diff --git a/Dockerfile b/Dockerfile
index 546463e83..636e33387 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.7
-ARG NODE_IMAGE=node:22-alpine
+ARG NODE_IMAGE=node:20.20.2-alpine
 FROM ${NODE_IMAGE} AS base
 WORKDIR /app
 
@@ -7,9 +7,9 @@ FROM base AS builder
 
 RUN apk --no-cache upgrade && apk --no-cache add python3 make g++ linux-headers
 
-COPY package.json ./
+COPY package.json package-lock.json ./
 RUN --mount=type=cache,target=/root/.npm \
-  npm install
+  npm ci
 
 COPY . ./
 ENV NEXT_TELEMETRY_DISABLED=1
diff --git a/cli/cli.js b/cli/cli.js
index 140df2939..e341e6980 100755
--- a/cli/cli.js
+++ b/cli/cli.js
@@ -4,7 +4,16 @@ const { spawn, exec, execSync } = require("child_process");
 const path = require("path");
 const fs = require("fs");
 const https = require("https");
+const http = require("http");
+const crypto = require("crypto");
 const os = require("os");
+const { stopMitmViaManagerSync } = require("./src/cli/mitmManagerStop");
+const { getAppDataDir, getGlobalMitmStateDir } = require("./src/cli/appDataDir");
+
+// Resolve once before any worker changes cwd. Every CLI helper and the Next
+// worker inherit the same absolute path, so database, PID, CA, and auth-token
+// state cannot split across process working directories.
+process.env.DATA_DIR = getAppDataDir();
 
 // Native spinner - no external dependency
 function createSpinner(text) {
@@ -85,7 +94,6 @@ if (hasFlag("--version", "-v")) {
 
 const { ensureSqliteRuntime, buildEnvWithRuntime } = require("./hooks/sqliteRuntime");
 const { ensureTrayRuntime } = require("./hooks/trayRuntime");
-const { cleanupMitmHostsFile } = require("./hooks/cleanupMitmHosts");
 
 
 // Self-heal SQLite runtime deps (sql.js + better-sqlite3) into ~/.9router/runtime
@@ -164,13 +172,6 @@ function compareVersions(a, b) {
   return 0;
 }
 
-// Get app data dir (matches app/src/lib/dataDir.js convention)
-function getAppDataDir() {
-  return process.platform === "win32"
-    ? path.join(process.env.APPDATA || "", "9router")
-    : path.join(os.homedir(), ".9router");
-}
-
 // Kill PID from file (best-effort, removes file after)
 function killByPidFile(pidFile) {
   try {
@@ -227,11 +228,14 @@ function killCloudflaredByAppPort(appPort) {
 
 // Kill all 9router processes
 function killAllAppProcesses(appPort) {
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     try {
-      cleanupMitmHostsFile();
-      // Kill MIT first (privileged process, needs special handling)
-      killProxyByPidFile();
+      const mitmPidFile = path.join(getAppDataDir(), "mitm", ".mitm.pid");
+      const managerStopped = stopMitmViaManagerSync(appPort);
+      if (!managerStopped && fs.existsSync(mitmPidFile)) {
+        reject(new Error("MITM manager cleanup could not be confirmed; refusing to orphan system redirect state"));
+        return;
+      }
       // Kill Headroom proxy by PID file — detached process that outlives the main server.
       // Must stop before npm rename; it holds a handle on the app/ directory on Windows (#2265).
       killByPidFile(path.join(getAppDataDir(), "headroom", "proxy.pid"));
@@ -331,48 +335,6 @@ function sleepSync(ms) {
   try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms); } catch { /* ignore */ }
 }
 
-// Wait until process dies or timeout reached
-function waitForExit(pid, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    try { process.kill(pid, 0); } catch { return true; }
-    sleepSync(100);
-  }
-  return false;
-}
-
-// Kill MIT server by PID file (runs privileged, needs special handling)
-// Sends SIGTERM first so MIT can clean up host entries before dying.
-function killProxyByPidFile() {
-  try {
-    const pidFile = path.join(getAppDataDir(), "mitm", ".mitm.pid");
-    if (!fs.existsSync(pidFile)) return;
-    const pid = parseInt(fs.readFileSync(pidFile, "utf8").trim(), 10);
-    if (!pid) return;
-
-    if (process.platform === "win32") {
-      // Graceful first (lets server cleanup hosts), then force
-      try { execSync(`taskkill /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 2000 }); } catch { }
-      if (!waitForExit(pid, 1500)) {
-        try { execSync(`taskkill /F /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch { }
-      }
-      // Last-resort: PowerShell Stop-Process (sometimes succeeds where taskkill fails on admin processes)
-      if (!waitForExit(pid, 500)) {
-        try { execSync(`powershell -NonInteractive -WindowStyle Hidden -Command "Stop-Process -Id ${pid} -Force"`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch { }
-      }
-    } else {
-      // SIGTERM via cached sudo token first
-      try { execSync(`sudo -n kill -TERM ${pid} 2>/dev/null`, { stdio: "ignore", timeout: 2000 }); }
-      catch { try { process.kill(pid, "SIGTERM"); } catch { } }
-      if (!waitForExit(pid, 1500)) {
-        try { execSync(`sudo -n kill -9 ${pid} 2>/dev/null`, { stdio: "ignore", timeout: 2000 }); }
-        catch { try { process.kill(pid, "SIGKILL"); } catch { } }
-      }
-    }
-    try { fs.unlinkSync(pidFile); } catch { }
-  } catch { }
-}
-
 // Kill any process on specific port
 function killProcessOnPort(port) {
   return new Promise((resolve) => {
@@ -506,13 +468,100 @@ function openBrowser(url) {
   });
 }
 
-// Find standalone server (bundled in bin/app for published package).
-// Prefer custom-server.js (injects real socket IP) when present.
+// The owner-aware wrapper is mandatory: starting the bare Next server would
+// bypass real-peer, anti-spoofing, and privileged-control proof checks.
 const standaloneDir = path.join(__dirname, "app");
 const customServerPath = path.join(standaloneDir, "custom-server.js");
-const serverPath = fs.existsSync(customServerPath)
-  ? customServerPath
-  : path.join(standaloneDir, "server.js");
+if (!fs.existsSync(customServerPath)) {
+  console.error("Error: owner-aware custom-server.js is missing. Reinstall DurinDoor.");
+  process.exit(1);
+}
+const serverPath = customServerPath;
+const { INTENTIONAL_HANDOFF_EXIT_CODE } = require(
+  path.join(standaloneDir, "src", "shared", "constants", "processExitCodes.js"),
+);
+const { isIntentionalWorkerHandoff } = require("./src/cli/workerExit");
+
+function hasStaleMitmOwnership() {
+  const mitmDir = path.join(getAppDataDir(), "mitm");
+  return fs.existsSync(path.join(mitmDir, ".mitm.pid"))
+    || fs.existsSync(path.join(getGlobalMitmStateDir(), "redirect.json"));
+}
+
+function waitForWorkerIdentity(child, expectedNonce, timeoutMs = 30000) {
+  const deadline = Date.now() + timeoutMs;
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      child.removeListener("exit", onExit);
+      if (error) reject(error); else resolve();
+    };
+    const onExit = (code) => finish(new Error(`Recovery worker exited before readiness (code ${code})`));
+    child.once("exit", onExit);
+    const attempt = () => {
+      if (settled) return;
+      const req = http.request({
+        hostname: "127.0.0.1",
+        port,
+        path: "/api/health",
+        method: "GET",
+        timeout: 1000,
+      }, (res) => {
+        const matches = res.statusCode >= 200
+          && res.statusCode < 300
+          && res.headers["x-durindoor-worker-nonce"] === expectedNonce;
+        res.resume();
+        res.on("end", () => {
+          if (matches) finish();
+          else if (Date.now() >= deadline) finish(new Error("Recovery worker identity could not be verified"));
+          else setTimeout(attempt, 250);
+        });
+      });
+      req.on("timeout", () => req.destroy());
+      req.on("error", () => {
+        if (Date.now() >= deadline) finish(new Error("Recovery worker did not become ready"));
+        else setTimeout(attempt, 250);
+      });
+      req.end();
+    };
+    attempt();
+  });
+}
+
+async function recoverStaleMitmOwnershipBeforeStartup() {
+  if (!hasStaleMitmOwnership()) return;
+  if (stopMitmViaManagerSync(port, { preserveDesiredState: true })) return;
+
+  const nonce = crypto.randomBytes(24).toString("hex");
+  const child = spawn(RUNTIME, ["--max-old-space-size=6144", serverPath], {
+    cwd: standaloneDir,
+    // A recovery worker may intentionally outlive this CLI after a failed
+    // cleanup. Ignore inherited output so no referenced/fillable pipe can keep
+    // the parent alive or stall that retained worker.
+    stdio: "ignore",
+    detached: true,
+    windowsHide: true,
+    env: {
+      ...buildEnvWithRuntime(process.env),
+      PORT: port.toString(),
+      HOSTNAME: "127.0.0.1",
+      DURINDOOR_WORKER_NONCE: nonce,
+    },
+  });
+  try {
+    await waitForWorkerIdentity(child, nonce);
+    if (!stopMitmViaManagerSync(port, { preserveDesiredState: true })) {
+      throw new Error("Recovery worker could not clean stale MITM ownership");
+    }
+    try { process.kill(child.pid, "SIGTERM"); } catch { /* already stopped */ }
+    try { process.kill(-child.pid, "SIGKILL"); } catch { /* platform/process-group fallback */ }
+  } catch (error) {
+    child.unref();
+    throw new Error(`${error.message}; recovery worker was retained for a safe cleanup retry`);
+  }
+}
 
 if (!fs.existsSync(serverPath)) {
   console.error("Error: Standalone build not found.");
@@ -521,12 +570,16 @@ if (!fs.existsSync(serverPath)) {
 }
 
 // Check for updates FIRST, then start server
-checkForUpdate().then((latestVersion) => {
-  killAllAppProcesses(port).then(() => {
+checkForUpdate().then(async (latestVersion) => {
+  await recoverStaleMitmOwnershipBeforeStartup();
+  return killAllAppProcesses(port).then(() => {
     return killProcessOnPort(port);
   }).then(() => {
     startServer(latestVersion);
   });
+}).catch((error) => {
+  console.error(`Startup cleanup failed: ${error.message}`);
+  process.exitCode = 1;
 });
 
 // Show interface selection menu
@@ -588,11 +641,12 @@ function startServer(latestVersion) {
 
   let restartCount = 0;
   let serverStartTime = Date.now();
+  let recoveryInProgress = false;
 
   const CRASH_LOG_LINES = 50;
   let crashLog = [];
 
-  function spawnServer() {
+  function spawnServer(extraEnv = {}) {
     serverStartTime = Date.now();
     crashLog = [];
     const child = spawn(RUNTIME, ["--max-old-space-size=6144", serverPath], {
@@ -603,7 +657,8 @@ function startServer(latestVersion) {
       env: {
         ...buildEnvWithRuntime(process.env),
         PORT: port.toString(),
-        HOSTNAME: host
+        HOSTNAME: host,
+        ...extraEnv,
       }
     });
     if (!showLog && child.stderr) {
@@ -621,20 +676,21 @@ function startServer(latestVersion) {
   // Cleanup function - force kill server process
   let isCleaningUp = false;
   function cleanup() {
-    if (isCleaningUp) return;
+    if (isCleaningUp) return false;
     isCleaningUp = true;
     try {
-      // Parent CLI must clean hosts — Next.js child is SIGKILL'd below and
-      // never runs initializeApp's removeAllDNSEntriesSync().
-      cleanupMitmHostsFile();
+      const mitmStopped = stopMitmViaManagerSync(port);
+      if (!mitmStopped) {
+        console.error("MITM manager cleanup could not be confirmed; leaving the app worker alive to preserve system redirect ownership.");
+        isCleaningUp = false;
+        return false;
+      }
 
       // Kill tray if running
       try {
         const { killTray } = require("./src/cli/tray/tray");
         killTray();
       } catch (e) { }
-      // Kill MIT server (privileged process) via PID file
-      killProxyByPidFile();
       // Kill Headroom proxy (detached process, holds handle on app/ on Windows)
       killByPidFile(path.join(getAppDataDir(), "headroom", "proxy.pid"));
       // Kill cloudflared/tailscale via PID file (only this app's tunnel)
@@ -652,7 +708,21 @@ function startServer(latestVersion) {
       if (server?.pid) {
         try { process.kill(-server.pid, "SIGKILL"); } catch (e) { }
       }
-    } catch (e) { }
+      return true;
+    } catch (error) {
+      console.error(`Cleanup failed: ${error.message}`);
+      isCleaningUp = false;
+      return false;
+    }
+  }
+
+  function exitAfterCleanup(code = 0, delayMs = 100) {
+    if (!cleanup()) {
+      isShuttingDown = false;
+      return false;
+    }
+    setTimeout(() => process.exit(code), delayMs);
+    return true;
   }
 
