From a0a88d040c69dead80f350bbf4b9a313917618ab Mon Sep 17 00:00:00 2001
From: YEONGUK LEE <contact@abruption.dev>
Date: Sun, 18 Oct 2026 12:44:12 +0900
Subject: [PATCH 1/4] test: measure macOS fileport and restricted observer
 visibility

---
 .../workflows/macos-visibility-research.yml   |   69 +
 experimental/127-macos-visibility/HANDOFF.md  |  102 ++
 experimental/127-macos-visibility/README.md   |  376 +++++
 .../127-macos-visibility/fileport_actor.c     |  510 ++++++
 .../127-macos-visibility/test_visibility.py   | 1076 +++++++++++++
 .../127-macos-visibility/visibility.py        | 1412 +++++++++++++++++
 6 files changed, 3545 insertions(+)
 create mode 100644 .github/workflows/macos-visibility-research.yml
 create mode 100644 experimental/127-macos-visibility/HANDOFF.md
 create mode 100644 experimental/127-macos-visibility/README.md
 create mode 100644 experimental/127-macos-visibility/fileport_actor.c
 create mode 100644 experimental/127-macos-visibility/test_visibility.py
 create mode 100644 experimental/127-macos-visibility/visibility.py

diff --git a/.github/workflows/macos-visibility-research.yml b/.github/workflows/macos-visibility-research.yml
new file mode 100644
index 0000000..f081c2d
--- /dev/null
+++ b/.github/workflows/macos-visibility-research.yml
@@ -0,0 +1,69 @@
+name: macOS visibility research
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/macos-visibility-research.yml'
+      - 'experimental/127-macos-contract/**'
+      - 'experimental/127-macos-visibility/**'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  synthetic-visibility:
+    name: macOS fileport and visibility fixtures (${{ matrix.runner }})
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [macos-15, macos-15-intel]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Record toolchain
+        run: |
+          sw_vers -productVersion
+          /usr/bin/clang --version | head -n 1
+          /usr/sbin/lsof -v 2>&1 | grep -E '^ *revision:' || true
+          python3 -V
+          if test -x /usr/bin/sandbox-exec; then echo 'sandbox-exec present'; else echo 'sandbox-exec absent'; fi
+      - name: Deterministic evaluator and actor tests
+        env:
+          RESEARCH_TMP_ROOT: ${{ runner.temp }}
+        run: |
+          if python3 -I -B -W error::ResourceWarning experimental/127-macos-visibility/test_visibility.py > "$RUNNER_TEMP/visibility-tests.log" 2>&1; then
+            echo 'visibility tests passed'
+          else
+            echo 'visibility tests failed; raw diagnostics kept private'
+            exit 1
+          fi
+          if python3 -I -B -W error::ResourceWarning experimental/127-macos-contract/test_inherit.py > "$RUNNER_TEMP/inherit-tests.log" 2>&1; then
+            echo 'inherit tests passed'
+          else
+            echo 'inherit tests failed; raw diagnostics kept private'
+            exit 1
+          fi
+      # Prints only the allowlisted public summary. The raw result (paths,
+      # PIDs, service names, stderr) stays in RUNNER_TEMP and is not uploaded.
+      # A not_executed scenario, failed control or failed cleanup exits
+      # nonzero: there is no green result for an unmeasured scope.
+      - name: Measure fileport, hidden-sharer and sandbox visibility fixtures
+        run: |
+          root="$(mktemp -d "$RUNNER_TEMP/codex-127v-XXXXXX")"
+          chmod 700 "$root"
+          python3 -I -B experimental/127-macos-visibility/visibility.py \
+            --scratch-root "$root" --result "$RUNNER_TEMP/visibility.json" 2> "$RUNNER_TEMP/visibility.stderr"
+      - name: Record bounded evidence summary
+        if: ${{ !cancelled() }}
+        run: |
+          raw="$RUNNER_TEMP/visibility.json"
+          if [ ! -f "$raw" ]; then
+            echo '{"present": false}'
+            exit 0
+          fi
+          shasum -a 256 "$raw" | cut -d ' ' -f 1
+          python3 -I -B experimental/127-macos-visibility/visibility.py --summarize "$raw"
diff --git a/experimental/127-macos-visibility/HANDOFF.md b/experimental/127-macos-visibility/HANDOFF.md
new file mode 100644
index 0000000..7d0ddff
--- /dev/null
+++ b/experimental/127-macos-visibility/HANDOFF.md
@@ -0,0 +1,102 @@
+# Handoff: proposed follow-ups outside this directory
+
+This directory owns no other file. The changes below are proposals only.
+`docs/macos-owner-contract.md`, `experimental/127-macos-contract/` and
+`experimental/127-macos-prerequisites/` were read and left unchanged. Nothing
+here reproduces a real Codex process or a wrong signal to a real PID.
+
+## 1. `docs/macos-owner-contract.md` (proposal)
+
+Section 4, gap table:
+
+| Row | Proposed status |
+| --- | --- |
+| Inherited FD / Mach fileport passing | Measured (same-user synthetic, macOS 27.0.1 arm64, APFS). Lock held while the description is only in a queued Mach message, with no opener in `lsof` and no fileport in `PROC_PIDLISTFILEPORTS`. A fileport in a task's port space is printed as FD `fp.` with the description's flags. The receiver that never called `flock` becomes the sole holder with the bit. See `experimental/127-macos-visibility/README.md`. |
+| Inherited FD / shared description with a hidden sharer | Measured as a model (#139 M2 style omission). With `SCM_RIGHTS` (either sharer hidden) and with fork (child hidden), the filter returns `not_excluded` for the visible sharer, which really shares the locked description. The lock stays held after that sharer releases. Recorded as `release_incomplete_due_to_hidden_reference`: one sharer's release does not release the lock. It is not a non-holder misidentified as the holder. |
+| Permission / same-user target under `sandbox-exec` | Measured for `(allow default)` and one deny-default profile: target fully visible to an unsandboxed observer. Hardened runtime and App Sandbox not covered. |
+| Permission / observer running sandboxed | Measured for five profiles, against a positive control with a full contract. `(deny process-info-pidfdinfo)` and a deny-default profile give exit 1, empty stdout and empty stderr, identical to "no openers". Detected here only by cross-checks (held probe, canary holder). Selective omission of some targets not covered and not detected by these checks. |
+
+Section 2, counterexample rows to add:
+
+| Counterexample | What the observer sees | Source |
+| --- | --- | --- |
+| Description in flight in a Mach message (fileport) | Held probe, no opener, no fileport listed anywhere | `127-macos-visibility` |
+| Description held only as a fileport in a task's port space | `lsof` FD `fp.` with `FWASLOCKED`; no numeric descriptor | `127-macos-visibility` |
+| Fileport converted by a process that never called `flock` | Receiver carries the bit and is the sole holder | `127-macos-visibility` |
+| Hidden second sharer of the locked description | Visible sharer is a real sharer, `not_excluded`; its release leaves the lock held | `127-macos-visibility` |
+| Restricted observer (sandbox) | Exit 1, empty output, no stderr: indistinguishable from "no openers" | `127-macos-visibility` |
+
+Keep the hidden-sharer row separate from the existing former-holder row: the
+former holder is a non-holding process that the filter does not refuse.
+
+Section 1 currently lists "Descriptor passing (`SCM_RIGHTS`, Mach fileports)"
+as not excluded by the source reading. That stays true: these fixtures show
+the OS mechanism, not that Codex uses it.
+
+## 2. Candidate inputs for option (b), not adopted
+
+These are design candidates for the separately reviewed (b) change. Nothing
+is implemented in `src/`. Adopting them, and accepting the residual risks,
+remain user decisions.
+
+1. Parse `lsof +fg` strictly. Any non-numeric FD, including `fp.`, makes the
+   scan `unknown`. It must not be skipped and must not count as a descriptor.
+2. A held probe with no visible opener is `unknown`, never "stale" or clean.
+3. A visibility canary: a descriptor the observer owns and must see exactly
+   in the same scan mode. A missing canary is `unknown`. It catches a
+   restriction of the whole observer. It does not detect selective omission.
+4. Residuals that stay documented with (b):
+   - a former holder that keeps its FD;
+   - a hidden sharer of one description, including fileport and
+     `SCM_RIGHTS` receivers that never called `flock`, where one sharer's
+     release does not release the lock;
+   - a description in flight;
+   - clean whole-record or selective omission.
+
+## 3. CI integration
+
+The integrating reviewer added `.github/workflows/macos-visibility-research.yml`
+from the handoff proposal. Its first hosted runs remain pending.
+
+- Runners: `macos-15` and `macos-15-intel`, with read-only `contents`
+  permission and checkout pinned to the same SHA as the existing macOS
+  workflow.
+- Steps: the deterministic tests of this directory and of
+  `127-macos-contract`, then one measurement run.
+- Summary: the SHA-256 of the raw result plus `visibility.py --summarize`
+  output.
+- Privacy: the measurement prints an allowlisted public summary. Actor and
+  test diagnostics stay private; test steps print fixed pass/fail status.
+  Raw results and logs are not uploaded.
+
+The original proposal was checked with `git apply --check` and YAML parsing.
+The integrated workflow also hides raw test/measurement stderr. `--summarize`
+was run locally against a result; hosted execution is recorded separately.
+
+A `not_executed` scenario, a failed control, an incomplete wait or a failed
+cleanup exits nonzero. There is no green result for an unmeasured scope. If a
+hosted runner cannot run something, the public summary names the
+`not_executed` kind or the failure kind, and the unmeasured scope must be
+reported from that.
+
+Risks to check on the first CI run:
+
+- `bootstrap_check_in` with a dynamic name worked in an interactive user
+  session here. A hosted runner's launchd domain may refuse it. The receiver
+  then emits `failed`, and the run fails visibly.
+- `sandbox-exec` may be unusable inside the runner's own confinement. The
+  sandbox scenarios are then `not_executed`, which keeps `ok` false.
+- A loaded runner can push an `lsof` call over its 5 s bound. This happened
+  once locally (run 5). It is recorded as incomplete, never stopped, and
+  fails the run.
+- The expected tables were measured only on macOS 27 / lsof 4.91. Kernel 24.x
+  may differ. A mismatch there is data, not a test bug.
+
+## 4. Policy decisions left to the user
+
+- Whether the hidden-sharer release and in-flight fileport shapes are
+  acceptable residuals for (b), or move macOS toward (c).
+- Whether (b) should adopt the canary and the held-without-opener rule as
+  candidates, knowing they do not detect selective omission.
+- Whether to adopt the CI proposal. `not_executed` must stay a failure either
+  way.
diff --git a/experimental/127-macos-visibility/README.md b/experimental/127-macos-visibility/README.md
new file mode 100644
index 0000000..5ac230e
--- /dev/null
+++ b/experimental/127-macos-visibility/README.md
@@ -0,0 +1,376 @@
+# #127 fileport, hidden-sharer and restricted-visibility fixtures (macOS)
+
+Unpublished research for [#127](https://github.com/abruption/codex-unlock/issues/127).
+It is outside the npm `files` list and is not run by `npm test`. It changes no
+runtime behavior, JSON output or signal path, and it applies no filter in
+`src/`. Proposed changes to the decision record are in [HANDOFF.md](HANDOFF.md).
+
+`visibility.py` starts only its own same-user actors on fresh fixture files in
+a private scratch directory. It never touches a Codex home or a Codex process.
+Nothing here reproduces a real Codex process or a wrong signal to a real PID.
+It reuses the read-only [`127-macos-contract/inherit.py`](../127-macos-contract/README.md)
+for framing with byte caps, bounded no-signal diagnostics, strict `lsof -F0pfG`
+parsing, exclusive result creation and the `SCM_RIGHTS`/fork actors. The C
+actor, `fileport_actor.c`, is compiled into the scratch directory with
+`/usr/bin/clang` at run time. Its binary is never committed.
+
+## Scenarios
+
+| Scenario | Shape |
+| --- | --- |
+| `fileport` | A C sender flocks the fixture, makes a Mach fileport and moves it in a Mach message to a C receiver that the script started separately (not the sender's descendant). The sender then closes its FD. The receiver later receives the port and converts it with `fileport_makefd`. |
+| `hidden_sharer` | One description shared by `SCM_RIGHTS` (either sharer hidden) or by fork without exec (child hidden). The hidden sharer is removed from the observer's view by a model, as in #139 M2 Part 2. The visible sharer then releases on its own (FD close or stdin-EOF exit, never a signal) and the lock is probed again. |
+| `sandbox_observer` | A target holder and a canary holder run normally. `lsof` and the flock probe run under `sandbox-exec` profiles written to the scratch directory. |
+| `sandbox_target` | The holder runs under `sandbox-exec`; the observer does not. |
+| `former_vs_opener` | A former holder (`flock`, `LOCK_UN`, FD kept) next to a never-locked opener, then an actual holder is added and hidden by the model. |
+
+Per stage the script records the independent nonblocking flock probe, the
+`lsof +fg` `FWASLOCKED` bit per role, and the refusal-only filter decision.
+`fileport` also records each task's `PROC_PIDLISTFILEPORTS`, including the
+`FWASLOCKED` bit of a fileport that names the fixture. Each scenario's record
+is registered in the result before it runs, and stages are appended as they
+are observed, so an exception keeps the earlier stages.
+
+## Decision vocabulary
+
+Only `unknown`, `reject` and `not_excluded` are produced. `not_excluded` only
+means "not refused by this filter". The bit is sticky after `LOCK_UN` and is
+never treated as holder evidence. `filter_decision` follows the #139 M2 rules.
+`visibility_decision` adds cross-checks that can only turn a decision into
+`unknown`:
+
+| Condition | Decision |
+| --- | --- |
+| Canary holder not seen exactly (when scanned) | `unknown:canary_not_visible` |
+| Probe error | `unknown:probe_error` |
+| Invalid scan (status, stderr, malformed or truncated output, a fileport `fp.` record) | `unknown:scan_invalid` |
+| Probe `held` and no visible opener | `unknown:held_without_visible_opener` |
+| PID absent | `unknown:pid_absent` |
+| No descriptor of the PID has the bit | `reject:bit_absent_on_all` |
+| At least one descriptor has the bit | `not_excluded:bit_present` |
+
+The canary and held-without-opener checks catch a restriction of the whole
+observer. They do not detect a selective omission of some processes. They are
+candidate design inputs for option (b), not adopted product rules.
+
+## Fileport enumeration
+
+`listfileports` reports `ok: true` only for a complete enumeration. These
+cases give `ok: false` with an error kind, never a zero count: the fixture
+identity (`stat`) failing (`identity`), the list call failing (`list`,
+`list_esrch`), a list length that is not whole entries (`list_length`), a
+full 64-entry buffer (`saturated`, because more entries may exist), and a
+vnode query that fails or returns a short record (`query`, `short_read`).
+Fileports whose type is not a vnode are counted in `non_vnode` and not
+queried. The fixture is a regular file, so only a vnode fileport can name it.
+That exclusion is limited to this fixture. On the Python side an error becomes
+`error:<kind>`, which never matches the expected `count=…` value, so the
+stage mismatches. A malformed or inconsistent event becomes `invalid`.
+
+## Results
+
+Darwin 27.0.0 arm64 (macOS 27.0.1), Python 3.15.0, Apple clang 21.0.0, lsof
+4.91 (`/usr/sbin/lsof`), APFS, same user, worktree base `6082a34a`,
+2026-10-18. Raw results are private because they contain local paths, PIDs
+and service names.
+
+### Handed-off revision (before root review corrections)
+
+Sources: `visibility.py` `9686152008f0d5a52184881af2cc7b258edd7bf27168a15a4281fd3f132b3016`,
+`fileport_actor.c` `c17980bcbb230753855172a36dbb8b6272cdcf37158fb8a2d7bf66426c94c211`,
+`inherit.py` `44215d458e53b7ddd038db32a65746b2fdf1402258563cac4f48f682dee51bac`.
+Binary `fe7e0f80624b833729f1aefbb272d4caaf0dbb64493aad4cd6a95f88a8ca439d`.
+Start and end source hashes matched in every run.
+
+| Run | Outcome | Raw result SHA-256 | Public stdout SHA-256 |
+| --- | --- | --- | --- |
+| 5 | exit 1, `run_ok` false. One `lsof` diagnostic (in `hidden_sharer/fork_hide_child/all_closed`) exceeded its 5 s bound. It was recorded as incomplete and not stopped, and it later exited with status 1. That stage's scan was therefore invalid (the only mismatch). Cleanup: `preserved` (`measurement_not_ok`); the fixture directory was kept. Bootstrap name removed. | `a793d61c7fbf699c1ee1b9e7dc38a61208786f857765939809e8d28ae0583a90` | `cbe13b5f4a896e7b59f100daa6e003e1574c9b565489fd2921cba32f0796c2fe` |
+| 6 | exit 0: `measurement_ok`, `run_ok`; nothing `not_executed`; no failures, incomplete waits, mismatches or pending diagnostics; cleanup `removed` (17 registered names); bootstrap name removed | `16fc95b249bc3352653bc7edbee3ec7c317d7a14e1886d5307996709a92a4347` | `6110937dc0d108ccccc4c39c71cd34555e5d19730aaf0f1c98931eb0c4832784` |
+| 7 | same as run 6 | `b6188ba39201e91050fd346040f73c3a7c5ea0b716d1d72ebe7bfda067fb4997` | `6110937dc0d108ccccc4c39c71cd34555e5d19730aaf0f1c98931eb0c4832784` |
+
+For runs 5–7, the public stdout was checked for every PID in the raw result,
+the bootstrap service name, the scratch path, `/Volumes`, `/Users` and
+`Traceback`. None appeared, and stderr was empty. `--summarize` on run 6's
+raw result produced byte-identical output.
+
+### Integrating reviewer validation
+
+After the CLI reviews, the integrating reviewer strengthened restricted-probe
+and case/exit evidence, captured actor stderr, and preserved setup failures.
+The first nominal validation rejected two bookkeeping details in the stricter
+evaluator: a fileport PID without a numeric FD, and an unused outer `stages`
+field. It exited 1; raw SHA-256
+`27a81c086c141e47d8ce598948ff298b74e7491e398b1b8df35be51a297546bf`.
+After correcting those contracts, 80 visibility tests and 23 inheritance tests
+passed, and one nominal run exited 0 with `measurement_ok`/`run_ok`, no
+mismatches/errors/incomplete waits, and cleanup `removed`. Raw SHA-256:
+`5133e330ad798a87ecf9120788e46ca884b7e6ec1a704bd8f5723814f00d049b`.
+Start/end source hashes agreed: `visibility.py`
+`9dd55023765c0f873b25d1baacd609b0862f3105f597f82049f05f06be676b2d`,
+`fileport_actor.c`
+`ab295109045e6ac349b069f27b7b182945b7eb715a2ed9469ee49f856c613972`.
+This validates the revised harness on the same local macOS environment, not
+the pending hosted runners or native Codex behavior.
+
+### History: runs 1–4 (earlier revision)
+
+Runs 1–4 used earlier sources (`visibility.py` `0f946d1c…` for run 1 and
+`a2b2753b…` for runs 2–4; `fileport_actor.c` `22cfee78…` and `30ed3560…`).
+All exited 0. Raw result SHA-256: run 1 `37829ef77aa5feb07a47da155beab7c3debd2dcc789b739a81f3f90d8844643f`,
+run 2 `c8f935d07b3db1d7137855cff744ae8e80af24ed39f64d6efd50692e0666d858`,
+run 3 `e10adb8f1963a3c38016996a558f43293d9da8c2c68496f92a1bf24c8f5ecc99`,
+run 4 `8bfdb91959551e743fa2eae253008a7d0c16c264c7ce0ef627c851b552fc0ea3`.
+Their per-stage observations are the same as below. They do not validate the
+revised code, and several of their rules were weaker:
+
+- Their fileport counts treated identity, query and short-read failures as
+  zero and did not detect a full buffer.
+- Their sandbox rules checked only `reduced: false` for the positive control.
+- Their console summary passed raw failure, incomplete, error and stderr text.
+- `ok: true` was written before cleanup ran.
+
+Their raw results name the hidden-sharer outcome `wrong_target_possible`.
+That historical name is kept inside those files, and its current
+interpretation is `release_incomplete_due_to_hidden_reference` (below).
+
+Before run 1, one unscripted exploratory run of the C actor was made by hand
+to learn the shape of the fileport stages. It was not recorded, and the
+expected table was written after it.
+
+### Fileport passing
+
+| Stage | Probe | Bit per process (`lsof +fg`) | Fileports per task | Filter decision |
+| --- | --- | --- | --- | --- |
+| Sender locked, receiver ready | held | sender bit, receiver absent | 0, 0 | sender `not_excluded`, receiver `unknown:pid_absent` |
+| Port sent, still queued in the receiver's port | held | sender bit, receiver absent | 0, 0 | same |
+| Sender closed its FD, port still queued | **held** | **no opener at all** | **0, 0** | both `unknown:held_without_visible_opener` |
+| Receiver holds only the port | held | lsof prints the receiver with FD `fp.`, flags `0x4003` | receiver 1 (names the fixture, bit set) | both `unknown:scan_invalid` |
+| Receiver ran `fileport_makefd` and released the port | held | sender absent, receiver bit | 0, 0 | receiver `not_excluded` (it never called `flock`) |
+| Sender exited | held | receiver bit | — | receiver `not_excluded` |
+| All closed | free | no openers | — | — |
+
+The receiver accepts only the fixed sender's message shape: message ID,
+complex bit, no reply port (`msgh_remote_port == MACH_PORT_NULL` and a zero
+remote disposition), one descriptor, and one moved send right. Other messages
+are unsupported. They are destroyed and reported as failed. This is
+validation of one fixture protocol, not general Mach message validation.
+
+After the receiver exited, `bootstrap_look_up` of its name returned 1102
+(unknown service). Names from a successfully validated receiver-ready event
+are registered in the result and checked in the cleanup `finally` even after
+a later exception. Anything other than 1102 is `present` or `unconfirmed` and
+fails the measurement. If check-in succeeds but the ready event is lost or
+invalid, the parent does not know the generated name and cannot confirm its
+removal. No universal exception-path removal guarantee is established.
+
+Within this scope:
+
+- A lock can be held while no process has a descriptor or a fileport for it.
+  The description lives only in a queued Mach message. Neither `lsof` nor
+  `PROC_PIDLISTFILEPORTS` showed any holder in that window.
+- `lsof` 4.91 prints a fileport held in a task's port space with FD `fp.` and
+  the description's flags. The strict parser makes that scan invalid.
+- A fileport is another way for a process that never called `flock` to
+  become the sole holder, carrying the bit. The receiver is the sender's
+  sibling, not its descendant.
+
+### Hidden shared description (modelled omission)
+
+| Shape | Visible sharer | Filter on the visible sharer | After it released (no signal) |
+| --- | --- | --- | --- |
+| `SCM_RIGHTS`, receiver hidden | sender (called `flock`) | `not_excluded` | lock still **held** |
+| `SCM_RIGHTS`, sender hidden | receiver (never called `flock`) | `not_excluded` | lock still **held** |
+| fork without exec, child hidden | parent | `not_excluded` | lock still **held** |
+
+All three record `release_incomplete_due_to_hidden_reference`. The visible
+sharer really shares the locked description, so the filter is right not to
+refuse it. The lock staying held only shows that releasing that one sharer
+did not release the lock, because a hidden sharer still references the same
+description. This is not a non-holding opener mistaken for the holder. That
+separate counterexample is the former holder below. After the release the
+evaluator returns `unknown:held_without_visible_opener`. This is documented,
+not fixed.
+
+### Restricted observer (`sandbox-exec`, no privileges)
+
+`sandbox-exec -p '(version 1)(allow default)' /usr/bin/true` worked
+unprivileged. Each profile is a file in the scratch directory; nothing is
+installed.
+
+The positive control (`allow_default`) must meet a full contract:
+
+- not reduced, canary seen, probe `held`, target present, scan valid;
+- `lsof` exit 0 with no stderr;
+- decision and probe-only decision both `not_excluded`;
+- classification `control_pass`.
+
+The unrestricted reference must also be held, valid, canary-visible and
+`not_excluded`. A missing, retyped or different field is a mismatch
+(`control_failed:<field>` / `reference_failed:<field>`). A failed control is
+classified `control_failed`, never `restricted_unknown`, and is never a
+measurement success. Restricted profiles must carry every rule field with the
+right type.
+
+| Observer profile | `lsof` exit | `lsof` stderr | Target seen | Canary seen | Probe | Decision (with canary / probe only) | Classification |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| `(allow default)` (control) | 0 | none | yes | yes | held | `not_excluded` / `not_excluded` | `control_pass` |
+| `(deny process-info-pidfdinfo)` | **1** | **none** | no | no | held | `unknown:canary_not_visible` / `unknown:held_without_visible_opener` | `restricted_unknown` |
+| `(deny process-info-pidfdinfo (target others))` | 0 | none | yes | yes | held | `not_excluded` / `not_excluded` | `unreduced` |
+| `(deny process-info*)` | 1 | present | no | no | held | `unknown:canary_not_visible` / `unknown:scan_invalid` | `restricted_unknown` |
+| `(deny default)` + exec of lsof/actor, `file-read*`, `sysctl-read`, `process-info*` | **1** | **none** | no | no | held | `unknown:canary_not_visible` / `unknown:held_without_visible_opener` | `restricted_unknown` |
+
+Within this scope:
+
+- Two restricted observers get exactly the output of "nobody has the file
+  open": exit 1, empty stdout, empty stderr. Format checks cannot detect
+  this. Here the held probe and the canary both turn it into `unknown`.
+- The probe still worked under the deny-default profile.
+- The `(target others)` variant had no visible effect. This was not
+  investigated further.
+- Not covered: a restriction that hides only some targets while the canary
+  stays visible. Neither cross-check detects that.
+
+### Sandboxed target
+
+A holder started under `sandbox-exec` with `(allow default)` or with a
+deny-default profile (exec of the actor, `file-read*`, `file-write*` of the
+fixture only, `sysctl-read`) stayed fully visible to the unsandboxed
+same-user observer: probe held, bit, `not_excluded`. Hardened runtime, App
+Sandbox entitlements and other confinement were not tested.
+
+### Former holder versus never-locked opener
+
+Measured and unit-tested. With no holder, the probe is free, the former
+holder's description keeps `0x4003` (`not_excluded`), and the opener has
+`0x3` (`reject`). With an actual holder added and hidden by the model, the
+former holder is still `not_excluded`, with flags identical to the holder's
+(#139 M2 `B_former`). This is a non-holding process that the filter does not
+refuse, a different counterexample from the hidden-sharer release above. The
+opener is still `reject`. `FormerVersusOpenerTest` checks this on fixed
+inputs.
+
+## Running
+
+```sh
+root="$(mktemp -d "<approved temporary root>/codex-127v-XXXXXX")" && chmod 700 "$root"
+python3 -I -B experimental/127-macos-visibility/visibility.py --scratch-root "$root" --result "<new private path>/result.json"
+python3 -I -B experimental/127-macos-visibility/visibility.py --summarize "<private path>/result.json"
+RESEARCH_TMP_ROOT="$root" python3 -I -B -W error::ResourceWarning experimental/127-macos-visibility/test_visibility.py
+```
+
+Result fields:
+
+| Field | Meaning |
+| --- | --- |
+| `collected` | No failure, incomplete wait or exception |
+| `measured` | Expected tables and rules hold |
+| `measurement_ok` | Both, and no scenario is `not_executed` |
+| `cleanup` | Settled before the record is written |
+| `run_ok` (= `ok`) | `measurement_ok` and cleanup `removed` |
+
+Initialization, scenario and cleanup failures are recorded when the reserved
+result file remains writable. A result write failure cannot preserve a complete
+record. The exit is nonzero unless `run_ok`.
+
+Public measurement output is allowlisted; actor stderr is captured in private
+unlinked temporary files, with a bounded prefix retained in the private result
+after confirmed exit. These files do not bound actor disk writes or lifetime.
+Unit-test failures can contain traceback values, so CI stores their raw output
+privately and prints only fixed pass/fail status. A green rule check does not
+mean every sandbox profile reproduced the same omission as macOS 27: each
+profile's observed classification remains in the public summary.
+
+Cleanup runs only when `measurement_ok` holds and no diagnostic is pending.
+It opens the scratch directory and its parent with `O_DIRECTORY|O_NOFOLLOW`.
+It compares the directory's device and inode with those recorded at creation,
+and refuses any entry this run did not register. Registered names are removed
+relative to the directory FD. Before `rmdir` relative to the parent FD, the
+device and inode are checked again. A mismatch, an unexpected entry or a
+failed delete leaves the directory and its remaining files in place as
+`preserved` or `failed`. These checks narrow path races; they do not close
+all of them. Nothing is deleted recursively.
+
+Public output: standard output carries only the public summary. It is an
+allowlist:
+
+- fixed booleans;
+- validated scenario, stage, role and profile identifiers;
+- decisions from the closed vocabulary;
+- bounded counts;
+- failure, incomplete and error kinds as counts of allowlisted
+  `<label>:<kind>` pairs;
+- source and binary SHA-256;
+- validated version strings.
+
+Anything else becomes `other`, or is counted in `unlisted_mismatches`. Raw
+error text, stderr, exception messages, PIDs, service names and paths stay in
+the private raw result. A failure outside the measurement (for example an
+existing result path) prints one fixed `{"ok": false, "fatal": <kind>}` line
+without a traceback.
+
+If `clang` is missing or the compile fails, `fileport`, `sandbox_observer`,
+`sandbox_target` and `former_vs_opener` are recorded as `not_executed` with a
+kind. If `sandbox-exec` cannot apply a trivial profile, the two sandbox
+scenarios are recorded the same way. `not_executed` is never a measurement
+success: `measurement_ok` and `ok` stay false.
+
+Lifecycle and signals: actors end on stdin EOF. Their 20 s lifetime is
