diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5f012a1..b06afac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,32 @@
 
 ## Unreleased
 
+### Generation-owned startup readiness
+
+- `spawnDaemon` and `pty run` can arm a daemon-owned startup lease. PTY
+  publishes one lifecycle tag containing the opaque generation, host boot
+  identity, and absolute monotonic deadline before detached spawn returns.
+  Caller exit cannot disarm or extend the deadline. Only a current-generation
+  live-daemon compare-and-set away from the exact starting value disarms it.
+  At expiry, complete frozen child containment records terminal cause
+  `deadline` before exact teardown. An unavailable or partial process-table
+  observation records `teardown-unavailable` instead, best-effort signals
+  observed exact identities plus the root process group, and preserves exit
+  evidence without claiming exact containment. Startup-lease generations retain
+  their terminal lifecycle and exit evidence through natural child/daemon exit
+  for generation-fenced consumption.
+- The public client and machine CLI now expose typed accepted-socket ownership
+  for an exact held TCP 4-tuple and generation. Linux uses complete procfs
+  socket/descriptor tables; package production builds one universal Darwin
+  `libproc` helper for arm64 and x86_64, while source installs may fall back to
+  a best-effort local build without making a compiler an install requirement.
+  Inspection runs off the daemon event loop.
+  Results distinguish `Owned`, `NotOwned`, and `Unavailable`; incomplete,
+  scoped, or changing observations fail closed.
+- `compareAndSetLifecycle` / `pty readiness cas` provide the matching
+  generation-fenced one-tag CAS so stale readiness or terminal completions
+  cannot overwrite a replacement generation.
+
 ### `pty metadata patch` waits out the attach window
 
 - An attached child starts while `pty run` still holds the per-session
diff --git a/completions/pty.bash b/completions/pty.bash
index 26abf02..073b444 100644
--- a/completions/pty.bash
+++ b/completions/pty.bash
@@ -5,7 +5,7 @@ _pty() {
   COMPREPLY=()
   cur="${COMP_WORDS[COMP_CWORD]}"
   prev="${COMP_WORDS[COMP_CWORD-1]}"
-  commands="run attach a exec peek send events list ls stats restart kill recover rm remove gc tag tag-multi emit rename metadata evidence up down test remote-serve"
+  commands="run attach a exec peek send events list ls stats restart kill recover rm remove gc tag tag-multi emit rename metadata readiness evidence up down test remote-serve"
 
   if [[ ${COMP_CWORD} -eq 1 ]]; then
     if [[ "${cur}" == -* ]]; then
@@ -24,7 +24,7 @@ _pty() {
 
   case "${COMP_WORDS[1]}" in
     run)
-      COMPREPLY=($(compgen -W "-d --detach -a --attach -e --ephemeral --id --name --no-display-name --tag --env --unset-env --cwd --isolate-env --force" -- "${cur}"))
+      COMPREPLY=($(compgen -W "-d --detach -a --attach -e --ephemeral --id --name --no-display-name --tag --env --unset-env --cwd --isolate-env --force --startup-timeout-ms --lifecycle-tag" -- "${cur}"))
       ;;
     attach|a)
       if [[ "${prev}" == "--attach-stream-fd-v1" ]]; then
@@ -128,6 +128,30 @@ _pty() {
     metadata)
       COMPREPLY=($(compgen -W "--id" -- "${cur}"))
       ;;
+    readiness)
+      if [[ ${COMP_CWORD} -eq 2 ]]; then
+        COMPREPLY=($(compgen -W "ownership cas" -- "${cur}"))
+        return
+      fi
+      case "${COMP_WORDS[2]}" in
+        ownership)
+          if [[ "${prev}" == "--id" ]]; then
+            return
+          fi
+          if [[ "${cur}" == -* ]]; then
+            COMPREPLY=($(compgen -W "--id" -- "${cur}"))
+          fi
+          ;;
+        cas)
+          if [[ "${prev}" == "--id" ]]; then
+            return
+          fi
+          if [[ "${cur}" == -* ]]; then
+            COMPREPLY=($(compgen -W "--id" -- "${cur}"))
+          fi
+          ;;
+      esac
+      ;;
     evidence)
       if [[ ${COMP_CWORD} -eq 2 ]]; then
         COMPREPLY=($(compgen -W "snapshot remove" -- "${cur}"))
diff --git a/completions/pty.fish b/completions/pty.fish
index daf0979..28d490e 100644
--- a/completions/pty.fish
+++ b/completions/pty.fish
@@ -72,6 +72,7 @@ complete -c pty -n __pty_needs_command -a tag-multi -d 'Bulk tag ops across sess
 complete -c pty -n __pty_needs_command -a emit -d 'Publish a user.* event'
 complete -c pty -n __pty_needs_command -a rename -d 'Set / show / clear displayName'
 complete -c pty -n __pty_needs_command -a metadata -d 'Atomically patch presentation metadata by stable id'
+complete -c pty -n __pty_needs_command -a readiness -d 'Exact socket ownership and lifecycle compare-and-set'
 complete -c pty -n __pty_needs_command -a evidence -d 'Read or remove exact-generation retained exit evidence'
 complete -c pty -n __pty_needs_command -a up -d 'Start sessions from pty.toml'
 complete -c pty -n __pty_needs_command -a down -d 'Stop sessions from pty.toml'
@@ -89,6 +90,8 @@ complete -c pty -n '__pty_using_command run' -l unset-env -d 'Remove inherited e
 complete -c pty -n '__pty_using_command run' -l cwd -d 'Working directory'
 complete -c pty -n '__pty_using_command run' -l isolate-env -d 'Scrub env to a safe allow-list'
 complete -c pty -n '__pty_using_command run' -l force -d 'Create even from inside another pty'
+complete -c pty -n '__pty_using_command run' -l startup-timeout-ms -x -d 'Daemon-owned startup deadline in milliseconds'
+complete -c pty -n '__pty_using_command run' -l lifecycle-tag -x -d 'Generation-fenced lifecycle tag key'
 complete -c pty -n '__pty_using_command attach a' -l auto-restart -s r -d 'Auto-restart if the session is exited'
 complete -c pty -n '__pty_using_command attach a' -l no-restart -d 'Attach only; never prompt or restart an exited session'
 complete -c pty -n '__pty_using_command attach a' -l force -d 'Attach even from inside another pty'
@@ -154,6 +157,10 @@ complete -c pty -n '__pty_using_command rename' -l clear -d 'Remove displayName'
 complete -c pty -n '__pty_using_command rename' -a '(__pty_sessions)' -d 'Session'
 complete -c pty -n '__pty_using_command metadata' -l id -d 'Exact stable session id'
 complete -c pty -n '__pty_using_command metadata' -x -a 'patch' -d 'Value'
+complete -c pty -n '__pty_needs_subcommand readiness' -a ownership -d 'Prove accepted socket ownership for one held connection'
+complete -c pty -n '__pty_using_subcommand readiness ownership' -l id -x -d 'Exact stable session id'
+complete -c pty -n '__pty_needs_subcommand readiness' -a cas -d 'Compare-and-set one lifecycle tag value'
+complete -c pty -n '__pty_using_subcommand readiness cas' -l id -x -d 'Exact stable session id'
 complete -c pty -n '__pty_needs_subcommand evidence' -a snapshot -d 'Read retained evidence for one exact generation'
 complete -c pty -n '__pty_using_subcommand evidence snapshot' -l id -x -d 'Exact stable session id'
 complete -c pty -n '__pty_needs_subcommand evidence' -a remove -d 'Remove only the matching terminal generation'
diff --git a/completions/pty.zsh b/completions/pty.zsh
index af8df55..eebd537 100644
--- a/completions/pty.zsh
+++ b/completions/pty.zsh
@@ -35,6 +35,7 @@ _pty() {
     'emit:Publish a user.* event'
     'rename:Set / show / clear displayName'
     'metadata:Atomically patch presentation metadata by stable id'
+    'readiness:Exact socket ownership and lifecycle compare-and-set'
     'evidence:Read or remove exact-generation retained exit evidence'
     'up:Start sessions from pty.toml'
     'down:Stop sessions from pty.toml'
@@ -68,7 +69,9 @@ _pty() {
             '--unset-env[Remove inherited environment key (repeatable)]' \
             '--cwd[Working directory]' \
             '--isolate-env[Scrub env to a safe allow-list]' \
-            '--force[Create even from inside another pty]'
+            '--force[Create even from inside another pty]' \
+            '--startup-timeout-ms[Daemon-owned startup deadline in milliseconds]:milliseconds:' \
+            '--lifecycle-tag[Generation-fenced lifecycle tag key]:key:'
           ;;
         attach|a)
           _arguments \
@@ -186,6 +189,22 @@ _pty() {
             '--id[Exact stable session id]' \
             '1:mode:(patch)'
           ;;
+        readiness)
+          if (( CURRENT == 3 )); then
+            _values 'operation' ownership cas
+          else
+            case ${words[2]} in
+              ownership)
+                _arguments \
+                  '--id[Exact stable session id]:id:'
+                ;;
+              cas)
+                _arguments \
+                  '--id[Exact stable session id]:id:'
+                ;;
+            esac
+          fi
+          ;;
         evidence)
           if (( CURRENT == 3 )); then
             _values 'operation' snapshot remove
diff --git a/docs/client.md b/docs/client.md
index 4030aa3..da96467 100644
--- a/docs/client.md
+++ b/docs/client.md
@@ -58,6 +58,63 @@ Invalid arguments and operational failures exit nonzero with a diagnostic on
 stderr. A reconciler should durably consume the snapshot before passing its
 opaque generation to `remove`; a mismatch must leave the replacement intact.
 
+### Accepted-socket ownership and lifecycle CAS
+
+`queryAcceptedSocketOwnership(name, request)` asks the live PTY daemon to prove
+that the accepted side of one exact held TCP connection belongs to the current
+child process or one of its descendants:
+
+```typescript
+const ownership = await queryAcceptedSocketOwnership("dev.web", {
+  expectedGeneration: generation,
+  connection: {
+    localAddress: socket.localAddress!,
+    localPort: socket.localPort!,
+    remoteAddress: socket.remoteAddress!,
+    remotePort: socket.remotePort!,
+  },
+});
+// { _tag: "Owned", pid } | { _tag: "NotOwned" } |
+// { _tag: "Unavailable", reason }
+```
+
+The caller must keep that exact connection open while querying. PTY reverses
+the client-observed 4-tuple to identify the server-side `ESTABLISHED` socket,
+then binds it to the exact current child identity and descendant tree. Inspection
+runs in a worker so procfs, `ps`, or `libproc` latency cannot stall the daemon's
+startup deadline timer. Linux uses procfs. Published packages include PTY's
+universal arm64/x86_64 Darwin helper; source installs may use a best-effort
+local build, and helper absence never fails package installation. Unsupported
+platforms, scoped IPv6 tuples, generation mismatch, process-tree or descriptor
+churn, unreadable or partial descriptor/socket tables, and helper failure return
+`Unavailable`; none are
+treated as `NotOwned`.
+
+`compareAndSetLifecycle(name, request)` compares and replaces one exact tag
+value through the live daemon:
+
+```typescript
+const result = await compareAndSetLifecycle("dev.web", {
+  expectedGeneration: generation,
+  tag: "run.lifecycle",
+  expectedValue: startingValue,
+  value: JSON.stringify({ _tag: "ready", generation }),
+});
+```
+
+Results are tagged: `Changed`, `Unchanged`, `ValueMismatch`, `Missing`,
+`GenerationMismatch`, `Busy`, `DeadlineExpired`, `Terminal`, or
+`InvalidRequest`. A replacement generation cannot be changed by a stale
+completion.
+
+The shell boundary reads the same typed request as one JSON object on stdin and
+emits exactly one tagged JSON result:
+
+```sh
+pty readiness ownership --id dev.web < ownership.json
+pty readiness cas --id dev.web < transition.json
+```
+
 ### `validateName(name: string): void`
 
 Throws if the name is invalid. Names must match `[a-zA-Z0-9._-]`, cannot be
@@ -224,6 +281,10 @@ interface SpawnDaemonOptions {
   extraEnv?: Record<string, string>; // explicit assignments applied last
   unsetEnv?: string[];               // inherited keys removed before assignments
   env?: Record<string, string>;      // exact child env; mutually exclusive with the above
+  startupLease?: {
+    timeoutMs: number;               // positive startup budget, converted once
+    lifecycleTag: string;            // exact tag carrying lifecycle JSON
+  };
 }
 ```
 
@@ -232,6 +293,24 @@ interface SpawnDaemonOptions {
 `xterm-256color`; naming either key in `unsetEnv` does not suppress those
 invariants. An explicit `extraEnv.TERM` value is preserved.
 
+When `startupLease` is present, the daemon atomically publishes the lifecycle
+tag as `{\"_tag\":\"starting\",\"generation\":\"…\",\"bootId\":\"…\",\"deadlineMonotonicNs\":\"…\"}`
+before `spawnDaemon()` resolves. The deadline is absolute in the named host-boot
+monotonic domain. Initiating caller exit cannot disarm or extend it. Only a
+successful live-daemon CAS away from that exact starting value disarms the
+timer. At expiry PTY first freezes and proves complete child containment. A
+complete observation records terminal cause `deadline` and terminates the exact
+child tree. An unavailable or partial observation instead records terminal
+cause `teardown-unavailable`, then best-effort signals every exact identity it
+did observe plus the root process group; it never claims exact teardown when
+containment is unknown. Both outcomes retain normal exit evidence. Child exit
+before readiness similarly records terminal cause `exit`. Startup-lease
+generations bypass ordinary daemon exit reaping so their terminal
+lifecycle and exit evidence survive child/daemon shutdown for generation-fenced
+consumption. A terminal value written by a successful current-generation
+CAS is retained through the resulting child and daemon shutdown rather than
+replaced by `exit`.
+
 ### `resolveCommand(cmd: string): string`
 
 Resolve a command name to an absolute path (like `which`). Throws if not found.
diff --git a/native/pty-socket-owner-darwin.c b/native/pty-socket-owner-darwin.c
new file mode 100644
index 0000000..af5e0e6
--- /dev/null
+++ b/native/pty-socket-owner-darwin.c
@@ -0,0 +1,164 @@
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libproc.h>
+#include <netinet/in.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+#include <sys/proc_info.h>
+#include <sys/socket.h>
+
+/*
+ * Private, release-sensitive Darwin backend for PTY accepted-socket ownership.
+ *
+ * argv: accepted-local-address accepted-local-port accepted-foreign-address
+ *       accepted-foreign-port pid...
+ * stdout: "owned PID", "not-owned", or "unavailable".
+ *
+ * Every requested PID must yield a complete descriptor table. A permission
+ * failure, short libproc record, invalid argument, or allocation failure is
+ * Unavailable rather than a false NotOwned.