   // Suppress all errors during shutdown (systray lib throws JSON parse errors)
@@ -667,20 +737,17 @@ function startServer(latestVersion) {
     if (isShuttingDown) return;
     isShuttingDown = true;
     console.log("\nExiting...");
-    cleanup();
-    setTimeout(() => process.exit(0), 100);
+    exitAfterCleanup(0);
   });
   process.on("SIGTERM", () => {
     if (isShuttingDown) return;
     isShuttingDown = true;
-    cleanup();
-    setTimeout(() => process.exit(0), 100);
+    exitAfterCleanup(0);
   });
   process.on("SIGHUP", () => {
     if (isShuttingDown) return;
     isShuttingDown = true;
-    cleanup();
-    setTimeout(() => process.exit(0), 100);
+    exitAfterCleanup(0);
   });
 
   // Initialize tray icon (runs alongside TUI)
@@ -692,8 +759,7 @@ function startServer(latestVersion) {
         onQuit: () => {
           isShuttingDown = true;
           console.log("\n👋 Shutting down from tray...");
-          cleanup();
-          setTimeout(() => process.exit(0), 100);
+          exitAfterCleanup(0);
         },
         onOpenDashboard: () => openBrowser(url)
       });
@@ -722,6 +788,7 @@ function startServer(latestVersion) {
 
   // Wait for server to be ready, then show interface menu loop + tray
   setTimeout(async () => {
+    if (recoveryInProgress) return;
     // Start tray icon alongside TUI
     initTrayIcon();
 
@@ -736,7 +803,10 @@ function startServer(latestVersion) {
           console.log(`\n⬆  Update v${pkg.version} → v${latestVersion}\n`);
           console.log(`Run this after exit:\n`);
           console.log(`   \x1b[33m${INSTALL_CMD_LATEST}\x1b[0m\n`);
-          cleanup();
+          if (!cleanup()) {
+            isShuttingDown = false;
+            continue;
+          }
           await killAllAppProcesses(port);
           await killProcessOnPort(port);
           setTimeout(() => process.exit(0), 200);
@@ -776,6 +846,14 @@ function startServer(latestVersion) {
             return;
           }
 
+          // Stop the current worker before creating its replacement. If MITM
+          // ownership cleanup cannot be confirmed, do not fork and orphan it.
+          isShuttingDown = true;
+          if (!cleanup()) {
+            isShuttingDown = false;
+            continue;
+          }
+
           // Windows/Linux: spawn detached bgProcess (systray works fine in child)
           console.log(`\n⏳ Starting background process... (tray icon will appear in ~3s)`);
 
@@ -791,36 +869,49 @@ function startServer(latestVersion) {
           console.log(`   Server: http://${displayHost}:${port}`);
           console.log(`\n💡 You can close this terminal. Right-click tray icon to quit.\n`);
 
-          // cleanup() kills server so bgProcess can claim the port fresh
-          cleanup();
           process.exit(0);
         } else if (choice === "exit") {
           isShuttingDown = true;
           console.log("\nExiting...");
-          cleanup();
-          setTimeout(() => process.exit(0), 100);
+          exitAfterCleanup(0);
         }
       }
     } catch (err) {
       console.error("Error:", err.message);
-      cleanup();
-      process.exit(1);
+      isShuttingDown = true;
+      exitAfterCleanup(1, 0);
     }
   }, 3000);
 
   function attachServerEvents() {
     server.on("error", (err) => {
       console.error("Failed to start server:", err.message);
+      if (recoveryInProgress) return;
       if (!isShuttingDown) tryRestart();
-      else { cleanup(); process.exit(1); }
+      else if (cleanup()) process.exit(1);
     });
 
     server.on("close", (code) => {
-      if (isShuttingDown || code === 0) {
+      if (recoveryInProgress) return;
+      if (isIntentionalWorkerHandoff(
+        code,
+        INTENTIONAL_HANDOFF_EXIT_CODE,
+        hasStaleMitmOwnership(),
+      )) {
+        isShuttingDown = true;
+        process.exit(0);
+        return;
+      }
+      if (isShuttingDown) {
         process.exit(code || 0);
         return;
       }
-      tryRestart(code);
+      if (code === INTENTIONAL_HANDOFF_EXIT_CODE) {
+        console.error("Intentional worker handoff was rejected because MITM ownership state remains.");
+      }
+      // A clean Next.js exit is still unexpected at the CLI layer. Restart so
+      // the manager can re-adopt or explicitly clean any active MITM state.
+      tryRestart(code || 1);
     });
   }
 
@@ -830,18 +921,9 @@ function startServer(latestVersion) {
     if (aliveMs >= RESTART_RESET_MS) restartCount = 0;
 
     if (restartCount >= MAX_RESTARTS) {
-      console.error(`\n⚠️  Server crashed ${MAX_RESTARTS} times. Disabling MIT and restarting...`);
-      try {
-        const dbPath = path.join(os.homedir(), process.platform === "win32" ? path.join("AppData", "Roaming", "9router", "db.json") : path.join(".9router", "db.json"));
-        if (fs.existsSync(dbPath)) {
-          const db = JSON.parse(fs.readFileSync(dbPath, "utf-8"));
-          if (db.settings) db.settings.mitmEnabled = false;
-          fs.writeFileSync(dbPath, JSON.stringify(db, null, 2));
-        }
-      } catch { /* best effort */ }
-      restartCount = 0;
-      server = spawnServer();
-      attachServerEvents();
+      console.error(`\n⚠️  Server crashed ${MAX_RESTARTS} times. Starting one recovery worker to clean MITM system state...`);
+      recoveryInProgress = true;
+      void recoverAfterRestartExhaustion();
       return;
     }
 
@@ -860,5 +942,32 @@ function startServer(latestVersion) {
     }, delay);
   }
 
+  async function recoverAfterRestartExhaustion() {
+    try {
+      const nonce = crypto.randomBytes(24).toString("hex");
+      server = spawnServer({ DURINDOOR_WORKER_NONCE: nonce });
+      attachServerEvents();
+      await waitForWorkerIdentity(server, nonce);
+      if (!stopMitmViaManagerSync(port, { preserveDesiredState: false })) {
+        throw new Error("MITM manager cleanup could not be confirmed on the recovery worker");
+      }
+      console.error("MITM system state was cleaned and disabled; exiting instead of continuing the crash loop.");
+      isShuttingDown = true;
+      if (!cleanup()) {
+        isShuttingDown = false;
+        throw new Error("Recovery worker shutdown cleanup could not be confirmed");
+      }
+      process.exit(1);
+    } catch (error) {
+      // Keep a live recovery worker when possible; it retains ownership and
+      // gives the operator a safe surface from which to retry cleanup.
+      console.error(`Recovery cleanup failed: ${error.message}`);
+      if (server?.exitCode != null || server?.signalCode != null) {
+        recoveryInProgress = false;
+      }
+      isShuttingDown = false;
+    }
+  }
+
   attachServerEvents();
 }
diff --git a/cli/package.json b/cli/package.json
index c065852da..7bd672bcd 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -3,7 +3,6 @@
   "version": "1.0.2",
   "description": "DurinDoor CLI - Start and manage DurinDoor server",
   "bin": {
-    "durindoor": "./cli.js",
     "durindoor": "./cli.js"
   },
   "files": [
@@ -32,7 +31,7 @@
   "comment_sqlite": "sql.js + better-sqlite3 are NOT bundled here. They are installed into <<~/.durindoor>>/runtime/node_modules by hooks/postinstall.js (and re-checked at runtime by cli.js). This avoids Windows EBUSY errors when updating the global CLI, since native .node files no longer live under the locked install dir.",
   "comment_systray": "systray2 is NOT bundled here. It is lazy-installed into <<~/.durindoor>>/runtime/node_modules by hooks/postinstall.js on macOS/Linux only. Windows uses PowerShell NotifyIcon (zero binary). This avoids shipping unsigned Go binaries that trigger antivirus false positives (Kaspersky). We use the systray2 fork because the legacy systray@1.0.5 ships a 2017 x86_64 binary that fails on modern macOS dyld.",
   "engines": {
-    "node": ">=18.0.0"
+    "node": "20.20.2"
   },
   "keywords": [
     "durindoor",
diff --git a/cli/scripts/build-cli.js b/cli/scripts/build-cli.js
index 885b03d56..c4c6bf1a3 100644
--- a/cli/scripts/build-cli.js
+++ b/cli/scripts/build-cli.js
@@ -175,7 +175,8 @@ if (fs.existsSync(customServerSrc)) {
   fs.copyFileSync(customServerSrc, path.join(cliAppDir, "custom-server.js"));
   console.log("✅ Copied custom-server.js\n");
 } else {
-  console.warn("⚠️  custom-server.js not found — server will run without real-IP injection\n");
+  console.error("❌ custom-server.js is required for socket ownership and anti-spoofing checks");
+  process.exit(1);
 }
 
 // Step 3b: Ensure sql.js (pure JS fallback) bundled in app/cli/app/node_modules.
diff --git a/cli/scripts/buildMitm.js b/cli/scripts/buildMitm.js
index 7c456471a..6a76d22c8 100644
--- a/cli/scripts/buildMitm.js
+++ b/cli/scripts/buildMitm.js
@@ -6,7 +6,10 @@ const path = require("path");
 const BUILD_CONFIG = {
   bundle: true,
   minify: true,
-  cleanPlainFiles: true,
+  // custom-server.js and the bundled Next manager load peer-owner, control
+  // proof, and lifecycle modules from this directory at runtime. Preserve the
+  // copied source closure and overwrite only server.js with its portable bundle.
+  cleanPlainFiles: false,
 };
 // ─────────────────────────────────────────────────────────
 
@@ -40,7 +43,7 @@ async function buildEntry(entry) {
       bundle: true,
       minify: BUILD_CONFIG.minify,
       platform: "node",
-      target: "node18",
+      target: "node20",
       external: EXTERNALS,
       plugins: [buildPlugin],
       outfile: output,
diff --git a/cli/src/cli/api/client.js b/cli/src/cli/api/client.js
index 257fcd226..8e22805c7 100644
--- a/cli/src/cli/api/client.js
+++ b/cli/src/cli/api/client.js
@@ -3,8 +3,8 @@ const https = require("https");
 const crypto = require("crypto");
 const fs = require("node:fs");
 const path = require("node:path");
-const os = require("node:os");
 const { machineIdSync } = require("node-machine-id");
+const { getAppDataDir } = require("../appDataDir");
 
 // Default configuration
 const DEFAULT_CONFIG = {
@@ -15,18 +15,9 @@ const DEFAULT_CONFIG = {
 
 const CLI_TOKEN_HEADER = "x-9r-cli-token";
 const CLI_TOKEN_SALT = "9r-cli-auth";
-const APP_NAME = "9router";
-
-function getDataDir() {
-  if (process.env.DATA_DIR) return process.env.DATA_DIR;
-  if (process.platform === "win32") {
-    return path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), APP_NAME);
-  }
-  return path.join(os.homedir(), `.${APP_NAME}`);
-}
-
-const MACHINE_ID_FILE = path.join(getDataDir(), "machine-id");
-const AUTH_DIR = path.join(getDataDir(), "auth");
+const DATA_DIR = getAppDataDir();
+const MACHINE_ID_FILE = path.join(DATA_DIR, "machine-id");
+const AUTH_DIR = path.join(DATA_DIR, "auth");
 const CLI_SECRET_FILE = path.join(AUTH_DIR, "cli-secret");
 
 let config = { ...DEFAULT_CONFIG };
@@ -496,6 +487,7 @@ async function disableTunnel() {
 