+checked only while they wait for a command. It does not interrupt a blocking
+write, file syscall or bootstrap RPC. `mach_msg` send and receive have their
+own 2 s and 3 s timeouts. **The script makes no kill calls and uses no
+killing subprocess timeouts.** A diagnostic that exceeds its bound is
+recorded as incomplete with its PID in the raw result, polled again at the
+end, and never stopped (run 5 is an example). The result file and the
+sandbox profiles are created with `O_CREAT|O_EXCL|O_NOFOLLOW`, mode 0600.
+
+Side effect: the receiver role calls `bootstrap_check_in` with a fresh
+`dev.codex-unlock.research.127v.<pid>.<random>` name. That is a transient
+entry in the user's launchd bootstrap namespace, owned by the receiver's
+receive right. It needs no privileges and changes no policy.
+
+`test_visibility.py` (80 tests) checks, with fixed inputs and finite children
+only:
+
+- **Parsing**: empty output, status and stderr rules, timeouts, eight
+  malformed shapes and `fp.` records.
+- **Filter and visibility rules**: the closed vocabulary, modelled omission,
+  canary and reduced-view comparison.
+- **Former holder versus never-locked opener**, and the hidden-sharer outcome
+  name.
+- **Expected-table counterexamples**, including a saturated fileport stage and
+  an enumeration error in the self-report.
+- **Sandbox contracts**: the reviewer's control mutation (`canary_visible:
+  false`, decision unknown); every control and reference field missing,
+  negated or retyped; a missing control; restricted fields missing or
+  retyped; `control_failed` versus `restricted_unknown`; and the rules for
+  reduced and unreduced views.
+- **Public summary privacy**: a raw result with injected fake paths, PIDs and
+  service names in every failure path (failures, incomplete waits, errors,
+  `not_executed`, mismatches, pending diagnostics, bootstrap names, cleanup,
+  hashes, build, environment, stage, role, decision, probe, fileport and
+  profile fields) gives a clean summary. Malformed raw input never raises or
+  echoes.
+- **Cleanup**: removal of registered names only; unexpected entries;
+  identity mismatch; a symlinked scratch; injected `unlink` and `rmdir`
+  failures; an unexpected exception. `finalize` writes `run_ok` false with
+  preserved evidence, and preserves on measurement failure, `not_executed`
+  and pending diagnostics.
+- **CLI**: fatal output without a path or traceback, `--summarize` on a
+  poisoned and on a broken file, and argument combinations.
+- **One-shot framing, event shapes and process behavior**: wrong ready PID or
+  kind, early exit, a `failed` event, a partial line followed by silence, and
+  a diagnostic timeout recorded as pending.
+- **The compiled actor**:
+  - probe free and held;
+  - framing failures ending with exit 3, and an unknown command;
+  - failure events instead of `ready`, and a send to an unknown service;
+  - fileport enumeration: 1 and 63 entries complete, 64 and 70 `saturated`,
+    a missing fixture giving `identity`, an exited PID giving `list_esrch`.
+
+Not covered by injection: `query` and `short_read`. They need a fileport
+that disappears between the list and the query, or a kernel record size
+change.
+
+`ci-proposal.patch` proposes a research-only workflow for `macos-15` and
+`macos-15-intel`. It is not applied. It prints only the public summary. See
+[HANDOFF.md](HANDOFF.md).
diff --git a/experimental/127-macos-visibility/fileport_actor.c b/experimental/127-macos-visibility/fileport_actor.c
new file mode 100644
index 0000000..eac1c03
--- /dev/null
+++ b/experimental/127-macos-visibility/fileport_actor.c
@@ -0,0 +1,510 @@
+/*
+ * #127 research actor (macOS only). Same-user synthetic fixtures only.
+ *
+ * Every role is started by visibility.py or its tests. Long-lived roles serve
+ * newline commands on stdin, close their descriptors and exit 0 on stdin EOF.
+ * ACTOR_LIFETIME_MS is checked only while waiting for a command: it does not
+ * interrupt a blocking write, file syscall or bootstrap RPC. mach_msg send and
+ * receive have their own timeouts. When the lifetime passes at a command
+ * boundary the role exits 3. One-shot roles print one event and exit.
+ * Nothing here sends a signal to any process.
+ *
+ * Output: one JSON object per line on stdout. Only integers, booleans, fixed
+ * strings and validated service names are emitted, so no escaping is needed.
+ *
+ * Roles:
+ *   holder <path>          flock(LOCK_EX|LOCK_NB) and keep the descriptor
+ *   former <path>          flock, then LOCK_UN, and keep the descriptor
+ *   opener <path>          open without locking and keep the descriptor
+ *   sender <path>          holder, plus commands `send <service>` and
+ *                          `close_own_fd`
+ *   receiver <path>        bootstrap_check_in a fresh name, then commands
+ *                          `receive`, `makefd` and `fileports`
+ *   probe <path>           one-shot independent nonblocking flock probe
+ *   listfileports <pid> <path>
+ *                          one-shot libproc PROC_PIDLISTFILEPORTS for <pid>
+ *   lookup <service>       one-shot bootstrap_look_up (removal check)
+ *   makeports <n> <path>   test role: make n fileports of one descriptor and
+ *                          report its own fileports (saturation check)
+ */
+
+#include <errno.h>
+#include <fcntl.h>
+#include <libproc.h>
+#include <mach/mach.h>
+#include <poll.h>
+#include <stdarg.h>
+#include <servers/bootstrap.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/fileport.h>
+#include <sys/file.h>
+#include <sys/proc_info.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <unistd.h>
+
+#define ACTOR_LIFETIME_MS 20000
+#define SEND_TIMEOUT_MS 2000
+#define RECEIVE_TIMEOUT_MS 3000
+#define LINE_LIMIT 256
+#define MESSAGE_ID 0x127
+#define FWASLOCKED_BIT 0x4000u
+#define MAX_FILEPORTS 64
+
+typedef struct {
+    mach_msg_header_t header;
+    mach_msg_body_t body;
+    mach_msg_port_descriptor_t port;
+} port_message_t;
+
+typedef struct {
+    port_message_t message;
+    mach_msg_trailer_t trailer;
+} port_receive_t;
+
+static int64_t now_ms(void) {
+    struct timespec ts;
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+    return (int64_t)ts.tv_sec * 1000 + ts.tv_nsec / 1000000;
+}
+
+static void emit(const char *format, ...) __attribute__((format(printf, 1, 2)));
+
+static void emit(const char *format, ...) {
+    char buffer[1024];
+    va_list args;
+    va_start(args, format);
+    int length = vsnprintf(buffer, sizeof buffer - 1, format, args);
+    va_end(args);
+    if (length < 0 || length >= (int)sizeof buffer - 1) {
+        length = snprintf(buffer, sizeof buffer, "{\"event\":\"failed\",\"reason\":\"emit_overflow\"}");
+    }
+    buffer[length++] = '\n';
+    const char *cursor = buffer;
+    while (length > 0) {
+        ssize_t written = write(1, cursor, (size_t)length);
+        if (written < 0) {
+            if (errno == EINTR) continue;
+            _exit(4);
+        }
+        cursor += written;
+        length -= (int)written;
+    }
+}
+
+static const char *error_name(int number) {
+    switch (number) {
+    case EWOULDBLOCK: return "EWOULDBLOCK";
+    case EPERM: return "EPERM";
+    case EACCES: return "EACCES";
+    case ENOENT: return "ENOENT";
+    case EBADF: return "EBADF";
+    case ELOOP: return "ELOOP";
+    case ESRCH: return "ESRCH";
+    case EINVAL: return "EINVAL";
+    default: return "other";
+    }
+}
+
+static int open_fixture(const char *path, int flags) {
+    return open(path, flags | O_CLOEXEC | O_NOFOLLOW);
+}
+
+static int same_file(int fd, const char *path) {
+    struct stat a, b;
+    if (fstat(fd, &a) != 0 || stat(path, &b) != 0) return 0;
+    return a.st_dev == b.st_dev && a.st_ino == b.st_ino;
+}
+
+static int valid_service(const char *name) {
+    size_t length = strlen(name);
+    if (length == 0 || length >= 128) return 0;
+    for (size_t i = 0; i < length; i++) {
+        char c = name[i];
+        if (!((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') ||
+              c == '.' || c == '-' || c == '_')) return 0;
+    }
+    return 1;
+}
+
+/*
+ * Read one command line before the deadline.
+ * Returns 1 for a line, 0 for EOF, -1 for deadline, -2 for a framing failure
+ * (overlong line or a partial line at EOF).
+ */
+static int read_command(char *line, int64_t deadline) {
+    static char buffer[LINE_LIMIT * 2];
+    static size_t used = 0;
+    static int eof = 0;
+    for (;;) {
+        char *newline = memchr(buffer, '\n', used);
+        if (newline) {
+            size_t length = (size_t)(newline - buffer);
+            if (length >= LINE_LIMIT) return -2;
+            memcpy(line, buffer, length);
+            line[length] = '\0';
+            memmove(buffer, newline + 1, used - length - 1);
+            used -= length + 1;
+            return 1;
+        }
+        if (used >= LINE_LIMIT) return -2;
+        if (eof) return used ? -2 : 0;
+        int64_t remaining = deadline - now_ms();
+        if (remaining <= 0) return -1;
+        struct pollfd item = {.fd = 0, .events = POLLIN};
+        int ready = poll(&item, 1, (int)remaining);
+        if (ready < 0 && errno == EINTR) continue;
+        if (ready <= 0) continue;
+        ssize_t got = read(0, buffer + used, sizeof buffer - used);
+        if (got < 0 && errno == EINTR) continue;
+        if (got <= 0) {
+            eof = 1;
+            continue;
+        }
+        used += (size_t)got;
+    }
+}
+
+/* Serve commands for a role that has none: EOF -> 0, anything else -> 3. */
+static int serve_none(int64_t deadline) {
+    char line[LINE_LIMIT];
+    for (;;) {
+        int status = read_command(line, deadline);
+        if (status == 0) return 0;
+        if (status < 0) return 3;
+        emit("{\"event\":\"error\",\"error\":\"unknown command\"}");
+    }
+}
+
+static int role_keep(const char *path, const char *kind, int64_t deadline) {
+    int lock = strcmp(kind, "opener") != 0;
+    int fd = open_fixture(path, O_RDWR);
+    if (fd < 0) {
+        emit("{\"event\":\"failed\",\"reason\":\"open:%s\"}", error_name(errno));
+        return 3;
+    }
+    if (lock && flock(fd, LOCK_EX | LOCK_NB) != 0) {
+        emit("{\"event\":\"failed\",\"reason\":\"flock:%s\"}", error_name(errno));
+        close(fd);
+        return 3;
+    }
+    if (strcmp(kind, "former") == 0 && flock(fd, LOCK_UN) != 0) {
+        emit("{\"event\":\"failed\",\"reason\":\"unlock:%s\"}", error_name(errno));
+        close(fd);
+        return 3;
+    }
+    emit("{\"event\":\"ready\",\"pid\":%d,\"kind\":\"%s\"}", getpid(), kind);
+    int code = serve_none(deadline);
+    close(fd);
+    return code;
+}
+
+static int role_sender(const char *path, int64_t deadline) {
+    int fd = open_fixture(path, O_RDWR);
+    if (fd < 0 || flock(fd, LOCK_EX | LOCK_NB) != 0) {
+        emit("{\"event\":\"failed\",\"reason\":\"lock:%s\"}", error_name(errno));
+        if (fd >= 0) close(fd);
+        return 3;
+    }
+    emit("{\"event\":\"ready\",\"pid\":%d,\"kind\":\"sender\"}", getpid());
+    char line[LINE_LIMIT];
+    for (;;) {
+        int status = read_command(line, deadline);
+        if (status == 0) break;
+        if (status < 0) {
+            if (fd >= 0) close(fd);
+            return 3;
+        }
+        if (strncmp(line, "send ", 5) == 0 && valid_service(line + 5)) {
+            mach_port_t service = MACH_PORT_NULL;
+            kern_return_t kr = bootstrap_look_up(bootstrap_port, line + 5, &service);
+            if (kr != KERN_SUCCESS) {
+                emit("{\"event\":\"failed\",\"reason\":\"look_up\",\"kr\":%d}", kr);
+                continue;
+            }
+            fileport_t port = FILEPORT_NULL;
+            if (fd < 0 || fileport_makeport(fd, &port) != 0) {
+                emit("{\"event\":\"failed\",\"reason\":\"makeport:%s\"}", error_name(errno));
+                mach_port_deallocate(mach_task_self(), service);
+                continue;
+            }
+            port_message_t message;
+            memset(&message, 0, sizeof message);
+            message.header.msgh_bits = MACH_MSGH_BITS_COMPLEX | MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0);
+            message.header.msgh_remote_port = service;
+            message.header.msgh_local_port = MACH_PORT_NULL;
+            message.header.msgh_size = sizeof message;
+            message.header.msgh_id = MESSAGE_ID;
+            message.body.msgh_descriptor_count = 1;
+            message.port.name = port;
+            message.port.disposition = MACH_MSG_TYPE_MOVE_SEND;
+            message.port.type = MACH_MSG_PORT_DESCRIPTOR;
+            kr = mach_msg(&message.header, MACH_SEND_MSG | MACH_SEND_TIMEOUT, sizeof message, 0,
+                          MACH_PORT_NULL, SEND_TIMEOUT_MS, MACH_PORT_NULL);
+            if (kr != KERN_SUCCESS) {
+                /* The send right was not moved; drop it so the sender keeps none. */
+                mach_port_deallocate(mach_task_self(), port);
+            }
+            mach_port_deallocate(mach_task_self(), service);
+            emit("{\"event\":\"sent\",\"kr\":%d}", kr);
+        } else if (strcmp(line, "close_own_fd") == 0 && fd >= 0) {
+            close(fd);
+            fd = -1;
+            emit("{\"event\":\"closed\",\"who\":\"sender\"}");
+        } else {
+            emit("{\"event\":\"error\",\"error\":\"unknown command\"}");
+        }
+    }
+    if (fd >= 0) close(fd);
+    return 0;
+}
+
+typedef struct {
+    int count;
+    int vnode;
+    int non_vnode;
+    int matching;
+    int matching_locked;
+    uint32_t flags;
+    const char *error; /* NULL when the enumeration is complete */
+} fileport_scan_t;
+
+/*
+ * Enumerate a task's fileports. Any step that cannot be completed sets
+ * `error` instead of reporting zero: list failure, a list length that is not
+ * a whole number of entries, a full buffer (more entries may exist), the
+ * fixture identity (stat) failing, or a vnode query failing or returning a
+ * short record. Fileports whose type is not a vnode are counted in
+ * `non_vnode` and not queried: the fixture is a regular file, so only a vnode
+ * fileport can name it. That exclusion is limited to this fixture.
+ */
+static fileport_scan_t scan_fileports(int pid, const char *path) {
+    fileport_scan_t scan = {0, 0, 0, 0, 0, 0, NULL};
+    struct proc_fileportinfo items[MAX_FILEPORTS];
+    struct stat expected;
+    if (stat(path, &expected) != 0) {
+        scan.error = "identity";
+        return scan;
+    }
+    errno = 0;
+    int bytes = proc_pidinfo(pid, PROC_PIDLISTFILEPORTS, 0, items, (int)sizeof items);
+    /* proc_pidinfo returns 0 both for "none" and for failures; errno decides. */
+    if (bytes < 0 || (bytes == 0 && errno != 0)) {
+        scan.error = errno == ESRCH ? "list_esrch" : "list";
+        return scan;
+    }
+    if (bytes % (int)PROC_PIDLISTFILEPORTS_SIZE != 0) {
+        scan.error = "list_length";
+        return scan;
+    }
+    scan.count = bytes / (int)PROC_PIDLISTFILEPORTS_SIZE;
+    if (scan.count >= MAX_FILEPORTS) {
+        scan.error = "saturated";
+        return scan;
+    }
+    for (int i = 0; i < scan.count; i++) {
+        if (items[i].proc_fdtype != PROX_FDTYPE_VNODE) {
+            scan.non_vnode++;
+            continue;
+        }
+        scan.vnode++;
+        struct vnode_fdinfowithpath info;
+        errno = 0;
+        int got = proc_pidfileportinfo(pid, items[i].proc_fileport, PROC_PIDFILEPORTVNODEPATHINFO,
+                                       &info, (int)sizeof info);
+        if (got <= 0) {
+            scan.error = "query";
+            return scan;
+        }
+        if (got != (int)sizeof info) {
+            scan.error = "short_read";
+            return scan;
+        }
+        if ((dev_t)info.pvip.vip_vi.vi_stat.vst_dev == expected.st_dev &&
+            info.pvip.vip_vi.vi_stat.vst_ino == expected.st_ino) {
+            scan.matching++;
+            scan.flags = info.pfi.fi_openflags;
+            if (info.pfi.fi_openflags & FWASLOCKED_BIT) scan.matching_locked++;
+        }
+    }
+    return scan;
+}
+
+static void emit_fileports(int pid, const char *path) {
+    fileport_scan_t scan = scan_fileports(pid, path);
+    if (scan.error) {
+        emit("{\"event\":\"fileports\",\"pid\":%d,\"ok\":false,\"error\":\"%s\",\"count\":%d}",
+             pid, scan.error, scan.count);
+        return;
+    }
+    emit("{\"event\":\"fileports\",\"pid\":%d,\"ok\":true,\"count\":%d,\"vnode\":%d,\"non_vnode\":%d,"
+         "\"matching\":%d,\"matching_was_locked\":%d,\"flags\":\"0x%x\"}",
+         pid, scan.count, scan.vnode, scan.non_vnode, scan.matching, scan.matching_locked, scan.flags);
+}
+
+/* Test role: make `n` fileports of one fixture descriptor, then report self. */
+static int role_makeports(const char *count_text, const char *path) {
+    char *end = NULL;
+    long n = strtol(count_text, &end, 10);
+    if (!end || *end || n < 0 || n > 4 * MAX_FILEPORTS) {
+        emit("{\"event\":\"failed\",\"reason\":\"count\"}");
+        return 3;
+    }
+    int fd = open_fixture(path, O_RDONLY);
+    if (fd < 0) {
+        emit("{\"event\":\"failed\",\"reason\":\"open:%s\"}", error_name(errno));
+        return 3;
+    }
+    for (long i = 0; i < n; i++) {
+        fileport_t port = FILEPORT_NULL;
+        if (fileport_makeport(fd, &port) != 0) {
+            emit("{\"event\":\"failed\",\"reason\":\"makeport:%s\"}", error_name(errno));
+            close(fd);
+            return 3;
+        }
+    }
+    close(fd);
+    emit_fileports(getpid(), path);
+    return 0;
+}
+
+static int role_receiver(const char *path, int64_t deadline) {
+    char service_name[128];
+    snprintf(service_name, sizeof service_name, "dev.codex-unlock.research.127v.%d.%08x",
+             getpid(), arc4random());
+    mach_port_t service = MACH_PORT_NULL;
+    kern_return_t kr = bootstrap_check_in(bootstrap_port, service_name, &service);
+    if (kr != KERN_SUCCESS) {
+        emit("{\"event\":\"failed\",\"reason\":\"check_in\",\"kr\":%d}", kr);
+        return 3;
+    }
+    emit("{\"event\":\"ready\",\"pid\":%d,\"kind\":\"receiver\",\"service\":\"%s\"}", getpid(), service_name);
+    fileport_t port = FILEPORT_NULL;
+    int fd = -1;
+    int code = 0;
+    char line[LINE_LIMIT];
+    for (;;) {
+        int status = read_command(line, deadline);
+        if (status == 0) break;
+        if (status < 0) {
+            code = 3;
+            break;
+        }
+        if (strcmp(line, "receive") == 0 && port == FILEPORT_NULL && fd < 0) {
+            port_receive_t buffer;
+            memset(&buffer, 0, sizeof buffer);
+            kr = mach_msg(&buffer.message.header, MACH_RCV_MSG | MACH_RCV_TIMEOUT, 0, sizeof buffer,
+                          service, RECEIVE_TIMEOUT_MS, MACH_PORT_NULL);
+            if (kr != KERN_SUCCESS) {
+                emit("{\"event\":\"failed\",\"reason\":\"receive\",\"kr\":%d}", kr);
+                continue;
+            }
+            mach_msg_header_t *header = &buffer.message.header;
+            /*
+             * Only the fixed sender's message is supported: id, complex bit,
+             * no reply port, one moved send right. Anything else is
+             * destroyed and reported as failed.
+             */
+            int shape = header->msgh_id == MESSAGE_ID && (header->msgh_bits & MACH_MSGH_BITS_COMPLEX) &&
+                        header->msgh_remote_port == MACH_PORT_NULL &&
+                        MACH_MSGH_BITS_REMOTE(header->msgh_bits) == 0 &&
+                        header->msgh_size >= sizeof(port_message_t) &&
+                        buffer.message.body.msgh_descriptor_count == 1 &&
+                        buffer.message.port.type == MACH_MSG_PORT_DESCRIPTOR &&
+                        buffer.message.port.disposition == MACH_MSG_TYPE_PORT_SEND &&
+                        buffer.message.port.name != MACH_PORT_NULL;
+            if (!shape) {
+                mach_msg_destroy(header);
+                emit("{\"event\":\"failed\",\"reason\":\"message_shape\"}");
+                continue;
+            }
+            port = buffer.message.port.name;
+            emit("{\"event\":\"received\",\"ports\":1}");
+        } else if (strcmp(line, "makefd") == 0 && port != FILEPORT_NULL && fd < 0) {
+            fd = fileport_makefd(port);
+            int saved = errno;
+            kern_return_t release_kr = mach_port_deallocate(mach_task_self(), port);
+            if (release_kr == KERN_SUCCESS) port = FILEPORT_NULL;
+            if (fd < 0) {
+                emit("{\"event\":\"failed\",\"reason\":\"makefd:%s\"}", error_name(saved));
+                continue;
+            }
+            fcntl(fd, F_SETFD, FD_CLOEXEC);
+            emit("{\"event\":\"made_fd\",\"matches\":%s,\"port_released\":%s,\"release_kr\":%d}",
+                 same_file(fd, path) ? "true" : "false", release_kr == KERN_SUCCESS ? "true" : "false", release_kr);
+        } else if (strcmp(line, "fileports") == 0) {
+            emit_fileports(getpid(), path);
+        } else {
+            emit("{\"event\":\"error\",\"error\":\"unknown command\"}");
+        }
+    }
+    if (fd >= 0) close(fd);
+    if (port != FILEPORT_NULL) mach_port_deallocate(mach_task_self(), port);
+    mach_port_mod_refs(mach_task_self(), service, MACH_PORT_RIGHT_RECEIVE, -1);
+    return code;
+}
+
+static int role_probe(const char *path) {
+    int fd = open_fixture(path, O_RDONLY);
+    if (fd < 0) {
+        emit("{\"event\":\"probe\",\"result\":\"error:open:%s\"}", error_name(errno));
+        return 0;
+    }
+    int locked = flock(fd, LOCK_EX | LOCK_NB);
+    int saved = errno;
+    close(fd);
+    if (locked == 0) {
+        emit("{\"event\":\"probe\",\"result\":\"free\"}");
+    } else if (saved == EWOULDBLOCK) {
+        emit("{\"event\":\"probe\",\"result\":\"held\"}");
+    } else {
+        emit("{\"event\":\"probe\",\"result\":\"error:flock:%s\"}", error_name(saved));
+    }
+    return 0;
+}
+
+static int role_lookup(const char *name) {
+    if (!valid_service(name)) {
+        emit("{\"event\":\"failed\",\"reason\":\"service_name\"}");
+        return 3;
+    }
+    mach_port_t port = MACH_PORT_NULL;
+    kern_return_t kr = bootstrap_look_up(bootstrap_port, name, &port);
+    if (kr == KERN_SUCCESS) mach_port_deallocate(mach_task_self(), port);
+    emit("{\"event\":\"lookup\",\"kr\":%d}", kr);
+    return 0;
+}
+
+static int parse_pid(const char *text) {
+    char *end = NULL;
+    errno = 0;
+    long value = strtol(text, &end, 10);
+    if (errno || !end || *end || value <= 0 || value > 99999999) return -1;
+    return (int)value;
+}
+
+int main(int argc, char **argv) {
+    int64_t deadline = now_ms() + ACTOR_LIFETIME_MS;
+    if (argc == 3 && (strcmp(argv[1], "holder") == 0 || strcmp(argv[1], "former") == 0 ||
+                      strcmp(argv[1], "opener") == 0))
+        return role_keep(argv[2], argv[1], deadline);
+    if (argc == 3 && strcmp(argv[1], "sender") == 0) return role_sender(argv[2], deadline);
+    if (argc == 3 && strcmp(argv[1], "receiver") == 0) return role_receiver(argv[2], deadline);
+    if (argc == 3 && strcmp(argv[1], "probe") == 0) return role_probe(argv[2]);
+    if (argc == 3 && strcmp(argv[1], "lookup") == 0) return role_lookup(argv[2]);
+    if (argc == 4 && strcmp(argv[1], "makeports") == 0) return role_makeports(argv[2], argv[3]);
+    if (argc == 4 && strcmp(argv[1], "listfileports") == 0) {
+        int pid = parse_pid(argv[2]);
+        if (pid < 0) {
+            emit("{\"event\":\"failed\",\"reason\":\"pid\"}");
+            return 3;
+        }
+        emit_fileports(pid, argv[3]);
+        return 0;
+    }
+    emit("{\"event\":\"failed\",\"reason\":\"usage\"}");
+    return 2;
+}
diff --git a/experimental/127-macos-visibility/test_visibility.py b/experimental/127-macos-visibility/test_visibility.py
new file mode 100644
index 0000000..ebb6dea
--- /dev/null
+++ b/experimental/127-macos-visibility/test_visibility.py
@@ -0,0 +1,1076 @@
+#!/usr/bin/env python3
+"""Deterministic tests for visibility.py and fileport_actor.c (#127 research).
+
+  RESEARCH_TMP_ROOT=<approved root> python3 -I -B experimental/127-macos-visibility/test_visibility.py
+
+Pure evaluator tests use finite fixed inputs. Process tests start only finite
+synthetic children (they end on stdin EOF or by themselves). No signals are
+sent. Tests that need RESEARCH_TMP_ROOT, clang or macOS skip without them.
+"""
+
+import copy
+import contextlib
+import io
+import json
+import os
+import platform
+import stat
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+from types import SimpleNamespace
+from unittest import mock
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import visibility as v  # noqa: E402
+
+inherit = v.inherit
+ROOT = os.environ.get("RESEARCH_TMP_ROOT")
+PY = sys.executable
+
+N, R = v.N, v.R
+
+
+def clear_flat(root):
+    """Remove a test directory this suite created: regular files and symlinks
+    directly inside it, then the directory. Not recursive; anything else stays."""
+    root = Path(root)
+    for name in os.listdir(root):
+        mode = os.lstat(root / name).st_mode
+        if stat.S_ISREG(mode) or stat.S_ISLNK(mode):
+            os.unlink(root / name)
+    os.rmdir(root)
+
+
+def scratch():
+    if not ROOT:
+        raise unittest.SkipTest("RESEARCH_TMP_ROOT is required")
+    path = Path(tempfile.mkdtemp(prefix="codex-127v-test-", dir=ROOT))
+    path.chmod(0o700)
+    return path
+
+
+def lsof_out(*records):
+    """Build `lsof -F0pfG` bytes from (pid, [(fd, flags), ...]) records."""
+    out = b""
+    for pid, files in records:
+        out += f"p{pid}\0\n".encode()
+        for fd, flags in files:
+            out += f"f{fd}\0G{flags};0x2\0\n".encode()
+    return out
+
+
+def scan_of(*records):
+    out = lsof_out(*records)
+    return v.interpret_scan(0 if out else 1, out, b"")
+
+
+class ParseTest(unittest.TestCase):
+    def test_empty_output_with_status_1_is_a_valid_empty_scan(self):
+        # This is also exactly what a restricted observer sees (clean omission).
+        scan = v.interpret_scan(1, b"", b"")
+        self.assertTrue(scan["valid"])
+        self.assertEqual(scan["pids"], {})
+
+    def test_status_and_stderr_rules(self):
+        good = lsof_out((10, [(3, "0x4003")]))
+        cases = {
+            "status_1_with_output": (1, good, b""),
+            "status_0_without_output": (0, b"", b""),
+            "status_2": (2, b"", b""),
+            "stderr": (1, b"", b"lsof: can't get PID byte count: Operation not permitted\n"),
+            "timeout": (None, b"", b""),
+        }
+        for name, (status, out, err) in cases.items():
+            with self.subTest(name=name):
+                self.assertFalse(v.interpret_scan(status, out, err)["valid"])
+
+    def test_diagnostic_problems_make_the_scan_invalid(self):
+        self.assertFalse(v.interpret_scan(0, lsof_out((10, [(3, "0x3")])), b"", ["output_limit"])["valid"])
+
+    def test_malformed_shapes_are_invalid_never_no_bit(self):
+        shapes = {
+            "partial_last_line": b"p10\0\nf3\0G0x4003;0x2\0",
+            "unterminated_record": b"p10\0\nf3\0G0x4003;0x2\n",
+            "missing_g": b"p10\0\nf3\0\n",
+            "non_hex_flags": b"p10\0\nf3\0G0xZZ;0x2\0\n",
+            "file_before_pid": b"f3\0G0x3;0x2\0\n",
+            "extra_field": b"p10\0\nf3\0G0x3;0x2\0n/x\0\n",
+            "pid_without_fd": b"p10\0\n",
+            "bad_pid": b"p0\0\nf3\0G0x3;0x2\0\n",
+        }
+        for name, out in shapes.items():
+            with self.subTest(name=name):
+                scan = v.interpret_scan(0, out, b"")
+                self.assertFalse(scan["valid"])
+                self.assertEqual(v.filter_decision(scan, 10)["decision"], "unknown")
+
+    def test_fileport_record_is_listed_and_invalidates_the_scan(self):
+        out = b"p20\0\nffp.\0G0x4003;0x0\0\n"
+        scan = v.interpret_scan(0, out, b"")
+        self.assertFalse(scan["valid"])
+        self.assertIn("fileport_record", scan["problems"])
+        self.assertEqual(scan["fileports"], [{"pid": "20", "flags": "0x4003", "was_locked": True}])
+        self.assertEqual(v.label(v.visibility_decision("held", scan, 20)), v.U_INVALID)
+        states, ports, unexpected = v.role_states(scan, {"receiver": 20})
+        self.assertEqual((states, ports, unexpected), ({"receiver": "absent"}, {"receiver": "bit"}, 0))
+
+
+class FilterDecisionTest(unittest.TestCase):
+    def test_rules(self):
+        scan = scan_of((10, [(3, "0x4003")]), (11, [(4, "0x3")]), (12, [(3, "0x3"), (5, "0x4001")]),
+                       (13, [(3, "0x1"), (4, "0x3")]))
+        self.assertEqual(v.label(v.filter_decision(scan, 10)), N)
+        self.assertEqual(v.label(v.filter_decision(scan, 11)), R)
+        self.assertEqual(v.label(v.filter_decision(scan, 12)), N)
+        self.assertEqual(v.label(v.filter_decision(scan, 13)), R)
+        self.assertEqual(v.label(v.filter_decision(scan, 99)), v.U_ABSENT)
+
+    def test_invalid_scan_is_unknown(self):
+        scan = scan_of((10, [(3, "0x4003")]))
+        scan["valid"] = False
+        self.assertEqual(v.label(v.filter_decision(scan, 10)), v.U_INVALID)
+
+    def test_unreadable_flags_are_unknown(self):
+        scan = scan_of((10, [(3, "0x4003")]))
+        scan["pids"]["10"][0]["was_locked"] = None
+        self.assertEqual(v.label(v.filter_decision(scan, 10)), "unknown:flags_unreadable")
+
+    def test_vocabulary_is_closed(self):
+        with self.assertRaises(ValueError):
+            v.label({"decision": "holder", "reason": "x"})
+        with self.assertRaises(ValueError):
+            v.label({"decision": "safe", "reason": "x"})
+
+    def test_bit_never_becomes_more_than_not_excluded(self):
+        scan = scan_of((10, [(3, "0x4003"), (4, "0x4003")]))
+        decision = v.filter_decision(scan, 10)
+        self.assertEqual(decision, {"decision": "not_excluded", "reason": "bit_present"})
+
+
+class FormerVersusOpenerTest(unittest.TestCase):
+    """#139 M2 former-holder counterexample versus a never-locked opener."""
+
+    def setUp(self):
+        # former: flock then LOCK_UN, FD kept -> the sticky bit stays (0x4003).