+ */
+
+static int parse_port(const char *text, uint16_t *out) {
+  char *end = NULL;
+  errno = 0;
+  long value = strtol(text, &end, 10);
+  if (errno != 0 || end == text || *end != '\0' || value <= 0 || value > 65535) {
+    return 0;
+  }
+  *out = (uint16_t)value;
+  return 1;
+}
+
+static int address_matches(
+  const struct in_sockinfo *info,
+  int family,
+  const void *local_address,
+  const void *foreign_address
+) {
+  if (family == AF_INET) {
+    if ((info->insi_vflag & INI_IPV4) == 0) return 0;
+    return memcmp(
+      &info->insi_laddr.ina_46.i46a_addr4,
+      local_address,
+      sizeof(struct in_addr)
+    ) == 0 && memcmp(
+      &info->insi_faddr.ina_46.i46a_addr4,
+      foreign_address,
+      sizeof(struct in_addr)
+    ) == 0;
+  }
+  if (family == AF_INET6) {
+    if ((info->insi_vflag & INI_IPV6) == 0) return 0;
+    return memcmp(
+      &info->insi_laddr.ina_6,
+      local_address,
+      sizeof(struct in6_addr)
+    ) == 0 && memcmp(
+      &info->insi_faddr.ina_6,
+      foreign_address,
+      sizeof(struct in6_addr)
+    ) == 0;
+  }
+  return 0;
+}
+
+int main(int argc, char **argv) {
+  if (argc < 6) {
+    puts("unavailable");
+    return 0;
+  }
+
+  int family = strchr(argv[1], ':') == NULL ? AF_INET : AF_INET6;
+  if ((strchr(argv[3], ':') == NULL ? AF_INET : AF_INET6) != family) {
+    puts("unavailable");
+    return 0;
+  }
+
+  struct in6_addr local6;
+  struct in6_addr foreign6;
+  struct in_addr local4;
+  struct in_addr foreign4;
+  void *local_address = family == AF_INET ? (void *)&local4 : (void *)&local6;
+  void *foreign_address = family == AF_INET ? (void *)&foreign4 : (void *)&foreign6;
+  if (inet_pton(family, argv[1], local_address) != 1 ||
+      inet_pton(family, argv[3], foreign_address) != 1) {
+    puts("unavailable");
+    return 0;
+  }
+
+  uint16_t local_port;
+  uint16_t foreign_port;
+  if (!parse_port(argv[2], &local_port) || !parse_port(argv[4], &foreign_port)) {
+    puts("unavailable");
+    return 0;
+  }
+
+  for (int arg = 5; arg < argc; arg++) {
+    char *end = NULL;
+    errno = 0;
+    long parsed_pid = strtol(argv[arg], &end, 10);
+    if (errno != 0 || end == argv[arg] || *end != '\0' || parsed_pid <= 0 || parsed_pid > INT32_MAX) {
+      puts("unavailable");
+      return 0;
+    }
+    int pid = (int)parsed_pid;
+    int bytes = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, NULL, 0);
+    if (bytes <= 0 || bytes % (int)sizeof(struct proc_fdinfo) != 0) {
+      puts("unavailable");
+      return 0;
+    }
+    int capacity = bytes + 32 * (int)sizeof(struct proc_fdinfo);
+    struct proc_fdinfo *fds = calloc(1, (size_t)capacity);
+    if (fds == NULL) {
+      puts("unavailable");
+      return 0;
+    }
+    int read_bytes = proc_pidinfo(pid, PROC_PIDLISTFDS, 0, fds, capacity);
+    if (read_bytes <= 0 || read_bytes >= capacity || read_bytes % (int)sizeof(*fds) != 0) {
+      free(fds);
+      puts("unavailable");
+      return 0;
+    }
+
+    int count = read_bytes / (int)sizeof(*fds);
+    for (int index = 0; index < count; index++) {
+      if (fds[index].proc_fdtype != PROX_FDTYPE_SOCKET) continue;
+      struct socket_fdinfo socket_info;
+      int socket_bytes = proc_pidfdinfo(
+        pid,
+        fds[index].proc_fd,
+        PROC_PIDFDSOCKETINFO,
+        &socket_info,
+        (int)sizeof(socket_info)
+      );
+      if (socket_bytes != (int)sizeof(socket_info)) {
+        free(fds);
+        puts("unavailable");
+        return 0;
+      }
+      if (socket_info.psi.soi_kind != SOCKINFO_TCP ||
+          socket_info.psi.soi_protocol != IPPROTO_TCP ||
+          socket_info.psi.soi_family != family ||
+          socket_info.psi.soi_proto.pri_tcp.tcpsi_state != TSI_S_ESTABLISHED) {
+        continue;
+      }
+      const struct in_sockinfo *info = &socket_info.psi.soi_proto.pri_tcp.tcpsi_ini;
+      if (ntohs((uint16_t)info->insi_lport) != local_port ||
+          ntohs((uint16_t)info->insi_fport) != foreign_port) {
+        continue;
+      }
+      if (address_matches(info, family, local_address, foreign_address)) {
+        free(fds);
+        printf("owned %d\n", pid);
+        return 0;
+      }
+    }
+    free(fds);
+  }
+
+  puts("not-owned");
+  return 0;
+}
diff --git a/package.json b/package.json
index f8e0988..54162e5 100644
--- a/package.json
+++ b/package.json
@@ -21,9 +21,11 @@
   "files": [
     "bin/",
     "dist/",
+    "native/",
     "completions/",
     "docs/",
     "scripts/postinstall.js",
+    "scripts/build-darwin-socket-owner.js",
     "README.md",
     "LICENSE"
   ],
@@ -61,6 +63,8 @@
     "build": "tsc -p tsconfig.build.json",
     "prepublishOnly": "npm run build",
     "postinstall": "node scripts/postinstall.js",
+    "prepack": "node scripts/build-darwin-socket-owner.js",
+    "postpack": "node scripts/build-darwin-socket-owner.js --clean",
     "prepare": "git config core.hooksPath githooks 2>/dev/null || true; sh scripts/update-nix-hash.sh 2>/dev/null || true",
     "install-completions": "sh scripts/install-completions.sh",
     "typecheck": "tsc",
diff --git a/scripts/build-darwin-socket-owner.js b/scripts/build-darwin-socket-owner.js
new file mode 100644
index 0000000..7fbd359
--- /dev/null
+++ b/scripts/build-darwin-socket-owner.js
@@ -0,0 +1,54 @@
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+
+/** Build the universal helper that is included by npm pack. Package production
+ * fails closed off Darwin or when either architecture cannot be compiled; an
+ * install never needs a compiler to use the resulting package. */
+export function buildDarwinSocketOwner({
+  platform = process.platform,
+  root = path.resolve(scriptDir, ".."),
+  run = spawnSync,
+} = {}) {
+  if (platform !== "darwin") {
+    throw new Error("Darwin socket-ownership packages must be produced on Darwin");
+  }
+  const source = path.join(root, "native", "pty-socket-owner-darwin.c");
+  const output = path.join(root, "bin", "pty-socket-owner-darwin");
+  const temporary = `${output}.tmp-${process.pid}`;
+  const result = run("cc", [
+    "-O2",
+    "-Wall",
+    "-Wextra",
+    "-arch",
+    "arm64",
+    "-arch",
+    "x86_64",
+    source,
+    "-o",
+    temporary,
+  ], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (result.error || result.status !== 0 || !fs.existsSync(temporary)) {
+    try { fs.rmSync(temporary, { force: true }); } catch {}
+    const detail = result.error?.message ?? result.stderr?.trim() ?? `cc exited ${result.status}`;
+    throw new Error(`Failed to build universal Darwin socket-ownership helper: ${detail}`);
+  }
+  fs.renameSync(temporary, output);
+  fs.chmodSync(output, 0o755);
+  return output;
+}
+
+export function cleanDarwinSocketOwner(root = path.resolve(scriptDir, "..")) {
+  fs.rmSync(path.join(root, "bin", "pty-socket-owner-darwin"), { force: true });
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  if (process.argv.includes("--clean")) cleanDarwinSocketOwner();
+  else buildDarwinSocketOwner();
+}
diff --git a/scripts/postinstall.js b/scripts/postinstall.js
index 5f27e96..2667208 100644
--- a/scripts/postinstall.js
+++ b/scripts/postinstall.js
@@ -8,17 +8,18 @@
 // The root-cause fix belongs in microsoft/node-pty; once that ships, this
 // script can be removed entirely.
 
+import { spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { createRequire } from "node:module";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 if (process.platform === "win32") process.exit(0);
 
 // Resolve from this package's root (package.json sibling), not from the
 // script file, so that node-pty is discoverable regardless of whether
 // node_modules is nested (npm/yarn/bun) or a sibling link (pnpm GVS).
-const pkgDir = path.dirname(new URL(import.meta.url).pathname);
+const pkgDir = path.dirname(fileURLToPath(import.meta.url));
 const requireFromPkg = createRequire(
   pathToFileURL(path.join(pkgDir, "..", "package.json")),
 );
@@ -28,19 +29,71 @@ try {
   nodePtyDir = path.dirname(requireFromPkg.resolve("node-pty/package.json"));
 } catch {
   console.warn("[@compoundingtech/pty] node-pty not found; skipping spawn-helper chmod");
-  process.exit(0);
 }
 
-const helper = path.join(
-  nodePtyDir,
-  "prebuilds",
-  `${process.platform}-${process.arch}`,
-  "spawn-helper",
-);
+if (nodePtyDir) {
+  const helper = path.join(
+    nodePtyDir,
+    "prebuilds",
+    `${process.platform}-${process.arch}`,
+    "spawn-helper",
+  );
+  try {
+    fs.chmodSync(helper, 0o755);
+  } catch {
+    // Acceptable when there's no prebuild for this arch and node-pty was
+    // built from source — node-gyp produces the binary executable already.
+  }
+}
 
-try {
-  fs.chmodSync(helper, 0o755);
-} catch {
-  // Acceptable when there's no prebuild for this arch and node-pty was
-  // built from source — node-gyp produces the binary executable already.
+export function installDarwinSocketOwner({
+  platform = process.platform,
+  root = path.resolve(pkgDir, ".."),
+  run = spawnSync,
+  warn = console.warn,
+} = {}) {
+  if (platform !== "darwin") return "not-applicable";
+  const source = path.join(root, "native", "pty-socket-owner-darwin.c");
+  const output = path.join(root, "bin", `pty-socket-owner-darwin-${process.arch}`);
+  const packaged = [
+    output,
+    path.join(root, "bin", "pty-socket-owner-darwin"),
+  ].find((candidate) => fs.existsSync(candidate));
+  if (packaged) {
+    try {
+      fs.chmodSync(packaged, 0o755);
+      return "available";
+    } catch (error) {
+      warn(`[@compoundingtech/pty] Darwin socket-ownership helper unavailable: ${
+        error instanceof Error ? error.message : String(error)
+      }`);
+      return "unavailable";
+    }
+  }
+  const temporary = `${output}.tmp-${process.pid}`;
+  const result = run("cc", ["-O2", "-Wall", "-Wextra", source, "-o", temporary], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  if (!result.error && result.status === 0) {
+    try {
+      fs.renameSync(temporary, output);
+      fs.chmodSync(output, 0o755);
+      return "available";
+    } catch (error) {
+      try { fs.rmSync(temporary, { force: true }); } catch {}
+      warn(`[@compoundingtech/pty] Darwin socket-ownership helper unavailable: ${
+        error instanceof Error ? error.message : String(error)
+      }`);
+      return "unavailable";
+    }
+  }
+  try { fs.rmSync(temporary, { force: true }); } catch {}
+  const detail = result.error?.message ?? result.stderr?.trim() ?? "unknown compiler failure";
+  warn(`[@compoundingtech/pty] Darwin socket-ownership helper unavailable: ${detail}`);
+  return "unavailable";
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  installDarwinSocketOwner();
 }
diff --git a/src/cli.ts b/src/cli.ts
index ecd3c50..2e18a30 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -4,8 +4,10 @@ import * as path from "node:path";
 import * as readline from "node:readline/promises";
 import { spawnSync, execFileSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { attach, peek, send, queryStats, resolveSeqDelayMs, validateAttachStreamFdV1, type StatsResult,
-  isSessionAlive,
+import {
+  attach, peek, send, queryStats, resolveSeqDelayMs, validateAttachStreamFdV1,
+  isSessionAlive, queryAcceptedSocketOwnership, compareAndSetLifecycle,
+  type StatsResult,
 } from "./client.ts";
 import { printVersion } from "./version.ts";
 import { parseSeqValue } from "./keys.ts";
@@ -79,6 +81,10 @@ import {
   verifyRecoveryResult,
   type RecoveryResult,
 } from "./recovery.ts";
+import {
+  decodeAcceptedSocketOwnershipRequest,
+  decodeLifecycleCompareAndSetRequest,
+} from "./protocol.ts";
 
 // Name this process so it shows up meaningfully in ps/top/htop/btm instead of
 // "MainThread" (V8's default main-thread name under Node 24+). `process.title`
@@ -135,6 +141,10 @@ Flags:
   --tag keep=true      Exempt from reaping: keep metadata/logs after exit
   --cwd <path>         Working directory for the command
   --isolate-env        Scrub the child env to a safe allow-list (for remote-reachable sessions)
+  --startup-timeout-ms <ms>
+                       Arm a daemon-owned hard startup lease
+  --lifecycle-tag <key>
+                       Tag carrying the generation-fenced lifecycle value
   --force              Create even from inside another pty session (bypass the nesting guard)
 
 Examples:
@@ -434,6 +444,22 @@ Examples:
   printf '%s' '{"displayName":"Worker","tags":{"role":"worker"}}' | pty metadata patch --id a1b2c3d4
   printf '%s' '{"displayName":null,"tags":{"temporary":null}}' | pty metadata patch --id a1b2c3d4`,
 
+  readiness: `Usage: pty readiness ownership --id <stable-id>
+       pty readiness cas --id <stable-id>
+
+Machine-only readiness control for one exact live daemon generation. Both
+operations read one JSON object from stdin and emit one tagged JSON result.
+
+ownership input:
+  {"expectedGeneration":"<opaque>","connection":{"localAddress":"127.0.0.1","localPort":51000,"remoteAddress":"127.0.0.1","remotePort":3000}}
+
+cas input:
+  {"expectedGeneration":"<opaque>","tag":"run.lifecycle","expectedValue":"<exact>","value":"<exact>"}
+
+Examples:
+  pty readiness ownership --id a1b2c3d4 < ownership.json
+  pty readiness cas --id a1b2c3d4 < transition.json`,
+
   evidence: `Usage: pty evidence snapshot --id <stable-id>
        pty evidence remove --id <stable-id> --expected-generation <opaque>
 
@@ -472,6 +498,23 @@ Examples:
   pty test -t "peek"`,
 };
 
+const READINESS_LEAF_HELP = {
+  ownership: `Usage: pty readiness ownership --id <stable-id>
+
+Read one exact-generation held TCP 4-tuple from stdin and emit one tagged
+Owned, NotOwned, or Unavailable JSON result.
+
+Example:
+  pty readiness ownership --id a1b2c3d4 < ownership.json`,
+  cas: `Usage: pty readiness cas --id <stable-id>
+
+Read one exact-generation, exact-value lifecycle tag compare-and-set from stdin
+and emit one tagged JSON result.
+
+Example:
+  pty readiness cas --id a1b2c3d4 < transition.json`,
+} as const;
+
 const EVIDENCE_LEAF_HELP = {
   snapshot: `Usage: pty evidence snapshot --id <stable-id>
 
@@ -520,6 +563,8 @@ Create sessions:
   pty run --cwd /path -- <command>        Run in a specific directory
   pty run --isolate-env -- <command>      Scrub the child env to a safe allow-list
                                           (intended for remote-reachable sessions)
+  pty run --startup-timeout-ms N --lifecycle-tag key ...
+                                          Arm a daemon-owned hard startup lease
   pty run --force -- <command>            Create even from inside another pty session (nested)
 
 Attach & interact:
@@ -562,6 +607,8 @@ Observe:
 Modify:
   pty metadata patch --id <id>            Atomically merge displayName/tags from JSON stdin
   pty evidence snapshot --id <id>         Read exact-generation retained exit evidence as JSON
+  pty readiness ownership --id <id>        Prove exact held TCP connection ownership
+  pty readiness cas --id <id>              Generation-fenced lifecycle tag CAS
   pty rename <label>                      Inside a session: set its displayName
   pty rename <ref> <label>                Outside: set displayName on <ref>
   pty rename --show <ref>                 Print the current displayName
@@ -809,6 +856,8 @@ async function main(): Promise<void> {
       const tags: Record<string, string> = {};
       const extraEnv: Record<string, string> = {};
       const unsetEnv: string[] = [];
+      let startupTimeoutMs: number | null = null;
+      let lifecycleTag: string | null = null;
       let i = 1;
       while (i < args.length && args[i] !== "--") {
         if (args[i] === "-d" || args[i] === "--detach") { detach = true; i++; }
@@ -820,6 +869,19 @@ async function main(): Promise<void> {
         else if (args[i] === "--id" && i + 1 < args.length) { explicitId = args[i + 1]; i += 2; }
         else if (args[i] === "--name" && i + 1 < args.length) { explicitDisplayName = args[i + 1]; i += 2; }
         else if (args[i] === "--cwd" && i + 1 < args.length) { cwd = args[i + 1]; i += 2; }
+        else if (args[i] === "--startup-timeout-ms" && i + 1 < args.length) {
+          const value = Number(args[i + 1]);
+          if (!Number.isSafeInteger(value) || value <= 0) {
+            console.error("pty run: --startup-timeout-ms requires a positive integer.");
+            process.exit(1);
+          }
+          startupTimeoutMs = value;
+          i += 2;
+        }
+        else if (args[i] === "--lifecycle-tag" && i + 1 < args.length) {
+          lifecycleTag = args[i + 1];
+          i += 2;
+        }
         else if (args[i] === "--tag" && i + 1 < args.length) {
           const eq = args[i + 1].indexOf("=");
           if (eq === -1) {
@@ -851,6 +913,16 @@ async function main(): Promise<void> {
         else break;
         // Note: unknown flags or positional args before -- break the loop
       }
+      if ((startupTimeoutMs === null) !== (lifecycleTag === null)) {
+        console.error(
+          "pty run: --startup-timeout-ms and --lifecycle-tag must be provided together.",
+        );
+        process.exit(1);
+      }
+      if (lifecycleTag === "") {
+        console.error("pty run: --lifecycle-tag must not be empty.");
+        process.exit(1);
+      }
 
       // Everything after -- is the command
       const dashDash = args.indexOf("--", i);
@@ -1011,6 +1083,7 @@ async function main(): Promise<void> {
       await cmdRun(
         name, cmd, cmdArgs, detach, attachExisting, displayCmd, ephemeral,
         tags, cwd, isolateEnv, displayName, extraEnv, unsetEnv,
+        startupTimeoutMs, lifecycleTag,
       );
       break;
     }
@@ -1653,6 +1726,11 @@ async function main(): Promise<void> {
       break;
     }
 
+
+    case "readiness": {
+      await cmdReadiness(args.slice(1));
+      break;
+    }
     case "rm":
     case "remove": {
       if (args.length < 2) {
@@ -1728,6 +1806,8 @@ async function cmdRun(
   displayName: string | null = null,
   extraEnv: Record<string, string> = {},
   unsetEnv: string[] = [],
+  startupTimeoutMs: number | null = null,
+  lifecycleTag: string | null = null,
 ): Promise<void> {
   let session = await getSessionByName(name);
 
@@ -1806,6 +1886,9 @@ async function cmdRun(
       ...(isolateEnv ? { isolateEnv: true } : {}),
       ...(extraEnvOpt && Object.keys(extraEnvOpt).length > 0 ? { extraEnv: extraEnvOpt } : {}),
       ...(unsetEnvOpt && unsetEnvOpt.length > 0 ? { unsetEnv: unsetEnvOpt } : {}),
+      ...(startupTimeoutMs !== null && lifecycleTag !== null
+        ? { startupLease: { timeoutMs: startupTimeoutMs, lifecycleTag } }
+        : {}),
     });
   } finally {
     if (ownsEventLock) releaseEventLock(name);
@@ -2964,10 +3047,56 @@ async function cmdMetadata(rawArgs: string[]): Promise<void> {
     const result = await patchMetadataById(id, patch as any);
     console.log(JSON.stringify(result));
   } catch (e) {
+
     console.error(`pty metadata patch: ${(e as Error).message}`);
     process.exit(1);
   }
 }
+async function cmdReadiness(rawArgs: string[]): Promise<void> {
+  const operation = rawArgs[0];
+  if (operation !== "ownership" && operation !== "cas") {
+    throw new Error('pty readiness: expected subcommand "ownership" or "cas".');
+  }
+  if (
+    rawArgs.length === 2 &&
+    (rawArgs[1] === "-h" || rawArgs[1] === "--help")
+  ) {
+    console.log(READINESS_LEAF_HELP[operation]);
+    return;
+  }
+  let id: string | null = null;
+  for (let i = 1; i < rawArgs.length; i++) {
+    if (rawArgs[i] !== "--id") {
+      throw new Error(`pty readiness ${operation}: unexpected argument "${rawArgs[i]}".`);
+    }
+    const value = rawArgs[++i];
+    if (!value) throw new Error(`pty readiness ${operation}: --id requires a stable session id.`);
+    if (id !== null) throw new Error(`pty readiness ${operation}: --id may only be provided once.`);
+    id = value;
+  }
+  if (id === null) throw new Error(`pty readiness ${operation}: missing required --id <stable-id>.`);