 module.exports = {
   configure,
+  getCliToken,
   
   // Providers
   getProviders,
diff --git a/cli/src/cli/appDataDir.js b/cli/src/cli/appDataDir.js
new file mode 100644
index 000000000..97467a7cb
--- /dev/null
+++ b/cli/src/cli/appDataDir.js
@@ -0,0 +1,44 @@
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+/** Match the server data-directory contract, including isolated DATA_DIR. */
+function getAppDataDir({
+  env = process.env,
+  platform = process.platform,
+  homedir = os.homedir,
+  cwd = process.cwd,
+  mkdir = fs.mkdirSync,
+  warn = console.warn,
+} = {}) {
+  const pathImpl = platform === "win32" ? path.win32 : path;
+  const fallback = platform === "win32"
+    ? pathImpl.join(env.APPDATA || pathImpl.join(homedir(), "AppData", "Roaming"), "9router")
+    : pathImpl.join(homedir(), ".9router");
+  const configured = env.DATA_DIR;
+  if (!configured) return fallback;
+  if (platform === "win32" && /^\//.test(configured)) {
+    warn(`[DATA_DIR] '${configured}' is a Unix path on Windows → fallback to default`);
+    return fallback;
+  }
+  const resolved = pathImpl.resolve(cwd(), configured);
+  try {
+    mkdir(resolved, { recursive: true });
+    return resolved;
+  } catch (error) {
+    if (error?.code === "EACCES" || error?.code === "EPERM") {
+      warn(`[DATA_DIR] '${resolved}' not writable → fallback ~/.9router`);
+      return fallback;
+    }
+    throw error;
+  }
+}
+
+function getGlobalMitmStateDir({ platform = process.platform, userInfo = os.userInfo } = {}) {
+  const homedir = userInfo().homedir;
+  return platform === "win32"
+    ? path.win32.join(homedir, "AppData", "Local", "DurinDoor", "mitm-state")
+    : path.join(homedir, ".durindoor-mitm-state");
+}
+
+module.exports = { getAppDataDir, getGlobalMitmStateDir };
diff --git a/cli/src/cli/mitmManagerStop.js b/cli/src/cli/mitmManagerStop.js
new file mode 100644
index 000000000..7a4b4c816
--- /dev/null
+++ b/cli/src/cli/mitmManagerStop.js
@@ -0,0 +1,51 @@
+const { execFileSync } = require("child_process");
+const { getCliToken } = require("./api/client");
+
+const STOP_MANAGER_SCRIPT = String.raw`
+const fs = require("fs");
+const http = require("http");
+const input = JSON.parse(fs.readFileSync(0, "utf8"));
+const port = Number(input.port);
+const token = typeof input.token === "string" ? input.token : "";
+if (!Number.isInteger(port) || port < 1 || port > 65535) process.exit(2);
+const body = JSON.stringify({ preserveDesiredState: input.preserveDesiredState === true });
+const req = http.request({
+  hostname: "127.0.0.1",
+  port,
+  path: "/api/cli-tools/antigravity-mitm",
+  method: "DELETE",
+  headers: {
+    "content-type": "application/json",
+    "content-length": Buffer.byteLength(body),
+    "x-9r-cli-token": token,
+  },
+}, (res) => {
+  res.resume();
+  res.on("end", () => process.exit(res.statusCode >= 200 && res.statusCode < 300 ? 0 : 2));
+});
+req.setTimeout(360000, () => req.destroy());
+req.on("error", () => process.exit(2));
+req.end(body);
+`;
+
+function stopMitmViaManagerSync(port, {
+  execFile = execFileSync,
+  nodePath = process.execPath,
+  cliToken = getCliToken(),
+  preserveDesiredState = true,
+} = {}) {
+  try {
+    execFile(nodePath, ["-e", STOP_MANAGER_SCRIPT], {
+      input: JSON.stringify({ port, token: cliToken, preserveDesiredState }),
+      stdio: ["pipe", "ignore", "ignore"],
+      timeout: 370000,
+      windowsHide: true,
+      env: { PATH: process.env.PATH || "" },
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+module.exports = { STOP_MANAGER_SCRIPT, stopMitmViaManagerSync };
diff --git a/cli/src/cli/workerExit.js b/cli/src/cli/workerExit.js
new file mode 100644
index 000000000..6bf56615b
--- /dev/null
+++ b/cli/src/cli/workerExit.js
@@ -0,0 +1,9 @@
+function isIntentionalWorkerHandoff(code, intentionalExitCode, hasStaleOwnership) {
+  return Number.isInteger(code)
+    && code === intentionalExitCode
+    && hasStaleOwnership === false;
+}
+
+module.exports = {
+  isIntentionalWorkerHandoff,
+};
diff --git a/custom-server.js b/custom-server.js
index d6edcf922..74ec59736 100644
--- a/custom-server.js
+++ b/custom-server.js
@@ -1,41 +1,140 @@
+const crypto = require("crypto");
 const http = require("http");
+const { createPeerOwnerVerifier } = require("./src/mitm/peerOwner");
+const {
+  CONTROL_PORT_HEADER,
+  CONTROL_PROOF_HEADER,
+  CONTROL_SECRET_ENV,
+  createControlProof,
+} = require("./src/mitm/controlProof");
 
-// Renaming next-server process to a unique name while keeping "next-server"
-// in the name for backward compatibility with existing process-matching whitelists.
-process.title = "9router next-server";
-Object.defineProperty(process, "title", {
-  get: () => "9router next-server",
-  set: () => {},
-  configurable: true
-});
-
-const origCreate = http.createServer.bind(http);
-
-// Wrap Next standalone HTTP server: derive client IP from the TCP socket
-// (unspoofable) and strip client-supplied forwarding headers so downstream
-// rate-limiting keys on the real peer address instead of attacker-controlled XFF.
-http.createServer = (...args) => {
-  const handler = args.find((a) => typeof a === "function");
-  const rest = args.filter((a) => typeof a !== "function");
-  if (!handler) return origCreate(...args);
-  const wrapped = (req, res) => {
-    const socketIp = req.socket && req.socket.remoteAddress ? req.socket.remoteAddress : "";
-    const xff = req.headers["x-forwarded-for"];
-    const xRealIp = req.headers["x-real-ip"];
-    const viaProxy = !!(xff || xRealIp);
-    const isLoopbackProxy = socketIp === "127.0.0.1" || socketIp === "::1" || socketIp === "::ffff:127.0.0.1";
-    // Trust forwarding headers only when the TCP peer is a local reverse proxy.
-    // Direct/public sockets remain keyed by the unspoofable peer address.
-    const proxyIp = xRealIp || (xff ? String(xff).split(",")[0].trim() : "");
-    const ip = isLoopbackProxy && proxyIp ? proxyIp : socketIp;
-    delete req.headers["x-9r-real-ip"];
-    delete req.headers["x-forwarded-for"];
-    delete req.headers["x-9r-via-proxy"];
-    req.headers["x-9r-real-ip"] = ip;
-    if (viaProxy) req.headers["x-9r-via-proxy"] = "1";
-    return handler(req, res);
+const MITM_CONTROL_PATH = "/api/cli-tools/antigravity-mitm";
+const STANDALONE_ROOT_ENV = "DURINDOOR_STANDALONE_ROOT";
+
+function canonicalizeRuntimePaths() {
+  // Resolve before Next's generated server can change cwd. Every bundled
+  // subsystem then observes the same absolute data directory, and the MITM
+  // manager receives an entrypoint root derived from this installed wrapper.
+  const { DATA_DIR } = require("./src/mitm/paths");
+  process.env.DATA_DIR = DATA_DIR;
+  process.env[STANDALONE_ROOT_ENV] = require("fs").realpathSync(__dirname);
+  return DATA_DIR;
+}
+
+function isMitmMutation(req) {
+  const pathname = new URL(req.url || "/", "http://localhost").pathname;
+  return (pathname === MITM_CONTROL_PATH || pathname.startsWith(`${MITM_CONTROL_PATH}/`))
+    && String(req.method || "GET").toUpperCase() !== "GET";
+}
+
+/**
+ * Install the standalone-server request wrapper. Besides deriving the real
+ * socket IP, it stamps mutating MITM requests only after proving that the
+ * loopback client socket belongs to the same OS user as the dashboard.
+ */
+function installRequestWrapper({ httpModule = http, secret, verifyPeerOwner } = {}) {
+  const controlSecret = secret || crypto.randomBytes(32).toString("hex");
+  process.env[CONTROL_SECRET_ENV] = controlSecret;
+  const dashboardPort = Number(process.env.PORT || 20128);
+  const verifyOwner = verifyPeerOwner || createPeerOwnerVerifier({ targetPorts: [dashboardPort] });
+  const origCreate = httpModule.createServer.bind(httpModule);
+
+  httpModule.createServer = (...args) => {
+    const handler = args.find((a) => typeof a === "function");
+    const rest = args.filter((a) => typeof a !== "function");
+    if (!handler) return origCreate(...args);
+    const wrapped = (req, res) => {
+      const socketIp = req.socket?.remoteAddress || "";
+      const xff = req.headers["x-forwarded-for"];
+      const xRealIp = req.headers["x-real-ip"];
+      const viaProxy = Boolean(xff || xRealIp);
+      const isLoopbackProxy = socketIp === "127.0.0.1" || socketIp === "::1" || socketIp === "::ffff:127.0.0.1";
+      const proxyIp = xRealIp || (xff ? String(xff).split(",")[0].trim() : "");
+      const ip = isLoopbackProxy && proxyIp ? proxyIp : socketIp;
+      delete req.headers["x-9r-real-ip"];
+      delete req.headers["x-forwarded-for"];
+      delete req.headers["x-9r-via-proxy"];
+      delete req.headers[CONTROL_PROOF_HEADER];
+      delete req.headers[CONTROL_PORT_HEADER];
+      req.headers["x-9r-real-ip"] = ip;
+      if (viaProxy) req.headers["x-9r-via-proxy"] = "1";
+      if (/^[a-f0-9]{48}$/.test(process.env.DURINDOOR_WORKER_NONCE || "")) {
+        res.setHeader?.("x-durindoor-worker-nonce", process.env.DURINDOOR_WORKER_NONCE);
+      }
+
+      const stampOwnerProof = async () => {
+        if (isMitmMutation(req) && await verifyOwner(req.socket)) {
+          const remotePort = req.socket?.remotePort;
+          const proof = createControlProof({
+            method: req.method,
+            pathname: req.url,
+            remotePort,
+            secret: controlSecret,
+          });
+          if (proof) {
+            req.headers[CONTROL_PORT_HEADER] = String(remotePort);
+            req.headers[CONTROL_PROOF_HEADER] = proof;
+          }
+        }
+      };
+      const dispatch = () => {
+        try {
+          const result = handler(req, res);
+          if (result && typeof result.catch === "function") {
+            void result.catch((error) => {
+              if (!res.headersSent) res.writeHead?.(500, { "content-type": "text/plain" });
+              if (!res.writableEnded) res.end?.("Internal Server Error");
+              process.stderr.write(`[custom-server] request handler failed: ${error.message}\n`);
+            });
+          }
+        } catch (error) {
+          if (!res.headersSent) res.writeHead?.(500, { "content-type": "text/plain" });
+          if (!res.writableEnded) res.end?.("Internal Server Error");
+        }
+      };
+      // Proof lookup is fail-closed, but the application handler must be
+      // dispatched exactly once even when lookup fails. In particular, never
+      // interpret a rejected application promise as a reason to replay a host
+      // mutation.
+      void stampOwnerProof().then(
+        dispatch,
+        dispatch,
+      );
+    };
+    return origCreate(...rest, wrapped);
   };
-  return origCreate(...rest, wrapped);
-};
+}
 
-require("./server.js");
+function createOwnerAwareHandler(handler, options = {}) {
+  const shim = { createServer: (...args) => args.find((value) => typeof value === "function") };
+  installRequestWrapper({ ...options, httpModule: shim });
+  return shim.createServer(handler);
+}
+
+function setProcessTitle(processImpl = process) {
+  // Keep "next-server" in the title for backwards-compatible process matching.
+  processImpl.title = "9router next-server";
+  Object.defineProperty(processImpl, "title", {
+    get: () => "9router next-server",
+    set: () => {},
+    configurable: true,
+  });
+}
+
+function run() {
+  canonicalizeRuntimePaths();
+  setProcessTitle();
+  installRequestWrapper();
+  require("./server.js");
+}
+
+if (require.main === module) run();
+
+module.exports = {
+  canonicalizeRuntimePaths,
+  createOwnerAwareHandler,
+  installRequestWrapper,
+  isMitmMutation,
+  run,
+  setProcessTitle,
+};
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 35b102736..33afd8d37 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -177,6 +177,121 @@ Fixes:
 4. If using OIDC, confirm callback URLs and provider configuration.
 5. Check `JWT_SECRET` consistency across restarts.
 