+        # opener: never called flock -> 0x3. holder: current holder -> 0x4003.
+        self.former, self.opener, self.holder = 101, 202, 303
+        self.full = scan_of((self.former, [(3, "0x4003")]), (self.opener, [(3, "0x3")]),
+                            (self.holder, [(3, "0x4003")]))
+
+    def test_former_holder_is_not_excluded_and_opener_is_rejected_without_a_holder(self):
+        scan = scan_of((self.former, [(3, "0x4003")]), (self.opener, [(3, "0x3")]))
+        self.assertEqual(v.label(v.visibility_decision("free", scan, self.former)), N)
+        self.assertEqual(v.label(v.visibility_decision("free", scan, self.opener)), R)
+
+    def test_hidden_holder_leaves_the_former_holder_not_excluded(self):
+        view = v.without_pids(self.full, [self.holder])
+        self.assertEqual(v.label(v.visibility_decision("held", view, self.former)), N)
+        self.assertEqual(v.label(v.visibility_decision("held", view, self.opener)), R)
+
+    def test_former_and_actual_holder_are_indistinguishable(self):
+        self.assertEqual(v.filter_decision(self.full, self.former), v.filter_decision(self.full, self.holder))
+        self.assertEqual(self.full["pids"][str(self.former)][0]["flags"],
+                         self.full["pids"][str(self.holder)][0]["flags"])
+
+
+class VisibilityDecisionTest(unittest.TestCase):
+    def test_cross_checks(self):
+        visible = scan_of((10, [(3, "0x4003")]))
+        empty = scan_of()
+        self.assertEqual(v.label(v.visibility_decision("held", visible, 10, False)), "unknown:canary_not_visible")
+        self.assertEqual(v.label(v.visibility_decision("error:open:EPERM", visible, 10)), "unknown:probe_error")
+        self.assertEqual(v.label(v.visibility_decision("held", empty, 10)), v.U_HIDDEN)
+        self.assertEqual(v.label(v.visibility_decision("free", empty, 10)), v.U_ABSENT)
+        self.assertEqual(v.label(v.visibility_decision("held", visible, 10, True)), N)
+        self.assertEqual(v.label(v.visibility_decision("held", visible, 10)), N)
+
+    def test_pid_with_only_a_fileport_counts_as_no_visible_opener(self):
+        scan = {"valid": True, "pids": {"10": []}, "fileports": []}
+        self.assertEqual(v.label(v.visibility_decision("held", scan, 10)), v.U_HIDDEN)
+
+    def test_reduced_and_canary(self):
+        reference = scan_of((10, [(3, "0x4003")]))
+        self.assertFalse(v.reduced(reference, scan_of((10, [(3, "0x4003")]))))
+        self.assertTrue(v.reduced(reference, scan_of()))
+        self.assertTrue(v.reduced(reference, scan_of((10, [(3, "0x3")]))))
+        invalid = copy.deepcopy(reference)
+        invalid["valid"] = False
+        self.assertTrue(v.reduced(reference, invalid))
+        self.assertTrue(v.canary_visible(scan_of((7, [(3, "0x4003")])), 7))
+        self.assertFalse(v.canary_visible(scan_of(), 7))
+        self.assertFalse(v.canary_visible(scan_of((7, [(3, "0x3")])), 7))
+        self.assertFalse(v.canary_visible(scan_of((7, [(3, "0x4003")]), (8, [(3, "0x3")])), 7))
+        self.assertFalse(v.canary_visible(invalid, 10))
+
+    def test_modelled_omission_does_not_mutate_the_scan(self):
+        scan = scan_of((10, [(3, "0x4003")]), (11, [(3, "0x4003")]))
+        view = v.without_pids(scan, [11])
+        self.assertEqual(set(view["pids"]), {"10"})
+        self.assertEqual(set(scan["pids"]), {"10", "11"})
+
+
+class HiddenOutcomeTest(unittest.TestCase):
+    def test_outcomes(self):
+        def stages(before, probe):
+            return [{"view_decisions": {"a": before}}, {"probe": probe, "roles": {"a": "absent", "b": "bit"},
+                    "scan_valid": True, "unexpected_pids": 0}]
+        self.assertEqual(v.hidden_outcome(stages(N, "held"), "a"), "release_incomplete_due_to_hidden_reference")
+        self.assertEqual(v.HIDDEN_OUTCOME, "release_incomplete_due_to_hidden_reference")
+        self.assertEqual(v.hidden_outcome(stages(N, "free"), "a"), "released")
+        self.assertEqual(v.hidden_outcome(stages(R, "held"), "a"), "refused")
+        self.assertEqual(v.hidden_outcome(stages(v.U_ABSENT, "held"), "a"), "refused")
+        self.assertIsNone(v.hidden_outcome([], "a"))
+
+
+# ---------------------------------------------------------- expected tables
+
+def good_stage(expected):
+    stage = {"unexpected_pids": 0, "fileport_roles": {}}
+    stage.update(copy.deepcopy(expected))
+    if expected["stage"] == "receiver_holds_port_only":
+        stage["scan_problems"] = ["record:2:fG", "pid_without_fd:42", "fileport_record"]
+    return stage
+
+
+def good_scenarios():
+    fp0 = {"event": "fileports", "ok": True, "count": 1, "vnode": 1, "non_vnode": 0, "matching": 1,
+           "matching_was_locked": 1}
+    scenarios = {
+        "fileport": {
+            "stages": [good_stage(e) for e in v.EXPECTED["fileport"]],
+            "events": {"sent": {"event": "sent", "kr": 0}, "closed": {"event": "closed", "who": "sender"},
+                       "received": {"event": "received", "ports": 1}, "self_report": fp0,
+                       "made_fd": {"event": "made_fd", "matches": True, "port_released": True},
+                       "lookup_after_exit": {"event": "lookup", "kr": v.BOOTSTRAP_UNKNOWN_SERVICE}},
+            "finish": [{"exit": 0, "events": []}, {"exit": 0, "events": []}],
+        },
+        "hidden_sharer": {},
+        "former_vs_opener": {"stages": [good_stage(e) for e in v.EXPECTED["former_vs_opener"]],
+                             "finish": [{"exit": 0, "events": []}] * 3},
+        "sandbox_target": {name: {"stages": [good_stage(e) for e in v.EXPECTED[f"sandbox_target/{name}"]],
+                                  "finish": {"exit": 0, "events": []}} for name in ("allow_default", "deny_default")},
+        "sandbox_observer": {
+            "reference": {"probe": "held", "decision": N, "canary_visible": True, "scan_valid": True},
+            "profiles": {name: {"reduced": False, "canary_visible": True, "decision": N,
+                                "decision_without_canary": N, "probe": "held", "scan_valid": True,
+                                "target_present": True, "lsof_status": 0, "lsof_stderr": "",
+                                "classification": "unreduced"}
+                         for name in v.observer_profiles("x")},
+            "finish": [{"exit": 0, "events": []}] * 2,
+        },
+    }
+    for name in ("scm_hide_receiver", "scm_hide_sender", "fork_hide_child"):
+        finish = {"exit": 0, "events": [{"code": 0, "event": "child_exit"}]} if name == "fork_hide_child" \
+            else [{"exit": 0, "events": []}] * 2
+        scenarios["hidden_sharer"][name] = {
+            "stages": [good_stage(e) for e in v.EXPECTED[f"hidden_sharer/{name}"]],
+            "outcome": v.HIDDEN_OUTCOME, "finish": finish}
+    profiles = scenarios["sandbox_observer"]["profiles"]
+    profiles["allow_default"]["classification"] = "control_pass"
+    for name in ("deny_pidfdinfo", "deny_default"):
+        profiles[name].update(reduced=True, canary_visible=False, decision=v.U_CANARY, target_present=False,
+                              decision_without_canary=v.U_HIDDEN, lsof_status=1, classification="restricted_unknown")
+    profiles["deny_process_info"].update(reduced=True, canary_visible=False, decision=v.U_CANARY,
+                                         decision_without_canary=v.U_INVALID, scan_valid=False, lsof_status=1,
+                                         target_present=False, lsof_stderr="x", classification="restricted_unknown")
+    return scenarios
+
+
+class EvaluateTest(unittest.TestCase):
+    def test_good_input_has_no_mismatches(self):
+        self.assertEqual(v.evaluate(good_scenarios(), {}), [])
+
+    def test_closed_case_and_actor_exit_evidence(self):
+        for mutate in (
+            lambda s: s.update(extra={}),
+            lambda s: s["hidden_sharer"].update(extra={}),
+            lambda s: s["sandbox_target"].update(extra={}),
+            lambda s: s["sandbox_observer"].update(finish=[{"exit": 0, "events": []}]),
+            lambda s: s["fileport"]["stages"][0].pop("unexpected_pids"),
+        ):
+            result = good_scenarios()
+            mutate(result)
+            self.assertTrue(v.evaluate(result, {}))
+
+    def test_restricted_probe_failure_is_not_a_measured_success(self):
+        result = good_scenarios()
+        profile = result["sandbox_observer"]["profiles"]["deny_pidfdinfo"]
+        profile.update(probe="error:open:EACCES", decision_without_canary="unknown:probe_error")
+        self.assertIn("sandbox_observer/deny_pidfdinfo:probe_not_held", v.evaluate(result, {}))
+
+    def test_unrelated_scan_failure_is_not_the_fileport_observation(self):
+        result = good_scenarios()
+        stage = next(s for s in result["fileport"]["stages"] if s["stage"] == "receiver_holds_port_only")
+        stage["scan_problems"].append("stderr")
+        self.assertIn("fileport/receiver_holds_port_only:scan_problems", v.evaluate(result, {}))
+
+    def mutated(self, mutate):
+        scenarios = good_scenarios()
+        mutate(scenarios)
+        return v.evaluate(scenarios, {})
+
+    def test_counterexamples(self):
+        def bit(s):
+            s["fileport"]["stages"][4]["roles"]["receiver"] = "no_bit"
+
+        def probe(s):
+            s["fileport"]["stages"][2]["probe"] = "free"
+
+        def order(s):
+            st = s["former_vs_opener"]["stages"]
+            st[0], st[1] = st[1], st[0]
+
+        def unexpected(s):
+            s["hidden_sharer"]["scm_hide_sender"]["stages"][0]["unexpected_pids"] = 1
+
+        def outcome(s):
+            s["hidden_sharer"]["fork_hide_child"]["outcome"] = "released"
+
+        def lookup(s):
+            s["fileport"]["events"]["lookup_after_exit"]["kr"] = 0
+
+        def sent(s):
+            s["fileport"]["events"]["sent"]["kr"] = 268435459
+
+        def self_report(s):
+            s["fileport"]["events"]["self_report"]["matching_was_locked"] = 0
+
+        def finish(s):
+            s["sandbox_target"]["deny_default"]["finish"]["exit"] = 3
+
+        def fork_finish(s):
+            s["hidden_sharer"]["fork_hide_child"]["finish"]["events"] = []
+
+        def invalid_scan(s):
+            s["fileport"]["stages"][0]["scan_valid"] = False
+
+        def missing(s):
+            del s["former_vs_opener"]
+
+        def view(s):
+            s["former_vs_opener"]["stages"][1]["view_decisions"]["former"] = R
+
+        def made(s):
+            s["fileport"]["events"]["made_fd"]["matches"] = False
+
+        cases = {
+            bit: "fileport/receiver_made_fd:roles", probe: "fileport/sender_closed_in_transit:probe",
+            order: "former_vs_opener:stage_list", unexpected: "hidden_sharer/scm_hide_sender/both_hold:unexpected_pids",
+            outcome: "hidden_sharer/fork_hide_child:outcome", lookup: "fileport:service_not_removed",
+            sent: "fileport:sent", self_report: "fileport:self_report", finish: "sandbox_target/deny_default:finish",
+            fork_finish: "hidden_sharer/fork_hide_child:finish", invalid_scan: "fileport/sender_locked:scan_valid",
+            missing: "former_vs_opener:missing", view: "former_vs_opener/with_holder:view_decisions",
+            made: "fileport:made_fd",
+        }
+        def saturated(s):
+            s["fileport"]["stages"][3]["fileports"]["receiver"] = "error:saturated"
+
+        def self_error(s):
+            s["fileport"]["events"]["self_report"] = {"event": "fileports", "ok": False, "error": "query",
+                                                      "count": 1}
+        cases[saturated] = "fileport/receiver_holds_port_only:fileports"
+        cases[self_error] = "fileport:self_report"
+        for mutate, expected in cases.items():
+            with self.subTest(expected=expected):
+                self.assertIn(expected, self.mutated(mutate))
+
+    def test_not_executed_is_not_a_mismatch_but_is_not_ok(self):
+        scenarios = good_scenarios()
+        for name in ("fileport", "sandbox_observer", "sandbox_target", "former_vs_opener"):
+            del scenarios[name]
+        not_executed = {name: "C actor unavailable: clang not present"
+                        for name in ("fileport", "sandbox_observer", "sandbox_target", "former_vs_opener")}
+        self.assertEqual(v.evaluate(scenarios, not_executed), [])
+        self.assertIn("fileport:missing", v.evaluate(scenarios, {}))
+
+    def test_hidden_sharer_is_always_required(self):
+        scenarios = good_scenarios()
+        del scenarios["hidden_sharer"]
+        self.assertIn("hidden_sharer:missing", v.evaluate(scenarios, {}))
+
+
+class SandboxRuleTest(unittest.TestCase):
+    def result(self):
+        return good_scenarios()["sandbox_observer"]
+
+    def test_reduced_view_that_is_not_unknown_is_a_mismatch(self):
+        result = self.result()
+        result["profiles"]["deny_pidfdinfo"]["decision"] = N
+        self.assertIn("sandbox_observer/deny_pidfdinfo:reduced_not_unknown", v.sandbox_rule_mismatches(result))
+
+    def test_missing_canary_that_is_not_unknown_is_a_mismatch(self):
+        result = self.result()
+        result["profiles"]["deny_pidfdinfo_others"].update(canary_visible=False)
+        self.assertIn("sandbox_observer/deny_pidfdinfo_others:reduced_not_unknown", v.sandbox_rule_mismatches(result))
+
+    def test_reduced_held_view_without_canary_must_still_be_unknown(self):
+        result = self.result()
+        result["profiles"]["deny_default"]["decision_without_canary"] = R
+        self.assertIn("sandbox_observer/deny_default:reduced_without_canary_not_unknown",
+                      v.sandbox_rule_mismatches(result))
+
+    def test_unreduced_decision_must_match_reference(self):
+        result = self.result()
+        result["profiles"]["deny_pidfdinfo_others"]["decision"] = R
+        self.assertIn("sandbox_observer/deny_pidfdinfo_others:unreduced_decision_changed",
+                      v.sandbox_rule_mismatches(result))
+
+    def test_control_and_reference_and_profile_set(self):
+        result = self.result()
+        result["profiles"]["allow_default"].update(reduced=True, decision="unknown:canary_not_visible")
+        result["reference"]["probe"] = "free"
+        del result["profiles"]["deny_default"]
+        mismatches = v.sandbox_rule_mismatches(result)
+        for expected in ("sandbox_observer/allow_default:control_failed:reduced",
+                         "sandbox_observer/allow_default:control_failed:decision",
+                         "sandbox_observer:reference_failed:probe", "sandbox_observer:profile_set"):
+            self.assertIn(expected, mismatches)
+
+    def test_good_result_has_no_mismatches(self):
+        self.assertEqual(v.sandbox_rule_mismatches(self.result()), [])
+
+    def test_reviewer_control_mutation_is_a_mismatch(self):
+        # The review case: control canary missing and decision unknown, while
+        # `reduced` stays False. A failed control is never a success.
+        result = self.result()
+        result["profiles"]["allow_default"].update(canary_visible=False, decision=v.U_CANARY)
+        mismatches = v.sandbox_rule_mismatches(result)
+        self.assertIn("sandbox_observer/allow_default:control_failed:canary_visible", mismatches)
+        self.assertIn("sandbox_observer/allow_default:control_failed:decision", mismatches)
+        self.assertEqual(v.classify_profile("allow_default", result["profiles"]["allow_default"], N),
+                         "control_failed")
+        self.assertIn("sandbox_observer/allow_default:control_failed:decision",
+                      v.evaluate({**good_scenarios(), "sandbox_observer": result}, {}))
+
+    def test_control_contract_rejects_missing_negated_and_retyped_fields(self):
+        for key, want in v.CONTROL_CONTRACT.items():
+            for mode in ("missing", "negated", "retyped"):
+                with self.subTest(key=key, mode=mode):
+                    result = self.result()
+                    record = result["profiles"]["allow_default"]
+                    if mode == "missing":
+                        del record[key]
+                    elif mode == "negated":
+                        record[key] = (not want) if isinstance(want, bool) else (
+                            want + 1 if isinstance(want, int) else want + "x")
+                    else:
+                        record[key] = int(want) if isinstance(want, bool) else (
+                            float(want) if isinstance(want, int) else None)
+                    self.assertIn(f"sandbox_observer/allow_default:control_failed:{key}",
+                                  v.sandbox_rule_mismatches(result))
+
+    def test_reference_contract_rejects_missing_negated_and_retyped_fields(self):
+        for key, want in v.REFERENCE_CONTRACT.items():
+            for value in (v.MISSING, (not want) if isinstance(want, bool) else want + "x",
+                          int(want) if isinstance(want, bool) else None):
+                with self.subTest(key=key, value=value):
+                    result = self.result()
+                    if value is v.MISSING:
+                        del result["reference"][key]
+                    else:
+                        result["reference"][key] = value
+                    self.assertIn(f"sandbox_observer:reference_failed:{key}", v.sandbox_rule_mismatches(result))
+        result = self.result()
+        del result["reference"]
+        self.assertIn("sandbox_observer:reference_failed:probe", v.sandbox_rule_mismatches(result))
+
+    def test_missing_control_profile_is_a_mismatch(self):
+        result = self.result()
+        del result["profiles"]["allow_default"]
+        self.assertIn("sandbox_observer/allow_default:control_failed:missing", v.sandbox_rule_mismatches(result))
+
+    def test_restricted_fields_must_be_present_and_typed(self):
+        for key in v.RESTRICTED_FIELDS:
+            with self.subTest(key=key):
+                result = self.result()
+                del result["profiles"]["deny_pidfdinfo"][key]
+                self.assertIn(f"sandbox_observer/deny_pidfdinfo:missing_field:{key}",
+                              v.sandbox_rule_mismatches(result))
+        result = self.result()
+        result["profiles"]["deny_pidfdinfo"]["reduced"] = 1
+        self.assertIn("sandbox_observer/deny_pidfdinfo:missing_field:reduced", v.sandbox_rule_mismatches(result))
+
+    def test_restricted_unknown_is_distinguished_from_a_failed_control(self):
+        profiles = self.result()["profiles"]
+        self.assertEqual(profiles["deny_pidfdinfo"]["classification"], "restricted_unknown")
+        self.assertEqual(v.classify_profile("deny_pidfdinfo", profiles["deny_pidfdinfo"], N), "restricted_unknown")
+        self.assertEqual(v.classify_profile("allow_default", profiles["deny_pidfdinfo"], N), "control_failed")
+        wrong = dict(profiles["deny_pidfdinfo"], decision=N)
+        self.assertEqual(v.classify_profile("deny_pidfdinfo", wrong, N), "rule_violation")
+
+    def test_vocabulary_outside_decisions_is_a_mismatch(self):
+        result = self.result()
+        result["profiles"]["deny_default"]["decision"] = "holder:bit_present"
+        mismatches = v.sandbox_rule_mismatches(result)
+        self.assertIn("sandbox_observer/deny_default:vocabulary", mismatches)
+        self.assertIn("sandbox_observer/deny_default:reduced_not_unknown", mismatches)
+
+
+class EventTest(unittest.TestCase):
+    def diag(self, stdout=b"", stderr=b"", status=0, problems=()):
+        return {"status": status, "stdout": stdout, "stderr": stderr, "problems": list(problems)}
+
+    def test_one_shot_framing(self):
+        good = b'{"event":"probe","result":"free"}\n'
+        self.assertEqual(v.parse_one_shot(self.diag(good), "probe")["event"], {"event": "probe", "result": "free"})
+        cases = {
+            "status": self.diag(good, status=3), "stderr": self.diag(good, b"x"),
+            "two_lines": self.diag(good + good), "partial": self.diag(good[:-1]),
+            "malformed": self.diag(b"{nope\n"), "wrong_event": self.diag(b'{"event":"failed"}\n'),
+            "timeout": self.diag(status=None, problems=["timeout"]), "empty": self.diag(b""),
+            "array": self.diag(b"[1]\n"),
+        }
+        for name, diag in cases.items():
+            with self.subTest(name=name):
+                parsed = v.parse_one_shot(diag, "probe")
+                self.assertIsNone(parsed["event"])
+                self.assertTrue(parsed["problems"])
+
+    def test_fileport_summary_shapes(self):
+        ok = {"event": "fileports", "ok": True, "count": 1, "vnode": 1, "non_vnode": 0, "matching": 1,
+              "matching_was_locked": 1}
+        self.assertEqual(v.fileport_summary(ok), v.FP1)
+        for kind in sorted(v.FILEPORT_ERRORS):
+            with self.subTest(kind=kind):
+                # An incomplete enumeration is an error, never a zero count.
+                event = {"event": "fileports", "ok": False, "error": kind, "count": 0}
+                self.assertEqual(v.fileport_summary(event), f"error:{kind}")
+        self.assertEqual(v.fileport_summary({"event": "fileports", "ok": False, "error": "/x/9876543"}),
+                         "error:other")
+        for bad in (None, {}, {"event": "fileports"}, dict(ok, count=True), dict(ok, matching="1"),
+                    {k: x for k, x in ok.items() if k != "count"}, dict(ok, event="probe"),
+                    dict(ok, vnode=0), dict(ok, matching=2, vnode=1), dict(ok, matching_was_locked=2),
+                    dict(ok, non_vnode=-1, vnode=2)):
+            with self.subTest(bad=bad):
+                self.assertEqual(v.fileport_summary(bad), "invalid")
+
+    def test_check_event(self):
+        self.assertTrue(v.check_event({"event": "sent", "kr": 0}, "sent", kr=lambda x: x == 0))
+        self.assertFalse(v.check_event({"event": "sent"}, "sent", kr=lambda x: x == 0))
+        self.assertFalse(v.check_event({"event": "failed", "kr": 0}, "sent", kr=lambda x: x == 0))
+        self.assertFalse(v.check_event("sent", "sent"))
+        self.assertFalse(v.is_pid(True))
+        self.assertTrue(v.SERVICE.fullmatch("dev.codex-unlock.research.127v.123.0a1b2c3d"))
+        self.assertFalse(v.SERVICE.fullmatch("dev.codex-unlock.research.127v.123.0a1b2c3d\n"))
+        self.assertFalse(v.SERVICE.fullmatch("com.apple.something"))
+
+
+class ProfileTest(unittest.TestCase):
+    def test_sbpl_string(self):
+        self.assertEqual(v.sbpl_string('/a b/"c"\\d'), '"/a b/\\"c\\"\\\\d"')
+        for bad in ("/a\nb", "/a\0b", "/a\x7fb"):
+            with self.subTest(bad=bad):
+                with self.assertRaises(ValueError):
+                    v.sbpl_string(bad)
+
+    def test_profiles_are_deterministic(self):
+        self.assertEqual(v.observer_profiles("/x"), v.observer_profiles("/x"))
+        self.assertIn("(deny default)", v.observer_profiles("/x")["deny_default"])
+        self.assertIn('(literal "/l")', v.target_profiles("/x", "/l")["deny_default"])
+
+    def test_write_private_refuses_existing_and_symlink(self):
+        root = scratch()
+        try:
+            path = root / "p.sb"
+            v.write_private(str(path), "(version 1)")
+            self.assertEqual(path.stat().st_mode & 0o777, 0o600)
+            with self.assertRaises(FileExistsError):
+                v.write_private(str(path), "(version 1)")
+            link = root / "link.sb"
+            link.symlink_to(root / "target.sb")
+            with self.assertRaises(FileExistsError):
+                v.write_private(str(link), "(version 1)")
+            self.assertFalse((root / "target.sb").exists())
+        finally:
+            clear_flat(root)
+
+
+class ProcessTest(unittest.TestCase):
+    """Finite synthetic children only; nothing is signalled."""
+
+    def setUp(self):
+        self.root = scratch()
+        self.runner = inherit.Run(self.root)
+        self.lab = v.Lab(v.State(self.runner), PY)
+
+    def tearDown(self):
+        self.runner.finish_all()
+        for item in self.runner.pending:
+            deadline = time.monotonic() + 5
+            while item["proc"].poll() is None and time.monotonic() < deadline:
+                time.sleep(0.05)
+            for stream in (item["proc"].stdout, item["proc"].stderr):
+                if stream and not stream.closed:
+                    stream.close()
+        clear_flat(self.root)
+
+    def child(self, code):
+        return self.runner.start("child", [PY, "-I", "-c", code])
+
+    def test_ready_with_wrong_pid_is_a_failure(self):
+        actor = self.child('import sys; print(\'{"event":"ready","pid":1,"kind":"holder"}\', flush=True); sys.stdin.read()')
+        self.assertIsNone(self.lab.ready(actor, "holder"))
+        self.assertIn("child:ready_pid", self.runner.failures)
+
+    def test_ready_with_wrong_kind_is_a_failure(self):
+        actor = self.child('import os, sys; print(\'{"event":"ready","pid":%d,"kind":"opener"}\' % os.getpid(), '
+                           'flush=True); sys.stdin.read()')
+        self.assertIsNone(self.lab.ready(actor, "holder"))
+        self.assertIn("child:ready_shape", self.runner.failures)
+
+    def test_early_exit_is_a_failure(self):
+        actor = self.child("pass")
+        self.assertIsNone(self.lab.ready(actor, "holder"))
+        self.assertIn("child:eof", self.runner.failures)
+
+    def test_failed_event_is_never_ready(self):
+        actor = self.child('print(\'{"event":"failed","reason":"check_in"}\', flush=True)')
+        self.assertIsNone(self.lab.ready(actor, "receiver"))
+        self.assertTrue(any(f.startswith("child:unexpected_event:failed") for f in self.runner.failures))
+
+    def test_partial_line_then_silence_is_incomplete(self):
+        actor = self.child('import sys; sys.stdout.write(\'{"event":"re\'); sys.stdout.flush(); sys.stdin.read()')
+        start = time.monotonic()
+        self.assertIsNone(self.lab.ready(actor, "holder"))
+        self.assertGreaterEqual(time.monotonic() - start, inherit.READY_TIMEOUT - 0.5)
+        self.assertIn("child:no_event", self.runner.incomplete)
+
+    def test_one_shot_timeout_is_pending_and_later_exited(self):
+        parsed = self.lab.one_shot(["-I", "-c", "import time; time.sleep(1)"], "probe", timeout=0.1)
+        self.assertIsNone(parsed["event"])
+        self.assertIn("timeout", parsed["problems"])
+        self.assertEqual(len(self.runner.pending), 1)
+        self.assertTrue(any(i.startswith("diagnostic_timeout:") for i in self.runner.incomplete))
+        deadline = time.monotonic() + 5
+        while self.runner.pending[0]["proc"].poll() is None and time.monotonic() < deadline:
+            time.sleep(0.05)
+        self.assertEqual(self.runner.poll_pending()[0]["state"], "exited:0")
+
+    def test_one_shot_malformed_output_is_a_failure(self):
+        parsed = self.lab.one_shot(["-I", "-c", "print('{oops')"], "probe")
+        self.assertIsNone(parsed["event"])
+        self.assertTrue(any(f.startswith("one_shot:-I:malformed_event") for f in self.runner.failures))
+
+
+@unittest.skipUnless(platform.system() == "Darwin" and os.access(v.CLANG, os.X_OK), "macOS with clang only")
+class ActorTest(unittest.TestCase):
+    """The compiled C actor with finite inputs; each child ends on EOF or by itself."""
+
+    @classmethod
+    def setUpClass(cls):
+        cls.root = scratch()
+        cls.runner = inherit.Run(cls.root)
+        cls.actor, cls.build = v.build_actor(cls.runner, cls.root)
+        if cls.actor is None:
+            clear_flat(cls.root)
+            raise unittest.SkipTest(f"actor not built: {cls.build}")
+
+    @classmethod
+    def tearDownClass(cls):
+        clear_flat(cls.root)
+
+    def call(self, args, data=b""):
+        proc = subprocess.Popen([self.actor, *args], stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                                stderr=subprocess.PIPE)
+        out, err = proc.communicate(data)
+        return proc.returncode, out, err
+
+    def fixture(self, name):
+        path = self.root / name
+        path.write_bytes(b"")
+        return str(path)
+
+    def test_build_recorded_binary_hash(self):
+        self.assertRegex(self.build["binary_sha256"], r"^[0-9a-f]{64}$")
+
+    def test_probe_free_and_held(self):
+        lock = self.fixture("probe.lock")
+        self.assertEqual(self.call(["probe", lock]), (0, b'{"event":"probe","result":"free"}\n', b""))
+        holder = subprocess.Popen([self.actor, "holder", lock], stdin=subprocess.PIPE, stdout=subprocess.PIPE)
+        try:
+            self.assertEqual(json.loads(holder.stdout.readline())["kind"], "holder")
+            self.assertEqual(self.call(["probe", lock])[1], b'{"event":"probe","result":"held"}\n')
+        finally:
+            holder.stdin.close()
+            self.assertEqual(holder.wait(), 0)
+            holder.stdout.close()
+        self.assertEqual(self.call(["probe", lock])[1], b'{"event":"probe","result":"free"}\n')
+
+    def test_framing_failures_end_with_exit_3(self):
+        lock = self.fixture("frame.lock")
+        for name, data in (("partial_at_eof", b"close_own_fd"), ("overlong", b"x" * 600 + b"\n")):
+            with self.subTest(name=name):
+                code, out, _ = self.call(["sender", lock], data)
+                self.assertEqual(code, 3)
+                self.assertEqual(json.loads(out.splitlines()[0])["event"], "ready")
+
+    def test_unknown_command_and_eof(self):
+        lock = self.fixture("cmd.lock")
+        code, out, _ = self.call(["opener", lock], b"nope\n")
+        self.assertEqual(code, 0)
+        self.assertEqual([json.loads(line)["event"] for line in out.splitlines()], ["ready", "error"])
+
+    def test_failures_are_reported_not_ready(self):
+        missing = str(self.root / "missing.lock")
+        self.assertEqual(self.call(["holder", missing])[:2], (3, b'{"event":"failed","reason":"open:ENOENT"}\n'))
+        self.assertEqual(self.call(["listfileports", "0", missing])[:2], (3, b'{"event":"failed","reason":"pid"}\n'))
+        self.assertEqual(self.call(["lookup", "bad name"])[:2], (3, b'{"event":"failed","reason":"service_name"}\n'))
