview) when present on a successful result, else the text the
-// model also saw. Error results keep their output so the failure shows.
-//
-// UNDECORATED, ALWAYS. The enforcement disclosure is carried separately as typed
-// notices and rendered by the card as its own furniture, so a body that already
-// had the notice composed into it drew the warning twice: once in the notice
-// lines and once at the top of the output. A rich preview never carried it, so
-// only the no-preview results (every bash and exec card, and every error) were
-// wrong, which is exactly the shape a preview-only test cannot see.
-//
-// One owner for composition: this returns the base text, and whoever presents it
-// decorates once. Provider-facing text still goes through ModelOutput.
-func (result ToolResult) CardBody() string {
-	display := result.BaseDisplay()
-	if strings.TrimSpace(display.Preview) != "" && (result.Status != tools.StatusError || result.Outcome.Finalized()) {
-		return display.Preview
-	}
-	return result.BaseModelOutput()
-}
-
-// ToolResultSessionPayload is THE serialization of a tool result into a session
-// event, shared by every writer: the TUI, headless exec, and the ACP agent.
-//
-// It lives here, beside ToolResult, because it has three callers and only one of
-// them is a terminal. The writers used to spell the payload separately, and each
-// time one of them was left behind the same thing went missing on reload. The
-// headless writer persisted only the decorated ModelOutput, so a CLI-written
-// result restored into the TUI arrived with no typed notices and no undecorated
-// body. The ACP writer persisted the raw Output field, which after the
-// output/notice split is the UNDECORATED text, so an ACP client that loaded a
-// session saw every sandboxed result with its disclosure gone, although the
-// live update for the same call had shown it. All of them write to the same
-// session store, so a session written by one surface is restored by another.
-// One owner for the contract means one place where a field can go missing, and a
-// test against this function covers every writer.
-//
-// output is the provider-facing text with the disclosure composed in.
-// displayPreview is the undecorated card body, written whenever it differs from
-// output. A result carrying enforcement notices ALWAYS differs, because output
-// is decorated and the card body is not, so the undecorated body is written
-// even when it is empty. Readers key on the field being PRESENT rather than
-// non-empty for exactly that case: a command that printed nothing under an
-// enforced profile has an empty body and a real notice, and falling back to
-// output there would restore the decorated text and draw the notice twice.
-func ToolResultSessionPayload(result ToolResult) map[string]any {
-	output := result.ModelOutput()
-	payload := map[string]any{
-		"toolCallId": result.ToolCallID,
-		"name":       result.Name,
-		"status":     string(result.Status),
-		"output":     output,
-	}
-	if preview := result.CardBody(); preview != output {
-		payload["displayPreview"] = preview
-	}
-	if result.Truncated {
-		payload["truncated"] = true
-	}
-	if result.Redacted {
-		payload["redacted"] = true
-	}
-	if len(result.Meta) > 0 {
-		payload["meta"] = result.Meta
-	}
-	if len(result.EnforcementNotices) > 0 {
-		payload["enforcementNotices"] = result.EnforcementNotices
-	}
-	if len(result.ChangedFiles) > 0 {
-		payload["changedFiles"] = result.ChangedFiles
-	}
-	if len(result.ChangeSummaries) > 0 {
-		payload["changeSummaries"] = result.ChangeSummaries
-	}
-	return payload
-}

internal/agent/types.go

@@ -79,10 +79,6 @@ type ToolResult struct {
 	// The full result may be recoverable through Meta["spill_path"].
 	Truncated bool
 	Meta      map[string]string
-	// EnforcementNotices mirrors tools.Result.EnforcementNotices so the
-	// disclosure survives the conversion into the agent-facing result and
-	// reaches the model, the transcript and the interactive display.
-	EnforcementNotices []string
 	// Images the tool produced, delivered to the model as a following user
 	// message rather than on this result. See tools.Result.Images.
 	Images       []zeroruntime.ImageBlock
@@ -114,42 +110,24 @@ type ToolResult struct {
 	RequestedModel string
 }
 
-// BaseModelOutput is the bounded provider-facing result WITHOUT the enforcement
-// disclosure composed into it, mirroring tools.Result.BaseModelOutput.
-//
-// A surface that renders the typed EnforcementNotices itself must build its body
-// from here, or the disclosure appears twice. Decoration has exactly one owner
-// per surface: either the text carries it or the surface draws it, never both.
-func (result ToolResult) BaseModelOutput() string {
+// ModelOutput returns the bounded provider-facing result while preserving
+// compatibility with synthetic and restored results created before outcomes
+// were finalized.
+func (result ToolResult) ModelOutput() string {
 	if result.Outcome.Finalized() {
 		return result.Outcome.ModelView
 	}
 	return result.Output
 }
 
-// BaseDisplay is BaseModelOutput's presentation half, and carries no enforcement
-// notices for the same reason.
-func (result ToolResult) BaseDisplay() tools.Display {
+// HumanDisplay returns the presentation intended for interactive surfaces.
+func (result ToolResult) HumanDisplay() tools.Display {
 	if result.Outcome.Finalized() {
 		return result.Outcome.HumanView
 	}
 	return result.Display
 }
 
-// ModelOutput returns the bounded provider-facing result while preserving
-// compatibility with synthetic and restored results created before outcomes
-// were finalized.
-func (result ToolResult) ModelOutput() string {
-	return tools.WithEnforcementNotices(result.BaseModelOutput(), result.EnforcementNotices)
-}
-
-// HumanDisplay returns the presentation intended for interactive surfaces.
-func (result ToolResult) HumanDisplay() tools.Display {
-	display := result.BaseDisplay()
-	display.Summary = tools.WithEnforcementNotices(display.Summary, result.EnforcementNotices)
-	return display
-}
-
 // DenialCategory classifies why a tool call was blocked before it executed.
 type DenialCategory string
 

internal/cli/app.go

@@ -874,19 +874,6 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 		}
 		fmt.Fprintf(stderr, "warning: MCP server %s unavailable, skipped: %s\n", skipped.Name, redaction.ErrorMessage(skipped.Err, redaction.Options{}))
 	}
-	// AND WHAT THE SERVERS THAT DID START RAN UNDER. A stdio MCP server prepared
-	// with a weakened write jail serves the whole session from that process, so
-	// the disclosure is about startup and no later tool result can carry it. Said
-	// once, here, next to the skip warnings, rather than pasted onto every
-	// response the server produces. Network servers launch no local process and
-	// report nothing, which is why the optional background registration is not
-	// asked: its only member is the built-in HTTP default, which starts no local
-	// process. A stdio default would need this statement from that path too.
-	// NOT deferred: stderr here is the bare terminal, and the TUI takes it over at
-	// deps.runTUI below. Delivery stops before that hand-off, so a late launch can
-	// never write raw text into the alt screen; see stopMCPDisclosures's call site.
-	guardedStderr, stopMCPDisclosures := reportMCPStartupDisclosures(stderr, mcpRuntime)
-	stderr = guardedStderr
 	// Make local plugins live: register their declared tools into the registry and
 	// collect their hooks + skill roots for the dispatcher and skill tool below.
 	// Done after specialist + MCP registration so plugin tools are part of the
@@ -982,10 +969,6 @@ func runInteractiveTUIWithSetup(stderr io.Writer, deps appDeps, permissionMode a
 	// describes the sandbox they actually get.
 	startupNotices := []string{sandboxEngine.DegradedNotice()}
 	modelRPM := zeroruntime.NewModelRPMLimiter(resolved.ModelRPM)
-	// The terminal stops being ours on the next line. Stop and join the disclosure
-	// pump first: anything already queued is printed here, on this goroutine, and a
-	// launch that resolves later is dropped rather than written raw over the TUI.
-	stopMCPDisclosures()
 	return deps.runTUI(context.Background(), tui.Options{
 		ModelRPM:             modelRPM,
 		Cwd:                  workspaceRoot,

internal/cli/exec.go

@@ -365,18 +365,6 @@ func runExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 			return writeExecProviderError(stdout, stderr, options.outputFormat, "mcp_error", err.Error())
 		}
 		defer closeMCPRuntime(stderr, mcpRuntime)
-		// Said HERE, before --list-tools and before the first result, because both
-		// return early and the process this describes is already running by now. On
-		// stderr, so text, JSON and stream-JSON framing on stdout are untouched:
-		// this is the same channel the skipped-server and trust notices use.
-		// Deferred AFTER closeMCPRuntime was deferred, so it runs BEFORE it: the
-		// pump stops and joins while stderr is still ours, and only then are the
-		// clients closed.
-		// Adopt the guarded writer for the rest of startup: the pump is live from
-		// here until stop, and everything below writes to this same stderr.
-		guardedStderr, stopDisclosures := reportMCPStartupDisclosures(stderr, mcpRuntime)
-		stderr = guardedStderr
-		defer stopDisclosures()
 	}
 	pluginActivation = activatePlugins(workspaceRoot, registry, deps, stderr, trustRoot, executionRunner)
 	registerLocalControlTools(registry, workspaceRoot, resolved.LocalControl)
@@ -734,7 +722,25 @@ func runExec(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) in
 		},
 		OnToolResult: func(result agent.ToolResult) {
 			writer.toolResult(result)
-			sessionRecorder.append(sessions.EventToolResult, persistedToolResultPayload(result))
+			payload := map[string]any{
+				"toolCallId": result.ToolCallID,
+				"name":       result.Name,
+				"status":     string(result.Status),
+				"output":     result.Output,
+			}
+			if len(result.Meta) > 0 {
+				payload["meta"] = result.Meta
+			}
+			if result.Truncated {
+				payload["truncated"] = true
+			}
+			if result.Redacted {
+				payload["redacted"] = true
+			}
+			if len(result.ChangedFiles) > 0 {
+				payload["changedFiles"] = result.ChangedFiles
+			}
+			sessionRecorder.append(sessions.EventToolResult, payload)
 		},
 		OnUsage: func(u agent.Usage) {
 			writer.usage(u)
@@ -1498,28 +1504,3 @@ func writeTraceSnapshot(snapshot *trace.TurnTrace, dest string, stderr io.Writer
 	defer file.Close()
 	return trace.WriteNDJSON(file, snapshot)
 }
-
-// persistedToolResultPayload renders one tool result for the durable session
-// log.
-//
-// IT USES THE ACCESSOR, NOT THE RAW FIELD. agent.ToolResult stores the
-// undecorated model text alongside the typed enforcement notices, and
-// ModelOutput is what composes the two. Replay reads this payload straight back
-// into the transcript without reconstructing a ToolResult, so a disclosure that
-// is not rendered here is simply absent from resumed and compacted context even
-// though it was visible during the original run.
-//
-// Both headless writers go through this, because they previously spelled the
-// same payload separately and had already drifted: one persisted the raw field
-// while the stream writer used the accessor.
-func persistedToolResultPayload(result agent.ToolResult) map[string]any {
-	// ONE CONTRACT WITH THE TUI. This used to build its own payload with the
-	// decorated output only, and both writers append to the same default
-	// session store the TUI resumes from. A CLI-written result restored into
-	// the TUI therefore arrived without typed enforcement notices and without
-	// the undecorated card body, so a long collapsed result rendered no body
-	// and, with it, no disclosure. internal/agent owns the shape now, beside
-	// ToolResult, and every writer calls the same function rather than keeping
-	// a matching copy of it.
-	return agent.ToolResultSessionPayload(result)
-}

internal/cli/exec_payload_test.go

@@ -1,47 +0,0 @@
-package cli
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// THE HEADLESS WRITER PERSISTS THE SAME SHAPE THE TUI DOES.
-//
-// The tui-side restore test proves the shared payload restores a disclosure
-// exactly once; this proves the CLI actually WRITES that shared payload rather
-// than its own. The two used to be spelled separately and the headless one had
-// already drifted to decorated output only. Reverting the delegation leaves
-// the tui test green and fails this one, which is the point of having both.
-func TestHeadlessPayloadCarriesTypedNoticesAndUndecoratedBody(t *testing.T) {
-	const notice = "denyRead is configured, so the Windows sandbox uses the token shape without WRITE_RESTRICTED (#869)"
-	result := agent.ToolResult{
-		ToolCallID:         "call-cli",
-		Name:               "bash",
-		Status:             tools.StatusOK,
-		Output:             "PROBE-BODY",
-		Truncated:          true,
-		EnforcementNotices: []string{notice},
-	}
-	payload := persistedToolResultPayload(result)
-
-	notices, _ := payload["enforcementNotices"].([]string)
-	if len(notices) != 1 || notices[0] != notice {
-		t.Errorf("headless payload does not carry the typed notice: %#v", payload["enforcementNotices"])
-	}
-	preview, _ := payload["displayPreview"].(string)
-	if preview != "PROBE-BODY" {
-		t.Errorf("headless payload does not carry the undecorated body as displayPreview: %q", preview)
-	}
-	output, _ := payload["output"].(string)
-	if !strings.Contains(output, notice) || !strings.Contains(output, "PROBE-BODY") {
-		t.Errorf("provider-facing output is no longer the decorated text: %q", output)
-	}
-	// The one field the headless writer added on its own must survive the
-	// delegation, or a truncation marker silently stops being persisted.
-	if truncated, _ := payload["truncated"].(bool); !truncated {
-		t.Errorf("truncated flag was lost in the shared payload: %#v", payload["truncated"])
-	}
-}

internal/cli/exec_spec.go

@@ -161,7 +161,22 @@ func runExecSpecDraft(run execSpecDraftRun) int {
 			if info, ok := execSpecDraftInfoFromToolResult(result); ok {
 				draftInfo = info
 			}
-			sessionRecorder.append(sessions.EventToolResult, persistedToolResultPayload(result))
+			payload := map[string]any{
+				"toolCallId": result.ToolCallID,
+				"name":       result.Name,
+				"status":     string(result.Status),
+				"output":     result.Output,
+			}
+			if len(result.Meta) > 0 {
+				payload["meta"] = result.Meta
+			}
+			if result.Redacted {
+				payload["redacted"] = true
+			}
+			if len(result.ChangedFiles) > 0 {
+				payload["changedFiles"] = result.ChangedFiles
+			}
+			sessionRecorder.append(sessions.EventToolResult, payload)
 		},
 		OnUsage: func(u agent.Usage) {
 			writer.usage(u)

internal/cli/exec_startup_disclosure_test.go

@@ -1,127 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/mcp"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// disclosingExecRuntime is an MCP runtime that launched a process under reduced
-// enforcement.
-type disclosingExecRuntime struct {
-	noopMCPRuntime
-	disclosures []mcp.StartupDisclosure
-}
-
-func (r disclosingExecRuntime) StartupDisclosures() []mcp.StartupDisclosure { return r.disclosures }
-
-const execDisclosureNotice = "denyRead is configured, so the write jail is not confining writes"
-
-// isolateConfigDirs points every config/cache root at test-owned storage.
-//
-// Without it these tests build a sandbox engine against the developer's REAL
-// config dir, trigger the one-time grant migration there, and the migration
-// notice then turns up on a LATER test's stderr, failing whichever test happens
-// to assert an empty one. The failure moves between runs, which is what makes it
-// look like flakiness rather than contamination.
-func isolateConfigDirs(t *testing.T) {
-	t.Helper()
-	dir := t.TempDir()
-	t.Setenv("HOME", dir)
-	t.Setenv("USERPROFILE", dir)
-	t.Setenv("APPDATA", dir)
-	t.Setenv("LOCALAPPDATA", dir)
-	t.Setenv("XDG_CONFIG_HOME", dir)
-	t.Setenv("XDG_CACHE_HOME", dir)
-}
-
-func execDisclosureDeps(cwd string) appDeps {
-	return appDeps{
-		getwd:         func() (string, error) { return cwd, nil },
-		resolveConfig: func(string, config.Overrides) (config.ResolvedConfig, error) { return execResolvedConfig(), nil },
-		resolveMCPConfig: func(string, bool) (config.MCPConfig, error) {
-			return config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-				"docs": {Type: "stdio", Command: "docs-mcp"},
-			}}, nil
-		},
-		registerMCPTools: func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-			return disclosingExecRuntime{disclosures: []mcp.StartupDisclosure{
-				{Name: "docs", Notices: []string{execDisclosureNotice}},
-			}}, nil
-		},
-	}
-}
-
-// A HEADLESS RUN IS A DISCLOSURE SURFACE TOO.
-//
-// `zero exec` registers workspace MCP servers through the same sandbox-backed
-// runner interactive startup uses, so a stdio server here can launch under the
-// weakened token and serve the whole run. Reporting the disclosure only from the
-// TUI meant every text, JSON, stream-JSON and --list-tools caller was told
-// nothing about the enforcement trade, for a process that was already running.
-func TestExecReportsMCPStartupDisclosures(t *testing.T) {
-	isolateConfigDirs(t)
-	for _, format := range []string{"", "--output-format=json", "--output-format=stream-json"} {
-		name := format
-		if name == "" {
-			name = "text"
-		}
-		t.Run(name, func(t *testing.T) {
-			args := []string{"exec", "--list-tools"}
-			if format != "" {
-				args = append(args, format)
-			}
-			var stdout, stderr bytes.Buffer
-			if code := runWithDeps(args, &stdout, &stderr, execDisclosureDeps(t.TempDir())); code != exitSuccess {
-				t.Fatalf("exit = %d, stderr = %s", code, stderr.String())
-			}
-			if !strings.Contains(stderr.String(), execDisclosureNotice) {
-				t.Errorf("the headless run said nothing about the enforcement trade: %q", stderr.String())
-			}
-			if !strings.Contains(stderr.String(), "docs") {
-				t.Errorf("the report does not name the server: %q", stderr.String())
-			}
-			// The machine-readable surfaces must stay parseable: the disclosure
-			// belongs on stderr precisely so stdout framing is untouched.
-			if format == "--output-format=json" {
-				var any map[string]any
-				if err := json.Unmarshal(bytes.TrimSpace(stdout.Bytes()), &any); err != nil {
-					t.Errorf("stdout is no longer valid JSON: %v (%q)", err, stdout.String())
-				}
-			}
-			if format == "--output-format=stream-json" {
-				for _, line := range strings.Split(strings.TrimSpace(stdout.String()), "\n") {
-					if strings.TrimSpace(line) == "" {
-						continue
-					}
-					var any map[string]any
-					if err := json.Unmarshal([]byte(line), &any); err != nil {
-						t.Errorf("a stream-json line is not valid JSON: %v (%q)", err, line)
-					}
-				}
-			}
-		})
-	}
-}
-
-// A run whose servers launched nothing says nothing.
-func TestExecWithoutDisclosuresStaysQuiet(t *testing.T) {
-	isolateConfigDirs(t)
-	deps := execDisclosureDeps(t.TempDir())
-	deps.registerMCPTools = func(context.Context, *tools.Registry, config.MCPConfig, mcp.RegisterOptions) (mcpToolRuntime, error) {
-		return noopMCPRuntime{}, nil
-	}
-	var stdout, stderr bytes.Buffer
-	if code := runWithDeps([]string{"exec", "--list-tools"}, &stdout, &stderr, deps); code != exitSuccess {
-		t.Fatalf("exit = %d, stderr = %s", code, stderr.String())
-	}
-	if strings.Contains(stderr.String(), "reduced enforcement") {
-		t.Errorf("a run with nothing to disclose printed one: %q", stderr.String())
-	}
-}

internal/cli/mcp_late_disclosure_test.go

@@ -1,163 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/mcp"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// A LAUNCH THAT COMPLETES AFTER THE REPORTER HAS RUN MUST STILL BE SAID, ONCE,
-// AND ONLY WHILE SOMEONE OWNS THE WRITER.
-//
-// Both production paths call reportMCPStartupDisclosures exactly once, right
-// after RegisterTools returns. A stdio attempt abandoned at the connect timeout
-// can still be inside cmd.Start at that moment; the process then starts under
-// the reduced write confinement, the reaper closes its client, and a reporter
-// that merely SAMPLED the runtime has already come and gone. The retained sink
-// held the fact and nobody read it again, so the operator saw the skipped
-// server and never the disclosure.
-//
-// This drives the REAL reporter against a REAL runtime, rather than polling
-// StartupDisclosures by hand, which is what an earlier regression did and which
-// is precisely how it masked the original bug: a test that re-reads on the
-// tester's behalf proves nothing about a production path that does not.
-//
-// It also never reads stderr while the pump could write. The buffer is examined
-// only after stop has joined the pump, which is the same discipline both
-// production callers follow, and is why this passes under -race.
-func TestLateMCPLaunchReachesTheStartupReporterExactlyOnce(t *testing.T) {
-	const notice = "MCP server started without WRITE_RESTRICTED because denyRead is configured (#869)"
-	released := make(chan struct{})
-	published := make(chan struct{})
-
-	runtime, err := mcp.RegisterTools(context.Background(), tools.NewRegistry(),
-		config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-			"slow": {Type: "stdio", Command: "slow-mcp"},
-		}},
-		mcp.RegisterOptions{
-			ConnectTimeout: 50 * time.Millisecond,
-			ClientFactory: func(ctx context.Context, server mcp.Server) (mcp.ToolClient, error) {
-				// Held past the registration timeout AND past the settle grace, so
-				// registration has already reaped this attempt and returned.
-				<-released
-				mcp.PublishLaunchForTest(ctx, []string{notice})
-				// Publishing is synchronous into the stream, so by the time this
-				// closes the disclosure is queued and stop cannot race past it.
-				close(published)
-				return nil, errors.New("initialize failed long after start")
-			},
-		})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = runtime.Close() })
-
-	// The reporter runs ONCE, here, exactly as runExec and the interactive
-	// startup path run it: before the launch has resolved.
-	var stderr bytes.Buffer
-	_, stop := reportMCPStartupDisclosures(&stderr, runtime)
-
-	close(released)
-	<-published
-	// The owner ends delivery and joins the pump. Every write to the buffer has
-	// happened by the time this returns, so the reads below are unsynchronised
-	// only because there is no longer anything to synchronise with.
-	stop()
-
-	got := stderr.String()
-	if n := strings.Count(got, notice); n != 1 {
-		t.Fatalf("a launch that completed after the reporter ran was disclosed %d time(s), want exactly 1:\n%s", n, got)
-	}
-	if !strings.Contains(got, "MCP server slow started with reduced enforcement") {
-		t.Errorf("the late disclosure does not name the server:\n%s", got)
-	}
-	if skipped := runtime.Skipped(); len(skipped) != 1 {
-		t.Errorf("the server should still be recorded as skipped: %#v", skipped)
-	}
-}
-
-// And a server whose launch was already known when the reporter ran is said
-// once by it, and not again by the late path.
-func TestKnownMCPLaunchIsNotReportedTwice(t *testing.T) {
-	const notice = "MCP server started under reduced enforcement"
-	runtime, err := mcp.RegisterTools(context.Background(), tools.NewRegistry(),
-		config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-			"fast": {Type: "stdio", Command: "fast-mcp"},
-		}},
-		mcp.RegisterOptions{
-			ConnectTimeout: time.Second,
-			ClientFactory: func(ctx context.Context, server mcp.Server) (mcp.ToolClient, error) {
-				mcp.PublishLaunchForTest(ctx, []string{notice})
-				return nil, errors.New("initialize failed after start")
-			},
-		})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = runtime.Close() })
-
-	var stderr bytes.Buffer
-	_, stop := reportMCPStartupDisclosures(&stderr, runtime)
-	stop()
-	if n := strings.Count(stderr.String(), notice); n != 1 {
-		t.Fatalf("a launch known at registration was disclosed %d time(s), want exactly 1:\n%s", n, stderr.String())
-	}
-}
-
-// THE OWNERSHIP BOUNDARY ITSELF: once the caller has stopped delivery, nothing
-// may write to its writer again.
-//
-// This is the property that the retained presentation callback could not hold.
-// It invoked the CLI's print function from the abandoned connect goroutine
-// whenever the launch happened to resolve, so a write could land after runExec
-// had returned or after Bubble Tea had taken the alt screen. The interactive
-// path stops delivery on the line before it hands over the terminal, and this
-// pins what that buys: a launch resolving afterwards is dropped, not printed.
-func TestMCPDisclosureAfterStopIsDroppedNotWritten(t *testing.T) {
-	const notice = "MCP server started under reduced enforcement"
-	released := make(chan struct{})
-	published := make(chan struct{})
-
-	runtime, err := mcp.RegisterTools(context.Background(), tools.NewRegistry(),
-		config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-			"slow": {Type: "stdio", Command: "slow-mcp"},
-		}},
-		mcp.RegisterOptions{
-			ConnectTimeout: 50 * time.Millisecond,
-			ClientFactory: func(ctx context.Context, server mcp.Server) (mcp.ToolClient, error) {
-				<-released
-				mcp.PublishLaunchForTest(ctx, []string{notice})
-				close(published)
-				return nil, errors.New("initialize failed long after start")
-			},
-		})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = runtime.Close() })
-
-	var stderr bytes.Buffer
-	_, stop := reportMCPStartupDisclosures(&stderr, runtime)
-	// The owner gives up the writer BEFORE the launch resolves, which is the
-	// interactive hand-off to the TUI.
-	stop()
-
-	close(released)
-	<-published
-	// Asserting an absence, so the wrong behaviour is given time to appear: once
-	// publishing has returned the disclosure is queued, and a delivery path that
-	// outlived stop would have this long to print it. With delivery ended and the
-	// pump joined there is no writer left, so this window changes nothing.
-	time.Sleep(50 * time.Millisecond)
-
-	if got := stderr.String(); got != "" {
-		t.Fatalf("a launch that resolved after the owner stopped still wrote to its writer: %q", got)
-	}
-}

internal/cli/mcp_startup_disclosure_test.go

@@ -1,52 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/mcp"
-)
-
-type disclosingRuntime struct {
-	noopMCPRuntime
-	disclosures []mcp.StartupDisclosure
-}
-
-func (runtime disclosingRuntime) StartupDisclosures() []mcp.StartupDisclosure {
-	return runtime.disclosures
-}
-
-// SAID ONCE, WHERE THE USER IS ALREADY BEING TOLD WHAT STARTED.
-//
-// The disclosure describes a server PROCESS, which serves the whole session, so
-// it cannot ride on a tool result and must not be repeated on every one.
-func TestStartupDisclosuresAreReportedOnce(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-	var stderr bytes.Buffer
-	reportMCPStartupDisclosures(&stderr, disclosingRuntime{
-		disclosures: []mcp.StartupDisclosure{{Name: "docs", Notices: []string{notice}}},
-	})
-	output := stderr.String()
-	if count := strings.Count(output, notice); count != 1 {
-		t.Errorf("the disclosure appears %d times, want exactly 1: %q", count, output)
-	}
-	if !strings.Contains(output, "docs") {
-		t.Errorf("the report does not name the server it is about: %q", output)
-	}
-}
-
-// A run with nothing to disclose prints nothing at all.
-func TestNoStartupDisclosuresPrintNothing(t *testing.T) {
-	var stderr bytes.Buffer
-	reportMCPStartupDisclosures(&stderr, disclosingRuntime{})
-	if stderr.Len() != 0 {
-		t.Errorf("a run with no disclosure wrote %q", stderr.String())
-	}
-	stderr.Reset()
-	// And a runtime that launches nothing is not required to answer.
-	reportMCPStartupDisclosures(&stderr, noopMCPRuntime{})
-	if stderr.Len() != 0 {
-		t.Errorf("a runtime that launches nothing wrote %q", stderr.String())
-	}
-}

internal/cli/mcp_tools.go

@@ -3,11 +3,9 @@ package cli
 import (
 	"context"
 	"fmt"
-	"io"
 	"net/url"
 	"sort"
 	"strings"
-	"sync"
 
 	"github.com/Twigpine/zero/internal/config"
 	"github.com/Twigpine/zero/internal/execution"
@@ -192,107 +190,3 @@ func isSensitiveMCPDisplayKey(key string) bool {
 	}
 	return false
 }
-
-// mcpStartupDisclosing is the optional interface a runtime implements when it
-// can report what its launched server processes ran under. Optional rather than
-// part of mcpToolRuntime so a runtime that launches nothing, and every test
-// double, stays unchanged.
-type mcpStartupDisclosing interface {
-	StartupDisclosures() []mcp.StartupDisclosure
-}
-
-// mcpStartupStreaming is the push form: the runtime queues each disclosure as a
-// typed event, including a launch that completes after registration returned,
-// and this package drains it on the goroutine that owns stderr.
-type mcpStartupStreaming interface {
-	StartupDisclosureStream() *mcp.StartupDisclosureStream
-}
-
-// reportMCPStartupDisclosures states once what enforcement applied to the MCP
-// server processes this run launched.
-//
-// A PUSH, NOT A SAMPLE. This used to read StartupDisclosures once, here, and a
-// stdio attempt abandoned at the connect timeout could still be inside cmd.Start
-// at that moment. The process then started under the reduced write confinement,
-// the reaper closed its client, and nothing read the runtime again: the operator
-// saw the skipped-server warning and never the disclosure.
-//
-// THIS GOROUTINE OWNS THE WRITER. The runtime queues typed disclosures; every
-// write to stderr happens either on the caller's goroutine (the set already known
-// when this returns, in server order, so startup output keeps its order) or on
-// the single pump started here, never both at once and never after stop.
-//
-// The returned stop ends delivery and joins the pump, so no write to stderr can
-// outlive the caller's ownership of it. The caller must run it before handing the
-// terminal to anything else. A disclosure that arrives after stop is dropped: it
-// is worth printing while someone owns the writer, and worth losing rather than
-// writing into a screen that now belongs to Bubble Tea. Anything already queued
-// when stop runs is still printed, on the caller's goroutine, with the pump
-// already finished.
-//
-// ONE WRITER, ONE CALLER AT A TIME. Joining the pump stops writes after its
-// lifetime but does nothing about the overlap: startup keeps emitting plugin,
-// trust, peer, provider and validation output to the same writer while the pump
-// is live. That is unsafe for an ordinary bytes.Buffer and interleaves lines even
-// on a writer that tolerates concurrent calls. A mutex private to the pump would
-// not help, because the other writes do not go through it. So the returned writer
-// is a guarded view of the caller's, and the caller adopts it for the rest of
-// startup; both sides then take the same lock.
-//
-// The pull form is kept for a runtime that implements no stream, which today is
-// only test doubles; it has no late launches to deliver, so its stop is a no-op
-// and its writer is handed back unchanged.
-func reportMCPStartupDisclosures(stderr io.Writer, runtime mcpToolRuntime) (guarded io.Writer, stop func()) {
-	serialized := &serializedWriter{writer: stderr}
-	print := func(disclosure mcp.StartupDisclosure) {
-		for _, notice := range disclosure.Notices {
-			fmt.Fprintf(serialized, "notice: MCP server %s started with reduced enforcement: %s\n", disclosure.Name, notice)
-		}
-	}
-	printAll := func(disclosures []mcp.StartupDisclosure) {
-		for _, disclosure := range disclosures {
-			print(disclosure)
-		}
-	}
-	streaming, ok := runtime.(mcpStartupStreaming)
-	if !ok {
-		if disclosing, ok := runtime.(mcpStartupDisclosing); ok {
-			printAll(disclosing.StartupDisclosures())
-		}
-		return stderr, func() {}
-	}
-	stream := streaming.StartupDisclosureStream()
-	if stream == nil {
-		return stderr, func() {}
-	}
-	printAll(stream.Drain())
-	pumped := make(chan struct{})
-	go func() {
-		defer close(pumped)
-		for stream.Wait() {
-			printAll(stream.Drain())
-		}
-	}()
-	var once sync.Once
-	return serialized, func() {
-		once.Do(func() {
-			stream.Close()
-			<-pumped
-			printAll(stream.Drain())
-		})
-	}
-}
-
-// serializedWriter gives one underlying writer a single owner at a time, so the
-// late-disclosure pump and the foreground startup path cannot be inside it
-// together.
-type serializedWriter struct {
-	mu     sync.Mutex
-	writer io.Writer
-}
-
-func (w *serializedWriter) Write(data []byte) (int, error) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	return w.writer.Write(data)
-}

internal/cli/mcp_writer_ownership_test.go

@@ -1,146 +0,0 @@
-package cli
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"strings"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/mcp"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// blockingWriter makes the overlap deterministic instead of hoping to hit it.
-//
-// The first write parks inside Write until the test releases it, which is the
-// window the pump and the foreground startup path really share: startup keeps
-// emitting plugin, trust, peer and provider output to the same stderr while a
-// late MCP disclosure can arrive at any moment. It also records whether it was
-// ever entered twice at once, which is the property under test.
-type blockingWriter struct {
-	mu       sync.Mutex
-	inside   int
-	overlaps int
-	buf      bytes.Buffer
-
-	block    chan struct{}
-	blockOne sync.Once
-	entered  chan struct{}
-}
-
-func newBlockingWriter() *blockingWriter {
-	return &blockingWriter{block: make(chan struct{}), entered: make(chan struct{})}
-}
-
-func (w *blockingWriter) Write(data []byte) (int, error) {
-	w.mu.Lock()
-	w.inside++
-	if w.inside > 1 {
-		w.overlaps++
-	}
-	w.mu.Unlock()
-
-	// Only the first writer parks, and it announces that it is inside.
-	first := false
-	w.blockOne.Do(func() {
-		first = true
-		close(w.entered)
-	})
-	if first {
-		<-w.block
-	}
-
-	w.mu.Lock()
-	n, err := w.buf.Write(data)
-	w.inside--
-	w.mu.Unlock()
-	return n, err
-}
-
-func (w *blockingWriter) overlapCount() int {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	return w.overlaps
-}
-
-func (w *blockingWriter) String() string {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	return w.buf.String()
-}
-
-// ONE CALLER AT A TIME, FOR THE WHOLE OVERLAP.
-//
-// Joining the pump at stop bounds writes to the pump's lifetime but says nothing
-// about what happens DURING it. The startup paths keep writing to the same
-// io.Writer the whole time, and the caller may legitimately hand in a plain
-// bytes.Buffer, which corrupts under concurrent use. A mutex private to the pump
-// would not have helped, because the foreground writes do not go through it; the
-// reporter therefore hands back a guarded view of the caller's writer and the
-// caller adopts it, so both sides take the same lock.
-func TestLateDisclosureAndForegroundStartupNeverShareTheWriter(t *testing.T) {
-	const notice = "MCP server started under reduced enforcement"
-	released := make(chan struct{})
-	published := make(chan struct{})
-
-	runtime, err := mcp.RegisterTools(context.Background(), tools.NewRegistry(),
-		config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-			"slow": {Type: "stdio", Command: "slow-mcp"},
-		}},
-		mcp.RegisterOptions{
-			ConnectTimeout: 50 * time.Millisecond,
-			ClientFactory: func(ctx context.Context, server mcp.Server) (mcp.ToolClient, error) {
-				<-released
-				mcp.PublishLaunchForTest(ctx, []string{notice})
-				close(published)
-				return nil, errors.New("initialize failed long after start")
-			},
-		})
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = runtime.Close() })
-
-	writer := newBlockingWriter()
-	guarded, stop := reportMCPStartupDisclosures(writer, runtime)
-	if guarded == io.Writer(writer) {
-		t.Fatal("SETUP INVALID: the reporter handed back the raw writer, so the caller cannot share its lock")
-	}
-
-	// Foreground startup writes through the guarded writer and parks inside it,
-	// exactly as a slow terminal would.
-	foregroundDone := make(chan struct{})
-	go func() {
-		defer close(foregroundDone)
-		fmt.Fprintln(guarded, "warning: MCP server other unavailable, skipped: dial tcp: refused")
-	}()
-	<-writer.entered
-
-	// While the foreground write is parked, the late launch resolves and the pump
-	// tries to print. If the two did not share a lock, this would enter Write
-	// concurrently.
-	close(released)
-	<-published
-	time.Sleep(50 * time.Millisecond)
-
-	close(writer.block)
-	<-foregroundDone
-	stop()
-
-	if n := writer.overlapCount(); n != 0 {
-		t.Fatalf("the pump and foreground startup were inside the writer together %d time(s)", n)
-	}
-	got := writer.String()
-	if count := strings.Count(got, notice); count != 1 {
-		t.Fatalf("the late disclosure was written %d time(s), want exactly 1 after stop drained it:\n%s", count, got)
-	}
-	if !strings.Contains(got, "unavailable, skipped") {
-		t.Errorf("the foreground startup message was lost:\n%s", got)
-	}
-}

internal/cli/persisted_tool_result_test.go

@@ -1,72 +0,0 @@
-package cli
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/agent"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// A DISCLOSURE THAT IS NOT PERSISTED DID NOT SURVIVE THE RUN.
-//
-// The session log is what a resumed or compacted conversation is rebuilt from,
-// and replay reads this payload's "output" straight into the transcript without
-// reconstructing an agent.ToolResult. So persisting the raw undecorated field
-// makes a warning that was visible during the original run disappear the moment
-// the session is resumed, with nothing failing anywhere to say so.
-func TestPersistedToolResultKeepsTheEnforcementNotice(t *testing.T) {
-	const notice = "least-privilege notice: read access was narrowed"
-	payload := persistedToolResultPayload(agent.ToolResult{
-		ToolCallID:         "call-1",
-		Name:               "bash",
-		Status:             tools.StatusOK,
-		Output:             "the command output",
-		EnforcementNotices: []string{notice},
-	})
-
-	output, _ := payload["output"].(string)
-	if count := strings.Count(output, notice); count != 1 {
-		t.Errorf("persisted output carries the notice %d times, want exactly 1: %q", count, output)
-	}
-	if !strings.Contains(output, "the command output") {
-		t.Errorf("persisted output lost the command output: %q", output)
-	}
-}
-
-// The other fields still round-trip, so the shared helper did not quietly drop
-// what the two writers used to record separately.
-func TestPersistedToolResultKeepsItsOtherFields(t *testing.T) {
-	payload := persistedToolResultPayload(agent.ToolResult{
-		ToolCallID:   "call-2",
-		Name:         "write_file",
-		Status:       tools.StatusError,
-		Output:       "boom",
-		Meta:         map[string]string{"k": "v"},
-		Truncated:    true,
-		Redacted:     true,
-		ChangedFiles: []string{"a.go"},
-	})
-	for _, field := range []string{"toolCallId", "name", "status", "output", "meta", "truncated", "redacted", "changedFiles"} {
-		if _, ok := payload[field]; !ok {
-			t.Errorf("payload is missing %q: %#v", field, payload)
-		}
-	}
-	if payload["status"] != string(tools.StatusError) {
-		t.Errorf("status = %v, want %q", payload["status"], tools.StatusError)
-	}
-}
-
-// An ordinary result records exactly what it did before, so the accessor is not
-// adding anything where there is nothing to add.
-func TestPersistedToolResultLeavesAnOrdinaryResultAlone(t *testing.T) {
-	payload := persistedToolResultPayload(agent.ToolResult{
-		ToolCallID: "call-3",
-		Name:       "bash",
-		Status:     tools.StatusOK,
-		Output:     "plain output",
-	})
-	if got := payload["output"]; got != "plain output" {
-		t.Errorf("persisted output = %v, want it untouched", got)
-	}
-}

internal/cli/sandbox.go

@@ -174,7 +174,7 @@ func runSandboxSetup(args []string, stdout io.Writer, stderr io.Writer, deps app
 	if !setupHelper.Available() {
 		return writeAppError(stderr, "Windows sandbox setup helper is not available", exitProvider)
 	}
-	setupArgs, err := zeroSandbox.BuildWindowsSandboxSetupArgs(zeroSandbox.WindowsSandboxSetupArgsOptions{
+	setupPlan, err := zeroSandbox.BuildWindowsSandboxSetupArgs(zeroSandbox.WindowsSandboxSetupArgsOptions{
 		CommandCWD:        workspaceRoot,
 		WorkspaceRoots:    []string{workspaceRoot},
 		PermissionProfile: profile,
@@ -182,9 +182,18 @@ func runSandboxSetup(args []string, stdout io.Writer, stderr io.Writer, deps app
 	if err != nil {
 		return writeAppError(stderr, err.Error(), exitCrash)
 	}
-	setupArgs = append(append([]string{}, setupHelper.ArgsPrefix...), setupArgs...)
+	setupArgs := append(append([]string{}, setupHelper.ArgsPrefix...), setupPlan.Args...)
+	// BUILDING THE ARGS ALREADY WROTE TO DISK. Selecting the runtime root takes a
+	// lease, and taking a lease creates the runtime tree and the lease file when
+	// they are not there. A helper that never publishes a marker leaves that tree
+	// behind, attested by nothing, so the undo belongs on this side of the process
+	// boundary where the record of it lives.
 	if err := deps.runSandboxSetupHelper(setupHelper.Name, setupArgs, stdout, stderr); err != nil {
-		return writeAppError(stderr, "Windows sandbox setup failed: "+err.Error(), exitProvider)
+		message := "Windows sandbox setup failed: " + err.Error()
+		if undo := setupPlan.Rollback(); undo != nil {
+			message += "\nleftover sandbox runtime state could not be removed: " + undo.Error()
+		}
+		return writeAppError(stderr, message, exitProvider)
 	}
 	return writeSandboxSetupResult(stdout, options.json, sandboxSetupResult{
 		Platform: "windows",

internal/doctor/hardening.go

@@ -99,11 +99,77 @@ func windowsSandboxSetupCheck(goos string, backend sandbox.Backend, workspaceRoo
 		return &result
 	}
 	profile := sandbox.PermissionProfileFromPolicy(workspaceRoot, doctorSandboxPolicy(sandboxConfig), scope)
+	// A RECORDED ROOT IS HISTORY, NOT PROOF. Doctor pins the marker's runtime
+	// root so the stamp check can run without taking a lease, but a command does
+	// not pin blindly: it derives the current cache and fallback candidates and
+	// honours the marker only when its root is one of them. Run setup with the
+	// cache at A, relocate the cache so commands derive B, and the stamped A tree
+	// remains: pinning A here reported a healthy sandbox immediately before every
+	// real command rejected A and failed on the out-of-date marker.
+	//
+	// So ask the command's own question first, through the command's own
+	// function. Only a root a command would still select is used to validate
+	// the marker; anything else is reported as out of date, with the remedy.
+	//
+	// THREE STATES, NOT TWO. The helper answers current, stale, or "I could not
+	// tell", and the last one used to fall through to the pinned branch: a valid
+	// old marker then made doctor report healthy while selectSandboxRuntimeRoot,
+	// reached by BuildCommandPlan, propagated the same resolution error and stopped
+	// every command from launching. Historical state is not a substitute for a
+	// failed current selection, so an error is surfaced as its own warning with the
+	// cause, and the pinned validation profile is built only once currentness has
+	// actually been established.
+	recorded, current, rootErr := sandbox.WindowsSandboxRecordedRuntimeRootIsCurrent(sandboxHome, workspaceRoot)
+	if rootErr != nil {
+		result := check("sandbox.backend", "Sandbox backend", StatusWarn, fmt.Sprintf("Native sandbox backend %s is installed, but the runtime root a command would select cannot be resolved (%s), so the recorded setup cannot be trusted and commands are likely to fail to launch.", backend.Name, rootErr.Error()), map[string]any{
+			"backend":      string(backend.Name),
+			"platform":     goos,
+			"supportLevel": string(backend.SupportLevel()),
+			"setupStatus":  "runtime-root-unresolved",
+			"error":        rootErr.Error(),
+			"remedy":       "run `zero sandbox setup` to prepare the Windows native sandbox for the current cache location",
+		})
+		return &result
+	}
+	if recorded != "" && !current {
+		result := check("sandbox.backend", "Sandbox backend", StatusWarn, fmt.Sprintf("Native sandbox backend %s is installed, but the runtime root setup recorded (%s) is not one a command would select now, so the setup is out of date.", backend.Name, recorded), map[string]any{
+			"backend":      string(backend.Name),
+			"platform":     goos,
+			"supportLevel": string(backend.SupportLevel()),
+			"setupStatus":  "runtime-root-stale",
+			"runtimeRoot":  recorded,
+			"remedy":       "run `zero sandbox setup` to prepare the Windows native sandbox for the current cache location",
+		})
+		return &result
+	}
 	setupConfig := sandbox.WindowsSandboxSetupConfig{
-		SandboxHome:       sandboxHome,
-		CommandCWD:        workspaceRoot,
-		WorkspaceRoots:    []string{workspaceRoot},
-		PermissionProfile: profile,
+		SandboxHome:    sandboxHome,
+		CommandCWD:     workspaceRoot,
+		WorkspaceRoots: []string{workspaceRoot},
+		// The same augmentation setup and the command plan apply, so doctor
+		// fingerprints what a real command fingerprints. Checking the bare profile
+		// made doctor call a correctly prepared machine "out of date", which is the
+		// mismatch this pairing exists to close. Safe to resolve in this process:
+		// doctor runs in the operator's shell, not behind the sandbox TEMP
+		// redirection that stops the runner deriving these for itself.
+		//
+		// The RECORDED runtime root goes on the profile as well, because that is
+		// what makes the stamp check run at all. Without it profile.Runtime is nil,
+		// validateWindowsSandboxRuntimeStamp returns nil early, and doctor reported
+		// a healthy sandbox on a machine whose runtime tree had been evicted and
+		// silently recreated without the capability ACE -- precisely the state the
+		// stamp exists to catch, and the state where every sandboxed command then
+		// fails with nothing explaining why.
+		//
+		// Read from the marker rather than selected, so doctor takes no lease and
+		// creates nothing, and read ONCE: this is the root whose currentness was
+		// checked above, not a second read that a rewritten marker could change. A
+		// marker from an older schema records no root, which leaves this exactly as
+		// it was.
+		PermissionProfile: sandbox.WindowsSandboxProfileWithRuntimeRoots(
+			sandbox.PermissionProfileWithRuntimeRoot(profile, recorded),
+			[]string{workspaceRoot},
+		),
 	}
 	if err := sandbox.ValidateWindowsSandboxSetupMarker(setupConfig); err != nil {
 		result := check("sandbox.backend", "Sandbox backend", StatusWarn, fmt.Sprintf("Native sandbox backend %s is installed, but Windows sandbox setup is missing or out of date: %v.", backend.Name, err), map[string]any{