+## MITM Proxy, Root CA, Redirect, or Startup Lock Errors
+
+Symptoms:
+
+- MITM fails with a Root CA generation or read error on first start.
+- `MITM server is already starting` from another request in this process.
+- `MITM server is already starting (lock contention)` from another process.
+- Startup reports that PF is disabled, an iptables rule failed, Windows
+  firewall isolation failed, or the authenticated public-port check failed.
+- A restart says that a fresh sudo credential or UAC-approved start is needed.
+- `MITM_PRIVILEGED_OPERATION_UNCERTAIN` after a sudo/UAC timeout or an
+  interrupted redirect installation.
+- A live legacy integer `.mitm.pid` is refused after an upgrade.
+
+Fixes:
+
+1. Run DurinDoor as a standard user. The full Node.js proxy is never elevated.
+   Only the exact certificate, hosts-file, firewall, or port-redirect mutation is
+   delegated to sudo/UAC. An already elevated DurinDoor process is refused
+   before it can create a CA, change trust, kill a process, or install a rule.
+2. On macOS and Linux the proxy listens on `127.0.0.1:8443`; an owner-scoped
+   kernel rule redirects that user's `127.0.0.1:443` traffic and rejects other
+   users on both ports. macOS PF must already be enabled by system policy;
+   DurinDoor does not call `pfctl -E` because doing so without retaining its
+   reference token can leave PF enabled. Linux requires sudo plus iptables with
+   the `owner`, `multiport`, and `comment` matches.
+3. On Windows the standard-user proxy binds `127.0.0.1:443` directly. Windows
+   does not require Administrator rights for that bind. DurinDoor uses a narrow
+   UAC operation to install an owner-conditioned outbound firewall rule; it
+   never creates a machine-wide `netsh portproxy` mapping.
+4. The proxy independently verifies the operating-system owner of every new
+   loopback connection before health checks or model routing. A request from a
+   different local account is rejected before the proxy can inject the owner's
+   DurinDoor API key. If owner discovery or the public-port health probe cannot
+   be verified, startup fails closed and retains cleanup metadata.
+   Mutating MITM controls additionally require a valid dashboard JWT or the
+   machine-bound CLI token; loopback, `Origin`, and same-user ownership are not
+   treated as authentication. When dashboard login is disabled, use the CLI or
+   enable login before changing MITM state in the browser.
+5. The executable startup path creates a missing, invalid, mismatched, or
+   expiring Root CA before reading TLS files. A valid pair is reused
+   byte-for-byte. On POSIX its directory is `0700`, its key is `0600`, and its
+   certificate is `0644`; stored API-key strings are never rewritten or rotated.
+   During CA rotation, the prior trust entry remains journaled until the exact
+   replacement is verified. Linux also replaces and verifies the exact
+   certificate in every discovered Chromium or Firefox NSS database; a failed
+   NSS update restores the prior entry and leaves the rotation retryable.
+6. Hosts entries and system Root CA trust are operating-system-wide even though
+   proxy access is owner-contained. Enabling MITM can therefore disrupt the
+   targeted IDE traffic of other logged-in users. Treat this as an
+   exclusive-interactive-user feature and do not enable it on a shared host.
+7. Sudo passwords are memory-only. DurinDoor clears legacy
+   `mitmSudoEncrypted` settings and never writes a replacement secret. A cold
+   restart that needs sudo, or any Windows restart that needs UAC, waits for an
+   explicit user-approved start. Passwordless-sudo Unix installs may restart
+   automatically.
+8. Stop removes only exact, tagged hosts entries while the verified proxy is
+   still available,
+   then stops the process, removes only the current user's exact redirect or
+   firewall identity, and finally removes PID metadata. A clean unexpected
+   child exit enters the bounded restart policy. If privileged cleanup fails,
+   PID/rule ownership metadata remains so a later authenticated stop can retry
+   rather than reporting a false success. Explicit stop writes the disabled
+   preference first; update and restart handoffs preserve the enabled intent.
+9. If the plain `already starting` error appears, let the active request finish
+   and retry. For `lock contention`, check whether another DurinDoor process is
+   starting or stopping MITM. Coordination uses exclusive listeners on
+   `127.0.0.1:20443` (startup) and `127.0.0.1:20444` (Root CA publication); the
+   operating system releases them automatically on process exit.
+10. The redirect journal is global to the operating-system user, not to
+    `DATA_DIR`: `~/.durindoor-mitm-state/redirect.json` on macOS/Linux and
+    `%USERPROFILE%\AppData\Local\DurinDoor\mitm-state\redirect.json` on
+    Windows. This intentionally permits only one MITM transport across all
+    DurinDoor data directories owned by that user.
+11. If contention remains after every DurinDoor process exits, check whether an
+    unrelated local service owns either coordination port. Preserve
+    `DATA_DIR/mitm/.mitm.pid` and any `.rootCA.previous.*.crt` recovery journal,
+    capture the MITM logs, and retry through the dashboard. Do not delete PID
+    metadata, trust journals, firewall rules, or Root CA files manually.
+12. A live integer-only `.mitm.pid` came from the previous privileged-launcher
+    design and cannot authenticate which process now owns that PID. Stop MITM
+    with the old DurinDoor version before updating. If that is no longer
+    possible, close DurinDoor and reboot; the new version will remove the dead
+    legacy metadata on its next start. Never raw-kill the recorded PID because
+    it may have been reused by an unrelated process.
+
+### Recover an uncertain privileged MITM operation
+
+An `installing` or `uncertain` redirect journal is a quarantine marker. A sudo
+or UAC descendant may still be running, so DurinDoor deliberately refuses both
+start and inverse cleanup. Do not delete the marker while the machine is still
+running.
+
+1. Close every DurinDoor process and reboot. Reboot is the boundary that proves
+   the unconfirmed privileged process tree has ended.
+2. Inspect and remove only the current user's exact DurinDoor rule:
+   - macOS: the PF anchor is `com.apple/durindoor.mitm.<uid>`. Inspect with
+     `sudo pfctl -a com.apple/durindoor.mitm.$(id -u) -sn` and `-sr`, then remove
+     it with `sudo pfctl -a com.apple/durindoor.mitm.$(id -u) -F all`.
+   - Linux: inspect `sudo iptables-save` for the exact comment
+     `durindoor-mitm-$(id -u)`. Remove only the matching loopback NAT rule for
+     port `443` to `8443` and matching owner-isolation OUTPUT rule. Do not flush
+     either table or delete another user's comment.
+   - Windows: in an elevated PowerShell, obtain the current SID with
+     `[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value`,
+     inspect `DurinDoor-MITM-Isolation-<SID>` with `Get-NetFirewallRule`, and
+     remove that exact name with `Remove-NetFirewallRule` only if its owner,
+     loopback address, port, and action match.
+3. Verify the exact anchor/rules are absent. Only then delete the user's
+   `redirect.json` path listed in step 10. Preserve `.mitm.pid`, Root CA files,
+   and trust-rotation journals; DurinDoor reconciles those separately.
+4. Start DurinDoor as a standard user and run an authenticated MITM stop/start.
+   If any verification differs from the values above, preserve the journal and
+   logs and ask a system administrator to review them.
+
 ## Request Logs Are Empty
 
 Possible causes:
diff --git a/package.json b/package.json
index 10e0db7fe..edf3ce82a 100644
--- a/package.json
+++ b/package.json
@@ -9,12 +9,12 @@
     "npm": "10.8.2"
   },
   "scripts": {
-    "dev": "next dev --webpack --port 20127",
+    "dev": "node scripts/next-owner-server.cjs --dev --port 20127",
     "build": "node scripts/build-app.mjs",
-    "start": "next start",
-    "dev:bun": "bun --bun next dev --webpack --port 20127",
-    "build:bun": "bun --bun next build --webpack",
-    "start:bun": "bun ./.next/standalone/server.js",
+    "start": "node .next/standalone/custom-server.js",
+    "dev:bun": "bun scripts/next-owner-server.cjs --dev --port 20127",
+    "build:bun": "bun scripts/build-app.mjs",
+    "start:bun": "bun ./.next/standalone/custom-server.js",
     "cli:pack": "npm --prefix cli run pack:cli",
     "cli:publish": "npm --prefix cli run publish:cli",
     "lint": "eslint src",
diff --git a/scripts/build-app.mjs b/scripts/build-app.mjs
index 11052c884..c35e0f9ff 100644
--- a/scripts/build-app.mjs
+++ b/scripts/build-app.mjs
@@ -18,6 +18,26 @@ try {
   });
   if (result.error) throw result.error;
   status = result.status ?? 1;
+  if (status === 0) {
+    const distDir = process.env.NEXT_DIST_DIR || ".next";
+    const standaloneRoot = path.join(process.cwd(), distDir, "standalone");
+    const standaloneDir = fs.existsSync(path.join(standaloneRoot, "server.js"))
+      ? standaloneRoot
+      : fs.readdirSync(standaloneRoot)
+        .map((name) => path.join(standaloneRoot, name))
+        .find((candidate) => fs.existsSync(path.join(candidate, "server.js")));
+    if (!standaloneDir) throw new Error(`Standalone server not found under ${standaloneRoot}`);
+    fs.copyFileSync(path.join(process.cwd(), "custom-server.js"), path.join(standaloneDir, "custom-server.js"));
+    fs.cpSync(path.join(process.cwd(), "src", "mitm"), path.join(standaloneDir, "src", "mitm"), {
+      recursive: true,
+    });
+    const sharedConstantsDir = path.join(standaloneDir, "src", "shared", "constants");
+    fs.mkdirSync(sharedConstantsDir, { recursive: true });
+    fs.copyFileSync(
+      path.join(process.cwd(), "src", "shared", "constants", "processExitCodes.js"),
+      path.join(sharedConstantsDir, "processExitCodes.js"),
+    );
+  }
 } finally {
   fs.rmSync(buildRoot, { recursive: true, force: true });
 }
diff --git a/scripts/next-owner-server.cjs b/scripts/next-owner-server.cjs
new file mode 100644
index 000000000..5f34545b4
--- /dev/null
+++ b/scripts/next-owner-server.cjs
@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+
+const http = require("http");
+const path = require("path");
+const {
+  canonicalizeRuntimePaths,
+  createOwnerAwareHandler,
+  setProcessTitle,
+} = require("../custom-server");
+
+const dev = process.argv.includes("--dev");
+if (dev) process.env.NODE_ENV = "development";
+canonicalizeRuntimePaths();
+const next = require("next");
+const portFlag = process.argv.indexOf("--port");
+const port = Number(process.env.PORT || (portFlag >= 0 ? process.argv[portFlag + 1] : dev ? 20127 : 20128));
+const hostname = process.env.HOSTNAME || "0.0.0.0";
+if (!Number.isSafeInteger(port) || port < 1 || port > 65535) throw new Error("Invalid server port");
+
+process.env.PORT = String(port);
+setProcessTitle();
+
+const app = next({ dev, webpack: true, dir: path.resolve(__dirname, ".."), hostname, port });
+const handler = createOwnerAwareHandler(app.getRequestHandler());
+
+app.prepare().then(() => {
+  const server = http.createServer(handler);
+  server.on("upgrade", app.getUpgradeHandler());
+  server.listen(port, hostname, () => {
+    console.log(`DurinDoor ${dev ? "development" : "production"} server ready on ${hostname}:${port}`);
+  });
+}).catch((error) => {
+  console.error(error);
+  process.exit(1);
+});
diff --git a/src/app/(dashboard)/dashboard/cli-tools/components/AntigravityToolCard.js b/src/app/(dashboard)/dashboard/cli-tools/components/AntigravityToolCard.js
index e0a713549..0a30a204e 100644
--- a/src/app/(dashboard)/dashboard/cli-tools/components/AntigravityToolCard.js
+++ b/src/app/(dashboard)/dashboard/cli-tools/components/AntigravityToolCard.js
@@ -387,11 +387,11 @@ export default function AntigravityToolCard({
             </>
           )}
 
-          {/* Windows admin warning */}
+          {/* Windows privilege boundary */}
           {!isRunning && serverIsWindows && (
             <div className="flex items-center gap-2 px-2 py-1.5 rounded text-xs bg-yellow-500/10 text-yellow-600 border border-yellow-500/20">
               <span className="material-symbols-outlined text-[14px]">warning</span>
-              <span>Windows: Run terminal (DurinDoor) as Administrator to enable MITM</span>
+              <span>Windows: keep DurinDoor in standard-user mode; UAC is requested only for system configuration.</span>
             </div>
           )}
 
diff --git a/src/app/(dashboard)/dashboard/cli-tools/components/MitmServerCard.js b/src/app/(dashboard)/dashboard/cli-tools/components/MitmServerCard.js
index dc9f262c4..87bde6f84 100644
--- a/src/app/(dashboard)/dashboard/cli-tools/components/MitmServerCard.js
+++ b/src/app/(dashboard)/dashboard/cli-tools/components/MitmServerCard.js
@@ -23,9 +23,6 @@ export default function MitmServerCard({ apiKeys, cloudEnabled, onStatusChange }
 
   const serverIsWindows = status?.isWin === true;
   const canRunWithoutPassword = serverIsWindows || status?.hasCachedPassword || status?.needsSudoPassword === false;
-  const isAdmin = status?.isAdmin !== false;
-  // No privilege: not admin/root AND (Win OR no cached sudo password)
-  const noPrivilege = !isAdmin && (serverIsWindows || (!status?.hasCachedPassword && status?.needsSudoPassword !== false));
 
   const fetchStatus = useCallback(async () => {
     try {
@@ -233,8 +230,8 @@ export default function MitmServerCard({ apiKeys, cloudEnabled, onStatusChange }
             ) : (
               <button
                 onClick={() => handleAction("start")}
-                disabled={loading || !status || (serverIsWindows && !isAdmin)}
-                title={serverIsWindows && !isAdmin ? "Administrator required" : undefined}
+                disabled={loading || !status || (serverIsWindows && status?.isAdmin === true)}
+                title={serverIsWindows && status?.isAdmin === true ? "Restart DurinDoor as a standard user" : undefined}
                 className="flex w-full items-center justify-center gap-1.5 rounded-lg border border-primary/30 bg-primary/10 px-4 py-2 text-xs font-medium text-primary transition-colors hover:bg-primary/20 disabled:opacity-50 sm:w-auto sm:py-1.5"
               >
                 <span className="material-symbols-outlined text-[16px]">play_circle</span>
@@ -254,11 +251,17 @@ export default function MitmServerCard({ apiKeys, cloudEnabled, onStatusChange }
             </div>
           )}
 