+        self.assertEqual(self.call(["nope"])[:2], (2, b'{"event":"failed","reason":"usage"}\n'))
+        self.assertEqual(json.loads(self.call(["probe", missing])[1])["result"], "error:open:ENOENT")
+
+    def test_send_with_unknown_service_keeps_the_sender_usable(self):
+        lock = self.fixture("send.lock")
+        code, out, _ = self.call(["sender", lock], b"send dev.codex-unlock.research.127v.1.00000000\nclose_own_fd\n")
+        events = [json.loads(line) for line in out.splitlines()]
+        self.assertEqual(code, 0)
+        self.assertEqual([e["event"] for e in events], ["ready", "failed", "closed"])
+        self.assertEqual(events[1]["reason"], "look_up")
+
+    def fileports_event(self, args):
+        code, out, err = self.call(args)
+        self.assertEqual((code, err), (0, b""))
+        return json.loads(out)
+
+    def test_fileport_enumeration_complete_and_saturated(self):
+        lock = self.fixture("ports.lock")
+        one = self.fileports_event(["makeports", "1", lock])
+        # makeports never calls flock, so the description has no FWASLOCKED.
+        self.assertEqual(v.fileport_summary(one), "count=1,matching=1,was_locked=0")
+        self.assertEqual((one["vnode"], one["non_vnode"]), (1, 0))
+        below = self.fileports_event(["makeports", "63", lock])
+        self.assertEqual(v.fileport_summary(below), "count=63,matching=63,was_locked=0")
+        for n in ("64", "70"):
+            with self.subTest(n=n):
+                # A full buffer may hide more entries: an error, never a count.
+                full = self.fileports_event(["makeports", n, lock])
+                self.assertEqual(full["ok"], False)
+                self.assertEqual(v.fileport_summary(full), "error:saturated")
+
+    def test_fileport_identity_and_list_failures_are_errors(self):
+        missing = str(self.root / "missing.lock")
+        event = self.fileports_event(["listfileports", str(os.getpid()), missing])
+        self.assertEqual(v.fileport_summary(event), "error:identity")
+        lock = self.fixture("gone.lock")
+        child = subprocess.Popen([PY, "-I", "-c", "pass"])
+        self.assertEqual(child.wait(), 0)
+        event = self.fileports_event(["listfileports", str(child.pid), lock])
+        self.assertEqual(v.fileport_summary(event), "error:list_esrch")
+
+
+# ------------------------------------------------------------ privacy
+
+SECRET_PATH = "/Users/secret-owner/.codex/sessions/x.lock"
+SECRET_PID = "9876543"
+SECRET_SERVICE = "dev.codex-unlock.research.127v.9876543.deadbeef"
+SECRETS = ("secret-owner", SECRET_PID, "deadbeef", "/Users", ".codex", "Traceback")
+
+
+def poisoned_raw():
+    scenarios = good_scenarios()
+    stage = scenarios["fileport"]["stages"][0]
+    stage.update(stage=SECRET_PATH, probe="error:open:" + SECRET_PATH, raw={"pids": {SECRET_PID: SECRET_PATH}},
+                 scan_problems=[SECRET_PATH])
+    stage["roles"][SECRET_PATH] = SECRET_PID
+    stage["decisions"]["sender"] = "unknown:" + SECRET_PATH
+    stage["fileports"]["receiver"] = f"count={SECRET_PID},matching=0,was_locked=0"
+    stage["view_openers"] = int(SECRET_PID)
+    scenarios["fileport"]["ready"] = [{"pid": int(SECRET_PID), "service": SECRET_SERVICE}]
+    scenarios["hidden_sharer"]["fork_hide_child"]["outcome"] = SECRET_PATH
+    profiles = scenarios["sandbox_observer"]["profiles"]
+    profiles["deny_process_info"].update(lsof_stderr=SECRET_PATH, lsof_status=int(SECRET_PID),
+                                         classification=SECRET_PATH, probe=SECRET_PID)
+    profiles[SECRET_PATH] = {"decision": SECRET_SERVICE}
+    return {
+        "ok": True, "run_ok": SECRET_PATH, "measurement_ok": True, "collected": False, "measured": False,
+        "failures": [f"fp_sender:exit:{SECRET_PID}", f"{SECRET_PATH}:eof", f"one_shot:{SECRET_PATH}:stderr",
+                     f"fp_receiver:unexpected_event:failed:{SECRET_SERVICE}"],
+        "incomplete": [f"diagnostic_timeout:lsof:{SECRET_PID}", f"fp_receiver:exit_wait:{SECRET_PID}",
+                       f"{SECRET_SERVICE}:no_event", f"diagnostic_timeout:{SECRET_PATH}:{SECRET_PID}"],
+        "errors": [{"where": SECRET_PATH, "kind": "OSError", "detail": SECRET_PATH},
+                   {"where": "cleanup", "kind": SECRET_PATH, "detail": SECRET_SERVICE}, SECRET_PATH],
+        "not_executed": {"fileport": {"kind": SECRET_PATH, "detail": SECRET_PATH},
+                         SECRET_PATH: {"kind": "clang_missing", "detail": SECRET_PID}},
+        "mismatches": [f"fileport:{SECRET_PATH}", f"fileport/sender_locked:unexpected_pids:{SECRET_PID}",
+                       "fileport:sent", SECRET_SERVICE],
+        "pending_diagnostics": [{"argv0": SECRET_PATH, "pid": int(SECRET_PID)}],
+        "bootstrap_names": [{"service": SECRET_SERVICE, "status": SECRET_PATH}, {"service": SECRET_SERVICE,
+                                                                                 "status": "removed"}],
+        "cleanup": {"status": "failed", "reason": SECRET_PATH, "detail": SECRET_PATH},
+        "source_identity": {"unchanged": True, "start": {"visibility.py": SECRET_PATH},
+                            "end": {"visibility.py": "a" * 64, "inherit.py": SECRET_PID}},
+        "build": {"clang": [SECRET_PATH], "stderr": SECRET_PATH, "binary_sha256": SECRET_PATH},
+        "environment": {"release": SECRET_PATH, "machine": SECRET_PATH, "lsof": f"revision: {SECRET_PATH}",
+                        "filesystem": SECRET_PATH, "python": SECRET_PID, "mac_ver": SECRET_PATH},
+        "scratch_identity": [int(SECRET_PID), int(SECRET_PID)],
+        "scenarios": scenarios,
+    }
+
+
+class PrivacyTest(unittest.TestCase):
+    def assert_clean(self, text):
+        for secret in SECRETS:
+            self.assertNotIn(secret, text)
+
+    def test_poisoned_raw_result_gives_a_clean_public_summary(self):
+        public = v.public_summary(poisoned_raw())
+        self.assert_clean(json.dumps(public))
+        self.assertEqual(public["mismatches"], ["fileport:sent"])
+        self.assertEqual(public["unlisted_mismatches"], 3)
+        self.assertEqual(public["failure_kinds"], {"fp_receiver:unexpected_event": 1, "fp_sender:exit": 1,
+                                                   "one_shot:other": 1, "other:eof": 1})
+        self.assertEqual(public["incomplete_kinds"], {"diagnostic_timeout:lsof": 1, "diagnostic_timeout:other": 1,
+                                                      "fp_receiver:exit_wait": 1, "other:no_event": 1})
+        self.assertEqual(public["error_kinds"], {"cleanup:other": 1, "other:OSError": 1, "other:other": 1})
+        self.assertEqual(public["not_executed"], {"fileport": "other", "other": "clang_missing"})
+        self.assertEqual(public["cleanup"], {"status": "failed", "reason": "other"})
+        self.assertEqual(public["bootstrap_names"], {"other": 1, "removed": 1})
+        self.assertEqual(public["run_ok"], "other")
+        self.assertIsNone(public["binary_sha256"])
+        self.assertEqual(public["pending_diagnostics"], 1)
+        profile = public["sandbox_observer_profiles"]["deny_process_info"]
+        self.assertEqual((profile["lsof_status"], profile["lsof_stderr_present"], profile["probe"]),
+                         ("other", True, "other"))
+        self.assertNotIn(SECRET_PATH, public["sandbox_observer_profiles"])
+
+    def test_good_raw_result_keeps_the_needed_fields(self):
+        raw = {"ok": True, "run_ok": True, "measurement_ok": True, "collected": True, "measured": True,
+               "scenarios": good_scenarios(), "cleanup": {"status": "removed", "reason": None},
+               "bootstrap_names": [{"service": SECRET_SERVICE, "status": "removed"}]}
+        public = v.public_summary(raw)
+        self.assert_clean(json.dumps(public))
+        self.assertEqual(public["stages"]["fileport/fileport"][3]["fileports"], {"sender": v.FP0, "receiver": v.FP1})
+        self.assertEqual(public["stages"]["hidden_sharer/fork_hide_child/outcome"], v.HIDDEN_OUTCOME)
+        self.assertEqual(public["sandbox_observer_profiles"]["allow_default"]["classification"], "control_pass")
+        self.assertEqual(public["bootstrap_names"], {"removed": 1})
+
+    def test_summary_never_raises_or_echoes(self):
+        for raw in ([], None, SECRET_PATH, {"scenarios": SECRET_PATH}, {"failures": SECRET_PATH},
+                    {"errors": [None, 3]}, {"scenarios": {"fileport": {"stages": [SECRET_PATH, None]}}}):
+            with self.subTest(raw=type(raw).__name__):
+                self.assert_clean(json.dumps(v.public_summary(raw)))
+
+
+class CleanupTest(unittest.TestCase):
+    def setUp(self):
+        self.root = scratch()
+        self.dir = Path(tempfile.mkdtemp(prefix="codex-127v-fixture-", dir=self.root))
+        self.created = {"a.lock", "observer-x.sb", v.ACTOR_NAME}
+        for name in self.created:
+            (self.dir / name).write_bytes(b"")
+        st = os.lstat(self.dir)
+        self.identity = (st.st_dev, st.st_ino)
+
+    def tearDown(self):
+        if self.dir.is_symlink():
+            os.unlink(self.dir)
+        if self.dir.exists():
+            clear_flat(self.dir)
+        for name in os.listdir(self.root):
+            if os.path.isdir(self.root / name) and not os.path.islink(self.root / name):
+                clear_flat(self.root / name)
+        clear_flat(self.root)
+
+    def remaining(self):
+        return set(os.listdir(self.dir)) if self.dir.exists() else None
+
+    def test_removes_only_registered_names(self):
+        record = v.cleanup_scratch(self.dir, self.identity, self.created)
+        self.assertEqual((record["status"], record["removed"]), ("removed", 3))
+        self.assertFalse(self.dir.exists())
+
+    def test_unexpected_entry_preserves_everything(self):
+        (self.dir / "stranger").write_bytes(b"")
+        record = v.cleanup_scratch(self.dir, self.identity, self.created)
+        self.assertEqual((record["status"], record["reason"]), ("preserved", "unexpected_entries"))
+        self.assertEqual(self.remaining(), self.created | {"stranger"})
+
+    def test_identity_mismatch_preserves_everything(self):
+        record = v.cleanup_scratch(self.dir, (self.identity[0], self.identity[1] + 1), self.created)
+        self.assertEqual((record["status"], record["reason"]), ("preserved", "identity_mismatch"))
+        self.assertEqual(self.remaining(), self.created)
+
+    def test_symlinked_scratch_is_refused(self):
+        moved = self.root / "moved"
+        os.rename(self.dir, moved)
+        os.symlink(moved, self.dir)
+        record = v.cleanup_scratch(self.dir, self.identity, self.created)
+        self.assertEqual((record["status"], record["reason"]), ("preserved", "open_failed"))
+        self.assertEqual(set(os.listdir(moved)), self.created)
+
+    def test_unlink_failure_is_failed_and_preserves(self):
+        def unlink(name, dir_fd):
+            raise PermissionError(1, "Operation not permitted", SECRET_PATH)
+        record = v.cleanup_scratch(self.dir, self.identity, self.created, unlink=unlink)
+        self.assertEqual((record["status"], record["reason"]), ("failed", "unlink_failed"))
+        self.assertEqual(self.remaining(), self.created)
+
+    def test_rmdir_failure_is_failed_and_keeps_the_directory(self):
+        def rmdir(name, dir_fd):
+            raise OSError(66, "Directory not empty", SECRET_PATH)
+        record = v.cleanup_scratch(self.dir, self.identity, self.created, rmdir=rmdir)
+        self.assertEqual((record["status"], record["reason"]), ("failed", "rmdir_failed"))
+        self.assertEqual(self.remaining(), set())
+
+    def finalize(self, result, pending=(), **ops):
+        path = self.root / "result.json"
+        fd = inherit.open_result(str(path))
+        code = v.finalize(fd, result, self.dir, self.identity, self.created, list(pending), **ops)
+        written = json.loads(path.read_text())
+        os.unlink(path)
+        return code, written
+
+    def good_result(self):
+        return {"collected": True, "measured": True, "not_executed": {}, "errors": []}
+
+    def test_finalize_success_writes_ok_after_cleanup(self):
+        code, written = self.finalize(self.good_result())
+        self.assertEqual(code, 0)
+        self.assertEqual((written["ok"], written["run_ok"], written["measurement_ok"]), (True, True, True))
+        self.assertEqual(written["cleanup"]["status"], "removed")
+
+    def test_finalize_unlink_failure_is_not_ok_and_preserves_evidence(self):
+        def unlink(name, dir_fd):
+            raise PermissionError(1, "Operation not permitted", SECRET_PATH)
+        code, written = self.finalize(self.good_result(), unlink=unlink)
+        self.assertEqual(code, 1)
+        self.assertEqual((written["ok"], written["run_ok"], written["measurement_ok"]), (False, False, True))
+        self.assertEqual(written["cleanup"]["reason"], "unlink_failed")
+        self.assertEqual(self.remaining(), self.created)
+        public = json.dumps(v.public_summary(written))
+        self.assertNotIn("secret-owner", public)
+        self.assertIn('"unlink_failed"', public)
+
+    def test_finalize_rmdir_failure_is_not_ok(self):
+        def rmdir(name, dir_fd):
+            raise OSError(66, "Directory not empty")
+        code, written = self.finalize(self.good_result(), rmdir=rmdir)
+        self.assertEqual((code, written["run_ok"], written["cleanup"]["reason"]), (1, False, "rmdir_failed"))
+        self.assertTrue(self.dir.exists())
+
+    def test_finalize_unexpected_exception_still_writes_the_record(self):
+        def unlink(name, dir_fd):
+            raise RuntimeError(SECRET_PATH)
+        code, written = self.finalize(self.good_result(), unlink=unlink)
+        self.assertEqual((code, written["run_ok"], written["cleanup"]["status"]), (1, False, "failed"))
+        self.assertEqual(written["errors"][-1]["where"], "cleanup")
+        self.assertNotIn("secret-owner", json.dumps(v.public_summary(written)))
+
+    def test_finalize_preserves_when_measurement_failed_or_pending(self):
+        result = self.good_result()
+        result["measured"] = False
+        code, written = self.finalize(result)
+        self.assertEqual((code, written["cleanup"]["reason"], written["measurement_ok"]), (1, "measurement_not_ok", False))
+        result = self.good_result()
+        result["not_executed"] = {"fileport": {"kind": "clang_missing"}}
+        self.assertEqual(self.finalize(result)[1]["cleanup"]["reason"], "measurement_not_ok")
+        code, written = self.finalize(self.good_result(), pending=[{"pid": 1}])
+        self.assertEqual((code, written["cleanup"]["reason"]), (1, "pending_diagnostics"))
+        self.assertEqual(self.remaining(), self.created)
+
+
+class MainTest(unittest.TestCase):
+    def setUp(self):
+        self.root = scratch()
+
+    def tearDown(self):
+        clear_flat(self.root)
+
+    def run_main(self, *args):
+        proc = subprocess.run([PY, "-I", "-B", v.SCRIPT, *args], capture_output=True, timeout=None,
+                              stdin=subprocess.DEVNULL)
+        return proc.returncode, proc.stdout.decode(), proc.stderr.decode()
+
+    def test_existing_result_is_a_fatal_record_without_paths(self):
+        existing = self.root / "secret-owner-result.json"
+        existing.write_text("{}")
+        code, out, err = self.run_main("--scratch-root", str(self.root), "--result", str(existing))
+        if platform.system() != "Darwin":
+            self.skipTest("macOS only")
+        self.assertEqual(code, 2)
+        self.assertEqual(json.loads(out), {"ok": False, "fatal": "FileExistsError"})
+        self.assertEqual(err, "")
+        self.assertEqual(os.listdir(self.root), [existing.name])
+
+    def test_summarize_prints_only_the_public_summary(self):
+        raw = self.root / "raw.json"
+        raw.write_text(json.dumps(poisoned_raw()))
+        code, out, err = self.run_main("--summarize", str(raw))
+        self.assertEqual((code, err), (0, ""))
+        for secret in SECRETS:
+            self.assertNotIn(secret, out)
+        self.assertEqual(json.loads(out)["mismatches"], ["fileport:sent"])
+
+    def test_summarize_of_a_broken_file_has_no_traceback(self):
+        raw = self.root / "raw.json"
+        raw.write_text("{" + SECRET_PATH)
+        code, out, err = self.run_main("--summarize", str(raw))
+        self.assertEqual((code, err), (2, ""))
+        self.assertEqual(json.loads(out), {"ok": False, "fatal": "JSONDecodeError"})
+
+    def test_argument_combinations(self):
+        for args in ((), ("--summarize", "x", "--result", "y"), ("--scratch-root", "x")):
+            with self.subTest(args=args):
+                self.assertEqual(self.run_main(*args)[0], 2)
+
+
+class PrivateFailureTest(unittest.TestCase):
+    def setUp(self):
+        self.root = scratch()
+
+    def tearDown(self):
+        for name in os.listdir(self.root):
+            candidate = self.root / name
+            if candidate.is_dir():
+                clear_flat(candidate)
+        clear_flat(self.root)
+
+    def test_actor_stderr_is_private_and_marks_collection_failure(self):
+        run = v.PrivateRun(self.root)
+        actor = run.start("one_shot", [PY, "-I", "-c", "import sys; sys.stderr.write('private-path-sentinel')"])
+        result = run.finish(actor)
+        self.assertEqual(result["exit"], 0)
+        self.assertIn("one_shot:stderr", run.failures)
+        self.assertEqual(run.actor_diagnostics[0]["stderr"], "private-path-sentinel")
+        self.assertIsNone(actor["private_stderr"])
+
+    def test_initialization_failure_keeps_a_private_error_record(self):
+        raw = self.root / "result.json"
+        args = SimpleNamespace(result=str(raw), scratch_root=str(self.root))
+        with mock.patch.object(v.platform, "system", return_value="Darwin"), \
+             mock.patch.object(v.tempfile, "mkdtemp", side_effect=OSError("private-path-sentinel")), \
+             contextlib.redirect_stdout(io.StringIO()) as stdout:
+            self.assertEqual(v.measure(args), 2)
+        record = json.loads(raw.read_text())
+        self.assertFalse(record["collected"])
+        self.assertIn("private-path-sentinel", record["errors"][0]["detail"])
+        self.assertNotIn("private-path-sentinel", stdout.getvalue())
+
+    def test_sandbox_setup_exception_preserves_previous_stages(self):
+        raw = self.root / "result.json"
+        args = SimpleNamespace(result=str(raw), scratch_root=str(self.root))
+        def prior(_lab, record):
+            record["stages"].append({"stage": "sentinel"})
+        with contextlib.ExitStack() as stack:
+            stack.enter_context(mock.patch.object(v.platform, "system", return_value="Darwin"))
+            stack.enter_context(mock.patch.object(v, "build_actor", return_value=("unused", {})))
+            stack.enter_context(mock.patch.object(v, "scenario_fileport", side_effect=prior))
+            stack.enter_context(mock.patch.object(v, "scenario_hidden_sharer", return_value=None))
+            stack.enter_context(mock.patch.object(v, "scenario_former_vs_opener", side_effect=prior))
+            stack.enter_context(mock.patch.object(v, "sandbox_usable", side_effect=OSError("private-path-sentinel")))
+            stack.enter_context(mock.patch.object(inherit, "run_diagnostic", return_value={"stderr": b""}))
+            stack.enter_context(mock.patch.object(inherit, "filesystem_of", return_value="apfs"))
+            stdout = stack.enter_context(contextlib.redirect_stdout(io.StringIO()))
+            self.assertEqual(v.measure(args), 1)
+        record = json.loads(raw.read_text())
+        self.assertEqual(record["scenarios"]["fileport"]["stages"], [{"stage": "sentinel"}])
+        self.assertEqual(record["not_executed"]["sandbox_observer"]["kind"], "sandbox_unusable")
+        self.assertFalse(record["run_ok"])
+        self.assertNotIn("private-path-sentinel", stdout.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/experimental/127-macos-visibility/visibility.py b/experimental/127-macos-visibility/visibility.py
new file mode 100644
index 0000000..e39a646
--- /dev/null
+++ b/experimental/127-macos-visibility/visibility.py
@@ -0,0 +1,1412 @@
+#!/usr/bin/env python3
+"""#127 research: fileports, hidden sharers and restricted visibility (macOS).
+
+Same-user synthetic fixtures only. Never targets a Codex process or home.
+Every actor is started by this script and registered before use. Actors close
+their descriptors on stdin EOF. Their 20 s lifetime (C actor and the reused
+inherit.py actors) is checked only while they wait for a command: it does not
+interrupt a blocking write, file syscall or bootstrap RPC.
+
+Signals: this script never calls kill or a subprocess timeout that kills.
+Diagnostics (clang, lsof, sandbox-exec, one-shot C roles) are waited for with
+a bound; one that does not finish is recorded as incomplete with its PID in
+the private raw result, polled again at the end, and never stopped. Nothing
+here guarantees that any child actually ended.
+
+Scenarios (each uses a fresh fixture file):
+  fileport          C sender flocks, passes a Mach fileport to a separately
+                    started C receiver (not its descendant), then closes; the
+                    receiver later converts the port with fileport_makefd
+  hidden_sharer     description shared by SCM_RIGHTS or fork (inherit.py
+                    actors), with one sharer omitted from the observer's view
+                    by a model; the visible sharer then releases without a
+                    signal and the lock is re-probed
+  sandbox_observer  lsof scans and the flock probe run under sandbox-exec
+                    profiles written to the scratch directory
+  sandbox_target    the holder runs under sandbox-exec; the observer does not
+  former_vs_opener  former holder (LOCK_UN, FD kept) next to a never-locked
+                    opener, with and without a hidden actual holder
+
+The refusal-only filter evaluator returns only `unknown`, `reject` or
+`not_excluded`. FWASLOCKED is recorded and filtered on; it is never treated
+as holder evidence.
+
+Result fields: `collected` (no failure, incomplete wait or exception),
+`measured` (expected tables and rules hold), `measurement_ok` (both, and no
+scenario `not_executed`), `cleanup` (settled before the record is written)
+and `run_ok`/`ok` (measurement_ok and the scratch directory removed).
+
+Output: the raw result file is private (paths, PIDs, service names, stderr,
+exception text). Standard output carries only `public_summary`, an allowlist
+of fixed kinds, counts and validated identifiers. `--summarize <raw>` prints
+the same public summary for an existing raw result.
+"""
+
+import argparse
+import copy
+import hashlib
+import json
+import os
+import platform
+import re
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+CONTRACT = HERE.parent / "127-macos-contract"
+sys.path.insert(0, str(CONTRACT))
+import inherit  # noqa: E402  read-only reuse of framing, diagnostics, lsof parsing and actors
+
+SCRIPT = str(Path(__file__).resolve())
+ACTOR_SOURCE = str(HERE / "fileport_actor.c")
+ACTOR_NAME = "fileport_actor"
+CLANG = "/usr/bin/clang"
+SANDBOX_EXEC = "/usr/bin/sandbox-exec"
+COMPILE_TIMEOUT = 120.0
+BOOTSTRAP_UNKNOWN_SERVICE = 1102
+SERVICE = re.compile(r"^dev\.codex-unlock\.research\.127v\.[1-9][0-9]*\.[0-9a-f]{8}$")
+STDERR_KEEP = 512
+DECISIONS = ("unknown", "reject", "not_excluded")
+REASONS = {"bit_present", "bit_absent_on_all", "pid_absent", "scan_invalid", "flags_unreadable",
+           "canary_not_visible", "probe_error", "held_without_visible_opener"}
+FILEPORT_ERRORS = {"identity", "list", "list_esrch", "list_length", "saturated", "query", "short_read"}
+# Historical name in raw results of runs 1-4: "wrong_target_possible".
+HIDDEN_OUTCOME = "release_incomplete_due_to_hidden_reference"
+
+
+# ------------------------------------------------------------ evaluators
+
+def parse_fg(out):
+    """inherit.parse_fg, plus explicit recognition of lsof fileport records.
+
+    lsof prints a fileport held by a task as FD `fp.`. Such a record is a
+    parse problem (the scan is invalid), and it is also listed in
+    `fileports` so the result shows what made the scan invalid.
+    """
+    parsed = inherit.parse_fg(out)
+    fileports = []
+    pid = None
+    for record in out.split(b"\n"):
+        text = record.decode("ascii", "replace")
+        if re.fullmatch(r"p[1-9][0-9]*\0", text):
+            pid = int(text[1:-1])
+            continue
+        match = re.fullmatch(r"ffp\.\0G(0x[0-9a-f]+);0x[0-9a-f]+\0", text)
+        if match and pid is not None:
+            fileports.append({"pid": str(pid), "flags": match.group(1),
+                              "was_locked": bool(int(match.group(1), 16) & inherit.FWASLOCKED)})
+    problems = list(parsed["problems"])
+    if fileports:
+        problems.append("fileport_record")
+    return {"problems": problems, "pids": parsed["pids"], "fileports": fileports}
+
+
+def interpret_scan(status, stdout, stderr, problems=()):
+    """Strict scan validity, as inherit.fg_scan, from raw diagnostic output."""
+    problems = list(problems)
+    if stderr:
+        problems.append("stderr")
+    # lsof exits 1 with no output when nothing it can see has the file open.
+    if status is not None and (status not in (0, 1) or (status == 1 and stdout) or (status == 0 and not stdout)):
+        problems.append(f"status:{status}")
+    parsed = parse_fg(stdout) if status is not None else {"problems": [], "pids": {}, "fileports": []}
+    problems += parsed["problems"]
+    return {"valid": status is not None and not problems, "problems": problems, "status": status,
+            "pids": parsed["pids"], "fileports": parsed["fileports"],
+            "stderr": stderr[:STDERR_KEEP].decode("utf-8", "replace")}
+
+
+def filter_decision(scan, pid):
+    """Refusal-only FWASLOCKED filter (the #139 M2 rules), for one PID.
+
+    Only `unknown`, `reject` or `not_excluded`. `not_excluded` means only
+    "not refused by this filter"; the bit is sticky and never holder evidence.
+    """
+    if not scan["valid"]:
+        return {"decision": "unknown", "reason": "scan_invalid"}
+    descriptors = scan["pids"].get(str(pid)) or []
+    if not descriptors:
+        return {"decision": "unknown", "reason": "pid_absent"}
+    if any(d.get("was_locked") is None for d in descriptors):
+        return {"decision": "unknown", "reason": "flags_unreadable"}
+    if any(d["was_locked"] for d in descriptors):
+        return {"decision": "not_excluded", "reason": "bit_present"}
+    return {"decision": "reject", "reason": "bit_absent_on_all"}
+
+
+def visibility_decision(probe, scan, pid, canary_visible=None):
+    """Filter decision with visibility cross-checks; they only add `unknown`.
+
+    canary_visible: None when no canary was scanned, else whether a known
+    canary holder was seen exactly. A missing canary, a probe error, an
+    invalid scan, or a held lock with no visible opener is `unknown`. These
+    checks catch a whole-observer restriction; they do not detect a selective
+    omission of some processes.
+    """
+    if canary_visible is False:
+        return {"decision": "unknown", "reason": "canary_not_visible"}
+    if probe not in ("held", "free"):
+        return {"decision": "unknown", "reason": "probe_error"}
+    if not scan["valid"]:
+        return {"decision": "unknown", "reason": "scan_invalid"}
+    if probe == "held" and not any(scan["pids"].values()):
+        return {"decision": "unknown", "reason": "held_without_visible_opener"}
+    return filter_decision(scan, pid)
+
+
+def label(decision):
+    value = decision["decision"]
+    if value not in DECISIONS:
+        raise ValueError(f"decision outside the vocabulary: {value}")
+    return f"{value}:{decision['reason']}"
+
+
+def without_pids(scan, pids):
+    """A modelled clean omission of whole process records from a scan."""
+    hidden = {str(p) for p in pids}
+    view = copy.deepcopy(scan)
+    view["pids"] = {k: v for k, v in scan["pids"].items() if k not in hidden}
+    view["fileports"] = [f for f in scan.get("fileports", []) if f["pid"] not in hidden]
+    return view
+
+
+def view_signature(scan):
+    if not scan["valid"]:
+        return None
+    return {pid: sorted(d["flags"] for d in descriptors) for pid, descriptors in scan["pids"].items()}
+
+
+def reduced(reference, restricted):
+    """True when the restricted view differs from the unrestricted reference."""
+    signature = view_signature(restricted)
+    return signature is None or signature != view_signature(reference)
+
+
+def canary_visible(scan, canary_pid):
+    if not scan["valid"] or set(scan["pids"]) != {str(canary_pid)}:
+        return False
+    return any(d["was_locked"] for d in scan["pids"][str(canary_pid)])
+
+
+def role_states(scan, roles):
+    states, fileport_states = {}, {}
+    for role, pid in roles.items():
+        descriptors = scan["pids"].get(str(pid)) or []
+        states[role] = "absent" if not descriptors else (
+            "bit" if any(d["was_locked"] for d in descriptors) else "no_bit")
+        ports = [f for f in scan.get("fileports", []) if f["pid"] == str(pid)]
+        if ports:
+            fileport_states[role] = "bit" if any(f["was_locked"] for f in ports) else "no_bit"
+    other = sorted(set(scan["pids"]) - {str(p) for p in roles.values()})
+    return states, fileport_states, len(other)
+
+
+# ------------------------------------------------------------ actor events
+
+def is_pid(value):
+    return inherit.is_pid(value)
+
+
+def is_count(value):
+    return isinstance(value, int) and not isinstance(value, bool) and value >= 0
+
+
+def check_event(event, name, **fields):
+    """True when event is `name` and every field passes its predicate."""
+    if not isinstance(event, dict) or event.get("event") != name:
+        return False
+    for key, predicate in fields.items():
+        if key not in event or not predicate(event[key]):
+            return False
+    return True
+
+
+def parse_one_shot(result, expected):
+    """One-shot C role output: status 0, no stderr, exactly one framed event."""
+    problems = list(result["problems"])
+    if result["status"] != 0:
+        problems.append(f"status:{result['status']}")
+    if result["stderr"]:
+        problems.append("stderr")
+    out = result["stdout"]
+    lines = out.split(b"\n")
+    event = None
+    if not out.endswith(b"\n") or len(lines) != 2:
+        problems.append("framing")
+    else:
+        event = inherit.parse_event(lines[0])
+        if event is None:
+            problems.append("malformed_event")
+        elif event["event"] != expected:
+            problems.append(f"unexpected_event:{event['event']}")
+            event = None
+    return {"event": event if not problems else None, "problems": problems,
+            "stderr": result["stderr"][:STDERR_KEEP].decode("utf-8", "replace")}
+
+
+def fileport_summary(event):
+    """`count=…` for a complete enumeration, `error:<kind>` or `invalid`.
+
+    An incomplete enumeration (identity, list, saturation, query or short
+    read) is an error, never zero.
+    """
+    if not check_event(event, "fileports", ok=lambda v: isinstance(v, bool)):
+        return "invalid"
+    if not event["ok"]:
+        kind = event.get("error")
+        return f"error:{kind}" if kind in FILEPORT_ERRORS else "error:other"
+    keys = ("count", "vnode", "non_vnode", "matching", "matching_was_locked")
+    if not all(is_count(event.get(k)) for k in keys):
+        return "invalid"
+    if event["vnode"] + event["non_vnode"] != event["count"] or event["matching"] > event["vnode"] \
+            or event["matching_was_locked"] > event["matching"]:
+        return "invalid"
+    return f"count={event['count']},matching={event['matching']},was_locked={event['matching_was_locked']}"
+
+
+# --------------------------------------------------------------- the lab
+
+class State:
+    """Everything recorded for the raw result, registered before use."""
+
+    def __init__(self, run):
+        self.run = run
+        self.scenarios = {}
+        self.not_executed = {}
+        self.errors = []
+        self.services = []
+        self.created = set()
+
+    def error(self, where, error):
+        self.errors.append({"where": where, "kind": type(error).__name__, "detail": str(error)})
+
+
+class PrivateRun(inherit.Run):
+    """Keep actor diagnostics out of public stderr, without a blocking pipe.
+
+    The temporary file is private and unlinked. Only a bounded prefix enters
+    the private result; an unfinished actor retains its file until exit.
+    This is not a bound on the actor's disk writes or lifetime.
+    """
+    def __init__(self, scratch):
+        super().__init__(scratch)
+        self.actor_diagnostics = []
+
+    def start(self, label_, argv, pass_fds=()):
+        stderr = tempfile.TemporaryFile(dir=self.scratch)
+        try:
+            proc = subprocess.Popen(argv, stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                                    stderr=stderr, pass_fds=pass_fds, close_fds=True, bufsize=0)
+        except Exception:
+            stderr.close()
+            raise
+        actor = {"label": label_, "proc": proc, "framed": inherit.Framed(proc.stdout.fileno()),
+                 "finished": None, "private_stderr": stderr}
+        self.actors.append(actor)
+        return actor
+
+    def finish(self, actor):
+        try:
+            return super().finish(actor)
+        finally:
+            handle = actor.get("private_stderr")
+            if handle is not None:
+                try:
+                    if actor["proc"].poll() is None:
+                        self.actor_diagnostics.append({"label": actor["label"], "complete": False})
+                    else:
+                        handle.seek(0)
+                        data = handle.read(STDERR_KEEP + 1)
+                        if data:
+                            self.failures.append(f"{actor['label']}:stderr")
+                            self.actor_diagnostics.append({"label": actor["label"], "complete": True,
+                                "stderr": data[:STDERR_KEEP].decode("utf-8", "replace"),
+                                "truncated": len(data) > STDERR_KEEP})
+                finally:
+                    handle.close()
+                    actor["private_stderr"] = None
+
+
+class Lab:
+    def __init__(self, state, actor):
+        self.state = state
+        self.run = state.run
+        self.actor = actor
+
+    def fixture(self, name):
+        self.state.created.add(f"{name}.lock")
+        return inherit.fixture(self.run, name)
+
+    def write_profile(self, name, text):
+        self.state.created.add(name)
+        path = str(self.run.scratch / name)
+        write_private(path, text)
+        return path
+
+    def scan(self, path, prefix=()):
+        result = inherit.run_diagnostic(self.run, [*prefix, inherit.LSOF, "-nP", "+fg", "-F0pfG", "--", path])
+        return interpret_scan(result["status"], result["stdout"], result["stderr"], result["problems"])
+
+    def one_shot(self, args, expected, prefix=(), timeout=inherit.DIAGNOSTIC_TIMEOUT):
+        result = inherit.run_diagnostic(self.run, [*prefix, self.actor, *args], timeout=timeout)
+        parsed = parse_one_shot(result, expected)
+        if parsed["problems"] and "timeout" not in parsed["problems"]:
+            self.run.failures.append(f"one_shot:{args[0]}:{','.join(parsed['problems'])}")
+        return parsed
+
+    def start(self, label_, args, prefix=()):
+        return self.run.start(label_, [*prefix, self.actor, *args])
+
+    def ready(self, actor, kind, **extra):
+        event = self.run.read_event(actor, "ready")
+        if event is None:
+            return None
+        if not check_event(event, "ready", pid=is_pid, kind=lambda v: v == kind, **extra):
+            self.run.failures.append(f"{actor['label']}:ready_shape")
+            return None
+        if event["pid"] != actor["proc"].pid:
+            self.run.failures.append(f"{actor['label']}:ready_pid")
+            return None
+        return event
+
+    def lookup_service(self, entry, where):
+        """Check that a registered bootstrap name is gone; record the outcome."""
+        entry["where"] = where
+        if self.actor is None:
+            entry["status"] = "unconfirmed"
+            return None
+        event = self.one_shot(["lookup", entry["service"]], "lookup")["event"]
+        if check_event(event, "lookup", kr=lambda v: v == BOOTSTRAP_UNKNOWN_SERVICE):
+            entry["status"] = "removed"
+        elif check_event(event, "lookup", kr=lambda v: v == 0):
+            entry["status"] = "present"
+        else:
+            entry["status"] = "unconfirmed"
+        return event
+
+    def observe(self, path, stage, roles, fileports_for=None, view_hidden=None):
+        scan = self.scan(path)
+        probe = inherit.probe(path)
+        states, fileport_states, unexpected = role_states(scan, roles)
+        stage_record = {
+            "stage": stage, "probe": probe, "roles": states, "fileport_roles": fileport_states,
+            "unexpected_pids": unexpected, "scan_valid": scan["valid"], "scan_problems": scan["problems"],
+            "decisions": {role: label(visibility_decision(probe, scan, pid)) for role, pid in roles.items()},
+            "raw": scan,
+        }
+        if fileports_for:
+            stage_record["fileports"] = {
+                role: fileport_summary(self.one_shot(["listfileports", str(pid), path], "fileports")["event"])
+                for role, pid in fileports_for.items()}
+        if view_hidden is not None:
+            hidden = {role: pid for role, pid in roles.items() if role in view_hidden}
+            view = without_pids(scan, hidden.values())
+            stage_record["view_hidden"] = sorted(hidden)
+            stage_record["view_openers"] = sum(1 for v in view["pids"].values() if v)
+            stage_record["view_decisions"] = {
+                role: label(visibility_decision(probe, view, pid))
+                for role, pid in roles.items() if role not in hidden}
+        return stage_record
+
+
+# Each scenario fills a record that is already registered in the result, and
+# appends stages as it goes, so an exception keeps the earlier stages.
+
+def scenario_fileport(lab, record):
+    run = lab.run
+    lock = lab.fixture("fileport")
+    receiver = lab.start("fp_receiver", ["receiver", lock])
+    r = lab.ready(receiver, "receiver", service=lambda v: isinstance(v, str) and bool(SERVICE.fullmatch(v)))
+    record["ready"] = [r]
+    if r:
+        entry = {"service": r["service"], "status": "unchecked", "where": None}
+        lab.state.services.append(entry)
+    sender = lab.start("fp_sender", ["sender", lock])
+    s = lab.ready(sender, "sender")
+    record["ready"].append(s)
+    if not r or not s:
+        record["finish"] = [run.finish(sender), run.finish(receiver)]
+        return
+    roles = {"sender": s["pid"], "receiver": r["pid"]}
+    events = record["events"] = {}
+    stages = record["stages"]
+    stages.append(lab.observe(lock, "sender_locked", roles, roles))
+    events["sent"] = run.command(sender, "send " + r["service"], "sent")
+    stages.append(lab.observe(lock, "port_in_transit", roles, roles))
+    events["closed"] = run.command(sender, "close_own_fd", "closed")
+    stages.append(lab.observe(lock, "sender_closed_in_transit", roles, roles))
+    events["received"] = run.command(receiver, "receive", "received")
+    events["self_report"] = run.command(receiver, "fileports", "fileports")
+    stages.append(lab.observe(lock, "receiver_holds_port_only", roles, roles))
+    events["made_fd"] = run.command(receiver, "makefd", "made_fd")
+    stages.append(lab.observe(lock, "receiver_made_fd", roles, roles))
+    record["finish"] = [run.finish(sender)]
+    stages.append(lab.observe(lock, "sender_exited", roles))
+    record["finish"].append(run.finish(receiver))
+    stages.append(lab.observe(lock, "all_closed", {}))
+    # Normal completion only; names left unchecked are looked up in `finally`.
+    events["lookup_after_exit"] = lab.lookup_service(entry, "normal")
+
+
+def scenario_hidden_scm(lab, record, hide):
+    """SCM_RIGHTS sharing; `hide` is the sharer omitted from the model view."""
+    run = lab.run
+    lock = lab.fixture(f"hidden_scm_{hide}")
+    left, right = socket.socketpair(socket.AF_UNIX, socket.SOCK_STREAM)
+    try:
+        receiver = run.start_actor(f"hs_{hide}_receiver", ["scm_receiver", str(right.fileno())], (right.fileno(),))
+        sender = run.start_actor(f"hs_{hide}_sender", ["scm_sender", lock, str(left.fileno())], (left.fileno(),))
+    finally:
+        left.close()
+        right.close()
+    sent = run.read_event(sender, "ready")
+    received = run.read_event(receiver, "ready")
+    record["ready"] = [sent, received]
+    if not sent or not received or not is_pid(sent.get("pid")) or received.get("received") != 1:
+        record["finish"] = [run.finish(sender), run.finish(receiver)]
+        return
+    roles = {"sender": sent["pid"], "receiver": received["pid"]}
+    stages = record["stages"]
+    stages.append(lab.observe(lock, "both_hold", roles, view_hidden={hide}))
+    if hide == "receiver":
+        record["released"] = {"closed": run.command(sender, "close_own_fd", "closed")}
+    else:
+        record["released"] = {"finish": run.finish(receiver)}
+    stages.append(lab.observe(lock, "visible_released", roles, view_hidden={hide}))
+    record["finish"] = [run.finish(sender), run.finish(receiver)]
+    stages.append(lab.observe(lock, "all_closed", {}))
+
+
+def scenario_hidden_fork(lab, record):
+    run = lab.run
+    lock = lab.fixture("hidden_fork")
+    actor = run.start_actor("hf_parent", ["fork_shared", lock])
+    ready = record["ready"] = run.read_event(actor, "ready")
+    if not ready or not is_pid(ready.get("pid")) or not is_pid(ready.get("child_pid")):
+        record["finish"] = run.finish(actor)
+        return
+    roles = {"parent": ready["pid"], "forked_child": ready["child_pid"]}
+    stages = record["stages"]
+    stages.append(lab.observe(lock, "both_hold", roles, view_hidden={"forked_child"}))
+    record["released"] = {"closed": run.command(actor, "close_parent_fd", "closed")}
+    stages.append(lab.observe(lock, "visible_released", roles, view_hidden={"forked_child"}))
+    record["finish"] = run.finish(actor)
+    stages.append(lab.observe(lock, "all_closed", {}))
+
+
+def hidden_outcome(stages, visible):
+    """release_incomplete_due_to_hidden_reference: the filter did not refuse
+    the visible sharer, which really shares the locked description, and the
+    lock stayed held after that sharer released without any signal, because
+    a hidden sharer still references the same description. This is not a
+    non-holding opener mistaken for the holder (see former_vs_opener)."""
+    if len(stages) < 2:
+        return None
+    before = stages[0].get("view_decisions", {}).get(visible, "")
+    after_probe = stages[1]["probe"]
+    if before.startswith("not_excluded") and after_probe == "held":
+        after = stages[1]
+        roles = after.get("roles", {})
+        if after.get("scan_valid") is True and type(after.get("unexpected_pids")) is int and after["unexpected_pids"] == 0 \
+                and roles.get(visible) == "absent" and any(role != visible and value == "bit" for role, value in roles.items()):
+            return HIDDEN_OUTCOME
+        return "held_unattributed"
+    if before.startswith(("reject", "unknown")):
+        return "refused"
+    return "released"
+
+
+HIDDEN_VISIBLE = {"scm_hide_receiver": "sender", "scm_hide_sender": "receiver", "fork_hide_child": "parent"}
+
+
+def scenario_hidden_sharer(lab, record):
+    runners = {
+        "scm_hide_receiver": lambda sub: scenario_hidden_scm(lab, sub, "receiver"),
+        "scm_hide_sender": lambda sub: scenario_hidden_scm(lab, sub, "sender"),
+        "fork_hide_child": lambda sub: scenario_hidden_fork(lab, sub),
+    }
+    for name, runner in runners.items():
+        sub = record[name] = {"stages": []}
+        try:
+            runner(sub)
+        except Exception as error:  # recorded; the next shape still runs
+            lab.state.error(f"hidden_sharer/{name}", error)
+        finally:
+            sub["outcome"] = hidden_outcome(sub["stages"], HIDDEN_VISIBLE[name])
+
+
+def sbpl_string(path):
+    """An SBPL string literal; refuses characters that need more than escaping."""
+    if any(ord(c) < 0x20 or ord(c) == 0x7f for c in path):
+        raise ValueError("control character in sandbox profile path")
+    return '"' + path.replace("\\", "\\\\").replace('"', '\\"') + '"'
+
+
+def observer_profiles(actor):
+    exec_allow = f"(allow process-exec (literal {sbpl_string(inherit.LSOF)}) (literal {sbpl_string(actor)}))"
+    return {
+        "allow_default": "(version 1)(allow default)",
+        "deny_pidfdinfo": "(version 1)(allow default)(deny process-info-pidfdinfo)",
+        "deny_pidfdinfo_others": "(version 1)(allow default)(deny process-info-pidfdinfo (target others))",
+        "deny_process_info": "(version 1)(allow default)(deny process-info*)",
+        "deny_default": f"(version 1)(deny default){exec_allow}(allow file-read*)(allow sysctl-read)(allow process-info*)",
+    }
+
+
+PROFILE_NAMES = tuple(observer_profiles("x"))
+TARGET_NAMES = ("allow_default", "deny_default")
+
+
+def target_profiles(actor, lock):
+    return {
+        "allow_default": "(version 1)(allow default)",
+        "deny_default": (f"(version 1)(deny default)(allow process-exec (literal {sbpl_string(actor)}))"
+                         f"(allow file-read*)(allow file-write* (literal {sbpl_string(lock)}))(allow sysctl-read)"),
+    }
+
+
+def write_private(path, text):
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW | os.O_CLOEXEC, 0o600)
+    with os.fdopen(fd, "w") as handle:
+        handle.write(text)
+
+
+def sandbox_usable(run):
+    """sandbox-exec present and able to apply a trivial profile unprivileged."""
+    if not os.access(SANDBOX_EXEC, os.X_OK):
+        return False, {"kind": "sandbox_missing", "detail": "sandbox-exec not present"}
+    result = inherit.run_diagnostic(run, [SANDBOX_EXEC, "-p", "(version 1)(allow default)", "/usr/bin/true"])
+    if result["status"] != 0 or result["stderr"] or result["problems"]:
+        return False, {"kind": "sandbox_unusable",
+                       "detail": f"status={result['status']} problems={result['problems']} "
+                                 f"stderr={result['stderr'][:200].decode('utf-8', 'replace')}"}
+    return True, None
+
+
+def classify_profile(name, record, reference_decision):
+    """control_pass / control_failed / restricted_unknown / unreduced / rule_violation."""
+    if name == "allow_default":
+        contract = {k: v for k, v in CONTROL_CONTRACT.items() if k != "classification"}
+        return "control_pass" if not control_failures(record, contract) else "control_failed"
+    if record.get("reduced") is True or record.get("canary_visible") is not True:
+        return "restricted_unknown" if str(record.get("decision", "")).startswith("unknown:") else "rule_violation"
+    return "unreduced" if record.get("decision") == reference_decision else "rule_violation"
+
+
+def scenario_sandbox_observer(lab, record):
+    run = lab.run
+    lock = lab.fixture("sandbox_observer")
+    canary_lock = lab.fixture("sandbox_canary")
+    target = lab.start("so_target", ["holder", lock])
+    canary = lab.start("so_canary", ["holder", canary_lock])
+    t = lab.ready(target, "holder")
+    c = lab.ready(canary, "holder")
+    record["ready"] = [t, c]
+    if not t or not c:
+        record["finish"] = [run.finish(target), run.finish(canary)]
+        return
+    reference = lab.scan(lock)
+    reference_canary = lab.scan(canary_lock)
+    reference_probe = inherit.probe(lock)
+    record["reference"] = {
+        "probe": reference_probe, "scan_valid": reference["valid"],
+        "decision": label(visibility_decision(reference_probe, reference, t["pid"])),
+        "canary_visible": canary_visible(reference_canary, c["pid"]), "raw": reference}
+    profiles = record["profiles"] = {}
+    for name, text in observer_profiles(lab.actor).items():
+        profile = lab.write_profile(f"observer-{name}.sb", text)
+        prefix = (SANDBOX_EXEC, "-f", profile)
+        canary_scan = lab.scan(canary_lock, prefix)
+        scan = lab.scan(lock, prefix)
+        probe_event = lab.one_shot(["probe", lock], "probe", prefix)["event"]
+        probe = probe_event["result"] if check_event(probe_event, "probe", result=lambda v: isinstance(v, str)) \
+            else "error:invalid"
+        canary_ok = canary_visible(canary_scan, c["pid"])
+        entry = profiles[name] = {
+            "lsof_status": scan["status"], "lsof_stderr": scan["stderr"], "scan_valid": scan["valid"],
+            "scan_problems": scan["problems"], "target_present": str(t["pid"]) in scan["pids"],
+            "canary_status": canary_scan["status"], "canary_stderr": canary_scan["stderr"],
+            "canary_visible": canary_ok, "probe": probe, "reduced": reduced(reference, scan),
+            "decision": label(visibility_decision(probe, scan, t["pid"], canary_ok)),
+            "decision_without_canary": label(visibility_decision(probe, scan, t["pid"])),
+            "raw": scan, "raw_canary": canary_scan,
+        }
+        entry["classification"] = classify_profile(name, entry, record["reference"]["decision"])
+    record["finish"] = [run.finish(target), run.finish(canary)]
+
+
+def scenario_sandbox_target(lab, record):
+    run = lab.run
+    for name in TARGET_NAMES:
+        sub = record[name] = {"stages": []}
+        lock = lab.fixture(f"sandbox_target_{name}")
+        profile = lab.write_profile(f"target-{name}.sb", target_profiles(lab.actor, lock)[name])
+        holder = lab.start(f"st_{name}", ["holder", lock], (SANDBOX_EXEC, "-f", profile))
+        ready = sub["ready"] = lab.ready(holder, "holder")
+        if not ready:
+            sub["finish"] = run.finish(holder)
+            continue
+        sub["stages"].append(lab.observe(lock, "sandboxed_holder", {"holder": ready["pid"]}))
+        sub["finish"] = run.finish(holder)
+        sub["stages"].append(lab.observe(lock, "all_closed", {}))
+
+
+def scenario_former_vs_opener(lab, record):
+    run = lab.run
+    lock = lab.fixture("former_vs_opener")
+    former = lab.start("fo_former", ["former", lock])
+    f = lab.ready(former, "former")
+    opener = lab.start("fo_opener", ["opener", lock])
+    o = lab.ready(opener, "opener")
+    record["ready"] = [f, o]
+    if not f or not o:
+        record["finish"] = [run.finish(former), run.finish(opener)]
+        return
+    roles = {"former": f["pid"], "opener": o["pid"]}
+    stages = record["stages"]
+    stages.append(lab.observe(lock, "no_holder", roles))
+    holder = lab.start("fo_holder", ["holder", lock])
+    h = lab.ready(holder, "holder")
+    record["ready"].append(h)
+    if not h:
+        record["finish"] = [run.finish(former), run.finish(opener), run.finish(holder)]
+        return
+    roles["holder"] = h["pid"]
+    stages.append(lab.observe(lock, "with_holder", roles, view_hidden={"holder"}))
+    record["finish"] = [run.finish(holder), run.finish(former), run.finish(opener)]
+    stages.append(lab.observe(lock, "all_closed", {}))
+
+
+# ------------------------------------------------------- expected tables
+
+N = "not_excluded:bit_present"
+R = "reject:bit_absent_on_all"
+U_ABSENT = "unknown:pid_absent"
+U_HIDDEN = "unknown:held_without_visible_opener"
+U_INVALID = "unknown:scan_invalid"
+U_CANARY = "unknown:canary_not_visible"
+FP0 = "count=0,matching=0,was_locked=0"
+FP1 = "count=1,matching=1,was_locked=1"
+
+# Per stage, every listed key must equal the observation; scan validity and
+# zero unexpected PIDs are listed explicitly.
+EXPECTED = {
+    "fileport": [
+        {"stage": "sender_locked", "probe": "held", "scan_valid": True,
+         "roles": {"sender": "bit", "receiver": "absent"}, "fileport_roles": {},
+         "decisions": {"sender": N, "receiver": U_ABSENT}, "fileports": {"sender": FP0, "receiver": FP0}},
+        {"stage": "port_in_transit", "probe": "held", "scan_valid": True,
+         "roles": {"sender": "bit", "receiver": "absent"}, "fileport_roles": {},
+         "decisions": {"sender": N, "receiver": U_ABSENT}, "fileports": {"sender": FP0, "receiver": FP0}},
+        {"stage": "sender_closed_in_transit", "probe": "held", "scan_valid": True,
+         "roles": {"sender": "absent", "receiver": "absent"}, "fileport_roles": {},
+         "decisions": {"sender": U_HIDDEN, "receiver": U_HIDDEN}, "fileports": {"sender": FP0, "receiver": FP0}},
+        {"stage": "receiver_holds_port_only", "probe": "held", "scan_valid": False,
+         "roles": {"sender": "absent", "receiver": "absent"}, "fileport_roles": {"receiver": "bit"},
+         "decisions": {"sender": U_INVALID, "receiver": U_INVALID}, "fileports": {"sender": FP0, "receiver": FP1}},
+        {"stage": "receiver_made_fd", "probe": "held", "scan_valid": True,
+         "roles": {"sender": "absent", "receiver": "bit"}, "fileport_roles": {},
+         "decisions": {"sender": U_ABSENT, "receiver": N}, "fileports": {"sender": FP0, "receiver": FP0}},
+        {"stage": "sender_exited", "probe": "held", "scan_valid": True,
+         "roles": {"sender": "absent", "receiver": "bit"}, "decisions": {"sender": U_ABSENT, "receiver": N}},
+        {"stage": "all_closed", "probe": "free", "scan_valid": True, "roles": {}, "decisions": {}},
+    ],
+    "hidden_sharer/scm_hide_receiver": [
+        {"stage": "both_hold", "probe": "held", "scan_valid": True, "roles": {"sender": "bit", "receiver": "bit"},
+         "view_openers": 1, "view_decisions": {"sender": N}},
+        {"stage": "visible_released", "probe": "held", "scan_valid": True,
+         "roles": {"sender": "absent", "receiver": "bit"}, "view_openers": 0, "view_decisions": {"sender": U_HIDDEN}},
+        {"stage": "all_closed", "probe": "free", "scan_valid": True, "roles": {}},
+    ],
+    "hidden_sharer/scm_hide_sender": [
+        {"stage": "both_hold", "probe": "held", "scan_valid": True, "roles": {"sender": "bit", "receiver": "bit"},
+         "view_openers": 1, "view_decisions": {"receiver": N}},
+        {"stage": "visible_released", "probe": "held", "scan_valid": True,
+         "roles": {"sender": "bit", "receiver": "absent"}, "view_openers": 0, "view_decisions": {"receiver": U_HIDDEN}},
+        {"stage": "all_closed", "probe": "free", "scan_valid": True, "roles": {}},
+    ],
+    "hidden_sharer/fork_hide_child": [
+        {"stage": "both_hold", "probe": "held", "scan_valid": True,
+         "roles": {"parent": "bit", "forked_child": "bit"}, "view_openers": 1, "view_decisions": {"parent": N}},
+        {"stage": "visible_released", "probe": "held", "scan_valid": True,
+         "roles": {"parent": "absent", "forked_child": "bit"}, "view_openers": 0, "view_decisions": {"parent": U_HIDDEN}},
+        {"stage": "all_closed", "probe": "free", "scan_valid": True, "roles": {}},
+    ],
+    "sandbox_target/allow_default": [
+        {"stage": "sandboxed_holder", "probe": "held", "scan_valid": True, "roles": {"holder": "bit"},
+         "decisions": {"holder": N}},
+        {"stage": "all_closed", "probe": "free", "scan_valid": True, "roles": {}},
+    ],
+    "sandbox_target/deny_default": [
+        {"stage": "sandboxed_holder", "probe": "held", "scan_valid": True, "roles": {"holder": "bit"},
+         "decisions": {"holder": N}},
+        {"stage": "all_closed", "probe": "free", "scan_valid": True, "roles": {}},
+    ],
+    "former_vs_opener": [
+        {"stage": "no_holder", "probe": "free", "scan_valid": True, "roles": {"former": "bit", "opener": "no_bit"},
+         "decisions": {"former": N, "opener": R}},
+        {"stage": "with_holder", "probe": "held", "scan_valid": True,
+         "roles": {"former": "bit", "opener": "no_bit", "holder": "bit"},
+         "decisions": {"former": N, "opener": R, "holder": N},
+         "view_openers": 2, "view_decisions": {"former": N, "opener": R}},
+        {"stage": "all_closed", "probe": "free", "scan_valid": True, "roles": {}},
+    ],
+}
+
+# The positive control is a full contract, not just "not reduced". A failed
+# control is never a measurement success, whatever the restricted rows say.
+CONTROL_CONTRACT = {"reduced": False, "canary_visible": True, "probe": "held", "decision": N,
+                    "decision_without_canary": N, "scan_valid": True, "target_present": True,
+                    "lsof_status": 0, "lsof_stderr": "", "classification": "control_pass"}
+REFERENCE_CONTRACT = {"probe": "held", "decision": N, "canary_visible": True, "scan_valid": True}
+RESTRICTED_FIELDS = {"reduced": bool, "canary_visible": bool, "scan_valid": bool, "probe": str,
+                     "decision": str, "decision_without_canary": str, "classification": str}
+MISSING = object()
+
+
+def control_failures(record, contract):
+    """Fields of a record that do not match a contract exactly (type and value)."""
+    if not isinstance(record, dict):
+        return sorted(contract)
+    out = []
+    for key, want in contract.items():
+        got = record.get(key, MISSING)
+        if got is MISSING or type(got) is not type(want) or got != want:
+            out.append(key)
+    return out
+
+
+def stage_mismatches(where, stages, expected):
+    if not stages:
+        return [f"{where}:no_stages"]
+    if [s.get("stage") for s in stages] != [e["stage"] for e in expected]:
+        return [f"{where}:stage_list"]
+    out = []
+    for stage, want in zip(stages, expected):
+        at = f"{where}/{want['stage']}"
+        if type(stage.get("unexpected_pids")) is not int or stage["unexpected_pids"] != 0:
+            out.append(f"{at}:unexpected_pids")
+        if where == "fileport" and want["stage"] == "receiver_holds_port_only":
+            problems = stage.get("scan_problems")
+            if not isinstance(problems, list) or "fileport_record" not in problems or any(
+                    not isinstance(p, str) or (p != "fileport_record" and re.fullmatch(r"(?:record:[0-9]+:fG|pid_without_fd:[0-9]+)", p) is None)
+                    for p in problems):
+                out.append(f"{at}:scan_problems")
+        for key, value in want.items():
+            if stage.get(key) != value:
+                out.append(f"{at}:{key}")
+    return out
+
+
+def finish_ok(finish, events=()):
+    return isinstance(finish, dict) and finish.get("exit") == 0 and finish.get("events") == list(events)
+
+
+def sandbox_rule_mismatches(result):
+    """Control and reference contracts, then rules for restricted profiles:
+    reduced or canary-missing views are unknown; unreduced views keep the
+    reference decision."""
+    out = []
+    reference = result.get("reference")
+    for key in control_failures(reference, REFERENCE_CONTRACT):
+        out.append(f"sandbox_observer:reference_failed:{key}")
+    reference_decision = (reference or {}).get("decision")
+    profiles = result.get("profiles") or {}
+    if not isinstance(profiles, dict) or set(profiles) != set(PROFILE_NAMES):
+        out.append("sandbox_observer:profile_set")
+        profiles = profiles if isinstance(profiles, dict) else {}
+    if "allow_default" not in profiles:
+        out.append("sandbox_observer/allow_default:control_failed:missing")
+    for name, record in profiles.items():
+        at = f"sandbox_observer/{name}"
+        if name not in PROFILE_NAMES:
+            continue
+        if name == "allow_default":
+            for key in control_failures(record, CONTROL_CONTRACT):
+                out.append(f"{at}:control_failed:{key}")
+            continue
+        if not isinstance(record, dict):
+            out.append(f"{at}:missing_field:record")
+            continue
+        missing = [k for k, kind in RESTRICTED_FIELDS.items() if type(record.get(k, MISSING)) is not kind]
+        for key in missing:
+            out.append(f"{at}:missing_field:{key}")
+        if missing:
+            continue
+        if record["probe"] != "held":
+            out.append(f"{at}:probe_not_held")
+        decision = record["decision"]
+        if decision.split(":", 1)[0] not in DECISIONS:
+            out.append(f"{at}:vocabulary")
+        if record["reduced"] or not record["canary_visible"]:
+            if not decision.startswith("unknown:"):
+                out.append(f"{at}:reduced_not_unknown")
+            if record["probe"] == "held" and not record["decision_without_canary"].startswith("unknown:"):
+                out.append(f"{at}:reduced_without_canary_not_unknown")
+        elif decision != reference_decision or record["decision_without_canary"] != reference_decision:
+            out.append(f"{at}:unreduced_decision_changed")
+        if record["classification"] != classify_profile(name, record, reference_decision):
+            out.append(f"{at}:classification")
+    if not isinstance(result.get("finish"), list) or len(result["finish"]) != 2 or not all(finish_ok(f) for f in result["finish"]):
+        out.append("sandbox_observer:finish")
+    return out
+
+
+def evaluate(scenarios, not_executed, services=()):
+    mismatches = []
+    if set(scenarios) - set(SCENARIOS) or set(not_executed) - set(SCENARIOS):
+        mismatches.append("scenario_set")
+    fileport = scenarios.get("fileport")
+    if fileport is not None:
+        mismatches += stage_mismatches("fileport", fileport.get("stages"), EXPECTED["fileport"])
+        events = fileport.get("events") or {}
+        if not check_event(events.get("sent"), "sent", kr=lambda v: v == 0):
+            mismatches.append("fileport:sent")
+        if not check_event(events.get("closed"), "closed", who=lambda v: v == "sender"):
+            mismatches.append("fileport:closed")
+        if not check_event(events.get("received"), "received", ports=lambda v: v == 1):
+            mismatches.append("fileport:received")
+        if fileport_summary(events.get("self_report")) != FP1:
+            mismatches.append("fileport:self_report")
+        if not check_event(events.get("made_fd"), "made_fd", matches=lambda v: v is True,
+                           port_released=lambda v: v is True):
+            mismatches.append("fileport:made_fd")
+        if not check_event(events.get("lookup_after_exit"), "lookup", kr=lambda v: v == BOOTSTRAP_UNKNOWN_SERVICE):
+            mismatches.append("fileport:service_not_removed")
+        finishes = fileport.get("finish")
+        if not isinstance(finishes, list) or len(finishes) != 2 or not all(finish_ok(f) for f in finishes):
+            mismatches.append("fileport:finish")
+    elif "fileport" not in not_executed:
+        mismatches.append("fileport:missing")
+    for entry in services:
+        if entry.get("status") != "removed":
+            mismatches.append(f"bootstrap_name:{'present' if entry.get('status') == 'present' else 'unconfirmed'}")
+    hidden = scenarios.get("hidden_sharer")
+    if hidden is None:
+        mismatches.append("hidden_sharer:missing")
+    else:
+        if set(hidden) != set(HIDDEN_VISIBLE):
+            mismatches.append("hidden_sharer:case_set")
+        for name in HIDDEN_VISIBLE:
+            result = hidden.get(name) or {}
+            mismatches += stage_mismatches(f"hidden_sharer/{name}", result.get("stages"),
+                                           EXPECTED[f"hidden_sharer/{name}"])
+            if result.get("outcome") != HIDDEN_OUTCOME:
+                mismatches.append(f"hidden_sharer/{name}:outcome")
+            finish = result.get("finish")
+            if name == "fork_hide_child":
+                if not finish_ok(finish, [{"code": 0, "event": "child_exit"}]):
+                    mismatches.append(f"hidden_sharer/{name}:finish")
+            elif not isinstance(finish, list) or len(finish) != 2 or not all(finish_ok(f) for f in finish):
+                mismatches.append(f"hidden_sharer/{name}:finish")
+    for name in ("sandbox_observer", "sandbox_target", "former_vs_opener"):
+        if scenarios.get(name) is None and name not in not_executed:
+            mismatches.append(f"{name}:missing")
+    if scenarios.get("sandbox_observer") is not None:
+        mismatches += sandbox_rule_mismatches(scenarios["sandbox_observer"])
+    if scenarios.get("sandbox_target") is not None:
+        if set(scenarios["sandbox_target"]) != set(TARGET_NAMES):
+            mismatches.append("sandbox_target:case_set")
+        for name in TARGET_NAMES:
+            result = scenarios["sandbox_target"].get(name) or {}
+            mismatches += stage_mismatches(f"sandbox_target/{name}", result.get("stages"),
+                                           EXPECTED[f"sandbox_target/{name}"])
+            if not finish_ok(result.get("finish")):
+                mismatches.append(f"sandbox_target/{name}:finish")
+    if scenarios.get("former_vs_opener") is not None:
+        result = scenarios["former_vs_opener"]
+        mismatches += stage_mismatches("former_vs_opener", result.get("stages"), EXPECTED["former_vs_opener"])
+        finishes = result.get("finish")
+        if not isinstance(finishes, list) or len(finishes) != 3 or not all(finish_ok(f) for f in finishes):
+            mismatches.append("former_vs_opener:finish")
+    return mismatches
+
+
+# ------------------------------------------------------- public summary
+
+SCENARIOS = ("fileport", "hidden_sharer", "sandbox_observer", "sandbox_target", "former_vs_opener")
+STAGES = {e["stage"] for table in EXPECTED.values() for e in table}
+ROLES = {r for table in EXPECTED.values() for e in table for k in ("roles", "decisions", "view_decisions",
+                                                                    "fileports", "fileport_roles")
+         for r in e.get(k, {})}
+STATES = {"bit", "no_bit", "absent"}
+ERRNO_NAMES = {"EWOULDBLOCK", "EPERM", "EACCES", "ENOENT", "EBADF", "ELOOP", "ESRCH", "EINVAL", "other"}
+ACTOR_LABELS = {"fp_receiver", "fp_sender", "hf_parent", "so_target", "so_canary", "fo_former", "fo_opener",
+                "fo_holder", "one_shot", "diagnostic_timeout", "diagnostic_exit_wait"} | \
+    {f"hs_{h}_{r}" for h in ("receiver", "sender") for r in ("receiver", "sender")} | \
+    {f"st_{n}" for n in TARGET_NAMES}
+EVENT_KINDS = {"eof", "unterminated", "limit", "timeout", "malformed_event", "unexpected_event", "output_limit",
+               "exit", "exit_wait", "output_wait", "output_unterminated", "finish_error", "finish_unconfirmed",
+               "no_event", "ready_shape", "ready_pid", "lsof", "clang", "sandbox-exec", "mount", ACTOR_NAME,
+               "probe", "listfileports", "lookup", "makeports"}
+ERROR_KINDS = {"OSError", "FileExistsError", "FileNotFoundError", "PermissionError", "IsADirectoryError",
+               "NotADirectoryError", "BrokenPipeError", "TimeoutError", "ValueError", "KeyError", "TypeError",
+               "IndexError", "AttributeError", "RuntimeError", "UnicodeDecodeError", "JSONDecodeError"}
+ERROR_WHERE = set(SCENARIOS) | {f"hidden_sharer/{n}" for n in HIDDEN_VISIBLE} | \
+    {"build", "environment", "source_hashes", "bootstrap", "cleanup", "summary", "main"}
+NOT_EXECUTED_KINDS = {"clang_missing", "compile_failed", "sandbox_missing", "sandbox_unusable"}
+CLEANUP_STATUS = {"removed", "preserved", "failed"}
+CLEANUP_REASONS = {"measurement_not_ok", "pending_diagnostics", "open_failed", "identity_mismatch",
+                   "identity_changed", "unexpected_entries", "unlink_failed", "rmdir_failed", "listing_failed",
+                   "exception", None}
+SERVICE_STATUS = {"removed", "present", "unconfirmed", "unchecked"}
+MISMATCH_TOKENS = set(SCENARIOS) | STAGES | set(PROFILE_NAMES) | set(HIDDEN_VISIBLE) | set(TARGET_NAMES) | \
+    {k for table in EXPECTED.values() for e in table for k in e} | set(CONTROL_CONTRACT) | \
+    set(REFERENCE_CONTRACT) | set(RESTRICTED_FIELDS) | {
+        "no_stages", "stage_list", "unexpected_pids", "sent", "closed", "received", "self_report", "made_fd",
+        "service_not_removed", "finish", "missing", "outcome", "reference_failed", "control_failed",
+        "profile_set", "vocabulary", "reduced_not_unknown", "reduced_without_canary_not_unknown",
+        "unreduced_decision_changed", "missing_field", "record", "source_identity", "changed_or_unavailable",
+        "bootstrap_name", "present", "unconfirmed", "scenario_set", "case_set", "probe_not_held"}
+HEX64 = re.compile(r"^[0-9a-f]{64}$")
+FILEPORT_VALUE = re.compile(r"^count=[0-9]{1,3},matching=[0-9]{1,3},was_locked=[0-9]{1,3}$")
+PUBLIC_ENV = {"release": re.compile(r"^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$"),
+              "mac_ver": re.compile(r"^[0-9]{1,3}(\.[0-9]{1,3}){0,2}$"),
+              "python": re.compile(r"^[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,2}([abrc]{1,2}[0-9]{1,2})?$"),
+              "lsof": re.compile(r"^revision: [0-9]{1,2}\.[0-9]{1,3}(\.[0-9]{1,3})?$")}
+MACHINES = {"arm64", "x86_64"}
+FILESYSTEMS = {"apfs", "hfs", "msdos", "exfat", "smbfs", "nfs", "afpfs", "macfuse", "unknown"}
+CLANG_LINE = re.compile(r"^Apple clang version [0-9.]{1,20} \(clang-[0-9.]{1,20}\)$")
+
+
+def pick(value, allowed):
+    return value if isinstance(value, str) and value in allowed else "other"
+
+
+def public_probe(value):
+    if value in ("held", "free", "error:invalid"):
+        return value
+    if isinstance(value, str):
+        parts = value.split(":")
+        if len(parts) == 3 and parts[0] == "error" and parts[1] in ("open", "flock") and parts[2] in ERRNO_NAMES:
+            return value
+    return "other"
+
+
+def public_decision(value):
+    if isinstance(value, str) and value.count(":") == 1:
+        decision, reason = value.split(":")
+        if decision in DECISIONS and reason in REASONS:
+            return value
+    return "other"
+
+
+def public_fileport(value):
+    if isinstance(value, str) and (FILEPORT_VALUE.fullmatch(value) or value == "invalid"
+                                   or (value.startswith("error:") and value[6:] in FILEPORT_ERRORS | {"other"})):
+        return value
+    return "other"
+
+
+def public_map(value, convert):
+    if not isinstance(value, dict):
+        return "other"
+    return {pick(k, ROLES): convert(v) for k, v in value.items()}
+
+
+def public_stage(stage):
+    out = {"stage": pick(stage.get("stage"), STAGES) if isinstance(stage, dict) else "other"}
+    if not isinstance(stage, dict):
+        return out
+    out["probe"] = public_probe(stage.get("probe"))
+    out["scan_valid"] = stage.get("scan_valid") if isinstance(stage.get("scan_valid"), bool) else "other"
+    out["roles"] = public_map(stage.get("roles"), lambda v: pick(v, STATES))
+    for key, convert in (("fileport_roles", lambda v: pick(v, STATES)), ("decisions", public_decision),
+                         ("view_decisions", public_decision), ("fileports", public_fileport)):
+        if key in stage:
+            out[key] = public_map(stage[key], convert)
+    if "view_openers" in stage:
+        out["view_openers"] = stage["view_openers"] if is_count(stage["view_openers"]) and \
+            stage["view_openers"] < 100 else "other"
+    return out
+
+
+def public_kind(text, first_allowed, second_allowed):
+    parts = text.split(":") if isinstance(text, str) else []
+    first = pick(parts[0], first_allowed) if parts else "other"
+    second = pick(parts[1], second_allowed) if len(parts) > 1 else "none"
+    return f"{first}:{second}"
+
+
+def counts(items):
+    out = {}
+    for item in items:
+        out[item] = out.get(item, 0) + 1
+    return dict(sorted(out.items()))
+
+
+def public_mismatch(text):
+    tokens = re.split(r"[:/]", text) if isinstance(text, str) else [None]
+    return text if all(t in MISMATCH_TOKENS for t in tokens) else "other"
+
+
+def public_hashes(value):
+    if not isinstance(value, dict):
+        return "other"
+    names = ("visibility.py", "inherit.py", "fileport_actor.c")
+    return {n: value[n] if isinstance(value.get(n), str) and HEX64.fullmatch(value[n]) else "other"
+            for n in names if n in value}
+
+
+def public_summary_unchecked(raw):
+    scenarios = raw.get("scenarios") or {}
+    stages = {}
+    for name in SCENARIOS:
+        scenario = scenarios.get(name)
+        if not isinstance(scenario, dict):
+            continue
+        if name in ("hidden_sharer", "sandbox_target"):
+            parts = {sub: scenario.get(sub) for sub in (HIDDEN_VISIBLE if name == "hidden_sharer" else TARGET_NAMES)}
+        elif name == "sandbox_observer":
+            parts = {}
+        else:
+            parts = {name: scenario}
+        for sub, part in parts.items():
+            if not isinstance(part, dict):
+                continue
+            stages[f"{name}/{sub}"] = [public_stage(s) for s in part.get("stages") or [] if isinstance(s, dict)]
+            if "outcome" in part:
+                stages[f"{name}/{sub}/outcome"] = pick(part["outcome"], {HIDDEN_OUTCOME, "refused", "released", "held_unattributed"})
+    profiles = {}
+    observer = scenarios.get("sandbox_observer")
+    if isinstance(observer, dict) and isinstance(observer.get("profiles"), dict):
+        for name, record in observer["profiles"].items():
+            if name not in PROFILE_NAMES or not isinstance(record, dict):
+                continue
+            status = record.get("lsof_status")
+            profiles[name] = {
+                "lsof_status": status if status is None or (is_count(status) and status < 256) else "other",
+                "lsof_stderr_present": bool(record.get("lsof_stderr")),
+                "scan_valid": record.get("scan_valid") if isinstance(record.get("scan_valid"), bool) else "other",
+                "target_present": record.get("target_present") if isinstance(record.get("target_present"), bool)
+                else "other",
+                "canary_visible": record.get("canary_visible") if isinstance(record.get("canary_visible"), bool)
+                else "other",
+                "reduced": record.get("reduced") if isinstance(record.get("reduced"), bool) else "other",
+                "probe": public_probe(record.get("probe")),
+                "decision": public_decision(record.get("decision")),
+                "decision_without_canary": public_decision(record.get("decision_without_canary")),
+                "classification": pick(record.get("classification"),
+                                       {"control_pass", "control_failed", "restricted_unknown", "unreduced",
+                                        "rule_violation"}),
+            }
+    environment = raw.get("environment") or {}
+    public_env = {key: environment.get(key) if isinstance(environment.get(key), str) and
+                  pattern.fullmatch(environment[key]) else "other" for key, pattern in PUBLIC_ENV.items()}
+    public_env["machine"] = pick(environment.get("machine"), MACHINES)
+    public_env["filesystem"] = pick(environment.get("filesystem"), FILESYSTEMS)
+    build = raw.get("build") or {}
+    clang = build.get("clang")
+    cleanup = raw.get("cleanup") or {}
+    not_executed = raw.get("not_executed") or {}
+    services = raw.get("bootstrap_names") or []
+    mismatches = [public_mismatch(m) for m in raw.get("mismatches") or []]
+    bools = {k: raw.get(k) if isinstance(raw.get(k), bool) else "other"
+             for k in ("ok", "run_ok", "measurement_ok", "collected", "measured")}
+    return {
+        **bools,
+        "not_executed": {pick(k, set(SCENARIOS)): pick((v or {}).get("kind") if isinstance(v, dict) else None,
+                                                       NOT_EXECUTED_KINDS) for k, v in not_executed.items()},
+        "failure_kinds": counts(public_kind(f, ACTOR_LABELS, EVENT_KINDS) for f in raw.get("failures") or []),
+        "incomplete_kinds": counts(public_kind(f, ACTOR_LABELS, EVENT_KINDS) for f in raw.get("incomplete") or []),
+        "error_kinds": counts(f"{pick(e.get('where'), ERROR_WHERE)}:{pick(e.get('kind'), ERROR_KINDS)}"
+                              if isinstance(e, dict) else "other:other" for e in raw.get("errors") or []),
+        "pending_diagnostics": len(raw.get("pending_diagnostics") or []),
+        "mismatches": sorted(m for m in mismatches if m != "other"),
+        "unlisted_mismatches": mismatches.count("other"),
+        "bootstrap_names": counts(pick(s.get("status") if isinstance(s, dict) else None, SERVICE_STATUS)
+                                  for s in services),
+        "cleanup": {"status": pick(cleanup.get("status"), CLEANUP_STATUS),
+                    "reason": cleanup.get("reason") if cleanup.get("reason") in CLEANUP_REASONS else "other"},
+        "source_identity": {
+            "unchanged": (raw.get("source_identity") or {}).get("unchanged") is True,
+            "start": public_hashes((raw.get("source_identity") or {}).get("start")),
+            "end": public_hashes((raw.get("source_identity") or {}).get("end"))},
+        "binary_sha256": build.get("binary_sha256") if isinstance(build.get("binary_sha256"), str) and
+        HEX64.fullmatch(build["binary_sha256"]) else None,
+        "clang": clang[0] if isinstance(clang, list) and len(clang) == 1 and isinstance(clang[0], str) and
+        CLANG_LINE.fullmatch(clang[0]) else "other",
+        "environment": public_env,
+        "stages": stages,
+        "sandbox_observer_profiles": profiles,
+    }
+
+
+def public_summary(raw):
+    """Allowlisted, path-, PID-, service- and stderr-free summary of a raw result."""
+    try:
+        if not isinstance(raw, dict):
+            raise TypeError("raw result is not an object")
+        return public_summary_unchecked(raw)
+    except Exception as error:  # never echo the raw text
+        return {"ok": False, "summary_error": pick(type(error).__name__, ERROR_KINDS)}
+
+
+# ------------------------------------------------------------- results
+
+def sha256_file(path):
+    return hashlib.sha256(Path(path).read_bytes()).hexdigest()
+
+
+def source_hashes():
+    return {"visibility.py": sha256_file(SCRIPT), "inherit.py": sha256_file(inherit.SCRIPT),
+            "fileport_actor.c": sha256_file(ACTOR_SOURCE)}
+
+
+def build_actor(run, out_dir, created=None):
+    """Compile the C actor into the scratch directory, or say why not."""
+    if not os.access(CLANG, os.X_OK):
+        return None, {"kind": "clang_missing", "detail": "clang not present"}
+    version = inherit.run_diagnostic(run, [CLANG, "--version"])
+    binary = str(Path(out_dir) / ACTOR_NAME)
+    if created is not None:
+        created.add(ACTOR_NAME)
+    result = inherit.run_diagnostic(run, [CLANG, "-std=c11", "-Wall", "-Wextra", "-Werror", "-O1",
+                                          "-o", binary, ACTOR_SOURCE], timeout=COMPILE_TIMEOUT)
+    info = {"clang": version["stdout"].decode("utf-8", "replace").splitlines()[:1],
+            "status": result["status"], "problems": result["problems"],
+            "stderr": result["stderr"][:STDERR_KEEP].decode("utf-8", "replace")}
+    if result["status"] != 0 or result["problems"] or not os.path.isfile(binary):
+        info["kind"] = "compile_failed"
+        info["detail"] = f"status={result['status']} problems={result['problems']}"
+        return None, info
+    info["binary_sha256"] = sha256_file(binary)
+    return binary, info
+
+
+def cleanup_scratch(scratch, identity, created, unlink=os.unlink, rmdir=os.rmdir):
+    """Remove only names this run created, relative to verified directory FDs.
+
+    The scratch directory must still be the one created (device and inode,
+    checked through an O_NOFOLLOW directory FD and again through its parent
+    before rmdir) and must contain only registered names. Anything else is
+    preserved. The checks narrow, but do not close, every path race.
+    """
+    record = {"status": "preserved", "reason": None, "detail": None, "removed": 0}
+    flags = os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW | os.O_CLOEXEC
+    scratch = Path(scratch)
+    try:
+        parent_fd = os.open(scratch.parent, flags)
+    except OSError as error:
+        record.update(reason="open_failed", detail=str(error))
+        return record
+    try:
+        try:
+            fd = os.open(scratch.name, flags, dir_fd=parent_fd)
+        except OSError as error:
+            record.update(reason="open_failed", detail=str(error))
+            return record
+        try:
+            st = os.fstat(fd)
+            if (st.st_dev, st.st_ino) != tuple(identity):
+                record.update(reason="identity_mismatch")
+                return record
+            try:
+                entries = set(os.listdir(fd))
+            except OSError as error:
+                record.update(reason="listing_failed", detail=str(error))
+                return record
+            unexpected = entries - set(created)
+            if unexpected:
+                record.update(reason="unexpected_entries", detail=sorted(unexpected))
+                return record
+            for name in sorted(entries):
+                try:
+                    unlink(name, dir_fd=fd)
+                except OSError as error:
+                    record.update(status="failed", reason="unlink_failed", detail=f"{name}: {error}")
+                    return record
+                record["removed"] += 1
+        finally:
+            os.close(fd)
+        st = os.stat(scratch.name, dir_fd=parent_fd, follow_symlinks=False)
+        if (st.st_dev, st.st_ino) != tuple(identity):
+            record.update(reason="identity_changed")
+            return record
+        try:
+            rmdir(scratch.name, dir_fd=parent_fd)
+        except OSError as error:
+            record.update(status="failed", reason="rmdir_failed", detail=str(error))
+            return record
+        record.update(status="removed")
+        return record
+    finally:
+        os.close(parent_fd)
+
+
+def finalize(result_fd, result, scratch, identity, created, pending, unlink=os.unlink, rmdir=os.rmdir):
+    """Settle cleanup, then write the record (always). Returns the exit code."""
+    measurement_ok = bool(result.get("collected")) and bool(result.get("measured")) and \
+        not result.get("not_executed")
+    result["measurement_ok"] = measurement_ok
+    if not measurement_ok:
+        cleanup = {"status": "preserved", "reason": "measurement_not_ok", "detail": None, "removed": 0}
+    elif pending:
+        cleanup = {"status": "preserved", "reason": "pending_diagnostics", "detail": None, "removed": 0}
+    else:
+        try:
+            cleanup = cleanup_scratch(scratch, identity, created, unlink, rmdir)
+        except Exception as error:  # recorded; the record is still written
+            cleanup = {"status": "failed", "reason": "exception", "detail": f"{type(error).__name__}: {error}",
+                       "removed": None}
+            result.setdefault("errors", []).append({"where": "cleanup", "kind": type(error).__name__,
+                                                    "detail": str(error)})
+    result["cleanup"] = cleanup
+    result["run_ok"] = result["ok"] = measurement_ok and cleanup["status"] == "removed"
+    with os.fdopen(result_fd, "w") as handle:
+        handle.write(json.dumps(result, indent=2, sort_keys=True, default=str))
+    return 0 if result["run_ok"] else 1
+
+
+def measure(args):
+    if platform.system() != "Darwin":
+        raise SystemExit("macOS only: fileports, FWASLOCKED and lsof +fg are XNU-specific")
+    result_fd = inherit.open_result(args.result)
+    scratch = None
+    try:
+        scratch = Path(tempfile.mkdtemp(prefix="codex-127v-fixture-", dir=args.scratch_root))
+        scratch.chmod(0o700)
+        created_stat = os.lstat(scratch)
+    except Exception as error:
+        result = {"collected": False, "measured": False, "measurement_ok": False, "run_ok": False, "ok": False,
+                  "errors": [{"where": "main", "kind": type(error).__name__, "detail": str(error)}],
+                  "scratch": str(scratch) if scratch is not None else None,
+                  "cleanup": {"status": "preserved", "reason": "measurement_not_ok", "removed": 0}}
+        with os.fdopen(result_fd, "w") as handle:
+            json.dump(result, handle)
+        print(json.dumps(public_summary(result), sort_keys=True))
+        return 2
+    identity = (created_stat.st_dev, created_stat.st_ino)
+    run = PrivateRun(scratch)
+    state = State(run)
+    build, environment = {}, {}
+    start_hashes = None
+    lab = Lab(state, None)
+    try:
+        start_hashes = source_hashes()
+    except Exception as error:
+        state.error("source_hashes", error)
+    try:
+        actor, build = build_actor(run, scratch, state.created)
+        lab.actor = actor
+    except Exception as error:
+        state.error("build", error)
+        actor, build = None, {"kind": "compile_failed", "detail": f"{type(error).__name__}"}
+
+    def scenario(name, function):
+        record = state.scenarios[name] = {} if name == "sandbox_target" else {"stages": []}
+        try:
+            function(lab, record)
+        except Exception as error:  # recorded, then reported nonzero
+            state.error(name, error)
+
+    try:
+        if actor is None:
+            for name in ("fileport", "sandbox_observer", "sandbox_target", "former_vs_opener"):
+                state.not_executed[name] = {"kind": build.get("kind", "compile_failed"),
+                                            "detail": build.get("detail")}
+        else:
+            scenario("fileport", scenario_fileport)
+        state.scenarios["hidden_sharer"] = {}
+        try:
+            scenario_hidden_sharer(lab, state.scenarios["hidden_sharer"])
+        except Exception as error:
+            state.error("hidden_sharer", error)
+        if actor is not None:
+            try:
+                usable, why = sandbox_usable(run)
+            except Exception as error:
+                state.error("sandbox_observer", error)
+                usable, why = False, {"kind": "sandbox_unusable", "detail": type(error).__name__}
+            if usable:
+                scenario("sandbox_observer", scenario_sandbox_observer)
+                scenario("sandbox_target", scenario_sandbox_target)
+            else:
+                state.not_executed["sandbox_observer"] = state.not_executed["sandbox_target"] = why
+            scenario("former_vs_opener", scenario_former_vs_opener)
+    finally:
+        run.finish_all()
+        # Names a scenario registered but did not check (for example after an
+        # exception) are looked up here; failures stay unconfirmed.
+        for entry in state.services:
+            if entry["status"] == "unchecked":
+                try:
+                    lab.lookup_service(entry, "finally")
+                except Exception as error:
+                    entry["status"] = "unconfirmed"
+                    state.error("bootstrap", error)
+    try:
+        version = inherit.run_diagnostic(run, [inherit.LSOF, "-v"])
+        environment = {
+            # Hostname deliberately omitted.
+            "system": platform.system(), "release": platform.release(), "machine": platform.machine(),
+            "mac_ver": platform.mac_ver()[0], "python": platform.python_version(),
+            "lsof": next((l.strip() for l in version["stderr"].decode("utf-8", "replace").splitlines()
+                          if "revision:" in l and "latest" not in l), None),
+            "filesystem": inherit.filesystem_of(run, scratch),
+        }
+    except Exception as error:
+        state.error("environment", error)
+    try:
+        mismatches = evaluate(state.scenarios, state.not_executed, state.services)
+    except Exception as error:
+        state.error("summary", error)
+        mismatches = ["scenario_set"]
+    end_hashes = None
+    try:
+        end_hashes = source_hashes()
+    except Exception as error:
+        state.error("source_hashes", error)
+    unchanged = start_hashes is not None and start_hashes == end_hashes
+    if not unchanged:
+        mismatches.append("source_identity:changed_or_unavailable")
+    pending = run.poll_pending()
+    collected = not run.failures and not run.incomplete and not state.errors
+    result = {
+        "collected": collected, "measured": not mismatches, "not_executed": state.not_executed,
+        "failures": run.failures, "incomplete": run.incomplete, "errors": state.errors,
+        "mismatches": mismatches, "pending_diagnostics": pending, "bootstrap_names": state.services,
+        "signals_sent_by_script": "none: no kill calls and no killing timeouts; see module docstring",
+        "script_sha256": (end_hashes or {}).get("visibility.py"),
+        "source_identity": {"start": start_hashes, "end": end_hashes, "unchanged": unchanged},
+        "build": build, "environment": environment, "scenarios": state.scenarios,
+        "scratch_identity": list(identity),
+        "actor_diagnostics": run.actor_diagnostics,
+    }
+    code = finalize(result_fd, result, scratch, identity, state.created, pending)
+    print(json.dumps(public_summary(result), indent=1, sort_keys=True))
+    return code
+
+
+def summarize(path):
+    fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_CLOEXEC)
+    with os.fdopen(fd, "rb") as handle:
+        raw = json.loads(handle.read(64 << 20))
+    print(json.dumps(public_summary(raw), indent=1, sort_keys=True))
+    return 0
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--scratch-root", help="existing directory; a private child is created")
+    parser.add_argument("--result", help="new JSON result path, outside the scratch directory")
+    parser.add_argument("--summarize", help="print the public summary of an existing raw result")
+    args = parser.parse_args(argv)
+    if bool(args.summarize) == bool(args.scratch_root or args.result) or \
+            (not args.summarize and not (args.scratch_root and args.result)):
+        parser.error("use --summarize RAW, or --scratch-root DIR --result NEW")
+    try:
+        return summarize(args.summarize) if args.summarize else measure(args)
+    except SystemExit:
+        raise
+    except Exception as error:  # no traceback: it could carry private paths
+        print(json.dumps({"ok": False, "fatal": pick(type(error).__name__, ERROR_KINDS)}))
+        return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