internal/doctor/windows_runtime_stamp_test.go

@@ -0,0 +1,247 @@
+package doctor
+
+import (
+	"os"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/Twigpine/zero/internal/config"
+	"github.com/Twigpine/zero/internal/sandbox"
+)
+
+// DOCTOR HAS TO ASK THE ONE QUESTION THE MARKER CANNOT ANSWER.
+//
+// The marker hashes ACL-plan entries, which are pathnames. Whether the directory
+// those pathnames resolve to is still the tree setup provisioned is a different
+// question, and the runtime stamp is what answers it. validateWindowsSandboxRuntimeStamp
+// returns nil early when profile.Runtime is nil, which is correct for the setup
+// side and for unrestricted profiles, and was wrong here: doctor built its
+// profile with PermissionProfileFromPolicy, which never sets Runtime, so the
+// check was skipped and `zero doctor` reported a healthy sandbox on exactly the
+// state the stamp was added to detect -- an evicted runtime tree, silently
+// recreated with ordinary permissions and no capability ACE, where every
+// sandboxed command then fails with nothing explaining why.
+// doctorRuntimeCandidate returns a runtime root this workspace would really
+// select, taken from the candidate set the Windows plan folds in.
+//
+// It has to be a REAL candidate. An arbitrary path is already in the ACL plan on
+// one side and not the other, so the plan hashes diverge and validation fails
+// before the stamp is ever consulted -- which would make this test fail without
+// the fix for a reason that has nothing to do with the stamp.
+// redirectUserCache points os.UserCacheDir at test-owned storage.
+//
+// WITHOUT THIS THE TEST WRITES INTO THE DEVELOPER'S REAL CACHE. The runtime
+// candidate is derived from the process's actual user cache directory, so the
+// test was creating, recursively removing, recreating and then cleanup-removing
+// a directory under the real %LocalAppData%zerountime (or ~/.cache/zero on
+// Unix). The workspace digest made a collision with a live runtime tree
+// unlikely rather than impossible, and "unlikely" is not the standard for a
+// test that calls RemoveAll.
+//
+// All three variables, because os.UserCacheDir reads a different one per
+// platform: %LocalAppData% on Windows, $XDG_CACHE_HOME or $HOME on Unix, and
+// $HOME on macOS.
+func redirectUserCache(t *testing.T) {
+	t.Helper()
+	cache := t.TempDir()
+	t.Setenv("LOCALAPPDATA", cache)
+	t.Setenv("XDG_CACHE_HOME", cache)
+	t.Setenv("HOME", cache)
+}
+
+func doctorRuntimeCandidate(t *testing.T, workspace string) string {
+	t.Helper()
+	bare := doctorProfile(t, workspace)
+	augmented := sandbox.WindowsSandboxProfileWithRuntimeRoots(bare, []string{workspace})
+	existing := map[string]bool{}
+	for _, root := range bare.FileSystem.WriteRoots {
+		existing[root.Root] = true
+	}
+	for _, root := range augmented.FileSystem.WriteRoots {
+		if !existing[root.Root] {
+			return root.Root
+		}
+	}
+	t.Skip("no runtime candidate is derivable in this environment")
+	return ""
+}
+
+func doctorProfile(t *testing.T, workspace string) sandbox.PermissionProfile {
+	t.Helper()
+	scope, err := sandbox.NewScope(workspace, nil)
+	if err != nil {
+		t.Fatalf("NewScope: %v", err)
+	}
+	return sandbox.PermissionProfileFromPolicy(workspace, doctorSandboxPolicy(config.SandboxConfig{}), scope)
+}
+
+func writeDoctorSetupMarker(t *testing.T, home, workspace, runtimeRoot string) {
+	t.Helper()
+	profile := doctorProfile(t, workspace)
+	setup := sandbox.WindowsSandboxSetupConfig{
+		SandboxHome:    home,
+		CommandCWD:     workspace,
+		WorkspaceRoots: []string{workspace},
+		PermissionProfile: sandbox.WindowsSandboxProfileWithRuntimeRoots(
+			sandbox.PermissionProfileWithRuntimeRoot(profile, runtimeRoot),
+			[]string{workspace},
+		),
+	}
+	if _, err := sandbox.WriteWindowsSandboxSetupMarker(setup); err != nil {
+		t.Fatalf("WriteWindowsSandboxSetupMarker: %v", err)
+	}
+}
+
+func TestDoctorReportsAnEvictedRuntimeTree(t *testing.T) {
+	home := t.TempDir()
+	workspace := t.TempDir()
+	t.Setenv("ZERO_WINDOWS_SANDBOX_HOME", home)
+	redirectUserCache(t)
+
+	runtimeRoot := doctorRuntimeCandidate(t, workspace)
+	// Belt and braces: if the redirection above ever stops working, fail loudly
+	// rather than quietly operating on the developer's real cache.
+	if !strings.HasPrefix(runtimeRoot, os.TempDir()) && !strings.Contains(runtimeRoot, t.Name()) {
+		t.Fatalf("the runtime candidate %q is outside test-owned storage; this test creates and removes that path", runtimeRoot)
+	}
+	if err := os.MkdirAll(runtimeRoot, 0o700); err != nil {
+		t.Fatalf("create the runtime root: %v", err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(runtimeRoot) })
+	writeDoctorSetupMarker(t, home, workspace, runtimeRoot)
+
+	backend := sandbox.Backend{Name: sandbox.BackendWindowsRestrictedToken}
+
+	// A healthy machine first, or the eviction assertion below would be satisfied
+	// by a check that warns unconditionally.
+	if result := windowsSandboxSetupCheck("windows", backend, workspace, config.SandboxConfig{}); result != nil {
+		t.Fatalf("a freshly set-up machine was reported unhealthy: %s", result.Message)
+	}
+
+	// cleanupSandboxRuntimeRoots evicts inactive roots on an age and count policy,
+	// and the next run recreates the pathname with inherited permissions. The plan
+	// hash never moves, so only the stamp can tell.
+	if err := os.RemoveAll(runtimeRoot); err != nil {
+		t.Fatalf("evict the runtime root: %v", err)
+	}
+	if err := os.MkdirAll(runtimeRoot, 0o700); err != nil {
+		t.Fatalf("recreate the pathname the way an ordinary run would: %v", err)
+	}
+
+	result := windowsSandboxSetupCheck("windows", backend, workspace, config.SandboxConfig{})
+	if result == nil {
+		t.Fatal("doctor reported a healthy sandbox while the provisioned runtime tree was gone; every sandboxed command on this machine would fail with nothing explaining why")
+	}
+	if !strings.Contains(strings.ToLower(result.Message), "setup") {
+		t.Errorf("the warning does not point at setup: %s", result.Message)
+	}
+}
+
+// UNKNOWN IS NOT CURRENT.
+//
+// WindowsSandboxRecordedRuntimeRootIsCurrent answers three ways: the recorded
+// root is still one a command would select, it is not, or the inputs a command
+// selects from cannot be resolved at all. The third used to fall through to the
+// pinned branch, so a valid old marker and stamp made doctor report healthy
+// while selectSandboxRuntimeRoot — reached by BuildCommandPlan — propagated the
+// same resolution failure and stopped every command from launching. Doctor and
+// the command disagreed about the same machine.
+//
+// Stale and unknown are different states, so this is deliberately separate from
+// the cache-A-to-cache-B test rather than another assertion on the same boolean.
+func TestDoctorWarnsWhenTheRuntimeRootCannotBeResolved(t *testing.T) {
+	home := t.TempDir()
+	workspace := t.TempDir()
+	t.Setenv("ZERO_WINDOWS_SANDBOX_HOME", home)
+	redirectUserCache(t)
+
+	runtimeRoot := doctorRuntimeCandidate(t, workspace)
+	if !strings.HasPrefix(runtimeRoot, os.TempDir()) && !strings.Contains(runtimeRoot, t.Name()) {
+		t.Fatalf("the runtime candidate %q is outside test-owned storage", runtimeRoot)
+	}
+	if err := os.MkdirAll(runtimeRoot, 0o700); err != nil {
+		t.Fatalf("create the runtime root: %v", err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(runtimeRoot) })
+	writeDoctorSetupMarker(t, home, workspace, runtimeRoot)
+
+	backend := sandbox.Backend{Name: sandbox.BackendWindowsRestrictedToken}
+
+	// Healthy first, so the assertion below cannot be satisfied by a check that
+	// warns unconditionally.
+	if result := windowsSandboxSetupCheck("windows", backend, workspace, config.SandboxConfig{}); result != nil {
+		t.Fatalf("SETUP INVALID: a freshly set-up machine was reported unhealthy: %s", result.Message)
+	}
+
+	// Now take away the inputs the selection is derived from, leaving the marker
+	// and the provisioned tree exactly as they were. os.UserCacheDir fails with no
+	// location to read, which is the same error a command would hit.
+	t.Setenv("LOCALAPPDATA", "")
+	t.Setenv("XDG_CACHE_HOME", "")
+	t.Setenv("HOME", "")
+
+	result := windowsSandboxSetupCheck("windows", backend, workspace, config.SandboxConfig{})
+	if result == nil {
+		t.Fatal("doctor reported a healthy sandbox while the runtime root a command selects could not be resolved; every command would fail to launch with doctor saying nothing")
+	}
+	if status, _ := result.Details["setupStatus"].(string); status != "runtime-root-unresolved" {
+		t.Errorf("setupStatus = %q, want runtime-root-unresolved so the unknown state is not reported as staleness: %s", status, result.Message)
+	}
+	if _, ok := result.Details["error"]; !ok {
+		t.Errorf("the warning does not carry the resolver cause, so an operator cannot act on it: %+v", result.Details)
+	}
+}
+
+// A CACHE DIRECTORY THAT RESOLVES TO NOTHING IS UNRESOLVED TOO, not only one
+// that fails to resolve. os.UserCacheDir succeeds on a value like "." and the
+// selection a command makes refuses it after canonicalizing, with "user cache
+// directory is unavailable". The diagnostic behind this check did not, so doctor
+// went on to compare the recorded root against candidates derived from an empty
+// cache root and reported staleness, which sends an operator to re-run setup on
+// a machine where setup cannot select a root either.
+//
+// The sandbox package pins the two entry points to one error through the
+// resolver seam on every platform. This is the consumer's half, and it is
+// Windows-only because that is where the environment can produce the value:
+// %LocalAppData% is returned as it is, while a relative XDG_CACHE_HOME is an
+// error on Linux and a relative HOME still joins to a usable path on macOS.
+// Reported by @jatmn.
+func TestDoctorReportsAnEmptyCacheRootAsUnresolvedNotStale(t *testing.T) {
+	if runtime.GOOS != "windows" {
+		t.Skip("only %LocalAppData% hands os.UserCacheDir a value that canonicalizes to nothing")
+	}
+	home := t.TempDir()
+	workspace := t.TempDir()
+	t.Setenv("ZERO_WINDOWS_SANDBOX_HOME", home)
+	redirectUserCache(t)
+
+	runtimeRoot := doctorRuntimeCandidate(t, workspace)
+	if !strings.HasPrefix(runtimeRoot, os.TempDir()) && !strings.Contains(runtimeRoot, t.Name()) {
+		t.Fatalf("the runtime candidate %q is outside test-owned storage", runtimeRoot)
+	}
+	if err := os.MkdirAll(runtimeRoot, 0o700); err != nil {
+		t.Fatalf("create the runtime root: %v", err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(runtimeRoot) })
+	writeDoctorSetupMarker(t, home, workspace, runtimeRoot)
+
+	backend := sandbox.Backend{Name: sandbox.BackendWindowsRestrictedToken}
+	if result := windowsSandboxSetupCheck("windows", backend, workspace, config.SandboxConfig{}); result != nil {
+		t.Fatalf("SETUP INVALID: a freshly set-up machine was reported unhealthy: %s", result.Message)
+	}
+
+	for _, value := range []string{".", " . "} {
+		t.Setenv("LOCALAPPDATA", value)
+		result := windowsSandboxSetupCheck("windows", backend, workspace, config.SandboxConfig{})
+		if result == nil {
+			t.Fatalf("LOCALAPPDATA=%q: doctor reported a healthy sandbox while no command can select a runtime root", value)
+		}
+		if status, _ := result.Details["setupStatus"].(string); status != "runtime-root-unresolved" {
+			t.Errorf("LOCALAPPDATA=%q: setupStatus = %q, want runtime-root-unresolved: %s", value, status, result.Message)
+		}
+		if cause, _ := result.Details["error"].(string); !strings.Contains(cause, "user cache directory is unavailable") {
+			t.Errorf("LOCALAPPDATA=%q: the warning does not carry the resolver cause a command would report: %+v", value, result.Details)
+		}
+	}
+}

internal/execution/child_launch.go

@@ -1,146 +0,0 @@
-package execution
-
-import "sync"
-
-// ChildLaunchTracker is the one monotonic answer to "did the requested child
-// run", shared by every consumer of a prepared command.
-//
-// THE REPORT HAS THREE STATES, NOT TWO. For a plan whose child is created inside
-// an adapter, the report file passes through: not settled yet, settled with no
-// child, and child created. An absent file, an empty file the adapter opened but
-// has not written, a half-written one, and a decode error are all the FIRST
-// state, and collapsing them to "no child" is a claim about a process that may be
-// running at that instant. Consumers used to make that collapse independently and
-// then compensate for the timing on their own, which is why fixing one
-// presentation site kept exposing the next.
-//
-// Two things make an answer terminal here:
-//
-//   - Confirm, when the consumer has observed the child directly. A stdio MCP
-//     server answering initialize is that observation: the adapter speaks no MCP,
-//     so a well-formed response can only have come from the requested child.
-//   - Settle, when the adapter process itself has exited. After that the report
-//     will never change, so whatever it says, including nothing, is the truth.
-//
-// Settle runs from Cleanup, BEFORE the report file is deleted. Reading the
-// evidence and then destroying it in one step is what lets a consumer ask after
-// close and still get an answer, rather than racing a deletion it does not
-// control.
-//
-// The decision only ever moves from unknown to known and never back, so two
-// consumers of the same prepared command cannot disagree, and a retry cannot turn
-// a launch that happened into one that did not.
-type ChildLaunchTracker struct {
-	mu       sync.Mutex
-	settled  bool
-	launched bool
-
-	ownedByAdapter bool
-	report         func() (AdapterReport, error)
-}
-
-// NewChildLaunchTracker builds the tracker for a prepared command and returns it
-// with a Cleanup that settles before releasing the plan's resources.
-//
-// The returned cleanup is the one the caller must use. Calling the prepared
-// command's own Cleanup instead deletes the report while the decision is still
-// unknown, which is the ordering hazard this type exists to remove.
-func NewChildLaunchTracker(prepared PreparedCommand) (*ChildLaunchTracker, func()) {
-	tracker := &ChildLaunchTracker{
-		ownedByAdapter: prepared.ChildLaunchOwnedByAdapter,
-		report:         prepared.Report,
-	}
-	// A plan whose child is the started process needs no evidence: Start
-	// succeeding IS the launch, so the answer is terminal from the beginning.
-	if !tracker.ownedByAdapter {
-		tracker.settled = true
-		tracker.launched = true
-	}
-	inner := prepared.Cleanup
-	return tracker, func() {
-		tracker.Settle()
-		if inner != nil {
-			inner()
-		}
-	}
-}
-
-// Confirm latches a launch the consumer observed for itself.
-//
-// Positive evidence is always terminal. Nothing that happens later can make a
-// child that answered not have run, so this needs no settlement and cannot be
-// undone by a subsequent Settle finding no report.
-func (tracker *ChildLaunchTracker) Confirm() {
-	if tracker == nil {
-		return
-	}
-	tracker.mu.Lock()
-	defer tracker.mu.Unlock()
-	tracker.settled = true
-	tracker.launched = true
-}
-
-// Settle freezes the answer because the adapter has finished.
-//
-// One last read first: the adapter may have published between the consumer's
-// last look and its exit, and this is the only remaining chance to see it.
-func (tracker *ChildLaunchTracker) Settle() {
-	if tracker == nil {
-		return
-	}
-	tracker.mu.Lock()
-	defer tracker.mu.Unlock()
-	if tracker.settled {
-		return
-	}
-	tracker.launched = tracker.readReportLocked()
-	tracker.settled = true
-}
-
-// Launched reports the decision so far.
-//
-// Before settlement this reads the report and answers true only for a published
-// launch. A negative answer here is NOT remembered, because the adapter may still
-// be between creating the child and recording it; the next caller asks again.
-// Consumers that need a final answer settle first, which Cleanup does for them.
-func (tracker *ChildLaunchTracker) Launched() bool {
-	if tracker == nil {
-		return false
-	}
-	tracker.mu.Lock()
-	defer tracker.mu.Unlock()
-	if tracker.settled {
-		return tracker.launched
-	}
-	if tracker.readReportLocked() {
-		tracker.launched = true
-		tracker.settled = true
-		return true
-	}
-	return false
-}
-
-// Settled reports whether the answer is final, for callers that would otherwise
-// present an unknown as a fact.
-func (tracker *ChildLaunchTracker) Settled() bool {
-	if tracker == nil {
-		return false
-	}
-	tracker.mu.Lock()
-	defer tracker.mu.Unlock()
-	return tracker.settled
-}
-
-// readReportLocked answers only the positive case. A missing file, an empty one,
-// a partial write and a decode error are all "nothing published yet", which is
-// the state this type refuses to record as an outcome.
-func (tracker *ChildLaunchTracker) readReportLocked() bool {
-	if tracker.report == nil {
-		return false
-	}
-	report, err := tracker.report()
-	if err != nil {
-		return false
-	}
-	return ResolveChildLaunched(true, tracker.ownedByAdapter, report)
-}

internal/execution/child_launch_test.go

@@ -1,168 +0,0 @@
-package execution
-
-import "testing"
-
-// scriptedReport is an adapter report whose answer changes over time, the way a
-// real one does: the file is opened empty, decodes to an error while nothing has
-// been written, and only later carries the fact.
-type scriptedReport struct {
-	launched bool
-	reads    int
-	err      error
-}
-
-func (script *scriptedReport) read() (AdapterReport, error) {
-	script.reads++
-	if script.err != nil {
-		return AdapterReport{}, script.err
-	}
-	if !script.launched {
-		// What an empty or half-written file decodes to. NOT childLaunched=false,
-		// which would be the adapter stating an outcome.
-		return AdapterReport{}, nil
-	}
-	launched := true
-	return AdapterReport{ChildLaunched: &launched}, nil
-}
-
-func trackerOver(script *scriptedReport) (*ChildLaunchTracker, func()) {
-	return NewChildLaunchTracker(PreparedCommand{
-		ChildLaunchOwnedByAdapter: true,
-		Report:                    script.read,
-	})
-}
-
-// A NEGATIVE READ IS NOT AN OUTCOME UNTIL THE ADAPTER IS DONE.
-//
-// This is the whole point of the type. Reading the report between the adapter
-// creating the child and recording it answers "nothing published", and caching
-// that answer freezes "not yet" into "never" for the rest of the session.
-func TestAnUnsettledNegativeIsNotRemembered(t *testing.T) {
-	script := &scriptedReport{}
-	tracker, _ := trackerOver(script)
-
-	if tracker.Launched() {
-		t.Fatal("SETUP INVALID: an unpublished report answered launched, so there is no negative here to cache")
-	}
-	if tracker.Settled() {
-		t.Fatal("a read that found nothing settled the decision; the adapter may still be about to publish")
-	}
-
-	// The adapter publishes, as it does a moment after CreateProcessAsUser.
-	script.launched = true
-	if !tracker.Launched() {
-		t.Fatal("the launch published after the first read was never seen; the earlier negative was cached")
-	}
-	if !tracker.Settled() {
-		t.Fatal("a confirmed launch left the decision open")
-	}
-}
-
-// And once it IS an outcome it stays one, so the answer is monotonic and two
-// consumers of the same prepared command cannot disagree.
-func TestASettledLaunchIsNeverWithdrawn(t *testing.T) {
-	script := &scriptedReport{launched: true}
-	tracker, cleanup := trackerOver(script)
-
-	if !tracker.Launched() {
-		t.Fatal("SETUP INVALID: a published report did not answer launched")
-	}
-	// Cleanup deletes the report in production, which is what a later read would
-	// find. The decision must not follow it.
-	script.launched = false
-	cleanup()
-	if !tracker.Launched() {
-		t.Fatal("the decision followed the report file into deletion; a server that ran became one that did not")
-	}
-}
-
-// CLEANUP SETTLES BEFORE IT DESTROYS THE EVIDENCE.
-//
-// The report is a file the plan's cleanup removes. A consumer that asks after
-// cleanup used to read an absent report and answer "no child" about a server that
-// really did run, which is why the decision was being taken early and hitting the
-// unsettled window instead.
-func TestCleanupSettlesBeforeReleasingThePlan(t *testing.T) {
-	script := &scriptedReport{launched: true}
-	var order []string
-	tracker, cleanup := NewChildLaunchTracker(PreparedCommand{
-		ChildLaunchOwnedByAdapter: true,
-		Report: func() (AdapterReport, error) {
-			order = append(order, "read")
-			return script.read()
-		},
-		Cleanup: func() { order = append(order, "release") },
-	})
-
-	cleanup()
-	if len(order) != 2 || order[0] != "read" || order[1] != "release" {
-		t.Fatalf("cleanup order = %v, want the report read before the plan is released", order)
-	}
-	if !tracker.Launched() {
-		t.Fatal("the launch published just before cleanup was lost; nothing read the report on the way out")
-	}
-}
-
-// An adapter that exits having published nothing settles negative, and that
-// answer is final: this is the case the unsettled rule must not swallow.
-func TestAnAdapterThatPublishedNothingSettlesNegative(t *testing.T) {
-	script := &scriptedReport{}
-	tracker, cleanup := trackerOver(script)
-	cleanup()
-
-	if !tracker.Settled() {
-		t.Fatal("the adapter finished without the decision becoming final")
-	}
-	if tracker.Launched() {
-		t.Fatal("an adapter that published nothing was credited with a launch")
-	}
-	// And a report that changes after the adapter is gone changes nothing.
-	script.launched = true
-	if tracker.Launched() {
-		t.Fatal("a settled decision was reopened by a later read")
-	}
-}
-
-// Direct evidence outranks the report and needs no settlement, because nothing
-// that happens later can make a child that answered not have run.
-func TestConfirmIsTerminalWithoutAReport(t *testing.T) {
-	script := &scriptedReport{}
-	tracker, cleanup := trackerOver(script)
-
-	tracker.Confirm()
-	if !tracker.Launched() || !tracker.Settled() {
-		t.Fatal("an observed child did not settle the decision")
-	}
-	cleanup()
-	if !tracker.Launched() {
-		t.Fatal("settling from cleanup overwrote an observed launch with an absent report")
-	}
-}
-
-// A plan whose started process IS the requested command has nothing to decide,
-// and must not be made to wait on a report it will never have.
-func TestAPlanTheAdapterDoesNotOwnIsLaunchedFromTheStart(t *testing.T) {
-	tracker, _ := NewChildLaunchTracker(PreparedCommand{ChildLaunchOwnedByAdapter: false})
-	if !tracker.Launched() || !tracker.Settled() {
-		t.Fatal("a directly started command was not treated as launched")
-	}
-}
-
-// A report that fails to read is the unsettled state, not a negative outcome.
-func TestADecodeErrorIsNotAnAnswer(t *testing.T) {
-	script := &scriptedReport{err: errScriptedReportBroken}
-	tracker, _ := trackerOver(script)
-
-	if tracker.Launched() {
-		t.Fatal("a broken report was read as a launch")
-	}
-	if tracker.Settled() {
-		t.Fatal("a broken report settled the decision; a half-written file is a moment, not an outcome")
-	}
-}
-
-var errScriptedReportBroken = errScriptedReport("unexpected end of JSON input")
-
-type errScriptedReport string
-
-func (e errScriptedReport) Error() string { return string(e) }

internal/execution/contracts.go

@@ -173,11 +173,6 @@ type Enforcement struct {
 	Level           string `json:"level,omitempty"`
 	Degraded        bool   `json:"degraded,omitempty"`
 	DowngradeReason string `json:"downgradeReason,omitempty"`
-	// Notices are least-privilege disclosures about the enforcement actually
-	// applied to THIS command, as opposed to the diagnostic views produced by
-	// `zero sandbox policy` and `zero sandbox check`. A trade an operator only
-	// discovers by running a separate diagnostic command is not disclosed.
-	Notices []string `json:"notices,omitempty"`
 }
 
 type Outcome struct {
@@ -187,18 +182,7 @@ type Outcome struct {
 	Exit        *Exit       `json:"exit,omitempty"`
 	Denial      *Denial     `json:"denial,omitempty"`
 	Enforcement Enforcement `json:"enforcement"`
-	// Launched records whether an OS process was actually created, observed at
-	// the boundary that calls Run rather than inferred afterwards.
-	//
-	// OutcomeKind is not a launch-state field, and reading it as one is wrong in
-	// both directions. A child that ran and then produced an unreadable adapter
-	// report is rewritten to a setup failure, so inference drops a disclosure that
-	// did apply; a context already cancelled before os.StartProcess yields a
-	// cancellation, so inference claims reduced enforcement for a child that never
-	// existed. Report decoding can fail after launch without rewriting history,
-	// and cancellation happens on either side of Start.
-	Launched bool     `json:"launched,omitempty"`
-	Changes  []Change `json:"changes,omitempty"`
+	Changes     []Change    `json:"changes,omitempty"`
 }
 
 // AdapterReport is the structured, machine-readable result emitted by a
@@ -206,51 +190,6 @@ type Outcome struct {
 // command text cannot impersonate a policy decision.
 type AdapterReport struct {
 	Denial *Denial `json:"denial,omitempty"`
-	// ChildLaunched is the adapter's authoritative statement that the REQUESTED
-	// process started, for a plan where the command the runner starts is not that
-	// process.
-	//
-	// A wrapped plan starts a helper, and the helper creates the sandboxed child
-	// only after validating the setup marker, applying ACLs, checking the network
-	// policy, building capability SIDs and minting the restricted token. Any of
-	// those can fail with the helper already running, so the runner's own
-	// exec.Cmd.Process tells it the WRAPPER started and nothing about the child.
-	// Only the adapter sees that transition, so only the adapter may report it.
-	//
-	// nil means the adapter does not speak to this, and the runner keeps its own
-	// observation. That is correct for every direct, unwrapped command, where the
-	// process the runner starts IS the requested one.
-	ChildLaunched *bool `json:"childLaunched,omitempty"`
-}
-
-// ChildLaunched reports whether this outcome describes a process that actually
-// started, from the recorded fact rather than from the terminal outcome kind.
-func (outcome Outcome) ChildLaunched() bool {
-	return outcome.Launched
-}
-
-// AppliedEnforcementNotices returns the least-privilege disclosures that are
-// true of what actually happened.
-//
-// ONE DECISION, AT THE BOUNDARY WHERE THE OUTCOME IS KNOWN. Enforcement.Notices
-// is planned: it describes the shape the command was PREPARED to run under, and
-// planning is not proof that anything ran. Every consumer that copied the field
-// straight out therefore made the completed-enforcement claim for commands that
-// never launched, telling an operator the write jail had been traded away for a
-// child that failed before it existed.
-//
-// Keeping this on Outcome rather than repeating an outcome-kind switch in hooks,
-// plugins and tools is the point: a new pre-launch outcome kind has to be
-// classified once, here, instead of being silently disclosed by whichever
-// consumer was not updated.
-func (outcome Outcome) AppliedEnforcementNotices() []string {
-	if !outcome.ChildLaunched() {
-		return nil
-	}
-	if len(outcome.Enforcement.Notices) == 0 {
-		return nil
-	}
-	return append([]string(nil), outcome.Enforcement.Notices...)
 }
 
 func (outcome Outcome) Validate() error {

internal/execution/launch_state_test.go

@@ -1,111 +0,0 @@
-package execution
-
-import (
-	"context"
-	"errors"
-	"os/exec"
-	"runtime"
-	"testing"
-)
-
-const launchStateNotice = "denyRead is configured, so the write jail is not confining writes"
-
-func launchStateShell(ctx context.Context, script string) *exec.Cmd {
-	if runtime.GOOS == "windows" {
-		return exec.CommandContext(ctx, "cmd.exe", "/c", script)
-	}
-	return exec.CommandContext(ctx, "/bin/sh", "-c", script)
-}
-
-// launchStatePreparer plans a command carrying an enforcement notice, and can
-// make the adapter report fail after the child has already run.
-type launchStatePreparer struct {
-	script    string
-	reportErr error
-	missing   bool
-}
-
-func (p *launchStatePreparer) PrepareExecution(ctx context.Context, _ Request) (PreparedCommand, error) {
-	command := launchStateShell(ctx, p.script)
-	if p.missing {
-		command = exec.CommandContext(ctx, "definitely-not-a-real-binary-zzz")
-	}
-	prepared := PreparedCommand{
-		Command:     command,
-		Enforcement: Enforcement{Notices: []string{launchStateNotice}},
-	}
-	if p.reportErr != nil {
-		prepared.Report = func() (AdapterReport, error) { return AdapterReport{}, p.reportErr }
-	}
-	return prepared, nil
-}
-
-func captured(t *testing.T, ctx context.Context, p *launchStatePreparer) CapturedResult {
-	t.Helper()
-	return NewRunner(p).ExecuteCaptured(ctx, CapturedRequest{Request: Request{
-		Origin:           OriginHook,
-		Mode:             ModeCaptured,
-		Command:          Command{Name: "irrelevant"},
-		WorkingDirectory: t.TempDir(),
-		WorkspaceRoots:   []string{t.TempDir()},
-		Approval:         ApprovalContext{PolicyVersion: PolicyVersion},
-	}})
-}
-
-// THE OUTCOME KIND IS NOT A LAUNCH-STATE FIELD, IN EITHER DIRECTION.
-//
-// Deriving launch from the terminal kind is wrong twice over. The adapter report
-// is read AFTER Run, so a child that really ran and then produced an unreadable
-// report is rewritten to a setup failure: inference drops a disclosure that did
-// apply. And a context already cancelled before os.StartProcess still selects a
-// cancellation, so inference claims reduced enforcement for a process that never
-// existed.
-func TestLaunchStateIsRecordedNotInferred(t *testing.T) {
-	t.Run("ran, then the adapter report failed", func(t *testing.T) {
-		result := captured(t, context.Background(), &launchStatePreparer{
-			script:    "exit 0",
-			reportErr: errors.New("adapter report is unreadable"),
-		})
-		if result.Outcome.Kind != OutcomeSandboxSetupFailure {
-			t.Fatalf("SETUP INVALID: kind = %q, want the report failure to rewrite it", result.Outcome.Kind)
-		}
-		if !result.Outcome.Launched {
-			t.Error("a child that ran was recorded as never launched")
-		}
-		if got := result.Outcome.AppliedEnforcementNotices(); len(got) != 1 {
-			t.Errorf("the disclosure was dropped for a child that did run: %#v", got)
-		}
-	})
-
-	t.Run("cancelled before the process started", func(t *testing.T) {
-		ctx, cancel := context.WithCancel(context.Background())
-		cancel()
-		result := captured(t, ctx, &launchStatePreparer{script: "exit 0"})
-		if result.Outcome.Launched {
-			t.Error("a process that never started was recorded as launched")
-		}
-		if got := result.Outcome.AppliedEnforcementNotices(); len(got) != 0 {
-			t.Errorf("an enforcement trade was claimed for a process that never existed: %#v", got)
-		}
-	})
-
-	t.Run("never found", func(t *testing.T) {
-		result := captured(t, context.Background(), &launchStatePreparer{missing: true})
-		if result.Outcome.Launched {
-			t.Error("a missing executable was recorded as launched")
-		}
-		if got := result.Outcome.AppliedEnforcementNotices(); len(got) != 0 {
-			t.Errorf("a missing executable claimed an enforcement trade: %#v", got)
-		}
-	})
-
-	t.Run("ordinary success still discloses", func(t *testing.T) {
-		result := captured(t, context.Background(), &launchStatePreparer{script: "exit 0"})
-		if !result.Outcome.Launched {
-			t.Fatal("an ordinary run was recorded as never launched")
-		}
-		if got := result.Outcome.AppliedEnforcementNotices(); len(got) != 1 {
-			t.Errorf("an ordinary run lost its disclosure: %#v", got)
-		}
-	})
-}

internal/execution/live_launch_observation_test.go

@@ -1,199 +0,0 @@
-package execution
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"testing"
-	"time"
-)
-
-const liveLaunchNotice = "denyRead is configured, so the write jail is not confining writes"
-
-// liveReportReader mirrors sandbox.CommandPlan.ExecutionReport: read the file the
-// helper publishes, treat "not there yet" as nothing recorded.
-func liveReportReader(path string) func() (AdapterReport, error) {
-	return func() (AdapterReport, error) {
-		raw, err := os.ReadFile(path)
-		if errors.Is(err, os.ErrNotExist) {
-			return AdapterReport{}, nil
-		}
-		if err != nil {
-			return AdapterReport{}, err
-		}
-		var report AdapterReport
-		if err := json.Unmarshal(raw, &report); err != nil {
-			return AdapterReport{}, err
-		}
-		return report, nil
-	}
-}
-
-// liveHelperCommand stands in for the Windows helper: publish the launch fact the
-// way it does right after CreateProcessAsUser, then stay alive the way it does
-// while waiting on the child.
-func liveHelperCommand(t *testing.T, reportPath string, publish bool) *exec.Cmd {
-	t.Helper()
-	if publish {
-		if err := os.WriteFile(reportPath, []byte(`{"childLaunched":true}`), 0o600); err != nil {
-			t.Fatalf("publish the launch report: %v", err)
-		}
-	}
-	if runtime.GOOS == "windows" {
-		// A child that holds itself open without exiting.
-		return exec.Command("cmd.exe", "/c", "pause")
-	}
-	return exec.Command("/bin/sh", "-c", "sleep 30")
-}
-
-// liveRequest is a valid interactive request; ProcessManager.Start validates it
-// before anything under test runs.
-func liveRequest(t *testing.T) Request {
-	t.Helper()
-	return Request{
-		Origin:           OriginInteractiveCommand,
-		Mode:             ModeInteractive,
-		Command:          Command{Name: "helper"},
-		WorkingDirectory: t.TempDir(),
-		WorkspaceRoots:   []string{t.TempDir()},
-		Approval:         ApprovalContext{PolicyVersion: PolicyVersion},
-	}
-}
-
-// A RETAINED SESSION HAS TO DISCLOSE WHILE IT IS STILL RUNNING.
-//
-// The helper publishes childLaunched immediately after it creates the restricted
-// child, and only then waits for it. The manager read that report exclusively in
-// the post-Wait goroutine, so for the whole live lifetime of a wrapped session the
-// report was the zero value: the first exec_command reply and every write_stdin
-// poll resolved Launched=false and disclosed nothing, while the fact sat readable
-// on disk. A watcher, or a retained session nobody polls to completion, would
-// never be told the write jail had been traded away.
-//
-// Driven through the real ProcessManager with a real child process, and asserted
-// on the ProcessResult the tool layer consumes.
-func TestALiveWrappedSessionCarriesTheLaunchFact(t *testing.T) {
-	directory := t.TempDir()
-	reportPath := filepath.Join(directory, "report.json")
-	command := liveHelperCommand(t, reportPath, true)
-
-	manager := NewProcessManager(ProcessManagerOptions{})
-	result, err := manager.Start(context.Background(), ProcessStart{
-		Prepared: PreparedCommand{
-			Command:                   command,
-			ChildLaunchOwnedByAdapter: true,
-			Enforcement:               Enforcement{Notices: []string{liveLaunchNotice}},
-			Report:                    liveReportReader(reportPath),
-		},
-		Request: liveRequest(t),
-	}, 300*time.Millisecond)
-	if err != nil {
-		t.Fatalf("Start: %v", err)
-	}
-	t.Cleanup(func() { manager.StopAll() })
-
-	// SETUP: this has to be the LIVE state, and the fact has to be on disk, or the
-	// assertion below would be about a terminal read.
-	if result.Exited {
-		t.Fatal("SETUP INVALID: the stand-in helper exited, so the live lifecycle is not under test")
-	}
-	if _, statErr := os.Stat(reportPath); statErr != nil {
-		t.Fatalf("SETUP INVALID: the launch report is not on disk, so there is nothing to observe: %v", statErr)
-	}
-
-	if !ResolveChildLaunched(true, result.ChildLaunchOwnedByAdapter, result.Report) {
-		t.Fatal("a live wrapped session resolved as not launched, so its enforcement disclosure is withheld while the command runs")
-	}
-
-	// And again on a poll, which is the write_stdin leg.
-	polled, err := manager.Continue(context.Background(), ProcessContinue{ProcessID: result.ProcessID, Wait: 200 * time.Millisecond})
-	if err != nil {
-		t.Fatalf("Continue: %v", err)
-	}
-	if polled.Exited {
-		t.Fatal("SETUP INVALID: the helper exited before the poll, so the live poll is not under test")
-	}
-	if !ResolveChildLaunched(true, polled.ChildLaunchOwnedByAdapter, polled.Report) {
-		t.Fatal("a live poll of a wrapped session resolved as not launched")
-	}
-	if got := polled.Enforcement.Notices; len(got) != 1 || got[0] != liveLaunchNotice {
-		t.Fatalf("the live poll carries notices %v, want exactly the one planned notice", got)
-	}
-}
-
-// AND A HELPER THAT NEVER CREATED THE CHILD STAYS SILENT.
-//
-// This is the negative the live read must not destroy. A helper that starts and
-// then fails setup, ACL application, or CreateProcessAsUser has an outer process
-// running and no child, so nothing may be promoted from the fact that the
-// wrapper itself is alive.
-func TestALiveWrappedSessionWithNoReportedChildStaysSilent(t *testing.T) {
-	directory := t.TempDir()
-	reportPath := filepath.Join(directory, "report.json")
-	command := liveHelperCommand(t, reportPath, false)
-
-	manager := NewProcessManager(ProcessManagerOptions{})
-	result, err := manager.Start(context.Background(), ProcessStart{
-		Prepared: PreparedCommand{
-			Command:                   command,
-			ChildLaunchOwnedByAdapter: true,
-			Enforcement:               Enforcement{Notices: []string{liveLaunchNotice}},
-			Report:                    liveReportReader(reportPath),
-		},
-		Request: liveRequest(t),
-	}, 300*time.Millisecond)
-	if err != nil {
-		t.Fatalf("Start: %v", err)
-	}
-	t.Cleanup(func() { manager.StopAll() })
-
-	if result.Exited {
-		t.Fatal("SETUP INVALID: the stand-in helper exited, so the live lifecycle is not under test")
-	}
-	if _, statErr := os.Stat(reportPath); statErr == nil {
-		t.Fatal("SETUP INVALID: a report exists, so this is not the no-child case")
-	}
-	if ResolveChildLaunched(true, result.ChildLaunchOwnedByAdapter, result.Report) {
-		t.Fatal("a helper that reported no child was promoted to a launch, so the operator is told a write jail was traded away for a child that never existed")
-	}
-}
-
-// A report that appears mid-flight is observed on the next poll, which is what
-// makes this a lifecycle transition rather than a start-time snapshot.
-func TestTheLaunchFactIsObservedWhenItAppearsMidFlight(t *testing.T) {
-	directory := t.TempDir()
-	reportPath := filepath.Join(directory, "report.json")
-	command := liveHelperCommand(t, reportPath, false)
-
-	manager := NewProcessManager(ProcessManagerOptions{})
-	result, err := manager.Start(context.Background(), ProcessStart{
-		Prepared: PreparedCommand{
-			Command:                   command,
-			ChildLaunchOwnedByAdapter: true,
-			Report:                    liveReportReader(reportPath),
-		},
-		Request: liveRequest(t),
-	}, 200*time.Millisecond)
-	if err != nil {
-		t.Fatalf("Start: %v", err)
-	}
-	t.Cleanup(func() { manager.StopAll() })
-	if ResolveChildLaunched(true, result.ChildLaunchOwnedByAdapter, result.Report) {
-		t.Fatal("SETUP INVALID: nothing was published yet, so the first result must not be a launch")
-	}
-
-	if err := os.WriteFile(reportPath, []byte(`{"childLaunched":true}`), 0o600); err != nil {
-		t.Fatalf("publish the launch report: %v", err)
-	}
-	polled, err := manager.Continue(context.Background(), ProcessContinue{ProcessID: result.ProcessID, Wait: 200 * time.Millisecond})
-	if err != nil {
-		t.Fatalf("Continue: %v", err)
-	}
-	if !ResolveChildLaunched(true, polled.ChildLaunchOwnedByAdapter, polled.Report) {
-		t.Fatal("the launch published while the session was live was never observed")
-	}
-}

internal/execution/process_manager.go

@@ -79,12 +79,8 @@ type ProcessResult struct {
 	Enforcement     Enforcement
 	Report          AdapterReport
 	ReportErr       error
-	// ChildLaunchOwnedByAdapter carries the prepared plan's ownership of the
-	// requested-child launch fact through to the caller, which for a retained
-	// session no longer has the plan.
-	ChildLaunchOwnedByAdapter bool
-	Changes                   []Change
-	Metadata                  map[string]string
+	Changes         []Change
+	Metadata        map[string]string
 }
 
 type ProcessSnapshot struct {
@@ -166,7 +162,6 @@ func (manager *ProcessManager) Start(ctx context.Context, input ProcessStart, wa
 		command:     command,
 		request:     request,
 		enforcement: input.Prepared.Enforcement,
-		ownedLaunch: input.Prepared.ChildLaunchOwnedByAdapter,
 		report:      input.Prepared.Report,
 		cleanup:     input.Prepared.Cleanup,
 		stdin:       stdin,
@@ -428,46 +423,31 @@ func (manager *ProcessManager) removeCompletedLater(process *managedProcess) {
 }
 
 type managedProcess struct {
-	id          int
-	commandText string
-	cwd         string
-	relativeCwd string
-	startedAt   time.Time
-	lastUsedAt  time.Time
-	tty         bool
-	command     *exec.Cmd
-	request     Request
-	enforcement Enforcement
-	ownedLaunch bool
-	// launchObserved latches the adapter's launch transition the first time it is
-	// seen, so a live result can report it. Guarded by mu.
-	launchObserved bool
-	report         func() (AdapterReport, error)
-	cleanup        func()
-	stdin          io.WriteCloser
-	output         *processOutputBuffer
-	reaped         chan struct{}
-	doneOnce       sync.Once
-	done           chan struct{}
-	kill           func(int) error
-	mu             sync.Mutex
-	exitCode       *int
-	waitErr        error
-	resultReport   AdapterReport
-	reportErr      error
-	changes        []Change
-	metadata       map[string]string
-}
-
-// launchedReportLocked returns the report to hand out, with a latched live
-// launch folded in. Caller holds mu.
-func (process *managedProcess) launchedReportLocked() AdapterReport {
-	report := process.resultReport
-	if report.ChildLaunched == nil && process.launchObserved {
-		launched := true
-		report.ChildLaunched = &launched
-	}
-	return report
+	id           int
+	commandText  string
+	cwd          string
+	relativeCwd  string
+	startedAt    time.Time
+	lastUsedAt   time.Time
+	tty          bool
+	command      *exec.Cmd
+	request      Request
+	enforcement  Enforcement
+	report       func() (AdapterReport, error)
+	cleanup      func()
+	stdin        io.WriteCloser
+	output       *processOutputBuffer
+	reaped       chan struct{}
+	doneOnce     sync.Once
+	done         chan struct{}
+	kill         func(int) error
+	mu           sync.Mutex
+	exitCode     *int
+	waitErr      error
+	resultReport AdapterReport
+	reportErr    error
+	changes      []Change
+	metadata     map[string]string
 }
 
 func (process *managedProcess) markDone(err error, exitCode int, report AdapterReport, reportErr error, changes []Change) {
@@ -475,76 +455,14 @@ func (process *managedProcess) markDone(err error, exitCode int, report AdapterR
 	process.waitErr = err
 	process.exitCode = &exitCode
 	process.resultReport = report
-	// The plan's cleanup has already removed the report file by the time this
-	// runs on some orderings, so a terminal read can answer "nothing recorded"
-	// about a child that demonstrably started. A launch we already saw is not
-	// un-seen by that.
-	if report.ChildLaunched == nil && process.launchObserved {
-		launched := true
-		process.resultReport.ChildLaunched = &launched
-	}
 	process.reportErr = reportErr
 	process.changes = append([]Change(nil), changes...)
 	process.mu.Unlock()
 	process.doneOnce.Do(func() { close(process.done) })
 }
 
-// observeLaunch reads the adapter's launch report while the process is still
-// running, and latches a confirmed launch.
-//
-// THE LAUNCH FACT IS A LIFECYCLE TRANSITION, NOT TERMINAL DATA. The Windows
-// helper publishes childLaunched immediately after CreateProcessAsUser creates
-// the restricted child, and then waits for it. The manager used to read the
-// report only in the post-Wait goroutine, so for the entire live lifetime of a
-// retained session the report was the zero value: the first exec_command reply
-// and every write_stdin poll resolved Launched=false and disclosed nothing,
-// even though the fact was sitting readable on disk. A watcher or an abandoned
-// retained session could therefore never be told the write jail had been traded
-// away. The MCP launcher already reads the report while its server is live;
-// this is the same read, in the launcher that was left behind.
-//
-// SILENCE IS NOT A NEGATIVE, BUT AN EXPLICIT NEGATIVE IS. An absent, partial or
-// undecodable report, and a helper that failed before it ever created the child,
-// must all leave the live result exactly as it was: not confirmed, nothing
-// disclosed. Reading absence as false, or surfacing a read error or a denial
-// from here, would let a mid-flight poll rewrite a running command into a setup
-// failure, and absence is the normal state once the plan's cleanup has removed
-// the file.
-//
-// A report that SAYS false is different, and it revokes. The Windows helper
-// publishes the launch before it resumes the suspended child, so there is a
-// window where the fact is readable and the child has still executed nothing; if
-// the resume then fails, the helper retracts the record with an explicit false.
-// Without this, a poll that landed inside that window would hold a launch that
-// never happened, and hold it through completion, since the final read finds the
-// file cleaned away and restores what was latched.
-//
-// Which is why the observation is repeated while the command runs rather than
-// latched once. It costs one small read per poll on a wrapped plan, and every
-// unwrapped plan still does no extra work at all; a fact that can be withdrawn
-// is not one to cache.
-func (process *managedProcess) observeLaunch() {
-	if process.report == nil {
-		return
-	}
-	process.mu.Lock()
-	skip := !process.ownedLaunch
-	process.mu.Unlock()
-	if skip || process.doneClosed() {
-		return
-	}
-	report, err := process.report()
-	if err != nil || report.ChildLaunched == nil {
-		return
-	}
-	process.mu.Lock()
-	process.launchObserved = *report.ChildLaunched
-	process.mu.Unlock()
-}
-
 func (process *managedProcess) collectResult(ctx context.Context, wait time.Duration, interrupted bool) ProcessResult {
 	output, truncated := process.collect(ctx, wait)
-	process.observeLaunch()
 	process.mu.Lock()
 	exitCode := 0
 	exited := process.exitCode != nil
@@ -555,9 +473,8 @@ func (process *managedProcess) collectResult(ctx context.Context, wait time.Dura
 		ProcessID: process.id, CommandText: process.commandText, RelativeCwd: process.relativeCwd,
 		TTY: process.tty, Output: output, OutputTruncated: truncated, Exited: exited,
 		ExitCode: exitCode, Interrupted: interrupted, Request: process.request,
-		Enforcement: process.enforcement, Report: process.launchedReportLocked(), ReportErr: process.reportErr,
-		ChildLaunchOwnedByAdapter: process.ownedLaunch,
-		Changes:                   append([]Change(nil), process.changes...), Metadata: cloneStringMap(process.metadata),
+		Enforcement: process.enforcement, Report: process.resultReport, ReportErr: process.reportErr,
+		Changes: append([]Change(nil), process.changes...), Metadata: cloneStringMap(process.metadata),
 	}
 	process.mu.Unlock()
 	return result

internal/execution/retracted_launch_test.go

@@ -1,128 +0,0 @@
-package execution
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-)
-
-// A LAUNCH THE HELPER TAKES BACK MUST NOT SURVIVE IN EITHER RESULT.
-//
-// The Windows helper publishes childLaunched before it resumes the suspended
-// child, so the fact is readable while the child has still executed nothing. A
-// poll landing in that window latched it, and the latch outlived the file: the
-// terminal read finds the report cleaned away and restores what was observed, so
-// a child that never became runnable was reported as launched, and the write-jail
-// trade it never made was disclosed as if it had.
-//
-// Deleting the report on that path cannot fix it, because deletion is also what a
-// normal cleanup does. The helper retracts with an explicit false instead, and
-// this is the interleaving that pins it: publish, live read, retract, poll, then
-// finish and read terminally.
-func TestARetractedLaunchIsNotCommittedLiveOrTerminally(t *testing.T) {
-	directory := t.TempDir()
-	reportPath := filepath.Join(directory, "report.json")
-	command := liveHelperCommand(t, reportPath, true)
-
-	manager := NewProcessManager(ProcessManagerOptions{})
-	result, err := manager.Start(context.Background(), ProcessStart{
-		Prepared: PreparedCommand{
-			Command:                   command,
-			ChildLaunchOwnedByAdapter: true,
-			Enforcement:               Enforcement{Notices: []string{liveLaunchNotice}},
-			Report:                    liveReportReader(reportPath),
-		},
-		Request: liveRequest(t),
-	}, 300*time.Millisecond)
-	if err != nil {
-		t.Fatalf("Start: %v", err)
-	}
-	t.Cleanup(func() { manager.StopAll() })
-
-	// SETUP: the publication window. The live read has to have seen the positive,
-	// or the revocation below would have nothing to revoke.
-	if result.Exited {
-		t.Fatal("SETUP INVALID: the stand-in helper exited, so the live lifecycle is not under test")
-	}
-	if !ResolveChildLaunched(true, result.ChildLaunchOwnedByAdapter, result.Report) {
-		t.Fatal("SETUP INVALID: the published launch was not observed live, so this test cannot show it being taken back")
-	}
-
-	// The resume fails: the helper retracts the record it published.
-	if err := os.WriteFile(reportPath, []byte(`{"childLaunched":false}`), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	polled, err := manager.Continue(context.Background(), ProcessContinue{ProcessID: result.ProcessID, Wait: 200 * time.Millisecond})
-	if err != nil {
-		t.Fatalf("Continue: %v", err)
-	}
-	if polled.Exited {
-		t.Fatal("SETUP INVALID: the helper exited before the poll, so the live poll is not under test")
-	}
-	if ResolveChildLaunched(true, polled.ChildLaunchOwnedByAdapter, polled.Report) {
-		t.Error("a live poll still reports a launch the helper retracted, so the disclosure stands for a child that never ran")
-	}
-
-	// Finish, with the plan's cleanup removing the report the way it always does.
-	// The terminal read then finds absence, which is exactly the case the restore
-	// exists for, and it must not resurrect the retracted launch.
-	if !manager.Stop(result.ProcessID) {
-		t.Fatal("Stop: process not found")
-	}
-	_ = os.Remove(reportPath)
-	final, err := manager.Continue(context.Background(), ProcessContinue{ProcessID: result.ProcessID, Wait: time.Second})
-	if err != nil {
-		t.Fatalf("Continue after stop: %v", err)
-	}
-	if !final.Exited {
-		t.Fatal("SETUP INVALID: the helper never exited, so there is no terminal result under test")
-	}
-	if ResolveChildLaunched(true, final.ChildLaunchOwnedByAdapter, final.Report) {
-		t.Error("the final result reports a launch the helper retracted")
-	}
-}
-
-// AND A GENUINE LAUNCH STILL SURVIVES ITS OWN CLEANUP. The revocation must key
-// on an explicit denial and nothing else: a report removed by the plan's normal
-// cleanup is silence, and silence does not take back what was seen.
-func TestAConfirmedLaunchSurvivesTheReportCleanup(t *testing.T) {
-	directory := t.TempDir()
-	reportPath := filepath.Join(directory, "report.json")
-	command := liveHelperCommand(t, reportPath, true)
-
-	manager := NewProcessManager(ProcessManagerOptions{})
-	result, err := manager.Start(context.Background(), ProcessStart{
-		Prepared: PreparedCommand{
-			Command:                   command,
-			ChildLaunchOwnedByAdapter: true,
-			Enforcement:               Enforcement{Notices: []string{liveLaunchNotice}},
-			Report:                    liveReportReader(reportPath),
-		},
-		Request: liveRequest(t),
-	}, 300*time.Millisecond)
-	if err != nil {
-		t.Fatalf("Start: %v", err)
-	}
-	t.Cleanup(func() { manager.StopAll() })
-	if !ResolveChildLaunched(true, result.ChildLaunchOwnedByAdapter, result.Report) {
-		t.Fatal("SETUP INVALID: the published launch was not observed live")
-	}
-
-	if !manager.Stop(result.ProcessID) {
-		t.Fatal("Stop: process not found")
-	}
-	_ = os.Remove(reportPath)
-	final, err := manager.Continue(context.Background(), ProcessContinue{ProcessID: result.ProcessID, Wait: time.Second})
-	if err != nil {
-		t.Fatalf("Continue after stop: %v", err)
-	}
-	if !final.Exited {
-		t.Fatal("SETUP INVALID: the helper never exited")
-	}
-	if !ResolveChildLaunched(true, final.ChildLaunchOwnedByAdapter, final.Report) {
-		t.Error("a confirmed launch was lost when the plan's cleanup removed its report")
-	}
-}

internal/execution/runner.go

@@ -24,12 +24,6 @@ type PreparedCommand struct {
 	Enforcement Enforcement
 	Report      func() (AdapterReport, error)
 	Cleanup     func()
-	// ChildLaunchOwnedByAdapter marks a plan where Command is a WRAPPER and the
-	// requested process is created inside it, so exec.Cmd.Process says nothing
-	// about whether the sandboxed child ever existed. The adapter must state the
-	// fact in its report; if it does not, the runner treats the child as not
-	// launched rather than crediting the wrapper's start.
-	ChildLaunchOwnedByAdapter bool
 }
 
 type CapturedRequest struct {
@@ -96,25 +90,10 @@ func (runner *Runner) ExecuteCaptured(ctx context.Context, input CapturedRequest
 	prepared.Command.Stdout = stdout
 	prepared.Command.Stderr = stderr
 	runErr := prepared.Command.Run()
-	// Observed HERE, from the only thing that knows: exec.Cmd sets Process only
-	// once os.StartProcess has succeeded, so this is false for a missing
-	// executable and for a context cancelled before Start, and true for anything
-	// that ran, including a later timeout or cancellation.
-	launched := prepared.Command.Process != nil
 	report, reportErr := AdapterReport{}, error(nil)
 	if prepared.Report != nil {
 		report, reportErr = prepared.Report()
 	}
-	// A WRAPPED PLAN'S LAUNCH BIT BELONGS TO THE ADAPTER. The line above observes
-	// the process THIS command started, which for a Windows restricted-token plan
-	// is the helper, not the requested executable: the helper validates the setup
-	// marker, applies ACLs, checks the network policy, builds capability SIDs and
-	// mints the restricted token after it is already running, and any of those can
-	// fail with no sandboxed child ever created. Believing the outer bit there
-	// reports that reads were denied as requested when only the unsandboxed
-	// adapter ran. An adapter that owns the inner transition overrides it; one
-	// that stays silent leaves the direct-command observation alone.
-	launched = ResolveChildLaunched(launched, prepared.ChildLaunchOwnedByAdapter, report)
 	result := CapturedResult{
 		Stdout:    stdout.String(),
 		Stderr:    stderr.String(),
@@ -122,7 +101,6 @@ func (runner *Runner) ExecuteCaptured(ctx context.Context, input CapturedRequest
 		Err:       runErr,
 		Outcome: Outcome{
 			Enforcement: prepared.Enforcement,
-			Launched:    launched,
 		},
 	}
 	exitCode := commandExitCode(runErr)
@@ -179,28 +157,6 @@ func (runner *Runner) Prepare(ctx context.Context, request Request) (PreparedCom
 	return preparer.PrepareExecution(ctx, request)
 }
 