-          {/* Windows admin warning */}
-          {serverIsWindows && !isAdmin && (
+          {/* Windows privilege boundary */}
+          {serverIsWindows && status?.isAdmin === true && (
             <div className="flex items-center gap-2 px-2 py-1.5 rounded text-xs bg-red-500/10 text-red-600 border border-red-500/20">
               <span className="material-symbols-outlined text-[14px]">shield_lock</span>
-              <span>Administrator required — restart DurinDoor as Administrator to use MITM</span>
+              <span>Restart DurinDoor as a standard user. Only the firewall, certificate, and hosts changes request UAC.</span>
+            </div>
+          )}
+          {serverIsWindows && status?.isAdmin === false && (
+            <div className="flex items-center gap-2 px-2 py-1.5 rounded text-xs bg-yellow-500/10 text-yellow-600 border border-yellow-500/20">
+              <span className="material-symbols-outlined text-[14px]">verified_user</span>
+              <span>The proxy stays unprivileged; Windows may show narrow UAC prompts for system configuration.</span>
             </div>
           )}
         </div>
diff --git a/src/app/api/cli-tools/antigravity-mitm/route.js b/src/app/api/cli-tools/antigravity-mitm/route.js
index 90ed714e5..55ec70dff 100644
--- a/src/app/api/cli-tools/antigravity-mitm/route.js
+++ b/src/app/api/cli-tools/antigravity-mitm/route.js
@@ -10,6 +10,8 @@ import {
   setCachedPassword,
   loadEncryptedPassword,
   isSudoPasswordRequired,
+  hasMitmCleanupState,
+  isAdmin as checkIsAdmin,
   initDbHooks,
 } from "@/mitm/manager";
 import { getSettings, updateSettings } from "@/lib/localDb";
@@ -45,21 +47,9 @@ function requiresSudoPassword(pwd) {
   return !isWin && !pwd && isSudoPasswordRequired();
 }
 
-function checkIsAdmin() {
-  if (isWin) {
-    try {
-      require("child_process").execSync("fltmc", { windowsHide: true, stdio: "ignore" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  return typeof process.getuid === "function" && process.getuid() === 0;
-}
-
 function checkPrivilege(pwd) {
-  if (checkIsAdmin()) return true;
-  if (isWin) return false;
+  if (isWin) return !checkIsAdmin();
+  if (checkIsAdmin()) return false;
   if (!isSudoPasswordRequired()) return true;
   return !!pwd;
 }
@@ -69,7 +59,8 @@ export async function GET() {
   try {
     const status = await getMitmStatus();
     const settings = await getSettings();
-    const hasCachedPassword = !!getCachedPassword() || !!(await loadEncryptedPassword());
+    await loadEncryptedPassword();
+    const hasCachedPassword = !!getCachedPassword();
     return NextResponse.json({
       running: status.running,
       pid: status.pid || null,
@@ -94,7 +85,8 @@ export async function GET() {
 export async function POST(request) {
   try {
     const { apiKey, sudoPassword, mitmRouterBaseUrl, forceKillPort443 } = await request.json();
-    const pwd = getPassword(sudoPassword) || await loadEncryptedPassword() || "";
+    await loadEncryptedPassword();
+    const pwd = getPassword(sudoPassword) || "";
 
     if (!apiKey || requiresSudoPassword(pwd)) {
       return NextResponse.json(
@@ -105,7 +97,9 @@ export async function POST(request) {
 
     if (!checkPrivilege(pwd)) {
       return NextResponse.json(
-        { error: isWin ? "Administrator required — restart 9Router as Administrator" : "Root or sudo password required to start MITM" },
+        { error: checkIsAdmin()
+          ? "Run DurinDoor as a standard user; elevation is requested only for the local redirect, certificate, and hosts entries"
+          : "Sudo password required to configure the local MITM redirect" },
         { status: 403 }
       );
     }
@@ -134,6 +128,12 @@ export async function POST(request) {
         { status: 409 }
       );
     }
+    if (error.code === "MITM_START_IN_PROGRESS") {
+      return NextResponse.json(
+        { error: error.message, code: "MITM_START_IN_PROGRESS" },
+        { status: 409 }
+      );
+    }
     return NextResponse.json({ error: error.message || "Failed to start MITM server" }, { status: 500 });
   }
 }
@@ -142,15 +142,15 @@ export async function POST(request) {
 export async function DELETE(request) {
   try {
     const body = await request.json().catch(() => ({}));
-    const { sudoPassword } = body;
-    const pwd = getPassword(sudoPassword) || await loadEncryptedPassword() || "";
+    const { sudoPassword, preserveDesiredState = false } = body;
+    await loadEncryptedPassword();
+    const pwd = getPassword(sudoPassword) || "";
 
-    if (requiresSudoPassword(pwd)) {
+    if (hasMitmCleanupState() && requiresSudoPassword(pwd)) {
       return NextResponse.json({ error: "Missing sudoPassword" }, { status: 400 });
     }
 
-    await stopServer(pwd);
-    if (!isWin && sudoPassword) setCachedPassword(sudoPassword);
+    await stopServer(pwd, { preserveDesiredState: preserveDesiredState === true });
 
     return NextResponse.json({ success: true, running: false });
   } catch (error) {
@@ -163,17 +163,23 @@ export async function DELETE(request) {
 export async function PATCH(request) {
   try {
     const { tool, action, sudoPassword } = await request.json();
-    const pwd = getPassword(sudoPassword) || await loadEncryptedPassword() || "";
+    await loadEncryptedPassword();
+    const pwd = getPassword(sudoPassword) || "";
 
-    if (!tool || !action) {
-      return NextResponse.json({ error: "tool and action required" }, { status: 400 });
+    if (!action) {
+      return NextResponse.json({ error: "action required" }, { status: 400 });
+    }
+    if (action !== "trust-cert" && !tool) {
+      return NextResponse.json({ error: "tool required for DNS changes" }, { status: 400 });
     }
     if (requiresSudoPassword(pwd)) {
       return NextResponse.json({ error: "Missing sudoPassword" }, { status: 400 });
     }
     if (!checkPrivilege(pwd)) {
       return NextResponse.json(
-        { error: isWin ? "Administrator required — restart 9Router as Administrator" : "Root or sudo password required to modify DNS" },
+        { error: isWin
+          ? "Run DurinDoor as a standard user; Windows will request UAC only for the hosts-file change"
+          : "Root or sudo password required to modify DNS" },
         { status: 403 }
       );
     }
diff --git a/src/app/api/settings/route.js b/src/app/api/settings/route.js
index ce955e517..fecd0d450 100644
--- a/src/app/api/settings/route.js
+++ b/src/app/api/settings/route.js
@@ -18,7 +18,7 @@ const PROTECTED_SETTING_KEYS = ["password", "mitmSudoEncrypted"];
 export async function GET() {
   try {
     const settings = await getSettings();
-    const { password, oidcClientSecret, ...safeSettings } = settings;
+    const { password, oidcClientSecret, mitmSudoEncrypted, ...safeSettings } = settings;
     safeSettings.oidcConfigured = !!(safeSettings.oidcIssuerUrl && safeSettings.oidcClientId && oidcClientSecret);
     
     const enableRequestLogs = process.env.ENABLE_REQUEST_LOGS === "true";
@@ -121,7 +121,7 @@ export async function PATCH(request) {
       });
     }
 
-    const { password, oidcClientSecret, ...safeSettings } = settings;
+    const { password, oidcClientSecret, mitmSudoEncrypted, ...safeSettings } = settings;
     safeSettings.oidcConfigured = !!(safeSettings.oidcIssuerUrl && safeSettings.oidcClientId && oidcClientSecret);
     return NextResponse.json(safeSettings, { headers: SETTINGS_RESPONSE_HEADERS });
   } catch (error) {
diff --git a/src/app/api/shutdown/route.js b/src/app/api/shutdown/route.js
index bf7ff107e..9e5118d02 100644
--- a/src/app/api/shutdown/route.js
+++ b/src/app/api/shutdown/route.js
@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import { headers } from "next/headers";
+import { stopMitmForUpdate } from "@/lib/appUpdater";
 
 export async function POST() {
   if (process.env.NODE_ENV === "production") {
@@ -13,12 +14,19 @@ export async function POST() {
     return NextResponse.json({ success: false, message: "Unauthorized" }, { status: 401 });
   }
 
-  const response = NextResponse.json({ success: true, message: "Shutting down..." });
+  try {
+    await stopMitmForUpdate();
+  } catch (error) {
+    return NextResponse.json({
+      success: false,
+      message: `Shutdown blocked because MITM cleanup failed: ${error.message}`,
+    }, { status: 500 });
+  }
 
+  const response = NextResponse.json({ success: true, message: "Shutting down..." });
   setTimeout(() => {
     process.exit(0);
   }, 500);
 
   return response;
 }
-
diff --git a/src/app/api/tunnel/tailscale-check/route.js b/src/app/api/tunnel/tailscale-check/route.js
index f1a830aba..ed5dade04 100644
--- a/src/app/api/tunnel/tailscale-check/route.js
+++ b/src/app/api/tunnel/tailscale-check/route.js
@@ -46,7 +46,8 @@ export async function GET() {
     ]);
     const daemonRunning = customDaemonRunning || systemDaemonRunning;
     const loggedIn = daemonRunning ? isTailscaleLoggedIn() : false;
-    const hasCachedPassword = !!(getCachedPassword() || await loadEncryptedPassword());
+    await loadEncryptedPassword();
+    const hasCachedPassword = !!getCachedPassword();
     return NextResponse.json({ installed, loggedIn, platform, brewAvailable, daemonRunning, customDaemonRunning, systemDaemonRunning, hasCachedPassword });
   } catch (error) {
     return NextResponse.json({ error: error.message }, { status: 500 });
diff --git a/src/app/api/tunnel/tailscale-install/route.js b/src/app/api/tunnel/tailscale-install/route.js
index f53c5eece..87f022964 100644
--- a/src/app/api/tunnel/tailscale-install/route.js
+++ b/src/app/api/tunnel/tailscale-install/route.js
@@ -21,7 +21,8 @@ export async function POST(request) {
   const isBrew = platform === "darwin" && hasBrew();
   const needsPassword = !isWindows && !isBrew;
 
-  const sudoPassword = body.sudoPassword || getCachedPassword() || await loadEncryptedPassword() || "";
+  await loadEncryptedPassword();
+  const sudoPassword = body.sudoPassword || getCachedPassword() || "";
 
   if (needsPassword && !sudoPassword.trim()) {
     return new Response(JSON.stringify({ error: "Sudo password is required" }), {
diff --git a/src/app/api/version/shutdown/route.js b/src/app/api/version/shutdown/route.js
index bb1cd9dcf..245b42743 100644
--- a/src/app/api/version/shutdown/route.js
+++ b/src/app/api/version/shutdown/route.js
@@ -1,15 +1,20 @@
 import { NextResponse } from "next/server";
-import { killAppProcesses } from "@/lib/appUpdater";
+import { killAppProcesses, scheduleIntentionalHandoffExit } from "@/lib/appUpdater";
 
 // Shutdown app to release file locks for manual update
 export async function POST() {
   try {
     await killAppProcesses();
-  } catch { /* best effort */ }
+  } catch (error) {
+    return NextResponse.json({
+      success: false,
+      message: `Shutdown blocked because safe process cleanup failed: ${error.message}`,
+    }, { status: 500 });
+  }
 
   const response = NextResponse.json({ success: true, message: "Shutting down for manual update..." });
 
-  setTimeout(() => process.exit(0), 500);
+  scheduleIntentionalHandoffExit(500);
 
   return response;
 }
diff --git a/src/app/api/version/update/route.js b/src/app/api/version/update/route.js
index e35de795b..30746359a 100644
--- a/src/app/api/version/update/route.js
+++ b/src/app/api/version/update/route.js
@@ -12,7 +12,12 @@ export async function POST() {
   try {
     // Kill sibling processes (cloudflared, MITM, stray next-server) to release file locks on Windows
     await killAppProcesses();
-  } catch { /* best effort */ }
+  } catch (error) {
+    return NextResponse.json({
+      success: false,
+      message: `Update blocked because safe process cleanup failed: ${error.message}`,
+    }, { status: 500 });
+  }
 
   // Schedule detached updater then exit current server process
   spawnUpdaterAndExit();
diff --git a/src/dashboardGuard.js b/src/dashboardGuard.js
index 84ec7c4ee..0876b1406 100644
--- a/src/dashboardGuard.js
+++ b/src/dashboardGuard.js
@@ -2,6 +2,11 @@ import { NextResponse } from "next/server";
 import { getSettings, validateApiKey, validateGatewayKey } from "@/lib/localDb";
 import { getConsistentMachineId } from "@/shared/utils/machineId";
 import { verifyDashboardAuthToken } from "@/lib/auth/dashboardSession";
+import {
+  CONTROL_PORT_HEADER,
+  CONTROL_PROOF_HEADER,
+  verifyControlProof,
+} from "@/mitm/controlProof";
 
 const CLI_TOKEN_HEADER = "x-9r-cli-token";
 const CLI_TOKEN_SALT = "9r-cli-auth";
@@ -92,6 +97,19 @@ function isLoopbackHostname(h) {
   return LOOPBACK_HOSTS.has(name);
 }
 