From eeb7605997d36653d2a4828c203b387fe33d9873 Mon Sep 17 00:00:00 2001
From: YEONGUK LEE <contact@abruption.dev>
Date: Sun, 18 Oct 2026 12:54:31 +0900
Subject: [PATCH 2/4] docs: point macOS research instructions to active CI

---
 experimental/127-macos-visibility/README.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/experimental/127-macos-visibility/README.md b/experimental/127-macos-visibility/README.md
index 5ac230e..128cd7c 100644
--- a/experimental/127-macos-visibility/README.md
+++ b/experimental/127-macos-visibility/README.md
@@ -371,6 +371,7 @@ Not covered by injection: `query` and `short_read`. They need a fileport
 that disappears between the list and the query, or a kernel record size
 change.
 
-`ci-proposal.patch` proposes a research-only workflow for `macos-15` and
-`macos-15-intel`. It is not applied. It prints only the public summary. See
+The checked-in [research workflow](../../.github/workflows/macos-visibility-research.yml)
+runs on `macos-15` and `macos-15-intel`. It prints the public measurement
+summary and fixed test status; raw diagnostics remain private. See
 [HANDOFF.md](HANDOFF.md).

From de4efc104b78efa0938f97bd35509f38f2eb1432 Mon Sep 17 00:00:00 2001
From: YEONGUK LEE <contact@abruption.dev>
Date: Sun, 18 Oct 2026 13:01:31 +0900
Subject: [PATCH 3/4] docs: record integrated macOS research CI status