-// ResolveChildLaunched decides whether the REQUESTED process launched.
-//
-// ONE IMPLEMENTATION, because every launcher needs the same answer and each one
-// that re-derived it got a different one. observed is what the caller saw of the
-// process IT started, which for a wrapped plan is the helper and not the
-// requested child.
-//
-//   - the adapter stated the fact: believe the adapter, in both directions.
-//   - the adapter owns the fact and stayed silent: not launched. An absent report
-//     must not be read as proof that enforcement applied.
-//   - nobody owns it but the caller: keep the direct observation, which is
-//     correct for a direct command and for bwrap.
-func ResolveChildLaunched(observed bool, ownedByAdapter bool, report AdapterReport) bool {
-	if report.ChildLaunched != nil {
-		return *report.ChildLaunched
-	}
-	if ownedByAdapter {
-		return false
-	}
-	return observed
-}
-
 func capturedSetupFailure(message string, err error, enforcement Enforcement) CapturedResult {
 	return CapturedResult{
 		Stderr: message,

internal/execution/wrapped_launch_state_test.go

@@ -1,103 +0,0 @@
-package execution
-
-import (
-	"context"
-	"testing"
-)
-
-// A WRAPPER'S START IS NOT THE REQUESTED CHILD'S START.
-//
-// For a Windows restricted-token plan the command the runner starts is the
-// sandbox helper, not the executable the caller asked for. Inside that helper,
-// setup-marker validation, unelevated ACL application, network-policy
-// validation, capability and offline SID construction, restricted-token creation
-// and the CreateProcessAsUser call all happen afterwards, and each of them can
-// return with no sandboxed child ever created. exec.Cmd.Process is already
-// non-nil by then, so reading the launch state off it reports that reads were
-// denied as requested when the only thing that ran was the unsandboxed adapter.
-//
-// The fact belongs to whoever sees the transition. These pin both directions of
-// that boundary.
-type wrappedPreparer struct {
-	script        string
-	owned         bool
-	childLaunched *bool
-	reportNothing bool
-}
-
-func (p *wrappedPreparer) PrepareExecution(ctx context.Context, _ Request) (PreparedCommand, error) {
-	prepared := PreparedCommand{
-		Command:                   launchStateShell(ctx, p.script),
-		Enforcement:               Enforcement{Notices: []string{launchStateNotice}},
-		ChildLaunchOwnedByAdapter: p.owned,
-	}
-	if !p.reportNothing {
-		launched := p.childLaunched
-		prepared.Report = func() (AdapterReport, error) {
-			return AdapterReport{ChildLaunched: launched}, nil
-		}
-	}
-	return prepared, nil
-}
-
-func capturedWrapped(t *testing.T, p *wrappedPreparer) CapturedResult {
-	t.Helper()
-	return NewRunner(p).ExecuteCaptured(context.Background(), CapturedRequest{Request: Request{
-		Origin:           OriginHook,
-		Mode:             ModeCaptured,
-		Command:          Command{Name: "irrelevant"},
-		WorkingDirectory: t.TempDir(),
-		WorkspaceRoots:   []string{t.TempDir()},
-		Approval:         ApprovalContext{PolicyVersion: PolicyVersion},
-	}})
-}
-
-func TestWrappedPlanDisclosesOnlyWhatTheAdapterConfirms(t *testing.T) {
-	// The helper starts and then fails before it can create the restricted child:
-	// a bad setup marker, an ACL it could not apply, a network policy it rejected,
-	// a token it could not mint. The wrapper process exists; the sandboxed one
-	// never did, so nothing may be claimed about enforcement.
-	t.Run("helper ran but never created the child", func(t *testing.T) {
-		no := false
-		result := capturedWrapped(t, &wrappedPreparer{script: "exit 1", owned: true, childLaunched: &no})
-		// The wrapper really did run, which is the whole point: its exit code is
-		// the script's. Without this the test could pass because nothing executed.
-		if result.Outcome.Exit == nil || result.Outcome.Exit.Code != 1 {
-			t.Fatalf("SETUP INVALID: the wrapper itself must have run; outcome = %+v", result.Outcome)
-		}
-		if notices := result.Outcome.AppliedEnforcementNotices(); len(notices) != 0 {
-			t.Fatalf("a helper that never created the restricted child disclosed %q", notices)
-		}
-	})
-
-	// Same shape, but the adapter says nothing at all. Silence from the owner of
-	// the fact is not permission to fall back to the wrapper's own start.
-	t.Run("adapter that owns the fact stayed silent", func(t *testing.T) {
-		result := capturedWrapped(t, &wrappedPreparer{script: "exit 1", owned: true, reportNothing: true})
-		if notices := result.Outcome.AppliedEnforcementNotices(); len(notices) != 0 {
-			t.Fatalf("an unreported child launch was disclosed as applied enforcement: %q", notices)
-		}
-	})
-
-	// And the other side of the boundary: a restricted child that really started
-	// and then exited non-zero DID run under the disclosed enforcement, so the
-	// notice must still be made, exactly once.
-	t.Run("restricted child started, then failed", func(t *testing.T) {
-		yes := true
-		result := capturedWrapped(t, &wrappedPreparer{script: "exit 3", owned: true, childLaunched: &yes})
-		notices := result.Outcome.AppliedEnforcementNotices()
-		if len(notices) != 1 || notices[0] != launchStateNotice {
-			t.Fatalf("a child that ran and then failed disclosed %q, want exactly one %q", notices, launchStateNotice)
-		}
-	})
-
-	// A direct, unwrapped command is unchanged: the process the runner starts IS
-	// the requested one, so its own observation still decides.
-	t.Run("direct command keeps its own observation", func(t *testing.T) {
-		result := capturedWrapped(t, &wrappedPreparer{script: "exit 0", owned: false, reportNothing: true})
-		notices := result.Outcome.AppliedEnforcementNotices()
-		if len(notices) != 1 || notices[0] != launchStateNotice {
-			t.Fatalf("a direct command that ran disclosed %q, want exactly one %q", notices, launchStateNotice)
-		}
-	})
-}

internal/hooks/dispatch.go

@@ -36,25 +36,7 @@ type DispatchOutcome struct {
 	// Messages collects the output (stdout, else stderr) of each hook that
 	// produced any, in run order. afterTool validators use this to feed results
 	// (e.g. a formatter diff or vet warning) back to the model on the tool result.
-	//
-	// PRESENTATION TEXT, NOT A NOTICE CHANNEL, and it no longer carries notices at
-	// all. hookMessage used to fold them in so afterTool got both on one line;
-	// that made the disclosure arrive twice once the typed slice was composed by
-	// every surface. Enforcement disclosures are on Notices, for both hook phases.
-	// A caller that only wants to know what the sandbox did must read that:
-	// delivering this slice would put every successful hook's routine logging into
-	// the model's context.
 	Messages []string
-	// Notices carries only the enforcement disclosures, one entry per notice, in
-	// run order across every hook that ran.
-	//
-	// Separate from Messages because they answer different questions and have
-	// different audiences. A notice says the hook ran under a weakened token,
-	// which the model and the operator both need; the hook's own output is for
-	// afterTool validators that asked to be heard. Appended as each hook runs,
-	// rather than read off the final result, so a disclosure from a hook that
-	// already ran survives a later hook's veto ending the chain.
-	Notices []string
 }
 
 type commandResult struct {
@@ -63,13 +45,6 @@ type commandResult struct {
 	Stderr   string
 	Err      error // set when the command could not be executed (not a non-zero exit)
 	TimedOut bool  // the hook started but its deadline/cancellation fired before it returned
-	// Notices carries the enforcement disclosures the execution runner attached.
-	//
-	// Same reason as the plugin path: the generic execution contract is not
-	// transport-only. Enforcement.Notices says what the sandbox actually did, and
-	// a projection that keeps only stdout, stderr and an exit code drops it, so a
-	// hook ran under a weakened token with nothing said about it.
-	Notices []string
 }
 
 // commandRunner executes one hook command. It is injectable so the dispatch
@@ -164,10 +139,6 @@ func executionCommandRunner(runner *execution.Runner) commandRunner {
 			Stderr:   stderr,
 			Err:      commandErr,
 			TimedOut: result.Outcome.Kind == execution.OutcomeTimedOut,
-			// One shared decision: see Outcome.AppliedEnforcementNotices. A setup
-			// failure or a missing executable launched no hook child, so the notice
-			// would describe a token trade nobody made.
-			Notices: result.Outcome.AppliedEnforcementNotices(),
 		}
 	}
 }
@@ -211,19 +182,11 @@ func (dispatcher *Dispatcher) Dispatch(ctx context.Context, input DispatchInput)
 		if message := hookMessage(result); message != "" {
 			outcome.Messages = append(outcome.Messages, message)
 		}
-		// Appended per hook rather than read off the final result, so hook A's
-		// disclosure is not lost when hook B stops the chain. A notice describes
-		// something that ALREADY happened.
-		for _, notice := range result.Notices {
-			if strings.TrimSpace(notice) != "" {
-				outcome.Notices = append(outcome.Notices, notice)
-			}
-		}
 
 		if blocked {
 			outcome.Blocked = true
 			outcome.BlockedBy = hook.ID
-			outcome.Reason = blockCause(result)
+			outcome.Reason = blockReason(result)
 			// Stop on the first veto: the action is already denied.
 			return outcome
 		}
@@ -280,38 +243,14 @@ func classifyResult(event Event, result commandResult) (AuditStatus, bool) {
 
 // hookMessage returns the output worth surfacing from a hook run: stdout when
 // present, else stderr. Empty when the hook produced no output.
-// STDOUT OR STDERR, AND NOTHING ELSE. The enforcement notices used to be
-// prepended here as well, so that afterTool got the disclosure and its own output
-// on one line. That was the only delivery available when this was written, and it
-// is not any more: the notices travel typed on DispatchOutcome.Notices, and the
-// agent loop merges them into ToolResult.EnforcementNotices for beforeTool and
-// afterTool alike.
-//
-// Keeping the fold as well made the same disclosure arrive twice, once from the
-// typed slice that every surface composes and once inside the hook feedback block
-// in the body. The two writers carry the identical fixed string, so the model saw
-// it doubled and a bash or exec card showed it in both the furniture and the body.
-// One owner per fact, and for a notice that owner is the typed slice.
 func hookMessage(result commandResult) string {
-	message := strings.TrimSpace(result.Stdout)
-	if message == "" {
-		message = strings.TrimSpace(result.Stderr)
+	if trimmed := strings.TrimSpace(result.Stdout); trimmed != "" {
+		return trimmed
 	}
-	return message
+	return strings.TrimSpace(result.Stderr)
 }
 
-// blockCause explains a veto in the hook's own words, and says nothing about
-// enforcement.
-//
-// THE SAME RULE AS hookMessage. The blocking hook's notices used to be folded in
-// here as well, from before the typed slice existed, and Dispatch had already
-// appended them to DispatchOutcome.Notices, so a hook that vetoed while running
-// without write confinement put one disclosure on two channels. The one consumer
-// made up for it by dropping every notice whose text appeared anywhere in the
-// reason, which also dropped an EARLIER hook's disclosure whenever the blocking
-// hook's output happened to quote it. The notice now travels on the typed slice
-// only, whichever hook in the chain produced it. Reported by CodeRabbit.
-func blockCause(result commandResult) string {
+func blockReason(result commandResult) string {
 	if result.TimedOut {
 		if trimmed := strings.TrimSpace(result.Stderr); trimmed != "" {
 			return "hook timed out: " + trimmed
@@ -349,14 +288,7 @@ func (dispatcher *Dispatcher) recordCompleted(hook Definition, input DispatchInp
 		Matcher:    hook.Matcher,
 		ToolCallID: input.ToolCallID,
 		Status:     status,
-		Results: []AuditResult{{
-			ExitCode: result.ExitCode,
-			Stdout:   result.Stdout,
-			Stderr:   result.Stderr,
-			// The notice is not in stdout or stderr by design, so the durable record
-			// has to carry it or the fact ends with the dispatch result.
-			EnforcementNotices: append([]string(nil), result.Notices...),
-		}},
+		Results:    []AuditResult{{ExitCode: result.ExitCode, Stdout: result.Stdout, Stderr: result.Stderr}},
 		DurationMs: durationMs,
 	})
 }

internal/hooks/dispatch_test.go

@@ -244,8 +244,8 @@ func TestClassifyResultTimedOutFailsClosedForBeforeTool(t *testing.T) {
 	if status, blocked := classifyResult(EventAfterTool, timedOut); blocked || status != AuditError {
 		t.Fatalf("afterTool timeout classify = (%q, %v), want (error, false)", status, blocked)
 	}
-	if reason := blockCause(timedOut); !strings.Contains(reason, "timed out") {
-		t.Fatalf("blockCause = %q, want a timeout message", reason)
+	if reason := blockReason(timedOut); !strings.Contains(reason, "timed out") {
+		t.Fatalf("blockReason = %q, want a timeout message", reason)
 	}
 }
 

internal/hooks/enforcement_audit_record_test.go

@@ -1,119 +0,0 @@
-package hooks
-
-import (
-	"context"
-	"os/exec"
-	"path/filepath"
-	"testing"
-)
-
-// auditedDispatcher wires a real audit store to a dispatcher whose hook result
-// is whatever the caller wants, and returns the events that survived the write.
-func auditedDispatcher(t *testing.T, hook Definition, result commandResult) []AuditEvent {
-	t.Helper()
-	store, err := NewAuditStore(AuditStoreOptions{AuditPath: filepath.Join(t.TempDir(), "audit.jsonl")})
-	if err != nil {
-		t.Fatalf("NewAuditStore: %v", err)
-	}
-	dispatcher := NewDispatcher(DispatcherOptions{
-		Config: beforeToolConfig(hook),
-		Audit:  store,
-		run: func(context.Context, string, []string, []byte, string, []string) commandResult {
-			return result
-		},
-	})
-	dispatcher.Dispatch(context.Background(), DispatchInput{Event: EventBeforeTool, ToolName: "bash", ToolCallID: "call_1"})
-
-	// READ BACK FROM DISK, not from the in-memory event the append returned. The
-	// durable reader is the consumer this field exists for.
-	events, err := store.ReadEvents()
-	if err != nil {
-		t.Fatalf("ReadEvents: %v", err)
-	}
-	return events
-}
-
-func completedResults(t *testing.T, events []AuditEvent) []AuditResult {
-	t.Helper()
-	for _, event := range events {
-		if len(event.Results) > 0 {
-			return event.Results
-		}
-	}
-	t.Fatalf("no completed record was written: %#v", events)
-	return nil
-}
-
-// THE TRANSIENT DISPATCH RESULT IS NOT WHERE THIS FACT CAN LIVE.
-//
-// recordCompleted kept an exit code, stdout and stderr, and the notice is
-// deliberately in none of those. So once the dispatch result was gone, an audit
-// or recovery reader could not tell that a hook had run under the weakened
-// DenyRead token, whatever the hook did afterwards.
-func TestTheAuditRecordKeepsTheEnforcementNotice(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-
-	for _, testCase := range []struct {
-		name   string
-		result commandResult
-	}{
-		{"launched and succeeded", commandResult{ExitCode: 0, Stdout: "looks fine", Notices: []string{notice}}},
-		{"vetoed the tool", commandResult{ExitCode: 2, Stderr: "policy violation", Notices: []string{notice}}},
-		{"silent hook", commandResult{ExitCode: 0, Notices: []string{notice}}},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			results := completedResults(t, auditedDispatcher(t,
-				Definition{ID: "policy", Event: EventBeforeTool, Command: "policy-check", Enabled: true},
-				testCase.result))
-			if len(results) != 1 {
-				t.Fatalf("results = %#v, want one", results)
-			}
-			if len(results[0].EnforcementNotices) != 1 || results[0].EnforcementNotices[0] != notice {
-				t.Errorf("the durable record lost the disclosure: %#v", results[0])
-			}
-			// The existing semantics are untouched.
-			if results[0].ExitCode != testCase.result.ExitCode {
-				t.Errorf("ExitCode = %d, want %d", results[0].ExitCode, testCase.result.ExitCode)
-			}
-			if results[0].Stdout != testCase.result.Stdout || results[0].Stderr != testCase.result.Stderr {
-				t.Errorf("stdout/stderr changed: %#v", results[0])
-			}
-		})
-	}
-}
-
-// A hook with nothing to disclose writes exactly what it wrote before, so a
-// reader of historical records sees no difference.
-func TestAnOrdinaryHookWritesNoEnforcementField(t *testing.T) {
-	results := completedResults(t, auditedDispatcher(t,
-		Definition{ID: "policy", Event: EventBeforeTool, Command: "policy-check", Enabled: true},
-		commandResult{ExitCode: 0, Stdout: "looks fine"}))
-	if len(results[0].EnforcementNotices) != 0 {
-		t.Errorf("a hook with no disclosure recorded one: %#v", results[0])
-	}
-}
-
-// And the durable record inherits the launch-state rule rather than restating
-// it: a hook that never started records no enforcement claim.
-func TestTheAuditRecordMakesNoClaimForAHookThatNeverLaunched(t *testing.T) {
-	store, err := NewAuditStore(AuditStoreOptions{AuditPath: filepath.Join(t.TempDir(), "audit.jsonl")})
-	if err != nil {
-		t.Fatalf("NewAuditStore: %v", err)
-	}
-	dispatcher := NewDispatcher(DispatcherOptions{
-		Config:    beforeToolConfig(Definition{ID: "policy", Event: EventBeforeTool, Command: "policy-check", Enabled: true}),
-		Audit:     store,
-		Cwd:       t.TempDir(),
-		Execution: newRunnerFor(&noticePreparer{build: func() *exec.Cmd { return exec.Command("definitely-not-a-real-binary-zzz") }}),
-	})
-	dispatcher.Dispatch(context.Background(), DispatchInput{Event: EventBeforeTool, ToolName: "bash", ToolCallID: "call_1"})
-	events, err := store.ReadEvents()
-	if err != nil {
-		t.Fatalf("ReadEvents: %v", err)
-	}
-	for _, result := range completedResults(t, events) {
-		if len(result.EnforcementNotices) != 0 {
-			t.Errorf("the durable record claims an enforcement trade for a hook that never started: %#v", result)
-		}
-	}
-}

internal/hooks/enforcement_launch_sleep_unix_test.go

@@ -1,6 +0,0 @@
-//go:build !windows
-
-package hooks
-
-// sleepScript keeps a launched child alive long enough for a timeout to fire.
-const sleepScript = "sleep 2"

internal/hooks/enforcement_launch_sleep_windows_test.go

@@ -1,6 +0,0 @@
-package hooks
-
-// sleepScript keeps a launched child alive long enough for a timeout to fire.
-// Paired with the !windows file of the same name; both must exist or the
-// platform without one silently loses the timeout case.
-const sleepScript = "ping -n 3 127.0.0.1 > NUL"

internal/hooks/enforcement_launch_state_test.go

@@ -1,184 +0,0 @@
-package hooks
-
-import (
-	"context"
-	"errors"
-	"os/exec"
-	"runtime"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/execution"
-)
-
-const launchStateNotice = "denyRead is configured, so the write jail is not confining writes"
-
-// shellCommand builds a portable child that the platform can actually launch.
-func shellCommand(script string) *exec.Cmd {
-	if runtime.GOOS == "windows" {
-		return exec.Command("cmd.exe", "/c", script)
-	}
-	return exec.Command("/bin/sh", "-c", script)
-}
-
-// noticePreparer plans a command carrying an enforcement notice, and can fail
-// the way the sandbox does before the child exists.
-type noticePreparer struct {
-	prepareErr error
-	build      func() *exec.Cmd
-}
-
-func (preparer *noticePreparer) PrepareExecution(_ context.Context, request execution.Request) (execution.PreparedCommand, error) {
-	if preparer.prepareErr != nil {
-		return execution.PreparedCommand{}, preparer.prepareErr
-	}
-	command := preparer.build
-	if command == nil {
-		command = func() *exec.Cmd { return exec.Command(request.Command.Name, request.Command.Args...) }
-	}
-	return execution.PreparedCommand{
-		Command:     command(),
-		Enforcement: execution.Enforcement{Notices: []string{launchStateNotice}},
-	}, nil
-}
-
-// PLANNING A WRAPPED COMMAND IS NOT PROOF THAT ANYTHING RAN.
-//
-// Enforcement.Notices describes the shape the command was PREPARED to run
-// under. Copying it straight out made the completed-enforcement claim for
-// commands that never existed: a sandbox setup failure and a missing executable
-// are both decided before the child launches, so the hook message told the
-// operator the write jail had been traded away for a process that never
-// started.
-//
-// Everything after launch keeps the disclosure, including a nonzero exit, a
-// timeout and a cancellation: those happened to a child that really did run
-// under that token.
-//
-// Driven through the execution runner rather than a hand-built commandResult,
-// because the projection is the thing under test.
-func TestTheHookRunnerOnlyDisclosesEnforcementForAChildThatLaunched(t *testing.T) {
-	for _, testCase := range []struct {
-		name         string
-		preparer     *noticePreparer
-		timeout      time.Duration
-		wantNotice   bool
-		wantTimedOut bool
-	}{
-		{
-			name:       "sandbox setup failed before the child existed",
-			preparer:   &noticePreparer{prepareErr: errors.New("could not build the restricted token")},
-			wantNotice: false,
-		},
-		{
-			name: "the executable was never found",
-			preparer: &noticePreparer{build: func() *exec.Cmd {
-				return exec.Command("definitely-not-a-real-binary-zzz")
-			}},
-			wantNotice: false,
-		},
-		{
-			name:       "the child launched and succeeded",
-			preparer:   &noticePreparer{build: func() *exec.Cmd { return shellCommand("exit 0") }},
-			wantNotice: true,
-		},
-		{
-			name:       "the child launched and exited nonzero",
-			preparer:   &noticePreparer{build: func() *exec.Cmd { return shellCommand("exit 3") }},
-			wantNotice: true,
-		},
-		{
-			name:         "the child launched and timed out",
-			preparer:     &noticePreparer{build: func() *exec.Cmd { return shellCommand(sleepScript) }},
-			timeout:      150 * time.Millisecond,
-			wantNotice:   true,
-			wantTimedOut: true,
-		},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			ctx := context.Background()
-			if testCase.timeout > 0 {
-				var cancel context.CancelFunc
-				ctx, cancel = context.WithTimeout(ctx, testCase.timeout)
-				defer cancel()
-			}
-			run := executionCommandRunner(execution.NewRunner(testCase.preparer))
-			result := run(ctx, "hook-command", nil, nil, t.TempDir(), nil)
-
-			if result.TimedOut != testCase.wantTimedOut {
-				t.Fatalf("TimedOut = %v, want %v: the case did not reach the outcome kind it is named for", result.TimedOut, testCase.wantTimedOut)
-			}
-			if got := len(result.Notices) > 0; got != testCase.wantNotice {
-				t.Fatalf("notices present = %v, want %v: %#v", got, testCase.wantNotice, result.Notices)
-			}
-			// Asserted on Notices, which is where the disclosure travels. It used
-			// to be folded into the hook message as well, and the agent loop now
-			// merges Notices into the typed enforcement slice for both hook
-			// phases, so carrying it in both places delivered it twice.
-			notices := strings.Join(result.Notices, "\n")
-			if testCase.wantNotice && !strings.Contains(notices, launchStateNotice) {
-				t.Errorf("a launched child lost its disclosure:\n%s", notices)
-			}
-			if !testCase.wantNotice && strings.Contains(notices, launchStateNotice) {
-				t.Errorf("a child that never launched claimed the token was traded away:\n%s", notices)
-			}
-			if message := hookMessage(result); strings.Contains(message, launchStateNotice) {
-				t.Errorf("the disclosure also rode along in the hook message, so it reaches the model twice:\n%s", message)
-			}
-		})
-	}
-}
-
-// And the same rule has to hold on the veto path, which returns early and is what
-// the model actually sees. Both channels are checked: the notice travels on
-// Notices, and Reason must not grow a copy of it either.
-func TestAVetoingHookThatNeverLaunchedClaimsNoEnforcement(t *testing.T) {
-	dispatcher := NewDispatcher(DispatcherOptions{
-		Config: beforeToolConfig(Definition{ID: "policy", Event: EventBeforeTool, Command: "policy-check", Enabled: true}),
-		Cwd:    t.TempDir(),
-		// A missing executable rather than a prepare error: a prepare error never
-		// builds the PreparedCommand, so its outcome carries no planned notice and
-		// the assertion below would hold with the launch gate deleted. This shape
-		// plans the notice and then fails to launch.
-		Execution: execution.NewRunner(&noticePreparer{build: func() *exec.Cmd {
-			return exec.Command("definitely-not-a-real-binary-zzz")
-		}}),
-	})
-	outcome := dispatcher.Dispatch(context.Background(), DispatchInput{Event: EventBeforeTool, ToolName: "bash"})
-	if !outcome.Blocked {
-		t.Fatal("SETUP INVALID: a beforeTool hook that could not run must fail closed, or the veto path is not exercised")
-	}
-	if len(outcome.Notices) != 0 {
-		t.Errorf("the dispatch outcome claims an enforcement trade for a hook that never started: %#v", outcome.Notices)
-	}
-	if strings.Contains(outcome.Reason, launchStateNotice) {
-		t.Errorf("the veto reason claims an enforcement trade for a hook that never started:\n%s", outcome.Reason)
-	}
-}
-
-// A launched hook still carries it all the way into the dispatch outcome, on the
-// typed slice and only there.
-func TestALaunchedHookCarriesTheNoticeIntoTheDispatchOutcome(t *testing.T) {
-	dispatcher := NewDispatcher(DispatcherOptions{
-		Config:    beforeToolConfig(Definition{ID: "policy", Event: EventBeforeTool, Command: "policy-check", Enabled: true}),
-		Cwd:       t.TempDir(),
-		Execution: execution.NewRunner(&noticePreparer{build: func() *exec.Cmd { return shellCommand("exit 2") }}),
-	})
-	outcome := dispatcher.Dispatch(context.Background(), DispatchInput{Event: EventBeforeTool, ToolName: "bash"})
-	if !outcome.Blocked {
-		t.Fatal("SETUP INVALID: the hook did not veto, so the reason path is not exercised")
-	}
-	if got := strings.Count(strings.Join(outcome.Notices, "\n"), launchStateNotice); got != 1 {
-		t.Errorf("a hook that really ran under the weakened token disclosed it %d times on Notices, want once: %#v", got, outcome.Notices)
-	}
-	if strings.Contains(outcome.Reason, launchStateNotice) {
-		t.Errorf("the veto reason carries a second copy of the notice:\n%s", outcome.Reason)
-	}
-}
-
-// newRunnerFor keeps the audit tests readable without importing the execution
-// package into every file that needs one.
-func newRunnerFor(preparer *noticePreparer) *execution.Runner {
-	return execution.NewRunner(preparer)
-}

internal/hooks/enforcement_notice_test.go

@@ -1,116 +0,0 @@
-package hooks
-
-import (
-	"context"
-	"strings"
-	"testing"
-)
-
-// A HOOK THAT RAN UNDER THE WEAKENED TOKEN STILL SAYS SO, ON THE TYPED CHANNEL.
-//
-// The projection once kept stdout, stderr and an exit code and dropped the
-// notices, so such a hook ran silently. The first fix put them into the message
-// alongside the hook's own output, which delivered them but made Messages two
-// things at once. Now that the agent loop merges Notices into the typed
-// EnforcementNotices for beforeTool and afterTool alike, folding them into the
-// message as well delivered the same disclosure twice.
-//
-// So the property is unchanged and its carrier moved: whatever the hook printed,
-// the notice reaches Notices exactly once and never rides along in Messages.
-func TestAHookSurfacesTheEnforcementNoticeOnTheTypedChannel(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-
-	for _, testCase := range []struct {
-		name   string
-		result commandResult
-	}{
-		{"hook printed nothing", commandResult{ExitCode: 0, Notices: []string{notice}}},
-		{"hook printed to stdout", commandResult{ExitCode: 0, Stdout: "looks fine", Notices: []string{notice}}},
-		{"hook printed to stderr only", commandResult{ExitCode: 0, Stderr: "a warning", Notices: []string{notice}}},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			result := testCase.result
-			dispatcher := NewDispatcher(DispatcherOptions{
-				Config: beforeToolConfig(Definition{ID: "vet", Event: EventAfterTool, Command: "vet", Enabled: true}),
-				run: func(context.Context, string, []string, []byte, string, []string) commandResult {
-					return result
-				},
-			})
-			outcome := dispatcher.Dispatch(context.Background(), DispatchInput{Event: EventAfterTool, ToolName: "bash"})
-
-			if got := strings.Count(strings.Join(outcome.Notices, "\n"), notice); got != 1 {
-				t.Fatalf("the notice reached Notices %d times, want once: %v", got, outcome.Notices)
-			}
-			// AND NOT IN THE PROSE AS WELL, which is what made it arrive twice.
-			if joined := strings.Join(outcome.Messages, "\n"); strings.Contains(joined, notice) {
-				t.Errorf("the notice also rode along in Messages, so every surface that composes the typed slice shows it twice:\n%s", joined)
-			}
-		})
-	}
-}
-
-// A hook's own output is untouched, with a notice or without one.
-func TestAHookMessageCarriesOnlyTheHooksOwnOutput(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-	if message := hookMessage(commandResult{ExitCode: 0, Stdout: "looks fine"}); message != "looks fine" {
-		t.Errorf("hookMessage = %q, want the hook's own output untouched", message)
-	}
-	if message := hookMessage(commandResult{ExitCode: 0, Stdout: "looks fine", Notices: []string{notice}}); message != "looks fine" {
-		t.Errorf("hookMessage = %q, want the notice left to the typed channel", message)
-	}
-	if message := hookMessage(commandResult{ExitCode: 0}); message != "" {
-		t.Errorf("a silent hook with no notice produced %q", message)
-	}
-	if message := hookMessage(commandResult{ExitCode: 0, Notices: []string{notice}}); message != "" {
-		t.Errorf("a silent hook produced %q, want nothing: its disclosure travels typed", message)
-	}
-}
-
-// THROUGH Dispatch, NOT A HAND-BUILT commandResult.
-//
-// The blocking branch returns immediately, so it never touches hookMessage, and a
-// vetoing beforeTool hook that ran without write confinement once reported only
-// the veto. The disclosure still has to come out of that branch, and it has to
-// come out ONCE: the blocking hook's notices used to be folded into Reason as well
-// as appended to Notices, so the same fact travelled on two channels and the
-// consumer had to guess which copy to drop. Reason is the hook's words, and the
-// notice travels on the typed slice like every other hook's.
-func TestABlockedBeforeToolHookCarriesItsNoticeOnTheTypedSliceOnly(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-
-	dispatcher := NewDispatcher(DispatcherOptions{
-		Config: beforeToolConfig(Definition{ID: "policy", Event: EventBeforeTool, Command: "policy-check", Enabled: true}),
-		run: func(context.Context, string, []string, []byte, string, []string) commandResult {
-			return commandResult{ExitCode: 2, Stderr: "policy violation", Notices: []string{notice}}
-		},
-	})
-
-	outcome := dispatcher.Dispatch(context.Background(), DispatchInput{Event: EventBeforeTool, ToolName: "bash"})
-	if !outcome.Blocked {
-		t.Fatal("SETUP INVALID: the hook did not block, so the blocking branch was never taken")
-	}
-	if len(outcome.Notices) != 1 || outcome.Notices[0] != notice {
-		t.Errorf("the veto lost the enforcement notice from the typed slice: %#v", outcome.Notices)
-	}
-	if outcome.Reason != "policy violation" {
-		t.Errorf("Reason = %q, want the hook's own explanation and nothing else", outcome.Reason)
-	}
-	// Across BOTH channels, because a copy in each is the defect this pins.
-	if got := strings.Count(outcome.Reason, notice) + strings.Count(strings.Join(outcome.Notices, "\n"), notice); got != 1 {
-		t.Errorf("the notice appears %d times across Reason and Notices, want once", got)
-	}
-}
-
-// And a veto with no notice reads exactly as it did before.
-func TestABlockedHookWithoutANoticeIsUnchanged(t *testing.T) {
-	dispatcher := NewDispatcher(DispatcherOptions{
-		Config: beforeToolConfig(Definition{ID: "policy", Event: EventBeforeTool, Command: "policy-check", Enabled: true}),
-		run: func(context.Context, string, []string, []byte, string, []string) commandResult {
-			return commandResult{ExitCode: 2, Stderr: "policy violation"}
-		},
-	})
-	outcome := dispatcher.Dispatch(context.Background(), DispatchInput{Event: EventBeforeTool, ToolName: "bash"})
-	if outcome.Reason != "policy violation" {
-		t.Errorf("Reason = %q, want the hook's own explanation untouched", outcome.Reason)
-	}
-}

internal/hooks/hooks.go

@@ -118,19 +118,6 @@ type AuditResult struct {
 	ExitCode int    `json:"exitCode"`
 	Stdout   string `json:"stdout,omitempty"`
 	Stderr   string `json:"stderr,omitempty"`
-	// EnforcementNotices are the least-privilege disclosures that were true of
-	// this hook's execution.
-	//
-	// A DURABLE READER CANNOT RECOVER A FACT THAT WAS DROPPED IN CONVERSION. The
-	// notice is deliberately not written into stdout or stderr, so recording only
-	// those three fields meant that once the transient dispatch result was gone,
-	// nothing could tell an audit or recovery reader that a successful, failing or
-	// vetoing hook had run under the weakened DenyRead token.
-	//
-	// Typed rather than a rendered line, and omitempty, so historical records that
-	// predate the field read back unchanged and an ordinary hook writes exactly
-	// what it wrote before.
-	EnforcementNotices []string `json:"enforcementNotices,omitempty"`
 }
 
 type AuditEvent struct {

internal/mcp/adapter_launch_disclosure_test.go

@@ -1,163 +0,0 @@
-package mcp
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/execution"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// helperCommandName is a command that resolves on this platform, so registration
-// reaches connectStdio. What actually runs is whatever the preparer returns.
-func helperCommandName() string {
-	if runtime.GOOS == "windows" {
-		return "cmd.exe"
-	}
-	return "sh"
-}
-
-const adapterLaunchNotice = "denyRead is configured, so the write jail is not confining writes"
-
-// adapterHelperPreparer models the Windows wrapped plan: the command is the
-// HELPER, the launch fact is a report file, and the plan's cleanup removes that
-// file. The cleanup is the part that matters, because it is what runs inside
-// client.Close and destroys the evidence a later decision needs.
-type adapterHelperPreparer struct {
-	reportPath  string
-	reportBody  string
-	writeReport bool
-	called      bool
-}
-
-func (preparer *adapterHelperPreparer) PrepareExecution(_ context.Context, _ execution.Request) (execution.PreparedCommand, error) {
-	preparer.called = true
-	if preparer.writeReport {
-		if err := os.WriteFile(preparer.reportPath, []byte(preparer.reportBody), 0o600); err != nil {
-			return execution.PreparedCommand{}, err
-		}
-	}
-	// A helper that starts, says nothing an MCP client understands, and exits, so
-	// the handshake fails the way it does when the requested server never existed.
-	var command *exec.Cmd
-	if runtime.GOOS == "windows" {
-		command = exec.Command("cmd.exe", "/c", "exit 0")
-	} else {
-		command = exec.Command("/bin/sh", "-c", "exit 0")
-	}
-	path := preparer.reportPath
-	return execution.PreparedCommand{
-		Command:                   command,
-		ChildLaunchOwnedByAdapter: true,
-		Enforcement:               execution.Enforcement{Notices: []string{adapterLaunchNotice}},
-		Report: func() (execution.AdapterReport, error) {
-			raw, err := os.ReadFile(path)
-			if errors.Is(err, os.ErrNotExist) {
-				return execution.AdapterReport{}, nil
-			}
-			if err != nil {
-				return execution.AdapterReport{}, err
-			}
-			var report execution.AdapterReport
-			if err := json.Unmarshal(raw, &report); err != nil {
-				return execution.AdapterReport{}, err
-			}
-			return report, nil
-		},
-		Cleanup: func() { _ = os.Remove(path) },
-	}, nil
-}
-
-func registerWithAdapterHelper(t *testing.T, preparer *adapterHelperPreparer) *Runtime {
-	t.Helper()
-	runtime, err := RegisterTools(context.Background(), tools.NewRegistry(), config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"docs": {Type: "stdio", Command: helperCommandName()},
-	}}, RegisterOptions{
-		// No ClientFactory on purpose: an injected factory skips connectStdio
-		// entirely, which is where the decision under test is made, and the test
-		// would pass with the fix removed.
-		Execution:     execution.NewRunner(preparer),
-		WorkspaceRoot: t.TempDir(),
-	})
-	if err != nil {
-		t.Fatalf("RegisterTools: %v", err)
-	}
-	t.Cleanup(func() { _ = runtime.Close() })
-	return runtime
-}
-
-// A HELPER THAT NEVER CREATED THE SERVER HAS NOTHING TO DISCLOSE.
-//
-// For an adapter-owned launch, cmd.Start proves only that the sandbox helper
-// started. It can then fail setup-marker validation, ACL application, network
-// validation, token construction, or CreateProcessAsUser without ever creating
-// the requested MCP server. The launch sink already made that distinction; the
-// initialize-error path did not, and carried the planned notices out
-// unconditionally. The operator was told the server had run without write
-// confinement when no server had run at all.
-func TestAnMCPHelperThatReportedNoChildDisclosesNothing(t *testing.T) {
-	directory := t.TempDir()
-	preparer := &adapterHelperPreparer{
-		reportPath:  filepath.Join(directory, "report.json"),
-		reportBody:  `{"childLaunched":false}`,
-		writeReport: true,
-	}
-	runtime := registerWithAdapterHelper(t, preparer)
-
-	// SETUP: the attempt really did fail, or there is no disclosure decision here.
-	if len(runtime.Skipped()) == 0 {
-		t.Fatal("SETUP INVALID: the server connected, so the initialize-failure path is not under test")
-	}
-	if got := runtime.StartupDisclosures(); len(got) != 0 {
-		t.Fatalf("a helper that reported no child announced %v; no server ran, confined or otherwise", got)
-	}
-}
-
-// AND ONE THAT DID CREATE IT DISCLOSES ONCE.
-//
-// The companion case, and the one that keeps the assertion above from being
-// satisfied by a path that discloses nothing ever. The child ran under the
-// planned token and may have done filesystem work before the handshake failed,
-// so the disclosure has to survive the failure.
-func TestAnMCPHelperThatLaunchedTheChildDisclosesOnce(t *testing.T) {
-	directory := t.TempDir()
-	preparer := &adapterHelperPreparer{
-		reportPath:  filepath.Join(directory, "report.json"),
-		reportBody:  `{"childLaunched":true}`,
-		writeReport: true,
-	}
-	runtime := registerWithAdapterHelper(t, preparer)
-
-	if !preparer.called {
-		t.Fatal("SETUP INVALID: the preparer never ran, so connectStdio was never reached")
-	}
-	disclosures := runtime.StartupDisclosures()
-	if len(disclosures) != 1 {
-		t.Fatalf("a server that really ran under the weakened token produced %d disclosures, want exactly one: %v", len(disclosures), disclosures)
-	}
-	if len(disclosures[0].Notices) != 1 || disclosures[0].Notices[0] != adapterLaunchNotice {
-		t.Fatalf("the disclosure carries %v, want the one planned notice", disclosures[0].Notices)
-	}
-}
-
-// A helper that wrote no report at all is the same answer as one that reported
-// no child: absence is not confirmation.
-func TestAnMCPHelperThatWroteNoReportDisclosesNothing(t *testing.T) {
-	directory := t.TempDir()
-	preparer := &adapterHelperPreparer{reportPath: filepath.Join(directory, "report.json")}
-	runtime := registerWithAdapterHelper(t, preparer)
-
-	if len(runtime.Skipped()) == 0 {
-		t.Fatal("SETUP INVALID: the server connected, so the initialize-failure path is not under test")
-	}
-	if got := runtime.StartupDisclosures(); len(got) != 0 {
-		t.Fatalf("a helper that published nothing announced %v", got)
-	}
-}

internal/mcp/adapter_launch_ordering_test.go

@@ -1,281 +0,0 @@
-package mcp
-
-import (
-	"bufio"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/execution"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-const (
-	adapterHelperModeEnv   = "ZERO_TEST_MCP_ADAPTER_MODE"
-	adapterHelperReportEnv = "ZERO_TEST_MCP_ADAPTER_REPORT"
-
-	// answerThenPublish models the ordering the fix is about: the child is
-	// serving before the adapter has recorded that it exists.
-	answerThenPublish = "answer-then-publish"
-	// failThenPublish is the same ordering on the other exit: the handshake dies
-	// first and the adapter publishes on its way out.
-	failThenPublish = "fail-then-publish"
-	// failAndNeverPublish is the companion that keeps the two above from being
-	// satisfied by disclosing unconditionally.
-	failAndNeverPublish = "fail-and-never-publish"
-)
-
-// TestAdapterHelperProcess is the helper process body, not a test.
-//
-// It exists so the report can be published at a controlled point RELATIVE TO THE
-// HANDSHAKE. A fixture that writes the finished report during PrepareExecution,
-// as the older test does, publishes before the helper command has even started,
-// so every ordering this file is about is already over before the parent looks.
-func TestAdapterHelperProcess(t *testing.T) {
-	mode := os.Getenv(adapterHelperModeEnv)
-	if mode == "" {
-		t.Skip("not the helper process")
-	}
-	reportPath := os.Getenv(adapterHelperReportEnv)
-	publish := func() {
-		// Same shape the Windows helper writes, into the file the preparer already
-		// created empty.
-		_ = os.WriteFile(reportPath, []byte(`{"childLaunched":true}`), 0o600)
-	}
-
-	switch mode {
-	case answerThenPublish:
-		serveOneMCPSessionThenPublish(publish)
-	case failThenPublish:
-		// The handshake dies here, before anything is recorded. Closing stdout is
-		// the child going away; the adapter is still running.
-		_ = os.Stdout.Close()
-		time.Sleep(300 * time.Millisecond)
-		publish()
-	case failAndNeverPublish:
-		_ = os.Stdout.Close()
-		time.Sleep(300 * time.Millisecond)
-	}
-	// Before the framework can write anything to the pipe the parent is reading.
-	os.Exit(0)
-}
-
-// serveOneMCPSessionThenPublish answers the handshake and only then records that
-// the child exists, which is the interleaving that used to lose the disclosure.
-func serveOneMCPSessionThenPublish(publish func()) {
-	reader := bufio.NewReader(os.Stdin)
-	out := bufio.NewWriter(os.Stdout)
-	published := false
-	for {
-		line, err := reader.ReadString('\n')
-		if strings.TrimSpace(line) != "" {
-			var message struct {
-				ID     *int   `json:"id"`
-				Method string `json:"method"`
-			}
-			if json.Unmarshal([]byte(strings.TrimSpace(line)), &message) == nil && message.ID != nil {
-				var result string
-				switch message.Method {
-				case "initialize":
-					result = `{"protocolVersion":"2024-11-05"}`
-				case "tools/list":
-					result = `{"tools":[]}`
-				default:
-					result = `{}`
-				}
-				fmt.Fprintf(out, `{"jsonrpc":"2.0","id":%d,"result":%s}`+"\n", *message.ID, result)
-				_ = out.Flush()
-				if message.Method == "initialize" && !published {
-					// AFTER the response is on the wire. The parent can act on a
-					// handshake that succeeded before this line runs.
-					time.Sleep(300 * time.Millisecond)
-					publish()
-					published = true
-				}
-			}
-		}
-		if err != nil {
-			return
-		}
-	}
-}
-
-// livePublishPreparer models the Windows wrapped plan with the real publication
-// ordering: the report file is created EMPTY before the launch, exactly as
-// openWindowsExecutionReport does, and the helper fills it in later.
-type livePublishPreparer struct {
-	mode       string
-	reportPath string
-	called     bool
-}
-
-func (preparer *livePublishPreparer) PrepareExecution(_ context.Context, _ execution.Request) (execution.PreparedCommand, error) {
-	preparer.called = true
-	// The empty file the parent can see before anything is published. This is the
-	// state that is neither "no child" nor "child created".
-	if err := os.WriteFile(preparer.reportPath, nil, 0o600); err != nil {
-		return execution.PreparedCommand{}, err
-	}
-	command := exec.Command(os.Args[0], "-test.run=^TestAdapterHelperProcess$")
-	command.Env = append(os.Environ(),
-		adapterHelperModeEnv+"="+preparer.mode,
-		adapterHelperReportEnv+"="+preparer.reportPath,
-	)
-	path := preparer.reportPath
-	return execution.PreparedCommand{
-		Command:                   command,
-		ChildLaunchOwnedByAdapter: true,
-		Enforcement:               execution.Enforcement{Notices: []string{adapterLaunchNotice}},
-		Report: func() (execution.AdapterReport, error) {
-			raw, err := os.ReadFile(path)
-			if errors.Is(err, os.ErrNotExist) {
-				return execution.AdapterReport{}, nil
-			}
-			if err != nil {
-				return execution.AdapterReport{}, err
-			}
-			var report execution.AdapterReport
-			// An empty or half-written file decodes to an error, which is the
-			// unsettled state and not an answer.
-			if err := json.Unmarshal(raw, &report); err != nil {
-				return execution.AdapterReport{}, err
-			}
-			return report, nil
-		},
-		Cleanup: func() { _ = os.Remove(path) },
-	}, nil
-}
-
-func registerWithLivePublisher(t *testing.T, mode string) (*Runtime, *livePublishPreparer) {
-	t.Helper()
-	preparer := &livePublishPreparer{mode: mode, reportPath: filepath.Join(t.TempDir(), "report.json")}
-	runtime, err := RegisterTools(context.Background(), tools.NewRegistry(), config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"docs": {Type: "stdio", Command: helperCommandName()},
-	}}, RegisterOptions{
-		Execution:     execution.NewRunner(preparer),
-		WorkspaceRoot: t.TempDir(),
-	})
-	if err != nil {
-		t.Fatalf("RegisterTools: %v", err)
-	}
-	t.Cleanup(func() { _ = runtime.Close() })
-	if !preparer.called {
-		t.Fatal("SETUP INVALID: the preparer never ran, so connectStdio was never reached")
-	}
-	return runtime, preparer
-}
-
-// A HANDSHAKE THAT SUCCEEDED IS PROOF THE CHILD RAN, WHATEVER THE REPORT SAYS YET.
-//
-// The child is created before the adapter records it, and it inherits the MCP
-// pipes, so it can answer initialize while the report file is still the empty one
-// the adapter opened. Reading it at that instant and remembering the answer
-// turned "not yet" into "never" for the rest of the session, and the operator was
-// never told the server serving these tools ran without the write jail.
-//
-// The adapter speaks no MCP, so a well-formed response can only have come from
-// the requested child. That is terminal evidence and needs no report.
-func TestADisclosureSurvivesAReportPublishedAfterTheHandshake(t *testing.T) {
-	runtime, _ := registerWithLivePublisher(t, answerThenPublish)
-
-	// SETUP: the server really connected, or this is the failure path instead.
-	if skipped := runtime.Skipped(); len(skipped) != 0 {
-		t.Fatalf("SETUP INVALID: the server did not connect (%v), so the successful-handshake path is not under test", skipped)
-	}
-	disclosures := runtime.StartupDisclosures()
-	if len(disclosures) != 1 {
-		t.Fatalf("a server that answered the handshake produced %d disclosures, want exactly one: %v", len(disclosures), disclosures)
-	}
-	if len(disclosures[0].Notices) != 1 || disclosures[0].Notices[0] != adapterLaunchNotice {
-		t.Fatalf("the disclosure carries %v, want the one planned notice", disclosures[0].Notices)
-	}
-}
-
-// AND ON THE OTHER EXIT, THE DECISION WAITS FOR THE ADAPTER.
-//
-// Here the handshake dies first and the adapter publishes on its way out. The
-// decision used to be taken before Close, precisely because Close deletes the
-// report, so it read the empty file and answered "no child" about a server that
-// really had run. Settling from inside cleanup, with the file still there, is what
-// lets the answer be taken after the adapter is terminal instead of before it.
-func TestADisclosureSurvivesAReportPublishedAfterAFailedHandshake(t *testing.T) {
-	runtime, _ := registerWithLivePublisher(t, failThenPublish)
-
-	// SETUP: the attempt really failed, or the successful path is being measured.
-	if len(runtime.Skipped()) == 0 {
-		t.Fatal("SETUP INVALID: the server connected, so the initialize-failure path is not under test")
-	}
-	disclosures := runtime.StartupDisclosures()
-	if len(disclosures) != 1 {
-		t.Fatalf("a helper that published its launch on the way out produced %d disclosures, want exactly one: %v", len(disclosures), disclosures)
-	}
-
-	// THROUGH THE ERROR, not only through the sink. Registration merges the two,
-	// so asserting the sink alone passes while the failure the operator actually
-	// reads carries nothing. This is the carrier that exists because the client
-	// holding the notices has already been closed and discarded by then.
-	skipped := runtime.Skipped()
-	if len(skipped) != 1 {
-		t.Fatalf("skipped = %v, want exactly the one server", skipped)
-	}
-	carried := startupNoticesFromError(skipped[0].Err)
-	if len(carried) != 1 || carried[0] != adapterLaunchNotice {
-		t.Fatalf("the initialize failure carries %v, want the planned notice; the decision was taken before the adapter settled", carried)
-	}
-}
-
-// AND AN ADAPTER THAT NEVER PUBLISHED STILL DISCLOSES NOTHING.
-//
-// The companion that keeps both cases above from being satisfied by announcing
-// unconditionally. Settling reads the report one last time and finds nothing,
-// which after the adapter has exited is the answer rather than a race.
-func TestNoDisclosureWhenTheAdapterExitsWithoutPublishing(t *testing.T) {
-	runtime, _ := registerWithLivePublisher(t, failAndNeverPublish)
-
-	if len(runtime.Skipped()) == 0 {
-		t.Fatal("SETUP INVALID: the server connected, so the initialize-failure path is not under test")
-	}
-	if got := runtime.StartupDisclosures(); len(got) != 0 {
-		t.Fatalf("a helper that published nothing announced %v; no server is known to have run", got)
-	}
-}
-
-// THE CARRIER ENFORCES THE RULE ITSELF, NOT ONLY ITS CALLERS.
-//
-// connectAndList reads StartupNotices on the success path and passes the result
-// straight through to the disclosure sources, so this method is a carrier of the
-// launch fact in its own right. Today the handshake confirmation makes the gate
-// redundant: every route that reaches here has already settled the decision
-// positive. It is kept because the redundancy is on the safe side. An edit that
-// moves or loses the confirmation makes this return nothing rather than announce
-// a confinement on the strength of the helper having started, which is the claim
-// this whole mechanism exists to stop making.
-//
-// Driven directly, because no path through connectStdio can reach it with a
-// negative decision, and a test that cannot construct the state it is about would
-// be asserting nothing.
-func TestStartupNoticesAreEmptyWhileTheLaunchIsUnknown(t *testing.T) {
-	client := &Client{startupNotices: []string{adapterLaunchNotice}}
-
-	// SETUP: ungated, this client discloses, or the assertion below is vacuous.
-	if len(client.StartupNotices()) != 1 {
-		t.Fatal("SETUP INVALID: the client discloses nothing even before the gate, so the gate cannot be what is under test")
-	}
-
-	client.launched = func() bool { return false }
-	if got := client.StartupNotices(); len(got) != 0 {
-		t.Fatalf("a client whose launch is not established carries %v", got)
-	}
-	client.launched = func() bool { return true }
-	if got := client.StartupNotices(); len(got) != 1 || got[0] != adapterLaunchNotice {
-		t.Fatalf("an established launch carries %v, want the planned notice", got)
-	}
-}

internal/mcp/client.go

@@ -54,56 +54,6 @@ type ToolClient interface {
 	Close() error
 }
 
-// startupDisclosureError carries a launch disclosure out through a failure.
-//
-// A launched process is a fact about the past: once Start has succeeded the
-// disclosure is true whatever the handshake does next. The client is the only
-// thing that holds it, and the failure paths close and discard the client, so
-// without this the fact dies with the connection it was attached to.
-type startupDisclosureError struct {
-	err     error
-	notices []string
-}
-
-func (e *startupDisclosureError) Error() string { return e.err.Error() }
-func (e *startupDisclosureError) Unwrap() error { return e.err }
-
-// startupNoticesFromError recovers a launch disclosure from a failed connect.
-func startupNoticesFromError(err error) []string {
-	var disclosure *startupDisclosureError
-	if errors.As(err, &disclosure) {
-		return disclosure.notices
-	}
-	return nil
-}
-
-// startupDisclosing is the optional interface a client implements when its
-// LAUNCH carried a least-privilege disclosure. A network server launches no
-// local process, so it does not implement this and reports nothing, which is the
-// correct answer rather than an empty one.
-type startupDisclosing interface {
-	StartupNotices() []string
-}
-
-// StartupNotices reports the disclosures that applied to this server's launch.
-//
-// GATED ON THE SAME DECISION AS EVERY OTHER CARRIER. connectAndList reads this on
-// the success path and hands the result straight to the disclosure sources, so
-// for a while a successfully connected wrapped server disclosed on the strength
-// of cmd.Start returning: the HELPER starting, which is the one thing the report
-// exists because it does not prove. It happened to be right, since a completed
-// handshake does imply the child ran, but by coincidence rather than by rule, and
-// the failure path next to it was already asking the adapter.
-func (client *Client) StartupNotices() []string {
-	if client == nil || len(client.startupNotices) == 0 {
-		return nil
-	}
-	if client.launched != nil && !client.launched() {
-		return nil
-	}
-	return append([]string(nil), client.startupNotices...)
-}
-
 type Client struct {
 	server  Server
 	cmd     *exec.Cmd
@@ -114,20 +64,6 @@ type Client struct {
 	idMu    sync.Mutex
 	nextID  int
 	cleanup func()
-	// startupNotices are the least-privilege disclosures that applied to THIS
-	// server's launch.
-	//
-	// THE FACT DESCRIBES STARTUP, SO IT CANNOT BE RECOVERED FROM A TOOL RESULT.
-	// A stdio server prepared under the weakened token runs for the whole session,
-	// and connectStdio used to keep only the command and its cleanup, so nothing
-	// downstream could tell the operator that the process serving these tools had
-	// reduced write confinement. Kept typed here and rendered exactly once at
-	// registration rather than pasted onto every later tool result.
-	startupNotices []string
-	// launched is the launch decision this server's disclosures are gated on, nil
-	// for a plan whose started process IS the server and where there is nothing to
-	// decide. See internal/execution/child_launch.go.
-	launched func() bool
 
 	writeMu          sync.Mutex
 	writeQueue       chan writeOp
@@ -233,11 +169,6 @@ func (b *boundedBuffer) String() string {
 func connectStdio(ctx context.Context, server Server, options ConnectOptions) (*Client, error) {
 	var cmd *exec.Cmd
 	var cleanup func()
-	var plannedEnforcement execution.Enforcement
-	// Retained from the prepared plan rather than dropped: for a wrapped plan the
-	// adapter, not cmd.Start, owns whether the requested server process exists.
-	var launchTracker *execution.ChildLaunchTracker
-	var ownedLaunch bool
 	cleanupTransferred := false
 	defer func() {
 		if cleanup != nil && !cleanupTransferred {
@@ -261,11 +192,7 @@ func connectStdio(ctx context.Context, server Server, options ConnectOptions) (*
 			return nil, fmt.Errorf("start MCP server %s: %w", server.Name, err)
 		}
 		cmd = prepared.Command
-		plannedEnforcement = prepared.Enforcement
-		ownedLaunch = prepared.ChildLaunchOwnedByAdapter
-		// The tracker's cleanup, not the plan's: it settles the launch decision
-		// before the report file it was read from is deleted.
-		launchTracker, cleanup = execution.NewChildLaunchTracker(prepared)
+		cleanup = prepared.Cleanup
 	} else {
 		cmd = exec.CommandContext(ctx, server.Command, server.Args...)
 		cmd.Env = mergeProcessEnv(server.Env)
@@ -284,55 +211,6 @@ func connectStdio(ctx context.Context, server Server, options ConnectOptions) (*
 		return nil, fmt.Errorf("start MCP server %s: %w", server.Name, err)
 	}
 