+function hasExactRequestOrigin(request) {
+  const rawOrigin = request.headers.get("origin");
+  const rawHost = request.headers.get("host");
+  if (!rawOrigin || !rawHost) return false;
+  try {
+    const protocol = new URL(request.url).protocol;
+    const expected = new URL(`${protocol}//${rawHost}`).origin;
+    return new URL(rawOrigin).origin === expected;
+  } catch {
+    return false;
+  }
+}
+
 export function isLocalRequest(request) {
   // Stamped by custom-server.js when forwarding headers exist: request came through
   // a reverse proxy, so the loopback socket is the proxy hop, not the end-user.
@@ -147,8 +165,32 @@ async function canAccessPublicLlmApi(request) {
 
 async function canAccessLocalOnlyRoute(request) {
   if (await hasValidCliToken(request)) return true;
-  // Browser on host: loopback Host + Origin (blocks tunnel/CSRF) + auth (JWT or requireLogin=false)
-  if (isLocalRequest(request) && await isAuthenticated(request)) return true;
+  if (!isLocalRequest(request)) return false;
+
+  const pathname = request.nextUrl.pathname;
+  const isMitmMutation = (pathname === "/api/cli-tools/antigravity-mitm"
+      || pathname.startsWith("/api/cli-tools/antigravity-mitm/"))
+    && String(request.method || "GET").toUpperCase() !== "GET";
+  if (isMitmMutation) {
+    // Loopback and same-OS-user ownership are not authentication: a local
+    // reverse proxy could otherwise become a confused deputy. Browser
+    // mutations require a dashboard JWT; CLI callers were accepted above with
+    // their machine-bound token. The owner proof remains defense in depth.
+    if (!(await hasValidToken(request))) return false;
+    // An explicit loopback Origin proves this is a direct same-origin browser
+    // request. Without it, a same-UID local reverse proxy could become a
+    // confused deputy even though the TCP owner proof itself is valid.
+    if (!hasExactRequestOrigin(request)) return false;
+    return verifyControlProof({
+      method: request.method,
+      pathname,
+      remotePort: request.headers.get(CONTROL_PORT_HEADER),
+      proof: request.headers.get(CONTROL_PROOF_HEADER),
+    });
+  }
+
+  // Other local-only routes retain the dashboard's normal login policy.
+  if (await isAuthenticated(request)) return true;
   return false;
 }
 
@@ -180,6 +222,7 @@ function isPublicApi(pathname) {
 
 export const __test__ = {
   isLocalRequest,
+  hasExactRequestOrigin,
   isPublicLlmApi,
   extractApiKey,
   canAccessPublicLlmApi,
diff --git a/src/lib/appUpdater.js b/src/lib/appUpdater.js
index e1e270cec..67b45be4a 100644
--- a/src/lib/appUpdater.js
+++ b/src/lib/appUpdater.js
@@ -3,38 +3,24 @@ import path from "path";
 import fs from "fs";
 import os from "os";
 import { UPDATER_CONFIG } from "@/shared/constants/config";
+import processExitCodes from "@/shared/constants/processExitCodes";
+import { getCachedPassword, loadEncryptedPassword, stopServer } from "@/mitm/manager";
 
 const KILL_TIMEOUT_MS = 5000;
 const PROCESS_WAIT_MS = 1500;
+const { INTENTIONAL_HANDOFF_EXIT_CODE } = processExitCodes;
 
-// Kill MITM server by PID file (MITM may run as admin/sudo)
-function killMitmByPidFile() {
-  try {
-    const mitmPidFile = path.join(
-      process.platform === "win32"
-        ? path.join(process.env.APPDATA || "", "9router")
-        : path.join(os.homedir(), ".9router"),
-      "mitm",
-      ".mitm.pid"
-    );
-    if (!fs.existsSync(mitmPidFile)) return;
-    const pid = parseInt(fs.readFileSync(mitmPidFile, "utf8").trim(), 10);
-    if (!pid) return;
-
-    if (process.platform === "win32") {
-      // taskkill first (works if same user); fallback to PowerShell Stop-Process which can kill admin process if our token allows
-      try { execSync(`taskkill /F /T /PID ${pid}`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch {
-        try { execSync(`powershell -NonInteractive -WindowStyle Hidden -Command "Stop-Process -Id ${pid} -Force"`, { stdio: "ignore", windowsHide: true, timeout: 3000 }); } catch { /* best effort */ }
-      }
-    } else {
-      try {
-        execSync(`sudo -n kill -9 ${pid} 2>/dev/null`, { stdio: "ignore", timeout: 3000 });
-      } catch {
-        try { process.kill(pid, "SIGKILL"); } catch { /* best effort */ }
-      }
-    }
-    try { fs.unlinkSync(mitmPidFile); } catch { /* best effort */ }
-  } catch { /* best effort */ }
+// The CLI parent treats only this reserved code as an intentional worker
+// handoff. Ordinary code-0 exits remain restartable crash/recovery events.
+export function scheduleIntentionalHandoffExit(delayMs) {
+  setTimeout(() => process.exit(INTENTIONAL_HANDOFF_EXIT_CODE), delayMs);
+}
+
+// Stop MITM through its authenticated manager path before killing app workers.
+export async function stopMitmForUpdate() {
+  await loadEncryptedPassword();
+  const password = getCachedPassword();
+  await stopServer(password, { preserveDesiredState: true });
 }
 
 // Collect PIDs of all 9router-related processes (excluding current)
@@ -137,7 +123,7 @@ function ensureRuntimeUpdater(bundledPath) {
 
 // Kill all app-related processes to release file locks (esp. on Windows)
 export async function killAppProcesses() {
-  killMitmByPidFile();
+  await stopMitmForUpdate();
   const pids = collectAppPids();
   const platform = process.platform;
 
@@ -196,5 +182,5 @@ export function spawnUpdaterAndExit(packageName = UPDATER_CONFIG.npmPackageName)
     },
   }).unref();
 
-  setTimeout(() => process.exit(0), UPDATER_CONFIG.exitDelayMs);
+  scheduleIntentionalHandoffExit(UPDATER_CONFIG.exitDelayMs);
 }
diff --git a/src/lib/dataDir.js b/src/lib/dataDir.js
index dff51e90a..32819df43 100644
--- a/src/lib/dataDir.js
+++ b/src/lib/dataDir.js
@@ -22,12 +22,13 @@ export function getDataDir() {
     return defaultDir();
   }
 
+  const resolved = path.resolve(configured);
   try {
-    fs.mkdirSync(configured, { recursive: true });
-    return configured;
+    fs.mkdirSync(resolved, { recursive: true });
+    return resolved;
   } catch (e) {
     if (e?.code === "EACCES" || e?.code === "EPERM") {
-      console.warn(`[DATA_DIR] '${configured}' not writable → fallback ~/.${APP_NAME}`);
+      console.warn(`[DATA_DIR] '${resolved}' not writable → fallback ~/.${APP_NAME}`);
       return defaultDir();
     }
     throw e;
diff --git a/src/lib/db/adapters/betterSqliteAdapter.js b/src/lib/db/adapters/betterSqliteAdapter.js
index 28832dd19..67e79f5b9 100644
--- a/src/lib/db/adapters/betterSqliteAdapter.js
+++ b/src/lib/db/adapters/betterSqliteAdapter.js
@@ -34,10 +34,14 @@ export function createBetterSqliteAdapter(filePath) {
   }
 
   // Ensure WAL is flushed and -wal/-shm files removed on shutdown
-  const onShutdown = () => gracefulClose();
-  process.once("beforeExit", onShutdown);
-  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
-  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
+  const onSignal = () => {
+    // Flush WAL without closing the database. The central app signal handler
+    // still needs the settings repository to stop MITM safely before exit.
+    try { db.pragma("wal_checkpoint(TRUNCATE)"); } catch {}
+  };
+  process.once("beforeExit", gracefulClose);
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
 
   return {
     driver: "better-sqlite3",
diff --git a/src/lib/db/adapters/bunSqliteAdapter.js b/src/lib/db/adapters/bunSqliteAdapter.js
index 5b3b50bd7..ced066f9e 100644
--- a/src/lib/db/adapters/bunSqliteAdapter.js
+++ b/src/lib/db/adapters/bunSqliteAdapter.js
@@ -31,10 +31,13 @@ export async function createBunSqliteAdapter(filePath) {
     try { stmtCache.clear(); } catch {}
     try { db.close(); } catch {}
   }
-  const onShutdown = () => gracefulClose();
-  process.once("beforeExit", onShutdown);
-  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
-  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
+  const onSignal = () => {
+    // Keep the repository available until the central MITM cleanup finishes.
+    try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
+  };
+  process.once("beforeExit", gracefulClose);
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
 
   return {
     driver: "bun:sqlite",
diff --git a/src/lib/db/adapters/nodeSqliteAdapter.js b/src/lib/db/adapters/nodeSqliteAdapter.js
index 5813e0d37..d5b73268f 100644
--- a/src/lib/db/adapters/nodeSqliteAdapter.js
+++ b/src/lib/db/adapters/nodeSqliteAdapter.js
@@ -44,10 +44,13 @@ export async function createNodeSqliteAdapter(filePath) {
     try { stmtCache.clear(); } catch {}
     try { db.close(); } catch {}
   }
-  const onShutdown = () => gracefulClose();
-  process.once("beforeExit", onShutdown);
-  process.once("SIGINT", () => { onShutdown(); process.exit(0); });
-  process.once("SIGTERM", () => { onShutdown(); process.exit(0); });
+  const onSignal = () => {
+    // Keep the repository available until the central MITM cleanup finishes.
+    try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
+  };
+  process.once("beforeExit", gracefulClose);
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
 
   return {
     driver: "node:sqlite",
diff --git a/src/lib/tunnel/tailscale/manager.js b/src/lib/tunnel/tailscale/manager.js
index 7fe40e7ec..e2a6a090b 100644
--- a/src/lib/tunnel/tailscale/manager.js
+++ b/src/lib/tunnel/tailscale/manager.js
@@ -28,7 +28,8 @@ export async function enableTailscale(localPort = 20128) {
   const token = svc.cancelToken;
 
   try {
-    const sudoPass = getCachedPassword() || await loadEncryptedPassword() || "";
+    await loadEncryptedPassword();
+    const sudoPass = getCachedPassword() || "";
     await startDaemonWithPassword(sudoPass);
     console.log("[Tailscale] daemon ready");
     throwIfCancelled(token);
diff --git a/src/mitm/cert/generate.js b/src/mitm/cert/generate.js
index e85f9dc69..e025fe306 100644
--- a/src/mitm/cert/generate.js
+++ b/src/mitm/cert/generate.js
@@ -15,10 +15,10 @@ function generateCert() {
  * Get certificate for a specific domain (dynamic generation)
  * Used by SNICallback in server.js
  */
-function getCertForDomain(domain) {
+function getCertForDomain(domain, rootCA = null) {
   try {
-    const rootCA = loadRootCA();
-    const leafCert = generateLeafCert(domain, rootCA);
+    const signingCA = rootCA || loadRootCA();
+    const leafCert = generateLeafCert(domain, signingCA);
     return {
       key: leafCert.key,
       cert: leafCert.cert
diff --git a/src/mitm/cert/install.js b/src/mitm/cert/install.js
index f8f8fe705..6c3052895 100644
--- a/src/mitm/cert/install.js
+++ b/src/mitm/cert/install.js
@@ -1,9 +1,15 @@
 const fs = require("fs");
 const crypto = require("crypto");
-const { exec } = require("child_process");
+const os = require("os");
+const { execFile } = require("child_process");
 const { execWithPassword, isSudoAvailable } = require("../dns/dnsConfig.js");
 const { runElevatedPowerShell, quotePs } = require("../winElevated.js");
 const { log, err } = require("../logger");
+const {
+  FIXED_UNIX_PATH,
+  resolveTrustedUnixBinary,
+  resolveWindowsSystemBinary,
+} = require("../trustedBinaries");
 
 const IS_WIN = process.platform === "win32";
 const IS_MAC = process.platform === "darwin";
@@ -27,35 +33,91 @@ function getLinuxCertConfig() {
   // Fallback to Debian default if none exist
   return LINUX_CERT_PATHS[0];
 }
+
+function resolveLinuxSystemCommand(name, { required = true } = {}) {
+  return resolveTrustedUnixBinary(name, {
+    candidates: [`/usr/sbin/${name}`, `/usr/bin/${name}`, `/sbin/${name}`, `/bin/${name}`],
+    required,
+  });
+}
 const ROOT_CA_CN = "9Router MITM Root CA";
 
