v1.88.1.0 fix: harden credential boundaries and owned state (#2942)

* fix(settings): preserve symlinked settings targets

Resolve the selected target for locking, mutation, backup, and rollback; refuse target changes and preserve private modes. Addresses #2830.

* fix(redact): bind masking to original detected spans

Inspired by #2929's anchored-span diagnosis; independently implemented using normalization offsets. Addresses #2930 and the relocation portion of #2912 without changing detection sensitivity.

* fix(evals): exclude operator credentials from prefix admission

Adapts the credential-suffix screen proposed in #2636, with real launched-child regression coverage and deliberate provider-auth exceptions.

* fix(artifacts): retain custom allowlist rules on reinitialization

Preserve the exact user-owned suffix and publish only a successfully assembled replacement. Independently implements the repair reported in #2907.

* test(cso): verify exact masked reads and unmaskable payload refusal

* fix(cso): preserve exact filesystem identities through lease recovery

Preserve 64-bit device/inode identity and nanosecond race checks. Add native NTFS lifecycle coverage for #2927; retain ambiguous legacy-state refusal without claiming Windows PID-reuse recovery is resolved.

* fix(redact): bind pre-push scans to destination and preserve seam context

Uses #2935 (bd07318) as source evidence for push-target range and slice-overlap defects. Independently implemented; no cherry-pick or release metadata adoption.

* test(ci): gate native agent ownership and settings links on macOS

* fix(browse): bind agent lifetimes and cleanup to owned generations

Uses #2931 by Chris Hutton / Claude Fable 5.1 as attributed design input; independently implemented without broad sweeps or copied code. Keep uncertain children and locks rather than deleting foreign state.

* test(ci): include concurrent shutdown controls in the native macOS gate

* v1.88.1.0 fix: harden credential boundaries and owned state

* fix(redact): preserve target provenance and scan boundary semantics

* test(artifacts): read managed rules from atomic allowlist assembly

* fix: preserve native exit observations and fixture prerequisites

* fix: preserve UTF-16 offsets through redaction normalization

browse/test/process-liveness-windows.test.ts

@@ -1,4 +1,5 @@
-import { describe, test, expect } from 'bun:test';
+import { describe, test, expect, spyOn } from 'bun:test';
+import * as childProcess from 'node:child_process';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -103,34 +104,54 @@ describe('process liveness probe (Windows terminal-agent leak)', () => {
     expect(offenders).toEqual([]);
   });
 
-  test('5. spawnTerminalAgent passes windowsHide so no console is shown', () => {
+  test('5. spawnTerminalAgent passes windowsHide so no console is shown', async () => {
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-hide-'));
     const script = path.join(tmpDir, 'fake-agent.ts');
     fs.writeFileSync(script, '// no-op\n');
     const origSpawn = (Bun as any).spawn;
+    const originalProbe = Bun.spawnSync;
+    const originalWindowsProbe = childProcess.spawnSync;
+    const probe = spyOn(Bun, 'spawnSync').mockImplementation(((command: string[], options: any) => {
+      if (command[0] === 'ps' && command[2] === String(process.pid)) {
+        return { exitCode: 0, stdout: Buffer.from('fixture-owner-start'), stderr: Buffer.alloc(0) };
+      }
+      return originalProbe(command, options);
+    }) as typeof Bun.spawnSync);
+    const windowsProbe = spyOn(childProcess, 'spawnSync').mockImplementation(((command: string, args: string[], options: any) => {
+      if (command === 'powershell.exe') {
+        const owner = args.join(' ').includes(`ProcessId = ${process.pid}'`);
+        return { status: 0, stdout: JSON.stringify(owner ? { CreationDate: 'fixture-owner-start', CommandLine: 'test-owner' } : null), stderr: '' };
+      }
+      return originalWindowsProbe(command, args, options);
+    }) as typeof childProcess.spawnSync);
+    const exited = Promise.resolve(0);
     let captured: any = null;
     (Bun as any).spawn = (_cmd: any, opts: any) => {
       captured = opts;
-      return { pid: 4242, unref() {} };
+      return { pid: 2147483647, exited, kill() {}, unref() {} };
     };
     try {
-      const pid = spawnTerminalAgent({
+      expect(() => spawnTerminalAgent({
         stateFile: path.join(tmpDir, 'state.json'),
         serverPort: 12345,
         ownerPid: process.pid,
         cwd: tmpDir,
         scriptPath: script,
-      });
-      expect(pid).toBe(4242);
+      })).toThrow('terminal-agent process identity is unavailable');
       expect(captured).not.toBeNull();
       expect(captured.windowsHide).toBe(true);
       // Owner-PID lifetime tie (#2019): the agent polls this and exits when
       // its owning browse server dies, so it can't be adopted by PID 1.
       expect(captured.env.BROWSE_OWNER_PID).toBe(String(process.pid));
+      expect(captured.env.BROWSE_OWNER_START_TIME).toBe('fixture-owner-start');
       // Detached background daemon — must not inherit a terminal either.
       expect(captured.stdio).toEqual(['ignore', 'ignore', 'ignore']);
+      await exited;
+      expect(fs.existsSync(path.join(tmpDir, 'terminal-agent-pid'))).toBe(false);
     } finally {
       (Bun as any).spawn = origSpawn;
+      windowsProbe.mockRestore();
+      probe.mockRestore();
       fs.rmSync(tmpDir, { recursive: true, force: true });
     }
   });