-	// PUBLISHED AT START, not at return. Registration abandons a server that
-	// exceeds the connect timeout, and everything below this line (initialize, and
-	// tools/list above it in the caller) can hang past that. Announcing the launch
-	// here is what lets an abandoned attempt still disclose the confinement its
-	// process ran under.
-	//
-	// EXCEPT WHEN START IS NOT THE LAUNCH. For a wrapped plan the process started
-	// above is the sandbox helper, which creates the MCP server only after marker,
-	// ACL, network, SID and token setup, any of which can fail leaving no server at
-	// all. Publishing here would make the durable delivery machinery reliably
-	// announce a confinement nothing ever ran under. Those plans publish from
-	// publishAdapterLaunch below, once the adapter has stated the fact.
-	if !ownedLaunch {
-		publishLaunch(ctx, plannedEnforcement.Notices)
-	}
-	// ONE ANSWER, AND IT IS ONLY CACHED ONCE IT CANNOT CHANGE.
-	//
-	// The adapter's report is a file the plan's cleanup deletes, so a decision made
-	// after cleanup used to read an absent report and answer "no child" about a
-	// server that really did run. Memoizing the first read fixed that ordering and
-	// introduced another: the read can land while the adapter has created the child
-	// and not yet recorded it, and "not yet" got frozen as "never".
-	//
-	// ChildLaunchTracker holds the three states apart. It caches a launch, never an
-	// absence, until the adapter is terminal, and it settles from cleanup with the
-	// report still on disk. See internal/execution/child_launch.go.
-	//
-	// It also gives the success, late and failed paths the same input. The failure
-	// path used to carry client.StartupNotices() unconditionally while the sink was
-	// gated on the adapter, which is two competing definitions of applied
-	// enforcement: an operator was told a server ran without write confinement when
-	// only the sandbox helper ran and the requested server never existed.
-	launchedOnce := func() bool {
-		if !ownedLaunch {
-			return true
-		}
-		return launchTracker.Launched()
-	}
-	// publishAdapterLaunch announces a wrapped plan's launch, but only if the
-	// adapter confirms the requested child was created. Called on both ways this
-	// attempt can end, which is also where an attempt abandoned at the connect
-	// timeout eventually arrives, so a late disclosure is still delivered once.
-	publishAdapterLaunch := func() {
-		if !ownedLaunch || !launchedOnce() {
-			return
-		}
-		publishLaunch(ctx, plannedEnforcement.Notices)
-	}
-
 	client := &Client{
 		server:  server,
 		cmd:     cmd,
@@ -341,51 +219,16 @@ func connectStdio(ctx context.Context, server Server, options ConnectOptions) (*
 		writer:  newMessageWriter(stdin),
 		nextID:  1,
 		cleanup: cleanup,
-		// Recorded only now, AFTER Start returned. Everything above returns early,
-		// so a prepare failure or an executable that could not be launched records
-		// nothing: same launch-state rule hooks and plugins use, expressed by where
-		// this assignment sits rather than by another outcome-kind switch.
-		startupNotices: append([]string(nil), plannedEnforcement.Notices...),
-		launched:       launchedOnce,
 	}
 	cleanupTransferred = true
 	if err := client.initialize(ctx); err != nil {
-		// THE LAUNCH ALREADY HAPPENED, so the fact has to leave through the error.
-		// Start succeeded above, which means the process ran under the planned token
-		// and may have done filesystem work before the handshake failed. Returning a
-		// bare error discards the client, and with it the only carrier the notices
-		// had, so the operator was told the server was unavailable and not that it
-		// had already run without the write jail.
-		// AFTER Close, which waits out the adapter and then settles the decision
-		// with the report still on disk. Asking first would ask an adapter that may
-		// be between creating the child and recording it, and read "not yet" as
-		// "never": the connect timeout ends the attempt here while the helper is
-		// still working.
 		_ = client.Close()
-		launched := launchedOnce()
-		publishAdapterLaunch()
 		message := strings.TrimSpace(stderr.String())
-		failure := fmt.Errorf("initialize MCP server %s: %w", server.Name, err)
 		if message != "" {
-			failure = fmt.Errorf("initialize MCP server %s: %w: %s", server.Name, err, message)
+			return nil, fmt.Errorf("initialize MCP server %s: %w: %s", server.Name, err, message)
 		}
-		// Same decision as the sink above. For a wrapped plan whose helper started
-		// and then failed before creating the requested server, there is nothing to
-		// disclose: no server ran, confined or otherwise.
-		var carried []string
-		if launched {
-			carried = client.StartupNotices()
-		}
-		return nil, &startupDisclosureError{err: failure, notices: carried}
+		return nil, fmt.Errorf("initialize MCP server %s: %w", server.Name, err)
 	}
-	// THE HANDSHAKE IS THE OBSERVATION. A wrapped plan's adapter speaks no MCP and
-	// creates the child suspended, so a well-formed initialize response can only
-	// have come from the requested server, already running. That is terminal
-	// evidence and does not depend on the report having been read yet, which is
-	// what keeps a long-lived session from having to wait for an adapter that will
-	// not exit until the session ends.
-	launchTracker.Confirm()
-	publishAdapterLaunch()
 	return client, nil
 }
 

internal/mcp/enforcement_notice_server_test.go

@@ -1,105 +0,0 @@
-package mcp
-
-import (
-	"bytes"
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// A MODEL-FACING PROTOCOL BOUNDARY IS A PRESENTATION CONSUMER.
-//
-// This branch changed the result contract: Result.Output holds the UNDECORATED
-// base text and ModelOutput is the sole model-facing projection that composes it
-// with the typed enforcement notices. tools/call serialized Output directly,
-// which was a complete value before and is not one now, so an affected Windows
-// command reached an MCP client with its ordinary output and no statement that
-// its DenyRead token shape left writes unconfined.
-//
-// Driven through Serve rather than the accessor, because the question is what
-// goes on the wire.
-func TestMCPToolsCallCarriesTheEnforcementNotice(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-	const output = "ran the command"
-
-	for _, testCase := range []struct {
-		name       string
-		result     tools.Result
-		wantText   string
-		wantIsErr  bool
-		wantNotice bool
-	}{
-		{
-			name:       "successful command with a notice",
-			result:     tools.Result{Status: tools.StatusOK, Output: output, EnforcementNotices: []string{notice}},
-			wantIsErr:  false,
-			wantNotice: true,
-		},
-		{
-			name:       "failed command with a notice",
-			result:     tools.Result{Status: tools.StatusError, Output: output, EnforcementNotices: []string{notice}},
-			wantIsErr:  true,
-			wantNotice: true,
-		},
-		{
-			name:       "ordinary command with no notice",
-			result:     tools.Result{Status: tools.StatusOK, Output: output},
-			wantIsErr:  false,
-			wantNotice: false,
-		},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			registry := tools.NewRegistry()
-			registry.Register(serverFakeTool{
-				name:        "run_thing",
-				description: "runs a thing",
-				parameters:  tools.Schema{Type: "object", AdditionalProperties: false},
-				safety:      tools.Safety{SideEffect: tools.SideEffectRead, Permission: tools.PermissionAllow, Reason: "test"},
-				run:         func(map[string]any) tools.Result { return testCase.result },
-			})
-
-			var input bytes.Buffer
-			writeServerTestMessage(t, &input, rpcMessage{ID: 1, Method: "initialize"})
-			writeServerTestMessage(t, &input, rpcMessage{Method: "notifications/initialized"})
-			writeServerTestMessage(t, &input, rpcMessage{
-				ID:     2,
-				Method: "tools/call",
-				Params: mustRaw(map[string]any{"name": "run_thing", "arguments": map[string]any{}}),
-			})
-
-			var out bytes.Buffer
-			if err := Serve(context.Background(), &input, &out, registry, ServeOptions{Name: "zero-test", Version: "1.2.3"}); err != nil {
-				t.Fatalf("Serve() error = %v", err)
-			}
-			reader := newMessageReader(&out)
-			readServerTestMessage(t, reader) // initialize
-			var call CallToolResult
-			decodeServerTestResult(t, readServerTestMessage(t, reader), &call)
-
-			if len(call.Content) != 1 || call.Content[0].Type != "text" {
-				t.Fatalf("content shape changed: %#v", call.Content)
-			}
-			text := call.Content[0].Text
-			if call.IsError != testCase.wantIsErr {
-				t.Errorf("IsError = %v, want %v", call.IsError, testCase.wantIsErr)
-			}
-			if count := strings.Count(text, output); count != 1 {
-				t.Errorf("the command's own output appears %d times, want exactly 1: %q", count, text)
-			}
-			gotNotice := strings.Count(text, notice)
-			if testCase.wantNotice && gotNotice != 1 {
-				t.Errorf("the disclosure appears %d times, want exactly 1: %q", gotNotice, text)
-			}
-			if !testCase.wantNotice {
-				if gotNotice != 0 {
-					t.Errorf("a disclosure appeared for a command that had none: %q", text)
-				}
-				if text != output {
-					t.Errorf("ordinary output was altered: got %q, want %q", text, output)
-				}
-			}
-		})
-	}
-}

internal/mcp/launch_sink.go

@@ -1,118 +0,0 @@
-package mcp
-
-import (
-	"context"
-	"sync"
-)
-
-// launchSink carries the fact that a server's PROCESS STARTED out of the connect
-// attempt, without waiting for that attempt to finish.
-//
-// The startup notices used to leave connectStdio only on the returned client, or
-// on the returned error. Both require the attempt to return. Registration
-// abandons a server that exceeds the connect timeout, so a server that started
-// under the reduced write confinement and then hung in initialize or tools/list
-// was recorded as skipped with nothing said about the confinement it ran under.
-// The reaper that later collects the abandoned attempt runs after the serial
-// commit phase has finished, so it cannot contribute without breaking the
-// deterministic ordering that phase exists to provide.
-//
-// Publishing at Start splits the two facts apart, which is the point: launch and
-// connection usability have different lifetimes. A sink that was never published
-// to means Start never happened, so prepare, pipe, and Start failures stay silent
-// exactly as before.
-//
-// IT IS ALSO AN EVENT, NOT ONLY A VALUE. A retained sink that nobody re-reads is
-// still a lost disclosure: both production reporters sample once, immediately
-// after registration returns, and a Start that completes after that sample had
-// no way to reach them. onPublish lets a reporter subscribe; if the launch has
-// already happened by the time it subscribes, it is told at once, so the fact
-// reaches exactly one presentation regardless of which side won the race.
-type launchSink struct {
-	mu        sync.Mutex
-	launched  bool
-	notices   []string
-	onPublish func(notices []string)
-	delivered bool
-}
-
-type launchSinkKey struct{}
-
-// withLaunchSink attaches a sink to the context handed to the client factory.
-// Carried on the context rather than added to the factory signature so an
-// injected or third-party factory that knows nothing about it still works, and
-// simply discloses nothing.
-func withLaunchSink(ctx context.Context, sink *launchSink) context.Context {
-	return context.WithValue(ctx, launchSinkKey{}, sink)
-}
-
-// publishLaunch records that the process for this connect attempt has started,
-// along with the enforcement notices that applied to it. Safe on a context with
-// no sink, which is every caller outside registration.
-func publishLaunch(ctx context.Context, notices []string) {
-	sink, _ := ctx.Value(launchSinkKey{}).(*launchSink)
-	if sink == nil {
-		return
-	}
-	sink.mu.Lock()
-	sink.launched = true
-	sink.notices = append([]string(nil), notices...)
-	deliver := sink.pendingDeliveryLocked()
-	sink.mu.Unlock()
-	if deliver != nil {
-		deliver()
-	}
-}
-
-// PublishLaunchForTest is publishLaunch for a test in another package that
-// injects a client factory and needs to mark its fake process as started. It
-// is the same function with the same context lookup, so a test exercises the
-// real sink rather than a stand-in, and it is inert on any context that did
-// not come through registration.
-func PublishLaunchForTest(ctx context.Context, notices []string) {
-	publishLaunch(ctx, notices)
-}
-
-// observe reports whether Start was reached and what applied to it. Read from
-// the registration goroutine while the connect goroutine may still be running,
-// hence the lock.
-func (sink *launchSink) observe() (bool, []string) {
-	if sink == nil {
-		return false, nil
-	}
-	sink.mu.Lock()
-	defer sink.mu.Unlock()
-	return sink.launched, append([]string(nil), sink.notices...)
-}
-
-// subscribe registers the one presentation this launch should reach. If the
-// launch already happened, fn runs before subscribe returns; otherwise it runs
-// from publishLaunch. Either way it runs at most once, and a second subscriber
-// replaces nothing: the first delivery is the only delivery.
-func (sink *launchSink) subscribe(fn func(notices []string)) {
-	if sink == nil || fn == nil {
-		return
-	}
-	sink.mu.Lock()
-	if sink.onPublish == nil {
-		sink.onPublish = fn
-	}
-	deliver := sink.pendingDeliveryLocked()
-	sink.mu.Unlock()
-	if deliver != nil {
-		deliver()
-	}
-}
-
-// pendingDeliveryLocked returns the delivery to perform, or nil, and marks it
-// done. Called with mu held; the returned closure must be invoked with mu
-// released, since a subscriber may itself take other locks.
-func (sink *launchSink) pendingDeliveryLocked() func() {
-	if !sink.launched || sink.onPublish == nil || sink.delivered {
-		return nil
-	}
-	sink.delivered = true
-	fn := sink.onPublish
-	notices := append([]string(nil), sink.notices...)
-	return func() { fn(notices) }
-}

internal/mcp/launch_timeout_disclosure_test.go

@@ -1,199 +0,0 @@
-package mcp
-
-import (
-	"context"
-	"errors"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-const launchNotice = "denyRead is configured, so the Windows sandbox uses the token shape without WRITE_RESTRICTED (#869)"
-
-func registerWithFactory(t *testing.T, factory func(context.Context, Server) (ToolClient, error)) *Runtime {
-	t.Helper()
-	runtime, err := RegisterTools(context.Background(), tools.NewRegistry(), config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"slow": {Type: "stdio", Command: "slow-mcp"},
-	}}, RegisterOptions{
-		ConnectTimeout: 50 * time.Millisecond,
-		ClientFactory:  factory,
-	})
-	if err != nil {
-		t.Fatalf("RegisterTools error: %v", err)
-	}
-	t.Cleanup(func() { _ = runtime.Close() })
-	return runtime
-}
-
-// A SERVER THAT STARTED AND THEN HUNG STILL RAN UNDER THE REDUCED TOKEN.
-//
-// Registration abandons a server that exceeds the connect timeout and records it
-// as skipped. The startup notices used to leave connectStdio only on the returned
-// client or the returned error, and the abandoned attempt returns neither before
-// the serial commit phase is over, so the process ran with reduced write
-// confinement and startup said only that the server was skipped.
-func TestTimeoutAfterLaunchKeepsTheStartupDisclosure(t *testing.T) {
-	runtime := registerWithFactory(t, func(ctx context.Context, server Server) (ToolClient, error) {
-		// The process started under the reduced token, then initialize hangs.
-		publishLaunch(ctx, []string{launchNotice})
-		<-ctx.Done()
-		return nil, ctx.Err()
-	})
-
-	disclosures := runtime.StartupDisclosures()
-	if len(disclosures) == 0 {
-		t.Fatal("a server that started and then timed out disclosed nothing, so it ran under reduced write confinement unannounced")
-	}
-	if disclosures[0].Name != "slow" || len(disclosures[0].Notices) != 1 || disclosures[0].Notices[0] != launchNotice {
-		t.Errorf("StartupDisclosures() = %#v, want one entry for slow carrying the launch notice", disclosures)
-	}
-	if skipped := runtime.Skipped(); len(skipped) != 1 || skipped[0].Name != "slow" {
-		t.Errorf("the server should still be recorded as skipped: %#v", skipped)
-	}
-}
-
-// AND A TIMEOUT BEFORE LAUNCH STAYS SILENT.
-//
-// Without this, retaining the disclosure on timeout could be satisfied by
-// disclosing on every timeout, which would claim a token trade for a process
-// that was never created.
-func TestTimeoutBeforeLaunchDisclosesNothing(t *testing.T) {
-	runtime := registerWithFactory(t, func(ctx context.Context, server Server) (ToolClient, error) {
-		// Never reached Start: no publish.
-		<-ctx.Done()
-		return nil, ctx.Err()
-	})
-
-	if disclosures := runtime.StartupDisclosures(); len(disclosures) != 0 {
-		t.Errorf("a server that never started claimed a token trade: %#v", disclosures)
-	}
-	if skipped := runtime.Skipped(); len(skipped) != 1 {
-		t.Errorf("the server should still be recorded as skipped: %#v", skipped)
-	}
-}
-
-// THE PUBLISH HAS TO SIT AFTER Start, AND ONLY A REAL LAUNCH PROVES IT.
-//
-// The two tests above inject a factory, so they exercise the registry's handling
-// of the sink and say nothing about where connectStdio publishes to it. Moving
-// the call one line up, above cmd.Start, leaves both of them green while every
-// failed launch starts claiming the token trade. This one drives the real
-// connectStdio with a command that cannot start.
-func TestAFailedStartPublishesNoLaunch(t *testing.T) {
-	sink := &launchSink{}
-	ctx := withLaunchSink(context.Background(), sink)
-
-	client, err := connectStdio(ctx, Server{
-		Name:    "missing",
-		Type:    "stdio",
-		Command: "zero-nonexistent-mcp-binary-for-test",
-	}, ConnectOptions{})
-	if err == nil {
-		if client != nil {
-			_ = client.Close()
-		}
-		t.Fatal("expected a nonexistent executable to fail to start")
-	}
-
-	if launched, notices := sink.observe(); launched {
-		t.Errorf("a server whose process never started was published as launched (notices %#v)", notices)
-	}
-}
-
-// A START THAT COMPLETES JUST AFTER THE TIMEOUT MUST STILL BE DISCLOSED.
-//
-// connectStdio publishes only once cmd.Start has returned, and the timeout
-// branch used to sample the sink the instant it fired. Those interleave: the
-// sample reads empty, the result commits with no notice, and the reaper closes
-// the late client without being able to amend a commit that already happened.
-//
-// The real window is microseconds wide, so this drives the CONTRACT instead:
-// the attempt starts after the registration timeout has elapsed but inside the
-// settle grace, which is the case the synchronization exists to catch.
-func TestStartJustAfterTheTimeoutIsStillDisclosed(t *testing.T) {
-	runtime := registerWithFactory(t, func(ctx context.Context, server Server) (ToolClient, error) {
-		// 50ms registration timeout has fired; this lands inside launchSettleGrace.
-		time.Sleep(120 * time.Millisecond)
-		publishLaunch(ctx, []string{launchNotice})
-		return nil, errors.New("initialize failed after start")
-	})
-
-	disclosures := runtime.StartupDisclosures()
-	if len(disclosures) != 1 || len(disclosures[0].Notices) != 1 || disclosures[0].Notices[0] != launchNotice {
-		t.Fatalf("a process that started just after the timeout was not disclosed: %#v", disclosures)
-	}
-	if skipped := runtime.Skipped(); len(skipped) != 1 {
-		t.Errorf("the server should still be recorded as skipped: %#v", skipped)
-	}
-}
-
-// And an attempt that never starts is not held for the grace, nor disclosed.
-func TestTimeoutBeforeStartIsNotDelayedOrDisclosed(t *testing.T) {
-	start := time.Now()
-	runtime := registerWithFactory(t, func(ctx context.Context, server Server) (ToolClient, error) {
-		<-ctx.Done() // cancel arrives with the timeout; returns immediately
-		return nil, ctx.Err()
-	})
-	elapsed := time.Since(start)
-
-	if disclosures := runtime.StartupDisclosures(); len(disclosures) != 0 {
-		t.Errorf("a server that never started claimed a token trade: %#v", disclosures)
-	}
-	// The grace is 250ms; an attempt that returns on cancel must not pay it.
-	if elapsed > 200*time.Millisecond {
-		t.Errorf("registration waited %v for an attempt that never started", elapsed)
-	}
-}
-
-// AND A START THAT COMPLETES AFTER THE SETTLE GRACE MUST STILL BE DISCLOSED.
-//
-// The grace is only another timeout. Once it expires, registration reaps the
-// attempt in the background and returns; the process can still be inside
-// cmd.Start at that moment and start successfully afterwards. If Runtime were a
-// snapshot taken at commit time, that launch would have no owner: the reaper can
-// close the late client but cannot amend a value already returned, so the server
-// would have run under the reduced write confinement with startup reporting it
-// only as skipped.
-//
-// A larger grace changes the probability, not the contract, which is why this
-// releases the launch strictly AFTER the bound rather than inside it. The sink
-// outlives registration and StartupDisclosures reads through it.
-func TestStartAfterTheSettleGraceIsStillDisclosed(t *testing.T) {
-	released := make(chan struct{})
-	runtime := registerWithFactory(t, func(ctx context.Context, server Server) (ToolClient, error) {
-		// Held past the 50ms registration timeout AND past launchSettleGrace, so
-		// registration has already reaped this attempt and returned.
-		<-released
-		publishLaunch(ctx, []string{launchNotice})
-		return nil, errors.New("initialize failed long after start")
-	})
-
-	// Registration is done and the disclosure legitimately is not known yet.
-	if disclosures := runtime.StartupDisclosures(); len(disclosures) != 0 {
-		t.Fatalf("nothing had started yet, so nothing should be disclosed: %#v", disclosures)
-	}
-
-	close(released)
-
-	deadline := time.Now().Add(2 * time.Second)
-	var disclosures []StartupDisclosure
-	for time.Now().Before(deadline) {
-		if disclosures = runtime.StartupDisclosures(); len(disclosures) > 0 {
-			break
-		}
-		time.Sleep(5 * time.Millisecond)
-	}
-
-	if len(disclosures) != 1 || len(disclosures[0].Notices) != 1 || disclosures[0].Notices[0] != launchNotice {
-		t.Fatalf("a process that started after the settle grace was never disclosed: %#v", disclosures)
-	}
-	// Reading again must not duplicate it.
-	if again := runtime.StartupDisclosures(); len(again) != 1 {
-		t.Errorf("a second read changed the disclosures: %#v", again)
-	}
-	if skipped := runtime.Skipped(); len(skipped) != 1 {
-		t.Errorf("the server should still be recorded as skipped: %#v", skipped)
-	}
-}

internal/mcp/registry.go

@@ -18,11 +18,6 @@ import (
 // so a slow or unreachable server (e.g. a hosted endpoint blocked by the local
 // network) cannot delay the first model response. Servers connect concurrently,
 // so total startup cost is the slowest reachable server, not the sum.
-// launchSettleGrace bounds how long an abandoned connect attempt is given to
-// say whether it had already started. It is paid only after cancel, so an
-// attempt that never reached Start returns well inside it.
-const launchSettleGrace = 250 * time.Millisecond
-
 const defaultConnectTimeout = 8 * time.Second
 
 type RegisterOptions struct {
@@ -52,18 +47,6 @@ type SkippedServer struct {
 	UnconfiguredDefault bool
 }
 
-// StartupDisclosure is a least-privilege statement about one MCP server's
-// LAUNCH, as opposed to anything a later tool call does.
-//
-// A stdio server prepared under a weakened token serves the whole session from
-// that process, so the fact describes startup and cannot be recovered from an
-// individual tool result afterwards. It is reported once, here, rather than
-// appended to every response the server produces.
-type StartupDisclosure struct {
-	Name    string
-	Notices []string
-}
-
 type Runtime struct {
 	clients []ToolClient
 	// cancels releases the per-server connect contexts of the clients we KEPT.
@@ -72,83 +55,8 @@ type Runtime struct {
 	// is closed). Same length/order as clients is not required.
 	cancels []context.CancelFunc
 	skipped []SkippedServer
-	// disclosureSources are the least-privilege statements that applied to each
-	// server process this registration LAUNCHED, in server order, each still
-	// holding the sink that carries the authoritative launch fact.
-	//
-	// NOT a frozen snapshot. Registration is bounded and a launch is not: an
-	// attempt abandoned at the connect timeout can still be inside cmd.Start when
-	// wg.Wait returns, so the serial commit samples an empty sink and the process
-	// then starts under the reduced confinement with nobody left to say so. The
-	// sink outlives registration and StartupDisclosures reads through it, so a
-	// late Start is reported instead of lost. See StartupDisclosures.
-	disclosureSources []disclosureSource
-	// disclosureStream is the typed hand-off to whoever owns the output. Created
-	// on the first StartupDisclosureStream call and closed by Close, so a launch
-	// that resolves after the runtime is gone has somewhere defined to land:
-	// nowhere.
-	disclosureStreamOnce sync.Once
-	disclosureStream     *StartupDisclosureStream
-	once                 sync.Once
-	err                  error
-}
-
-// disclosureSource pairs a server with both the notices known at commit time and
-// the sink that may still learn them. notices wins when it is already populated,
-// so a settled server never re-reads the sink.
-type disclosureSource struct {
-	name    string
-	notices []string
-	sink    *launchSink
-}
-
-// ReportStartupDisclosures delivers each server's launch disclosure to report
-// EXACTLY ONCE, whether the launch had already completed when this was called
-// or completes later.
-//
-// StartupDisclosures reads through the sink, which stopped a late Start from
-// being lost, but a value nobody re-reads is still a lost disclosure: both
-// production reporters sample once, right after RegisterTools returns, and an
-// attempt abandoned at the connect timeout can finish Start after that sample.
-// The reaper only closes the late client. So the operator saw the skipped-server
-// warning and never learned that a local process had run under the reduced
-// enforcement.
-//
-// Servers whose notices were known at commit are reported now, in server order.
-// Every other server subscribes its sink: if the launch already happened the
-// subscriber runs before this returns, otherwise it runs from publishLaunch on
-// the connect goroutine. Either way each server reaches report once. A server
-// that never starts never publishes, so prepare, pipe and Start failures stay
-// silent, and network servers, which launch no process, contribute nothing.
-//
-// Late deliveries arrive in completion order, which is the only order they
-// have; the immediate set keeps server order.
-//
-// A STREAM, NOT A CALLBACK. An earlier version took the presentation function
-// and invoked it from whichever goroutine resolved the launch, which for an
-// abandoned attempt is the connect goroutine. That put a write to the caller's
-// writer on a goroutine and at a time the caller did not control. The runtime
-// owns the fact; it appends the fact here and the owner drains it. See
-// StartupDisclosureStream.
-func (runtime *Runtime) StartupDisclosureStream() *StartupDisclosureStream {
-	if runtime == nil {
-		return nil
-	}
-	runtime.disclosureStreamOnce.Do(func() {
-		stream := newStartupDisclosureStream()
-		runtime.disclosureStream = stream
-		for _, source := range runtime.disclosureSources {
-			if len(source.notices) > 0 {
-				stream.offer(StartupDisclosure{Name: source.name, Notices: append([]string(nil), source.notices...)})
-				continue
-			}
-			name := source.name
-			source.sink.subscribe(func(notices []string) {
-				stream.offer(StartupDisclosure{Name: name, Notices: notices})
-			})
-		}
-	})
-	return runtime.disclosureStream
+	once    sync.Once
+	err     error
 }
 
 // Skipped returns the servers that were skipped during registration (unreachable
@@ -202,38 +110,19 @@ func RegisterTools(ctx context.Context, registry *tools.Registry, cfg config.MCP
 		remote []RemoteTool
 		cancel context.CancelFunc
 		err    error
-		// notices travels with the indexed result rather than being appended to
-		// shared state from inside the goroutine. The concurrent phase touches no
-		// shared state, which is the property the comment above promises and the
-		// reason the serial phase can be deterministic; appending here broke both,
-		// racing the slice header and ordering disclosures by completion time.
-		notices []string
 	}
 	results := make([]connectResult, len(servers))
-	// RETAINED PAST THE CONCURRENT PHASE. The timeout branch samples the sink the
-	// moment it fires, but connectStdio does not publish until cmd.Start has
-	// returned, so a Start that succeeds just after the timeout selected was
-	// sampled as "never launched" and its disclosure was lost: the reaper closes
-	// the late client and cannot amend a commit that has already happened.
-	// Reading the sink again in the serial phase is strictly later than the
-	// timeout branch and still deterministic, because it runs after wg.Wait.
-	sinks := make([]*launchSink, len(servers))
 	var wg sync.WaitGroup
 	for index := range servers {
 		wg.Add(1)
 		go func(index int) {
 			defer wg.Done()
 			server := servers[index]
-			// The sink hears about Start as it happens, so an attempt abandoned below
-			// can still report the confinement its process ran under. The connect
-			// result cannot supply that: it does not arrive until after this phase.
-			sink := &launchSink{}
-			sinks[index] = sink
-			serverCtx, cancel := context.WithCancel(withLaunchSink(ctx, sink))
+			serverCtx, cancel := context.WithCancel(ctx)
 			done := make(chan connectResult, 1)
 			go func() {
-				client, remote, notices, err := connectAndList(serverCtx, factory, server)
-				done <- connectResult{client: client, remote: remote, notices: notices, err: err}
+				client, remote, err := connectAndList(serverCtx, factory, server)
+				done <- connectResult{client: client, remote: remote, err: err}
 			}()
 			select {
 			case res := <-done:
@@ -245,47 +134,14 @@ func RegisterTools(ctx context.Context, registry *tools.Registry, cfg config.MCP
 				results[index] = res
 			case <-time.After(timeout):
 				cancel() // abandon the slow connect: tears down the conn/subprocess
-				timedOut := connectResult{err: fmt.Errorf("connect timed out after %s", timeout)}
-				// SYNCHRONIZE WITH THE START, briefly, before deciding there was none.
-				//
-				// connectStdio publishes only after cmd.Start returns, so sampling the
-				// sink the instant the timeout fires races a Start that is about to
-				// succeed: the sample reads empty, the result commits with no notice,
-				// and the reaper cannot amend a commit that has already happened. The
-				// window is microseconds and unreachable from a test seam, which is
-				// exactly why it must be closed by construction rather than measured.
-				//
-				// cancel() has already fired, so an attempt that has NOT started fails
-				// fast and this returns immediately; only one that did start can still
-				// be in Start, and it publishes on the way out. The grace is therefore
-				// paid only when there is something to learn.
-				select {
-				case res := <-done:
-					if res.client != nil {
+				// Reap the goroutine + any partial client in the background so a
+				// slow server never blocks startup.
+				go func() {
+					if res := <-done; res.client != nil {
 						_ = res.client.Close()
 					}
-					if len(res.notices) > 0 {
-						timedOut.notices = res.notices
-					}
-				case <-time.After(launchSettleGrace):
-					// Still stuck past the grace. Reap in the background so a slow
-					// server never blocks startup.
-					go func() {
-						if res := <-done; res.client != nil {
-							_ = res.client.Close()
-						}
-					}()
-				}
-				// A server that reached Start ran under the planned enforcement even
-				// though its connection never became usable. One that timed out
-				// before Start discloses nothing, so the sink stays empty and this
-				// adds nothing.
-				if len(timedOut.notices) == 0 {
-					if launched, notices := sink.observe(); launched {
-						timedOut.notices = notices
-					}
-				}
-				results[index] = timedOut
+				}()
+				results[index] = connectResult{err: fmt.Errorf("connect timed out after %s", timeout)}
 			}
 		}(index)
 	}
@@ -301,28 +157,6 @@ func RegisterTools(ctx context.Context, registry *tools.Registry, cfg config.MCP
 	stagedNames := make(map[string]struct{})
 	for index, server := range servers {
 		res := results[index]
-		// Recorded here, in server order, for any server whose PROCESS STARTED,
-		// including one whose tools are rejected below: the launch happened under
-		// that token either way, and a skip warning does not say what confinement
-		// the process ran with while it was alive.
-		notices := res.notices
-		if len(notices) == 0 {
-			// A launch that published after the timeout branch sampled. Checked here
-			// rather than only there so the window between Start succeeding and the
-			// timeout committing cannot swallow the disclosure.
-			if launched, late := sinks[index].observe(); launched {
-				notices = late
-			}
-		}
-		// Recorded whether or not notices are known YET. An abandoned attempt can
-		// still be inside cmd.Start, and keeping its sink here is what lets
-		// StartupDisclosures report that launch after this phase has finished.
-		// Order is server order, so a late arrival does not reorder the rest.
-		runtime.disclosureSources = append(runtime.disclosureSources, disclosureSource{
-			name:    server.Name,
-			notices: notices,
-			sink:    sinks[index],
-		})
 		if res.err != nil {
 			runtime.skipped = append(runtime.skipped, SkippedServer{Name: server.Name, Err: res.err, UnconfiguredDefault: server.UnconfiguredDefault})
 			continue
@@ -356,42 +190,17 @@ func RegisterTools(ctx context.Context, registry *tools.Registry, cfg config.MCP
 // connectAndList connects to one server and lists its tools. It does ONLY I/O
 // (no registry, permission-store, or other shared state), so it is safe to run
 // concurrently for every server. On a list error it closes the client.
-// connectAndList returns the client, its tools, and the least-privilege
-// disclosures that applied to its LAUNCH.
-//
-// THE LAUNCH FACT OUTLIVES THE CONNECTION. A stdio server can start, and do
-// filesystem work, and then fail initialize or tools/list. Returning the notices
-// separately rather than leaving them on the client means the fact survives that
-// failure: the client is closed and discarded here, so anything reachable only
-// through it is gone by the time the caller sees the error, and the skip warning
-// on its own does not say the process already ran with reduced write
-// confinement.
-func connectAndList(ctx context.Context, factory func(context.Context, Server) (ToolClient, error), server Server) (ToolClient, []RemoteTool, []string, error) {
+func connectAndList(ctx context.Context, factory func(context.Context, Server) (ToolClient, error), server Server) (ToolClient, []RemoteTool, error) {
 	client, err := factory(ctx, server)
 	if err != nil {
-		// A failure BEFORE the process started discloses nothing. A failure after it
-		// started carries the fact out through the error, because the client that
-		// held it has already been closed and discarded by then.
-		return nil, nil, startupNoticesFromError(err), err
+		return nil, nil, err
 	}
-	notices := startupNoticesOf(client)
 	remoteTools, err := client.ListTools(ctx)
 	if err != nil {
 		_ = client.Close()
-		return nil, nil, notices, fmt.Errorf("list MCP tools for %s: %w", server.Name, err)
+		return nil, nil, fmt.Errorf("list MCP tools for %s: %w", server.Name, err)
 	}
-	return client, remoteTools, notices, nil
-}
-
-// startupNoticesOf reads a client's launch disclosures, if it reports any.
-func startupNoticesOf(client ToolClient) []string {
-	if client == nil {
-		return nil
-	}
-	if disclosing, ok := client.(startupDisclosing); ok {
-		return disclosing.StartupNotices()
-	}
-	return nil
+	return client, remoteTools, nil
 }
 
 // buildServerTools validates a server's remote tools against the registry and the
@@ -427,25 +236,6 @@ func (runtime *Runtime) Close() error {
 		return nil
 	}
 	runtime.once.Do(func() {
-		// End disclosure delivery FIRST. A launch that resolves while the clients
-		// are being closed has no owner left to print it, and the runtime must not
-		// leave a subscriber holding a writer whose lifetime it does not know.
-		//
-		// THROUGH THE ONCE, NOT THE FIELD. Reading disclosureStream directly raced
-		// a first StartupDisclosureStream call on another goroutine, and a Close
-		// that came before any call found nil and closed nothing, so a later call
-		// built a fresh, open stream and subscribed it to launches from a runtime
-		// that was already gone. Reported by CodeRabbit.
-		//
-		// If nobody asked for the stream before this, nobody is draining it, so it
-		// is published EMPTY rather than built the usual way: no sink is
-		// subscribed and nothing is queued for an owner that does not exist. Every
-		// later caller then gets this stream, already closed. The read after Do is
-		// ordered by the Once whichever call got there first.
-		runtime.disclosureStreamOnce.Do(func() {
-			runtime.disclosureStream = newStartupDisclosureStream()
-		})
-		runtime.disclosureStream.Close()
 		for _, client := range runtime.clients {
 			if err := client.Close(); err != nil && runtime.err == nil {
 				runtime.err = err
@@ -644,41 +434,6 @@ func isPersistentlyApproved(store *PermissionStore, server Server, toolName stri
 	return err == nil && approved
 }
 
-// StartupDisclosures returns the least-privilege statements that applied to the
-// MCP server processes this registration launched, so a caller can report them
-// once. Empty when no server was launched under reduced enforcement, and always
-// empty for network servers, which launch no local process.
-//
-// READ THROUGH THE SINK, so this is not fixed at the moment registration
-// returned. A server abandoned at the connect timeout may still have been inside
-// cmd.Start then, and its process starts under the reduced write confinement
-// regardless of whether the connection ever became usable. Registration stays
-// bounded; the disclosure does not expire with it.
-//
-// Server order, and a settled entry never re-reads its sink, so calling this
-// twice cannot reorder or duplicate anything.
-func (runtime *Runtime) StartupDisclosures() []StartupDisclosure {
-	if runtime == nil {
-		return nil
-	}
-	disclosures := make([]StartupDisclosure, 0, len(runtime.disclosureSources))
-	for _, source := range runtime.disclosureSources {
-		notices := source.notices
-		if len(notices) == 0 {
-			if launched, late := source.sink.observe(); launched {
-				notices = late
-			}
-		}
-		if len(notices) > 0 {
-			disclosures = append(disclosures, StartupDisclosure{Name: source.name, Notices: notices})
-		}
-	}
-	if len(disclosures) == 0 {
-		return nil
-	}
-	return disclosures
-}
-
 // appendServerNote joins a [zero] note to output, choosing "returned" or
 // "also returned" based on whether anything precedes it.
 func appendServerNote(output, subject, tail string) string {

internal/mcp/registry_close_disclosure_test.go

@@ -1,127 +0,0 @@
-package mcp
-
-import (
-	"context"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// streamStillOpen asks Wait whether the stream is worth draining, without
-// letting it block the suite. An open, empty stream blocks Wait forever, which
-// is the very defect these tests pin, so an unbounded call hangs until the test
-// binary times out instead of failing. Past the bound the stream is reported
-// open and closed here, so the waiting goroutine returns.
-func streamStillOpen(t *testing.T, stream *StartupDisclosureStream) bool {
-	t.Helper()
-	result := make(chan bool, 1)
-	go func() { result <- stream.Wait() }()
-	select {
-	case open := <-result:
-		return open
-	case <-time.After(5 * time.Second):
-		stream.Close()
-		<-result
-		return true
-	}
-}
-
-// disclosingRuntime registers one server whose launch carried a startup notice,
-// so its runtime has something the stream could deliver.
-func disclosingRuntime(t *testing.T) *Runtime {
-	t.Helper()
-	client := &disclosingFakeClient{
-		fakeToolClient: fakeToolClient{listed: []RemoteTool{{Name: "lookup", Description: "Lookup"}}},
-		notices:        []string{startupNotice},
-	}
-	runtime, err := RegisterTools(context.Background(), tools.NewRegistry(), config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"docs": {Type: "stdio", Command: "docs-mcp"},
-	}}, RegisterOptions{ClientFactory: func(context.Context, Server) (ToolClient, error) { return client, nil }})
-	if err != nil {
-		t.Fatalf("RegisterTools() error = %v", err)
-	}
-	if disclosures := runtime.StartupDisclosures(); len(disclosures) != 1 {
-		t.Fatalf("SETUP INVALID: the runtime has %d disclosures, so an empty stream would prove nothing", len(disclosures))
-	}
-	return runtime
-}
-
-// A CLOSED RUNTIME HANDS OUT A CLOSED STREAM.
-//
-// Close read the stream field directly. Before anyone had asked for the stream
-// that field was nil, so Close closed nothing, and the next caller built a fresh,
-// open stream, queued this runtime's disclosures into it and subscribed it to
-// launches from a runtime that was already gone. A pump started on it then
-// waited forever.
-func TestAStreamRequestedAfterCloseIsAlreadyClosed(t *testing.T) {
-	runtime := disclosingRuntime(t)
-	if err := runtime.Close(); err != nil {
-		t.Fatalf("Close() error = %v", err)
-	}
-
-	stream := runtime.StartupDisclosureStream()
-	if stream == nil {
-		t.Fatal("StartupDisclosureStream() returned nil for a runtime")
-	}
-	if queued := stream.Drain(); len(queued) != 0 {
-		t.Errorf("a stream requested after Close delivered %#v from a runtime that is gone", queued)
-	}
-	if streamStillOpen(t, stream) {
-		t.Error("the stream is still open after Close, so a pump started on it never returns")
-	}
-}
-
-// And the stream an owner already holds is the one Close ends, with what was
-// queued before Close still drainable.
-func TestCloseEndsTheStreamAnOwnerAlreadyHolds(t *testing.T) {
-	runtime := disclosingRuntime(t)
-	stream := runtime.StartupDisclosureStream()
-	if err := runtime.Close(); err != nil {
-		t.Fatalf("Close() error = %v", err)
-	}
-	if again := runtime.StartupDisclosureStream(); again != stream {
-		t.Error("Close replaced the stream the owner holds, so the owner's pump is never told to stop")
-	}
-	if queued := stream.Drain(); len(queued) != 1 {
-		t.Errorf("the disclosure queued before Close was lost: %#v", queued)
-	}
-	if streamStillOpen(t, stream) {
-		t.Error("Close did not end the stream the owner holds")
-	}
-}
-
-// NO RACE BETWEEN CLOSE AND THE FIRST REQUEST FOR THE STREAM.
-//
-// Close read the field while a first StartupDisclosureStream call could be
-// writing it inside the Once on another goroutine. Only meaningful under -race,
-// which the race job runs.
-func TestCloseAndTheFirstStreamRequestDoNotRace(t *testing.T) {
-	for attempt := 0; attempt < 20; attempt++ {
-		runtime := disclosingRuntime(t)
-		start := make(chan struct{})
-		var group sync.WaitGroup
-		group.Add(2)
-		go func() {
-			defer group.Done()
-			<-start
-			_ = runtime.StartupDisclosureStream()
-		}()
-		go func() {
-			defer group.Done()
-			<-start
-			_ = runtime.Close()
-		}()
-		close(start)
-		group.Wait()
-		// Whichever call won the Once, the stream is closed now. A disclosure
-		// queued before Close stays drainable, so drain before asking.
-		stream := runtime.StartupDisclosureStream()
-		stream.Drain()
-		if streamStillOpen(t, stream) {
-			t.Fatal("the stream survived Close")
-		}
-	}
-}

internal/mcp/server.go

@@ -218,14 +218,8 @@ func (server toolServer) callTool(ctx context.Context, rawParams json.RawMessage
 	result := server.registry.RunWithOptions(ctx, params.Name, params.Arguments, tools.RunOptions{
 		PermissionGranted: server.options.PermissionGranted,
 	})
-	// ModelOutput, not the raw field. This is a model-facing protocol boundary,
-	// and Result.Output now holds the UNDECORATED base text: the enforcement
-	// disclosure lives in typed state and the accessor is what composes the two.
-	// Serializing Output directly hands an MCP client a Windows command's ordinary
-	// output with no statement that its DenyRead token shape left writes
-	// unconfined, which is the one thing the disclosure exists to say.
 	return CallToolResult{
-		Content: []Content{{Type: "text", Text: result.ModelOutput()}},
+		Content: []Content{{Type: "text", Text: result.Output}},
 		IsError: result.Status != tools.StatusOK,
 	}, nil
 }

internal/mcp/startup_disclosure_race_test.go

@@ -1,193 +0,0 @@
-package mcp
-
-import (
-	"context"
-	"fmt"
-	"sort"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// disclosingRaceClient is a launched server that reports a disclosure.
-type disclosingRaceClient struct {
-	fakeToolClient
-	notices []string
-}
-
-func (c *disclosingRaceClient) StartupNotices() []string { return c.notices }
-
-// THE CONCURRENT PHASE TOUCHES NO SHARED STATE, AND THAT IS LOAD-BEARING.
-//
-// RegisterTools runs one goroutine per server and commits everything in a
-// deterministic serial phase afterwards, which is what lets the result be
-// identical regardless of completion order. Collecting the startup disclosures
-// inside the goroutine broke both halves of that: the append raced the slice
-// header, so entries could be lost or overwritten, and whichever survived were
-// ordered by completion time rather than by server.
-//
-// Many servers rather than one, because a single disclosing server cannot
-// exercise a shared write at all. Run this package with -race.
-func TestStartupDisclosuresAreCollectedWithoutRacing(t *testing.T) {
-	const servers = 32
-	configured := map[string]config.MCPServerConfig{}
-	for index := range servers {
-		configured[fmt.Sprintf("srv%02d", index)] = config.MCPServerConfig{Type: "stdio", Command: "server"}
-	}
-
-	registry := tools.NewRegistry()
-	runtime, err := RegisterTools(context.Background(), registry, config.MCPConfig{Servers: configured}, RegisterOptions{
-		ClientFactory: func(_ context.Context, server Server) (ToolClient, error) {
-			return &disclosingRaceClient{
-				fakeToolClient: fakeToolClient{listed: []RemoteTool{{Name: "tool_" + server.Name, Description: "d"}}},
-				notices:        []string{"denyRead is configured for " + server.Name},
-			}, nil
-		},
-	})
-	if err != nil {
-		t.Fatalf("RegisterTools() error = %v", err)
-	}
-	defer runtime.Close()
-
-	got := runtime.StartupDisclosures()
-	if len(got) != servers {
-		t.Fatalf("collected %d disclosures, want %d: a shared append loses entries", len(got), servers)
-	}
-
-	// Deterministic server order, not completion order. Sorting the result and
-	// then comparing would hide exactly the defect this pins.
-	names := make([]string, 0, len(got))
-	for _, disclosure := range got {
-		names = append(names, disclosure.Name)
-	}
-	sorted := append([]string(nil), names...)
-	sort.Strings(sorted)
-	for index := range names {
-		if names[index] != sorted[index] {
-			t.Fatalf("disclosure %d is %q, want %q: order follows completion rather than server order", index, names[index], sorted[index])
-		}
-	}
-}
-
-// failingDisclosingClient launches (so it has a disclosure) and then fails
-// tools/list, which is the shape that used to drop the fact.
-type failingDisclosingClient struct {
-	fakeToolClient
-	notices []string
-}
-
-func (c *failingDisclosingClient) StartupNotices() []string { return c.notices }
-func (c *failingDisclosingClient) ListTools(context.Context) ([]RemoteTool, error) {
-	return nil, fmt.Errorf("initialize failed after the process started")
-}
-
-// THE LAUNCH FACT OUTLIVES THE CONNECTION.
-//
-// connectStdio records the disclosure once cmd.Start returns, which is the right
-// moment. But a stdio server can start, do filesystem work, and then fail
-// initialize or tools/list, and that path closes the client and returns nil. The
-// disclosure was reachable only through that client, so it died with it, and the
-// operator was told the server was unavailable without being told the process
-// had already run without the write jail.
-func TestADisclosureSurvivesAFailureAfterTheProcessLaunched(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-	registry := tools.NewRegistry()
-	runtime, err := RegisterTools(context.Background(), registry, config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"docs": {Type: "stdio", Command: "docs-mcp"},
-	}}, RegisterOptions{
-		ClientFactory: func(context.Context, Server) (ToolClient, error) {
-			return &failingDisclosingClient{notices: []string{notice}}, nil
-		},
-	})
-	if err != nil {
-		t.Fatalf("RegisterTools() error = %v", err)
-	}
-	defer runtime.Close()
-
-	skipped := runtime.Skipped()
-	if len(skipped) != 1 {
-		t.Fatalf("Skipped() = %#v, want the failure recorded", skipped)
-	}
-	disclosures := runtime.StartupDisclosures()
-	if len(disclosures) != 1 || len(disclosures[0].Notices) != 1 || disclosures[0].Notices[0] != notice {
-		t.Fatalf("StartupDisclosures() = %#v, want the launch disclosure kept despite the failure", disclosures)
-	}
-	if disclosures[0].Name != "docs" {
-		t.Errorf("Name = %q, want the server it describes", disclosures[0].Name)
-	}
-}
-
-// And a server that never launched still discloses nothing.
-func TestAFactoryFailureDisclosesNothing(t *testing.T) {
-	registry := tools.NewRegistry()
-	runtime, err := RegisterTools(context.Background(), registry, config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"docs": {Type: "stdio", Command: "docs-mcp"},
-	}}, RegisterOptions{
-		ClientFactory: func(context.Context, Server) (ToolClient, error) {
-			return nil, fmt.Errorf("could not start the process")
-		},
-	})
-	if err != nil {
-		t.Fatalf("RegisterTools() error = %v", err)
-	}
-	defer runtime.Close()
-	if disclosures := runtime.StartupDisclosures(); len(disclosures) != 0 {
-		t.Errorf("StartupDisclosures() = %#v, want none for a process that never started", disclosures)
-	}
-}
-
-// A launched process that fails its HANDSHAKE keeps its disclosure too.
-//
-// connectStdio records the notices once cmd.Start returns, which is the right
-// moment, but the initialize failure path closes and discards the client. The
-// client was the only carrier, so the fact died with the connection unless the
-// failure carries it out itself.
-func TestADisclosureSurvivesAnInitializeFailure(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-	registry := tools.NewRegistry()
-	runtime, err := RegisterTools(context.Background(), registry, config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"docs": {Type: "stdio", Command: "docs-mcp"},
-	}}, RegisterOptions{
-		ClientFactory: func(context.Context, Server) (ToolClient, error) {
-			// What connectStdio does once Start has succeeded and the handshake
-			// then fails: the client is gone, the fact rides the error.
-			return nil, &startupDisclosureError{
-				err:     fmt.Errorf("initialize MCP server docs: handshake timed out"),
-				notices: []string{notice},
-			}
-		},
-	})
-	if err != nil {
-		t.Fatalf("RegisterTools() error = %v", err)
-	}
-	defer runtime.Close()
-
-	if skipped := runtime.Skipped(); len(skipped) != 1 {
-		t.Fatalf("Skipped() = %#v, want the failure recorded", skipped)
-	}
-	disclosures := runtime.StartupDisclosures()
-	if len(disclosures) != 1 || len(disclosures[0].Notices) != 1 || disclosures[0].Notices[0] != notice {
-		t.Fatalf("StartupDisclosures() = %#v, want the launch disclosure kept through the handshake failure", disclosures)
-	}
-}
-
-// And a plain failure with no launch behind it still discloses nothing, so the
-// error path is not just attaching notices to everything.
-func TestAPlainConnectFailureDisclosesNothing(t *testing.T) {
-	registry := tools.NewRegistry()
-	runtime, err := RegisterTools(context.Background(), registry, config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"docs": {Type: "stdio", Command: "docs-mcp"},
-	}}, RegisterOptions{
-		ClientFactory: func(context.Context, Server) (ToolClient, error) {
-			return nil, fmt.Errorf("could not start the process")
-		},
-	})
-	if err != nil {
-		t.Fatalf("RegisterTools() error = %v", err)
-	}
-	defer runtime.Close()
-	if disclosures := runtime.StartupDisclosures(); len(disclosures) != 0 {
-		t.Errorf("StartupDisclosures() = %#v, want none", disclosures)
-	}
-}