-// Get SHA1 fingerprint from cert file using Node.js crypto
+function quoteSh(value) {
+  return `'${String(value).replace(/'/g, `'"'"'`)}'`;
+}
+
+function readCertificateSnapshot(certPath) {
+  const pathStat = fs.lstatSync(certPath);
+  if (!pathStat.isFile() || pathStat.isSymbolicLink()) throw new Error(`Unsafe certificate path: ${certPath}`);
+  const noFollow = fs.constants.O_NOFOLLOW || 0;
+  const fd = fs.openSync(certPath, fs.constants.O_RDONLY | noFollow);
+  try {
+    const fdStat = fs.fstatSync(fd);
+    if (!fdStat.isFile()
+      || String(fdStat.dev) !== String(pathStat.dev)
+      || String(fdStat.ino) !== String(pathStat.ino)) {
+      throw new Error(`Certificate path changed while opening: ${certPath}`);
+    }
+    const bytes = fs.readFileSync(fd);
+    return { bytes, cert: new crypto.X509Certificate(bytes) };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+// Get SHA-1 fingerprint from a validated, no-follow certificate snapshot.
 function getCertFingerprint(certPath) {
-  const pem = fs.readFileSync(certPath, "utf-8");
-  const der = Buffer.from(pem.replace(/-----[^-]+-----/g, "").replace(/\s/g, ""), "base64");
-  return crypto.createHash("sha1").update(der).digest("hex").toUpperCase().match(/.{2}/g).join(":");
+  return readCertificateSnapshot(certPath).cert.fingerprint;
+}
+
+function certificatesMatch(sourcePath, installedPath) {
+  try {
+    const source = readCertificateSnapshot(sourcePath);
+    const installed = readCertificateSnapshot(installedPath);
+    return source.cert.raw.equals(installed.cert.raw);
+  } catch {
+    return false;
+  }
+}
+
+function assertDurinDoorRootCertificate(certPath) {
+  const snapshot = readCertificateSnapshot(certPath);
+  const { cert } = snapshot;
+  const commonNameMatches = cert.subject.split(/\n|,\s*/).some((field) => field === `CN=${ROOT_CA_CN}`);
+  if (!commonNameMatches || !cert.ca || cert.issuer !== cert.subject || !cert.verify(cert.publicKey)) {
+    throw new Error("Refusing privileged trust-store mutation for a certificate that is not a DurinDoor MITM root");
+  }
+  return snapshot;
 }
 
 /**
  * Check if certificate is already installed in system store
  */
 async function checkCertInstalled(certPath) {
-  if (IS_WIN) return checkCertInstalledWindows(certPath);
-  if (IS_MAC) return checkCertInstalledMac(certPath);
-  return checkCertInstalledLinux();
+  let snapshot;
+  try { snapshot = readCertificateSnapshot(certPath); }
+  catch { return false; }
+  return checkCertificateSnapshotInstalled(certPath, snapshot);
+}
+
+function checkCertificateSnapshotInstalled(certPath, snapshot) {
+  if (IS_WIN) return checkCertInstalledWindows(snapshot);
+  if (IS_MAC) return checkCertInstalledMac(certPath, snapshot);
+  return checkCertInstalledLinux(certPath, snapshot);
 }
 
-function checkCertInstalledMac(certPath) {
+function checkCertInstalledMac(certPath, snapshot) {
   return new Promise((resolve) => {
     try {
-      const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
+      const fingerprint = snapshot.cert.fingerprint.replace(/:/g, "");
       // Verify exact cert bytes match — same CN with different fingerprint = stale cert
-      exec(`security find-certificate -a -c "${ROOT_CA_CN}" -Z /Library/Keychains/System.keychain 2>/dev/null`, { windowsHide: true }, (error, stdout) => {
+      const securityBin = resolveTrustedUnixBinary("security");
+      execFile(securityBin, ["find-certificate", "-a", "-c", ROOT_CA_CN, "-Z", "/Library/Keychains/System.keychain"], { windowsHide: true }, (error, stdout) => {
         if (error || !stdout) return resolve(false);
         const match = new RegExp(`SHA-1 hash:\\s*${fingerprint}`, "i").test(stdout);
         if (!match) return resolve(false);
         // Cert exists with matching fingerprint — confirm trust policy
-        exec(`security verify-cert -c "${certPath}" -p ssl -k /Library/Keychains/System.keychain 2>/dev/null`, { windowsHide: true }, (err2) => {
+        execFile(securityBin, ["verify-cert", "-c", certPath, "-p", "ssl", "-k", "/Library/Keychains/System.keychain"], { windowsHide: true }, (err2) => {
           resolve(!err2);
         });
       });
@@ -65,16 +127,10 @@ function checkCertInstalledMac(certPath) {
   });
 }
 
-function checkCertInstalledWindows(certPath) {
+function checkCertInstalledWindows(snapshot) {
   return new Promise((resolve) => {
-    // Check by SHA1 fingerprint — detects stale cert with same CN but different key
-    let fingerprint;
-    try {
-      fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
-    } catch {
-      return resolve(false);
-    }
-    exec(`certutil -store Root ${fingerprint}`, { windowsHide: true }, (error) => {
+    const fingerprint = snapshot.cert.fingerprint.replace(/:/g, "");
+    execFile(resolveWindowsSystemBinary("certutil.exe"), ["-store", "Root", fingerprint], { windowsHide: true }, (error) => {
       resolve(!error);
     });
   });
@@ -88,27 +144,27 @@ async function installCert(sudoPassword, certPath) {
     throw new Error(`Certificate file not found: ${certPath}`);
   }
 
-  const isInstalled = await checkCertInstalled(certPath);
+  const snapshot = assertDurinDoorRootCertificate(certPath);
+  const isInstalled = await checkCertificateSnapshotInstalled(certPath, snapshot);
   if (isInstalled) {
     log("🔐 Cert: already trusted ✅");
     return;
   }
 
   if (IS_WIN) {
-    await installCertWindows(certPath);
+    await installCertWindows(snapshot);
   } else if (IS_MAC) {
-    await installCertMac(sudoPassword, certPath);
+    await installCertMac(sudoPassword, snapshot);
   } else {
-    await installCertLinux(sudoPassword, certPath);
+    await installCertLinux(sudoPassword, certPath, snapshot);
   }
 }
 
-async function installCertMac(sudoPassword, certPath) {
-  // Remove all old certs with same name first to avoid duplicate/stale cert conflict
-  const deleteOld = `security delete-certificate -c "9Router MITM Root CA" /Library/Keychains/System.keychain 2>/dev/null || true`;
-  const install = `security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "${certPath}"`;
+async function installCertMac(sudoPassword, snapshot) {
+  const encoded = snapshot.bytes.toString("base64");
+  const install = `set -eu; umask 077; temp=$(mktemp /var/root/durindoor-mitm-ca.XXXXXX); trap 'rm -f -- "$temp"' EXIT HUP INT TERM; printf '%s' ${quoteSh(encoded)} | base64 -D > "$temp"; security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain "$temp"`;
   try {
-    await execWithPassword(`${deleteOld} && ${install}`, sudoPassword);
+    await execWithPassword(install, sudoPassword);
     log("🔐 Cert: ✅ installed to system keychain");
   } catch (error) {
     const msg = error.message?.includes("canceled") ? "User canceled authorization" : "Certificate install failed";
@@ -116,13 +172,26 @@ async function installCertMac(sudoPassword, certPath) {
   }
 }
 
-async function installCertWindows(certPath) {
+async function installCertWindows(snapshot) {
   // Auto-elevate via UAC popup if not admin (zero popup if already admin).
-  // Delete any stale cert with same CN before adding to avoid duplicates.
+  const encodedDer = snapshot.cert.raw.toString("base64");
+  const fingerprint = snapshot.cert.fingerprint.replace(/:/g, "");
   const script = `
-    certutil -delstore Root ${quotePs(ROOT_CA_CN)} 2>$null | Out-Null
-    $exit = & certutil -addstore Root ${quotePs(certPath)} 2>&1
-    if ($LASTEXITCODE -ne 0) { throw "certutil exit $LASTEXITCODE" }
+    $ErrorActionPreference = 'Stop'
+    $bytes = [Convert]::FromBase64String(${quotePs(encodedDer)})
+    $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($bytes)
+    if ($cert.Thumbprint -ne ${quotePs(fingerprint)}) { throw 'MITM certificate snapshot fingerprint mismatch' }
+    $store = [System.Security.Cryptography.X509Certificates.X509Store]::new('Root', 'LocalMachine')
+    $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
+    try {
+      $store.Add($cert)
+      if (-not ($store.Certificates | Where-Object { $_.Thumbprint -eq ${quotePs(fingerprint)} })) {
+        throw 'MITM certificate trust-store publication could not be verified'
+      }
+    } finally {
+      $store.Close()
+      $cert.Dispose()
+    }
   `;
   try {
     await runElevatedPowerShell(script);
@@ -136,23 +205,24 @@ async function installCertWindows(certPath) {
  * Uninstall SSL certificate from system store
  */
 async function uninstallCert(sudoPassword, certPath) {
-  const isInstalled = await checkCertInstalled(certPath);
+  const snapshot = assertDurinDoorRootCertificate(certPath);
+  const isInstalled = await checkCertificateSnapshotInstalled(certPath, snapshot);
   if (!isInstalled) {
     log("🔐 Cert: not found in system store");
     return;
   }
 
   if (IS_WIN) {
-    await uninstallCertWindows();
+    await uninstallCertWindows(snapshot);
   } else if (IS_MAC) {
-    await uninstallCertMac(sudoPassword, certPath);
+    await uninstallCertMac(sudoPassword, snapshot);
   } else {
     await uninstallCertLinux(sudoPassword);
   }
 }
 
-async function uninstallCertMac(sudoPassword, certPath) {
-  const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
+async function uninstallCertMac(sudoPassword, snapshot) {
+  const fingerprint = snapshot.cert.fingerprint.replace(/:/g, "");
   const command = `security delete-certificate -Z "${fingerprint}" /Library/Keychains/System.keychain`;
   try {
     await execWithPassword(command, sudoPassword);
@@ -162,9 +232,14 @@ async function uninstallCertMac(sudoPassword, certPath) {
   }
 }
 
-async function uninstallCertWindows() {
+async function uninstallCertWindows(snapshot) {
   // Auto-elevate via UAC popup if not admin
-  const script = `certutil -delstore Root ${quotePs(ROOT_CA_CN)}`;
+  const fingerprint = snapshot.cert.fingerprint.replace(/:/g, "");
+  const certutilPath = resolveWindowsSystemBinary("certutil.exe", { verify: IS_WIN });
+  const script = `
+    & ${quotePs(certutilPath)} -delstore Root ${quotePs(fingerprint)} 2>&1 | Out-Null
+    if ($LASTEXITCODE -ne 0) { throw "certutil exit $LASTEXITCODE" }
+  `;
   try {
     await runElevatedPowerShell(script);
     log("🔐 Cert: ✅ uninstalled from Windows Root store");
@@ -173,57 +248,147 @@ async function uninstallCertWindows() {
   }
 }
 
-function checkCertInstalledLinux() {
+async function checkCertInstalledLinux(certPath, sourceSnapshot = null) {
   const config = getLinuxCertConfig();
   const certFile = `${config.dir}/9router-root-ca.crt`;
-  return Promise.resolve(fs.existsSync(certFile));
+  const source = sourceSnapshot || readCertificateSnapshot(certPath);
+  let systemMatches = false;
+  try {
+    const installed = readCertificateSnapshot(certFile);
+    systemMatches = source.cert.raw.equals(installed.cert.raw);
+  } catch { /* system trust file is absent or stale */ }
+  const nss = await checkNssDatabases(source);
+  if (!isSudoAvailable()) return nss.found && nss.matches;
+  return systemMatches && nss.matches;
 }
 
-async function updateNssDatabases(certPath, action = 'add') {
-  const certName = "9Router MITM Root CA";
-  
-  const script = `
-    if ! command -v certutil &> /dev/null; then
-      exit 0
-    fi
-    
-    DIRS="$HOME/.pki/nssdb $HOME/snap/chromium/current/.pki/nssdb"
-    
-    if [ -d "$HOME/.mozilla/firefox" ]; then
-      for profile in "$HOME"/.mozilla/firefox/*/; do
-        if [ -f "\${profile}cert9.db" ] || [ -f "\${profile}cert8.db" ]; then
-          DIRS="$DIRS $profile"
-        fi
-      done
-    fi
+const NSS_CERT_NAME = "9Router MITM Root CA";
 
-    if [ -d "$HOME/snap/firefox/common/.mozilla/firefox" ]; then
-      for profile in "$HOME"/snap/firefox/common/.mozilla/firefox/*/; do
-        if [ -f "\${profile}cert9.db" ] || [ -f "\${profile}cert8.db" ]; then
-          DIRS="$DIRS $profile"
-        fi
-      done
-    fi
+function discoverNssDatabaseDirs(home = os.homedir()) {
+  const candidates = [
+    `${home}/.pki/nssdb`,
+    `${home}/snap/chromium/current/.pki/nssdb`,
+  ];
+  for (const base of [
+    `${home}/.mozilla/firefox`,
+    `${home}/snap/firefox/common/.mozilla/firefox`,
+  ]) {
+    if (!fs.existsSync(base)) continue;
+    for (const entry of fs.readdirSync(base, { withFileTypes: true })) {
+      if (entry.isDirectory()) candidates.push(`${base}/${entry.name}`);
+    }
+  }
+  return [...new Set(candidates)].filter((dir) => {
+    try {
+      return fs.statSync(dir).isDirectory()
+        && (fs.existsSync(`${dir}/cert9.db`) || fs.existsSync(`${dir}/cert8.db`));
+    } catch {
+      return false;
+    }
+  });
+}
 