+
+  const input = fs.readFileSync(0, "utf8").trim();
+  if (input.length === 0) throw new Error(`pty readiness ${operation}: expected one JSON object on stdin.`);
+  let value: unknown;
+  try {
+    value = JSON.parse(input);
+  } catch (error) {
+    throw new Error(
+      `pty readiness ${operation}: invalid JSON on stdin: ` +
+      `${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+  if (operation === "ownership") {
+    const request = decodeAcceptedSocketOwnershipRequest(value);
+    if (!request) throw new Error("pty readiness ownership: invalid request object.");
+    fs.writeFileSync(1, `${JSON.stringify(await queryAcceptedSocketOwnership(id, request))}\n`);
+    return;
+  }
+  const request = decodeLifecycleCompareAndSetRequest(value);
+  if (!request) throw new Error("pty readiness cas: invalid request object.");
+  fs.writeFileSync(1, `${JSON.stringify(await compareAndSetLifecycle(id, request))}\n`);
+}
 
 async function cmdEvidence(rawArgs: string[]): Promise<void> {
   const operation = rawArgs[0];
diff --git a/src/client-api.ts b/src/client-api.ts
index 87982ba..13a5b04 100644
--- a/src/client-api.ts
+++ b/src/client-api.ts
@@ -32,6 +32,7 @@ export {
 // Session interaction (CLI-oriented — uses process.stdin/stdout, may call process.exit)
 export {
   attach, peek, send, queryStats,
+  queryAcceptedSocketOwnership, compareAndSetLifecycle,
   TERMINAL_SANITIZE,
   type AttachOptions, type PeekOptions, type SendOptions,
   type StatsResult, type ProcessResources,
@@ -68,5 +69,8 @@ export { resolveKey, parseSeqValue } from "./keys.ts";
 // Protocol (advanced)
 export {
   PacketReader, MessageType,
-  type Packet,
+  type Packet, type TcpConnectionTuple,
+  type AcceptedSocketOwnershipRequest, type AcceptedSocketOwnershipResult,
+  type LifecycleCompareAndSetRequest, type LifecycleCompareAndSetResult,
 } from "./protocol.ts";
+export { type StartupLeaseOptions } from "./startup-lease.ts";
diff --git a/src/client.ts b/src/client.ts
index b1d6308..f41bead 100644
--- a/src/client.ts
+++ b/src/client.ts
@@ -11,7 +11,13 @@ import {
   encodePeek,
   encodeResize,
   encodeStatus,
+  encodeAcceptedSocketOwnershipRequest,
+  encodeLifecycleCompareAndSetRequest,
   decodeExit,
+  type AcceptedSocketOwnershipRequest,
+  type AcceptedSocketOwnershipResult,
+  type LifecycleCompareAndSetRequest,
+  type LifecycleCompareAndSetResult,
 } from "./protocol.ts";
 import { getSocketPath } from "./sessions.ts";
 import { stripAnsi } from "./tui/colors.ts";
@@ -411,6 +417,136 @@ export function queryStats(name: string, timeoutMs = 2000): Promise<StatsResult>
   });
 }
 
+const requestControlJson = <TResult>(
+  name: string,
+  type: typeof MessageType.ACCEPTED_SOCKET_OWNERSHIP | typeof MessageType.LIFECYCLE_CAS,
+  packet: Buffer,
+  decode: (value: unknown) => TResult | undefined,
+  timeoutMs: number,
+): Promise<TResult> => new Promise<TResult>((resolve, reject) => {
+  const socket = net.createConnection(getSocketPath(name));
+  const reader = new PacketReader();
+  const timer = setTimeout(() => {
+    socket.destroy();
+    reject(new Error(`Timeout querying readiness control for "${name}"`));
+  }, timeoutMs);
+  socket.on("connect", () => socket.write(packet));
+  socket.on("data", (data: Buffer) => {
+    let packets;
+    try {
+      packets = reader.feed(data);
+    } catch (error) {
+      clearTimeout(timer);
+      socket.destroy();
+      reject(error);
+      return;
+    }
+    for (const response of packets) {
+      if (response.type !== type) continue;
+      let value: unknown;
+      try {
+        value = JSON.parse(response.payload.toString("utf8"));
+      } catch {
+        value = undefined;
+      }
+      const result = decode(value);
+      clearTimeout(timer);
+      socket.destroy();
+      if (result === undefined) {
+        reject(new Error(`Invalid readiness control response from "${name}"`));
+      } else {
+        resolve(result);
+      }
+      return;
+    }
+  });
+  socket.on("error", (error) => {
+    clearTimeout(timer);
+    reject(error);
+  });
+});
+
+const taggedRecord = (value: unknown): Record<string, unknown> | undefined =>
+  typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+
+const decodeOwnershipResult = (value: unknown): AcceptedSocketOwnershipResult | undefined => {
+  const result = taggedRecord(value);
+  if (
+    result?._tag === "Owned" &&
+    typeof result.pid === "number" &&
+    Number.isSafeInteger(result.pid) &&
+    result.pid > 0
+  ) {
+    return { _tag: "Owned", pid: result.pid };
+  }
+  if (result?._tag === "NotOwned") return { _tag: "NotOwned" };
+  if (result?._tag === "Unavailable" && typeof result.reason === "string") {
+    return { _tag: "Unavailable", reason: result.reason };
+  }
+  return undefined;
+};
+
+const decodeLifecycleResult = (value: unknown): LifecycleCompareAndSetResult | undefined => {
+  const result = taggedRecord(value);
+  if (!result || typeof result._tag !== "string") return undefined;
+  if (
+    (result._tag === "Changed" ||
+      result._tag === "Unchanged" ||
+      result._tag === "DeadlineExpired" ||
+      result._tag === "Terminal") &&
+    typeof result.value === "string"
+  ) return { _tag: result._tag, value: result.value };
+  if (result._tag === "ValueMismatch") {
+    return typeof result.value === "string"
+      ? { _tag: "ValueMismatch", value: result.value }
+      : { _tag: "ValueMismatch" };
+  }
+  if (
+    result._tag === "Missing" ||
+    result._tag === "GenerationMismatch" ||
+    result._tag === "Busy"
+  ) return { _tag: result._tag };
+  if (result._tag === "InvalidRequest" && typeof result.reason === "string") {
+    return { _tag: "InvalidRequest", reason: result.reason };
+  }
+  return undefined;
+};
+
+/** Ask the live daemon whether the accepted side of this exact held TCP
+ * connection belongs to its current child process tree. */
+export function queryAcceptedSocketOwnership(
+  name: string,
+  request: AcceptedSocketOwnershipRequest,
+  timeoutMs = 2_000,
+): Promise<AcceptedSocketOwnershipResult> {
+  return requestControlJson(
+    name,
+    MessageType.ACCEPTED_SOCKET_OWNERSHIP,
+    encodeAcceptedSocketOwnershipRequest(request),
+    decodeOwnershipResult,
+    timeoutMs,
+  );
+}
+
+/** Compare-and-set one tag through the current daemon generation. A successful
+ * transition away from its exact starting value is the only operation that can
+ * disarm a startup lease. */
+export function compareAndSetLifecycle(
+  name: string,
+  request: LifecycleCompareAndSetRequest,
+  timeoutMs = 2_000,
+): Promise<LifecycleCompareAndSetResult> {
+  return requestControlJson(
+    name,
+    MessageType.LIFECYCLE_CAS,
+    encodeLifecycleCompareAndSetRequest(request),
+    decodeLifecycleResult,
+    timeoutMs,
+  );
+}
+
 export interface AttachOptions {
   name: string;
   onExit?: (code: number) => void;
diff --git a/src/completions.ts b/src/completions.ts
index 3bbb586..50cef15 100644
--- a/src/completions.ts
+++ b/src/completions.ts
@@ -85,6 +85,16 @@ const COMMANDS: readonly CommandSpec[] = [
       { name: "cwd", desc: "Working directory" },
       { name: "isolate-env", desc: "Scrub env to a safe allow-list" },
       { name: "force", desc: "Create even from inside another pty" },
+      {
+        name: "startup-timeout-ms",
+        desc: "Daemon-owned startup deadline in milliseconds",
+        argument: { _tag: "free", name: "milliseconds" },
+      },
+      {
+        name: "lifecycle-tag",
+        desc: "Generation-fenced lifecycle tag key",
+        argument: { _tag: "free", name: "key" },
+      },
     ],
   },
   {
@@ -252,6 +262,30 @@ const COMMANDS: readonly CommandSpec[] = [
     flags: [{ name: "id", desc: "Exact stable session id" }],
     positionalValues: ["patch"],
   },
+  {
+    name: "readiness",
+    desc: "Exact socket ownership and lifecycle compare-and-set",
+    subcommands: [
+      {
+        name: "ownership",
+        desc: "Prove accepted socket ownership for one held connection",
+        flags: [{
+          name: "id",
+          desc: "Exact stable session id",
+          argument: { _tag: "free", name: "id" },
+        }],
+      },
+      {
+        name: "cas",
+        desc: "Compare-and-set one lifecycle tag value",
+        flags: [{
+          name: "id",
+          desc: "Exact stable session id",
+          argument: { _tag: "free", name: "id" },
+        }],
+      },
+    ],
+  },
   {
     name: "evidence",
     desc: "Read or remove exact-generation retained exit evidence",
diff --git a/src/proc-table.ts b/src/proc-table.ts
index 56da86f..2a7daed 100644
--- a/src/proc-table.ts
+++ b/src/proc-table.ts
@@ -45,11 +45,13 @@ export type Unknown =
 export type Answer<T> =
   | { readonly kind: "known"; readonly value: T }
   | { readonly kind: "not-present" }
-  | { readonly kind: "unknown"; readonly reason: Unknown };
+  | { readonly kind: "unknown"; readonly reason: Unknown; readonly partial?: T };
 
 export const known = <T>(value: T): Answer<T> => ({ kind: "known", value });
 export const notPresent = <T>(): Answer<T> => ({ kind: "not-present" });
-export const unknown = <T>(reason: Unknown): Answer<T> => ({ kind: "unknown", reason });
+export const unknown = <T>(reason: Unknown, partial?: T): Answer<T> => (
+  partial === undefined ? { kind: "unknown", reason } : { kind: "unknown", reason, partial }
+);
 
 /** The value if the table knew it. Silence and absence both yield null, so
  *  this is for callers that have decided the difference does not matter. */
@@ -205,18 +207,26 @@ class DirectSource implements ProcessSource {
       return unknown("table-unreadable");
     }
     const out: Row[] = [];
+    let incomplete: Unknown | null = null;
     for (const name of names) {
       if (!/^\d+$/.test(name)) continue;
       const pid = Number(name);
       try {
         const row = parseProcStat(pid, fs.readFileSync(`/proc/${pid}/stat`, "utf8"));
         if (row) out.push(row);
-      } catch {
-        // Exited between the readdir and the read. That is a real absence.
+        else incomplete = "field-empty";
+      } catch (error) {
+        const code = (error as NodeJS.ErrnoException).code;
+        // An exited process is absent. Permission and malformed-I/O failures
+        // make a whole-tree answer incomplete, but preserve all safely observed
+        // rows so teardown can still exact-signal visible out-of-group children.
+        if (code !== "ENOENT" && code !== "ESRCH") incomplete = "table-unreadable";
       }
     }
-    if (!out.some((r) => r.pid === process.pid)) return unknown("table-unreadable");
-    return known(out);
+    if (!out.some((r) => r.pid === process.pid)) {
+      return unknown("table-unreadable", out);
+    }
+    return incomplete === null ? known(out) : unknown(incomplete, out);
   }
 }
 
diff --git a/src/process-tree.ts b/src/process-tree.ts
index 39e5916..a328364 100644
--- a/src/process-tree.ts
+++ b/src/process-tree.ts
@@ -21,6 +21,195 @@ interface ProcessTreeDeps {
   source?: () => ProcessSource;
   signal?: (pid: number, signal: NodeJS.Signals) => void;
   sleep?: (ms: number) => Promise<void>;
+  groupExists?: (processGroupId: number) => boolean;
+}
+export type CompleteProcessTreeSnapshot =
+  | { _tag: "Complete"; identities: ProcessIdentity[] }
+  | { _tag: "Unavailable"; reason: string; identities: ProcessIdentity[] };
+
+/** Snapshot every live descendant or report that completeness could not be
+ * proved. Unlike the historical best-effort snapshot, this never turns an
+ * unreadable table or identity into an empty tree. */
+export function snapshotDescendantProcessesComplete(
+  rootPid: number,
+  deps: ProcessTreeDeps = {},
+): CompleteProcessTreeSnapshot {
+  const source = (deps.source ?? openSource)();
+  const answer = source.rows();
+  if (answer.kind !== "known") {
+    return {
+      _tag: "Unavailable",
+      reason: answer.kind === "unknown"
+        ? `process-${answer.reason}`
+        : "process-table-not-present",
+      identities: answer.kind === "unknown" && answer.partial
+        ? observedDescendantIdentities(rootPid, answer.partial)
+        : [],
+    };
+  }
+  const byPid = new Map(answer.value.map((row) => [row.pid, row]));
+  const root = byPid.get(rootPid);
+  if (!root || isZombie(root) || root.identity === null) {
+    return {
+      _tag: "Unavailable",
+      reason: "root-identity-unavailable",
+      identities: observedDescendantIdentities(rootPid, answer.value),
+    };
+  }
+  const children = new Map<number, Row[]>();
+  for (const row of answer.value) {
+    const siblings = children.get(row.ppid) ?? [];
+    siblings.push(row);
+    children.set(row.ppid, siblings);
+  }
+  const identities: ProcessIdentity[] = [];
+  const queue = (children.get(rootPid) ?? []).map((row) => ({ row, depth: 1 }));
+  const seen = new Set<number>([rootPid]);
+  while (queue.length > 0) {
+    const current = queue.shift()!;
+    if (seen.has(current.row.pid)) continue;
+    seen.add(current.row.pid);
+    queue.push(
+      ...(children.get(current.row.pid) ?? []).map((row) => ({
+        row,
+        depth: current.depth + 1,
+      })),
+    );
+    if (isZombie(current.row)) continue;
+    if (current.row.identity === null) {
+      return {
+        _tag: "Unavailable",
+        reason: `process-identity-unavailable:${current.row.pid}`,
+        identities: observedDescendantIdentities(rootPid, answer.value),
+      };
+    }
+    identities.push({
+      pid: current.row.pid,
+      identity: current.row.identity,
+      depth: current.depth,
+    });
+  }
+  identities.sort((a, b) => b.depth - a.depth || b.pid - a.pid);
+  return { _tag: "Complete", identities };
+}
+
+/** Recover every exact descendant identity visible in an incomplete table.
+ * The result is not called complete, but it is still safe to signal alongside
+ * the process-group fallback and includes children that created another PGID. */
+const observedDescendantIdentities = (
+  rootPid: number,
+  rows: Row[],
+): ProcessIdentity[] => {
+  const children = new Map<number, Row[]>();
+  for (const row of rows) {
+    const siblings = children.get(row.ppid) ?? [];
+    siblings.push(row);
+    children.set(row.ppid, siblings);
+  }
+  const identities: ProcessIdentity[] = [];
+  const queue = (children.get(rootPid) ?? []).map((row) => ({ row, depth: 1 }));
+  const seen = new Set<number>([rootPid]);
+  while (queue.length > 0) {
+    const current = queue.shift()!;
+    if (seen.has(current.row.pid)) continue;
+    seen.add(current.row.pid);
+    queue.push(
+      ...(children.get(current.row.pid) ?? []).map((row) => ({
+        row,
+        depth: current.depth + 1,
+      })),
+    );
+    if (!isZombie(current.row) && current.row.identity !== null) {
+      identities.push({
+        pid: current.row.pid,
+        identity: current.row.identity,
+        depth: current.depth,
+      });
+    }
+  }
+  return identities.sort((a, b) => b.depth - a.depth || b.pid - a.pid);
+};
+
+const mergeIdentities = (
+  left: ProcessIdentity[],
+  right: ProcessIdentity[],
+): ProcessIdentity[] => {
+  const identities = [...left];
+  for (const candidate of right) {
+    if (!identities.some((identity) =>
+      identity.pid === candidate.pid && identity.identity === candidate.identity
+    )) {
+      identities.push(candidate);
+    }
+  }
+  return identities.sort((a, b) => b.depth - a.depth || b.pid - a.pid);
+};
+
+const sameIdentities = (
+  left: ProcessIdentity[],
+  right: ProcessIdentity[],
+): boolean => left.length === right.length && left.every((identity, index) =>
+  identity.pid === right[index]?.pid &&
+  identity.identity === right[index]?.identity
+);
+
+/** Freeze the PTY process group and every discovered descendant, rescanning
+ * until a complete identity snapshot is stable. Once this succeeds no member
+ * of the returned tree can fork before the caller signals it. */
+export function freezeDescendantProcesses(
+  rootPid: number,
+  deps: ProcessTreeDeps = {},
+): CompleteProcessTreeSnapshot {
+  const snapshot = snapshotDescendantProcessesComplete(rootPid, deps);
+  let observed = [...snapshot.identities];
+  let unavailableReason = snapshot._tag === "Unavailable"
+    ? snapshot.reason
+    : "process-tree-did-not-quiesce";
+  let previousComplete = snapshot._tag === "Complete" ? snapshot.identities : null;
+  const maxAttempts = snapshot._tag === "Complete" ? 8 : 1;
+  const sendSignal = deps.signal ?? ((pid, signal) => process.kill(pid, signal));
+  try { sendSignal(-rootPid, "SIGSTOP"); } catch {}
+  try {
+    sendSignal(rootPid, "SIGSTOP");
+  } catch {
+    return {
+      _tag: "Unavailable",
+      reason: "root-freeze-failed",
+      identities: observed,
+    };
+  }
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    const signalled = signalProcessIdentities(observed, "SIGSTOP", deps);
+    if (signalled.length !== observed.length) {
+      return {
+        _tag: "Unavailable",
+        reason: "descendant-freeze-unverified",
+        identities: observed,
+      };
+    }
+    const next = snapshotDescendantProcessesComplete(rootPid, deps);
+    observed = mergeIdentities(observed, next.identities);
+    if (next._tag === "Complete") {
+      if (
+        previousComplete !== null &&
+        sameIdentities(previousComplete, next.identities)
+      ) {
+        return next;
+      }
+      previousComplete = next.identities;
+    } else {
+      return {
+        _tag: "Unavailable",
+        reason: next.reason,
+        identities: observed,
+      };
+    }
+  }
+  return {
+    _tag: "Unavailable",
+    reason: unavailableReason,
+    identities: observed,
+  };
 }
 
 /** Take one parent-chain snapshot before the PTY leader can exit and lose its
@@ -87,6 +276,7 @@ export function signalProcessIdentities(
   signal: NodeJS.Signals,
   deps: ProcessTreeDeps = {},
 ): number[] {
+  if (identities.length === 0) return [];
   const source = (deps.source ?? openSource)();
   const sendSignal = deps.signal ?? ((pid, value) => process.kill(pid, value));
   const signalled: number[] = [];
@@ -143,3 +333,29 @@ export async function terminateProcessIdentities(
   signalProcessIdentities(afterTerm, "SIGKILL", deps);
   return waitForIdentitiesToExit(afterTerm, options.killWaitMs ?? 500, deps);
 }
+
+/** Bounded fallback when a complete descendant table is unavailable. The PTY
+ * leader is its process-group leader, so this still reaches the ordinary tree
+ * without converting unknown descendants into an empty successful snapshot. */
+export async function terminateProcessGroup(
+  rootPid: number,
+  options: { termWaitMs?: number; killWaitMs?: number } = {},
+  deps: ProcessTreeDeps = {},
+): Promise<boolean> {
+  const sendSignal = deps.signal ?? ((pid, signal) => process.kill(pid, signal));
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const groupExists = deps.groupExists ?? ((groupId: number) => {
+    try {
+      process.kill(-groupId, 0);
+      return true;
+    } catch (error) {
+      return (error as NodeJS.ErrnoException).code === "EPERM";
+    }
+  });
+  try { sendSignal(-rootPid, "SIGTERM"); } catch {}
+  if (options.termWaitMs !== 0) await sleep(options.termWaitMs ?? 1_500);
+  if (!groupExists(rootPid)) return true;
+  try { sendSignal(-rootPid, "SIGKILL"); } catch {}
+  if (options.killWaitMs !== 0) await sleep(options.killWaitMs ?? 500);
+  return !groupExists(rootPid);
+}
diff --git a/src/protocol.ts b/src/protocol.ts
index 2276708..907fda0 100644
--- a/src/protocol.ts
+++ b/src/protocol.ts
@@ -9,7 +9,8 @@ export const MessageType = {
   SCREEN: 5, // Server → Client: screen buffer replay on attach
   PEEK: 6, // Client → Server: read-only attach (no input, no resize)
   STATUS: 7, // Client → Server: request stats; Server → Client: JSON stats response
-  // Values 8 and 9 are reserved for independent protocol extensions.