internal/mcp/startup_disclosure_stream.go

@@ -1,116 +0,0 @@
-package mcp
-
-import "sync"
-
-// StartupDisclosureStream carries launch disclosures out of the runtime as
-// TYPED EVENTS, for whichever component owns the output to drain on its own
-// goroutine.
-//
-// It replaces handing the runtime a presentation callback. That callback closed
-// over the CLI's writer, and the runtime invoked it synchronously from whichever
-// goroutine happened to resolve the launch. For a server still inside cmd.Start
-// when registration gave up, that goroutine is the abandoned connect attempt,
-// which runs on no schedule the caller controls: the write landed off the output
-// owner's goroutine, raced any other writer, and could arrive after the owner had
-// returned or after Bubble Tea had taken the alt screen. The runtime owns the
-// FACT that a process started; it does not own anyone's writer.
-//
-// So the runtime only ever appends a value here. Delivery, ordering against other
-// startup output, and the decision to stop listening all belong to the owner.
-//
-// LIFETIME IS EXPLICIT. Close is the owner saying "I will not write again".
-// Offers after Close are dropped rather than queued for a consumer that no longer
-// exists, and Wait returns false so a pump exits. Both are deliberate: a
-// disclosure is worth printing while someone can print it, and worth dropping
-// rather than corrupting a screen that now belongs to something else. Close is
-// idempotent and safe from any goroutine, so the runtime and the owner may both
-// call it.
-type StartupDisclosureStream struct {
-	mu     sync.Mutex
-	queue  []StartupDisclosure
-	closed bool
-	wake   chan struct{}
-}
-
-func newStartupDisclosureStream() *StartupDisclosureStream {
-	return &StartupDisclosureStream{wake: make(chan struct{}, 1)}
-}
-
-// offer queues one disclosure. Called from the registration goroutine for a
-// launch already known at commit, and from an abandoned connect goroutine for one
-// that resolves later. It takes a lock and appends; it never touches a writer,
-// which is the whole point of the type.
-func (stream *StartupDisclosureStream) offer(disclosure StartupDisclosure) {
-	if stream == nil || len(disclosure.Notices) == 0 {
-		return
-	}
-	stream.mu.Lock()
-	if stream.closed {
-		stream.mu.Unlock()
-		return
-	}
-	stream.queue = append(stream.queue, disclosure)
-	stream.mu.Unlock()
-	select {
-	case stream.wake <- struct{}{}:
-	default:
-	}
-}
-
-// Drain removes and returns everything queued right now, without blocking. The
-// owner calls this on the goroutine that owns the writer, so every disclosure is
-// printed by exactly one goroutine at a time.
-func (stream *StartupDisclosureStream) Drain() []StartupDisclosure {
-	if stream == nil {
-		return nil
-	}
-	stream.mu.Lock()
-	defer stream.mu.Unlock()
-	if len(stream.queue) == 0 {
-		return nil
-	}
-	queued := stream.queue
-	stream.queue = nil
-	return queued
-}
-
-// Wait blocks until at least one disclosure is queued or the stream is closed. It
-// reports whether draining is still worthwhile: false means closed and empty, so
-// a pump loop should return.
-func (stream *StartupDisclosureStream) Wait() bool {
-	if stream == nil {
-		return false
-	}
-	for {
-		stream.mu.Lock()
-		queued := len(stream.queue) > 0
-		closed := stream.closed
-		stream.mu.Unlock()
-		if queued {
-			return true
-		}
-		if closed {
-			return false
-		}
-		<-stream.wake
-	}
-}
-
-// Close ends delivery. Idempotent, safe from any goroutine, and safe to call
-// from both the runtime and the output owner.
-func (stream *StartupDisclosureStream) Close() {
-	if stream == nil {
-		return
-	}
-	stream.mu.Lock()
-	if stream.closed {
-		stream.mu.Unlock()
-		return
-	}
-	stream.closed = true
-	stream.mu.Unlock()
-	select {
-	case stream.wake <- struct{}{}:
-	default:
-	}
-}

internal/mcp/startup_disclosure_test.go

@@ -1,200 +0,0 @@
-package mcp
-
-import (
-	"context"
-	"errors"
-	"os"
-	"os/exec"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Twigpine/zero/internal/config"
-	"github.com/Twigpine/zero/internal/execution"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-const startupNotice = "denyRead is configured, so the write jail is not confining writes"
-
-// disclosingPreparer plans an MCP server launch that carries an enforcement
-// notice, and can fail the way the sandbox does before the child exists.
-type disclosingPreparer struct {
-	prepareErr error
-	missing    bool
-}
-
-func (preparer *disclosingPreparer) PrepareExecution(ctx context.Context, request execution.Request) (execution.PreparedCommand, error) {
-	if preparer.prepareErr != nil {
-		return execution.PreparedCommand{}, preparer.prepareErr
-	}
-	name, args := request.Command.Name, request.Command.Args
-	if preparer.missing {
-		name, args = "definitely-not-a-real-binary-zzz", nil
-	}
-	command := exec.CommandContext(ctx, name, args...)
-	command.Dir = request.WorkingDirectory
-	command.Env = request.Command.Env
-	return execution.PreparedCommand{
-		Command:     command,
-		Enforcement: execution.Enforcement{Notices: []string{startupNotice}},
-	}, nil
-}
-
-func helperServer(t *testing.T) Server {
-	t.Helper()
-	executable, err := os.Executable()
-	if err != nil {
-		t.Fatal(err)
-	}
-	return Server{
-		Name:    "docs",
-		Type:    ServerTypeStdio,
-		Command: executable,
-		Args:    []string{"-test.run=TestMCPStdioHelperProcess", "--"},
-		Env:     map[string]string{"ZERO_MCP_STDIO_HELPER": "1"},
-	}
-}
-
-// THE FACT DESCRIBES STARTUP, SO NOTHING LATER CAN CARRY IT.
-//
-// The generic adapter puts plan notes on PreparedCommand.Enforcement for
-// OriginMCPServer, and connectStdio kept only the command and its cleanup. A
-// stdio server launched under the weakened token then served the whole session
-// with no path able to tell the operator that its write confinement was
-// reduced, and no individual tool result could recover it, because the fact is
-// about the process rather than about any response.
-func TestAnMCPServerLaunchKeepsItsEnforcementDisclosure(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-
-	client, err := ConnectWithOptions(ctx, helperServer(t), ConnectOptions{
-		Execution:     execution.NewRunner(&disclosingPreparer{}),
-		WorkspaceRoot: t.TempDir(),
-	})
-	if err != nil {
-		t.Fatalf("ConnectWithOptions() error = %v", err)
-	}
-	defer client.Close()
-
-	disclosing, ok := client.(startupDisclosing)
-	if !ok {
-		t.Fatal("a launched stdio client does not report its startup enforcement at all")
-	}
-	notices := disclosing.StartupNotices()
-	if len(notices) != 1 || notices[0] != startupNotice {
-		t.Fatalf("StartupNotices() = %#v, want the launch disclosure", notices)
-	}
-}
-
-// A launch with nothing to disclose reports nothing, or every server would carry
-// a notice and the statement would mean nothing.
-func TestAnUnrestrictedMCPServerLaunchDisclosesNothing(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancel()
-
-	client, err := ConnectWithOptions(ctx, helperServer(t), ConnectOptions{
-		Execution:     execution.NewRunner(&mcpExecutionPreparer{}),
-		WorkspaceRoot: t.TempDir(),
-	})
-	if err != nil {
-		t.Fatalf("ConnectWithOptions() error = %v", err)
-	}
-	defer client.Close()
-	disclosing, ok := client.(startupDisclosing)
-	if !ok {
-		t.Fatal("a launched stdio client does not report its startup enforcement at all")
-	}
-	if notices := disclosing.StartupNotices(); len(notices) != 0 {
-		t.Errorf("StartupNotices() = %#v, want none", notices)
-	}
-}
-
-// And a launch that never happened claims nothing, which is the same launch-state
-// rule hooks and plugins apply. Here it is expressed by WHERE the notice is
-// recorded: every failure above returns before the client exists.
-func TestAnMCPServerThatNeverLaunchedClaimsNoEnforcement(t *testing.T) {
-	for _, testCase := range []struct {
-		name     string
-		preparer *disclosingPreparer
-	}{
-		{"sandbox setup failed", &disclosingPreparer{prepareErr: errors.New("could not build the restricted token")}},
-		{"executable not found", &disclosingPreparer{missing: true}},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-			defer cancel()
-			client, err := ConnectWithOptions(ctx, helperServer(t), ConnectOptions{
-				Execution:     execution.NewRunner(testCase.preparer),
-				WorkspaceRoot: t.TempDir(),
-			})
-			if err == nil {
-				client.Close()
-				t.Fatal("the server started even though its launch was supposed to fail")
-			}
-			// THE CARRIER, NOT THE TEXT. A connect failure hands its notices on
-			// startupDisclosureError, whose Error() prints only the cause, so a
-			// check of the message could never see a notice that was carried.
-			if carried := startupNoticesFromError(err); len(carried) != 0 {
-				t.Errorf("a launch that never happened claimed an enforcement trade: %#v", carried)
-			}
-			if strings.Contains(err.Error(), startupNotice) {
-				t.Errorf("a launch that never happened claimed an enforcement trade in its error: %v", err)
-			}
-		})
-	}
-}
-
-// disclosingFakeClient is a launched server that carries a disclosure.
-type disclosingFakeClient struct {
-	fakeToolClient
-	notices []string
-}
-
-func (client *disclosingFakeClient) StartupNotices() []string { return client.notices }
-
-// Registration is the boundary that reports it, once, for the process it
-// launched.
-func TestRegistrationCollectsStartupDisclosures(t *testing.T) {
-	registry := tools.NewRegistry()
-	client := &disclosingFakeClient{
-		fakeToolClient: fakeToolClient{listed: []RemoteTool{{Name: "lookup", Description: "Lookup"}}},
-		notices:        []string{startupNotice},
-	}
-	runtime, err := RegisterTools(context.Background(), registry, config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"docs": {Type: "stdio", Command: "docs-mcp"},
-	}}, RegisterOptions{ClientFactory: func(context.Context, Server) (ToolClient, error) { return client, nil }})
-	if err != nil {
-		t.Fatalf("RegisterTools() error = %v", err)
-	}
-	defer runtime.Close()
-
-	disclosures := runtime.StartupDisclosures()
-	if len(disclosures) != 1 {
-		t.Fatalf("StartupDisclosures() = %#v, want one", disclosures)
-	}
-	if disclosures[0].Name != "docs" {
-		t.Errorf("Name = %q, want the server it describes", disclosures[0].Name)
-	}
-	if len(disclosures[0].Notices) != 1 || disclosures[0].Notices[0] != startupNotice {
-		t.Errorf("Notices = %#v, want the launch disclosure", disclosures[0].Notices)
-	}
-}
-
-// A network server launches no local process, so it implements nothing and
-// reports nothing. That is a different answer from an empty one and the negative
-// case that keeps the statement meaningful.
-func TestANetworkServerReportsNoStartupDisclosure(t *testing.T) {
-	registry := tools.NewRegistry()
-	runtime, err := RegisterTools(context.Background(), registry, config.MCPConfig{Servers: map[string]config.MCPServerConfig{
-		"docs": {Type: "http", URL: "https://host.invalid/mcp"},
-	}}, RegisterOptions{ClientFactory: func(context.Context, Server) (ToolClient, error) {
-		return &fakeToolClient{listed: []RemoteTool{{Name: "lookup", Description: "Lookup"}}}, nil
-	}})
-	if err != nil {
-		t.Fatalf("RegisterTools() error = %v", err)
-	}
-	defer runtime.Close()
-	if disclosures := runtime.StartupDisclosures(); len(disclosures) != 0 {
-		t.Errorf("StartupDisclosures() = %#v, want none for a server that launches no process", disclosures)
-	}
-}

internal/plugins/activate.go

@@ -56,15 +56,6 @@ type commandOutput struct {
 	Stderr   string
 	ExitCode int
 	Err      error
-	// Notices carries the enforcement disclosures the execution runner attached
-	// to this command.
-	//
-	// The generic contract is not transport-only. Enforcement.Notices says what
-	// the sandbox actually did, and on Windows that includes trading the write
-	// jail away for a deny-read profile. A projection that copies stdout, stderr
-	// and an exit code drops it, so a plugin tool ran under the weakened token
-	// and said nothing about it.
-	Notices []string
 }
 
 // toolRunner executes a resolved plugin tool command. It is injectable so
@@ -558,37 +549,26 @@ func (tool pluginTool) invoke(ctx context.Context, args map[string]any, cwd stri
 	meta["exit_code"] = strconv.Itoa(output.ExitCode)
 
 	if output.Err != nil {
-		// EVERY POST-LAUNCH TERMINAL OUTCOME CARRIES THE DISCLOSURE. This branch
-		// used to rebuild a result from status, output and metadata alone, so a
-		// plugin that timed out or was cancelled reported only that and said
-		// nothing about having run without write confinement. Whether the notice
-		// survives must not depend on how the process ended. The launched-or-not
-		// question is answered in execPluginCommandWithExecution; by here
-		// output.Notices is empty for anything that never started.
 		return tools.Result{
-			Status:             tools.StatusError,
-			Output:             "Error executing plugin tool " + tool.name + ": " + output.Err.Error(),
-			Meta:               meta,
-			EnforcementNotices: output.Notices,
-			Display:            tools.Display{Summary: tool.name + " failed", Kind: "plugin"},
+			Status: tools.StatusError,
+			Output: "Error executing plugin tool " + tool.name + ": " + output.Err.Error(),
+			Meta:   meta,
 		}
 	}
 	formatted := formatPluginToolOutput(output)
 	if output.ExitCode != 0 {
 		return tools.Result{
-			Status:             tools.StatusError,
-			Output:             formatted,
-			Meta:               meta,
-			EnforcementNotices: output.Notices,
-			Display:            tools.Display{Summary: tool.name + " failed", Kind: "plugin"},
+			Status:  tools.StatusError,
+			Output:  formatted,
+			Meta:    meta,
+			Display: tools.Display{Summary: tool.name + " failed", Kind: "plugin"},
 		}
 	}
 	return tools.Result{
-		Status:             tools.StatusOK,
-		Output:             formatted,
-		Meta:               meta,
-		EnforcementNotices: output.Notices,
-		Display:            tools.Display{Summary: tool.name, Kind: "plugin"},
+		Status:  tools.StatusOK,
+		Output:  formatted,
+		Meta:    meta,
+		Display: tools.Display{Summary: tool.name, Kind: "plugin"},
 	}
 }
 
@@ -739,18 +719,7 @@ func execPluginCommandWithExecution(ctx context.Context, runner *execution.Runne
 	if result.Outcome.Exit != nil {
 		exitCode = result.Outcome.Exit.Code
 	}
-	output := commandOutput{
-		Stdout:   result.Stdout,
-		Stderr:   result.Stderr,
-		ExitCode: exitCode,
-	}
-	// THE NOTICE DESCRIBES A CHILD THAT RAN. Deciding that here, where the outcome
-	// kind is known, rather than at each result constructor: a timeout or a
-	// cancellation happened to a process that had already launched under the
-	// weakened token, so the disclosure is still true of it. A setup failure or a
-	// missing executable launched nothing, and claiming the write jail was traded
-	// away there would describe a trade nobody made.
-	output.Notices = result.Outcome.AppliedEnforcementNotices()
+	output := commandOutput{Stdout: result.Stdout, Stderr: result.Stderr, ExitCode: exitCode}
 	switch result.Outcome.Kind {
 	case execution.OutcomeSandboxSetupFailure, execution.OutcomeExecutableNotFound, execution.OutcomeTimedOut, execution.OutcomeCancelled:
 		output.Err = result.Err

internal/plugins/enforcement_notice_test.go

@@ -1,164 +0,0 @@
-package plugins
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/Twigpine/zero/internal/execution"
-	"github.com/Twigpine/zero/internal/tools"
-)
-
-// THE DISCLOSURE HAS TO SURVIVE THE PROJECTION.
-//
-// The execution runner puts enforcement notices on the structured outcome, and
-// this path used to copy only stdout, stderr and an exit code out of it. A
-// plugin tool therefore ran under the non-WRITE_RESTRICTED token and returned a
-// result that said nothing about the write jail it had just traded away.
-//
-// Asserted through pluginTool.invoke, which is what the registry calls, and
-// through Result.ModelOutput, which is what the model actually reads.
-func TestAPluginToolCarriesTheEnforcementNotice(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-
-	for _, testCase := range []struct {
-		name     string
-		exitCode int
-	}{
-		{"successful command", 0},
-		{"failed command", 3},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			tool := pluginTool{
-				name: "demo",
-				run: func(context.Context, pluginCommand) commandOutput {
-					return commandOutput{Stdout: "hello", ExitCode: testCase.exitCode, Notices: []string{notice}}
-				},
-			}
-
-			result := tool.invoke(context.Background(), map[string]any{}, t.TempDir())
-			if len(result.EnforcementNotices) == 0 {
-				t.Fatal("the plugin result carried no enforcement notice; the command ran under the weakened token and said nothing")
-			}
-			model := result.ModelOutput()
-			if !strings.Contains(model, notice) {
-				t.Errorf("the model-facing output does not contain the notice:\n%s", model)
-			}
-			if strings.Count(model, notice) != 1 {
-				t.Errorf("the notice appears %d times, want exactly once:\n%s", strings.Count(model, notice), model)
-			}
-			if summary := result.HumanDisplay().Summary; !strings.Contains(summary, notice) {
-				t.Errorf("the human summary does not contain the notice: %q", summary)
-			}
-		})
-	}
-}
-
-// And a command with no notice is unchanged, or the assertion above would be
-// satisfied by text pasted onto everything.
-func TestAPluginToolWithoutANoticeIsUnchanged(t *testing.T) {
-	tool := pluginTool{
-		name: "demo",
-		run: func(context.Context, pluginCommand) commandOutput {
-			return commandOutput{Stdout: "hello", ExitCode: 0}
-		},
-	}
-	result := tool.invoke(context.Background(), map[string]any{}, t.TempDir())
-	if len(result.EnforcementNotices) != 0 {
-		t.Errorf("a command with no enforcement notice grew one: %v", result.EnforcementNotices)
-	}
-	if result.Status != tools.StatusOK {
-		t.Errorf("status = %v, want ok", result.Status)
-	}
-}
-
-// A TIMEOUT OR CANCELLATION STILL RAN THE CHILD.
-//
-// invoke's error branch rebuilt a result from status, output and metadata alone,
-// so a plugin that timed out under the non-WRITE_RESTRICTED token reported only
-// the timeout. The process had already launched without write confinement;
-// whether the disclosure survives must not depend on how it ended.
-func TestAPluginToolCarriesTheNoticeWhenItTimesOutOrIsCancelled(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-
-	for _, testCase := range []struct {
-		name string
-		err  error
-	}{
-		{"timed out", context.DeadlineExceeded},
-		{"cancelled", context.Canceled},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			tool := pluginTool{
-				name: "demo",
-				run: func(context.Context, pluginCommand) commandOutput {
-					return commandOutput{ExitCode: -1, Err: testCase.err, Notices: []string{notice}}
-				},
-			}
-			result := tool.invoke(context.Background(), map[string]any{}, t.TempDir())
-
-			model := result.ModelOutput()
-			if !strings.Contains(model, notice) {
-				t.Errorf("the model-facing output lost the notice:\n%s", model)
-			}
-			if strings.Count(model, notice) != 1 {
-				t.Errorf("the notice appears %d times, want once:\n%s", strings.Count(model, notice), model)
-			}
-			if summary := result.HumanDisplay().Summary; !strings.Contains(summary, notice) {
-				t.Errorf("the human summary lost the notice: %q", summary)
-			}
-		})
-	}
-}
-
-// But a child that never launched must stay silent, or the notice describes a
-// trade nobody made.
-//
-// KEYED ON THE RECORDED FACT, NOT ON THE OUTCOME KIND. Reading the kind as a
-// launch-state field is wrong in both directions: a child that ran and then
-// produced an unreadable adapter report is rewritten to a setup failure, so the
-// disclosure is dropped although it applied, and a context cancelled before
-// os.StartProcess yields a cancellation, so the disclosure is claimed for a
-// process that never existed. This is why the earlier version of this test,
-// which asserted that the kind decides, was encoding the defect.
-func TestAPluginNoticeFollowsRecordedLaunchState(t *testing.T) {
-	const notice = "denyRead is configured, so the write jail is not confining writes"
-	enforcement := execution.Enforcement{Notices: []string{notice}}
-
-	// The two directions the kind gets wrong, spelled out.
-	ranThenReportFailed := execution.Outcome{
-		Kind:        execution.OutcomeSandboxSetupFailure,
-		Launched:    true,
-		Enforcement: enforcement,
-	}
-	if got := ranThenReportFailed.AppliedEnforcementNotices(); len(got) != 1 {
-		t.Errorf("a child that ran lost its disclosure because the report failed afterwards: %#v", got)
-	}
-
-	cancelledBeforeStart := execution.Outcome{
-		Kind:        execution.OutcomeCancelled,
-		Launched:    false,
-		Enforcement: enforcement,
-	}
-	if got := cancelledBeforeStart.AppliedEnforcementNotices(); len(got) != 0 {
-		t.Errorf("a process that never started claimed an enforcement trade: %#v", got)
-	}
-
-	// And the ordinary pairs still behave.
-	for _, testCase := range []struct {
-		name      string
-		outcome   execution.Outcome
-		discloses bool
-	}{
-		{"launched and succeeded", execution.Outcome{Kind: execution.OutcomeSuccess, Launched: true, Enforcement: enforcement}, true},
-		{"launched then timed out", execution.Outcome{Kind: execution.OutcomeTimedOut, Launched: true, Enforcement: enforcement}, true},
-		{"never launched, missing executable", execution.Outcome{Kind: execution.OutcomeExecutableNotFound, Launched: false, Enforcement: enforcement}, false},
-		{"never launched, setup failed", execution.Outcome{Kind: execution.OutcomeSandboxSetupFailure, Launched: false, Enforcement: enforcement}, false},
-	} {
-		t.Run(testCase.name, func(t *testing.T) {
-			if got := len(testCase.outcome.AppliedEnforcementNotices()) > 0; got != testCase.discloses {
-				t.Errorf("discloses = %v, want %v", got, testCase.discloses)
-			}
-		})
-	}
-}

internal/sandbox/enforcement_notices_test.go

@@ -1,37 +0,0 @@
-package sandbox
-
-import "testing"
-
-// THE CHANNEL IS PINNED WITHOUT A PRODUCER.
-//
-// Nothing in the tree fills CommandPlan.Notes today: the Windows denyRead trade
-// notice was the last producer, and since #1006 refuses denyRead outright there
-// is no trade to describe. The line in EnforcementFor that carries plan notes
-// into Enforcement.Notices is still what hooks, plugins and MCP read, and the
-// end-to-end test that used to reach it through the real producer went with the
-// producer. So it is driven from a fixture plan instead: deleting that one line
-// fails here, and nowhere else.
-func TestEnforcementForCarriesThePlanNoticesToTheGenericContract(t *testing.T) {
-	plan := CommandPlan{Notes: []string{
-		"first fixed sentence from the sandbox",
-		"second fixed sentence from the sandbox",
-	}}
-	notices := EnforcementFor(plan).Notices
-	if len(notices) != len(plan.Notes) {
-		t.Fatalf("EnforcementFor produced %d notices from %d plan notes; hooks, plugins and MCP read this field and would see nothing",
-			len(notices), len(plan.Notes))
-	}
-	for index, note := range plan.Notes {
-		if notices[index] != note {
-			t.Errorf("notice %d = %q, want the plan note %q in the same position", index, notices[index], note)
-		}
-	}
-}
-
-// And a plan with nothing to say produces no notices, so a consumer cannot be
-// handed an empty string it would then render as a card.
-func TestEnforcementForCarriesNoNoticesFromASilentPlan(t *testing.T) {
-	if notices := EnforcementFor(CommandPlan{}).Notices; len(notices) != 0 {
-		t.Fatalf("EnforcementFor produced notices from a plan with none: %q", notices)
-	}
-}

internal/sandbox/main_test.go

@@ -0,0 +1,35 @@
+package sandbox
+
+import (
+	"os"
+	"testing"
+)
+
+// TestMain points the sandbox runtime's user-cache root at test-owned storage
+// for the whole package.
+//
+// PLAN CONSTRUCTION CREATES DIRECTORIES, which is easy to miss because it reads
+// like naming. windowsSandboxProfileWithProvisionedRuntime provisions the root
+// it selects, and the simulated-Windows tests run on every platform, so a test
+// that supplies an explicit child environment but leaves the cache alone writes
+// into the developer's real one. Not hypothetical: the machine this was found on
+// had accumulated thousands of entries under the real runtime root from exactly
+// these runs.
+//
+// Done once for the package rather than per test, because the leak is in the
+// DEFAULT: any new test that builds a Windows plan is affected unless its author
+// remembers, and remembering is what failed here. A test that needs a specific
+// cache root still overrides sandboxUserCacheDir itself.
+func TestMain(m *testing.M) {
+	root, err := os.MkdirTemp("", "zero-sandbox-testcache-")
+	if err != nil {
+		// Fail loudly rather than silently falling back to the real cache.
+		panic("sandbox tests: create the test cache root: " + err.Error())
+	}
+	sandboxUserCacheDir = func() (string, error) { return root, nil }
+
+	code := m.Run()
+
+	_ = os.RemoveAll(root)
+	os.Exit(code)
+}

internal/sandbox/runner.go

@@ -70,20 +70,6 @@ type CommandPlan struct {
 	// workspace. It carries structured policy facts; command output is never
 	// parsed as the control protocol.
 	executionReportPath string
-	// childLaunchReported marks a plan whose helper publishes the authoritative
-	// child-launch fact through executionReportPath. Set ONLY by adapters that
-	// actually write it: Wrapped alone is not enough, since a bwrap plan is also
-	// wrapped and reports only denials, and treating its silence as "no child"
-	// would deny every successful Linux sandbox run its disclosure.
-	childLaunchReported bool
-}
-
-// ChildLaunchOwnedByAdapter reports whether this plan starts a WRAPPER whose
-// helper creates the requested process itself, so the requested child launched
-// only if the adapter says so. False for a direct command, where the process the
-// caller starts IS the requested one.
-func (plan CommandPlan) ChildLaunchOwnedByAdapter() bool {
-	return plan.childLaunchReported
 }
 
 // Cleanup releases any resources the plan holds. It is safe to call on a zero
@@ -145,12 +131,15 @@ func (engine *Engine) PrepareExecution(ctx context.Context, request execution.Re
 		return execution.PreparedCommand{}, err
 	}
 	return execution.PreparedCommand{
-		Command:     command,
-		Enforcement: EnforcementFor(plan),
-		Report:      plan.ExecutionReport,
-		Cleanup:     plan.Cleanup,
-		// Only for adapters that publish the fact; see CommandPlan.childLaunchReported.
-		ChildLaunchOwnedByAdapter: plan.childLaunchReported,
+		Command: command,
+		Enforcement: execution.Enforcement{
+			Backend:         string(plan.TargetBackend),
+			Level:           string(plan.EnforcementLevel),
+			Degraded:        plan.EnforcementLevel == EnforcementDegraded,
+			DowngradeReason: plan.DowngradeReason,
+		},
+		Report:  plan.ExecutionReport,
+		Cleanup: plan.Cleanup,
 	}, nil
 }
 
@@ -200,7 +189,18 @@ func (engine *Engine) BuildCommandPlan(spec CommandSpec) (CommandPlan, error) {
 	}
 	var runtimeCleanup func()
 	if preference != SandboxPreferenceForbid && policy.Mode != ModeDisabled {
-		runtimeState, cleanup, runtimeErr := prepareSandboxRuntime(workspaceRoot)
+		// The home THIS command asked for. Windows planning resolves
+		// ZERO_WINDOWS_SANDBOX_HOME out of spec.Env and hands it to the runner for
+		// marker validation, so selection has to read the same environment or the
+		// two disagree about which marker describes the tree. See
+		// pinnedSandboxRuntimeRoot.
+		commandSandboxHome := ""
+		if spec.Env != nil {
+			if resolved, err := ResolveWindowsSandboxHome(envListToMap(spec.Env)); err == nil {
+				commandSandboxHome = resolved
+			}
+		}
+		runtimeState, cleanup, runtimeErr := prepareSandboxRuntime(workspaceRoot, commandSandboxHome)
 		if runtimeErr != nil {
 			return CommandPlan{}, runtimeErr
 		}
@@ -1207,26 +1207,3 @@ func isDynamicSensitiveEnvKey(key string) bool {
 		strings.HasSuffix(key, suffix) &&
 		len(key) > len(prefix)+len(suffix)
 }
-
-// EnforcementFor projects a CommandPlan onto the platform-neutral enforcement
-// contract.
-//
-// ONE PROJECTION, because there were two and they drifted. PrepareExecution
-// built execution.Enforcement by hand for the generic adapter that hooks,
-// plugins and MCP processes go through, and exec_command built the same struct
-// by hand for the tool path. When Notices was added it reached only the tool
-// path, so the contract was true for one wrapper and false for the wrapper other
-// execution consumers depend on. A hand-maintained projection duplicated across
-// two adapters cannot be kept honest by review; a shared one cannot be missed.
-//
-// The notice slice is copied rather than aliased so a consumer cannot mutate the
-// plan through it.
-func EnforcementFor(plan CommandPlan) execution.Enforcement {
-	return execution.Enforcement{
-		Backend:         string(plan.TargetBackend),
-		Level:           string(plan.EnforcementLevel),
-		Degraded:        plan.EnforcementLevel == EnforcementDegraded,
-		DowngradeReason: plan.DowngradeReason,
-		Notices:         append([]string(nil), plan.Notes...),
-	}
-}

internal/sandbox/runner_windows_integration_test.go

@@ -393,10 +393,11 @@ func realSmokeExecutable(t *testing.T, envKey string, fallbackName string) strin
 
 func runWindowsRealSmokeSetup(t *testing.T, setupExe string, options WindowsSandboxSetupArgsOptions) {
 	t.Helper()
-	args, err := BuildWindowsSandboxSetupArgs(options)
+	setupPlan, err := BuildWindowsSandboxSetupArgs(options)
 	if err != nil {
 		t.Fatalf("BuildWindowsSandboxSetupArgs: %v", err)
 	}
+	args := setupPlan.Args
 	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
 	defer cancel()
 	cmd := exec.CommandContext(ctx, setupExe, args...)
@@ -406,8 +407,30 @@ func runWindowsRealSmokeSetup(t *testing.T, setupExe string, options WindowsSand
 	}
 }
 
+// prepareWindowsRealSmokeCommand gives an elevated-tier smoke command the profile
+// the planner would have given it. The elevated runner validates the command
+// against the setup marker, and setup fingerprinted a profile with the selected
+// runtime folded in, so a command built from the bare profile can only be
+// refused. The unelevated tier applies its own plan and has no marker to agree
+// with, so it is left exactly as the test wrote it.
+func prepareWindowsRealSmokeCommand(t *testing.T, base WindowsSandboxCommandArgsOptions) (WindowsSandboxCommandArgsOptions, func()) {
+	t.Helper()
+	if base.SandboxLevel != WindowsSandboxLevelRestrictedToken || base.PermissionProfile.Runtime != nil {
+		return base, func() {}
+	}
+	workspace := firstNonEmpty(base.WorkspaceRoots...)
+	prepared, release, err := plannerPreparedWindowsProfile(workspace, base.SandboxHome, base.PermissionProfile)
+	if err != nil {
+		t.Fatalf("prepare the smoke command the way the planner does: %v", err)
+	}
+	base.PermissionProfile = prepared
+	return base, release
+}
+
 func runWindowsRealSmokeCommand(t *testing.T, runnerExe string, base WindowsSandboxCommandArgsOptions, command []string, wantCode int) {
 	t.Helper()
+	base, release := prepareWindowsRealSmokeCommand(t, base)
+	defer release()
 	base.Command = command
 	args, err := BuildWindowsSandboxCommandArgs(base)
 	if err != nil {
@@ -433,6 +456,8 @@ func runWindowsRealSmokeCommand(t *testing.T, runnerExe string, base WindowsSand
 // explicit unsupported-mode rejections rather than sandboxed command failures).
 func runWindowsRealSmokeCommandExpectError(t *testing.T, runnerExe string, base WindowsSandboxCommandArgsOptions, command []string, wantSubstr ...string) {
 	t.Helper()
+	base, release := prepareWindowsRealSmokeCommand(t, base)
+	defer release()
 	base.Command = command
 	args, err := BuildWindowsSandboxCommandArgs(base)
 	if err != nil {

internal/sandbox/runtime_bound_records_test.go

@@ -0,0 +1,88 @@
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// THE TWO HALVES OF A ROLLBACK RECORD MUST DESCRIBE ONE OBJECT.
+//
+// The snapshot used to read the identity through a handle, close it, and then
+// re-resolve the pathname to read the stamp. A rename between those pairs one
+// directory's identity with another's bytes, and a rollback that correctly
+// proves it holds the first then writes the second's contents into it.
+//
+// The window itself needs an elevated installer racing an unelevated renamer and
+// is not reproducible here, so this pins the contract the binding provides: both
+// facts come back together, and they agree with the object actually at the path.
+func TestStampSnapshotPairsIdentityWithItsOwnBytes(t *testing.T) {
+	root := filepath.Join(t.TempDir(), "root")
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	const contents = "the stamp that belongs to this directory"
+	if err := os.WriteFile(windowsSandboxRuntimeStampPath(root, testStampPlanHash), []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	identity, identified, prior, state, err := snapshotRuntimeStampBound(root, windowsSandboxRuntimeStampName(testStampPlanHash))
+	if err != nil {
+		t.Fatalf("snapshot: %v", err)
+	}
+	existed := state == runtimeStampPresent
+	if !identified {
+		t.Fatal("the snapshot established no identity for a directory that exists")
+	}
+	if !existed || string(prior) != contents {
+		t.Fatalf("prior stamp = %q existed=%v, want %q", string(prior), existed, contents)
+	}
+	if direct, ok := runtimeDirIdentity(root); !ok || direct != identity {
+		t.Errorf("snapshot identity %q does not describe the directory at the path (%q)", identity, direct)
+	}
+}
+
+// An absent stamp still establishes the identity, because that came from the
+// directory handle and not from the stamp read.
+func TestStampSnapshotIdentifiesARootWithNoStamp(t *testing.T) {
+	root := filepath.Join(t.TempDir(), "root")
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	identity, identified, _, state, err := snapshotRuntimeStampBound(root, windowsSandboxRuntimeStampName(testStampPlanHash))
+	if err != nil {
+		t.Fatalf("snapshot: %v", err)
+	}
+	existed := state == runtimeStampPresent
+	if !identified || identity == "" {
+		t.Error("a root with no stamp established no identity")
+	}
+	if existed {
+		t.Error("reported a prior stamp that does not exist")
+	}
+}
+
+// A created directory's identity must come from the creation, so the ledger
+// cannot record an object this run did not make.
+func TestCreatedDirectoryIdentityDescribesWhatWasCreated(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "created")
+
+	identity, identified, err := createRuntimeDirIdentified(path)
+	if err != nil {
+		t.Fatalf("create: %v", err)
+	}
+	if !identified || identity == "" {
+		t.Fatal("creation established no identity")
+	}
+	if info, statErr := os.Stat(path); statErr != nil || !info.IsDir() {
+		t.Fatalf("the directory was not created: %v", statErr)
+	}
+	if direct, ok := runtimeDirIdentity(path); !ok || direct != identity {
+		t.Errorf("creation identity %q does not describe the directory now at the path (%q)", identity, direct)
+	}
+
+	// Creating over something that exists is the caller's already-handled signal.
+	if _, _, again := createRuntimeDirIdentified(path); !os.IsExist(again) {
+		t.Errorf("creating over an existing directory returned %v, want an IsExist error", again)
+	}
+}

internal/sandbox/runtime_compensation_absent_windows_test.go

@@ -0,0 +1,97 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// ABSENCE IS CLASSIFIED IN THE PRODUCER'S DOMAIN.
+//
+// The stamp is opened through NtCreateFile, so a stamp that is not there comes
+// back as STATUS_OBJECT_NAME_NOT_FOUND. Compensation compared it with the Win32
+// codes only. An NTStatus is a different type and errors.Is does not convert it,
+// so removing a stamp that never existed was reported as a rollback failure.
+//
+// Native, against real directories: the question is what the API returns at this
+// boundary, and a synthetic error value would only test the comparison.
+
+func runtimeRootForCompensation(t *testing.T) (string, string) {
+	t.Helper()
+	root := filepath.Join(t.TempDir(), "zero", "runtime", "v1", "abcd")
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatalf("create the runtime root: %v", err)
+	}
+	identity, ok := runtimeDirIdentity(root)
+	if !ok {
+		t.Fatal("identify the runtime root")
+	}
+	return root, identity
+}
+
+// A runtime directory that exists and holds no stamp: removal has nothing to do
+// and says so by succeeding.
+func TestRemovingAStampThatIsNotThereSucceeds(t *testing.T) {
+	root, identity := runtimeRootForCompensation(t)
+	name := windowsSandboxRuntimeStampName(testStampPlanHash)
+
+	if err := compensateRuntimeStampBound(root, identity, name, nil, false); err != nil {
+		t.Fatalf("removing a stamp that was never written reported a failure: %v", err)
+	}
+	if _, err := os.Stat(root); err != nil {
+		t.Errorf("the runtime directory itself was disturbed: %v", err)
+	}
+}
+
+// A fresh setup that fails BEFORE its stamp is written, composed the way the
+// setup transaction composes it: a real snapshot of the untouched tree, and the
+// compensation run with the original failure as its cause. The cause has to come
+// back alone. A second error about the stamp sends the operator looking for
+// residue that does not exist.
+func TestAFreshSetupFailureBeforeTheStampReportsOnlyItsCause(t *testing.T) {
+	root, _ := runtimeRootForCompensation(t)
+	snapshot, err := snapshotWindowsSandboxRuntimeStamp(root, testStampPlanHash)
+	if err != nil {
+		t.Fatalf("snapshot: %v", err)
+	}
+	if snapshot.priorState != runtimeStampAbsent || !snapshot.rootIdentified {
+		t.Fatalf("SETUP INVALID: the snapshot did not record an identified root with no stamp: %+v", snapshot)
+	}
+
+	cause := errors.New("windows ACL target does not exist: an earlier entry in the plan")
+	reported := runWindowsSandboxSetupCompensations(cause, nil, windowsRuntimeRootRollback{stamp: snapshot})
+
+	if reported == nil || !errors.Is(reported, cause) {
+		t.Fatalf("the original failure is no longer visible: %v", reported)
+	}
+	if text := reported.Error(); strings.Contains(text, "rollback failed") || strings.Contains(text, "setup stamp") {
+		t.Errorf("compensation added a failure of its own for a stamp that never existed:\n%s", text)
+	}
+}
+
+// AND ONLY ABSENCE. Something at the stamp's name that cannot be opened as the
+// stamp is not "already removed", and treating every failed open as success
+// would report a clean undo over residue nobody looked at. A directory at that
+// name is a failure the real API produces on demand.
+func TestAnUninspectableStampIsStillReported(t *testing.T) {
+	root, identity := runtimeRootForCompensation(t)
+	name := windowsSandboxRuntimeStampName(testStampPlanHash)
+	if err := os.Mkdir(filepath.Join(root, name), 0o700); err != nil {
+		t.Fatalf("put a directory where the stamp would be: %v", err)
+	}
+
+	err := compensateRuntimeStampBound(root, identity, name, nil, false)
+	if err == nil {
+		t.Fatal("compensation reported success over something it could not open as the stamp")
+	}
+	if isWindowsNotFound(err) {
+		t.Errorf("the failure classifies as not-found, so it would be swallowed: %v", err)
+	}
+	if _, statErr := os.Stat(filepath.Join(root, name)); statErr != nil {
+		t.Errorf("the object it could not inspect was removed anyway: %v", statErr)
+	}
+}

internal/sandbox/runtime_compensation_identity_test.go

@@ -0,0 +1,112 @@
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// COMPENSATION MUST PROVE IT HOLDS THE OBJECT IT CHANGED.
+//
+// The forward apply and its stamp go through one handle, so they are provably
+// about one object. Compensation runs later, after those handles have closed,
+// and used to resolve the pathname again. Rename the original aside, put an
+// ordinary directory at the name, and a pathname-only undo strips a stamp from
+// the substitute, or writes bytes snapshotted from another object onto it, and
+// then removes it as though this run had created it, while the moved original
+// keeps this run's grant and stamp.
+func TestStampCompensationRefusesAReplacementDirectory(t *testing.T) {
+	parent := t.TempDir()
+	root := filepath.Join(parent, "runtime-root")
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	stampPath := windowsSandboxRuntimeStampPath(root, testStampPlanHash)
+	if err := os.WriteFile(stampPath, []byte("previous-plan-hash"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	snapshot, err := snapshotWindowsSandboxRuntimeStamp(root, testStampPlanHash)
+	if err != nil {
+		t.Fatalf("snapshot: %v", err)
+	}
+	if snapshot.priorState != runtimeStampPresent {
+		t.Fatal("SETUP INVALID: the snapshot did not record the pre-existing stamp")
+	}
+
+	// The original is moved aside and an ordinary directory takes the name.
+	moved := filepath.Join(parent, "moved-aside")
+	if err := os.Rename(root, moved); err != nil {
+		t.Skipf("cannot rename the runtime root on this filesystem: %v", err)
+	}
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	substituteStamp := filepath.Join(root, filepath.Base(stampPath))
+	if err := os.WriteFile(substituteStamp, []byte("not-ours"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	err = snapshot.restore()
+	if err == nil {
+		t.Fatal("compensation mutated a directory it never touched and reported success")
+	}
+	for _, want := range []string{"no longer the directory", "replacement"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("the error does not say what was left behind (%q): %v", want, err)
+		}
+	}
+	if body, readErr := os.ReadFile(substituteStamp); readErr != nil || string(body) != "not-ours" {
+		t.Errorf("the substitute's stamp was overwritten: %q %v", string(body), readErr)
+	}
+	if body, readErr := os.ReadFile(filepath.Join(moved, filepath.Base(stampPath))); readErr != nil || string(body) != "previous-plan-hash" {
+		t.Errorf("the original lost its stamp: %q %v", string(body), readErr)
+	}
+}
+
+// And the created-directory ledger applies the same rule, or the stamp check
+// just moves the damage one line down.
+func TestCreatedDirectoryCompensationRefusesAReplacement(t *testing.T) {
+	parent := t.TempDir()
+	root := filepath.Join(parent, "created-root")
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	rollback := windowsRuntimeRootRollback{created: createdRuntimeDirsForTest(root)}
+
+	moved := filepath.Join(parent, "moved")
+	if err := os.Rename(root, moved); err != nil {
+		t.Skipf("cannot rename on this filesystem: %v", err)
+	}
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatal(err)
+	}
+
+	err := rollback.run()
+	if err == nil {
+		t.Fatal("a substitute directory was removed as though this run had created it")
+	}
+	if !strings.Contains(err.Error(), "no longer the directory this run created") {
+		t.Errorf("the error does not name the replacement: %v", err)
+	}
+	if _, statErr := os.Stat(root); statErr != nil {
+		t.Errorf("the substitute was removed: %v", statErr)
+	}
+}
+
+// The ordinary case still cleans up, or the guard would be refusing everything.
+func TestCompensationStillRemovesWhatThisRunCreated(t *testing.T) {
+	parent := t.TempDir()
+	root := filepath.Join(parent, "mine")
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	rollback := windowsRuntimeRootRollback{created: createdRuntimeDirsForTest(root)}
+	if err := rollback.run(); err != nil {
+		t.Fatalf("compensation refused a directory it really did create: %v", err)
+	}
+	if _, err := os.Stat(root); !os.IsNotExist(err) {
+		t.Errorf("the directory this run created survived compensation: %v", err)
+	}
+}

internal/sandbox/runtime_compensation_other.go

@@ -0,0 +1,67 @@
+//go:build !windows
+
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// runtimeCompensationSwapSeam exists so the shared compensation code compiles
+// everywhere. Only the Windows build closes a check-then-mutate window, because
+// only there does setup run elevated against a tree an unelevated process can
+// rename.
+var runtimeCompensationSwapSeam func()
+
+func compensateRuntimeStampBound(root string, identity string, name string, prior []byte, existed bool) error {
+	current, ok := runtimeDirIdentity(root)
+	if !ok {
+		return fmt.Errorf("identify the sandbox runtime root %s for stamp compensation", root)
+	}
+	if current != identity {
+		return fmt.Errorf("sandbox runtime root %s is no longer the directory this setup stamped; "+
+			"leaving the replacement untouched, and the original still carries this run's stamp", root)
+	}
+	if runtimeCompensationSwapSeam != nil {
+		runtimeCompensationSwapSeam()
+	}
+	path := filepath.Join(root, name)
+	if !existed {
+		if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+			return fmt.Errorf("remove sandbox runtime setup stamp written by this run: %w", err)
+		}
+		return nil
+	}
+	if err := os.WriteFile(path, prior, 0o600); err != nil {
+		return fmt.Errorf("restore the previous sandbox runtime setup stamp: %w", err)
+	}
+	return nil
+}
+
+func removeCreatedRuntimeDirBound(path string, identity string) error {
+	current, ok := runtimeDirIdentity(path)
+	if !ok {
+		// ONLY ABSENCE MEANS THERE IS NOTHING TO UNDO. Any lookup failure used to
+		// return here, so a directory that exists but could not be identified was
+		// reported as cleanly removed while it stayed on disk. The Windows build
+		// already draws this line, and the rollback it serves promises to report
+		// what it could not remove. Reported by CodeRabbit.
+		if _, err := os.Lstat(path); errors.Is(err, os.ErrNotExist) {
+			return nil
+		}
+		return fmt.Errorf("sandbox runtime root %s was created by this run but could not be identified for removal; leaving it in place", path)
+	}
+	if current != identity {
+		return fmt.Errorf("sandbox runtime root %s is no longer the directory this run created; "+
+			"leaving the replacement in place", path)
+	}
+	if runtimeCompensationSwapSeam != nil {
+		runtimeCompensationSwapSeam()
+	}
+	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove sandbox runtime root %s created by this run: %w", path, err)
+	}
+	return nil
+}

internal/sandbox/runtime_compensation_other_test.go

@@ -0,0 +1,74 @@
+//go:build !windows
+
+package sandbox
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// ONLY ABSENCE IS NOTHING TO UNDO.
+//
+// removeCreatedRuntimeDirBound returned success on any failure to identify the
+// directory, so one that was still there, but could not be looked at, was
+// reported as removed. Here the parent loses search permission, which makes the
+// directory exist and be unidentifiable at the same time.
+func TestRemovingAnUnidentifiableCreatedDirectoryIsReported(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root bypasses directory search permission, so the lookup cannot be made to fail")
+	}
+	parent := filepath.Join(t.TempDir(), "zero")
+	created := filepath.Join(parent, "runtime")
+	if err := os.MkdirAll(created, 0o700); err != nil {
+		t.Fatalf("create the directory: %v", err)
+	}
+	identity, ok := runtimeDirIdentity(created)
+	if !ok {
+		t.Fatal("identify the created directory")
+	}
+	if err := os.Chmod(parent, 0o600); err != nil {
+		t.Fatalf("withdraw search permission: %v", err)
+	}
+	t.Cleanup(func() { _ = os.Chmod(parent, 0o700) })
+	if _, err := os.Lstat(created); err == nil || errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("SETUP INVALID: the directory should exist and be unidentifiable, Lstat said %v", err)
+	}
+
+	err := removeCreatedRuntimeDirBound(created, identity)
+	if err == nil {
+		t.Fatal("a created directory that could not be identified was reported as removed")
+	}
+	if !strings.Contains(err.Error(), "could not be identified") {
+		t.Errorf("the error does not say why the directory was left: %v", err)
+	}
+
+	// And it is still there, which is why the error is owed.
+	if err := os.Chmod(parent, 0o700); err != nil {
+		t.Fatalf("restore search permission: %v", err)
+	}
+	if _, err := os.Lstat(created); err != nil {
+		t.Fatalf("the directory was gone after all, so the error was not owed: %v", err)
+	}
+}
+
+// Absence stays a clean undo, or the test above would be satisfied by a function
+// that reports every lookup failure.
+func TestRemovingACreatedDirectoryThatIsAlreadyGoneSucceeds(t *testing.T) {
+	created := filepath.Join(t.TempDir(), "runtime")
+	if err := os.Mkdir(created, 0o700); err != nil {
+		t.Fatalf("create the directory: %v", err)
+	}
+	identity, ok := runtimeDirIdentity(created)
+	if !ok {
+		t.Fatal("identify the created directory")
+	}
+	if err := os.Remove(created); err != nil {
+		t.Fatalf("remove the directory: %v", err)
+	}
+	if err := removeCreatedRuntimeDirBound(created, identity); err != nil {
+		t.Fatalf("a created directory that is already gone was reported as a failed undo: %v", err)
+	}
+}

