[Mjones13]

The packaged helper runs detached during normal Install. Killing the recorded app while helper custody is unresolved can trigger an unintended relaunch. Add the normal-Install refusal exercise with required native app/helper capture and closure hooks; unknown effects retain the app and fixture evidence.

Fixture cleanup now participates in that custody. withNativeFixtureScratch supplies (root, ownership), where NativeFixtureOwnership extends the existing FixtureOwnership and guards its cleanup with root-bound custody holds. The Install entry points require that same owner. Holds begin before raw spawn/observation and release only after helper closure, child close, complete native settlement, stable input checks and bridge closure. SIGTERM acceptance alone never permits cleanup. Errors, including bridge errors and replacement outer-finally errors, preserve the root and causal evidence; pre-Install app-closure failures also retain custody.

The prepared-intent binder has an explicit pre-effect-refused outcome that consumes the completed journal, fault plan/receipt, protocol-3 preparation/activation requests and selected attempt. Completed-refusal validation follows the continuation’s preparation protocol independently of fault instrumentation: direct-intent plans must also supply genuine protocol-3 records, while supported protocol-2 preparation remains compatible. Its default interrupted-state behavior remains strict. Deferred relaunch observation is admitted only at before-pair, where the helper proves its recorded processes stopped and captures the database/settings/profile baseline it compares immediately before reopen.

Validation:

• Final serial affected union: 62 passed, 0 skipped across packaged-desktop-helper-fault.node-test.mjs, packaged-desktop-pair.node-test.mjs, native-fixture-support.node-test.mjs and native-startup-fixture.node-test.mjs, on the verified real Node 24.22.1 executable.
• Failing-before integration evidence at reviewed head 8dd7c8087ab52ff3c6b34ad4afe18d3a8f59e8e5: fault timeout reached recursive scratch removal while captured Node app/helper controls were alive. Passing-after cases cover fault/helper timeouts, stop accepted without close proof, pre-Install close timeout, failed/incomplete settlement, bridge failure and proved closure. Every test reaps its helper before its app, verifies group absence and removes only its exact root.
• P2 failing-before evidence at 32d1496f09483cb5dd11f6e9ee82c4b0c39c54f0: direct-intent instrumentation accepted a protocol-3 continuation with a missing preparation request. Passing-after regressions reject missing preparation/activation/attempt records, invalid claim hashes and process birth proofs, altered activation/attempt relations, and later mutation. Valid direct-intent protocol-2/protocol-3 combinations pass; deferred protocol-2 preparation remains refused. The Install observer already separately rejected null preparation; this binder finding is not a premature-app-termination claim.
• Shared ownership regressions retain scratch through swallowed errors and replacement finally errors; a different owner cannot acquire custody for the root.
• scripts/jones/check-boundary.ts --strict: zero violations; existing 12 source-bound unsupported import dispositions retained. Used the lockfile's TypeScript 6.0.3 parser through a temporary external resolver.
• Changed JavaScript passes the lockfile's oxfmt 0.74.0 check; git diff --check passes.

This changes existing harness/test files only. No production app, server, UI, provider, installer, signing, shared boundary fragment or competing PR surface changed. Original base: 49088776d25f5cdf5e55d0eb44590e4959bd40fb. The P1 cleanup repair 32d1496f09483cb5dd11f6e9ee82c4b0c39c54f0 is preserved. P2 repair e1026220e8fe67a682fe48e8f355a708f87ae615 preserves the P1 repair. Independent focused correctness re-review at that final head resolved both selected findings, with no remaining findings in the affected scope. The original P1/blocking and P2/nonblocking severity and source bindings remain preserved.

Native limits: this PR upstreams the passed MAC-A1 storage-row prototype and adds source support; this work executed no macOS app or real relaunch. Reserve, exit-wait, post-swap rollback, interrupted startup, LaunchServices custody and unlocked visual acceptance remain separate native rows/gates. No live-profile byte-identity claim. The repository-wide Node 26.12.1 toolchain/build was not installed or run. The root thread owns current-head CI watch, independent review and any qualifying merge; this implementation child does not merge or watch.

Implemented by gpt-6.1-sol (high reasoning, default tier, no Fast), through the Jones Code Codex harness, as a prompt-only implementation sub-agent. No enforced-profile claim.