+  ACCEPTED_SOCKET_OWNERSHIP: 8, // Request/response: exact held TCP connection ancestry
+  LIFECYCLE_CAS: 9, // Request/response: generation-fenced one-tag compare-and-set
   GEOMETRY: 10, // Server → Client: effective shared rows/cols
 } as const;
 
@@ -20,6 +21,99 @@ export interface Packet {
   payload: Buffer;
 }
 
+export interface TcpConnectionTuple {
+  /** Address/port of the held probing socket. */
+  localAddress: string;
+  localPort: number;
+  /** Address/port the held probing socket connected to. */
+  remoteAddress: string;
+  remotePort: number;
+}
+
+export interface AcceptedSocketOwnershipRequest {
+  expectedGeneration: string;
+  connection: TcpConnectionTuple;
+}
+
+export type AcceptedSocketOwnershipResult =
+  | { _tag: "Owned"; pid: number }
+  | { _tag: "NotOwned" }
+  | { _tag: "Unavailable"; reason: string };
+
+export interface LifecycleCompareAndSetRequest {
+  expectedGeneration: string;
+  tag: string;
+  expectedValue: string;
+  value: string;
+}
+export type LifecycleCompareAndSetResult =
+  | { _tag: "Changed"; value: string }
+  | { _tag: "Unchanged"; value: string }
+  | { _tag: "ValueMismatch"; value?: string }
+  | { _tag: "Missing" }
+  | { _tag: "GenerationMismatch" }
+  | { _tag: "Busy" }
+  | { _tag: "DeadlineExpired"; value: string }
+  | { _tag: "Terminal"; value: string }
+  | { _tag: "InvalidRequest"; reason: string };
+
+const recordValue = (value: unknown): Record<string, unknown> | undefined =>
+  typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+
+export const decodeAcceptedSocketOwnershipRequest = (
+  input: unknown,
+): AcceptedSocketOwnershipRequest | undefined => {
+  const value = recordValue(input);
+  const connection = recordValue(value?.connection);
+  if (
+    typeof value?.expectedGeneration !== "string" ||
+    value.expectedGeneration.length === 0 ||
+    typeof connection?.localAddress !== "string" ||
+    connection.localAddress.length === 0 ||
+    typeof connection.localPort !== "number" ||
+    !Number.isInteger(connection.localPort) ||
+    connection.localPort < 1 ||
+    connection.localPort > 65_535 ||
+    typeof connection.remoteAddress !== "string" ||
+    connection.remoteAddress.length === 0 ||
+    typeof connection.remotePort !== "number" ||
+    !Number.isInteger(connection.remotePort) ||
+    connection.remotePort < 1 ||
+    connection.remotePort > 65_535
+  ) return undefined;
+  return {
+    expectedGeneration: value.expectedGeneration,
+    connection: {
+      localAddress: connection.localAddress,
+      localPort: connection.localPort,
+      remoteAddress: connection.remoteAddress,
+      remotePort: connection.remotePort,
+    },
+  };
+};
+
+export const decodeLifecycleCompareAndSetRequest = (
+  input: unknown,
+): LifecycleCompareAndSetRequest | undefined => {
+  const value = recordValue(input);
+  if (
+    typeof value?.expectedGeneration !== "string" ||
+    value.expectedGeneration.length === 0 ||
+    typeof value.tag !== "string" ||
+    value.tag.length === 0 ||
+    typeof value.expectedValue !== "string" ||
+    typeof value.value !== "string"
+  ) return undefined;
+  return {
+    expectedGeneration: value.expectedGeneration,
+    tag: value.tag,
+    expectedValue: value.expectedValue,
+    value: value.value,
+  };
+};
+
 // Packet wire format: [type: uint8][length: uint32BE][payload: N bytes]
 const HEADER_SIZE = 5;
 
@@ -103,6 +197,36 @@ export function encodeStatusResponse(json: string): Buffer {
   return encodePacket(MessageType.STATUS, Buffer.from(json));
 }
 
+export function encodeAcceptedSocketOwnershipRequest(
+  request: AcceptedSocketOwnershipRequest,
+): Buffer {
+  return encodePacket(
+    MessageType.ACCEPTED_SOCKET_OWNERSHIP,
+    Buffer.from(JSON.stringify(request)),
+  );
+}
+
+export function encodeAcceptedSocketOwnershipResponse(
+  result: AcceptedSocketOwnershipResult,
+): Buffer {
+  return encodePacket(
+    MessageType.ACCEPTED_SOCKET_OWNERSHIP,
+    Buffer.from(JSON.stringify(result)),
+  );
+}
+
+export function encodeLifecycleCompareAndSetRequest(
+  request: LifecycleCompareAndSetRequest,
+): Buffer {
+  return encodePacket(MessageType.LIFECYCLE_CAS, Buffer.from(JSON.stringify(request)));
+}
+
+export function encodeLifecycleCompareAndSetResponse(
+  result: LifecycleCompareAndSetResult,
+): Buffer {
+  return encodePacket(MessageType.LIFECYCLE_CAS, Buffer.from(JSON.stringify(result)));
+}
+
 export function decodeSize(payload: Buffer): { rows: number; cols: number } {
   if (payload.length < 4) {
     return { rows: 24, cols: 80 };
diff --git a/src/server.ts b/src/server.ts
index e0dcbf5..aef3b25 100644
--- a/src/server.ts
+++ b/src/server.ts
@@ -18,7 +18,15 @@ import {
   encodeScreen,
   encodeStatusResponse,
   encodeGeometry,
+  encodeAcceptedSocketOwnershipResponse,
+  encodeLifecycleCompareAndSetResponse,
+  decodeAcceptedSocketOwnershipRequest,
+  decodeLifecycleCompareAndSetRequest,
   decodeSize,
+  type AcceptedSocketOwnershipRequest,
+  type AcceptedSocketOwnershipResult,
+  type LifecycleCompareAndSetRequest,
+  type LifecycleCompareAndSetResult,
 } from "./protocol.ts";
 import {
   getSocketPath,
@@ -31,6 +39,7 @@ import {
   writeMetadata,
   readMetadata,
   mutateMetadataUnderLock,
+  compareAndSetTagValue,
   shouldReapAtExit,
   reapOnExitDefault,
   SESSION_EXIT_LAST_LINES_LIMIT,
@@ -66,11 +75,24 @@ import {
 } from "./recovery.ts";
 import type { StatsResult } from "./client.ts";
 import {
+  freezeDescendantProcesses,
   signalProcessIdentities,
-  snapshotDescendantProcesses,
+  snapshotDescendantProcessesComplete,
+  terminateProcessGroup,
   terminateProcessIdentities,
   type ProcessIdentity,
 } from "./process-tree.ts";
+import { inspectAcceptedSocketOwnershipAsync } from "./socket-ownership.ts";
+import {
+  armStartupLease,
+  startupLeaseDeadlineCause,
+  remainingLeaseDelayMs,
+  systemMonotonicClock,
+  terminalStartupLeaseValue,
+  type ArmedStartupLease,
+  type StartupLeaseOptions,
+  type StartupLeaseTerminalCause,
+} from "./startup-lease.ts";
 
 interface Client {
   socket: net.Socket;
@@ -89,6 +111,17 @@ interface Client {
   }>;
 }
 
+const jsonRecord = (payload: Buffer): Record<string, unknown> | undefined => {
+  try {
+    const value: unknown = JSON.parse(payload.toString("utf8"));
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+      ? value as Record<string, unknown>
+      : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
 export interface ServerOptions {
   name: string;
   generation?: string;
@@ -126,6 +159,11 @@ export interface ServerOptions {
    *  the caller wants total control of the child environment (e.g., a
    *  launcher shell that injects a shim tmux on `PATH`). */
   env?: Record<string, string>;
+  /** Optional daemon-owned hard startup deadline. The daemon publishes the
+   *  generation, boot identity, and absolute monotonic deadline in this tag. */
+  startupLease?: StartupLeaseOptions;
+  /** Called only after the current generation wins the deadline transition. */
+  onStartupLeaseDeadline?: () => void;
 }
 
 /** Env variables that are safe to pass through to a session child when
@@ -319,12 +357,22 @@ export class PtyServer {
   private lastResizeTime = 0;
   private eventWriter: EventWriter;
   private generation: string;
+  private startupLease: ArmedStartupLease | null = null;
+  private startupLeaseTimer: NodeJS.Timeout | null = null;
+  private startupLeaseDisarmed = false;
+  private startupLeaseTerminalCause: StartupLeaseTerminalCause | null = null;
+  private startupLeaseDeadlineNotified = false;
+  private startupLeaseDeadlineNotificationPending = false;
+  private startupLeaseDeadlineResponseReleased = false;
+  private startupLeaseTerminalValue: string | null = null;
   private recoveryCapability: RecoveryCapability | null = null;
   private recoveryRoot = "";
   private recoveryInFlight = false;
   private recoveryWatcher: fs.FSWatcher | null = null;
   private lastTitle = "";
   private shutdownDescendants: ProcessIdentity[] = [];
+  private shutdownTreeUnavailable: string | null = null;
+  private shutdownTreeSnapshotted = false;
   readonly ready: Promise<void>;
   // Resolves when the child process's onExit has fired — used by close() to
   // make sure session_exit has been queued to the event chain before we
@@ -336,6 +384,9 @@ export class PtyServer {
     this.name = options.name;
     this.options = options;
     this.generation = options.generation ?? randomBytes(16).toString("hex");
+    if (options.startupLease) {
+      this.startupLease = armStartupLease(options.startupLease, this.generation);
+    }
     this.eventWriter = new EventWriter(options.name);
     this.childExited = new Promise<void>((resolve) => {
       this.resolveChildExited = resolve;
@@ -596,6 +647,7 @@ export class PtyServer {
       // nonzero `signal` and often exitCode 0 — if we recorded only the raw
       // exitCode, a killed process would look like a clean finish and any
       // consumer gating on "nonzero exit" (convoy's crash→ding) would miss it.
+      this.settleStartupLease("exit");
       // Surface it the way a shell does: 128 + signal (SIGKILL 9 → 137).
       const code = signal ? 128 + signal : exitCode;
       this.exitCode = code;
@@ -673,6 +725,13 @@ export class PtyServer {
       });
       this.socketServer.listen(socketPath, () => {
         try { fs.chmodSync(socketPath, 0o600); } catch {}
+        const publishedTags: Record<string, string> = Object.assign(
+          Object.create(null),
+          options.tags ?? {},
+        );
+        if (this.startupLease) {
+          publishedTags[this.startupLease.lifecycleTag] = this.startupLease.startingValue;
+        }
         writeMetadata(this.name, {
           generation: this.generation,
           daemonPid: process.pid,
@@ -685,7 +744,7 @@ export class PtyServer {
           cols: options.cols,
           ephemeral: options.ephemeral === true,
           createdAt: new Date().toISOString(),
-          ...(options.tags && Object.keys(options.tags).length > 0 ? { tags: options.tags } : {}),
+          ...(Object.keys(publishedTags).length > 0 ? { tags: publishedTags } : {}),
           ...(options.displayName ? { displayName: options.displayName } : {}),
           ...(options.isolateEnv ? { isolateEnv: true } : {}),
           ...(options.extraEnv && Object.keys(options.extraEnv).length > 0 ? { extraEnv: options.extraEnv } : {}),
@@ -693,8 +752,10 @@ export class PtyServer {
           ...(options.env ? { env: options.env } : {}),
         });
         this.emitEvent(EventType.SESSION_START, {
-          ...(options.tags && Object.keys(options.tags).length > 0 ? { tags: options.tags } : {}),
+          ...(Object.keys(publishedTags).length > 0 ? { tags: publishedTags } : {}),
         });
+        if (this.exited) this.settleStartupLease("exit");
+        else this.scheduleStartupLeaseDeadline();
         if (settled) return;
         settled = true;
         resolve();
@@ -922,6 +983,226 @@ export class PtyServer {
     }
   }
 
+  private scheduleStartupLeaseDeadline(retryMs?: number): void {
+    if (!this.startupLease || this.startupLeaseDisarmed) return;
+    clearTimeout(this.startupLeaseTimer ?? undefined);
+    const delay = retryMs ?? remainingLeaseDelayMs(
+      this.startupLease.deadlineMonotonicNs,
+      systemMonotonicClock.nowNs(),
+    );
+    this.startupLeaseTimer = setTimeout(() => {
+      this.startupLeaseTimer = null;
+      if (!this.startupLease || this.startupLeaseDisarmed) return;
+      const remaining = remainingLeaseDelayMs(
+        this.startupLease.deadlineMonotonicNs,
+        systemMonotonicClock.nowNs(),
+      );
+      if (remaining > 0) {
+        this.scheduleStartupLeaseDeadline();
+        return;
+      }
+      this.settleStartupLeaseDeadline();
+    }, delay);
+  }
+
+  private settleStartupLeaseDeadline(notify = true): string | undefined {
+    if (!this.shutdownTreeSnapshotted) {
+      const snapshot = freezeDescendantProcesses(this.ptyProcess.pid);
+      this.shutdownTreeSnapshotted = true;
+      this.shutdownDescendants = snapshot.identities;
+      if (snapshot._tag === "Unavailable") {
+        this.shutdownTreeUnavailable = snapshot.reason;
+        console.error(
+          `pty daemon "${this.name}": complete child containment unavailable: ${snapshot.reason}; ` +
+          `publishing teardown-unavailable and exact-signalling ` +
+          `${snapshot.identities.length} observed descendant(s) plus process-group fallback`,
+        );
+      }
+    }
+    return this.settleStartupLease(startupLeaseDeadlineCause(
+      this.shutdownTreeUnavailable === null,
+    ), notify);
+  }
+
+  private resumePreparedDeadlineTeardown(): void {
+    try { process.kill(-this.ptyProcess.pid, "SIGCONT"); } catch {}
+    try { this.ptyProcess.kill("SIGCONT"); } catch {}
+    signalProcessIdentities(this.shutdownDescendants, "SIGCONT");
+  }
+
+  private releaseStartupLeaseDeadlineResponse(): void {
+    this.startupLeaseDeadlineResponseReleased = true;
+    this.notifyStartupLeaseDeadline();
+  }
+
+  private notifyStartupLeaseDeadline(): void {
+    if (
+      !this.startupLeaseDeadlineNotificationPending ||
+      this.startupLeaseDeadlineNotified
+    ) return;
+    this.startupLeaseDeadlineNotificationPending = false;
+    this.startupLeaseDeadlineNotified = true;
+    this.options.onStartupLeaseDeadline?.();
+  }
+
+  private settleStartupLease(
+    cause: StartupLeaseTerminalCause,
+    notify = true,
+  ): string | undefined {
+    const lease = this.startupLease;
+    const effectiveCause = cause === "exit"
+      ? this.startupLeaseTerminalCause ?? cause
+      : cause;
+    this.startupLeaseTerminalCause = effectiveCause;
+    if (!lease) return undefined;
+    if (this.startupLeaseTerminalValue !== null) return this.startupLeaseTerminalValue;
+    const terminalValue = terminalStartupLeaseValue(this.generation, effectiveCause);
+    const result = mutateMetadataUnderLock(this.name, (metadata) => {
+      if (metadata.tags?.[lease.lifecycleTag] === terminalValue) return false;
+      metadata.tags = { ...metadata.tags, [lease.lifecycleTag]: terminalValue };
+      return true;
+    }, { expectedGeneration: this.generation });
+    if (result.status === "changed" || result.status === "unchanged") {
+      this.startupLeaseDisarmed = true;
+      clearTimeout(this.startupLeaseTimer ?? undefined);
+      this.startupLeaseTimer = null;
+      this.startupLeaseTerminalValue = terminalValue;
+      if (effectiveCause !== "exit") {
+        this.startupLeaseDeadlineNotificationPending = true;
+        if (notify || this.startupLeaseDeadlineResponseReleased) {
+          this.notifyStartupLeaseDeadline();
+        }
+      }
+    } else if (
+      result.status === "busy" || result.status === "stale" || result.status === "missing"
+    ) {
+      clearTimeout(this.startupLeaseTimer ?? undefined);
+      this.startupLeaseTimer = setTimeout(() => {
+        this.startupLeaseTimer = null;
+        this.settleStartupLease(effectiveCause, notify);
+      }, 10);
+    } else if (result.status === "generation-mismatch") {
+      this.startupLeaseDisarmed = true;
+      if (cause !== "exit" && this.shutdownTreeSnapshotted) {
+        this.resumePreparedDeadlineTeardown();
+      }
+      clearTimeout(this.startupLeaseTimer ?? undefined);
+      this.startupLeaseTimer = null;
+    }
+    return terminalValue;
+  }
+
+  private async acceptedSocketOwnership(
+    request: AcceptedSocketOwnershipRequest,
+  ): Promise<AcceptedSocketOwnershipResult> {
+    if (request.expectedGeneration !== this.generation) {
+      return { _tag: "Unavailable", reason: "generation-mismatch" };
+    }
+    if (this.exited) return { _tag: "Unavailable", reason: "child-exited" };
+    const before = readMetadata(this.name);
+    if (!before) return { _tag: "Unavailable", reason: "metadata-unavailable" };
+    if (before.generation !== this.generation) {
+      return { _tag: "Unavailable", reason: "generation-mismatch" };
+    }
+    const result = await inspectAcceptedSocketOwnershipAsync(
+      this.ptyProcess.pid,
+      request.connection,
+    );
+    if (this.exited || this.startupLeaseDeadlineNotified) {
+      return { _tag: "Unavailable", reason: "child-exited" };
+    }
+    const after = readMetadata(this.name);
+    if (!after) return { _tag: "Unavailable", reason: "metadata-unavailable" };
+    return after.generation === this.generation
+      ? result
+      : { _tag: "Unavailable", reason: "generation-mismatch" };
+  }
+
+  private compareAndSetLifecycle(
+    request: LifecycleCompareAndSetRequest,
+  ): LifecycleCompareAndSetResult {
+    if (request.expectedGeneration !== this.generation) {
+      return { _tag: "GenerationMismatch" };
+    }
+    const current = readMetadata(this.name);
+    if (!current) return { _tag: "Missing" };
+    if (current.generation !== this.generation) {
+      return { _tag: "GenerationMismatch" };
+    }
+    if (this.exited) {
+      const value = this.settleStartupLease("exit") ??