internal/sandbox/runtime_compensation_swap_windows_test.go

@@ -0,0 +1,100 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// swapDuringCompensation installs a seam that runs once, between the identity
+// check and the mutation, and replaces root with a fresh directory carrying a
+// file of its own.
+func swapDuringCompensation(t *testing.T, root string, aside string) *string {
+	t.Helper()
+	fired := false
+	previous := runtimeCompensationSwapSeam
+	t.Cleanup(func() { runtimeCompensationSwapSeam = previous })
+	runtimeCompensationSwapSeam = func() {
+		if fired {
+			return
+		}
+		fired = true
+		if err := os.Rename(root, aside); err != nil {
+			t.Logf("could not rename the original aside: %v", err)
+			return
+		}
+		if err := os.MkdirAll(root, 0o700); err != nil {
+			t.Fatalf("create the substitute: %v", err)
+		}
+		if err := os.WriteFile(filepath.Join(root, "substitute.txt"), []byte("belongs to whoever put it here"), 0o600); err != nil {
+			t.Fatalf("seed the substitute: %v", err)
+		}
+	}
+	return &aside
+}
+
+// A REPLACEMENT AFTER THE CHECK MUST NOT REACH THE SUBSTITUTE.
+//
+// Compensation used to read the identity through a handle, close it, and then
+// resolve the pathname again for the write or the delete. A rename plus a
+// replacement in that interval made the comparison true about one object while
+// the mutation landed on another, under elevation. Holding the handle across
+// both means the mutation follows the object that was verified, and whatever now
+// answers to the name is untouched.
+func TestStampCompensationDoesNotReachASubstitute(t *testing.T) {
+	parent := t.TempDir()
+	root := filepath.Join(parent, "zero", "runtime", "v1", "abcd")
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatalf("create the runtime root: %v", err)
+	}
+	if err := writeWindowsSandboxRuntimeStamp(root, "planhash"); err != nil {
+		t.Fatalf("write the stamp: %v", err)
+	}
+	identity, ok := runtimeDirIdentity(root)
+	if !ok {
+		t.Fatal("identify the runtime root")
+	}
+	aside := filepath.Join(parent, "renamed-aside")
+	swapDuringCompensation(t, root, aside)
+
+	// Removal of a stamp this run wrote, i.e. the fresh-setup rollback.
+	_ = compensateRuntimeStampBound(root, identity, windowsSandboxRuntimeStampName(testStampPlanHash), nil, false)
+
+	// Whatever the outcome, the substitute is not this run's business.
+	substitute := filepath.Join(root, "substitute.txt")
+	if _, err := os.Stat(substitute); err != nil {
+		t.Errorf("compensation removed a file from the substitute directory: %v", err)
+	}
+	if _, err := os.Stat(windowsSandboxRuntimeStampPath(root, testStampPlanHash)); err == nil {
+		t.Error("compensation created a stamp inside the substitute directory")
+	}
+	// And the original, which is the object that was verified, is the one that
+	// lost the stamp this run wrote.
+	if _, err := os.Stat(windowsSandboxRuntimeStampPath(aside, testStampPlanHash)); err == nil {
+		t.Error("the stamp this run wrote is still on the original object, so compensation followed the name instead")
+	}
+}
+
+// The same for the delete, where following the name would remove a directory
+// this run never created.
+func TestDirectoryCompensationDoesNotRemoveASubstitute(t *testing.T) {
+	parent := t.TempDir()
+	created := filepath.Join(parent, "created")
+	if err := os.MkdirAll(created, 0o700); err != nil {
+		t.Fatalf("create the directory: %v", err)
+	}
+	identity, ok := runtimeDirIdentity(created)
+	if !ok {
+		t.Fatal("identify the created directory")
+	}
+	aside := filepath.Join(parent, "renamed-aside")
+	swapDuringCompensation(t, created, aside)
+
+	_ = removeCreatedRuntimeDirBound(created, identity)
+
+	if _, err := os.Stat(filepath.Join(created, "substitute.txt")); err != nil {
+		t.Errorf("compensation removed the substitute directory's contents: %v", err)
+	}
+}

internal/sandbox/runtime_compensation_verify_windows_test.go

@@ -0,0 +1,78 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// ONLY NOT-FOUND IS EVIDENCE OF REMOVAL.
+//
+// The verification probe used to read any Lstat error as absence, so a sharing
+// violation, an access denial, or an entry left delete-pending by another
+// process that holds a share-delete handle all reported complete compensation
+// for a directory that is still there. A holder able to clear the disposition
+// could then make the "removed" object visible again, and setup would already
+// have said the rollback finished.
+//
+// The three outcomes are distinguished with a probe seam, because a real
+// filesystem will not produce the third on demand.
+func TestDeletionVerificationDistinguishesAllThreeOutcomes(t *testing.T) {
+	previous := runtimeCompensationStat
+	t.Cleanup(func() { runtimeCompensationStat = previous })
+
+	newDir := func() (string, string) {
+		t.Helper()
+		dir := filepath.Join(t.TempDir(), "created")
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			t.Fatal(err)
+		}
+		identity, ok := runtimeDirIdentity(dir)
+		if !ok {
+			t.Fatal("identify the created directory")
+		}
+		return dir, identity
+	}
+
+	t.Run("absence is proven and reported as success", func(t *testing.T) {
+		dir, identity := newDir()
+		runtimeCompensationStat = func(string) (fs.FileInfo, error) {
+			return nil, &os.PathError{Op: "lstat", Path: dir, Err: os.ErrNotExist}
+		}
+		if err := removeCreatedRuntimeDirBound(dir, identity); err != nil {
+			t.Errorf("a proven-absent directory was reported as a failure: %v", err)
+		}
+	})
+
+	t.Run("still present is reported", func(t *testing.T) {
+		dir, identity := newDir()
+		runtimeCompensationStat = func(path string) (fs.FileInfo, error) { return os.Stat(".") }
+		err := removeCreatedRuntimeDirBound(dir, identity)
+		if err == nil {
+			t.Fatal("a directory still present after deletion was reported as removed")
+		}
+		if !strings.Contains(err.Error(), "still present") {
+			t.Errorf("unexpected error: %v", err)
+		}
+	})
+
+	t.Run("an unverifiable probe is residue, not success", func(t *testing.T) {
+		dir, identity := newDir()
+		// What a share-delete holder produces: neither absence nor presence.
+		runtimeCompensationStat = func(path string) (fs.FileInfo, error) {
+			return nil, &os.PathError{Op: "lstat", Path: path, Err: errors.New("Access is denied.")}
+		}
+		err := removeCreatedRuntimeDirBound(dir, identity)
+		if err == nil {
+			t.Fatal("an unverifiable removal was reported as complete compensation")
+		}
+		if !strings.Contains(err.Error(), "could not be verified") {
+			t.Errorf("the error does not say the removal is unproven: %v", err)
+		}
+	})
+}

internal/sandbox/runtime_compensation_windows.go

@@ -0,0 +1,195 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// THE HANDLE IS THE OBJECT. A pathname is not.
+//
+// Compensation used to read the directory identity through a handle, close it,
+// and then resolve the pathname again for the mutation. A rename followed by a
+// replacement between those two steps makes the comparison true about one
+// object while the write or delete lands on another, and this runs elevated, so
+// a redirected pathname gives the mutation reach the replacer does not have
+// directly.
+//
+// Opening once and keeping the handle open across BOTH the identity check and
+// the mutation removes the interval. The child operations are relative to that
+// handle, so no ancestor is re-resolved either.
+
+// runtimeCompensationSwapSeam runs between the identity check and the mutation.
+// Nil in production; a test installs one to replace the directory in exactly the
+// window this design closes.
+var runtimeCompensationSwapSeam func()
+
+// runtimeCompensationStat is the post-deletion existence probe. A var so a test
+// can produce the third outcome, an inspection that neither proves absence nor
+// presence, which no real filesystem produces on demand.
+var runtimeCompensationStat = os.Lstat
+
+type fileDispositionInfo struct {
+	DeleteFile byte
+}
+
+func handleRuntimeIdentity(handle windows.Handle) (string, error) {
+	var info windows.ByHandleFileInformation
+	if err := windows.GetFileInformationByHandle(handle, &info); err != nil {
+		return "", err
+	}
+	return fmt.Sprintf("%d:%d:%d", info.VolumeSerialNumber, info.FileIndexHigh, info.FileIndexLow), nil
+}
+
+// openVerifiedRuntimeDirectory opens path without following a link at the final
+// component and returns it only if it is still the object identity names.
+func openVerifiedRuntimeDirectory(path string, identity string, access uint32, what string) (windows.Handle, error) {
+	utf16Path, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+	handle, err := windows.CreateFile(
+		utf16Path,
+		access|windows.FILE_READ_ATTRIBUTES,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+		nil,
+		windows.OPEN_EXISTING,
+		windows.FILE_FLAG_BACKUP_SEMANTICS|windows.FILE_FLAG_OPEN_REPARSE_POINT,
+		0,
+	)
+	if err != nil {
+		return 0, err
+	}
+	current, err := handleRuntimeIdentity(handle)
+	if err != nil {
+		_ = windows.CloseHandle(handle)
+		return 0, fmt.Errorf("identify the sandbox runtime directory %s for compensation: %w", path, err)
+	}
+	if current != identity {
+		_ = windows.CloseHandle(handle)
+		return 0, fmt.Errorf("sandbox runtime root %s is no longer the directory this run %s; "+
+			"leaving the replacement in place, and the original still carries this run's changes", path, what)
+	}
+	return handle, nil
+}
+
+// markForDeletion queues the object the handle names for removal. It never
+// resolves a pathname, so it can only reach what this process already holds.
+func markForDeletion(handle windows.Handle) error {
+	info := fileDispositionInfo{DeleteFile: 1}
+	return windows.SetFileInformationByHandle(
+		handle,
+		windows.FileDispositionInfo,
+		(*byte)(unsafe.Pointer(&info)),
+		uint32(unsafe.Sizeof(info)),
+	)
+}
+
+// compensateRuntimeStampBound restores or removes the stamp through a handle on
+// the directory whose identity still matches.
+//
+// RESTORED WITHOUT A GAP. This used to delete the stamp and then recreate the
+// previous one, so a command validating in between, or a process stopping
+// there, found no stamp at all where the previous setup had left a valid one.
+// The ordinary writer replaces the stamp in one step and puts the protected
+// DACL back, which a raw write would not, so a restore is just a publish of the
+// previous bytes. Only the branch that had no stamp before deletes, because
+// absent is the state it restores. Reported by @jatmn.
+func compensateRuntimeStampBound(root string, identity string, name string, prior []byte, existed bool) error {
+	directory, err := openVerifiedRuntimeDirectory(root, identity,
+		windows.FILE_TRAVERSE|windowsFileAddFile|windows.READ_CONTROL|windows.SYNCHRONIZE, "stamped")
+	if err != nil {
+		return err
+	}
+	defer windows.CloseHandle(directory)
+
+	if runtimeCompensationSwapSeam != nil {
+		runtimeCompensationSwapSeam()
+	}
+
+	if !existed {
+		return deleteRuntimeStampChild(directory, name)
+	}
+	// Through the ordinary writer so it is protected again, and so the reader ACE
+	// is resolved the same way a fresh setup resolves it.
+	if err := writeWindowsRuntimeStampToDirectoryHandle(directory, name, string(prior)); err != nil {
+		return fmt.Errorf("restore the previous sandbox runtime setup stamp: %w", err)
+	}
+	return nil
+}
+
+// deleteRuntimeStampChild removes the stamp relative to an already verified
+// directory handle. A stamp that is not there is the desired end state; anything
+// else is reported rather than swallowed.
+func deleteRuntimeStampChild(directory windows.Handle, name string) error {
+	stamp, err := openWindowsChildNoFollow(directory, name,
+		windows.DELETE|windows.FILE_READ_ATTRIBUTES, windows.FILE_NON_DIRECTORY_FILE)
+	if err != nil {
+		// ABSENCE IS CLASSIFIED BY THE PRODUCER'S DOMAIN. openWindowsChildNoFollow
+		// goes through NtCreateFile, so a stamp that is not there arrives as
+		// STATUS_OBJECT_NAME_NOT_FOUND. This compared against the Win32 codes only,
+		// and an NTStatus is a different type that errors.Is does not convert, so a
+		// fresh setup that failed before writing any stamp reported a second,
+		// spurious rollback failure for removing a file that never existed. The
+		// snapshot path already answers this question for both domains, and using
+		// the same answer keeps snapshot and compensation agreeing about what
+		// absence means. Reported by @jatmn.
+		if isWindowsNotFound(err) {
+			return nil
+		}
+		return fmt.Errorf("remove sandbox runtime setup stamp written by this run: %w", err)
+	}
+	if err := markForDeletion(stamp); err != nil {
+		_ = windows.CloseHandle(stamp)
+		return fmt.Errorf("remove sandbox runtime setup stamp written by this run: %w", err)
+	}
+	// The entry goes when the last handle closes.
+	_ = windows.CloseHandle(stamp)
+	return nil
+}
+
+// removeCreatedRuntimeDirBound removes a directory this run created, through a
+// handle on the object identity names.
+func removeCreatedRuntimeDirBound(path string, identity string) error {
+	handle, err := openVerifiedRuntimeDirectory(path, identity, windows.DELETE, "created")
+	if err != nil {
+		if isWindowsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+	if runtimeCompensationSwapSeam != nil {
+		runtimeCompensationSwapSeam()
+	}
+	if err := markForDeletion(handle); err != nil {
+		_ = windows.CloseHandle(handle)
+		return fmt.Errorf("remove sandbox runtime root %s created by this run: %w", path, err)
+	}
+	// The entry goes when the last handle closes, so releasing ours is what makes
+	// the removal observable.
+	_ = windows.CloseHandle(handle)
+	// REPORTED SUCCESS IS NOT PROOF. A handle-bound operation accepting the call
+	// has been seen not to take effect (PR #751, the promote rename), so the
+	// outcome is checked rather than assumed.
+	//
+	// THREE OUTCOMES, NOT TWO. This used to read any Lstat error as absence, so a
+	// sharing violation, an access denial, or a delete-pending entry held open by
+	// another process all reported complete compensation for a directory that is
+	// still there. A holder that clears the disposition can then make the
+	// "removed" object visible again. Only not-found is evidence of removal;
+	// everything else is at best unproven and has to be reported as residue.
+	_, statErr := runtimeCompensationStat(path)
+	switch {
+	case errors.Is(statErr, os.ErrNotExist):
+		return nil
+	case statErr == nil:
+		return fmt.Errorf("remove sandbox runtime root %s created by this run: it is still present after the deletion was accepted", path)
+	default:
+		return fmt.Errorf("remove sandbox runtime root %s created by this run: its removal could not be verified, so it may still be present: %w", path, statErr)
+	}
+}

internal/sandbox/runtime_create.go

@@ -0,0 +1,15 @@
+package sandbox
+
+// runtimeIdentityAfterCreate resolves a just-created runtime directory's
+// identity BY PATHNAME, which is a second resolution of the same name and
+// therefore a window: the directory created can be renamed away and an ordinary
+// one substituted before this runs, and the ledger then records the substitute
+// for a directory the run never made.
+//
+// It is the honest implementation off Windows, where the elevated-installer
+// versus unelevated-renamer split this closes does not apply. On Windows the
+// creation returns the handle and identity is read from that, so nothing there
+// may call this: a Windows test asserts the count is zero, which is what makes
+// "the creation establishes the identity" a checked property rather than a
+// comment.
+var runtimeIdentityAfterCreate = runtimeDirIdentity

internal/sandbox/runtime_create_other.go

@@ -0,0 +1,15 @@
+//go:build !windows
+
+package sandbox
+
+import "os"
+
+// createRuntimeDirIdentified keeps the pathname form off Windows, where the
+// elevated-installer-versus-unelevated-renamer split this closes does not apply.
+func createRuntimeDirIdentified(path string) (string, bool, error) {
+	if err := os.Mkdir(path, 0o700); err != nil {
+		return "", false, err
+	}
+	identity, ok := runtimeIdentityAfterCreate(path)
+	return identity, ok, nil
+}

internal/sandbox/runtime_create_windows.go

@@ -0,0 +1,131 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// createRuntimeDirIdentified creates path and returns the identity of the
+// directory it created, read from the handle the creation itself returned.
+//
+// THE CREATION MUST BE THE THING THAT ESTABLISHES IDENTITY. os.Mkdir followed by
+// runtimeDirIdentity(path) is two resolutions of one name: Mkdir creates A, and
+// the reopen can land on a B substituted in between, so the rollback ledger
+// records B's identity for a directory this run never made. Compensation then
+// correctly proves it holds B and deletes it, while A keeps this run's ACL and
+// stamp under a name nothing is tracking. The runtime parent belongs to the
+// ordinary user, so that substitution needs no privilege.
+//
+// Win32 CreateFile cannot create a directory at all, whatever disposition it is
+// given, so an earlier attempt to do this with CREATE_NEW fell through to the
+// Mkdir-plus-reopen path on EVERY real creation and the documented handle
+// contract never once held. NtCreateFile with FILE_CREATE and
+// FILE_DIRECTORY_FILE does create one, and returns the handle to it.
+//
+// If the atomic create cannot be completed, this returns an error rather than
+// manufacturing an ownership record from a reopen: an unidentified create must
+// stop setup before privileged state is applied, not enter the ledger as though
+// it were proven.
+func createRuntimeDirIdentified(path string) (string, bool, error) {
+	clean := filepath.Clean(path)
+	parentPath, leaf := filepath.Split(clean)
+	leaf = filepath.Clean(leaf)
+	parentPath = filepath.Clean(parentPath)
+	if leaf == "" || leaf == "." || parentPath == clean {
+		return "", false, fmt.Errorf("sandbox runtime path %s has no component to create", path)
+	}
+
+	// The parent is either a directory that already existed when the missing
+	// components were computed, or one this same loop created a moment ago.
+	parent, err := openWindowsDirectoryByName(parentPath)
+	if err != nil {
+		return "", false, fmt.Errorf("open sandbox runtime parent %s: %w", parentPath, err)
+	}
+	defer windows.CloseHandle(parent)
+
+	handle, err := createWindowsChildDirectory(parent, leaf)
+	if err != nil {
+		// A collision is the same signal os.Mkdir gives for a component another
+		// process won the race to create, and the caller already treats that as
+		// "not ours" (windows_setup.go). Returned as a *PathError so BOTH
+		// os.IsExist, which the caller uses and which does not unwrap %w, and
+		// errors.Is recognize it; wrapping with %w alone would have turned a
+		// benign race into a hard setup failure.
+		if errors.Is(err, windows.STATUS_OBJECT_NAME_COLLISION) {
+			return "", false, &os.PathError{Op: "mkdir", Path: clean, Err: os.ErrExist}
+		}
+		return "", false, fmt.Errorf("create sandbox runtime directory %s: %w", clean, err)
+	}
+	defer windows.CloseHandle(handle)
+
+	identity, idErr := handleRuntimeIdentity(handle)
+	if idErr != nil {
+		return "", false, fmt.Errorf("identify the sandbox runtime directory created at %s: %w", clean, idErr)
+	}
+	return identity, true, nil
+}
+
+// removeWindowsObjectByHandle deletes the object this handle is open on.
+//
+// THROUGH THE HANDLE, NOT THE NAME. Every caller is on a failure path partway
+// through a creation, and the one object it may remove is the one it just made
+// and is still holding. Re-resolving the name to delete it is the substitution
+// hole this whole descent exists to close, and here it would be a pathname
+// authoritative delete of somebody else's directory.
+//
+// The handle needs DELETE access, which the creating opens above ask for.
+func removeWindowsObjectByHandle(handle windows.Handle) error {
+	var iosb windows.IO_STATUS_BLOCK
+	deleteIt := byte(1)
+	return windows.NtSetInformationFile(handle, &iosb, &deleteIt, 1, windows.FileDispositionInformation)
+}
+
+// createWindowsChildDirectory creates exactly one directory component beneath
+// parent and returns the handle to the object it created.
+//
+// Relative to a handle, so no ancestor is re-resolved and there is no interval
+// for a swap to land in. FILE_CREATE fails rather than opening anything that is
+// already there, so the returned handle cannot describe a pre-existing object,
+// and FILE_OPEN_REPARSE_POINT keeps the failure honest if one is.
+func createWindowsChildDirectory(parent windows.Handle, name string) (windows.Handle, error) {
+	objectName, err := windows.NewNTUnicodeString(name)
+	if err != nil {
+		return 0, fmt.Errorf("encode sandbox runtime component %s: %w", name, err)
+	}
+	attributes := windows.OBJECT_ATTRIBUTES{
+		RootDirectory: parent,
+		ObjectName:    objectName,
+		Attributes:    windows.OBJ_CASE_INSENSITIVE,
+	}
+	attributes.Length = uint32(unsafe.Sizeof(attributes))
+
+	var handle windows.Handle
+	var iosb windows.IO_STATUS_BLOCK
+	// DELETE because the caller has to be able to undo this creation through the
+	// handle it just got, without going back through the name. See
+	// removeWindowsObjectByHandle.
+	err = windows.NtCreateFile(
+		&handle,
+		windows.DELETE|windows.FILE_READ_ATTRIBUTES|windows.FILE_TRAVERSE|windows.SYNCHRONIZE,
+		&attributes,
+		&iosb,
+		nil,
+		windows.FILE_ATTRIBUTE_DIRECTORY,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+		windows.FILE_CREATE,
+		windows.FILE_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
+		0,
+		0,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return handle, nil
+}

internal/sandbox/runtime_creation_ownership_test.go

@@ -0,0 +1,158 @@
+package sandbox
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// CREATION IS THE OWNERSHIP BOUNDARY, NOT THE STEP AFTER IT.
+//
+// Acquisition learns it created a directory or a lease file at the create
+// itself, but used to publish that fact only once every later step had also
+// succeeded: the identity read for a directory, and the inspection, wrapping and
+// locking for a lease. A failure in between returned an error while leaving the
+// object on disk with nothing above holding a record of it. Setup then reported
+// failure and left invocation-owned state behind, and where an ancestor HAD been
+// recorded, that ancestor's compensation failed afterwards on a child it could
+// not account for.
+//
+// Both platforms are driven through acquireRuntimeLeaseForPlatform, the call
+// production makes, rather than through either descent directly.
+
+var errInjectedRuntimeFailure = errors.New("injected failure after the create")
+
+// failRuntimeCreationAt makes the step after the creation of the named object
+// fail, which is the only way to reach the paths under test.
+func failRuntimeCreationAt(t *testing.T, match string) {
+	t.Helper()
+	runtimeCreationFailure = func(created string) error {
+		if filepath.Base(created) == match {
+			return errInjectedRuntimeFailure
+		}
+		return nil
+	}
+	t.Cleanup(func() { runtimeCreationFailure = nil })
+}
+
+// runtimeRootForAcquisition returns a root whose owned tail does not exist yet,
+// so acquisition has to create it.
+func runtimeRootForAcquisition(t *testing.T) string {
+	t.Helper()
+	base := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(base, "zero", "runtime"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	return filepath.Join(base, "zero", "runtime", "v1", "digest")
+}
+
+// A directory whose identity could not be read is removed, not abandoned.
+func TestAcquisitionUndoesADirectoryItCreatedButCouldNotIdentify(t *testing.T) {
+	root := runtimeRootForAcquisition(t)
+	version := filepath.Dir(root)
+	failRuntimeCreationAt(t, filepath.Base(version))
+
+	lease, created, err := acquireRuntimeLeaseForPlatform(root)
+	if err == nil {
+		lease.release()
+		t.Fatal("SETUP INVALID: acquisition succeeded, so the injected failure never fired")
+	}
+	if !errors.Is(err, errInjectedRuntimeFailure) {
+		t.Fatalf("acquisition failed for some other reason: %v", err)
+	}
+	if len(created) != 0 {
+		t.Errorf("acquisition returned a ledger for a failed create: %v", created)
+	}
+	if _, statErr := os.Stat(version); !os.IsNotExist(statErr) {
+		t.Errorf("%s was created by this run and left behind after the failure, with nothing recording it (stat: %v)", version, statErr)
+	}
+	// And what was already there is untouched.
+	if _, statErr := os.Stat(filepath.Dir(version)); statErr != nil {
+		t.Errorf("a directory that existed before the run was removed: %v", statErr)
+	}
+}
+
+// So is a lease file this run created but never got to lock.
+func TestAcquisitionUndoesALeaseFileItCreatedButCouldNotLock(t *testing.T) {
+	root := runtimeRootForAcquisition(t)
+	leasePath := sandboxRuntimeLeasePath(root)
+	failRuntimeCreationAt(t, filepath.Base(leasePath))
+
+	lease, _, err := acquireRuntimeLeaseForPlatform(root)
+	if err == nil {
+		lease.release()
+		t.Fatal("SETUP INVALID: acquisition succeeded, so the injected failure never fired")
+	}
+	if !errors.Is(err, errInjectedRuntimeFailure) {
+		t.Fatalf("acquisition failed for some other reason: %v", err)
+	}
+	if _, statErr := os.Stat(leasePath); !os.IsNotExist(statErr) {
+		t.Errorf("%s was created by this run and left behind after the failure, so its directory can never be compensated (stat: %v)", leasePath, statErr)
+	}
+}
+
+// A LEASE FILE THAT WAS ALREADY THERE IS SOMEBODY ELSE'S.
+//
+// The undo is keyed on this call having created the object, so an acquisition
+// that merely opened an existing lease must not remove it on its way out.
+func TestAcquisitionLeavesALeaseFileItDidNotCreate(t *testing.T) {
+	root := runtimeRootForAcquisition(t)
+	if err := os.MkdirAll(filepath.Dir(root), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	leasePath := sandboxRuntimeLeasePath(root)
+	if err := os.WriteFile(leasePath, nil, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	failRuntimeCreationAt(t, filepath.Base(leasePath))
+
+	lease, _, err := acquireRuntimeLeaseForPlatform(root)
+	if err == nil {
+		lease.release()
+		t.Fatal("SETUP INVALID: acquisition succeeded, so the injected failure never fired")
+	}
+	if _, statErr := os.Stat(leasePath); statErr != nil {
+		t.Errorf("acquisition removed a lease file it did not create: %v", statErr)
+	}
+}
+
+// AND THE LEDGER STILL COVERS WHAT SURVIVES A LATER FAILURE.
+//
+// Undoing the component that failed must not undo the ones before it: those are
+// recorded, and compensation is what removes them.
+func TestAcquisitionKeepsTheLedgerForComponentsItFinished(t *testing.T) {
+	base := t.TempDir()
+	root := filepath.Join(base, "zero", "runtime", "v1", "digest")
+	failRuntimeCreationAt(t, "v1")
+
+	lease, created, err := acquireRuntimeLeaseForPlatform(root)
+	if err == nil {
+		lease.release()
+		t.Fatal("SETUP INVALID: acquisition succeeded, so the injected failure never fired")
+	}
+	var recorded []string
+	for _, entry := range created {
+		recorded = append(recorded, filepath.Base(entry.path))
+	}
+	// "zero" and "runtime" were created and identified before the injected
+	// failure, so they belong to the caller to compensate.
+	if len(recorded) != 2 || recorded[0] != "zero" || recorded[1] != "runtime" {
+		t.Errorf("the completed components are not on the ledger the caller compensates from: %v", recorded)
+	}
+	if _, statErr := os.Stat(filepath.Join(base, "zero", "runtime")); statErr != nil {
+		t.Errorf("a component that was created and recorded was removed anyway: %v", statErr)
+	}
+	if failed := filepath.Join(base, "zero", "runtime", "v1"); !isMissing(failed) {
+		t.Errorf("%s failed after being created and was left behind", failed)
+	}
+	if !strings.Contains(err.Error(), "v1") {
+		t.Errorf("the error does not name the component that failed: %v", err)
+	}
+}
+
+func isMissing(path string) bool {
+	_, err := os.Stat(path)
+	return os.IsNotExist(err)
+}

internal/sandbox/runtime_descend_other.go

@@ -0,0 +1,24 @@
+//go:build !windows
+
+package sandbox
+
+import "golang.org/x/sys/unix"
+
+// createRuntimeTailHandleRelative creates the owned tail through the same
+// no-follow boundary the lease uses.
+//
+// This was an os.Mkdir loop over full pathnames, on the reasoning that the
+// elevated-installer-versus-unelevated-renamer split the Windows descent closes
+// does not apply here. That is true of the elevation asymmetry and false of the
+// substitution: the fallback root is a predictable name under a temp directory
+// every local account can write to, so another user can put a link at an owned
+// component and have this loop create the rest of the tree inside it. Same
+// descent, same refusal, one implementation per platform rather than one
+// protected platform.
+func createRuntimeTailHandleRelative(base string, tail []string) ([]windowsCreatedRuntimeDir, error) {
+	created, parent, err := createRuntimeTailRetainingFD(base, tail)
+	if parent >= 0 {
+		_ = unix.Close(parent)
+	}
+	return created, err
+}

internal/sandbox/runtime_descend_seams.go

@@ -0,0 +1,40 @@
+package sandbox
+
+// The two seams the rooted descent exposes, shared by both platform
+// implementations so a test asserts the same property on either.
+//
+// They live apart from the Windows descent they started in because the POSIX
+// fallback now takes the same shape, and a seam defined next to one of two
+// implementations is how the other one quietly ends up untested.
+
+// runtimeDescentBarrier, when set, runs after the base directory has been opened
+// and before the first owned component is touched. It exists so a test can swap
+// an owned component for a link at exactly the point the old pathname walk was
+// vulnerable, and prove the redirected target is never created or granted. Nil in
+// production.
+var runtimeDescentBarrier func()
+
+// runtimeCreationFailure, when set, is consulted immediately after this run
+// creates a runtime object and before the step that would publish it: a
+// directory component's identity read, or the lease file's inspection, wrapping
+// and locking. Returning an error stands in for that step failing.
+//
+// It is the only way to reach those paths, and they are the ones where the
+// transaction knows it created something that nothing above it knows about yet.
+// The argument is the created component's path, or the lease file's name. Nil in
+// production.
+var runtimeCreationFailure func(string) error
+
+// runtimeCleanupExclusivityBarrier, when set, runs during compensation while the
+// exclusive cleanup lease is held: after it has been taken and before the first
+// thing is removed. It exists so a test can put a contender into that window and
+// prove the exclusion still covers it, which is precisely where the old shape had
+// already handed the lease back. Nil in production.
+var runtimeCleanupExclusivityBarrier func()
+
+// runtimeBaseOpenedByName, when set, receives the ONE path this descent opens by
+// name. The whole security property is which path that is: the fixed cache or
+// temp directory above the owned tail, never a predictable component Zero owns. A
+// test can assert it directly instead of inferring it from whether a swap
+// happened to be caught, which is not discriminating. Nil in production.
+var runtimeBaseOpenedByName func(string)

internal/sandbox/runtime_descend_unix.go

@@ -0,0 +1,171 @@
+//go:build !windows
+
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+	"path/filepath"
+	"strconv"
+
+	"golang.org/x/sys/unix"
+)
+
+// createRuntimeTailRetainingFD creates the owned tail of the runtime root
+// beneath base, one component at a time, from retained descriptors.
+//
+// THE NAME IS NOT AUTHORIZATION, ON THIS SIDE EITHER.
+//
+// The fallback root moved from an atomically minted os.MkdirTemp parent to a
+// predictable /tmp/zero-u<uid>/runtime/v1/<digest>. The stable name is required,
+// because setup and every later process have to agree on one root without
+// talking to each other, but it also means another local account can name the
+// first owned component before this one does. refuseAliasedRuntimeComponents
+// answers about a component that is ABSENT by saying there is nothing to alias,
+// and the code then called os.MkdirAll on the parent and opened <root>.lease by
+// full pathname. Both follow a link planted after that answer, so the guard was
+// authorizing writes it could not see the destination of.
+//
+// So the base is opened by name exactly once, and every component below it is
+// created or opened relative to a retained descriptor with O_NOFOLLOW. A link at
+// an owned component is then an ELOOP or ENOTDIR from the kernel rather than a
+// redirection nobody noticed, and no owned name is ever resolved twice.
+//
+// The base itself is opened WITHOUT O_NOFOLLOW. It belongs to the operator and is
+// legitimately a link on macOS, where /tmp resolves through /private. Only the
+// tail Zero creates is held to the stricter rule.
+func createRuntimeTailRetainingFD(base string, tail []string) ([]windowsCreatedRuntimeDir, int, error) {
+	if runtimeBaseOpenedByName != nil {
+		runtimeBaseOpenedByName(base)
+	}
+	parent, err := unix.Open(base, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return nil, -1, fmt.Errorf("open sandbox runtime base %s: %w", base, err)
+	}
+
+	if runtimeDescentBarrier != nil {
+		runtimeDescentBarrier()
+	}
+
+	var created []windowsCreatedRuntimeDir
+	for _, path := range tail {
+		name := filepath.Base(path)
+		child, madeIt, openErr := openOrCreateRuntimeChildNoFollow(parent, name)
+		if openErr != nil {
+			_ = unix.Close(parent)
+			return created, -1, fmt.Errorf("open sandbox runtime component %s: %w", path, openErr)
+		}
+		// CREATED, AND ABOUT TO BE FORGOTTEN. Both checks below run before the
+		// ledger entry is appended, so failing either used to return a directory
+		// this run had made with nothing above holding a record of it: setup
+		// reported failure and left it behind, and a recorded ancestor's
+		// compensation then failed on a child it could not explain.
+		//
+		// Undone relative to the parent descriptor rather than published to the
+		// ledger, because on the identity path the identity the ledger needs is the
+		// thing that just failed, and the descriptor is the only authority here
+		// that is not a name.
+		undoCreation := func(err error) error {
+			if !madeIt {
+				return err
+			}
+			if undoErr := unix.Unlinkat(parent, name, unix.AT_REMOVEDIR); undoErr != nil {
+				return fmt.Errorf("%w; and the directory this run created there could not be removed: %w", err, undoErr)
+			}
+			return err
+		}
+		if err := refuseForeignRuntimeDirectory(child, path); err != nil {
+			err = undoCreation(err)
+			_ = unix.Close(child)
+			_ = unix.Close(parent)
+			return created, -1, err
+		}
+		if madeIt {
+			identity, idErr := runtimeDirectoryIdentity(child)
+			if idErr == nil && runtimeCreationFailure != nil {
+				idErr = runtimeCreationFailure(path)
+			}
+			if idErr != nil {
+				err := undoCreation(fmt.Errorf("identify the sandbox runtime directory created at %s: %w", path, idErr))
+				_ = unix.Close(child)
+				_ = unix.Close(parent)
+				return created, -1, err
+			}
+			created = append(created, windowsCreatedRuntimeDir{path: path, identity: identity, identified: true})
+		}
+		_ = unix.Close(parent)
+		parent = child
+	}
+	return created, parent, nil
+}
+
+// openOrCreateRuntimeChildNoFollow opens name under parent, creating it if it is
+// not there, and never follows a link at that name.
+//
+// madeIt distinguishes the directory this process created from one that was
+// already there, because only the former belongs on the rollback ledger.
+func openOrCreateRuntimeChildNoFollow(parent int, name string) (fd int, madeIt bool, err error) {
+	const flags = unix.O_RDONLY | unix.O_DIRECTORY | unix.O_NOFOLLOW | unix.O_CLOEXEC
+	child, openErr := unix.Openat(parent, name, flags, 0)
+	if openErr == nil {
+		return child, false, nil
+	}
+	if !errors.Is(openErr, unix.ENOENT) {
+		// ELOOP or ENOTDIR here IS the finding: a link sits where a directory of
+		// ours should be. Returned as-is rather than translated, because the two
+		// platforms spell it differently and the caller only needs it to fail.
+		return -1, false, openErr
+	}
+	if mkErr := unix.Mkdirat(parent, name, 0o700); mkErr != nil {
+		if !errors.Is(mkErr, unix.EEXIST) {
+			return -1, false, mkErr
+		}
+		// Somebody created it between the open and the create. That is an ordinary
+		// race with another Zero process, and the reopen below is still no-follow,
+		// so a link that arrived in the same window is refused rather than used.
+		child, openErr = unix.Openat(parent, name, flags, 0)
+		if openErr != nil {
+			return -1, false, openErr
+		}
+		return child, false, nil
+	}
+	child, openErr = unix.Openat(parent, name, flags, 0)
+	if openErr != nil {
+		return -1, false, openErr
+	}
+	return child, true, nil
+}
+
+// refuseForeignRuntimeDirectory proves the directory reached belongs to this
+// user and is not group- or world-writable.
+//
+// Asked of the DESCRIPTOR, so it describes the object the descent is holding
+// rather than whatever the name resolves to now. Ownership is the part that
+// matters on a shared temp root: a component another account created first is
+// theirs, and continuing into it would put the sandbox runtime inside a tree they
+// control even though nothing about it is a link.
+func refuseForeignRuntimeDirectory(fd int, path string) error {
+	var stat unix.Stat_t
+	if err := unix.Fstat(fd, &stat); err != nil {
+		return fmt.Errorf("inspect sandbox runtime component %s: %w", path, err)
+	}
+	if uid := unix.Getuid(); uid >= 0 && stat.Uid != uint32(uid) {
+		return fmt.Errorf("refusing to use the sandbox runtime component %s: it is owned by uid %d, not %d, so another account chose what the sandbox writes into",
+			path, stat.Uid, uid)
+	}
+	if stat.Mode&(unix.S_IWGRP|unix.S_IWOTH) != 0 {
+		return fmt.Errorf("refusing to use the sandbox runtime component %s: mode %#o lets another account replace what is inside it",
+			path, stat.Mode&0o7777)
+	}
+	return nil
+}
+
+// runtimeDirectoryIdentity names the object behind a descriptor, so rollback can
+// tell the directory it created from one that replaced it under the same name.
+func runtimeDirectoryIdentity(fd int) (string, error) {
+	var stat unix.Stat_t
+	if err := unix.Fstat(fd, &stat); err != nil {
+		return "", err
+	}
+	return strconv.FormatUint(uint64(stat.Dev), 10) + ":" + strconv.FormatUint(uint64(stat.Ino), 10), nil
+}

internal/sandbox/runtime_descend_windows.go

@@ -0,0 +1,124 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+	"path/filepath"
+
+	"golang.org/x/sys/windows"
+)
+
+// createRuntimeTailHandleRelative creates the owned tail of the runtime root
+// beneath base, one component at a time, from retained handles.
+//
+// THE NAME IS NOT AUTHORIZATION. The previous shape found the deepest existing
+// ancestor with os.Stat and then created each missing component by opening its
+// parent BY NAME. Both follow a junction, so a local user could replace the
+// predictable owned "zero" component with a junction after the pre-check,
+// point it anywhere, let elevated setup create runtime\v1\<hash> beneath that
+// target, and put the original back before the post-check. The post-check then
+// saw an ordinary path, the plan applied normally, and rollback reported the
+// separately created target only as identity-mismatched residue.
+//
+// So the base is opened by name exactly once, and everything below it is
+// addressed relative to a handle with FILE_OPEN_REPARSE_POINT: an existing
+// component is opened no-follow and refused if it is a link, and a missing one
+// is created relative to its parent's handle and identified from the handle the
+// create returned. No component name is resolved twice, so there is no interval
+// for a swap to land in, and a junction placed at any owned component is seen
+// as the link it is rather than followed.
+//
+// Redirected cache and TEMP locations ABOVE the owned tail are still allowed:
+// they are part of base, which is the operator's business. The restriction is
+// on the zero/runtime/v1/<hash> components Zero itself owns.
+func createRuntimeTailHandleRelative(base string, tail []string) ([]windowsCreatedRuntimeDir, error) {
+	created, parent, err := createRuntimeTailRetainingHandle(base, tail)
+	if parent != 0 {
+		_ = windows.CloseHandle(parent)
+	}
+	return created, err
+}
+
+// createRuntimeTailRetainingHandle is the same descent, but it hands the caller
+// the retained handle to the deepest component instead of closing it.
+//
+// Lease acquisition needs that handle: the lease file is a sibling of the
+// runtime root, so creating it by pathname would re-resolve the owned components
+// the descent just verified, which is the whole interval this design removes.
+// The caller owns the returned handle and must close it, including when an error
+// is returned alongside a non-zero handle.
+func createRuntimeTailRetainingHandle(base string, tail []string) ([]windowsCreatedRuntimeDir, windows.Handle, error) {
+	if runtimeBaseOpenedByName != nil {
+		runtimeBaseOpenedByName(base)
+	}
+	parent, err := openWindowsDirectoryByName(base)
+	if err != nil {
+		return nil, 0, fmt.Errorf("open sandbox runtime base %s: %w", base, err)
+	}
+
+	if runtimeDescentBarrier != nil {
+		runtimeDescentBarrier()
+	}
+
+	var created []windowsCreatedRuntimeDir
+	for _, path := range tail {
+		name := filepath.Base(path)
+		// Exists already: another process won the race, or it was there before
+		// setup began. Opened no-follow, so a junction here is refused rather than
+		// descended, and it is not ours to record.
+		existing, openErr := openWindowsChildNoFollow(parent, name,
+			windows.FILE_READ_ATTRIBUTES|windows.FILE_TRAVERSE, windows.FILE_DIRECTORY_FILE)
+		if openErr == nil {
+			_ = windows.CloseHandle(parent)
+			parent = existing
+			continue
+		}
+		if !isWindowsNotFound(openErr) {
+			return created, parent, fmt.Errorf("inspect sandbox runtime component %s: %w", path, openErr)
+		}
+		handle, createErr := createWindowsChildDirectory(parent, name)
+		if createErr != nil {
+			if errors.Is(createErr, windows.STATUS_OBJECT_NAME_COLLISION) {
+				// Created between the open and the create by someone else. Same
+				// answer as the os.IsExist branch the caller already had: not ours,
+				// but not a failure either. Reopen no-follow so the descent
+				// continues through a verified object rather than a name.
+				existing, reopenErr := openWindowsChildNoFollow(parent, name,
+					windows.FILE_READ_ATTRIBUTES|windows.FILE_TRAVERSE, windows.FILE_DIRECTORY_FILE)
+				if reopenErr != nil {
+					return created, parent, fmt.Errorf("inspect sandbox runtime component %s after a concurrent create: %w", path, reopenErr)
+				}
+				_ = windows.CloseHandle(parent)
+				parent = existing
+				continue
+			}
+			return created, parent, fmt.Errorf("create sandbox runtime root %s: %w", path, createErr)
+		}
+		identity, idErr := handleRuntimeIdentity(handle)
+		if idErr == nil && runtimeCreationFailure != nil {
+			idErr = runtimeCreationFailure(path)
+		}
+		if idErr != nil {
+			// CREATED, AND ABOUT TO BE FORGOTTEN. The ledger entry is appended on
+			// the next line, so returning here left a directory this run had made
+			// with nothing above holding a record of it: setup reports failure and
+			// leaves it behind, and if an ancestor WAS recorded, that ancestor's
+			// compensation then fails on a directory it cannot explain.
+			//
+			// Undone through the handle rather than published to the ledger,
+			// because the identity the ledger needs is the thing that just failed.
+			err := fmt.Errorf("identify the sandbox runtime directory created at %s: %w", path, idErr)
+			if undoErr := removeWindowsObjectByHandle(handle); undoErr != nil {
+				err = fmt.Errorf("%w; and the directory this run created there could not be removed: %w", err, undoErr)
+			}
+			_ = windows.CloseHandle(handle)
+			return created, parent, err
+		}
+		created = append(created, windowsCreatedRuntimeDir{path: path, identity: identity, identified: true})
+		_ = windows.CloseHandle(parent)
+		parent = handle
+	}
+	return created, parent, nil
+}

internal/sandbox/runtime_descent_swap_windows_test.go

@@ -0,0 +1,93 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+)
+
+// THE SWAP THE OLD WALK COULD NOT SEE.
+//
+// createRuntimeDirRecording used to find the deepest existing ancestor with
+// os.Stat and then create each missing component by opening its parent BY
+// NAME. Both follow a junction. So between the pre-check and the create, a
+// local user could replace the predictable owned "zero" component with a
+// junction into a directory of their choosing, and elevated setup would create
+// runtime\v1\<hash> beneath that target, apply its ACL plan there, and then
+// find an ordinary path at the post-check once the original was put back.
+//
+// This plants the junction at the deterministic barrier between opening the
+// base and touching the first owned component, which is that exact interval,
+// and proves two things: nothing is created beneath the redirected target, and
+// the descent refuses rather than continuing through the link. A junction
+// needs no privilege on Windows, which is why it is the shape used here rather
+// than a symlink that would skip on an unelevated box.
+func TestRuntimeDescentRefusesAJunctionSwappedIntoAnOwnedComponent(t *testing.T) {
+	base := t.TempDir()
+	target := t.TempDir()
+
+	zero := filepath.Join(base, "zero")
+	tail := []string{zero, filepath.Join(zero, "runtime")}
+
+	previous := runtimeDescentBarrier
+	runtimeDescentBarrier = func() {
+		out, err := exec.Command("cmd", "/c", "mklink", "/J", zero, target).CombinedOutput()
+		if err != nil {
+			t.Fatalf("mklink /J: %v\n%s", err, out)
+		}
+	}
+	t.Cleanup(func() { runtimeDescentBarrier = previous })
+
+	created, err := createRuntimeTailHandleRelative(base, tail)
+	if err == nil {
+		t.Fatalf("the descent continued through a junction and reported success: created=%v", created)
+	}
+	if len(created) != 0 {
+		t.Errorf("a junction-swapped component still produced ownership records: %v", created)
+	}
+
+	// The whole point: the redirected target must be untouched.
+	entries, readErr := os.ReadDir(target)
+	if readErr != nil {
+		t.Fatal(readErr)
+	}
+	if len(entries) != 0 {
+		names := make([]string, 0, len(entries))
+		for _, entry := range entries {
+			names = append(names, entry.Name())
+		}
+		t.Errorf("setup created %v beneath the junction target, which is somebody else's directory", names)
+	}
+}
+
+// And the honest control: with no swap, the same descent creates the tail,
+// records an identity for each component from the creation handle, and the
+// result matches what the name resolves to afterwards.
+func TestRuntimeDescentCreatesTheOwnedTailFromHandles(t *testing.T) {
+	base := t.TempDir()
+	zero := filepath.Join(base, "zero")
+	tail := []string{zero, filepath.Join(zero, "runtime"), filepath.Join(zero, "runtime", "v1")}
+
+	created, err := createRuntimeTailHandleRelative(base, tail)
+	if err != nil {
+		t.Fatalf("descent: %v", err)
+	}
+	if len(created) != len(tail) {
+		t.Fatalf("created %d components, want %d: %v", len(created), len(tail), created)
+	}
+	for i, record := range created {
+		if record.path != tail[i] {
+			t.Errorf("record %d path = %q, want %q", i, record.path, tail[i])
+		}
+		if !record.identified {
+			t.Errorf("record %d for %s carries no identity", i, record.path)
+			continue
+		}
+		if now, ok := runtimeDirIdentity(record.path); !ok || now != record.identity {
+			t.Errorf("record %d identity %q does not describe the directory at %s (%q)", i, record.identity, record.path, now)
+		}
+	}
+}

internal/sandbox/runtime_dir_identity_other.go

@@ -0,0 +1,27 @@
+//go:build !windows
+
+package sandbox
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+)
+
+// runtimeDirIdentity identifies the directory currently at path.
+//
+// device plus inode, read with Lstat so a link substituted at the final
+// component is identified as the link rather than followed. The Windows build
+// cannot use os.SameFile for this and explains why; here the same eager capture
+// keeps both platforms on one rule.
+func runtimeDirIdentity(path string) (string, bool) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return "", false
+	}
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return "", false
+	}
+	return fmt.Sprintf("%d:%d", stat.Dev, stat.Ino), true
+}

internal/sandbox/runtime_dir_identity_windows.go

@@ -0,0 +1,45 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"fmt"
+
+	"golang.org/x/sys/windows"
+)
+
+// runtimeDirIdentity identifies the directory currently at path, EAGERLY.
+//
+// os.SameFile cannot be used for this on Windows. A Windows fileStat loads its
+// volume serial and file index lazily, by PATHNAME, at comparison time, so an
+// identity captured before a replacement and compared afterwards reports the
+// substitute as the same object and the original as a different one: exactly
+// backwards, and silently. Measured, not reasoned about.
+//
+// Reading the identity through a handle at capture time removes the lazy step.
+// Opened with FILE_FLAG_OPEN_REPARSE_POINT so a link substituted at the final
+// component is identified as the link it is rather than followed.
+func runtimeDirIdentity(path string) (string, bool) {
+	utf16Path, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		return "", false
+	}
+	handle, err := windows.CreateFile(
+		utf16Path,
+		windows.FILE_READ_ATTRIBUTES,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+		nil,
+		windows.OPEN_EXISTING,
+		windows.FILE_FLAG_BACKUP_SEMANTICS|windows.FILE_FLAG_OPEN_REPARSE_POINT,
+		0,
+	)
+	if err != nil {
+		return "", false
+	}
+	defer windows.CloseHandle(handle)
+	var info windows.ByHandleFileInformation
+	if err := windows.GetFileInformationByHandle(handle, &info); err != nil {
+		return "", false
+	}
+	return fmt.Sprintf("%d:%d:%d", info.VolumeSerialNumber, info.FileIndexHigh, info.FileIndexLow), true
+}

internal/sandbox/runtime_fallback_scope_windows_test.go

@@ -0,0 +1,44 @@
+//go:build windows
+
+package sandbox
+
+import "testing"
+
+// THE COMMAND HAS TO RECOGNISE THE ROOT SETUP RECORDED, WHATEVER ITS
+// ENVIRONMENT SAYS.
+//
+// Setup derives the fallback root in an elevated terminal and records it; a
+// command re-derives it in an ordinary one to decide whether the record belongs
+// to this workspace. The user scope in that derivation used to come from
+// USERNAME, so a value that differed between the two terminals made the command
+// reject the record and select a root with no capability ACE on it.
+func TestRecordedFallbackRootSurvivesADifferentUsernameVariable(t *testing.T) {
+	// Canonical, as selection hands it over. The record check canonicalizes on
+	// its own, so a raw t.TempDir() spelling digests differently wherever TEMP is
+	// an 8.3 short path, as it is on the CI runners.
+	workspace := canonicalSandboxWorkspaceRoot(t.TempDir())
+	tempHome := t.TempDir()
+	t.Setenv("TMP", tempHome)
+	t.Setenv("TEMP", tempHome)
+
+	t.Setenv("USERNAME", "setup-terminal")
+	recorded, err := fallbackSandboxRuntimeRoot(workspace)
+	if err != nil {
+		t.Fatalf("derive the fallback root as setup: %v", err)
+	}
+	if !ownedFallbackRuntimeRecord(workspace, recorded) {
+		t.Fatalf("SETUP INVALID: the fallback root is not recognised even in the environment that derived it: %s", recorded)
+	}
+
+	t.Setenv("USERNAME", "command-terminal")
+	if !ownedFallbackRuntimeRecord(workspace, recorded) {
+		t.Fatalf("once USERNAME changed, the command no longer recognises the fallback root setup recorded: %s", recorded)
+	}
+	derived, err := fallbackSandboxRuntimeRoot(workspace)
+	if err != nil {
+		t.Fatalf("derive the fallback root as the command: %v", err)
+	}
+	if !sameWindowsRuntimeRootPath(derived, recorded) {
+		t.Fatalf("setup and the command derived different fallback roots for one workspace:\n  setup:   %s\n  command: %s", recorded, derived)
+	}
+}

internal/sandbox/runtime_fallback_user_scope_test.go

@@ -0,0 +1,106 @@
+package sandbox
+
+import (
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// EVERY OWNERSHIP-CHECKED ANCESTOR MUST ALREADY BE INSIDE ONE USER'S NAMESPACE.
+//
+// The temp-derived fallback lives under a directory that is shared on Unix
+// whenever TMPDIR is unset. Runtime preparation creates and ownership-checks
+// each component of the tail at 0700, so a fixed first component meant the
+// first account to use the fallback created a private directory every other
+// account was then refused at: traversal fails on the mode, and relaxing the
+// mode fails the ownership guard instead. The per-workspace digest is the leaf,
+// so it never got the chance to separate them.
+//
+// The invariant is therefore about the SHALLOWEST checked component, not the
+// leaf: it has to carry the user scope, or the guards below it are guarding a
+// namespace two users share.
+func TestFallbackRuntimeRootScopesItsShallowestOwnedComponent(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("os.TempDir() resolves inside the user profile on Windows, so the shared-temp collision cannot arise")
+	}
+	workspace := t.TempDir()
+	tempHome := t.TempDir()
+	t.Setenv("TMPDIR", tempHome)
+
+	root, err := fallbackSandboxRuntimeRoot(workspace)
+	if err != nil {
+		t.Fatalf("fallbackSandboxRuntimeRoot: %v", err)
+	}
+	components := ownedRuntimeComponents(root)
+	if len(components) == 0 {
+		t.Fatal("no ownership-checked components derived for the fallback root")
+	}
+	// ownedRuntimeComponents walks upward, so the last entry is the shallowest
+	// directory the guards create and validate.
+	shallowest := filepath.Base(components[len(components)-1])
+	scope := sandboxRuntimeUserScope()
+	if !strings.Contains(shallowest, scope) {
+		t.Errorf("the shallowest ownership-checked component is %q and does not carry the user scope %q; "+
+			"two accounts on a shared temp would contend for it", shallowest, scope)
+	}
+}
+
+// The workspace still decides the leaf, so setup and the command derive the same
+// root for the same workspace. Scoping the top must not have moved that.
+func TestFallbackRuntimeRootStaysStableForOneWorkspace(t *testing.T) {
+	workspace := t.TempDir()
+	tempHome := t.TempDir()
+	t.Setenv("TMPDIR", tempHome)
+	t.Setenv("TMP", tempHome)
+	t.Setenv("TEMP", tempHome)
+
+	first, err := fallbackSandboxRuntimeRoot(workspace)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := fallbackSandboxRuntimeRoot(workspace)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first != second {
+		t.Errorf("the fallback root is not stable for one workspace:\n  %s\n  %s", first, second)
+	}
+
+	other, err := fallbackSandboxRuntimeRoot(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if other == first {
+		t.Error("two different workspaces derived the same fallback root")
+	}
+	if filepath.Dir(other) != filepath.Dir(first) {
+		t.Errorf("two workspaces for one user should differ only in the leaf:\n  %s\n  %s", first, other)
+	}
+}
+
+// And the Windows side is a deliberate choice, not an omission. Its temp root
+// is already inside the user profile, and the names have to stay fixed so
+// windowsSandboxRuntimeOwnedTail can still recognise a root that an elevated
+// setup running as a different account built.
+func TestFallbackOwnedNamesAreUnscopedOnWindowsOnly(t *testing.T) {
+	names := sandboxRuntimeFallbackOwnedNames()
+	if len(names) != len(windowsSandboxRuntimeOwnedNames) {
+		t.Fatalf("fallback names = %v, want the same depth as %v", names, windowsSandboxRuntimeOwnedNames)
+	}
+	// The components below the first are shared by both platforms, so a change
+	// to them would break the tail matcher on Windows.
+	for index := 1; index < len(names); index++ {
+		if names[index] != windowsSandboxRuntimeOwnedNames[index] {
+			t.Errorf("component %d = %q, want %q", index, names[index], windowsSandboxRuntimeOwnedNames[index])
+		}
+	}
+	scoped := names[0] != windowsSandboxRuntimeOwnedNames[0]
+	if runtime.GOOS == "windows" && scoped {
+		t.Errorf("the Windows fallback scoped its first component to %q; the tail matcher compares fixed names", names[0])
+	}
+	if runtime.GOOS != "windows" && !scoped {
+		t.Errorf("the first component is %q on %s, where the temp root can be shared between accounts",
+			names[0], runtime.GOOS)
+	}
+}

internal/sandbox/runtime_home_authority_test.go

@@ -0,0 +1,74 @@
+package sandbox
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// writeRecordedRoot puts a setup marker naming root under sandboxHome.
+func writeRecordedRoot(t *testing.T, sandboxHome, root string) {
+	t.Helper()
+	path := WindowsSandboxSetupMarkerPath(sandboxHome)
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	blob, err := json.Marshal(WindowsSandboxSetupMarker{SchemaVersion: windowsSandboxSetupMarkerSchemaVersion, RuntimeRoot: root})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, blob, 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// ONE COMMAND, ONE SANDBOX HOME.
+//
+// Runtime preparation happens before Windows platform planning, and it used to
+// resolve the sandbox home from the AMBIENT environment while the planner
+// resolves ZERO_WINDOWS_SANDBOX_HOME out of the command's own spec.Env and hands
+// that one to the runner for marker validation. So a command that explicitly
+// selects home B, while the parent process still points at home A, pinned A's
+// recorded root into the profile; the runner then loaded B's marker, saw a
+// different root, and rejected the command as out of date even though setup for
+// B was valid. The two homes need no different derivation rules to disagree,
+// only different valid selections from the same preferred/fallback pair.
+func TestThePinnedRootComesFromTheCommandsOwnSandboxHome(t *testing.T) {
+	homeA := t.TempDir()
+	homeB := t.TempDir()
+	preferred := filepath.Join(t.TempDir(), "preferred")
+	fallback := filepath.Join(t.TempDir(), "fallback")
+
+	writeRecordedRoot(t, homeA, preferred)
+	writeRecordedRoot(t, homeB, fallback)
+
+	if got := pinnedSandboxRuntimeRoot(t.TempDir(), preferred, fallback, homeB); got != fallback {
+		t.Errorf("pinned %q for a command that selected home B, want %q: the ambient home decided instead of the command's", got, fallback)
+	}
+	if got := pinnedSandboxRuntimeRoot(t.TempDir(), preferred, fallback, homeA); got != preferred {
+		t.Errorf("pinned %q for home A, want %q", got, preferred)
+	}
+}
+
+// A recorded root that this workspace could not select is still refused, which
+// is the protection that stops one workspace's tree being pinned into another.
+func TestARecordedRootFromAnotherWorkspaceIsStillRefused(t *testing.T) {
+	home := t.TempDir()
+	writeRecordedRoot(t, home, filepath.Join(t.TempDir(), "someone-elses-tree"))
+	if got := pinnedSandboxRuntimeRoot(t.TempDir(), filepath.Join(t.TempDir(), "preferred"), filepath.Join(t.TempDir(), "fallback"), home); got != "" {
+		t.Errorf("pinned %q, want none: it matches neither candidate this workspace derives", got)
+	}
+}
+
+// No command context means the ambient environment is the only authority there
+// is, so an empty home must still resolve rather than refusing outright.
+func TestAnEmptyCommandHomeFallsBackToTheAmbientEnvironment(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("ZERO_WINDOWS_SANDBOX_HOME", home)
+	preferred := filepath.Join(t.TempDir(), "preferred")
+	writeRecordedRoot(t, home, preferred)
+	if got := pinnedSandboxRuntimeRoot(t.TempDir(), preferred, filepath.Join(t.TempDir(), "fallback"), ""); got != preferred {
+		t.Errorf("pinned %q with no command home, want the ambient one to decide (%q)", got, preferred)
+	}
+}

internal/sandbox/runtime_lease.go

@@ -1,31 +1,88 @@
 package sandbox
 
 import (
-	"fmt"
+	"errors"
 	"sync"
 )
 
 const sandboxRuntimeLeaseSuffix = ".lease"
 