---
 experimental/127-macos-visibility/HANDOFF.md | 13 ++++++++-----
 experimental/127-macos-visibility/README.md  |  5 +++--
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/experimental/127-macos-visibility/HANDOFF.md b/experimental/127-macos-visibility/HANDOFF.md
index 7d0ddff..896fff5 100644
--- a/experimental/127-macos-visibility/HANDOFF.md
+++ b/experimental/127-macos-visibility/HANDOFF.md
@@ -1,6 +1,7 @@
 # Handoff: proposed follow-ups outside this directory
 
-This directory owns no other file. The changes below are proposals only.
+Sections 1 and 2 propose follow-ups outside this directory. The research CI
+in section 3 is integrated; product policy changes remain proposals only.
 `docs/macos-owner-contract.md`, `experimental/127-macos-contract/` and
 `experimental/127-macos-prerequisites/` were read and left unchanged. Nothing
 here reproduces a real Codex process or a wrong signal to a real PID.
@@ -56,7 +57,8 @@ remain user decisions.
 ## 3. CI integration
 
 The integrating reviewer added `.github/workflows/macos-visibility-research.yml`
-from the handoff proposal. Its first hosted runs remain pending.
+from the handoff proposal. Hosted macOS 15 ARM/Intel jobs have passed; consult
+the PR checks for the result at each revision.
 
 - Runners: `macos-15` and `macos-15-intel`, with read-only `contents`
   permission and checkout pinned to the same SHA as the existing macOS
@@ -79,7 +81,7 @@ hosted runner cannot run something, the public summary names the
 `not_executed` kind or the failure kind, and the unmeasured scope must be
 reported from that.
 
-Risks to check on the first CI run:
+Hosted-runner limits to preserve:
 
 - `bootstrap_check_in` with a dynamic name worked in an interactive user
   session here. A hosted runner's launchd domain may refuse it. The receiver
@@ -98,5 +100,6 @@ Risks to check on the first CI run:
   acceptable residuals for (b), or move macOS toward (c).
 - Whether (b) should adopt the canary and the held-without-opener rule as
   candidates, knowing they do not detect selective omission.
-- Whether to adopt the CI proposal. `not_executed` must stay a failure either
-  way.
+
+The research CI is already included. `not_executed` remains a failure; any
+future change to that requirement needs a separate review.
diff --git a/experimental/127-macos-visibility/README.md b/experimental/127-macos-visibility/README.md
index 128cd7c..c0d7c6e 100644
--- a/experimental/127-macos-visibility/README.md
+++ b/experimental/127-macos-visibility/README.md
@@ -109,8 +109,9 @@ Start/end source hashes agreed: `visibility.py`
 `9dd55023765c0f873b25d1baacd609b0862f3105f597f82049f05f06be676b2d`,
 `fileport_actor.c`
 `ab295109045e6ac349b069f27b7b182945b7eb715a2ed9469ee49f856c613972`.
-This validates the revised harness on the same local macOS environment, not
-the pending hosted runners or native Codex behavior.
+This validates the revised harness on the same local macOS environment.
+Hosted-runner results are separate CI evidence; native Codex behavior remains
+unverified.
 
 ### History: runs 1–4 (earlier revision)
 

From f038d2b60e2e014cb6191d6f6743057840c2fc70 Mon Sep 17 00:00:00 2001
From: YEONGUK LEE <contact@abruption.dev>
Date: Sun, 18 Oct 2026 18:00:25 +0900
Subject: [PATCH 4/4] test: identify macOS privacy markers as synthetic
 fixtures

---
 .../127-macos-visibility/test_visibility.py   | 106 +++++++++---------
 1 file changed, 55 insertions(+), 51 deletions(-)

diff --git a/experimental/127-macos-visibility/test_visibility.py b/experimental/127-macos-visibility/test_visibility.py
index ebb6dea..4b62549 100644
--- a/experimental/127-macos-visibility/test_visibility.py
+++ b/experimental/127-macos-visibility/test_visibility.py
@@ -763,57 +763,61 @@ def test_fileport_identity_and_list_failures_are_errors(self):
 
 # ------------------------------------------------------------ privacy
 
-SECRET_PATH = "/Users/secret-owner/.codex/sessions/x.lock"
-SECRET_PID = "9876543"
-SECRET_SERVICE = "dev.codex-unlock.research.127v.9876543.deadbeef"
-SECRETS = ("secret-owner", SECRET_PID, "deadbeef", "/Users", ".codex", "Traceback")
+# Fixed synthetic privacy markers, not credentials or observations from a real
+# account, process or bootstrap service. These values deliberately enter the
+# raw-file CLI fixture; the assertions below require their exclusion from the
+# public summary. No file at SYNTHETIC_PRIVATE_PATH is read or written.
+SYNTHETIC_PRIVATE_PATH = "/Users/fixture-owner/.codex/sessions/x.lock"
+FIXTURE_PID = "9876543"
+SYNTHETIC_SERVICE = "dev.codex-unlock.research.127v.9876543.deadbeef"
+PRIVATE_MARKERS = ("fixture-owner", FIXTURE_PID, "deadbeef", "/Users", ".codex", "Traceback")
 
 
 def poisoned_raw():
     scenarios = good_scenarios()
     stage = scenarios["fileport"]["stages"][0]
-    stage.update(stage=SECRET_PATH, probe="error:open:" + SECRET_PATH, raw={"pids": {SECRET_PID: SECRET_PATH}},
-                 scan_problems=[SECRET_PATH])
-    stage["roles"][SECRET_PATH] = SECRET_PID
-    stage["decisions"]["sender"] = "unknown:" + SECRET_PATH
-    stage["fileports"]["receiver"] = f"count={SECRET_PID},matching=0,was_locked=0"
-    stage["view_openers"] = int(SECRET_PID)
-    scenarios["fileport"]["ready"] = [{"pid": int(SECRET_PID), "service": SECRET_SERVICE}]
-    scenarios["hidden_sharer"]["fork_hide_child"]["outcome"] = SECRET_PATH
+    stage.update(stage=SYNTHETIC_PRIVATE_PATH, probe="error:open:" + SYNTHETIC_PRIVATE_PATH, raw={"pids": {FIXTURE_PID: SYNTHETIC_PRIVATE_PATH}},
+                 scan_problems=[SYNTHETIC_PRIVATE_PATH])
+    stage["roles"][SYNTHETIC_PRIVATE_PATH] = FIXTURE_PID
+    stage["decisions"]["sender"] = "unknown:" + SYNTHETIC_PRIVATE_PATH
+    stage["fileports"]["receiver"] = f"count={FIXTURE_PID},matching=0,was_locked=0"
+    stage["view_openers"] = int(FIXTURE_PID)
+    scenarios["fileport"]["ready"] = [{"pid": int(FIXTURE_PID), "service": SYNTHETIC_SERVICE}]
+    scenarios["hidden_sharer"]["fork_hide_child"]["outcome"] = SYNTHETIC_PRIVATE_PATH
     profiles = scenarios["sandbox_observer"]["profiles"]
-    profiles["deny_process_info"].update(lsof_stderr=SECRET_PATH, lsof_status=int(SECRET_PID),
-                                         classification=SECRET_PATH, probe=SECRET_PID)
-    profiles[SECRET_PATH] = {"decision": SECRET_SERVICE}
+    profiles["deny_process_info"].update(lsof_stderr=SYNTHETIC_PRIVATE_PATH, lsof_status=int(FIXTURE_PID),
+                                         classification=SYNTHETIC_PRIVATE_PATH, probe=FIXTURE_PID)
+    profiles[SYNTHETIC_PRIVATE_PATH] = {"decision": SYNTHETIC_SERVICE}
     return {
-        "ok": True, "run_ok": SECRET_PATH, "measurement_ok": True, "collected": False, "measured": False,
-        "failures": [f"fp_sender:exit:{SECRET_PID}", f"{SECRET_PATH}:eof", f"one_shot:{SECRET_PATH}:stderr",
-                     f"fp_receiver:unexpected_event:failed:{SECRET_SERVICE}"],
-        "incomplete": [f"diagnostic_timeout:lsof:{SECRET_PID}", f"fp_receiver:exit_wait:{SECRET_PID}",
-                       f"{SECRET_SERVICE}:no_event", f"diagnostic_timeout:{SECRET_PATH}:{SECRET_PID}"],
-        "errors": [{"where": SECRET_PATH, "kind": "OSError", "detail": SECRET_PATH},
-                   {"where": "cleanup", "kind": SECRET_PATH, "detail": SECRET_SERVICE}, SECRET_PATH],
-        "not_executed": {"fileport": {"kind": SECRET_PATH, "detail": SECRET_PATH},
-                         SECRET_PATH: {"kind": "clang_missing", "detail": SECRET_PID}},
-        "mismatches": [f"fileport:{SECRET_PATH}", f"fileport/sender_locked:unexpected_pids:{SECRET_PID}",
-                       "fileport:sent", SECRET_SERVICE],
-        "pending_diagnostics": [{"argv0": SECRET_PATH, "pid": int(SECRET_PID)}],
-        "bootstrap_names": [{"service": SECRET_SERVICE, "status": SECRET_PATH}, {"service": SECRET_SERVICE,
+        "ok": True, "run_ok": SYNTHETIC_PRIVATE_PATH, "measurement_ok": True, "collected": False, "measured": False,
+        "failures": [f"fp_sender:exit:{FIXTURE_PID}", f"{SYNTHETIC_PRIVATE_PATH}:eof", f"one_shot:{SYNTHETIC_PRIVATE_PATH}:stderr",
+                     f"fp_receiver:unexpected_event:failed:{SYNTHETIC_SERVICE}"],
+        "incomplete": [f"diagnostic_timeout:lsof:{FIXTURE_PID}", f"fp_receiver:exit_wait:{FIXTURE_PID}",
+                       f"{SYNTHETIC_SERVICE}:no_event", f"diagnostic_timeout:{SYNTHETIC_PRIVATE_PATH}:{FIXTURE_PID}"],
+        "errors": [{"where": SYNTHETIC_PRIVATE_PATH, "kind": "OSError", "detail": SYNTHETIC_PRIVATE_PATH},
+                   {"where": "cleanup", "kind": SYNTHETIC_PRIVATE_PATH, "detail": SYNTHETIC_SERVICE}, SYNTHETIC_PRIVATE_PATH],
+        "not_executed": {"fileport": {"kind": SYNTHETIC_PRIVATE_PATH, "detail": SYNTHETIC_PRIVATE_PATH},
+                         SYNTHETIC_PRIVATE_PATH: {"kind": "clang_missing", "detail": FIXTURE_PID}},
+        "mismatches": [f"fileport:{SYNTHETIC_PRIVATE_PATH}", f"fileport/sender_locked:unexpected_pids:{FIXTURE_PID}",
+                       "fileport:sent", SYNTHETIC_SERVICE],
+        "pending_diagnostics": [{"argv0": SYNTHETIC_PRIVATE_PATH, "pid": int(FIXTURE_PID)}],
+        "bootstrap_names": [{"service": SYNTHETIC_SERVICE, "status": SYNTHETIC_PRIVATE_PATH}, {"service": SYNTHETIC_SERVICE,
                                                                                  "status": "removed"}],
-        "cleanup": {"status": "failed", "reason": SECRET_PATH, "detail": SECRET_PATH},
-        "source_identity": {"unchanged": True, "start": {"visibility.py": SECRET_PATH},
-                            "end": {"visibility.py": "a" * 64, "inherit.py": SECRET_PID}},
-        "build": {"clang": [SECRET_PATH], "stderr": SECRET_PATH, "binary_sha256": SECRET_PATH},
-        "environment": {"release": SECRET_PATH, "machine": SECRET_PATH, "lsof": f"revision: {SECRET_PATH}",
-                        "filesystem": SECRET_PATH, "python": SECRET_PID, "mac_ver": SECRET_PATH},
-        "scratch_identity": [int(SECRET_PID), int(SECRET_PID)],
+        "cleanup": {"status": "failed", "reason": SYNTHETIC_PRIVATE_PATH, "detail": SYNTHETIC_PRIVATE_PATH},
+        "source_identity": {"unchanged": True, "start": {"visibility.py": SYNTHETIC_PRIVATE_PATH},
+                            "end": {"visibility.py": "a" * 64, "inherit.py": FIXTURE_PID}},
+        "build": {"clang": [SYNTHETIC_PRIVATE_PATH], "stderr": SYNTHETIC_PRIVATE_PATH, "binary_sha256": SYNTHETIC_PRIVATE_PATH},
+        "environment": {"release": SYNTHETIC_PRIVATE_PATH, "machine": SYNTHETIC_PRIVATE_PATH, "lsof": f"revision: {SYNTHETIC_PRIVATE_PATH}",
+                        "filesystem": SYNTHETIC_PRIVATE_PATH, "python": FIXTURE_PID, "mac_ver": SYNTHETIC_PRIVATE_PATH},
+        "scratch_identity": [int(FIXTURE_PID), int(FIXTURE_PID)],
         "scenarios": scenarios,
     }
 
 
 class PrivacyTest(unittest.TestCase):
     def assert_clean(self, text):
-        for secret in SECRETS:
-            self.assertNotIn(secret, text)
+        for marker in PRIVATE_MARKERS:
+            self.assertNotIn(marker, text)
 
     def test_poisoned_raw_result_gives_a_clean_public_summary(self):
         public = v.public_summary(poisoned_raw())
@@ -834,12 +838,12 @@ def test_poisoned_raw_result_gives_a_clean_public_summary(self):
         profile = public["sandbox_observer_profiles"]["deny_process_info"]
         self.assertEqual((profile["lsof_status"], profile["lsof_stderr_present"], profile["probe"]),
                          ("other", True, "other"))
-        self.assertNotIn(SECRET_PATH, public["sandbox_observer_profiles"])
+        self.assertNotIn(SYNTHETIC_PRIVATE_PATH, public["sandbox_observer_profiles"])
 
     def test_good_raw_result_keeps_the_needed_fields(self):
         raw = {"ok": True, "run_ok": True, "measurement_ok": True, "collected": True, "measured": True,
                "scenarios": good_scenarios(), "cleanup": {"status": "removed", "reason": None},
-               "bootstrap_names": [{"service": SECRET_SERVICE, "status": "removed"}]}
+               "bootstrap_names": [{"service": SYNTHETIC_SERVICE, "status": "removed"}]}
         public = v.public_summary(raw)
         self.assert_clean(json.dumps(public))
         self.assertEqual(public["stages"]["fileport/fileport"][3]["fileports"], {"sender": v.FP0, "receiver": v.FP1})
@@ -848,8 +852,8 @@ def test_good_raw_result_keeps_the_needed_fields(self):
         self.assertEqual(public["bootstrap_names"], {"removed": 1})
 
     def test_summary_never_raises_or_echoes(self):
-        for raw in ([], None, SECRET_PATH, {"scenarios": SECRET_PATH}, {"failures": SECRET_PATH},
-                    {"errors": [None, 3]}, {"scenarios": {"fileport": {"stages": [SECRET_PATH, None]}}}):
+        for raw in ([], None, SYNTHETIC_PRIVATE_PATH, {"scenarios": SYNTHETIC_PRIVATE_PATH}, {"failures": SYNTHETIC_PRIVATE_PATH},
+                    {"errors": [None, 3]}, {"scenarios": {"fileport": {"stages": [SYNTHETIC_PRIVATE_PATH, None]}}}):
             with self.subTest(raw=type(raw).__name__):
                 self.assert_clean(json.dumps(v.public_summary(raw)))
 
@@ -903,14 +907,14 @@ def test_symlinked_scratch_is_refused(self):
 
     def test_unlink_failure_is_failed_and_preserves(self):
         def unlink(name, dir_fd):
-            raise PermissionError(1, "Operation not permitted", SECRET_PATH)
+            raise PermissionError(1, "Operation not permitted", SYNTHETIC_PRIVATE_PATH)
         record = v.cleanup_scratch(self.dir, self.identity, self.created, unlink=unlink)
         self.assertEqual((record["status"], record["reason"]), ("failed", "unlink_failed"))
         self.assertEqual(self.remaining(), self.created)
 
     def test_rmdir_failure_is_failed_and_keeps_the_directory(self):
         def rmdir(name, dir_fd):
-            raise OSError(66, "Directory not empty", SECRET_PATH)
+            raise OSError(66, "Directory not empty", SYNTHETIC_PRIVATE_PATH)
         record = v.cleanup_scratch(self.dir, self.identity, self.created, rmdir=rmdir)
         self.assertEqual((record["status"], record["reason"]), ("failed", "rmdir_failed"))
         self.assertEqual(self.remaining(), set())
@@ -934,14 +938,14 @@ def test_finalize_success_writes_ok_after_cleanup(self):
 
     def test_finalize_unlink_failure_is_not_ok_and_preserves_evidence(self):
         def unlink(name, dir_fd):
-            raise PermissionError(1, "Operation not permitted", SECRET_PATH)
+            raise PermissionError(1, "Operation not permitted", SYNTHETIC_PRIVATE_PATH)
         code, written = self.finalize(self.good_result(), unlink=unlink)
         self.assertEqual(code, 1)
         self.assertEqual((written["ok"], written["run_ok"], written["measurement_ok"]), (False, False, True))
         self.assertEqual(written["cleanup"]["reason"], "unlink_failed")
         self.assertEqual(self.remaining(), self.created)
         public = json.dumps(v.public_summary(written))
-        self.assertNotIn("secret-owner", public)
+        self.assertNotIn("fixture-owner", public)
         self.assertIn('"unlink_failed"', public)
 
     def test_finalize_rmdir_failure_is_not_ok(self):
@@ -953,11 +957,11 @@ def rmdir(name, dir_fd):
 
     def test_finalize_unexpected_exception_still_writes_the_record(self):
         def unlink(name, dir_fd):
-            raise RuntimeError(SECRET_PATH)
+            raise RuntimeError(SYNTHETIC_PRIVATE_PATH)
         code, written = self.finalize(self.good_result(), unlink=unlink)
         self.assertEqual((code, written["run_ok"], written["cleanup"]["status"]), (1, False, "failed"))
         self.assertEqual(written["errors"][-1]["where"], "cleanup")
-        self.assertNotIn("secret-owner", json.dumps(v.public_summary(written)))
+        self.assertNotIn("fixture-owner", json.dumps(v.public_summary(written)))
 
     def test_finalize_preserves_when_measurement_failed_or_pending(self):
         result = self.good_result()
@@ -985,7 +989,7 @@ def run_main(self, *args):
         return proc.returncode, proc.stdout.decode(), proc.stderr.decode()
 
     def test_existing_result_is_a_fatal_record_without_paths(self):
-        existing = self.root / "secret-owner-result.json"
+        existing = self.root / "fixture-owner-result.json"
         existing.write_text("{}")
         code, out, err = self.run_main("--scratch-root", str(self.root), "--result", str(existing))
         if platform.system() != "Darwin":
@@ -1000,13 +1004,13 @@ def test_summarize_prints_only_the_public_summary(self):
         raw.write_text(json.dumps(poisoned_raw()))
         code, out, err = self.run_main("--summarize", str(raw))
         self.assertEqual((code, err), (0, ""))
-        for secret in SECRETS:
-            self.assertNotIn(secret, out)
+        for marker in PRIVATE_MARKERS:
+            self.assertNotIn(marker, out)
         self.assertEqual(json.loads(out)["mismatches"], ["fileport:sent"])
 
     def test_summarize_of_a_broken_file_has_no_traceback(self):
         raw = self.root / "raw.json"
-        raw.write_text("{" + SECRET_PATH)
+        raw.write_text("{" + SYNTHETIC_PRIVATE_PATH)
         code, out, err = self.run_main("--summarize", str(raw))
         self.assertEqual((code, err), (2, ""))
         self.assertEqual(json.loads(out), {"ok": False, "fatal": "JSONDecodeError"})