+        terminalStartupLeaseValue(this.generation, "exit");
+      const after = readMetadata(this.name);
+      if (!after) return { _tag: "Missing" };
+      if (after.generation !== this.generation) {
+        return { _tag: "GenerationMismatch" };
+      }
+      return { _tag: "Terminal", value };
+    }
+    const lease = this.startupLease;
+    if (
+      lease &&
+      !this.startupLeaseDisarmed &&
+      systemMonotonicClock.nowNs() >= BigInt(lease.deadlineMonotonicNs)
+    ) {
+      this.settleStartupLeaseDeadline(false);
+      const after = readMetadata(this.name);
+      if (!after) return { _tag: "Missing" };
+      if (after.generation !== this.generation) {
+        return { _tag: "GenerationMismatch" };
+      }
+      const value = after.tags?.[lease.lifecycleTag];
+      return value === undefined
+        ? { _tag: "ValueMismatch" }
+        : { _tag: "DeadlineExpired", value };
+    }
+
+    const result = compareAndSetTagValue(
+      this.name,
+      request.expectedGeneration,
+      request.tag,
+      request.expectedValue,
+      request.value,
+    );
+    if (result.status === "changed" || result.status === "unchanged") {
+      if (
+        lease &&
+        request.tag === lease.lifecycleTag &&
+        request.expectedValue === lease.startingValue &&
+        request.value !== lease.startingValue
+      ) {
+        this.startupLeaseDisarmed = true;
+        clearTimeout(this.startupLeaseTimer ?? undefined);
+        this.startupLeaseTimer = null;
+      }
+      if (lease && request.tag === lease.lifecycleTag) {
+        try {
+          const lifecycle: unknown = JSON.parse(request.value);
+          if (
+            typeof lifecycle === "object" &&
+            lifecycle !== null &&
+            !Array.isArray(lifecycle) &&
+            (lifecycle as Record<string, unknown>)._tag === "terminal" &&
+            (lifecycle as Record<string, unknown>).generation === this.generation
+          ) {
+            this.startupLeaseTerminalValue = request.value;
+          }
+        } catch {}
+      }
+      return result.status === "changed"
+        ? { _tag: "Changed", value: result.value }
+        : { _tag: "Unchanged", value: result.value };
+    }
+    if (result.status === "value-mismatch") {
+      return result.value === undefined
+        ? { _tag: "ValueMismatch" }
+        : { _tag: "ValueMismatch", value: result.value };
+    }
+    if (result.status === "missing") return { _tag: "Missing" };
+    if (result.status === "generation-mismatch") return { _tag: "GenerationMismatch" };
+    return { _tag: "Busy" };
+  }
+
   private handleClient(socket: net.Socket): void {
     const client: Client = {
       socket,
@@ -1068,6 +1349,47 @@ export class PtyServer {
             socket.write(encodeStatusResponse(JSON.stringify(stats)));
             break;
           }
+
+          case MessageType.ACCEPTED_SOCKET_OWNERSHIP: {
+            const request = decodeAcceptedSocketOwnershipRequest(jsonRecord(packet.payload));
+            if (request === undefined) {
+              socket.write(encodeAcceptedSocketOwnershipResponse({
+                _tag: "Unavailable",
+                reason: "invalid-request",
+              }));
+            } else {
+              void this.acceptedSocketOwnership(request).then((result) => {
+                if (!socket.destroyed) {
+                  socket.write(encodeAcceptedSocketOwnershipResponse(result));
+                }
+              });
+            }
+            break;
+          }
+
+          case MessageType.LIFECYCLE_CAS: {
+            const request = decodeLifecycleCompareAndSetRequest(jsonRecord(packet.payload));
+            const result = request === undefined
+              ? { _tag: "InvalidRequest" as const, reason: "invalid request payload" }
+              : this.compareAndSetLifecycle(request);
+            const deferDeadlineShutdown =
+              this.startupLeaseTerminalCause !== null &&
+              this.startupLeaseTerminalCause !== "exit" &&
+              !this.startupLeaseDeadlineNotified;
+            socket.write(
+              encodeLifecycleCompareAndSetResponse(result),
+              deferDeadlineShutdown
+                ? () => setImmediate(() => this.releaseStartupLeaseDeadlineResponse())
+                : undefined,
+            );
+            if (deferDeadlineShutdown) {
+              const shutdownBackstop = setTimeout(() => {
+                this.releaseStartupLeaseDeadlineResponse();
+              }, 2_000);
+              shutdownBackstop.unref();
+            }
+            break;
+          }
         }
       }
     });
@@ -1386,13 +1708,15 @@ export class PtyServer {
 
   /** Clean up resources. Does not call process.exit(). */
   close(options: { terminateDescendants?: boolean } = {}): Promise<void> {
-    if (options.terminateDescendants && this.shutdownDescendants.length === 0) {
-      try {
-        this.shutdownDescendants = snapshotDescendantProcesses(this.ptyProcess.pid);
-      } catch (error) {
+    if (options.terminateDescendants && !this.shutdownTreeSnapshotted) {
+      const snapshot = snapshotDescendantProcessesComplete(this.ptyProcess.pid);
+      this.shutdownTreeSnapshotted = true;
+      this.shutdownDescendants = snapshot.identities;
+      if (snapshot._tag === "Unavailable") {
+        this.shutdownTreeUnavailable = snapshot.reason;
         console.error(
-          `pty daemon "${this.name}": could not snapshot child processes: ` +
-          `${error instanceof Error ? error.message : String(error)}`,
+          `pty daemon "${this.name}": complete child snapshot unavailable: ${snapshot.reason}; ` +
+          `exact-signalling ${snapshot.identities.length} observed descendant(s) plus process-group fallback`,
         );
       }
     }
@@ -1420,10 +1744,18 @@ export class PtyServer {
           pid: process.pid,
         });
         try {
-          this.ptyProcess.kill();
+          if (this.startupLeaseDeadlineNotified) this.ptyProcess.kill("SIGKILL");
+          else this.ptyProcess.kill();
         } catch {}
+        const groupFallback = options.terminateDescendants && this.shutdownTreeUnavailable !== null
+          ? terminateProcessGroup(this.ptyProcess.pid, {
+            ...(this.startupLeaseDeadlineNotified ? { termWaitMs: 0 } : {}),
+          })
+          : Promise.resolve(true);
         const descendantsDone = options.terminateDescendants
-          ? terminateProcessIdentities(this.shutdownDescendants)
+          ? terminateProcessIdentities(this.shutdownDescendants, {
+            ...(this.startupLeaseDeadlineNotified ? { termWaitMs: 0 } : {}),
+          })
           : Promise.resolve([]);
         // Wait for the child's onExit to fire (which enqueues session_exit)
         // before draining the writer. Without this, SIGTERM-initiated
@@ -1442,6 +1774,13 @@ export class PtyServer {
           ]);
         }
         const survivingDescendants = await descendantsDone;
+        const processGroupGone = await groupFallback;
+        if (!processGroupGone) {
+          console.error(
+            `pty daemon "${this.name}": process-group fallback could not verify teardown ` +
+            `after incomplete snapshot (${this.shutdownTreeUnavailable})`,
+          );
+        }
         if (survivingDescendants.length > 0) {
           const pids = survivingDescendants.map((d) => d.pid);
           console.error(
@@ -1469,6 +1808,9 @@ export class PtyServer {
   forceKillChild(): void {
     try { this.ptyProcess.kill("SIGKILL"); } catch {}
     signalProcessIdentities(this.shutdownDescendants, "SIGKILL");
+    if (this.shutdownTreeUnavailable !== null) {
+      try { process.kill(-this.ptyProcess.pid, "SIGKILL"); } catch {}
+    }
   }
 }
 
@@ -1559,8 +1901,8 @@ if (process.argv[1]?.endsWith("/server.js")) {
   //     two would delete the evidence the operator killed the session to
   //     inspect. Keep.
   //
-  // `--ephemeral` remains the pre-existing aggressive opt-in and reaps on
-  // either path, so no existing caller of it regresses.
+  // Startup-lease generations always retain their terminal lifecycle and exit
+  // evidence; explicit evidence removal remains generation-fenced.
   let externalKill = false;
   function reapAtExit(): boolean {
     const metadata = readMetadata(config.name);
@@ -1570,6 +1912,7 @@ if (process.argv[1]?.endsWith("/server.js")) {
     ) {
       return false;
     }
+    if (config.startupLease) return false;
     if (externalKill && !isEphemeral) return false;
     const tags = metadata?.tags ?? config.tags;
     // `PTY_REAP_ON_EXIT` (network/global config) sets the default when no
@@ -1638,6 +1981,11 @@ if (process.argv[1]?.endsWith("/server.js")) {
     extraEnv: config.extraEnv,
     unsetEnv: config.unsetEnv,
     env: config.env,
+    startupLease: config.startupLease,
+    onStartupLeaseDeadline: () => {
+      externalKill = true;
+      void cleanShutdown(124);
+    },
     onExit: (code) => {
       // Give clients a moment to receive the exit message, then shut down
       setTimeout(() => cleanShutdown(code), 500);
diff --git a/src/sessions.ts b/src/sessions.ts
index 5f91ca9..7029ce9 100644
--- a/src/sessions.ts
+++ b/src/sessions.ts
@@ -428,6 +428,51 @@ export function mutateMetadataUnderLock(
   }
 }
 
+export type TagCompareAndSetResult =
+  | { status: "changed"; value: string }
+  | { status: "unchanged"; value: string }
+  | { status: "value-mismatch"; value?: string }
+  | { status: "busy" }
+  | { status: "missing" }
+  | { status: "generation-mismatch" }
+  | { status: "stale" };
+
+/** Generation-fenced compare-and-set for one exact tag value.
+ *
+ * This is the metadata primitive used by the daemon protocol. Callers that
+ * need a startup lease disarmed must use that live protocol rather than this
+ * filesystem helper, because the daemon owns the deadline timer. */
+export function compareAndSetTagValue(
+  name: string,
+  expectedGeneration: string,
+  tag: string,
+  expectedValue: string,
+  value: string,
+): TagCompareAndSetResult {
+  if (tag.length === 0) throw new Error("tag must not be empty");
+  let currentValue: string | undefined;
+  let matched = false;
+  const result = mutateMetadataUnderLock(name, (metadata) => {
+    currentValue = metadata.tags?.[tag];
+    if (currentValue !== expectedValue) return false;
+    matched = true;
+    if (currentValue === value) return false;
+    metadata.tags = { ...metadata.tags, [tag]: value };
+    return true;
+  }, { expectedGeneration });
+  if (
+    (result.status === "changed" || result.status === "unchanged") &&
+    !matched
+  ) {
+    return currentValue === undefined
+      ? { status: "value-mismatch" }
+      : { status: "value-mismatch", value: currentValue };
+  }
+  if (result.status === "changed") return { status: "changed", value };
+  if (result.status === "unchanged") return { status: "unchanged", value };
+  return result;
+}
+
 function validateMetadataPatch(patch: unknown): asserts patch is MetadataPatch {
   if (patch === null || typeof patch !== "object" || Array.isArray(patch)) {
     throw new Error("Metadata patch must be a JSON object.");
diff --git a/src/socket-ownership-worker.ts b/src/socket-ownership-worker.ts
new file mode 100644
index 0000000..3f6a706
--- /dev/null
+++ b/src/socket-ownership-worker.ts
@@ -0,0 +1,7 @@
+import { parentPort, workerData } from "node:worker_threads";
+import { inspectAcceptedSocketOwnership } from "./socket-ownership.ts";
+import type { TcpConnectionTuple } from "./protocol.ts";
+
+const input = workerData as { rootPid: number; tuple: TcpConnectionTuple };
+const result = inspectAcceptedSocketOwnership(input.rootPid, input.tuple);
+parentPort?.postMessage(result);
diff --git a/src/socket-ownership.ts b/src/socket-ownership.ts
new file mode 100644
index 0000000..207c65d
--- /dev/null
+++ b/src/socket-ownership.ts
@@ -0,0 +1,385 @@
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { Worker } from "node:worker_threads";
+import { openSource, type LiveIdentity, type ProcessSource, type Row } from "./proc-table.ts";
+import type {
+  AcceptedSocketOwnershipResult,
+  TcpConnectionTuple,
+} from "./protocol.ts";
+
+export interface SocketOwnershipDeps {
+  platform?: NodeJS.Platform;
+  processSource?: () => ProcessSource;
+  linuxProcRoot?: string;
+  darwinHelperPath?: string;
+  execHelper?: (file: string, args: string[]) => string;
+  endianness?: "BE" | "LE";
+}
+
+type BackendResult =
+  | { _tag: "Owned"; pid: number }
+  | { _tag: "NotOwned" }
+  | { _tag: "Unavailable"; reason: string };
+
+interface TreeIdentity {
+  pid: number;
+  identity: LiveIdentity;
+}
+
+/**
+ * Prove that the server side of one exact held TCP connection belongs to the
+ * current PTY child or one of its descendants. Both the process tree and every
+ * inspected socket table are complete-or-unavailable; missing facts never turn
+ * into NotOwned.