+// errRuntimeLeaseReplaced says a lock was taken on a lease object that the lease
+// name no longer resolves to: cleanup unlinked or replaced it while this call was
+// waiting. Both acquisitions retry from their open on it, and surface it only
+// once the retries are spent.
+var errRuntimeLeaseReplaced = errors.New("the sandbox runtime lease was removed or replaced while it was being taken")
+
+// runtimeLeaseAcquireAttempts bounds those retries. Each stale lock means one
+// cleanup ran to completion in the window, and cleanups do not chain without
+// limit; a third stale object in a row is reported rather than chased.
+const runtimeLeaseAcquireAttempts = 3
+
+// sandboxRuntimeLease is one holder's grip on a runtime root.
+//
+// createdFile says this acquisition is the one that brought the lease file into
+// existence. Compensation needs it: rollback refuses a non-empty directory, and
+// the lease sits beside the leaf inside a directory a failed setup has to be able
+// to remove, so the file has to go with it. It may only go if it was ours, which
+// is a fact only the create knows.
 type sandboxRuntimeLease struct {
 	handle runtimeLeaseHandle
 	once   sync.Once
+	// root is the runtime root this lease is for, kept so compensation can name
+	// the lease file without deriving it again.
+	root string
+	// createdFile says THIS acquisition brought the lease file into existence.
+	createdFile bool
+}
+
+// createdLeaseFile reports whether compensation may remove the lease file.
+//
+// Only the acquisition that created it may, and only while nothing else holds
+// it. A lease that was already there belongs to whoever made it, and removing it
+// would take the coordination object out from under a live command.
+func (lease *sandboxRuntimeLease) createdLeaseFile() (string, bool) {
+	if lease == nil || !lease.createdFile {
+		return "", false
+	}
+	return sandboxRuntimeLeasePath(lease.root), true
 }
 
 func sandboxRuntimeLeasePath(root string) string {
 	return root + sandboxRuntimeLeaseSuffix
 }
 
-func acquireSandboxRuntimeLease(root string) (*sandboxRuntimeLease, error) {
-	handle, err := acquireSharedRuntimeLease(sandboxRuntimeLeasePath(root))
-	if err != nil {
-		return nil, fmt.Errorf("acquire sandbox runtime lease: %w", err)
+// The pathname-based shared acquisition that used to live here is gone with its
+// two platform halves. It opened the lease by full pathname, so it followed a
+// link planted at that name and, on Windows, opened without FILE_SHARE_DELETE,
+// which alone stops cleanup from ever removing the lease it is holding. Every
+// caller now goes through acquireRuntimeLeaseForPlatform, which descends from a
+// retained parent handle no-follow. Leaving the weaker door defined next to the
+// stronger one is how a later change quietly takes it.
+
+// appendCreatedRuntimeDirs merges one acquisition attempt's ledger into the
+// running one. A path seen again was re-created after cleanup removed the
+// earlier object, so the later identity supersedes; rollback verifies identity
+// before it removes anything, and a stale one would make it refuse the directory
+// this run actually made.
+func appendCreatedRuntimeDirs(existing, made []windowsCreatedRuntimeDir) []windowsCreatedRuntimeDir {
+	for _, record := range made {
+		replaced := false
+		for index := range existing {
+			if existing[index].path == record.path {
+				existing[index] = record
+				replaced = true
+				break
+			}
+		}
+		if !replaced {
+			existing = append(existing, record)
+		}
 	}
-	return &sandboxRuntimeLease{handle: handle}, nil
+	return existing
 }
 
 func tryAcquireSandboxRuntimeCleanupLease(root string) (*sandboxRuntimeLease, bool, error) {
-	handle, inUse, err := tryAcquireExclusiveRuntimeLease(sandboxRuntimeLeasePath(root))
+	handle, inUse, err := tryAcquireExclusiveRuntimeLease(root)
 	if err != nil || inUse {
 		return nil, inUse, err
 	}

internal/sandbox/runtime_lease_barrier.go

@@ -0,0 +1,15 @@
+package sandbox
+
+// runtimeLeasePreCreateBarrier, when set, runs after lease acquisition has
+// decided what it is going to do and before it creates anything.
+//
+// It exists so a test can reproduce the CHECK-THEN-USE RACE rather than a
+// junction that was already there when acquisition started. The two are not the
+// same finding: a junction present from the outset was already refused by the
+// alias pre-check, while one planted in this window defeated it, because
+// os.MkdirAll and the lease open both resolved the component again and followed
+// it. A test that only plants the junction up front passes against the defective
+// implementation and proves nothing.
+//
+// Nil in production.
+var runtimeLeasePreCreateBarrier func()

internal/sandbox/runtime_lease_junction_windows_test.go

@@ -0,0 +1,150 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// leaseRootUnder builds a production-shaped runtime root beneath a test-owned
+// cache directory, so the owned tail is real rather than assumed.
+func leaseRootUnder(t *testing.T, cacheRoot string) string {
+	t.Helper()
+	workspace := t.TempDir()
+	root, ok := deterministicSandboxRuntimeRoot(canonicalSandboxWorkspaceRoot(workspace), canonicalSandboxWorkspaceRoot(cacheRoot))
+	if !ok {
+		t.Fatalf("SETUP INVALID: no deterministic runtime root under %s", cacheRoot)
+	}
+	return root
+}
+
+// THE LEASE IS THE FIRST WRITE SETUP MAKES, SO IT IS THE ONE THAT MATTERS MOST.
+//
+// prepareSandboxRuntimeLease checked the owned components for aliases and then
+// created the parent with os.MkdirAll and opened "<root>.lease" by pathname.
+// Both follow. An ordinary same-account process could replace "zero", "runtime"
+// or "v1" with a junction after the check and before either call, and elevated
+// setup would then build the tree and the lease file inside somebody else's
+// target. Putting the component back afterwards left the later handle-relative
+// provisioning working on the legitimate tree, so no post-check ever saw it, and
+// the rollback could not compensate what it had no record of.
+//
+// A junction needs no privilege on Windows, so the caller's half of this runs on
+// an ordinary unelevated box.
+func TestRuntimeLeaseRefusesAJunctionPlantedAfterTheCheck(t *testing.T) {
+	cacheRoot := t.TempDir()
+	target := t.TempDir()
+	root := leaseRootUnder(t, cacheRoot)
+
+	owned := filepath.Join(canonicalSandboxWorkspaceRoot(cacheRoot), "zero")
+	if !strings.HasPrefix(strings.ToLower(root), strings.ToLower(owned)) {
+		t.Fatalf("SETUP INVALID: %s does not sit under the owned component %s", root, owned)
+	}
+
+	// THE JUNCTION ARRIVES IN THE WINDOW, WHICH IS THE WHOLE POINT.
+	//
+	// One that is already there when acquisition starts was refused by the old
+	// alias pre-check too, so a test that plants it up front passes against the
+	// defective implementation and proves nothing. This one lands after the
+	// decision and before the first create, which is exactly where os.MkdirAll and
+	// the pathname lease open used to follow it.
+	previous := runtimeLeasePreCreateBarrier
+	t.Cleanup(func() { runtimeLeasePreCreateBarrier = previous })
+	attempted, planted := false, false
+	runtimeLeasePreCreateBarrier = func() {
+		if attempted {
+			return
+		}
+		attempted = true
+		if out, err := exec.Command("cmd", "/c", "mklink", "/J", owned, target).CombinedOutput(); err != nil {
+			t.Logf("mklink /J unavailable: %v: %s", err, out)
+			return
+		}
+		planted = true
+	}
+
+	lease, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if lease != nil {
+		lease.release()
+	}
+	if !attempted {
+		t.Skip("the pre-create barrier never ran, so the race was not reproduced")
+	}
+	// Bound to mklink's result, not to the attempt. When it fails, acquisition
+	// goes on to create an ordinary directory at the same name, the check below
+	// finds it, and a correct acquisition would be failed as a junction bypass.
+	if !planted {
+		t.Skip("mklink /J could not create the junction here, so the race was not reproduced")
+	}
+	if _, statErr := os.Lstat(owned); statErr != nil {
+		t.Skipf("the junction could not be created here: %v", statErr)
+	}
+
+	entries, readErr := os.ReadDir(target)
+	if readErr != nil {
+		t.Fatal(readErr)
+	}
+	if len(entries) != 0 {
+		names := make([]string, 0, len(entries))
+		for _, entry := range entries {
+			names = append(names, entry.Name())
+		}
+		t.Fatalf("lease acquisition wrote %v beneath a junction planted after its own check; err=%v", names, err)
+	}
+	if err == nil {
+		t.Fatal("lease acquisition reported success through a junction planted after its check")
+	}
+}
+
+// And an ordinary cache tree still gets its lease, or the refusal above would be
+// satisfied by an acquirer that refuses everything.
+func TestRuntimeLeaseStillAcquiresOnAnOrdinaryTree(t *testing.T) {
+	cacheRoot := t.TempDir()
+	root := leaseRootUnder(t, cacheRoot)
+
+	lease, created, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Fatalf("an ordinary cache tree was refused: %v", err)
+	}
+	defer lease.release()
+
+	if _, statErr := os.Stat(sandboxRuntimeLeasePath(root)); statErr != nil {
+		t.Fatalf("the lease file was not created: %v", statErr)
+	}
+	// The components above the leaf are recorded, so a later failure can undo
+	// them. The leaf itself belongs to provisioning and must NOT appear here.
+	for _, entry := range created {
+		if strings.EqualFold(filepath.Clean(entry.path), filepath.Clean(root)) {
+			t.Fatalf("lease acquisition claimed the runtime leaf %s, which provisioning owns", root)
+		}
+	}
+	if len(created) == 0 {
+		t.Fatal("SETUP INVALID: nothing was recorded as created, so the accounting assertion above is vacuous")
+	}
+}
+
+// A second acquisition over an existing tree records nothing: it created nothing,
+// so it owns nothing, and rollback must not remove a tree it found.
+func TestRuntimeLeaseRecordsOnlyWhatItCreated(t *testing.T) {
+	cacheRoot := t.TempDir()
+	root := leaseRootUnder(t, cacheRoot)
+
+	first, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Fatalf("first acquisition: %v", err)
+	}
+	first.release()
+
+	second, created, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Fatalf("second acquisition: %v", err)
+	}
+	defer second.release()
+	if len(created) != 0 {
+		t.Fatalf("the second acquisition claimed %d directories it did not create; rollback would delete a tree it found", len(created))
+	}
+}

internal/sandbox/runtime_lease_link_unix_test.go

@@ -0,0 +1,216 @@
+//go:build !windows
+
+package sandbox
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"golang.org/x/sys/unix"
+)
+
+// unixLeaseRootUnder builds a production-shaped runtime root beneath a
+// test-owned base, so the owned tail is real rather than assumed.
+func unixLeaseRootUnder(t *testing.T, base string) string {
+	t.Helper()
+	workspace := t.TempDir()
+	root, ok := deterministicSandboxRuntimeRoot(canonicalSandboxWorkspaceRoot(workspace), canonicalSandboxWorkspaceRoot(base))
+	if !ok {
+		t.Fatalf("SETUP INVALID: no deterministic runtime root under %s", base)
+	}
+	return root
+}
+
+// countEntriesUnder reports how many entries exist anywhere beneath dir, so a
+// test can say "nothing was written here" rather than checking one name.
+func countEntriesUnder(t *testing.T, dir string) []string {
+	t.Helper()
+	var found []string
+	err := filepath.Walk(dir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		if path == dir {
+			return nil
+		}
+		found = append(found, path)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("walk %s: %v", dir, err)
+	}
+	return found
+}
+
+// A PRE-CHECK CANNOT AUTHORIZE A PATHNAME WRITE THAT COMES AFTER IT.
+//
+// The fallback root moved from an atomically minted MkdirTemp parent to a
+// predictable /tmp/zero-u<uid>/runtime/v1/<digest>. The stable name is required,
+// because setup and every later process have to agree on one root without talking
+// to each other, but it also means another local account can name the first owned
+// component first. refuseAliasedRuntimeComponents answers about an ABSENT
+// component by saying there is nothing to alias, which is the state a fresh
+// fallback is in, and os.MkdirAll plus the pathname lease open then followed a
+// link planted after that answer.
+//
+// The link arrives after the last validation and before the first create, which
+// is the only window that matters: one planted earlier was refused by the old
+// pre-check too, so a test that plants it up front passes against the defect and
+// proves nothing.
+func TestRuntimeLeaseRefusesALinkPlantedAfterTheCheck(t *testing.T) {
+	base := t.TempDir()
+	target := t.TempDir()
+	root := unixLeaseRootUnder(t, base)
+
+	owned := filepath.Join(canonicalSandboxWorkspaceRoot(base), "zero")
+	if !pathWithinRoot(owned, root) {
+		t.Fatalf("SETUP INVALID: %s does not sit under the owned component %s", root, owned)
+	}
+
+	previous := runtimeDescentBarrier
+	t.Cleanup(func() { runtimeDescentBarrier = previous })
+	planted := false
+	runtimeDescentBarrier = func() {
+		if planted {
+			return
+		}
+		planted = true
+		if err := os.Symlink(target, owned); err != nil {
+			t.Errorf("plant the link: %v", err)
+		}
+	}
+
+	lease, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if lease != nil {
+		lease.release()
+	}
+
+	// SETUP: the swap really happened in the window, or nothing was under test.
+	if !planted {
+		t.Fatal("SETUP INVALID: the descent never reached the barrier, so no link was planted")
+	}
+	if err == nil {
+		t.Fatal("lease acquisition succeeded through a link planted at the first owned component")
+	}
+	// ELOOP on Linux, and either that or ENOTDIR elsewhere. Asserted as a class
+	// rather than one kernel's spelling.
+	if !errors.Is(err, unix.ELOOP) && !errors.Is(err, unix.ENOTDIR) {
+		t.Errorf("refused for the wrong reason, want a no-follow refusal: %v", err)
+	}
+
+	// THE POINT IS WHERE THE WRITES DID NOT GO. An error alone would also be
+	// produced by a later guard noticing the link after the tree was built inside
+	// somebody else's directory.
+	if leaked := countEntriesUnder(t, target); len(leaked) != 0 {
+		t.Fatalf("the redirected target received %v; the refusal happened after the writes rather than instead of them", leaked)
+	}
+}
+
+// CONTROL: an ordinary tree still gets its lease, and the one path opened by name
+// is the operator's base rather than a component Zero owns.
+//
+// Refusing everything would satisfy the test above. Asserting the base directly
+// is what makes this discriminating: inferring it from whether a swap was caught
+// says nothing about which name was trusted.
+func TestRuntimeLeaseOpensOnlyTheBaseByName(t *testing.T) {
+	base := t.TempDir()
+	root := unixLeaseRootUnder(t, base)
+
+	previousBase := runtimeBaseOpenedByName
+	t.Cleanup(func() { runtimeBaseOpenedByName = previousBase })
+	var byName []string
+	runtimeBaseOpenedByName = func(path string) { byName = append(byName, path) }
+
+	lease, created, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Fatalf("lease acquisition failed on an ordinary tree: %v", err)
+	}
+	lease.release()
+
+	if len(byName) != 1 {
+		t.Fatalf("opened %v by name, want exactly the base", byName)
+	}
+	if got := byName[0]; got != canonicalSandboxWorkspaceRoot(base) && got != base {
+		t.Fatalf("opened %q by name, want the base %q", got, base)
+	}
+	if len(created) == 0 {
+		t.Fatal("the descent created the owned components but recorded none of them, so rollback has nothing to undo")
+	}
+	if _, err := os.Lstat(sandboxRuntimeLeasePath(root)); err != nil {
+		t.Fatalf("no lease file was created on an ordinary tree: %v", err)
+	}
+}
+
+// And a link at the LEASE NAME itself is refused by both holders, so the shared
+// and exclusive sides cannot end up locking different objects.
+func TestRuntimeLeaseRefusesALinkAtTheLeaseName(t *testing.T) {
+	base := t.TempDir()
+	root := unixLeaseRootUnder(t, base)
+
+	lease, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Fatalf("SETUP: cannot seed a lease: %v", err)
+	}
+	lease.release()
+	leasePath := sandboxRuntimeLeasePath(root)
+	if err := os.Remove(leasePath); err != nil {
+		t.Fatalf("SETUP INVALID: cannot clear the seeded lease: %v", err)
+	}
+	target := filepath.Join(t.TempDir(), "target.lease")
+	if err := os.WriteFile(target, nil, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(target, leasePath); err != nil {
+		t.Fatalf("SETUP: cannot plant the link: %v", err)
+	}
+
+	shared, _, sharedErr := prepareSandboxRuntimeLeaseRecording(root)
+	if shared != nil {
+		shared.release()
+	}
+	if sharedErr == nil {
+		t.Error("shared acquisition accepted a link at the lease name")
+	}
+
+	cleanup, inUse, cleanupErr := tryAcquireSandboxRuntimeCleanupLease(root)
+	if cleanup != nil {
+		cleanup.release()
+	}
+	if cleanupErr == nil {
+		t.Errorf("cleanup accepted a link at the lease name (inUse=%t); it would treat a lock on %s as proof the root is free to delete", inUse, target)
+	}
+}
+
+// CONTROL: the two sides still coordinate on an ordinary lease.
+func TestUnixSharedLeaseMakesCleanupReportInUse(t *testing.T) {
+	base := t.TempDir()
+	root := unixLeaseRootUnder(t, base)
+
+	held, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Fatalf("cannot acquire a runtime lease: %v", err)
+	}
+
+	lease, inUse, err := tryAcquireSandboxRuntimeCleanupLease(root)
+	if lease != nil {
+		lease.release()
+	}
+	if err != nil {
+		t.Fatalf("cleanup failed against a legitimately held lease: %v", err)
+	}
+	if !inUse {
+		t.Fatal("cleanup reported the runtime root free while a shared lease was held; it would delete a tree a live command is using")
+	}
+
+	held.release()
+	lease, inUse, err = tryAcquireSandboxRuntimeCleanupLease(root)
+	if err != nil {
+		t.Fatalf("cleanup failed after the shared lease was released: %v", err)
+	}
+	if inUse {
+		t.Fatal("cleanup still reported the root in use after the only holder released it, so reclamation never happens")
+	}
+	lease.release()
+}

internal/sandbox/runtime_lease_ownership_test.go

@@ -0,0 +1,93 @@
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// runtimeRootUnderTest builds a root with the shape production uses, so the
+// components refuseAliasedRuntimeComponents walks stay inside test-owned
+// storage.
+//
+// Owned depth is the fixed names plus the digest, so a root placed directly in
+// t.TempDir() puts an owned component on /tmp, which the Unix ownership guard
+// correctly refuses because /tmp belongs to root. That is the guard working, not
+// a test environment problem, and it only shows up off Windows.
+func runtimeRootUnderTest(t *testing.T, leaf string) string {
+	t.Helper()
+	root := filepath.Join(t.TempDir(), "zero", "runtime", "v1", leaf)
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	return root
+}
+
+// A LEASE IS OWNERSHIP FOR A TRANSACTION, NOT A SELECTION PROBE.
+//
+// Setup took a lease only to learn which root won and released it at once, so
+// nothing owned the selected root while the elevated helper provisioned the
+// tree, applied the ACL and stamp, installed network state and wrote the marker.
+// A command for another workspace scans the same runtime parent and excludes
+// only its own current root, so it can take this root's cleanup lease and
+// RemoveAll it mid-transaction; setup then publishes success for a pathname that
+// is gone.
+//
+// This pins the mechanism the fix relies on: a held lease is what makes the
+// cleanup's exclusive acquire fail.
+func TestAHeldRuntimeLeaseStopsConcurrentCleanup(t *testing.T) {
+	root := runtimeRootUnderTest(t, "deadbeefdeadbeef")
+
+	lease, err := prepareSandboxRuntimeLease(root)
+	if err != nil {
+		t.Fatalf("acquire the runtime lease: %v", err)
+	}
+	removeSandboxRuntimeRootIfUnused(root)
+	if _, err := os.Stat(root); err != nil {
+		t.Fatalf("cleanup removed a root that setup was holding: %v", err)
+	}
+	lease.release()
+
+	// And once nothing holds it, cleanup does its job: without this half the test
+	// would pass against a cleanup that never removes anything.
+	removeSandboxRuntimeRootIfUnused(root)
+	if _, err := os.Stat(root); !os.IsNotExist(err) {
+		t.Fatalf("an unheld root survived cleanup: %v", err)
+	}
+}
+
+// The lease is on the root the caller names, so holding one root does not
+// protect a sibling: setup reserving its own selection must not stop the
+// cleanup doing its work elsewhere.
+func TestAHeldLeaseDoesNotProtectASiblingRoot(t *testing.T) {
+	held := runtimeRootUnderTest(t, "aaaaaaaaaaaaaaaa")
+	sibling := filepath.Join(filepath.Dir(held), "bbbbbbbbbbbbbbbb")
+	if err := os.MkdirAll(sibling, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	lease, err := prepareSandboxRuntimeLease(held)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer lease.release()
+
+	removeSandboxRuntimeRootIfUnused(sibling)
+	if _, err := os.Stat(sibling); !os.IsNotExist(err) {
+		t.Errorf("holding one root blocked cleanup of an unrelated sibling: %v", err)
+	}
+	if _, err := os.Stat(held); err != nil {
+		t.Errorf("the held root was removed: %v", err)
+	}
+}
+
+// createdRuntimeDirsForTest builds identity-bound rollback records for paths a
+// test made itself, so a test can express "these are the directories this run
+// created" without restating the identity capture.
+func createdRuntimeDirsForTest(paths ...string) []windowsCreatedRuntimeDir {
+	records := make([]windowsCreatedRuntimeDir, 0, len(paths))
+	for _, path := range paths {
+		identity, identified := runtimeDirIdentity(path)
+		records = append(records, windowsCreatedRuntimeDir{path: path, identity: identity, identified: identified})
+	}
+	return records
+}

internal/sandbox/runtime_lease_platform_other.go

@@ -0,0 +1,21 @@
+//go:build !windows
+
+package sandbox
+
+// acquireRuntimeLeaseForPlatform creates and locks the lease through the same
+// rooted no-follow boundary the Windows side uses.
+//
+// A PRE-CHECK IS NOT A BOUNDARY. This used to call refuseAliasedRuntimeComponents
+// and then os.MkdirAll plus a pathname lease open. The guard answers about an
+// ABSENT component by saying there is nothing to alias, which is exactly the
+// state a fresh fallback root is in, and both calls that followed resolve the
+// name again. A link planted in between was therefore created through and
+// written into, and the next check could only report it after the writes.
+//
+// The alias guard is gone from this path rather than kept alongside: retaining it
+// would suggest the two together are the protection, when the descent is the
+// protection and the guard is the thing that could not be one. Other callers
+// still use it where a pathname really is all there is.
+func acquireRuntimeLeaseForPlatform(root string) (*sandboxRuntimeLease, []windowsCreatedRuntimeDir, error) {
+	return acquireRuntimeLeaseRootedUnix(root)
+}

internal/sandbox/runtime_lease_platform_windows.go

@@ -0,0 +1,10 @@
+//go:build windows
+
+package sandbox
+
+// acquireRuntimeLeaseForPlatform routes Windows through the rooted, no-follow
+// acquisition. See acquireRuntimeLeaseRooted for why the pathname walk it
+// replaces was unsafe.
+func acquireRuntimeLeaseForPlatform(root string) (*sandboxRuntimeLease, []windowsCreatedRuntimeDir, error) {
+	return acquireRuntimeLeaseRooted(root)
+}

internal/sandbox/runtime_lease_reparse_windows_test.go

@@ -0,0 +1,299 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// seedRuntimeLeaseTree creates the owned tail and the lease the way a first run
+// does, then removes just the lease file so a test can put something else at that
+// name. The tree has to exist, or cleanup's descent has nothing to open and the
+// test would pass for the wrong reason.
+func seedRuntimeLeaseTree(t *testing.T, root string) string {
+	t.Helper()
+	lease, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Skipf("cannot seed a runtime lease here: %v", err)
+	}
+	lease.release()
+	leasePath := sandboxRuntimeLeasePath(root)
+	if err := os.Remove(leasePath); err != nil {
+		t.Fatalf("SETUP INVALID: cannot clear the seeded lease: %v", err)
+	}
+	return leasePath
+}
+
+// plantFileLink puts a FILE symbolic link at leasePath pointing at an ordinary
+// file, and returns the target.
+//
+// A file link, not a junction: a junction is a directory and FILE_NON_DIRECTORY_FILE
+// already refuses it, so a junction here would pass against the defect and prove
+// nothing. Creating one needs SeCreateSymbolicLinkPrivilege, which an ordinary
+// unelevated account does not hold, so this skips there and runs on CI.
+func plantFileLink(t *testing.T, leasePath string) string {
+	t.Helper()
+	target := filepath.Join(t.TempDir(), "target.lease")
+	if err := os.WriteFile(target, nil, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(target, leasePath); err != nil {
+		t.Skipf("cannot create a file symbolic link here, which needs SeCreateSymbolicLinkPrivilege: %v", err)
+	}
+	// SETUP: it really is a reparse point, or nothing below is about links.
+	info, err := os.Lstat(leasePath)
+	if err != nil || info.Mode()&os.ModeSymlink == 0 {
+		t.Fatalf("SETUP INVALID: %s is not a link (%v, %v)", leasePath, info, err)
+	}
+	return target
+}
+
+// assertTargetUnlocked proves nobody holds a lock on the link's target, which is
+// the object the defect made the two sides fight over.
+func assertTargetUnlocked(t *testing.T, target string) {
+	t.Helper()
+	file, err := os.OpenFile(target, os.O_RDWR, 0o600)
+	if err != nil {
+		t.Fatalf("open the link target: %v", err)
+	}
+	defer func() { _ = file.Close() }()
+	var overlapped windows.Overlapped
+	flags := uint32(windows.LOCKFILE_EXCLUSIVE_LOCK | windows.LOCKFILE_FAIL_IMMEDIATELY)
+	if err := windows.LockFileEx(windows.Handle(file.Fd()), flags, 0, 1, 0, &overlapped); err != nil {
+		t.Fatalf("the link target is locked, so the refusal happened after the lease had already been taken on it: %v", err)
+	}
+	_ = windows.UnlockFileEx(windows.Handle(file.Fd()), 0, 1, 0, &overlapped)
+}
+
+// FILE_OPEN_REPARSE_POINT SAYS DO NOT FOLLOW, NOT REFUSE.
+//
+// The rooted opener passed that flag and FILE_NON_DIRECTORY_FILE and treated the
+// pair as a guarantee. It is not: the flag returns a handle to the LINK, and
+// FILE_NON_DIRECTORY_FILE excludes directories rather than non-directory reparse
+// objects. A file symbolic link at <digest>.lease was opened, wrapped and locked
+// as though it were the lease.
+//
+// That matters because cleanup opened the same name by pathname with no
+// no-follow flag at all, so it locked the link's TARGET. Two holders, two
+// objects, both calls succeeding, and cleanup free to RemoveAll a runtime root a
+// live command was using.
+func TestSharedLeaseRefusesAFileLinkAtTheLeaseName(t *testing.T) {
+	cacheRoot := t.TempDir()
+	root := leaseRootUnder(t, cacheRoot)
+	leasePath := seedRuntimeLeaseTree(t, root)
+	target := plantFileLink(t, leasePath)
+
+	lease, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if lease != nil {
+		lease.release()
+	}
+	if err == nil {
+		t.Fatal("shared acquisition accepted a file link at the lease name, so it is holding a lock on an object cleanup does not see")
+	}
+	if !strings.Contains(err.Error(), "reparse point") {
+		t.Errorf("refused for the wrong reason: %v", err)
+	}
+	assertTargetUnlocked(t, target)
+}
+
+// And cleanup refuses the same object, so it cannot decide the root is free by
+// locking something else.
+func TestCleanupLeaseRefusesAFileLinkAtTheLeaseName(t *testing.T) {
+	cacheRoot := t.TempDir()
+	root := leaseRootUnder(t, cacheRoot)
+	leasePath := seedRuntimeLeaseTree(t, root)
+	target := plantFileLink(t, leasePath)
+
+	lease, inUse, err := tryAcquireSandboxRuntimeCleanupLease(root)
+	if lease != nil {
+		lease.release()
+	}
+	if err == nil {
+		t.Fatalf("cleanup accepted a file link at the lease name (inUse=%t); it would treat a lock on %s as proof the runtime root is free to delete", inUse, target)
+	}
+	if !strings.Contains(err.Error(), "reparse point") {
+		t.Errorf("refused for the wrong reason: %v", err)
+	}
+	assertTargetUnlocked(t, target)
+}
+
+// CONTROL: THE TWO SIDES REALLY DO COORDINATE ON AN ORDINARY LEASE.
+//
+// Without this, refusing everything would satisfy the two tests above. This one
+// runs everywhere, including on an unelevated box with no symbolic-link
+// privilege, so the mutual-exclusion contract stays pinned even where the link
+// cases skip.
+func TestASharedLeaseMakesCleanupReportInUse(t *testing.T) {
+	cacheRoot := t.TempDir()
+	root := leaseRootUnder(t, cacheRoot)
+
+	held, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Skipf("cannot acquire a runtime lease here: %v", err)
+	}
+
+	lease, inUse, err := tryAcquireSandboxRuntimeCleanupLease(root)
+	if lease != nil {
+		lease.release()
+	}
+	if err != nil {
+		t.Fatalf("cleanup failed against a legitimately held lease: %v", err)
+	}
+	if !inUse {
+		t.Fatal("cleanup reported the runtime root free while a shared lease was held; it would delete a tree a live command is using")
+	}
+
+	held.release()
+
+	lease, inUse, err = tryAcquireSandboxRuntimeCleanupLease(root)
+	if err != nil {
+		t.Fatalf("cleanup failed after the shared lease was released: %v", err)
+	}
+	if inUse {
+		t.Fatal("cleanup still reported the runtime root in use after the only holder released it, so reclamation never happens")
+	}
+	if lease == nil {
+		t.Fatal("cleanup reported the root free but handed back no lease")
+	}
+	lease.release()
+}
+
+// CONTROL: a legitimate lease is still SHARED between processes.
+//
+// The classification must not turn the shared lease into an exclusive one, or
+// two concurrent commands on one workspace would stop working.
+func TestAnOrdinaryLeaseIsStillSharedByTwoHolders(t *testing.T) {
+	cacheRoot := t.TempDir()
+	root := leaseRootUnder(t, cacheRoot)
+
+	first, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Skipf("cannot acquire a runtime lease here: %v", err)
+	}
+	defer first.release()
+
+	second, _, err := prepareSandboxRuntimeLeaseRecording(root)
+	if err != nil {
+		t.Fatalf("a second holder was refused an existing ordinary lease: %v", err)
+	}
+	second.release()
+}
+
+// reparseGUIDDataBuffer is the non-Microsoft form of REPARSE_GUID_DATA_BUFFER.
+//
+// Setting a tag with the Microsoft bit clear needs only write access to the file,
+// unlike a symbolic link, so this runs on an ordinary unelevated account and the
+// classification stays pinned where the link cases skip.
+type reparseGUIDDataBuffer struct {
+	ReparseTag        uint32
+	ReparseDataLength uint16
+	Reserved          uint16
+	ReparseGUID       windows.GUID
+	Data              [16]byte
+}
+
+// plantGenericReparsePoint turns an ordinary file at path into a reparse object.
+func plantGenericReparsePoint(t *testing.T, path string) {
+	t.Helper()
+	if err := os.WriteFile(path, nil, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	name, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	handle, err := windows.CreateFile(name,
+		windows.GENERIC_WRITE|windows.FILE_WRITE_ATTRIBUTES, 0, nil,
+		windows.OPEN_EXISTING,
+		windows.FILE_FLAG_OPEN_REPARSE_POINT|windows.FILE_FLAG_BACKUP_SEMANTICS, 0)
+	if err != nil {
+		t.Skipf("cannot open %s to set a reparse tag: %v", path, err)
+	}
+	defer func() { _ = windows.CloseHandle(handle) }()
+
+	buffer := reparseGUIDDataBuffer{
+		// Bit 31 clear, so this is a third-party tag and needs no privilege.
+		ReparseTag:        0x00000042,
+		ReparseDataLength: 16,
+		ReparseGUID:       windows.GUID{Data1: 0x5ee0e5f1, Data2: 0x1a11, Data3: 0x4d3b, Data4: [8]byte{0x9a, 0x77, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06}},
+	}
+	size := uint32(unsafe.Sizeof(buffer))
+	var returned uint32
+	if err := windows.DeviceIoControl(handle, windowsFSCTLSetReparsePoint,
+		(*byte)(unsafe.Pointer(&buffer)), size, nil, 0, &returned, nil); err != nil {
+		t.Skipf("cannot set a generic reparse tag here: %v", err)
+	}
+}
+
+const windowsFSCTLSetReparsePoint = 0x000900A4
+
+// ANY REPARSE OBJECT AT THE LEASE NAME IS REFUSED, NOT ONLY A SYMBOLIC LINK.
+//
+// The requirement is that the name denotes an ordinary file, because that is what
+// makes the shared holder and cleanup lock the same thing. Keying on the link
+// shape instead would leave every other reparse tag accepted, and it would leave
+// this untested on any machine without the symbolic-link privilege.
+//
+// WHAT THIS CASE CANNOT SHOW, so nobody reads a local pass as more than it is:
+// an unknown third-party tag is unresolvable, so the OLD pathname cleanup fails
+// on it too, with ERROR_CANT_ACCESS_FILE rather than by classifying anything. It
+// therefore pins that both sites refuse, and the reason check below is what
+// separates a refusal from an accident. Only the symbolic-link cases above show
+// the half that matters most, a pathname open SUCCEEDING on the target, and those
+// need the privilege. Read their result in CI, not here.
+func TestLeaseRefusesAnyReparseObjectAtTheLeaseName(t *testing.T) {
+	for name, acquire := range map[string]func(string) error{
+		"shared": func(root string) error {
+			lease, _, err := prepareSandboxRuntimeLeaseRecording(root)
+			if lease != nil {
+				lease.release()
+			}
+			return err
+		},
+		"cleanup": func(root string) error {
+			lease, _, err := tryAcquireSandboxRuntimeCleanupLease(root)
+			if lease != nil {
+				lease.release()
+			}
+			return err
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			cacheRoot := t.TempDir()
+			root := leaseRootUnder(t, cacheRoot)
+			leasePath := seedRuntimeLeaseTree(t, root)
+			plantGenericReparsePoint(t, leasePath)
+
+			// SETUP: the attribute really is set, or this asserts nothing.
+			info, err := os.Lstat(leasePath)
+			if err != nil || info.Mode()&os.ModeIrregular == 0 && info.Mode()&os.ModeSymlink == 0 {
+				attrs, statErr := windowsFileAttributes(leasePath)
+				if statErr != nil || attrs&windows.FILE_ATTRIBUTE_REPARSE_POINT == 0 {
+					t.Fatalf("SETUP INVALID: %s is not a reparse object (attrs=%#x err=%v)", leasePath, attrs, statErr)
+				}
+			}
+
+			err = acquire(root)
+			if err == nil {
+				t.Fatalf("%s acquisition accepted a reparse object at the lease name", name)
+			}
+			if !strings.Contains(err.Error(), "reparse point") {
+				t.Errorf("refused for the wrong reason: %v", err)
+			}
+		})
+	}
+}
+
+func windowsFileAttributes(path string) (uint32, error) {
+	name, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		return 0, err
+	}
+	return windows.GetFileAttributes(name)
+}

internal/sandbox/runtime_lease_rooted_unix.go

@@ -0,0 +1,282 @@
+//go:build !windows
+
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"golang.org/x/sys/unix"
+)
+
+// acquireRuntimeLeaseRootedUnix creates and locks the lease for root without
+// resolving an owned component by name.
+//
+// The lease is the FIRST thing setup writes, so it is the write a redirection has
+// to be caught before, not after. It is a sibling of the runtime root rather than
+// one of its owned components, which is why the alias guard never looked at it at
+// all: it walks the components, and the lease is not one of them.
+//
+// Only the components above the leaf are created here. The leaf belongs to
+// provisioning, which records it for rollback, and creating it here would mean
+// two owners for one directory.
+func acquireRuntimeLeaseRootedUnix(root string) (*sandboxRuntimeLease, []windowsCreatedRuntimeDir, error) {
+	base, components, owned := windowsSandboxRuntimeOwnedTail(root)
+	if !owned || len(components) == 0 {
+		// Fail rather than fall back to the pathname walk: the walk is the defect.
+		return nil, nil, fmt.Errorf("acquire sandbox runtime lease for %s: %w", root, errRuntimeTailNotOwned)
+	}
+	if runtimeLeasePreCreateBarrier != nil {
+		runtimeLeasePreCreateBarrier()
+	}
+	// The base is the operator's, and may legitimately be a redirected or linked
+	// temp location, so it is created and opened by name exactly as before.
+	// Everything below it is Zero's and is addressed by descriptor.
+	if err := os.MkdirAll(base, 0o700); err != nil {
+		return nil, nil, fmt.Errorf("create sandbox runtime base: %w", err)
+	}
+
+	// The lease sits beside the leaf, so the deepest directory needed here is the
+	// leaf's parent.
+	tail := make([]string, 0, len(components)-1)
+	current := base
+	for _, component := range components[:len(components)-1] {
+		current = filepath.Join(current, component)
+		tail = append(tail, current)
+	}
+
+	// THE WHOLE ACQUISITION RETRIES, NOT JUST THE LOCK. A contender that waited
+	// on the lease while cleanup held it exclusively can wake on an object cleanup
+	// has since unlinked, and by then cleanup has compensated the tail this run
+	// created as well. Re-taking the lock alone would lock a fresh file beside a
+	// leaf that is gone, so a stale lock sends the caller back through tail
+	// creation. The ledger accumulates across attempts: a directory this run made
+	// on an earlier pass and cleanup did not remove is still this run's to
+	// compensate.
+	var created []windowsCreatedRuntimeDir
+	for attempt := 1; ; attempt++ {
+		made, parent, err := createRuntimeTailRetainingFD(base, tail)
+		created = appendCreatedRuntimeDirs(created, made)
+		if err != nil {
+			return nil, created, err
+		}
+		handle, madeLease, err := acquireSharedRuntimeLeaseAtFD(parent, filepath.Base(sandboxRuntimeLeasePath(root)))
+		_ = unix.Close(parent)
+		if err == nil {
+			return &sandboxRuntimeLease{handle: handle, root: root, createdFile: madeLease}, created, nil
+		}
+		if errors.Is(err, errRuntimeLeaseReplaced) && attempt < runtimeLeaseAcquireAttempts {
+			continue
+		}
+		return nil, created, fmt.Errorf("acquire sandbox runtime lease: %w", err)
+	}
+}
+
+// acquireSharedRuntimeLeaseAtFD opens the lease relative to a verified parent and
+// takes the shared lock on it.
+func acquireSharedRuntimeLeaseAtFD(parent int, name string) (runtimeLeaseHandle, bool, error) {
+	file, created, err := openRuntimeLeaseAtFD(parent, name)
+	if err != nil {
+		return runtimeLeaseHandle{}, false, err
+	}
+	if err := unix.Flock(int(file.Fd()), unix.LOCK_SH); err != nil {
+		// The lock is the last step, and until now the created fact went out only
+		// alongside a lease object. Failing here returned no object, so this
+		// invocation's own lease file stayed on disk with nothing recording it,
+		// and its directory could never be compensated afterwards.
+		err = undoCreatedRuntimeLeaseAtFD(created, parent, name, err)
+		_ = file.Close()
+		return runtimeLeaseHandle{}, false, err
+	}
+	// THE LOCK IS ON AN INODE, THE COORDINATION IS ON A NAME. Flock blocks while
+	// cleanup holds the exclusive lock, and cleanup unlinks the lease name before
+	// it lets go. A waiter then acquires the old, unlinked inode and returns a
+	// lease that coordinates with nobody: the next cleanup creates a fresh file at
+	// the name, locks it unopposed, and reports the root unused while this holder
+	// is still running in it. So the lock is only a lease once the locked object
+	// is still what the name resolves to. Reported by @gnanam1990.
+	current, err := runtimeLeaseIsCurrentAtFD(parent, name, int(file.Fd()))
+	if err != nil {
+		_ = file.Close()
+		return runtimeLeaseHandle{}, false, err
+	}
+	if !current {
+		// Not undone by name, whatever created says: the name is no longer this
+		// object's, so an unlink there would take somebody else's lease.
+		_ = file.Close()
+		return runtimeLeaseHandle{}, false, errRuntimeLeaseReplaced
+	}
+	return runtimeLeaseHandle{file: file}, created, nil
+}
+
+// runtimeLeaseIsCurrentAtFD reports whether the locked lease is still the object
+// the lease name resolves to under parent.
+//
+// Both answers come from the descriptor side: the locked file's own identity and
+// the directory entry read relative to the retained parent, no-follow. A missing
+// entry, a different inode at the name, or a locked inode with no links left all
+// mean the coordination moved on while this call was waiting.
+func runtimeLeaseIsCurrentAtFD(parent int, name string, fd int) (bool, error) {
+	var locked, entry unix.Stat_t
+	if err := unix.Fstat(fd, &locked); err != nil {
+		return false, fmt.Errorf("inspect the locked sandbox runtime lease %s: %w", name, err)
+	}
+	if locked.Nlink == 0 {
+		return false, nil
+	}
+	if err := unix.Fstatat(parent, name, &entry, unix.AT_SYMLINK_NOFOLLOW); err != nil {
+		if errors.Is(err, unix.ENOENT) {
+			return false, nil
+		}
+		return false, fmt.Errorf("inspect the sandbox runtime lease entry %s: %w", name, err)
+	}
+	return locked.Dev == entry.Dev && locked.Ino == entry.Ino, nil
+}
+
+// undoCreatedRuntimeLeaseAtFD removes a lease file this call created, when a
+// later step means no lease object will be returned to carry that fact.
+//
+// Relative to the verified parent descriptor, and only when this call is the one
+// that created the file: a lease that was already there belongs to whoever is
+// holding it.
+func undoCreatedRuntimeLeaseAtFD(created bool, parent int, name string, cause error) error {
+	if !created {
+		return cause
+	}
+	if undoErr := unix.Unlinkat(parent, name, 0); undoErr != nil {
+		return fmt.Errorf("%w; and the lease file this run created could not be removed: %w", cause, undoErr)
+	}
+	return cause
+}
+
+// openRuntimeLeaseAtFD opens or creates the lease under parent and proves it is
+// an ordinary file.
+//
+// O_NOFOLLOW so a symlink planted at the lease name is an ELOOP rather than an
+// open of its target, and a regular-file check besides, because O_NOFOLLOW says
+// nothing about a fifo or a device a local user can also create there. Both
+// holders have to end up on the same object or the lock protects nothing.
+func openRuntimeLeaseAtFD(parent int, name string) (*os.File, bool, error) {
+	const flags = unix.O_RDWR | unix.O_NOFOLLOW | unix.O_CLOEXEC
+	// O_EXCL FIRST, so the create is what reports the create. A Stat beforehand
+	// answers about a moment that has passed by the time the open runs, and
+	// compensation would then delete a lease another process had just made.
+	created := true
+	fd, err := unix.Openat(parent, name, flags|unix.O_CREAT|unix.O_EXCL, 0o600)
+	if errors.Is(err, unix.EEXIST) {
+		created = false
+		fd, err = unix.Openat(parent, name, flags, 0)
+	}
+	if err != nil {
+		if errors.Is(err, unix.ELOOP) {
+			return nil, false, fmt.Errorf("refusing to use the sandbox runtime lease at %s: it is a link, so the holders would lock different objects: %w", name, err)
+		}
+		return nil, false, err
+	}
+	// Every failure from here on has already created the file when created is
+	// true, and returns no lease object to carry that fact, so each one undoes
+	// its own creation rather than leaving an unrecorded artifact behind.
+	if runtimeCreationFailure != nil {
+		if injected := runtimeCreationFailure(name); injected != nil {
+			injected = undoCreatedRuntimeLeaseAtFD(created, parent, name, injected)
+			_ = unix.Close(fd)
+			return nil, false, injected
+		}
+	}
+	var stat unix.Stat_t
+	if err := unix.Fstat(fd, &stat); err != nil {
+		err = undoCreatedRuntimeLeaseAtFD(created, parent, name, fmt.Errorf("inspect the sandbox runtime lease %s: %w", name, err))
+		_ = unix.Close(fd)
+		return nil, false, err
+	}
+	if stat.Mode&unix.S_IFMT != unix.S_IFREG {
+		err := undoCreatedRuntimeLeaseAtFD(created, parent, name, fmt.Errorf("refusing to use the sandbox runtime lease at %s: it is not an ordinary file (mode %#o)", name, stat.Mode&unix.S_IFMT))
+		_ = unix.Close(fd)
+		return nil, false, err
+	}
+	if uid := unix.Getuid(); uid >= 0 && stat.Uid != uint32(uid) {
+		err := undoCreatedRuntimeLeaseAtFD(created, parent, name, fmt.Errorf("refusing to use the sandbox runtime lease at %s: it is owned by uid %d, not %d", name, stat.Uid, uid))
+		_ = unix.Close(fd)
+		return nil, false, err
+	}
+	file := os.NewFile(uintptr(fd), name)
+	if file == nil {
+		err := undoCreatedRuntimeLeaseAtFD(created, parent, name, fmt.Errorf("wrap the sandbox runtime lease handle for %s", name))
+		_ = unix.Close(fd)
+		return nil, false, err
+	}
+	return file, created, nil
+}
+
+// tryAcquireExclusiveRuntimeLeaseRootedUnix is cleanup's acquisition, resolved
+// the way acquisition resolves it.
+//
+// It opens and never creates the tree: a runtime root that is not there has no
+// lease to take, and cleanup rebuilding it in order to lock it would be inventing
+// the thing it is about to remove.
+func tryAcquireExclusiveRuntimeLeaseRootedUnix(root string) (runtimeLeaseHandle, bool, error) {
+	base, components, owned := windowsSandboxRuntimeOwnedTail(root)
+	if !owned || len(components) == 0 {
+		return runtimeLeaseHandle{}, false, fmt.Errorf("open the sandbox runtime lease parent for %s: %w", root, errRuntimeTailNotOwned)
+	}
+	parent, err := unix.Open(base, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
+	if err != nil {
+		return runtimeLeaseHandle{}, false, fmt.Errorf("open sandbox runtime base %s: %w", base, err)
+	}
+	path := base
+	for _, name := range components[:len(components)-1] {
+		path = filepath.Join(path, name)
+		child, openErr := unix.Openat(parent, name, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_NOFOLLOW|unix.O_CLOEXEC, 0)
+		if openErr != nil {
+			_ = unix.Close(parent)
+			return runtimeLeaseHandle{}, false, fmt.Errorf("open sandbox runtime component %s: %w", path, openErr)
+		}
+		if err := refuseForeignRuntimeDirectory(child, path); err != nil {
+			_ = unix.Close(child)
+			_ = unix.Close(parent)
+			return runtimeLeaseHandle{}, false, err
+		}
+		_ = unix.Close(parent)
+		parent = child
+	}
+	defer func() { _ = unix.Close(parent) }()
+
+	name := filepath.Base(sandboxRuntimeLeasePath(root))
+	for attempt := 1; ; attempt++ {
+		file, created, err := openRuntimeLeaseAtFD(parent, name)
+		if err != nil {
+			return runtimeLeaseHandle{}, false, err
+		}
+		if err := unix.Flock(int(file.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
+			if errors.Is(err, unix.EWOULDBLOCK) || errors.Is(err, unix.EAGAIN) {
+				// Somebody holds it, so it is not this call's to remove, whatever the
+				// open reported. A file this call created cannot reach here anyway.
+				_ = file.Close()
+				return runtimeLeaseHandle{}, true, nil
+			}
+			err = undoCreatedRuntimeLeaseAtFD(created, parent, name, err)
+			_ = file.Close()
+			return runtimeLeaseHandle{}, false, err
+		}
+		// The exclusive side has the same window in miniature: between its open
+		// and its lock another cleanup can unlink and replace the name, and an
+		// exclusive lock on the old inode would then remove a tree a holder of the
+		// new one is entering. Same check, same answer: only the current object
+		// counts, and a stale one is reopened rather than reasoned about.
+		current, err := runtimeLeaseIsCurrentAtFD(parent, name, int(file.Fd()))
+		if err != nil {
+			_ = file.Close()
+			return runtimeLeaseHandle{}, false, err
+		}
+		if !current {
+			_ = file.Close()
+			if attempt < runtimeLeaseAcquireAttempts {
+				continue
+			}
+			return runtimeLeaseHandle{}, false, errRuntimeLeaseReplaced
+		}
+		return runtimeLeaseHandle{file: file}, false, nil
+	}
+}