+ */
+export const inspectAcceptedSocketOwnership = (
+  rootPid: number,
+  tuple: TcpConnectionTuple,
+  deps: SocketOwnershipDeps = {},
+): AcceptedSocketOwnershipResult => {
+  const tupleError = validateTuple(tuple);
+  if (tupleError !== undefined) return { _tag: "Unavailable", reason: tupleError };
+
+  const sourceFactory = deps.processSource ?? openSource;
+  const before = exactTree(rootPid, sourceFactory());
+  if (before._tag === "Unavailable") return before;
+
+  const pids = before.identities.map(({ pid }) => pid);
+  const observed = inspectBackend(pids, tuple, deps);
+  if (observed._tag === "Unavailable") return observed;
+
+  const middle = exactTree(rootPid, sourceFactory());
+  if (middle._tag === "Unavailable") return middle;
+  if (!sameTree(before.identities, middle.identities)) {
+    return { _tag: "Unavailable", reason: "process-tree-changed" };
+  }
+  if (observed._tag === "NotOwned") return observed;
+  if (!before.identities.some(({ pid }) => pid === observed.pid)) {
+    return { _tag: "Unavailable", reason: "backend-returned-non-descendant" };
+  }
+
+  const confirmed = inspectBackend(pids, tuple, deps);
+  if (confirmed._tag !== "Owned" || confirmed.pid !== observed.pid) {
+    return { _tag: "Unavailable", reason: "socket-ownership-changed" };
+  }
+  const after = exactTree(rootPid, sourceFactory());
+  if (after._tag === "Unavailable") return after;
+  return sameTree(middle.identities, after.identities)
+    ? confirmed
+    : { _tag: "Unavailable", reason: "process-tree-changed" };
+};
+
+const inspectBackend = (
+  pids: number[],
+  tuple: TcpConnectionTuple,
+  deps: SocketOwnershipDeps,
+): BackendResult => {
+  const platform = deps.platform ?? process.platform;
+  return platform === "linux"
+    ? inspectLinux(pids, tuple, deps.linuxProcRoot ?? "/proc", deps.endianness ?? os.endianness())
+    : platform === "darwin"
+      ? inspectDarwin(pids, tuple, deps)
+      : { _tag: "Unavailable", reason: `unsupported-platform:${platform}` };
+};
+
+const exactTree = (
+  rootPid: number,
+  source: ProcessSource,
+): { _tag: "Available"; identities: TreeIdentity[] } | { _tag: "Unavailable"; reason: string } => {
+  const answer = source.rows();
+  if (answer.kind !== "known") {
+    return { _tag: "Unavailable", reason: `process-table-${answer.kind}` };
+  }
+  const byPid = new Map(answer.value.map((row) => [row.pid, row]));
+  const root = byPid.get(rootPid);
+  if (!root || root.state.startsWith("Z") || root.identity === null) {
+    return { _tag: "Unavailable", reason: "child-identity-unavailable" };
+  }
+
+  const children = new Map<number, Row[]>();
+  for (const row of answer.value) {
+    const list = children.get(row.ppid) ?? [];
+    list.push(row);
+    children.set(row.ppid, list);
+  }
+  const identities: TreeIdentity[] = [];
+  const queue = [root];
+  const seen = new Set<number>();
+  while (queue.length > 0) {
+    const row = queue.shift()!;
+    if (seen.has(row.pid)) continue;
+    seen.add(row.pid);
+    if (row.state.startsWith("Z") || row.identity === null) {
+      return { _tag: "Unavailable", reason: `process-identity-unavailable:${row.pid}` };
+    }
+    identities.push({ pid: row.pid, identity: row.identity });
+    queue.push(...(children.get(row.pid) ?? []));
+  }
+  identities.sort((a, b) => a.pid - b.pid);
+  return { _tag: "Available", identities };
+};
+
+const sameTree = (left: TreeIdentity[], right: TreeIdentity[]): boolean =>
+  left.length === right.length && left.every((entry, index) =>
+    entry.pid === right[index]?.pid && entry.identity === right[index]?.identity
+  );
+
+const validateTuple = (tuple: TcpConnectionTuple): string | undefined => {
+  if (tuple.localAddress.includes("%") || tuple.remoteAddress.includes("%")) {
+    return "scoped-ipv6-unavailable";
+  }
+  if (net.isIP(tuple.localAddress) === 0) return "invalid-local-address";
+  if (net.isIP(tuple.remoteAddress) === 0) return "invalid-remote-address";
+  if (net.isIP(tuple.localAddress) !== net.isIP(tuple.remoteAddress)) {
+    return "address-family-mismatch";
+  }
+  if (!isPort(tuple.localPort)) return "invalid-local-port";
+  if (!isPort(tuple.remotePort)) return "invalid-remote-port";
+  return undefined;
+};
+
+const isPort = (value: number): boolean => Number.isSafeInteger(value) && value > 0 && value <= 65535;
+const stripZone = (address: string): string => address.split("%", 1)[0];
+
+const inspectLinux = (
+  pids: number[],
+  tuple: TcpConnectionTuple,
+  procRoot: string,
+  endianness: "BE" | "LE",
+): BackendResult => {
+  const family = net.isIP(stripZone(tuple.localAddress));
+  const expectedLocal = encodeLinuxProcAddress(stripZone(tuple.remoteAddress), endianness);
+  const expectedRemote = encodeLinuxProcAddress(stripZone(tuple.localAddress), endianness);
+  if (expectedLocal === undefined || expectedRemote === undefined) {
+    return { _tag: "Unavailable", reason: "address-encoding-failed" };
+  }
+  const tableName = family === 4 ? "tcp" : "tcp6";
+  const localPort = tuple.remotePort.toString(16).padStart(4, "0").toUpperCase();
+  const remotePort = tuple.localPort.toString(16).padStart(4, "0").toUpperCase();
+
+  for (const pid of pids) {
+    let table: string;
+    let fds: string[];
+    try {
+      table = fs.readFileSync(path.join(procRoot, String(pid), "net", tableName), "utf8");
+      fds = fs.readdirSync(path.join(procRoot, String(pid), "fd"));
+    } catch {
+      return { _tag: "Unavailable", reason: `procfs-unreadable:${pid}` };
+    }
+    const parsed = parseLinuxTcpTable(table);
+    if (parsed === undefined) {
+      return { _tag: "Unavailable", reason: `socket-table-invalid:${pid}` };
+    }
+    const inodes = new Set(parsed.filter((row) =>
+      row.state === "01" &&
+      row.localAddress === expectedLocal &&
+      row.localPort === localPort &&
+      row.remoteAddress === expectedRemote &&
+      row.remotePort === remotePort
+    ).map((row) => row.inode));
+    if (inodes.size === 0) continue;
+
+    for (const fd of fds) {
+      let target: string;
+      try {
+        target = fs.readlinkSync(path.join(procRoot, String(pid), "fd", fd));
+      } catch {
+        return { _tag: "Unavailable", reason: `fd-table-unreadable:${pid}` };
+      }
+      const match = /^socket:\[(\d+)]$/.exec(target);
+      if (match && inodes.has(match[1])) return { _tag: "Owned", pid };
+    }
+  }
+  return { _tag: "NotOwned" };
+};
+
+interface LinuxTcpRow {
+  localAddress: string;
+  localPort: string;
+  remoteAddress: string;
+  remotePort: string;
+  state: string;
+  inode: string;
+}
+
+/** Parse a complete procfs tcp/tcp6 table. Any malformed data invalidates it. */
+export const parseLinuxTcpTable = (input: string): LinuxTcpRow[] | undefined => {
+  const lines = input.trimEnd().split("\n");
+  if (lines.length === 0 || !lines[0]?.includes("local_address")) return undefined;
+  const rows: LinuxTcpRow[] = [];
+  for (const line of lines.slice(1)) {
+    if (line.trim() === "") continue;
+    const fields = line.trim().split(/\s+/);
+    if (fields.length < 10) return undefined;
+    const local = /^([0-9A-Fa-f]+):([0-9A-Fa-f]{4})$/.exec(fields[1]);
+    const remote = /^([0-9A-Fa-f]+):([0-9A-Fa-f]{4})$/.exec(fields[2]);
+    if (!local || !remote || !/^[0-9A-Fa-f]{2}$/.test(fields[3]) || !/^\d+$/.test(fields[9])) {
+      return undefined;
+    }
+    rows.push({
+      localAddress: local[1].toUpperCase(),
+      localPort: local[2].toUpperCase(),
+      remoteAddress: remote[1].toUpperCase(),
+      remotePort: remote[2].toUpperCase(),
+      state: fields[3].toUpperCase(),
+      inode: fields[9],
+    });
+  }
+  return rows;
+};
+
+export const encodeLinuxProcAddress = (
+  address: string,
+  endianness: "BE" | "LE" = os.endianness(),
+): string | undefined => {
+  const bytes = ipBytes(address);
+  if (bytes === undefined) return undefined;
+  if (endianness === "BE") return Buffer.from(bytes).toString("hex").toUpperCase();
+  const out: number[] = [];
+  for (let offset = 0; offset < bytes.length; offset += 4) {
+    out.push(bytes[offset + 3], bytes[offset + 2], bytes[offset + 1], bytes[offset]);
+  }
+  return Buffer.from(out).toString("hex").toUpperCase();
+};
+
+const ipBytes = (address: string): number[] | undefined => {
+  if (net.isIPv4(address)) {
+    const bytes = address.split(".").map(Number);
+    return bytes.length === 4 && bytes.every((part) => Number.isInteger(part) && part >= 0 && part <= 255)
+      ? bytes
+      : undefined;
+  }
+  if (!net.isIPv6(address)) return undefined;
+  const halves = address.toLowerCase().split("::");
+  if (halves.length > 2) return undefined;
+  const expand = (part: string): number[] | undefined => {
+    if (part === "") return [];
+    const words: number[] = [];
+    for (const token of part.split(":")) {
+      if (token.includes(".")) {
+        const v4 = ipBytes(token);
+        if (v4 === undefined) return undefined;
+        words.push((v4[0] << 8) | v4[1], (v4[2] << 8) | v4[3]);
+      } else if (/^[0-9a-f]{1,4}$/.test(token)) {
+        words.push(Number.parseInt(token, 16));
+      } else {
+        return undefined;
+      }
+    }
+    return words;
+  };
+  const left = expand(halves[0] ?? "");
+  const right = expand(halves[1] ?? "");
+  if (left === undefined || right === undefined) return undefined;
+  const missing = halves.length === 2 ? 8 - left.length - right.length : 0;
+  if (missing < 0 || (halves.length === 1 && left.length !== 8)) return undefined;
+  const words = [...left, ...Array.from({ length: missing }, () => 0), ...right];
+  if (words.length !== 8) return undefined;
+  return words.flatMap((word) => [word >>> 8, word & 0xff]);
+};
+
+const inspectDarwin = (
+  pids: number[],
+  tuple: TcpConnectionTuple,
+  deps: SocketOwnershipDeps,
+): BackendResult => {
+  const bin = path.resolve(
+    import.meta.dirname ?? path.dirname(fileURLToPath(import.meta.url)),
+    "..",
+    "bin",
+  );
+  const architectureHelper = path.join(bin, `pty-socket-owner-darwin-${process.arch}`);
+  const helper = deps.darwinHelperPath ?? (
+    fs.existsSync(architectureHelper)
+      ? architectureHelper
+      : path.join(bin, "pty-socket-owner-darwin")
+  );
+  const execute = deps.execHelper ?? ((file: string, args: string[]) => execFileSync(file, args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 2_000,
+  }));
+  let output: string;
+  try {
+    output = execute(helper, [
+      stripZone(tuple.remoteAddress),
+      String(tuple.remotePort),
+      stripZone(tuple.localAddress),
+      String(tuple.localPort),
+      ...pids.map(String),
+    ]).trim();
+  } catch {
+    return { _tag: "Unavailable", reason: "darwin-helper-failed" };
+  }
+  if (output === "not-owned") return { _tag: "NotOwned" };
+  if (output === "unavailable") return { _tag: "Unavailable", reason: "darwin-table-unavailable" };
+  const match = /^owned (\d+)$/.exec(output);
+  if (!match) return { _tag: "Unavailable", reason: "darwin-helper-invalid-output" };
+  const pid = Number(match[1]);
+  return Number.isSafeInteger(pid) && pids.includes(pid)
+    ? { _tag: "Owned", pid }
+    : { _tag: "Unavailable", reason: "darwin-helper-returned-non-descendant" };
+};
+
+export interface AsyncSocketOwnershipDeps {
+  workerUrl?: URL;
+  timeoutMs?: number;
+}
+
+/** Run synchronous procfs/libproc inspection in an isolated worker so a slow
+ * readiness query cannot delay the daemon-owned startup deadline timer. */
+export const inspectAcceptedSocketOwnershipAsync = (
+  rootPid: number,
+  tuple: TcpConnectionTuple,
+  deps: AsyncSocketOwnershipDeps = {},
+): Promise<AcceptedSocketOwnershipResult> => new Promise((resolve) => {
+  const extension = import.meta.url.endsWith(".ts") ? "ts" : "js";
+  let worker: Worker;
+  try {
+    worker = new Worker(
+      deps.workerUrl ?? new URL(`./socket-ownership-worker.${extension}`, import.meta.url),
+      { workerData: { rootPid, tuple } },
+    );
+  } catch {
+    resolve({ _tag: "Unavailable", reason: "ownership-worker-failed" });
+    return;
+  }
+  let settled = false;
+  const finish = (result: AcceptedSocketOwnershipResult): void => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    void worker.terminate();
+    resolve(result);
+  };
+  const timer = setTimeout(
+    () => finish({ _tag: "Unavailable", reason: "ownership-worker-timeout" }),
+    deps.timeoutMs ?? 10_000,
+  );
+  worker.once("message", (value: unknown) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      finish({ _tag: "Unavailable", reason: "ownership-worker-invalid-result" });
+      return;
+    }
+    const result = value as Record<string, unknown>;
+    if (result._tag === "Owned" && Number.isSafeInteger(result.pid) && (result.pid as number) > 0) {
+      finish({ _tag: "Owned", pid: result.pid as number });
+    } else if (result._tag === "NotOwned") {
+      finish({ _tag: "NotOwned" });
+    } else if (result._tag === "Unavailable" && typeof result.reason === "string") {
+      finish({ _tag: "Unavailable", reason: result.reason });
+    } else {
+      finish({ _tag: "Unavailable", reason: "ownership-worker-invalid-result" });
+    }
+  });
+  worker.once("error", () => {
+    finish({ _tag: "Unavailable", reason: "ownership-worker-failed" });
+  });
+  worker.once("exit", (code) => {
+    if (code !== 0) finish({ _tag: "Unavailable", reason: "ownership-worker-failed" });
+  });
+});
diff --git a/src/spawn.ts b/src/spawn.ts
index c045598..3bb8960 100644
--- a/src/spawn.ts
+++ b/src/spawn.ts
@@ -8,6 +8,7 @@ import {
   validateDisplayName,
   hasProcessExitedForReap,
 } from "./sessions.ts";
+import type { StartupLeaseOptions } from "./startup-lease.ts";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -102,6 +103,8 @@ export interface SpawnDaemonOptions {
   /** @internal PID owning an already-held per-name creation lock. Used only
    *  when a lifecycle operation must keep its CAS lock across CLI fallback. */
   creationLockOwnerPid?: number;
+  /** Daemon-owned startup deadline, published as a generation-fenced lifecycle tag. */
+  startupLease?: StartupLeaseOptions;
 }
 
 /** Default time we wait for a daemon's Unix socket to appear after
@@ -182,6 +185,7 @@ async function spawnViaNode(options: SpawnDaemonOptions, serverModule: string):
     ...(options.extraEnv && Object.keys(options.extraEnv).length > 0 ? { extraEnv: options.extraEnv } : {}),
     ...(options.unsetEnv && options.unsetEnv.length > 0 ? { unsetEnv: options.unsetEnv } : {}),
     ...(options.env ? { env: options.env } : {}),
+    ...(options.startupLease ? { startupLease: options.startupLease } : {}),
   });
 
   const launcherCmd = options.launcher?.command ?? process.execPath;
@@ -316,8 +320,8 @@ function hasPublishedSessionStart(name: string, createdAt: string): boolean {
  * Only the inputs that the CLI surface supports are passed through. Initial
  * size, an alternate display command, an exact replacement env, and a custom
  * launcher remain Node-path-only; the restart-relevant CLI settings
- * (ephemeral, cwd, display name, tags, isolation, env overlay, and env
- * removal) all have lossless flag equivalents.
+ * (ephemeral, cwd, display name, tags, isolation, env overlay, env removal,
+ * and startup lease) all have lossless flag equivalents.
  *
  * `isolateEnv` maps to `--isolate-env`. `cwd` to `--cwd`. `tags` to
  * repeated `--tag k=v`. `name` to `--id` (the on-disk identifier under the
@@ -350,6 +354,10 @@ function spawnViaCli(options: SpawnDaemonOptions): Promise<void> {
       cliArgs.push("--tag", `${k}=${v}`);
     }
   }
+  if (options.startupLease) {
+    cliArgs.push("--startup-timeout-ms", String(options.startupLease.timeoutMs));
+    cliArgs.push("--lifecycle-tag", options.startupLease.lifecycleTag);
+  }
   cliArgs.push("--", options.command, ...options.args);
 
   const env = { ...process.env };
diff --git a/src/startup-lease.ts b/src/startup-lease.ts
new file mode 100644
index 0000000..6593bfd
--- /dev/null
+++ b/src/startup-lease.ts
@@ -0,0 +1,110 @@
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+
+export interface StartupLeaseOptions {
+  /** Positive startup budget. PTY converts this once into an absolute deadline. */
+  timeoutMs: number;
+  /** The one metadata tag whose value carries the generation-fenced lifecycle. */
+  lifecycleTag: string;
+}
+
+export interface ArmedStartupLease {
+  generation: string;
+  lifecycleTag: string;
+  bootId: string;
+  deadlineMonotonicNs: string;
+  startingValue: string;
+}
+
+export type StartupLeaseTerminalCause = "exit" | "deadline" | "teardown-unavailable";
+
+export interface MonotonicClock {
+  bootId(): string | undefined;
+  nowNs(): bigint;
+}
+
+export const systemMonotonicClock: MonotonicClock = {
+  bootId: () => readBootIdentity(),
+  nowNs: () => process.hrtime.bigint(),
+};
+
+export const armStartupLease = (
+  options: StartupLeaseOptions,
+  generation: string,
+  clock: MonotonicClock = systemMonotonicClock,
+): ArmedStartupLease => {
+  if (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs <= 0) {
+    throw new Error("startup lease timeoutMs must be a positive safe integer");
+  }
+  if (options.lifecycleTag.length === 0) {
+    throw new Error("startup lease lifecycleTag must not be empty");
+  }
+  const bootId = clock.bootId();
+  if (bootId === undefined || bootId.length === 0) {
+    throw new Error("startup lease boot identity is unavailable");
+  }
+  const deadline = clock.nowNs() + BigInt(options.timeoutMs) * 1_000_000n;
+  const deadlineMonotonicNs = deadline.toString();
+  return {
+    generation,
+    lifecycleTag: options.lifecycleTag,
+    bootId,
+    deadlineMonotonicNs,
+    startingValue: JSON.stringify({
+      _tag: "starting",
+      generation,
+      bootId,
+      deadlineMonotonicNs,
+    }),
+  };
+};
+
+export const terminalStartupLeaseValue = (
+  generation: string,
+  cause: StartupLeaseTerminalCause,
+): string => JSON.stringify({ _tag: "terminal", generation, cause });
+
+/** A deadline is only claimed when PTY proved complete process containment.