internal/sandbox/runtime_lease_rooted_windows.go

@@ -0,0 +1,408 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// acquireRuntimeLeaseRooted creates and locks the lease file for root without
+// ever resolving an owned component by name.
+//
+// THE LEASE IS ACQUIRED BEFORE ANYTHING ELSE, SO IT CANNOT BE THE WEAK LINK.
+//
+// Provisioning already descends from the fixed cache or TEMP base through
+// retained no-follow handles, because a predictable owned component is exactly
+// what an ordinary same-account process can replace with a junction. Lease
+// acquisition ran first and did neither: it checked the components for aliases,
+// then called os.MkdirAll on the parent by pathname and opened
+// "<root>.lease" by pathname, both of which follow. A junction dropped on
+// "zero", "runtime" or "v1" between the check and either call put elevated
+// setup's first writes inside somebody else's tree, and restoring the component
+// afterwards left the later handle-relative provisioning working on the
+// legitimate tree so no post-check ever saw it.
+//
+// The lease file is a SIBLING of the runtime root rather than one of its owned
+// components, so refuseAliasedRuntimeComponents never inspected it at all. Here
+// it is created relative to the retained handle for the directory that contains
+// it, which is the deepest owned component, so its name is resolved exactly once
+// and relative to a verified object.
+//
+// Only the components above the leaf are created. The leaf itself belongs to
+// provisioning, which records it for rollback; creating it here would mean two
+// owners for one directory.
+func acquireRuntimeLeaseRooted(root string) (*sandboxRuntimeLease, []windowsCreatedRuntimeDir, error) {
+	base, components, owned := windowsSandboxRuntimeOwnedTail(root)
+	if !owned {
+		// Fail rather than fall back to the pathname walk: the walk is the defect.
+		return nil, nil, fmt.Errorf("acquire sandbox runtime lease for %s: %w", root, errRuntimeTailNotOwned)
+	}
+	if len(components) == 0 {
+		return nil, nil, fmt.Errorf("acquire sandbox runtime lease for %s: %w", root, errRuntimeTailNotOwned)
+	}
+	// The base is the operator's, and may legitimately be a redirected cache or
+	// TEMP location, so it is created and opened by name exactly as provisioning
+	// does. Everything below it is Zero's and is addressed by handle.
+	if runtimeLeasePreCreateBarrier != nil {
+		runtimeLeasePreCreateBarrier()
+	}
+	if err := os.MkdirAll(base, 0o700); err != nil {
+		return nil, nil, fmt.Errorf("create sandbox runtime base: %w", err)
+	}
+
+	// The lease sits beside the leaf, so the deepest directory needed here is the
+	// leaf's parent.
+	parents := components[:len(components)-1]
+	tail := make([]string, 0, len(parents))
+	current := base
+	for _, component := range parents {
+		current = filepath.Join(current, component)
+		tail = append(tail, current)
+	}
+
+	// THE WHOLE ACQUISITION RETRIES, NOT JUST THE LOCK. A contender that waited
+	// on the lease while cleanup held it exclusively can wake on an object cleanup
+	// has since marked for deletion, and by then cleanup has compensated the tail
+	// this run created as well. Re-taking the lock alone would lock a fresh file
+	// beside a leaf that is gone, so a stale lock sends the caller back through
+	// tail creation. The ledger accumulates across attempts: a directory this run
+	// made on an earlier pass and cleanup did not remove is still this run's to
+	// compensate.
+	var created []windowsCreatedRuntimeDir
+	for attempt := 1; ; attempt++ {
+		made, parent, err := createRuntimeTailRetainingHandle(base, tail)
+		created = appendCreatedRuntimeDirs(created, made)
+		if err != nil {
+			if parent != 0 {
+				_ = windows.CloseHandle(parent)
+			}
+			return nil, created, err
+		}
+		handle, madeLease, err := acquireSharedRuntimeLeaseAt(parent, filepath.Base(sandboxRuntimeLeasePath(root)))
+		_ = windows.CloseHandle(parent)
+		if err == nil {
+			return &sandboxRuntimeLease{handle: handle, root: root, createdFile: madeLease}, created, nil
+		}
+		if errors.Is(err, errRuntimeLeaseReplaced) && attempt < runtimeLeaseAcquireAttempts {
+			continue
+		}
+		return nil, created, fmt.Errorf("acquire sandbox runtime lease: %w", err)
+	}
+}
+
+// acquireSharedRuntimeLeaseAt is acquireSharedRuntimeLease with the file named
+// relative to a directory handle instead of by full path.
+func acquireSharedRuntimeLeaseAt(parent windows.Handle, name string) (runtimeLeaseHandle, bool, error) {
+	objectName, err := windows.NewNTUnicodeString(name)
+	if err != nil {
+		return runtimeLeaseHandle{}, false, fmt.Errorf("encode sandbox runtime lease name %s: %w", name, err)
+	}
+	attributes := windows.OBJECT_ATTRIBUTES{
+		RootDirectory: parent,
+		ObjectName:    objectName,
+		Attributes:    windows.OBJ_CASE_INSENSITIVE,
+	}
+	attributes.Length = uint32(unsafe.Sizeof(attributes))
+
+	var handle windows.Handle
+	var iosb windows.IO_STATUS_BLOCK
+	// FILE_OPEN_IF because the lease is shared: whoever gets there first creates
+	// it. FILE_NON_DIRECTORY_FILE so a directory under that name is refused.
+	//
+	// FILE_OPEN_REPARSE_POINT IS NOT A REFUSAL. It says do not follow, so the call
+	// returns a handle to the LINK, and FILE_NON_DIRECTORY_FILE excludes
+	// directories rather than non-directory reparse objects. A file symbolic link
+	// planted at <digest>.lease was therefore opened and locked as if it were the
+	// lease. No-follow and classification are two requirements; the flag is only
+	// the first, and the handle is asked for the second below.
+	err = windows.NtCreateFile(
+		&handle,
+		windows.DELETE|windows.GENERIC_READ|windows.GENERIC_WRITE|windows.SYNCHRONIZE,
+		&attributes,
+		&iosb,
+		nil,
+		windows.FILE_ATTRIBUTE_NORMAL,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+		windows.FILE_OPEN_IF,
+		windows.FILE_NON_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
+		0,
+		0,
+	)
+	if err != nil {
+		return runtimeLeaseHandle{}, false, err
+	}
+	// FILE_CREATED here, rather than a Stat before the call, because only the
+	// create itself can distinguish the file it made from one that arrived a
+	// moment earlier.
+	created := iosb.Information == windowsFileCreatedDisposition
+	// And every failure below has already created the file when that is true,
+	// while returning no lease object to carry the fact, so each undoes its own
+	// creation instead of leaving an unrecorded artifact in a directory
+	// compensation then cannot empty.
+	if runtimeCreationFailure != nil {
+		if injected := runtimeCreationFailure(name); injected != nil {
+			injected = undoCreatedRuntimeLease(created, handle, injected)
+			_ = windows.CloseHandle(handle)
+			return runtimeLeaseHandle{}, false, injected
+		}
+	}
+	if err := refuseReparseRuntimeLeaseHandle(handle, name); err != nil {
+		err = undoCreatedRuntimeLease(created, handle, err)
+		_ = windows.CloseHandle(handle)
+		return runtimeLeaseHandle{}, false, err
+	}
+	file := os.NewFile(uintptr(handle), name)
+	if file == nil {
+		err := undoCreatedRuntimeLease(created, handle, fmt.Errorf("wrap the sandbox runtime lease handle for %s", name))
+		_ = windows.CloseHandle(handle)
+		return runtimeLeaseHandle{}, false, err
+	}
+	lease := runtimeLeaseHandle{file: file}
+	if err := windows.LockFileEx(windows.Handle(file.Fd()), 0, 0, 1, 0, &lease.overlapped); err != nil {
+		err = undoCreatedRuntimeLease(created, windows.Handle(file.Fd()), err)
+		_ = file.Close()
+		return runtimeLeaseHandle{}, false, err
+	}
+	// THE LOCK IS ON AN OBJECT, THE COORDINATION IS ON A NAME. LockFileEx waits
+	// while cleanup holds the exclusive lock, and cleanup marks the lease for
+	// deletion before it lets go; this handle was opened with FILE_SHARE_DELETE
+	// precisely so cleanup could. A waiter then locks a delete-pending object and
+	// returns a lease that coordinates with nobody: once this handle closes the
+	// name is free, the next cleanup creates a fresh file there, locks it
+	// unopposed, and reports the root unused while this holder is still running
+	// in it. So the lock is only a lease once the locked object is still what the
+	// name resolves to. Reported by @gnanam1990.
+	current, err := runtimeLeaseIsCurrentAt(parent, name, windows.Handle(file.Fd()))
+	if err != nil {
+		_ = file.Close()
+		return runtimeLeaseHandle{}, false, err
+	}
+	if !current {
+		// Not undone, whatever created says: the object is already going, and the
+		// name now belongs to whoever comes next. Closing this handle is what lets
+		// the name go so the retry can take a current one.
+		_ = file.Close()
+		return runtimeLeaseHandle{}, false, errRuntimeLeaseReplaced
+	}
+	return lease, created, nil
+}
+
+// runtimeLeaseIsCurrentAt reports whether the locked lease is still the object
+// the lease name resolves to under parent.
+//
+// Both answers come from handles: the locked file's own identity, and a fresh
+// no-follow open of the name relative to the retained parent, asked for nothing
+// but attributes. A name that is gone or delete-pending, or that resolves to a
+// different volume and file index, means the coordination moved on while this
+// call was waiting.
+func runtimeLeaseIsCurrentAt(parent windows.Handle, name string, locked windows.Handle) (bool, error) {
+	var lockedInfo windows.ByHandleFileInformation
+	if err := windows.GetFileInformationByHandle(locked, &lockedInfo); err != nil {
+		return false, fmt.Errorf("inspect the locked sandbox runtime lease %s: %w", name, err)
+	}
+	objectName, err := windows.NewNTUnicodeString(name)
+	if err != nil {
+		return false, fmt.Errorf("encode sandbox runtime lease name %s: %w", name, err)
+	}
+	attributes := windows.OBJECT_ATTRIBUTES{
+		RootDirectory: parent,
+		ObjectName:    objectName,
+		Attributes:    windows.OBJ_CASE_INSENSITIVE,
+	}
+	attributes.Length = uint32(unsafe.Sizeof(attributes))
+	var probe windows.Handle
+	var iosb windows.IO_STATUS_BLOCK
+	err = windows.NtCreateFile(
+		&probe,
+		windows.FILE_READ_ATTRIBUTES|windows.SYNCHRONIZE,
+		&attributes,
+		&iosb,
+		nil,
+		0,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+		windows.FILE_OPEN,
+		windows.FILE_NON_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
+		0,
+		0,
+	)
+	if err != nil {
+		if errors.Is(err, windows.STATUS_OBJECT_NAME_NOT_FOUND) || errors.Is(err, windows.STATUS_DELETE_PENDING) {
+			return false, nil
+		}
+		return false, fmt.Errorf("inspect the sandbox runtime lease entry %s: %w", name, err)
+	}
+	defer func() { _ = windows.CloseHandle(probe) }()
+	var entryInfo windows.ByHandleFileInformation
+	if err := windows.GetFileInformationByHandle(probe, &entryInfo); err != nil {
+		return false, fmt.Errorf("inspect the sandbox runtime lease entry %s: %w", name, err)
+	}
+	return lockedInfo.VolumeSerialNumber == entryInfo.VolumeSerialNumber &&
+		lockedInfo.FileIndexHigh == entryInfo.FileIndexHigh &&
+		lockedInfo.FileIndexLow == entryInfo.FileIndexLow, nil
+}
+
+// undoCreatedRuntimeLease removes a lease file this call created, when a later
+// step means no lease object will be returned to carry that fact.
+//
+// Through the handle, and only when this call is the one that created the file:
+// a lease that was already there belongs to whoever is holding it.
+func undoCreatedRuntimeLease(created bool, handle windows.Handle, cause error) error {
+	if !created {
+		return cause
+	}
+	if undoErr := removeWindowsObjectByHandle(handle); undoErr != nil {
+		return fmt.Errorf("%w; and the lease file this run created could not be removed: %w", cause, undoErr)
+	}
+	return cause
+}
+
+// refuseReparseRuntimeLeaseHandle proves the opened lease is an ordinary file.
+//
+// Asked of the HANDLE, not the name, so there is no second resolution for a
+// substitution to land in. This is the check the directory descent already makes
+// in openWindowsChildNoFollow; the lease carried the no-follow flag and not the
+// classification that has to go with it.
+func refuseReparseRuntimeLeaseHandle(handle windows.Handle, name string) error {
+	var info windows.ByHandleFileInformation
+	if err := windows.GetFileInformationByHandle(handle, &info); err != nil {
+		return fmt.Errorf("inspect the sandbox runtime lease %s: %w", name, err)
+	}
+	if info.FileAttributes&windows.FILE_ATTRIBUTE_REPARSE_POINT != 0 {
+		return fmt.Errorf("refusing to use the sandbox runtime lease at %s: a reparse point here means the shared and exclusive holders would lock different objects", name)
+	}
+	return nil
+}
+
+// openRuntimeLeaseParentRooted opens, and never creates, the directory holding
+// the lease for root.
+//
+// Cleanup's side of the contract. It descends the same owned components from the
+// same base with the same no-follow opens acquisition uses, so both sides resolve
+// the lease name relative to a verified directory rather than by pathname.
+//
+// It creates nothing. A runtime tree that is not there has no lease to take, and
+// cleanup rebuilding the tree in order to lock it would be inventing the thing it
+// is about to remove.
+func openRuntimeLeaseParentRooted(root string) (windows.Handle, error) {
+	base, components, owned := windowsSandboxRuntimeOwnedTail(root)
+	if !owned || len(components) == 0 {
+		return 0, fmt.Errorf("open the sandbox runtime lease parent for %s: %w", root, errRuntimeTailNotOwned)
+	}
+	parent, err := openWindowsDirectoryByName(base)
+	if err != nil {
+		return 0, fmt.Errorf("open sandbox runtime base %s: %w", base, err)
+	}
+	// The lease is a SIBLING of the leaf, so the deepest directory needed here is
+	// the leaf's parent, exactly as in acquisition.
+	for _, name := range components[:len(components)-1] {
+		child, openErr := openWindowsChildNoFollow(parent, name,
+			windows.FILE_READ_ATTRIBUTES|windows.FILE_TRAVERSE, windows.FILE_DIRECTORY_FILE)
+		if openErr != nil {
+			_ = windows.CloseHandle(parent)
+			return 0, openErr
+		}
+		_ = windows.CloseHandle(parent)
+		parent = child
+	}
+	return parent, nil
+}
+
+// tryAcquireExclusiveRuntimeLeaseRooted is cleanup's acquisition, resolved the
+// way acquisition resolves it.
+func tryAcquireExclusiveRuntimeLeaseRooted(root string) (runtimeLeaseHandle, bool, error) {
+	parent, err := openRuntimeLeaseParentRooted(root)
+	if err != nil {
+		return runtimeLeaseHandle{}, false, err
+	}
+	defer func() { _ = windows.CloseHandle(parent) }()
+
+	name := filepath.Base(sandboxRuntimeLeasePath(root))
+	objectName, err := windows.NewNTUnicodeString(name)
+	if err != nil {
+		return runtimeLeaseHandle{}, false, fmt.Errorf("encode sandbox runtime lease name %s: %w", name, err)
+	}
+	attributes := windows.OBJECT_ATTRIBUTES{
+		RootDirectory: parent,
+		ObjectName:    objectName,
+		Attributes:    windows.OBJ_CASE_INSENSITIVE,
+	}
+	attributes.Length = uint32(unsafe.Sizeof(attributes))
+
+	for attempt := 1; ; attempt++ {
+		var handle windows.Handle
+		var iosb windows.IO_STATUS_BLOCK
+		// FILE_OPEN_IF matches what cleanup did by pathname with O_CREATE: a
+		// runtime root whose lease file is gone is held by nobody, and creating the
+		// empty lease is how that is expressed.
+		err = windows.NtCreateFile(
+			&handle,
+			windows.DELETE|windows.GENERIC_READ|windows.GENERIC_WRITE|windows.SYNCHRONIZE,
+			&attributes,
+			&iosb,
+			nil,
+			windows.FILE_ATTRIBUTE_NORMAL,
+			windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+			windows.FILE_OPEN_IF,
+			windows.FILE_NON_DIRECTORY_FILE|windows.FILE_SYNCHRONOUS_IO_NONALERT|windows.FILE_OPEN_REPARSE_POINT,
+			0,
+			0,
+		)
+		if err != nil {
+			return runtimeLeaseHandle{}, false, err
+		}
+		created := iosb.Information == windowsFileCreatedDisposition
+		if err := refuseReparseRuntimeLeaseHandle(handle, name); err != nil {
+			err = undoCreatedRuntimeLease(created, handle, err)
+			_ = windows.CloseHandle(handle)
+			return runtimeLeaseHandle{}, false, err
+		}
+		file := os.NewFile(uintptr(handle), name)
+		if file == nil {
+			err := undoCreatedRuntimeLease(created, handle, fmt.Errorf("wrap the sandbox runtime lease handle for %s", name))
+			_ = windows.CloseHandle(handle)
+			return runtimeLeaseHandle{}, false, err
+		}
+		lease := runtimeLeaseHandle{file: file}
+		flags := uint32(windows.LOCKFILE_EXCLUSIVE_LOCK | windows.LOCKFILE_FAIL_IMMEDIATELY)
+		if err := windows.LockFileEx(windows.Handle(file.Fd()), flags, 0, 1, 0, &lease.overlapped); err != nil {
+			if errors.Is(err, windows.ERROR_LOCK_VIOLATION) {
+				// Somebody holds it, so it is not this call's to remove, whatever the
+				// open reported. A file this call created cannot reach here anyway.
+				_ = file.Close()
+				return runtimeLeaseHandle{}, true, nil
+			}
+			err = undoCreatedRuntimeLease(created, windows.Handle(file.Fd()), err)
+			_ = file.Close()
+			return runtimeLeaseHandle{}, false, err
+		}
+		// The exclusive side has the same window in miniature: between its open
+		// and its lock another cleanup can mark the object for deletion, and an
+		// exclusive lock on that object would then remove a tree a holder of the
+		// replacement is entering. Same check, same answer: only the current
+		// object counts, and a stale one is reopened rather than reasoned about.
+		current, err := runtimeLeaseIsCurrentAt(parent, name, windows.Handle(file.Fd()))
+		if err != nil {
+			_ = file.Close()
+			return runtimeLeaseHandle{}, false, err
+		}
+		if !current {
+			_ = file.Close()
+			if attempt < runtimeLeaseAcquireAttempts {
+				continue
+			}
+			return runtimeLeaseHandle{}, false, errRuntimeLeaseReplaced
+		}
+		return lease, false, nil
+	}
+}
+
+// windowsFileCreatedDisposition is the IO_STATUS_BLOCK Information value that
+// says NtCreateFile made the file rather than opening one that was there.
+// x/sys/windows does not export it.
+const windowsFileCreatedDisposition = 2

internal/sandbox/runtime_lease_unix.go

@@ -3,7 +3,6 @@
 package sandbox
 
 import (
-	"errors"
 	"os"
 
 	"golang.org/x/sys/unix"
@@ -13,31 +12,15 @@ type runtimeLeaseHandle struct {
 	file *os.File
 }
 
-func acquireSharedRuntimeLease(path string) (runtimeLeaseHandle, error) {
-	file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
-	if err != nil {
-		return runtimeLeaseHandle{}, err
-	}
-	if err := unix.Flock(int(file.Fd()), unix.LOCK_SH); err != nil {
-		_ = file.Close()
-		return runtimeLeaseHandle{}, err
-	}
-	return runtimeLeaseHandle{file: file}, nil
-}
-
-func tryAcquireExclusiveRuntimeLease(path string) (runtimeLeaseHandle, bool, error) {
-	file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
-	if err != nil {
-		return runtimeLeaseHandle{}, false, err
-	}
-	if err := unix.Flock(int(file.Fd()), unix.LOCK_EX|unix.LOCK_NB); err != nil {
-		_ = file.Close()
-		if errors.Is(err, unix.EWOULDBLOCK) || errors.Is(err, unix.EAGAIN) {
-			return runtimeLeaseHandle{}, true, nil
-		}
-		return runtimeLeaseHandle{}, false, err
-	}
-	return runtimeLeaseHandle{file: file}, false, nil
+// BOTH SIDES HAVE TO MEAN THE SAME OBJECT.
+//
+// Cleanup opened the lease by full pathname while acquisition opened it relative
+// to a verified parent, so a symlink at <digest>.lease gave the two of them
+// different files: a live command held a shared lock on one, cleanup took an
+// exclusive lock on the other, both succeeded, and cleanup went on to remove a
+// runtime root that was still in use.
+func tryAcquireExclusiveRuntimeLease(root string) (runtimeLeaseHandle, bool, error) {
+	return tryAcquireExclusiveRuntimeLeaseRootedUnix(root)
 }
 
 func (lease runtimeLeaseHandle) release() {

internal/sandbox/runtime_lease_waiting_contender_test.go

@@ -0,0 +1,95 @@
+package sandbox
+
+import (
+	"os"
+	"testing"
+)
+
+// A CONTENDER THAT WAITED OUT A CLEANUP HOLDS THE CURRENT LEASE, NOT THE OLD ONE.
+//
+// The schedule the exclusivity test does not reach. A command opens the lease
+// while cleanup holds it exclusively and waits for the shared lock. Cleanup
+// removes the lease name and the tree before it lets go. The waiter then wakes on
+// the old object: unlinked on POSIX, delete-pending on Windows. Locking it
+// succeeds, and the acquisition used to return that as a lease. Nothing else
+// could ever see it: the next cleanup created a fresh lease at the name, locked
+// it unopposed, and reported the root unused while the command was running in
+// it. The two locks each succeeded and coordinated nothing.
+//
+// Both seams are used as barriers, not as failures. The cleanup barrier is
+// where the contender is started, so its open lands while cleanup owns the lease;
+// the creation seam is installed there too, rather than up front, because
+// cleanup's own open consults it on POSIX and would otherwise signal before the
+// contender exists. Reported by @gnanam1990.
+func TestAContenderThatWaitedOutACleanupHoldsTheCurrentLease(t *testing.T) {
+	root, _, leasePath := runtimeTreeAwaitingCompensation(t)
+	// Only the leaf is this run's, the same shape as the exclusivity test: the
+	// contender's retained parent handle must survive compensation, which is a
+	// different race from the one under test.
+	created := createdRuntimeDirsForTest(root)
+
+	opened := make(chan struct{})
+	entered := make(chan struct{})
+	var contender *sandboxRuntimeLease
+	var contenderErr error
+	runtimeCleanupExclusivityBarrier = func() {
+		runtimeCreationFailure = func(string) error {
+			select {
+			case <-opened:
+			default:
+				close(opened)
+			}
+			return nil
+		}
+		go func() {
+			defer close(entered)
+			contender, _, contenderErr = acquireRuntimeLeaseForPlatform(root)
+		}()
+		// The contender now holds a handle on the lease cleanup is about to
+		// remove, and is waiting for the lock cleanup holds.
+		<-opened
+	}
+	t.Cleanup(func() {
+		runtimeCleanupExclusivityBarrier = nil
+		runtimeCreationFailure = nil
+	})
+
+	if err := undoWindowsSetupRuntimeCreation(root, created, leasePath, true); err != nil {
+		t.Fatalf("compensation failed: %v", err)
+	}
+	<-entered
+	runtimeCreationFailure = nil
+	if contenderErr != nil {
+		t.Fatalf("the contender could not take the lease after cleanup finished: %v", contenderErr)
+	}
+	if contender == nil {
+		t.Fatal("SETUP INVALID: the contender returned neither a lease nor an error")
+	}
+	defer contender.release()
+
+	// The proof is the next cleanup: if the contender holds the current object,
+	// cleanup finds the root in use. If it holds the object cleanup already
+	// removed, cleanup locks a fresh one and calls the root free.
+	second, inUse, err := tryAcquireSandboxRuntimeCleanupLease(root)
+	if err != nil {
+		t.Fatalf("a second cleanup could not take the lease at all, so the contender is holding an object the name no longer resolves to: %v", err)
+	}
+	if !inUse {
+		second.release()
+		t.Fatal("a second cleanup found the root unused while the contender holds a lease on it: the contender locked the object cleanup had already removed")
+	}
+	if _, statErr := os.Stat(leasePath); statErr != nil {
+		t.Errorf("the contender's lease is not at the lease name: %v", statErr)
+	}
+
+	// CONTROL: once the contender lets go, the root really is free.
+	contender.release()
+	third, inUse, err := tryAcquireSandboxRuntimeCleanupLease(root)
+	if err != nil {
+		t.Fatalf("cleanup after the contender released: %v", err)
+	}
+	if inUse {
+		t.Fatal("the root is still reported in use after the contender released")
+	}
+	third.release()
+}

internal/sandbox/runtime_lease_windows.go

@@ -3,7 +3,6 @@
 package sandbox
 
 import (
-	"errors"
 	"os"
 
 	"golang.org/x/sys/windows"
@@ -14,34 +13,19 @@ type runtimeLeaseHandle struct {
 	overlapped windows.Overlapped
 }
 
-func acquireSharedRuntimeLease(path string) (runtimeLeaseHandle, error) {
-	file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
-	if err != nil {
-		return runtimeLeaseHandle{}, err
-	}
-	handle := runtimeLeaseHandle{file: file}
-	if err := windows.LockFileEx(windows.Handle(file.Fd()), 0, 0, 1, 0, &handle.overlapped); err != nil {
-		_ = file.Close()
-		return runtimeLeaseHandle{}, err
-	}
-	return handle, nil
-}
-
-func tryAcquireExclusiveRuntimeLease(path string) (runtimeLeaseHandle, bool, error) {
-	file, err := os.OpenFile(path, os.O_CREATE|os.O_RDWR, 0o600)
-	if err != nil {
-		return runtimeLeaseHandle{}, false, err
-	}
-	handle := runtimeLeaseHandle{file: file}
-	flags := uint32(windows.LOCKFILE_EXCLUSIVE_LOCK | windows.LOCKFILE_FAIL_IMMEDIATELY)
-	if err := windows.LockFileEx(windows.Handle(file.Fd()), flags, 0, 1, 0, &handle.overlapped); err != nil {
-		_ = file.Close()
-		if errors.Is(err, windows.ERROR_LOCK_VIOLATION) {
-			return runtimeLeaseHandle{}, true, nil
-		}
-		return runtimeLeaseHandle{}, false, err
-	}
-	return handle, false, nil
+// BOTH SIDES HAVE TO MEAN THE SAME OBJECT.
+//
+// This opened the lease by full pathname with os.OpenFile and no no-follow flag,
+// while shared acquisition opened it relative to a retained parent handle. A file
+// symbolic link at <digest>.lease therefore handed the two sides different
+// objects: setup or a running command held a shared lock on the link, cleanup
+// took an exclusive lock on its target, both calls succeeded, and cleanup went on
+// to RemoveAll a root somebody was still using.
+//
+// Mutual exclusion is a property of the OBJECT, so cleanup resolves the name the
+// way acquisition does and refuses the same reparse objects.
+func tryAcquireExclusiveRuntimeLease(root string) (runtimeLeaseHandle, bool, error) {
+	return tryAcquireExclusiveRuntimeLeaseRooted(root)
 }
 
 func (lease runtimeLeaseHandle) release() {

internal/sandbox/runtime_owned_tail_scope_test.go

@@ -0,0 +1,49 @@
+package sandbox
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+// THE SHAPE HAS TO HOLD FOR BOTH SPELLINGS OF THE FIRST COMPONENT.
+//
+// The cache-derived root uses the fixed name; the temp-derived fallback scopes
+// that component to the user wherever the temp root is shared. A tail that
+// stops matching loses the rooted no-follow traversal AND the owned-component
+// guard, and neither failure is visible where it happens.
+//
+// The scoped spelling does not exist on Windows, so without the seam this
+// branch could only ever be exercised by another platform's CI.
+func TestOwnedTailAcceptsBothFirstComponentSpellings(t *testing.T) {
+	previous := fallbackOwnedNamesForMatch
+	t.Cleanup(func() { fallbackOwnedNamesForMatch = previous })
+	fallbackOwnedNamesForMatch = func() []string {
+		return []string{windowsSandboxRuntimeOwnedNames[0] + "-u1001", "runtime", "v1"}
+	}
+
+	base := filepath.Join("C:", "shared")
+	for _, testCase := range []struct {
+		name  string
+		first string
+		want  bool
+	}{
+		{"fixed cache spelling", windowsSandboxRuntimeOwnedNames[0], true},
+		{"user-scoped fallback spelling", windowsSandboxRuntimeOwnedNames[0] + "-u1001", true},
+		{"a different user's scope", windowsSandboxRuntimeOwnedNames[0] + "-u2002", false},
+		{"an unrelated directory", "notzero", false},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			root := filepath.Join(base, testCase.first, "runtime", "v1", "abcdef0123456789")
+			if _, _, ok := windowsSandboxRuntimeOwnedTail(root); ok != testCase.want {
+				t.Errorf("owned tail for %s = %v, want %v", root, ok, testCase.want)
+			}
+		})
+	}
+
+	// The components below the first stay fixed for both spellings, or the
+	// traversal would accept a tree Zero does not own.
+	wrong := filepath.Join(base, windowsSandboxRuntimeOwnedNames[0]+"-u1001", "elsewhere", "v1", "abcdef0123456789")
+	if _, _, ok := windowsSandboxRuntimeOwnedTail(wrong); ok {
+		t.Errorf("owned tail accepted %s, whose middle component is not one Zero owns", wrong)
+	}
+}

internal/sandbox/runtime_physical_path.go

@@ -0,0 +1,15 @@
+//go:build !windows
+
+package sandbox
+
+// physicalSandboxPath resolves path to the spelling the filesystem itself uses.
+//
+// Off Windows that is what canonicalSandboxWorkspaceRoot already does:
+// filepath.EvalSymlinks follows every symlink, and there is no junction to
+// follow. Two aliases remain unresolved and are handled by the identity walk in
+// runtimeRootWithinWorkspace instead: a differing case on a case-insensitive
+// volume, which EvalSymlinks preserves, and a bind mount, which no userspace
+// path API resolves because the kernel deliberately presents it as a real path.
+func physicalSandboxPath(path string) string {
+	return canonicalSandboxWorkspaceRoot(path)
+}

internal/sandbox/runtime_physical_path_windows.go

@@ -0,0 +1,116 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"path/filepath"
+	"strings"
+
+	"golang.org/x/sys/windows"
+)
+
+const (
+	// GetFinalPathNameByHandle flags. golang.org/x/sys/windows does not export
+	// these; both are zero, and naming them keeps the call site readable.
+	fileNameNormalized = 0x0
+	volumeNameDOS      = 0x0
+)
+
+// physicalSandboxPath resolves path to the spelling the filesystem itself uses.
+//
+// canonicalSandboxWorkspaceRoot cannot do this on Windows. filepath.EvalSymlinks
+// returns a directory JUNCTION unchanged, so a TEMP that reaches into the
+// workspace through one still measures as outside it, and that is how a runtime
+// tree ends up inside the very workspace the sandbox exists to confine.
+// GetFinalPathNameByHandle answers with the target's real path, junctions and
+// mount points followed and casing as stored on disk.
+//
+// This deliberately opens WITHOUT FILE_FLAG_OPEN_REPARSE_POINT, the opposite of
+// openWindowsACLTarget. That helper must refuse to follow a reparse point,
+// because following one is the path-swap it guards against. Here the whole
+// question is where the reparse point leads, and the answer is only ever used to
+// decide that a runtime root is contained, never that it is safe.
+func physicalSandboxPath(path string) string {
+	cleaned := canonicalSandboxWorkspaceRoot(path)
+	if cleaned == "" || cleaned == "." {
+		return cleaned
+	}
+	// The runtime root does not exist yet at derivation time, which is the point.
+	// Resolve the deepest ancestor that does exist and re-append the rest, the
+	// same shape canonicalSandboxWorkspaceRoot uses for EvalSymlinks.
+	remainder := ""
+	current := cleaned
+	for {
+		if resolved, ok := finalWindowsPathName(current); ok {
+			if remainder == "" {
+				return resolved
+			}
+			return filepath.Join(resolved, remainder)
+		}
+		parent := filepath.Dir(current)
+		if parent == current {
+			// Nothing along the path could be opened. The cleaned form is the best
+			// answer available, and the caller's spelling comparison already ran.
+			return cleaned
+		}
+		remainder = filepath.Join(filepath.Base(current), remainder)
+		current = parent
+	}
+}
+
+func finalWindowsPathName(path string) (string, bool) {
+	utf16Path, err := windows.UTF16PtrFromString(path)
+	if err != nil {
+		return "", false
+	}
+	// Zero desired access is enough: GetFinalPathNameByHandle reads metadata, so
+	// this cannot be refused for lack of read rights on the directory contents.
+	handle, err := windows.CreateFile(
+		utf16Path,
+		0,
+		windows.FILE_SHARE_READ|windows.FILE_SHARE_WRITE|windows.FILE_SHARE_DELETE,
+		nil,
+		windows.OPEN_EXISTING,
+		windows.FILE_FLAG_BACKUP_SEMANTICS,
+		0,
+	)
+	if err != nil {
+		return "", false
+	}
+	defer func() { _ = windows.CloseHandle(handle) }()
+
+	buffer := make([]uint16, windows.MAX_PATH)
+	for attempt := 0; attempt < 2; attempt++ {
+		n, err := windows.GetFinalPathNameByHandle(handle, &buffer[0], uint32(len(buffer)), fileNameNormalized|volumeNameDOS)
+		if err != nil {
+			return "", false
+		}
+		if int(n) >= len(buffer) {
+			// TWO DIFFERENT CONVENTIONS, and the boundary is where they meet. On
+			// success the return value EXCLUDES the terminating null; on an
+			// insufficient buffer it INCLUDES it. So n == len(buffer) cannot be
+			// read as a complete path: a success that large would not have fitted
+			// its own terminator, which means the only reading left is a required
+			// size. Retrying on >= costs one extra call in a case that may not be
+			// reachable and removes the need to be right about which it was.
+			buffer = make([]uint16, int(n)+1)
+			continue
+		}
+		if n == 0 {
+			return "", false
+		}
+		return trimWindowsExtendedPrefix(windows.UTF16ToString(buffer[:n])), true
+	}
+	return "", false
+}
+
+// trimWindowsExtendedPrefix converts the \\?\ form GetFinalPathNameByHandle
+// returns into an ordinary path, so it compares against paths the rest of this
+// package builds with filepath.Join. \\?\UNC\server\share becomes
+// \\server\share; anything else loses the \\?\ and keeps its drive letter.
+func trimWindowsExtendedPrefix(path string) string {
+	if rest, ok := strings.CutPrefix(path, `\\?\UNC\`); ok {
+		return `\\` + rest
+	}
+	return strings.TrimPrefix(path, `\\?\`)
+}

internal/sandbox/runtime_record_states_windows_test.go

@@ -0,0 +1,208 @@
+//go:build windows
+
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// THE CREATION ITSELF HAS TO ESTABLISH THE IDENTITY.
+//
+// Win32 CreateFile cannot create a directory whatever disposition it is given,
+// so the CREATE_NEW attempt fell through to os.Mkdir plus a separate reopen on
+// EVERY real creation and the documented creation-handle contract never once
+// held. The runtime parent belongs to the ordinary user, who can rename the new
+// directory A away and drop an ordinary directory B at the predictable name in
+// between, and the ledger then records B for a directory this run never made.
+//
+// Driving the interleaving is not the point, and a barrier there would only
+// prove the window was still measurable. The property is that no reopen exists
+// to be raced: whatever the name resolves to afterwards, the recorded identity
+// is the object the create returned.
+func TestCreatedRuntimeDirIdentityComesFromTheCreation(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, "created")
+
+	// THE DETERMINISTIC BARRIER. The old shape resolved the pathname a second
+	// time after os.Mkdir, and that reopen is the whole window. Counting the
+	// resolutions turns "the creation establishes the identity" into something
+	// checked: on Windows the create returns the handle, so this must be zero.
+	resolutions := 0
+	restore := runtimeIdentityAfterCreate
+	runtimeIdentityAfterCreate = func(p string) (string, bool) {
+		resolutions++
+		return restore(p)
+	}
+	t.Cleanup(func() { runtimeIdentityAfterCreate = restore })
+
+	identity, identified, err := createRuntimeDirIdentified(path)
+	if err != nil || !identified {
+		t.Fatalf("create: identity=%q identified=%v err=%v", identity, identified, err)
+	}
+	if resolutions != 0 {
+		t.Errorf("the creation resolved the pathname again %d time(s); identity must come from the creation handle", resolutions)
+	}
+	info, statErr := os.Stat(path)
+	if statErr != nil || !info.IsDir() {
+		t.Fatalf("no directory was created: err=%v", statErr)
+	}
+
+	// Substitute the whole directory the way the parent's owner could, then ask
+	// what the name says now. The record must still describe what was created.
+	aside := filepath.Join(root, "moved-aside")
+	if err := os.Rename(path, aside); err != nil {
+		t.Skipf("cannot rename the runtime directory on this filesystem: %v", err)
+	}
+	if err := os.Mkdir(path, 0o700); err != nil {
+		t.Fatal(err)
+	}
+
+	substitute, ok := runtimeDirIdentity(path)
+	if !ok {
+		t.Fatal("the substitute could not be identified, so the comparison proves nothing")
+	}
+	if identity == substitute {
+		t.Fatal("SETUP INVALID: the substitute has the same identity as the created directory")
+	}
+	moved, ok := runtimeDirIdentity(aside)
+	if !ok {
+		t.Fatal("the created directory could not be identified after the rename")
+	}
+	if identity != moved {
+		t.Errorf("the recorded identity %q describes neither the created directory (%q) nor anything this run owns", identity, moved)
+	}
+}
+
+// A component another process created first must stay "not ours", and it must
+// keep saying so through os.IsExist, which is what the caller asks and which
+// does not unwrap a %w chain.
+func TestCreatedRuntimeDirRefusesAnExistingName(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "created")
+	if _, _, err := createRuntimeDirIdentified(path); err != nil {
+		t.Fatalf("first create: %v", err)
+	}
+	identity, identified, err := createRuntimeDirIdentified(path)
+	if !os.IsExist(err) {
+		t.Errorf("creating over an existing directory returned %v, want an IsExist error", err)
+	}
+	if identified || identity != "" {
+		t.Errorf("a refused create still produced an ownership record: identity=%q identified=%v", identity, identified)
+	}
+}
+
+// THE THREE STATES ARE DIFFERENT FACTS.
+//
+// "Read it and there was nothing" and "could not read it" both used to arrive as
+// existed=false. The stamp writer uses FILE_OVERWRITE_IF and can replace an
+// existing stamp even where the read was denied, so that lie let a setup which
+// then FAILED delete an attestation it had no record of, leaving the previous
+// run's marker pointing at a runtime root it can no longer prove.
+func TestRuntimeStampSnapshotSeparatesAbsentPresentAndUnknown(t *testing.T) {
+	t.Run("absent", func(t *testing.T) {
+		root := t.TempDir()
+		_, _, prior, state, err := snapshotRuntimeStampBound(root, windowsSandboxRuntimeStampName(testStampPlanHash))
+		if err != nil {
+			t.Fatalf("a readable root with no stamp is not an error: %v", err)
+		}
+		if state != runtimeStampAbsent {
+			t.Errorf("state = %v, want absent", state)
+		}
+		if prior != nil {
+			t.Errorf("absent produced prior bytes %q", prior)
+		}
+	})
+
+	t.Run("present", func(t *testing.T) {
+		root := t.TempDir()
+		want := []byte("prior-attestation")
+		if err := os.WriteFile(filepath.Join(root, windowsSandboxRuntimeStampName(testStampPlanHash)), want, 0o600); err != nil {
+			t.Fatal(err)
+		}
+		_, _, prior, state, err := snapshotRuntimeStampBound(root, windowsSandboxRuntimeStampName(testStampPlanHash))
+		if err != nil {
+			t.Fatalf("snapshot: %v", err)
+		}
+		if state != runtimeStampPresent {
+			t.Errorf("state = %v, want present", state)
+		}
+		if string(prior) != string(want) {
+			t.Errorf("prior = %q, want %q", prior, want)
+		}
+	})
+
+	// A stamp NAME that cannot be read as a file. The child open is refused for a
+	// reason that is emphatically not "not found", which is the whole distinction.
+	t.Run("unknown", func(t *testing.T) {
+		root := t.TempDir()
+		if err := os.Mkdir(filepath.Join(root, windowsSandboxRuntimeStampName(testStampPlanHash)), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		_, _, prior, state, err := snapshotRuntimeStampBound(root, windowsSandboxRuntimeStampName(testStampPlanHash))
+		if err == nil {
+			t.Fatal("an unreadable stamp was reported as a successful snapshot")
+		}
+		if state != runtimeStampUnknown {
+			t.Errorf("state = %v, want unknown", state)
+		}
+		if prior != nil {
+			t.Errorf("unknown produced prior bytes %q", prior)
+		}
+	})
+}
+
+// AND UNKNOWN MUST NOT AUTHORIZE COMPENSATION.
+//
+// The forward mutation is refused before it begins, so this asserts the second
+// half: a record that somehow reached compensation with an unproven prior state
+// leaves the current stamp alone and says so, rather than deleting it and
+// returning with nothing to put back.
+func TestUnknownPriorStampIsNeverCompensated(t *testing.T) {
+	root := t.TempDir()
+	stampPath := filepath.Join(root, windowsSandboxRuntimeStampName(testStampPlanHash))
+	current := []byte("the-attestation-of-the-previous-successful-setup")
+	if err := os.WriteFile(stampPath, current, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	identity, identified := runtimeDirIdentity(root)
+	if !identified {
+		t.Fatal("SETUP INVALID: the runtime root could not be identified")
+	}
+
+	snapshot := windowsSandboxStampSnapshot{
+		path:           stampPath,
+		priorState:     runtimeStampUnknown,
+		root:           root,
+		rootIdentity:   identity,
+		rootIdentified: true,
+	}
+	err := snapshot.restore()
+	if err == nil {
+		t.Fatal("compensation acted on a prior state it never established, and reported success")
+	}
+
+	after, readErr := os.ReadFile(stampPath)
+	if readErr != nil {
+		t.Fatalf("the existing stamp was destroyed by a rollback that had nothing to restore: %v", readErr)
+	}
+	if string(after) != string(current) {
+		t.Errorf("the existing stamp was rewritten: got %q, want %q", after, current)
+	}
+}
+
+// And setup refuses BEFORE the ACL and stamp are applied, which is the half that
+// keeps the writer from running at all.
+func TestSetupRefusesAnUnreadablePriorStamp(t *testing.T) {
+	root := t.TempDir()
+	if err := os.Mkdir(filepath.Join(root, windowsSandboxRuntimeStampName(testStampPlanHash)), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	snapshot, err := snapshotWindowsSandboxRuntimeStamp(root, testStampPlanHash)
+	if err == nil {
+		t.Fatal("setup accepted a snapshot that could not read the prior stamp")
+	}
+	if snapshot.priorState != runtimeStampUnknown {
+		t.Errorf("the refused snapshot carried state %v, want unknown", snapshot.priorState)
+	}
+}

internal/sandbox/runtime_recorded_fallback_test.go

@@ -0,0 +1,134 @@
+package sandbox
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// A RECORDED ROOT IS HISTORY. IT MUST NOT BE RE-DERIVED FROM TODAY'S TEMP.
+//
+// Setup reaches the temp fallback when the preferred cache-derived root cannot
+// be leased, and it records that concrete root in the marker. Command selection
+// then recognised the record only by deriving today's fallback from this
+// process's TEMP and comparing. A later IDE, service or terminal running with a
+// different TEMP therefore matched neither of today's candidates: the record was
+// ignored, selection produced a tree setup never provisioned, and the runner
+// rejected the marker as out of date. Re-running setup from the original
+// environment repeats the original answer and does not make the other
+// environment converge.
+//
+// The record is now recognised by its own shape instead, which is the question
+// that was actually being asked: does this belong to this workspace and home.
+//
+// Not gated on Windows. The marker only exists where setup wrote one, so this is
+// Windows-only in practice, but keeping it platform-neutral means the
+// setup-to-command contract runs on every CI runner rather than only one.
+func TestARecordedFallbackSurvivesATempChange(t *testing.T) {
+	home := t.TempDir()
+	workspace := canonicalSandboxWorkspaceRoot(t.TempDir())
+	// The cache is an input of the preferred candidate, so it is owned as well.
+	// Left alone it made the result depend on the machine, and gave this test two
+	// more ways to skip instead of asserting.
+	cacheRoot := t.TempDir()
+	originalCacheDir := sandboxUserCacheDir
+	sandboxUserCacheDir = func() (string, error) { return cacheRoot, nil }
+	t.Cleanup(func() { sandboxUserCacheDir = originalCacheDir })
+
+	// EVERY temp variable, in both phases. With only TMP and TEMP set this
+	// changed nothing on Unix: the fallback derived from the ambient TMPDIR, the
+	// MkdirAll below created a workspace-digest tree outside anything this test
+	// owns, the second derivation came back identical, and the test skipped
+	// having asserted nothing and left the directory behind.
+	tempA := t.TempDir()
+	redirectSandboxTestTemp(t, tempA)
+	recorded, err := fallbackSandboxRuntimeRoot(workspace)
+	if err != nil {
+		t.Fatalf("SETUP INVALID: no fallback runtime root under a temp this test owns: %v", err)
+	}
+	// Containment BEFORE the tree exists, so cleanup belongs to tempA and happens
+	// even when an assertion below fails.
+	requireWithinTestOwned(t, recorded, tempA)
+	if err := os.MkdirAll(recorded, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	writeRecordedRoot(t, home, recorded)
+
+	// SETUP: with the original TEMP the record is honoured, so a failure after the
+	// flip is about the flip and not about the record being unusable.
+	preferred := preferredRuntimeRootFor(t, workspace)
+	if got := pinnedSandboxRuntimeRoot(workspace, preferred, recorded, home); got != recorded {
+		t.Fatalf("SETUP INVALID: the record is not honoured even before the temp change: got %q, want %q", got, recorded)
+	}
+
+	// The same command, run later from an environment with a different TEMP.
+	tempB := t.TempDir()
+	redirectSandboxTestTemp(t, tempB)
+	derivedNow, err := fallbackSandboxRuntimeRoot(workspace)
+	if err != nil {
+		t.Fatalf("SETUP INVALID: no fallback runtime root under the second temp: %v", err)
+	}
+	requireWithinTestOwned(t, derivedNow, tempB)
+	// A FAILURE, NOT A SKIP. The redirect owns every input the derivation reads,
+	// so an unmoved fallback means the premise of this test is broken, and a skip
+	// here is how it passed on Unix without ever reaching the assertion below.
+	if sameWindowsRuntimeRootPath(derivedNow, recorded) {
+		t.Fatalf("SETUP INVALID: the temp change did not move the derived fallback (%s), so the assertion below would prove nothing", derivedNow)
+	}
+
+	if got := pinnedSandboxRuntimeRoot(workspace, preferred, derivedNow, home); got != recorded {
+		t.Fatalf("selection abandoned the root setup provisioned after only TEMP changed: got %q, want the recorded %q", got, recorded)
+	}
+}
+
+// preferredRuntimeRootFor is the cache-derived candidate, which must stay a
+// candidate: this change is about the fallback only.
+func preferredRuntimeRootFor(t *testing.T, workspace string) string {
+	t.Helper()
+	cacheRoot, err := sandboxUserCacheDir()
+	if err != nil {
+		t.Fatalf("SETUP INVALID: no user cache directory: %v", err)
+	}
+	root, err := sandboxRuntimeRootFor(workspace, canonicalSandboxWorkspaceRoot(cacheRoot))
+	if err != nil {
+		t.Fatalf("SETUP INVALID: no preferred runtime root under a cache this test owns: %v", err)
+	}
+	return root
+}
+
+// AND THE PROTECTION THAT MADE THE OLD COMPARISON WORTH HAVING STAYS.
+//
+// Recognising the record by shape must not turn into recognising anybody's
+// record. A fallback root belonging to a DIFFERENT workspace has the same owned
+// shape and a different digest, so it is still refused.
+func TestARecordedFallbackForAnotherWorkspaceIsStillRefused(t *testing.T) {
+	home := t.TempDir()
+	mine := canonicalSandboxWorkspaceRoot(t.TempDir())
+	theirs := canonicalSandboxWorkspaceRoot(t.TempDir())
+
+	temp := t.TempDir()
+	redirectSandboxTestTemp(t, temp)
+
+	theirRoot, err := fallbackSandboxRuntimeRoot(theirs)
+	if err != nil {
+		t.Fatalf("SETUP INVALID: no fallback runtime root under a temp this test owns: %v", err)
+	}
+	requireWithinTestOwned(t, theirRoot, temp)
+	writeRecordedRoot(t, home, theirRoot)
+
+	if got := pinnedSandboxRuntimeRoot(mine, filepath.Join(t.TempDir(), "preferred"), filepath.Join(t.TempDir(), "fallback"), home); got != "" {
+		t.Fatalf("pinned %q, which was provisioned for another workspace", got)
+	}
+}
+
+// A record with no owned runtime shape at all is refused too, so the shape test
+// is doing work rather than waving anything through.
+func TestARecordedRootWithoutTheOwnedShapeIsRefused(t *testing.T) {
+	home := t.TempDir()
+	workspace := canonicalSandboxWorkspaceRoot(t.TempDir())
+	writeRecordedRoot(t, home, filepath.Join(t.TempDir(), "not-a-runtime-root"))
+
+	if got := pinnedSandboxRuntimeRoot(workspace, filepath.Join(t.TempDir(), "preferred"), filepath.Join(t.TempDir(), "fallback"), home); got != "" {
+		t.Fatalf("pinned %q, which has none of the owned runtime shape", got)
+	}
+}