+ * Unknown or partial observations remain terminal, but explicitly report that
+ * the ensuing exact-identity/group signals are best-effort containment. */
+export const startupLeaseDeadlineCause = (
+  containmentComplete: boolean,
+): StartupLeaseTerminalCause => containmentComplete
+  ? "deadline"
+  : "teardown-unavailable";
+
+export const remainingLeaseDelayMs = (deadlineMonotonicNs: string, nowNs: bigint): number => {
+  let deadline: bigint;
+  try {
+    deadline = BigInt(deadlineMonotonicNs);
+  } catch {
+    return 0;
+  }
+  if (nowNs >= deadline) return 0;
+  const remaining = (deadline - nowNs + 999_999n) / 1_000_000n;
+  return Number(remaining > 2_147_483_647n ? 2_147_483_647n : remaining);
+};
+
+export const readBootIdentity = (): string | undefined => {
+  if (process.platform === "linux") {
+    try {
+      const value = fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      return value.length > 0 ? `linux:${value}` : undefined;
+    } catch {
+      return undefined;
+    }
+  }
+  if (process.platform === "darwin") {
+    try {
+      const value = execFileSync("sysctl", ["-n", "kern.boottime"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 2_000,
+      }).trim();
+      return value.length > 0 ? `darwin:${value}` : undefined;
+    } catch {
+      return undefined;
+    }
+  }
+  return undefined;
+};
diff --git a/tests/completions.test.ts b/tests/completions.test.ts
index d1e1a6e..46c8415 100644
--- a/tests/completions.test.ts
+++ b/tests/completions.test.ts
@@ -75,6 +75,21 @@ describe("completion spec parity with COMMAND_HELP", () => {
       ],
     });
   });
+
+  it("models readiness as ownership and CAS leaves with required ids", () => {
+    expect(COMMANDS.find((command) => command.name === "readiness")).toMatchObject({
+      subcommands: [
+        {
+          name: "ownership",
+          flags: [{ name: "id", argument: { _tag: "free" } }],
+        },
+        {
+          name: "cas",
+          flags: [{ name: "id", argument: { _tag: "free" } }],
+        },
+      ],
+    });
+  });
 });
 
 describe("pty completions <shell>", () => {
diff --git a/tests/fixtures/socket-ownership-worker.mjs b/tests/fixtures/socket-ownership-worker.mjs
new file mode 100644
index 0000000..75a6543
--- /dev/null
+++ b/tests/fixtures/socket-ownership-worker.mjs
@@ -0,0 +1,5 @@
+import { parentPort } from "node:worker_threads";
+
+const until = Date.now() + 100;
+while (Date.now() < until) {}
+parentPort.postMessage({ _tag: "NotOwned" });
diff --git a/tests/help.test.ts b/tests/help.test.ts
index d9ce8da..cfb5d2d 100644
--- a/tests/help.test.ts
+++ b/tests/help.test.ts
@@ -13,7 +13,7 @@ const cliSource = fs.readFileSync(path.join(__dirname, "..", "src", "cli.ts"), "
 const COMMANDS = [
   "run", "attach", "exec", "peek", "send", "events", "list", "stats",
   "restart", "kill", "recover", "rm", "gc", "tag", "tag-multi", "emit", "rename", "metadata",
-  "up", "down", "test", "remote-serve", "evidence",
+  "up", "down", "test", "remote-serve", "readiness", "evidence",
 ];
 // Aliases that must resolve to the same help.
 const ALIASES = ["a", "ls", "remove"];
@@ -68,6 +68,20 @@ describe("pty --help — per-subcommand help", () => {
       }
     });
   }
+
+  for (const leaf of ["ownership", "cas"] as const) {
+    it(`\`pty readiness ${leaf} --help\` prints leaf-specific help and exits 0`, () => {
+      const r = spawnSync(nodeBin, [cliPath, "readiness", leaf, "--help"], {
+        encoding: "utf8",
+        timeout: 15000,
+        env: { ...process.env, PTY_ROOT_LEGACY_SILENT: "1" },
+      });
+      expect(r.status, r.stderr).toBe(0);
+      expect(r.stderr).toBe("");
+      expect(r.stdout).toMatch(new RegExp(`^Usage: pty readiness ${leaf} `));
+      expect(r.stdout).toContain("--id <stable-id>");
+    });
+  }
 });
 
 describe("pty --help — no drift", () => {
diff --git a/tests/postinstall-darwin.test.mjs b/tests/postinstall-darwin.test.mjs
new file mode 100644
index 0000000..3b5ba2b
--- /dev/null
+++ b/tests/postinstall-darwin.test.mjs
@@ -0,0 +1,78 @@
+import { afterEach, describe, expect, it } from "vitest";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { installDarwinSocketOwner } from "../scripts/postinstall.js";
+import { buildDarwinSocketOwner } from "../scripts/build-darwin-socket-owner.js";
+
+const roots = [];
+afterEach(() => {
+  for (const root of roots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
+});
+
+const makeRoot = () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "pty-darwin-helper-"));
+  roots.push(root);
+  fs.mkdirSync(path.join(root, "bin"));
+  return root;
+};
+
+describe("Darwin helper installation", () => {
+  it("uses a packaged helper without invoking a compiler", () => {
+    const root = makeRoot();
+    fs.writeFileSync(
+      path.join(root, "bin", "pty-socket-owner-darwin"),
+      "fixture",
+    );
+    let compiled = false;
+    expect(installDarwinSocketOwner({
+      platform: "darwin",
+      root,
+      run: () => { compiled = true; },
+    })).toBe("available");
+    expect(compiled).toBe(false);
+  });
+
+  it("produces one packaged universal helper for both Darwin architectures", () => {
+    const root = makeRoot();
+    fs.mkdirSync(path.join(root, "native"));
+    fs.writeFileSync(path.join(root, "native", "pty-socket-owner-darwin.c"), "fixture");
+    let invocation;
+    const output = buildDarwinSocketOwner({
+      platform: "darwin",
+      root,
+      run: (file, args) => {
+        invocation = { file, args };
+        fs.writeFileSync(args.at(-1), "universal fixture");
+        return { status: 0, stderr: "" };
+      },
+    });
+    expect(output).toBe(path.join(root, "bin", "pty-socket-owner-darwin"));
+    expect(fs.readFileSync(output, "utf8")).toBe("universal fixture");
+    expect(invocation).toMatchObject({
+      file: "cc",
+      args: expect.arrayContaining(["-arch", "arm64", "x86_64"]),
+    });
+  });
+
+  it("refuses package production that would omit the Darwin helper", () => {
+    expect(() => buildDarwinSocketOwner({
+      platform: "linux",
+      root: makeRoot(),
+    })).toThrow("must be produced on Darwin");
+  });
+
+  it("keeps installation successful when no compiler is available", () => {
+    const root = makeRoot();
+    const warnings = [];
+    expect(() => installDarwinSocketOwner({
+      platform: "darwin",
+      root,
+      run: () => ({ error: new Error("cc missing"), status: null, stderr: "" }),
+      warn: (message) => warnings.push(message),
+    })).not.toThrow();
+    expect(warnings).toEqual([
+      "[@compoundingtech/pty] Darwin socket-ownership helper unavailable: cc missing",
+    ]);
+  });
+});
diff --git a/tests/process-tree.test.ts b/tests/process-tree.test.ts
index 85c773c..9b4be4d 100644
--- a/tests/process-tree.test.ts
+++ b/tests/process-tree.test.ts
@@ -1,7 +1,10 @@
 import { describe, expect, it } from "vitest";
 import {
+  freezeDescendantProcesses,
   signalProcessIdentities,
   snapshotDescendantProcesses,
+  snapshotDescendantProcessesComplete,
+  terminateProcessGroup,
   terminateProcessIdentities,
   type ProcessIdentity,
 } from "../src/process-tree.ts";
@@ -11,6 +14,10 @@ import {
   valueOf,
   type ProcessSource,
 } from "../src/proc-table.ts";
+import {
+  startupLeaseDeadlineCause,
+  terminalStartupLeaseValue,
+} from "../src/startup-lease.ts";
 
 /** A source whose identities can change under the test, so a reused PID can be
  *  simulated without touching a real machine. */
@@ -116,4 +123,167 @@ describe("exact descendant process shutdown", () => {
     ]);
     expect(signals.every(([pid]) => pid > 0)).toBe(true);
   });
+
+  it("keeps an unreadable process table distinct from an empty tree", () => {
+    const base = sourceFromShape("10 1 10 S root");
+    const snapshot = snapshotDescendantProcessesComplete(10, {
+      source: () => ({
+        rows: () => ({ kind: "unknown", reason: "table-unreadable" }),
+        row: (pid) => base.row(pid),
+        isRunning: (pid) => base.isRunning(pid),
+        identity: (pid) => base.identity(pid),
+      }),
+    });
+    expect(snapshot).toEqual({
+      _tag: "Unavailable",
+      reason: "process-table-unreadable",
+      identities: [],
+    });
+  });
+
+  it("reports teardown-unavailable when the complete process table cannot be read", () => {
+    const base = sourceFromShape("10 1 10 S root");
+    const snapshot = snapshotDescendantProcessesComplete(10, {
+      source: () => ({
+        rows: () => ({ kind: "unknown", reason: "table-unreadable" }),
+        row: (pid) => base.row(pid),
+        isRunning: (pid) => base.isRunning(pid),
+        identity: (pid) => base.identity(pid),
+      }),
+    });
+    const cause = startupLeaseDeadlineCause(snapshot._tag === "Complete");
+    expect(cause).toBe("teardown-unavailable");
+    expect(JSON.parse(terminalStartupLeaseValue("generation", cause))).toEqual({
+      _tag: "terminal",
+      generation: "generation",
+      cause: "teardown-unavailable",
+    });
+  });
+
+  it("freezes and rescans until a fork appearing after the first snapshot is captured", () => {
+    const shapes = [
+      "10 1 10 S root\n11 10 10 S child",
+      "10 1 10 S root\n11 10 10 S child\n12 11 10 S fork",
+      "10 1 10 S root\n11 10 10 S child\n12 11 10 S fork",
+    ];
+    let read = 0;
+    const signals: Array<[number, NodeJS.Signals]> = [];
+    const snapshot = freezeDescendantProcesses(10, {
+      source: () => sourceFromShape(shapes[Math.min(read++, shapes.length - 1)]),
+      signal: (pid, signal) => { signals.push([pid, signal]); },
+    });
+    expect(snapshot).toEqual({
+      _tag: "Complete",
+      identities: [
+        { pid: 12, identity: liveIdentity("fork"), depth: 2 },
+        { pid: 11, identity: liveIdentity("child"), depth: 1 },
+      ],
+    });
+    expect(signals).toContainEqual([-10, "SIGSTOP"]);
+    expect(signals).toContainEqual([12, "SIGSTOP"]);
+  });
+
+  it("uses a verified TERM-to-KILL process-group fallback when the tree is unavailable", async () => {
+    let exists = true;
+    const signals: Array<[number, NodeJS.Signals]> = [];
+    const gone = await terminateProcessGroup(
+      10,
+
+      { termWaitMs: 0, killWaitMs: 0 },
+      {
+        signal: (pid, signal) => {
+          signals.push([pid, signal]);
+          if (signal === "SIGKILL") exists = false;
+        },
+        groupExists: () => exists,
+      },
+    );
+    expect(gone).toBe(true);
+    expect(signals).toEqual([
+      [-10, "SIGTERM"],
+      [-10, "SIGKILL"],
+    ]);
+  });
+
+  it("does not claim deadline teardown when a partial table omits a setsid descendant", () => {
+    const base = sourceFromShape(
+      "10 1 10 S root\n20 10 20 S omitted-setsid-child",
+    );
+    const partialRows = valueOf(base.rows())!.filter(({ pid }) => pid === 10);
+    const signals: Array<[number, NodeJS.Signals]> = [];
+    const snapshot = freezeDescendantProcesses(10, {
+      source: () => ({
+        rows: () => ({
+          kind: "unknown",
+          reason: "table-unreadable",
+          partial: partialRows,
+        }),
+        row: (pid) => base.row(pid),
+        isRunning: (pid) => base.isRunning(pid),
+        identity: (pid) => base.identity(pid),
+      }),
+      signal: (pid, signal) => { signals.push([pid, signal]); },
+    });
+    expect(snapshot).toMatchObject({
+      _tag: "Unavailable",
+      identities: [],
+    });
+    expect(signals.some(([pid]) => pid === 20)).toBe(false);
+    expect(startupLeaseDeadlineCause(snapshot._tag === "Complete")).toBe(
+      "teardown-unavailable",
+    );
+  });
+
+  it("preserves exact out-of-group identities from an incomplete table", async () => {
+    const base = sourceFromShape(
+      "10 1 10 S root\n20 10 20 S setsid-child",
+    );
+    const partialRows = valueOf(base.rows())!;
+    const source = (): ProcessSource => ({
+      rows: () => ({
+        kind: "unknown",
+        reason: "table-unreadable",
+        partial: partialRows,
+      }),
+      row: (pid) => base.row(pid),
+      isRunning: (pid) => base.isRunning(pid),
+      identity: (pid) => base.identity(pid),
+    });
+    const signals: Array<[number, NodeJS.Signals]> = [];
+    const snapshot = freezeDescendantProcesses(10, {
+      source,
+      signal: (pid, signal) => { signals.push([pid, signal]); },
+    });
+    expect(snapshot).toEqual({
+      _tag: "Unavailable",
+      reason: "process-table-unreadable",
+      identities: [
+        { pid: 20, identity: liveIdentity("setsid-child"), depth: 1 },
+      ],
+    });
+
+    signals.length = 0;
+    expect(startupLeaseDeadlineCause(snapshot._tag === "Complete")).toBe(
+      "teardown-unavailable",
+    );
+    await terminateProcessIdentities(
+      snapshot.identities,
+      { termWaitMs: 0, killWaitMs: 0 },
+      { source, signal: (pid, signal) => { signals.push([pid, signal]); } },
+    );
+    await terminateProcessGroup(
+      10,
+      { termWaitMs: 0, killWaitMs: 0 },
+      {
+        signal: (pid, signal) => { signals.push([pid, signal]); },
+        groupExists: () => true,
+      },
+    );
+    expect(signals).toEqual([
+      [20, "SIGTERM"],
+      [20, "SIGKILL"],
+      [-10, "SIGTERM"],
+      [-10, "SIGKILL"],
+    ]);
+  });
 });
diff --git a/tests/socket-ownership.test.ts b/tests/socket-ownership.test.ts
new file mode 100644
index 0000000..7236266
--- /dev/null
+++ b/tests/socket-ownership.test.ts
@@ -0,0 +1,183 @@
+import { afterEach, describe, expect, it } from "vitest";
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+import { sourceFromShape, type ProcessSource } from "../src/proc-table.ts";
+import {
+  encodeLinuxProcAddress,
+  inspectAcceptedSocketOwnership,
+  inspectAcceptedSocketOwnershipAsync,
+  parseLinuxTcpTable,
+} from "../src/socket-ownership.ts";
+
+const roots: string[] = [];
+afterEach(() => {
+  for (const root of roots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
+});
+
+const tuple = {
+  localAddress: "127.0.0.1",
+  localPort: 51_000,
+  remoteAddress: "127.0.0.1",
+  remotePort: 3_000,
+};
+
+const table = (inode?: number, address = "0100007F"): string => [
+  "  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode",
+  ...(inode === undefined ? [] : [
+    `   0: ${address}:0BB8 ${address}:C738 01 00000000:00000000 00:00000000 00000000 1000 0 ${inode}`,
+  ]),
+  "",
+].join("\n");
+
+const addProcess = (root: string, pid: number, inode?: number): void => {
+  const base = path.join(root, String(pid));
+  fs.mkdirSync(path.join(base, "net"), { recursive: true });
+  fs.mkdirSync(path.join(base, "fd"));
+  fs.writeFileSync(path.join(base, "net", "tcp"), table(inode));
+  if (inode !== undefined) fs.symlinkSync(`socket:[${inode}]`, path.join(base, "fd", "7"));
+};
+
+const fixture = (): { root: string; source: ProcessSource } => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "pty-socket-owner-"));
+  roots.push(root);
+  return {
+    root,
+    source: sourceFromShape("100 1 100 S root\n101 100 100 S child"),
+  };
+};
+
+describe("Linux accepted socket ownership", () => {
+  it("binds the exact reverse 4-tuple to a descendant fd", () => {
+    const { root, source } = fixture();
+    addProcess(root, 100);
+    addProcess(root, 101, 42);
+    expect(inspectAcceptedSocketOwnership(100, tuple, {
+      platform: "linux",
+      linuxProcRoot: root,
+      processSource: () => source,
+    })).toEqual({ _tag: "Owned", pid: 101 });
+  });
+
+  it("does not accept a matching decoy outside the child tree", () => {
+    const { root, source } = fixture();
+    addProcess(root, 100);
+    addProcess(root, 101);
+    addProcess(root, 999, 42);
+    expect(inspectAcceptedSocketOwnership(100, tuple, {
+      platform: "linux",
+      linuxProcRoot: root,
+      processSource: () => source,
+    })).toEqual({ _tag: "NotOwned" });
+  });
+
+  it("fails closed when any descendant socket table is unavailable", () => {
+    const { root, source } = fixture();
+    addProcess(root, 100);
+    expect(inspectAcceptedSocketOwnership(100, tuple, {
+      platform: "linux",
+      linuxProcRoot: root,
+      processSource: () => source,
+    })).toEqual({ _tag: "Unavailable", reason: "procfs-unreadable:101" });
+  });
+
+  it("rejects a partial procfs table rather than reading it as empty", () => {
+    expect(parseLinuxTcpTable("sl local_address\n0: broken")).toBeUndefined();
+  });
+
+  it("encodes procfs address words for the host byte order", () => {
+    expect(encodeLinuxProcAddress("127.0.0.1", "LE")).toBe("0100007F");
+    expect(encodeLinuxProcAddress("127.0.0.1", "BE")).toBe("7F000001");
+    expect(encodeLinuxProcAddress("2001:db8::1", "LE")).toBe(
+      "B80D0120000000000000000001000000",
+    );
+    expect(encodeLinuxProcAddress("2001:db8::1", "BE")).toBe(
+      "20010DB8000000000000000000000001",
+    );
+  });
+
+
+  it("matches a big-endian procfs tuple end to end", () => {
+    const { root, source } = fixture();
+    addProcess(root, 100);
+    addProcess(root, 101, 42);
+    fs.writeFileSync(path.join(root, "101", "net", "tcp"), table(42, "7F000001"));
+    expect(inspectAcceptedSocketOwnership(100, tuple, {
+      platform: "linux",
+      linuxProcRoot: root,
+      processSource: () => source,
+      endianness: "BE",
+    })).toEqual({ _tag: "Owned", pid: 101 });
+  });
+  it("fails closed for scoped IPv6 tuples", () => {
+    expect(inspectAcceptedSocketOwnership(100, {
+      localAddress: "fe80::1%eth0",
+      localPort: 51_000,
+      remoteAddress: "fe80::2%eth0",
+      remotePort: 3_000,
+    })).toEqual({ _tag: "Unavailable", reason: "scoped-ipv6-unavailable" });
+  });
+});
+
+describe("Darwin libproc backend", () => {
+  it("keeps helper failure distinct from NotOwned", () => {
+    const source = sourceFromShape("100 1 100 S root");
+    expect(inspectAcceptedSocketOwnership(100, tuple, {
+      platform: "darwin",
+      processSource: () => source,
+      execHelper: () => "unavailable\n",
+    })).toEqual({ _tag: "Unavailable", reason: "darwin-table-unavailable" });
+  });
+
+  it("rechecks a positive descriptor observation before returning Owned", () => {
+    const source = sourceFromShape("100 1 100 S root");
+    let observations = 0;
+    expect(inspectAcceptedSocketOwnership(100, tuple, {
+      platform: "darwin",
+      processSource: () => source,
+      execHelper: () => ++observations === 1 ? "owned 100\n" : "not-owned\n",
+    })).toEqual({ _tag: "Unavailable", reason: "socket-ownership-changed" });
+  });
+
+  it.runIf(process.platform === "darwin")(
+    "proves a real accepted loopback socket through libproc",
+    async () => {
+      const server = net.createServer();
+      await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+      const address = server.address();
+      if (!address || typeof address === "string") throw new Error("TCP listener address unavailable");
+      const accepted = new Promise<net.Socket>((resolve) => server.once("connection", resolve));
+      const client = net.createConnection(address.port, "127.0.0.1");
+      await new Promise<void>((resolve) => client.once("connect", resolve));
+      const serverSocket = await accepted;
+      try {
+        expect(inspectAcceptedSocketOwnership(process.pid, {
+          localAddress: client.localAddress!,
+          localPort: client.localPort!,
+          remoteAddress: client.remoteAddress!,
+          remotePort: client.remotePort!,
+        })).toEqual({ _tag: "Owned", pid: process.pid });
+      } finally {
+        client.destroy();
+        serverSocket.destroy();
+        await new Promise<void>((resolve) => server.close(() => resolve()));
+      }
+    },
+  );
+});
+
+describe("ownership worker isolation", () => {
+  it("does not block daemon timers while inspection is running", async () => {
+    // This is deliberately a real timer: the guarantee is that CPU-blocking
+    // inspection in another thread cannot stall the daemon event loop.
+    let timerFired = false;
+    setTimeout(() => { timerFired = true; }, 10);
+    const result = await inspectAcceptedSocketOwnershipAsync(100, tuple, {
+      workerUrl: new URL("./fixtures/socket-ownership-worker.mjs", import.meta.url),
+      timeoutMs: 1_000,
+    });
+    expect(result).toEqual({ _tag: "NotOwned" });
+    expect(timerFired).toBe(true);
+  });
+});
diff --git a/tests/startup-readiness.test.ts b/tests/startup-readiness.test.ts
new file mode 100644
index 0000000..f698806
--- /dev/null
+++ b/tests/startup-readiness.test.ts
@@ -0,0 +1,383 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { spawnSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { compareAndSetLifecycle } from "../src/client.ts";
+import {
+  compareAndSetTagValue,
+  acquireLock,
+  getSessionExitEvidence,
+  readMetadata,
+  writeMetadata,
+  releaseLock,
+  waitForProcessExit,
+} from "../src/sessions.ts";
+import { setServerModulePath, spawnDaemon } from "../src/spawn.ts";
+import { PtyServer } from "../src/server.ts";
+import { systemMonotonicClock } from "../src/startup-lease.ts";
+import { terminateAndWait } from "./setup/processes.ts";
+
+const dirname = path.dirname(fileURLToPath(import.meta.url));
+const serverModule = path.join(dirname, "..", "dist", "server.js");
+const spawnModule = path.join(dirname, "..", "dist", "spawn.js");
+setServerModulePath(serverModule);
+
+const roots: string[] = [];
+const daemonPids: number[] = [];
+afterEach(async () => {
+  await terminateAndWait(daemonPids.splice(0));
+  for (const root of roots.splice(0)) fs.rmSync(root, { recursive: true, force: true });
+  delete process.env.PTY_ROOT;
+});
+
+const makeRoot = (): string => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "pty-startup-lease-"));
+  roots.push(root);
+  process.env.PTY_ROOT = root;
+  return root;
+};
+
+// These integration cases exercise the real cross-process monotonic clock and
+// daemon timer; fake timers cannot advance the detached daemon.
+const waitFor = async <TValue>(read: () => TValue | undefined, timeoutMs = 5_000): Promise<TValue> => {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const value = read();
+    if (value !== undefined) return value;
+    await new Promise<void>((resolve) => setTimeout(resolve, 20));
+  }
+  throw new Error("timed out waiting for startup lease state");
+};
+
+const waitForAsync = async <TValue>(
+  read: () => Promise<TValue | undefined>,
+  timeoutMs = 5_000,
+): Promise<TValue> => {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const value = await read();
+    if (value !== undefined) return value;
+    await new Promise<void>((resolve) => setTimeout(resolve, 20));
+  }
+  throw new Error("timed out waiting for startup lease state");
+};
+
+const terminalLifecycle = (name: string): { _tag: string; generation: string; cause: string } | undefined => {
+  const raw = readMetadata(name)?.tags?.["run.lifecycle"];
+  if (!raw) return undefined;
+  const value = JSON.parse(raw) as { _tag?: string; generation?: string; cause?: string };
+  return value._tag === "terminal" && value.generation && value.cause
+    ? { _tag: value._tag, generation: value.generation, cause: value.cause }
+    : undefined;
+};
+
+describe("generation-fenced lifecycle CAS", () => {
+  it("cannot let a stale generation overwrite its replacement", () => {
+    makeRoot();
+    writeMetadata("worker", {
+      generation: "replacement",
+      command: "/bin/sh",
+      args: [],
+      displayCommand: "sh",
+      cwd: os.tmpdir(),
+      createdAt: new Date().toISOString(),
+      tags: { "run.lifecycle": "starting-new" },
+    });
+    expect(compareAndSetTagValue(
+      "worker",
+      "stale",
+      "run.lifecycle",
+      "starting-old",
+      "ready-old",
+    )).toEqual({ status: "generation-mismatch" });
+    expect(readMetadata("worker")?.tags?.["run.lifecycle"]).toBe("starting-new");
+  });
+
+  it("returns the persisted teardown-unavailable value for an expired CAS", () => {
+    makeRoot();
+    const name = "expired-cas-containment";
+    const generation = "generation";
+    const starting = JSON.stringify({
+      _tag: "starting",
+      generation,
+      bootId: "boot",
+      deadlineMonotonicNs: "0",
+    });
+    const terminal = JSON.stringify({
+      _tag: "terminal",
+      generation,
+      cause: "teardown-unavailable",
+    });
+    writeMetadata(name, {
+      generation,
+      command: "/bin/sh",
+      args: [],
+      displayCommand: "sh",
+      cwd: os.tmpdir(),
+      createdAt: new Date().toISOString(),
+      tags: { "run.lifecycle": starting },
+    });
+
+    const harness = Object.create(PtyServer.prototype) as Record<string, unknown>;
+    Object.assign(harness, {
+      name,
+      generation,
+      exited: false,
+      startupLease: {
+        generation,
+        lifecycleTag: "run.lifecycle",
+        bootId: "boot",
+        deadlineMonotonicNs: "0",
+        startingValue: starting,
+      },
+      startupLeaseDisarmed: false,
+      startupLeaseTerminalCause: null,
+      startupLeaseDeadlineNotified: false,
+      startupLeaseTerminalValue: null,
+      startupLeaseTimer: null,
+      options: {},
+      settleStartupLeaseDeadline: () => {
+        compareAndSetTagValue(
+          name,
+          generation,
+          "run.lifecycle",
+          starting,
+          terminal,
+        );
+        return terminal;
+      },
+    });
+    const compare = Reflect.get(
+      PtyServer.prototype,
+      "compareAndSetLifecycle",
+    );
+    if (typeof compare !== "function") throw new Error("lifecycle CAS unavailable");
+    const result = Reflect.apply(compare, harness, [{
+      expectedGeneration: generation,
+      tag: "run.lifecycle",
+      expectedValue: starting,
+      value: JSON.stringify({ _tag: "ready", generation }),
+    }]);
+    expect(result).toEqual({ _tag: "DeadlineExpired", value: terminal });
+    expect(readMetadata(name)?.tags?.["run.lifecycle"]).toBe(terminal);
+  });
+
+  it("shuts down after an expired CAS flushes even when persistence is delayed past the backstop", async () => {
+    makeRoot();
+    const name = "expired-cas-wire";
+    const generation = "wire-generation";
+    const shutdown: { current: Promise<void> | null } = { current: null };
+    let server!: PtyServer;
+    server = new PtyServer({
+      name,
+      generation,
+      command: "/bin/sh",
+      args: ["-c", "sleep 30"],
+      displayCommand: "sleep 30",
+      cwd: os.tmpdir(),
+      rows: 24,
+      cols: 80,
+      startupLease: { timeoutMs: 30_000, lifecycleTag: "run.lifecycle" },
+      onStartupLeaseDeadline: () => {
+        shutdown.current = server.close({ terminateDescendants: true });
+      },
+    });
+    await server.ready;
+    const metadata = readMetadata(name)!;
+    expect(acquireLock(name)).toBe(true);
+    const lockReleased = new Promise<void>((resolve) => {
+      setTimeout(() => {
+        releaseLock(name);
+        resolve();
+      }, 2_200);
+    });
+    const starting = metadata.tags!["run.lifecycle"];
+    const originalNow = systemMonotonicClock.nowNs;
+    systemMonotonicClock.nowNs = () =>
+      BigInt(JSON.parse(starting).deadlineMonotonicNs);
+    try {
+      const result = await compareAndSetLifecycle(name, {
+        expectedGeneration: generation,
+        tag: "run.lifecycle",
+        expectedValue: starting,
+        value: JSON.stringify({ _tag: "ready", generation }),
+      });
+      expect(result).toEqual({ _tag: "DeadlineExpired", value: starting });
+      await lockReleased;
+      await waitFor(() => shutdown.current === null ? undefined : true);
+      expect(JSON.parse(readMetadata(name)!.tags!["run.lifecycle"])).toMatchObject({
+        _tag: "terminal",
+        generation,
+        cause: "deadline",
+      });
+    } finally {
+      systemMonotonicClock.nowNs = originalNow;
+      releaseLock(name);
+      await new Promise<void>((resolve) => setImmediate(resolve));
+      if (shutdown.current) await shutdown.current;
+      else await server.close({ terminateDescendants: true });
+    }
+  }, 15_000);
+
+  it("disarms only through the live current-generation CAS", async () => {
+    makeRoot();
+    const name = "lease-ready";
+    await spawnDaemon({
+      name,
+      command: "/bin/sh",
+      args: ["-c", "sleep 30"],
+      displayCommand: "sleep 30",
+      startupLease: { timeoutMs: 600, lifecycleTag: "run.lifecycle" },
+    });
+    const metadata = readMetadata(name)!;
+    daemonPids.push(metadata.daemonPid!);
+    const starting = metadata.tags!["run.lifecycle"];
+    const ready = JSON.stringify({ _tag: "ready", generation: metadata.generation });
+    await expect(compareAndSetLifecycle(name, {
+      expectedGeneration: "stale",
+      tag: "run.lifecycle",
+      expectedValue: starting,
+      value: ready,
+    })).resolves.toEqual({ _tag: "GenerationMismatch" });
+    await expect(compareAndSetLifecycle(name, {
+      expectedGeneration: metadata.generation!,
+      tag: "run.lifecycle",
+      expectedValue: starting,
+      value: ready,
+    })).resolves.toEqual({ _tag: "Changed", value: ready });
+    await waitFor(() =>
+      process.hrtime.bigint() >= BigInt(JSON.parse(starting).deadlineMonotonicNs) + 100_000_000n
+        ? true
+        : undefined
+    );
+    expect(readMetadata(name)?.tags?.["run.lifecycle"]).toBe(ready);
+    const terminalDown = JSON.stringify({
+      _tag: "terminal",
+      generation: metadata.generation,
+      cause: "down",
+    });
+    await expect(compareAndSetLifecycle(name, {
+      expectedGeneration: metadata.generation!,
+      tag: "run.lifecycle",
+      expectedValue: ready,
+      value: terminalDown,
+    })).resolves.toEqual({ _tag: "Changed", value: terminalDown });
+    await terminateAndWait([metadata.daemonPid!]);
+    expect(readMetadata(name)?.tags?.["run.lifecycle"]).toBe(terminalDown);
+  }, 15_000);
+});
+
+  it("publishes prototype-named lifecycle tags and retains terminal CAS through natural exit", async () => {
+    makeRoot();
+    const name = "lease-prototype-tag";
+    await spawnDaemon({
+      name,
+      command: "/bin/sh",
+      args: ["-c", "sleep 0.5"],
+      displayCommand: "short startup",
+      startupLease: { timeoutMs: 5_000, lifecycleTag: "__proto__" },
+    });
+    const metadata = readMetadata(name)!;
+    daemonPids.push(metadata.daemonPid!);
+    expect(Object.hasOwn(metadata.tags!, "__proto__")).toBe(true);
+    const starting = metadata.tags!["__proto__"];
+    const terminal = JSON.stringify({
+      _tag: "terminal",
+      generation: metadata.generation,
+      cause: "down",
+    });
+    await expect(compareAndSetLifecycle(name, {
+      expectedGeneration: metadata.generation!,
+      tag: "__proto__",
+      expectedValue: starting,
+      value: terminal,
+    })).resolves.toEqual({ _tag: "Changed", value: terminal });
+    expect(await waitForProcessExit(metadata.daemonPid!, 5_000)).toBe(true);
+    expect(readMetadata(name)?.tags?.["__proto__"]).toBe(terminal);
+  }, 15_000);
+
+describe("daemon-owned startup deadline", () => {
+  it("terminates the exact generation and retains terminal evidence", async () => {
+    makeRoot();
+    const name = "lease-deadline";
+    await spawnDaemon({
+      name,
+      command: "/bin/sh",
+      args: ["-c", "trap '' HUP TERM; sleep 30 & wait"],
+      displayCommand: "stubborn startup",
+      startupLease: { timeoutMs: 300, lifecycleTag: "run.lifecycle" },
+    });
+    const metadata = readMetadata(name)!;
+    daemonPids.push(metadata.daemonPid!);
+    const terminal = await waitFor(() => terminalLifecycle(name));
+    expect(terminal).toEqual({
+      _tag: "terminal",
+      generation: metadata.generation,
+      cause: "deadline",
+    });
+    const evidence = await waitForAsync(async () => {
+      const result = await getSessionExitEvidence(name);
+      return result._tag === "snapshot" ? result : undefined;
+    });
+    expect(evidence._tag).toBe("snapshot");
+  }, 15_000);
+
+  it("retains terminal exit lifecycle and evidence after natural child exit", async () => {
+    makeRoot();
+    const name = "lease-natural-exit";
+    await spawnDaemon({
+      name,
+      command: "/bin/sh",
+      args: ["-c", "sleep 0.4; exit 7"],
+      displayCommand: "natural exit",
+      startupLease: { timeoutMs: 5_000, lifecycleTag: "run.lifecycle" },
+    });
+    const metadata = readMetadata(name)!;
+    daemonPids.push(metadata.daemonPid!);
+    expect(await waitForProcessExit(metadata.daemonPid!, 5_000)).toBe(true);
+    expect(terminalLifecycle(name)).toEqual({
+      _tag: "terminal",
+      generation: metadata.generation,
+      cause: "exit",
+    });
+    await expect(getSessionExitEvidence(name)).resolves.toMatchObject({
+      _tag: "snapshot",
+      snapshot: {
+        generation: metadata.generation,
+        exitCode: 7,
+      },
+    });
+  }, 15_000);
+
+  it("survives the initiating caller and enforces the original deadline", async () => {
+    const root = makeRoot();
+    const name = "lease-caller-crash";
+    const script = `
+      import { setServerModulePath, spawnDaemon } from ${JSON.stringify(pathToFileURL(spawnModule).href)};
+      setServerModulePath(${JSON.stringify(serverModule)});
+      await spawnDaemon({
+        name: ${JSON.stringify(name)},
+        command: "/bin/sh",
+        args: ["-c", "trap '' HUP TERM; sleep 30 & wait"],
+        displayCommand: "caller crash fixture",
+        startupLease: { timeoutMs: 700, lifecycleTag: "run.lifecycle" },
+      });
+    `;
+    const caller = spawnSync(process.execPath, ["--input-type=module", "-e", script], {
+      env: { ...process.env, PTY_ROOT: root },
+      encoding: "utf8",
+      timeout: 5_000,
+    });
+    expect(caller.status, caller.stderr).toBe(0);
+    const metadata = readMetadata(name)!;
+    daemonPids.push(metadata.daemonPid!);
+    expect(terminalLifecycle(name)).toBeUndefined();
+    expect(await waitFor(() => terminalLifecycle(name))).toEqual({
+      _tag: "terminal",
+      generation: metadata.generation,
+      cause: "deadline",
+    });
+  }, 15_000);
+});