-    for db in $DIRS; do
-      if [ -d "$db" ]; then
-        if [ "${action}" = "add" ]; then
-          certutil -d sql:"$db" -A -t "C,," -n "${certName}" -i "${certPath}" 2>/dev/null || \\
-          certutil -d "$db" -A -t "C,," -n "${certName}" -i "${certPath}" 2>/dev/null || true
-        else
-          certutil -d sql:"$db" -D -n "${certName}" 2>/dev/null || \\
-          certutil -d "$db" -D -n "${certName}" 2>/dev/null || true
-        fi
-      fi
-    done
-  `;
-  
+function runCertutil(certutil, args) {
   return new Promise((resolve) => {
-    exec(script, { shell: "/bin/bash" }, () => resolve());
+    execFile(certutil, args, {
+      encoding: "utf8",
+      env: { HOME: os.homedir(), PATH: FIXED_UNIX_PATH, LANG: "C", LC_ALL: "C" },
+      maxBuffer: 4 * 1024 * 1024,
+      windowsHide: true,
+    }, (error, stdout = "", stderr = "") => resolve({ error, stdout, stderr }));
   });
 }
 
-async function installCertLinux(sudoPassword, certPath) {
+async function resolveNssDatabaseSpec(certutil, dir) {
+  for (const spec of [`sql:${dir}`, dir]) {
+    const result = await runCertutil(certutil, ["-d", spec, "-L"]);
+    if (!result.error) return spec;
+  }
+  throw new Error(`Unable to open NSS certificate database: ${dir}`);
+}
+
+async function readNssCertificate(certutil, spec) {
+  const result = await runCertutil(certutil, ["-d", spec, "-L", "-n", NSS_CERT_NAME, "-a"]);
+  if (result.error || !result.stdout.trim()) return null;
+  try {
+    return { pem: result.stdout, cert: new crypto.X509Certificate(result.stdout) };
+  } catch {
+    throw new Error(`NSS certificate entry ${NSS_CERT_NAME} is unreadable in ${spec}`);
+  }
+}
+
+async function deleteNssCertificate(certutil, spec) {
+  const existing = await readNssCertificate(certutil, spec);
+  if (!existing) return;
+  const removed = await runCertutil(certutil, ["-d", spec, "-D", "-n", NSS_CERT_NAME]);
+  if (removed.error || await readNssCertificate(certutil, spec)) {
+    throw new Error(`Failed to delete stale NSS certificate in ${spec}`);
+  }
+}
+
+async function replaceNssCertificate(certutil, spec, certPath, expectedSnapshot) {
+  const old = await readNssCertificate(certutil, spec);
+  if (old?.cert.raw.equals(expectedSnapshot.cert.raw)) return;
+  const rollbackDir = fs.mkdtempSync(`${os.tmpdir()}/durindoor-nss-`);
+  const rollbackPath = `${rollbackDir}/previous.crt`;
+  try {
+    if (old) fs.writeFileSync(rollbackPath, old.pem, { mode: 0o600 });
+    await deleteNssCertificate(certutil, spec);
+    const added = await runCertutil(certutil, [
+      "-d", spec, "-A", "-t", "C,,", "-n", NSS_CERT_NAME, "-i", certPath,
+    ]);
+    const installed = await readNssCertificate(certutil, spec);
+    if (added.error || !installed?.cert.raw.equals(expectedSnapshot.cert.raw)) {
+      throw new Error(`NSS replacement certificate could not be verified in ${spec}`);
+    }
+  } catch (error) {
+    try {
+      await deleteNssCertificate(certutil, spec);
+      if (old) {
+        const restored = await runCertutil(certutil, [
+          "-d", spec, "-A", "-t", "C,,", "-n", NSS_CERT_NAME, "-i", rollbackPath,
+        ]);
+        const restoredCert = await readNssCertificate(certutil, spec);
+        if (restored.error || !restoredCert?.cert.raw.equals(old.cert.raw)) {
+          throw new Error("prior NSS certificate restoration could not be verified");
+        }
+      }
+    } catch (rollbackError) {
+      throw new Error(`${error.message}; ${rollbackError.message}`);
+    }
+    throw error;
+  } finally {
+    fs.rmSync(rollbackDir, { recursive: true, force: true });
+  }
+}
+
+async function checkNssDatabases(expectedSnapshot) {
+  const certutil = resolveLinuxSystemCommand("certutil", { required: false });
+  const dirs = certutil ? discoverNssDatabaseDirs() : [];
+  if (!certutil || dirs.length === 0) return { found: false, matches: true };
+  for (const dir of dirs) {
+    const spec = await resolveNssDatabaseSpec(certutil, dir);
+    const installed = await readNssCertificate(certutil, spec);
+    if (!installed?.cert.raw.equals(expectedSnapshot.cert.raw)) {
+      return { found: true, matches: false };
+    }
+  }
+  return { found: true, matches: true };
+}
+
+async function updateNssDatabases(certPath, action = "add") {
+  const certutil = resolveLinuxSystemCommand("certutil", { required: false });
+  if (!certutil) return;
+  const dirs = discoverNssDatabaseDirs();
+  const expected = action === "add" ? assertDurinDoorRootCertificate(certPath) : null;
+  for (const dir of dirs) {
+    const spec = await resolveNssDatabaseSpec(certutil, dir);
+    if (action === "add") await replaceNssCertificate(certutil, spec, certPath, expected);
+    else await deleteNssCertificate(certutil, spec);
+  }
+}
+
+async function installCertLinux(sudoPassword, certPath, snapshot) {
   if (!isSudoAvailable()) {
     log(`🔐 Cert: cannot install to system store without sudo — trust this file on clients: ${certPath}`);
     // Still try to update user NSS DBs even if no sudo!
@@ -232,10 +397,51 @@ async function installCertLinux(sudoPassword, certPath) {
   }
   
   const config = getLinuxCertConfig();
+  const updateTrust = resolveLinuxSystemCommand(config.cmd);
   const destFile = `${config.dir}/9router-root-ca.crt`;
-  
-  // Copy to the discovered directory and execute the specific update command
-  const cmd = `cp "${certPath}" "${destFile}" && (${config.cmd} 2>/dev/null || true)`;
+  const encoded = snapshot.bytes.toString("base64");
+  const tempPattern = `${destFile}.durindoor.XXXXXX`;
+  const backupPattern = `${destFile}.durindoor-backup.XXXXXX`;
+  const cmd = `
+    set -eu
+    umask 077
+    temp=$(mktemp ${quoteSh(tempPattern)})
+    backup=$(mktemp ${quoteSh(backupPattern)})
+    had_previous=0
+    published=0
+    cleanup() {
+      if [ "$published" -eq 1 ]; then
+        if [ "$had_previous" -eq 1 ]; then mv -f -- "$backup" ${quoteSh(destFile)}; else rm -f -- ${quoteSh(destFile)}; fi
+        ${quoteSh(updateTrust)} >/dev/null 2>&1 || true
+      fi
+      rm -f -- "$temp" "$backup"
+    }
+    trap cleanup EXIT HUP INT TERM
+    if [ -f ${quoteSh(destFile)} ]; then
+      cp -p -- ${quoteSh(destFile)} "$backup"
+      had_previous=1
+    fi
+    printf '%s' ${quoteSh(encoded)} | base64 -d > "$temp"
+    chmod 0644 "$temp"
+    mv -f -- "$temp" ${quoteSh(destFile)}
+    published=1
+    if ${quoteSh(updateTrust)}; then
+      published=0
+      rm -f -- "$backup"
+      had_previous=0
+    else
+      status=$?
+      if [ "$had_previous" -eq 1 ]; then
+        mv -f -- "$backup" ${quoteSh(destFile)}
+        had_previous=0
+      else
+        rm -f -- ${quoteSh(destFile)}
+      fi
+      published=0
+      ${quoteSh(updateTrust)} >/dev/null 2>&1 || true
+      exit "$status"
+    fi
+  `;
   
   try {
     await execWithPassword(cmd, sudoPassword);
@@ -255,8 +461,9 @@ async function uninstallCertLinux(sudoPassword) {
   }
   
   const config = getLinuxCertConfig();
+  const updateTrust = resolveLinuxSystemCommand(config.cmd);
   const destFile = `${config.dir}/9router-root-ca.crt`;
-  const cmd = `rm -f "${destFile}" && (${config.cmd} 2>/dev/null || true)`;
+  const cmd = `rm -f -- ${quoteSh(destFile)} && ${quoteSh(updateTrust)}`;
   
   try {
     await execWithPassword(cmd, sudoPassword);
@@ -266,4 +473,17 @@ async function uninstallCertLinux(sudoPassword) {
   }
 }
 
-module.exports = { installCert, uninstallCert, checkCertInstalled };
+module.exports = {
+  installCert,
+  uninstallCert,
+  checkCertInstalled,
+  checkCertInstalledLinux,
+  certificatesMatch,
+  assertDurinDoorRootCertificate,
+  discoverNssDatabaseDirs,
+  getCertFingerprint,
+  quoteSh,
+  readNssCertificate,
+  replaceNssCertificate,
+  updateNssDatabases,
+};
diff --git a/src/mitm/cert/rootCA.js b/src/mitm/cert/rootCA.js
index c6e60a066..c3df83838 100644
--- a/src/mitm/cert/rootCA.js
+++ b/src/mitm/cert/rootCA.js
@@ -1,46 +1,265 @@
+const crypto = require("crypto");
 const path = require("path");
 const fs = require("fs");
 const forge = require("node-forge");
 const { MITM_DIR } = require("../paths");
+const { ensureWindowsPrivateDirectorySync } = require("../windowsAcl");
 
 const ROOT_CA_KEY_PATH = path.join(MITM_DIR, "rootCA.key");
 const ROOT_CA_CERT_PATH = path.join(MITM_DIR, "rootCA.crt");
 
-/**
- * Check if cert file is expired or expiring within 30 days
- */
-function isCertExpired(certPath) {
+function fsyncMitmDirectory() {
+  if (process.platform === "win32") return;
+  let fd;
   try {
-    const cert = forge.pki.certificateFromPem(fs.readFileSync(certPath, "utf8"));
-    const expiryThreshold = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
-    return cert.validity.notAfter < expiryThreshold;
+    fd = fs.openSync(MITM_DIR, "r");
+    fs.fsyncSync(fd);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+function ensurePrivateDirectory() {
+  fs.mkdirSync(MITM_DIR, { recursive: true, mode: 0o700 });
+  const stat = fs.lstatSync(MITM_DIR);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) {
+    throw new Error(`Unsafe MITM directory: ${MITM_DIR}`);
+  }
+  if (process.platform !== "win32") fs.chmodSync(MITM_DIR, 0o700);
+  else ensureWindowsPrivateDirectorySync(MITM_DIR);
+}
+
+function assertRegularFileOrMissing(filePath) {
+  try {
+    const stat = fs.lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error(`Unsafe Root CA path: ${filePath}`);
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+
+function rootCAFilesMatchPaths(keyPath, certPath) {
+  try {
+    const privateKey = forge.pki.privateKeyFromPem(fs.readFileSync(keyPath, "utf8"));
+    const certificate = forge.pki.certificateFromPem(fs.readFileSync(certPath, "utf8"));
+    return privateKey.n.compareTo(certificate.publicKey.n) === 0
+      && privateKey.e.compareTo(certificate.publicKey.e) === 0;
   } catch {
-    return true; // treat unreadable cert as expired
+    return false;
+  }
+}
+
+function rootCAFilesMatch() {
+  return rootCAFilesMatchPaths(ROOT_CA_KEY_PATH, ROOT_CA_CERT_PATH);
+}
+
+function hasValidRootCA() {
+  return fs.existsSync(ROOT_CA_KEY_PATH)
+    && fs.existsSync(ROOT_CA_CERT_PATH)
+    && !isCertExpired(ROOT_CA_CERT_PATH)
+    && rootCAFilesMatch();
+}
+
+function writeExclusiveTemp(filePath, content, mode, token) {
+  const tempPath = `${filePath}.${process.pid}.${token}.tmp`;
+  let fd;
+  try {
+    fd = fs.openSync(tempPath, "wx", mode);
+    fs.writeFileSync(fd, content);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = undefined;
+    if (process.platform !== "win32") fs.chmodSync(tempPath, mode);
+    return tempPath;
+  } catch (error) {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* ignore cleanup failure */ }
+    }
+    try { fs.unlinkSync(tempPath); } catch { /* ignore cleanup failure */ }
+    throw error;
+  }
+}
+
+function publishRootCAPair(privateKeyPem, certPem) {
+  ensurePrivateDirectory();
+  assertRegularFileOrMissing(ROOT_CA_KEY_PATH);
+  assertRegularFileOrMissing(ROOT_CA_CERT_PATH);
+
+  const token = crypto.randomBytes(12).toString("hex");
+  const keyBackup = `${ROOT_CA_KEY_PATH}.${token}.bak`;
+  const certBackup = `${ROOT_CA_CERT_PATH}.${token}.bak`;
+  const hadKey = fs.existsSync(ROOT_CA_KEY_PATH);
+  const hadCert = fs.existsSync(ROOT_CA_CERT_PATH);
+  let keyTemp;
+  let certTemp;
+  let keyBackedUp = false;
+  let certBackedUp = false;
+  let keyPublished = false;
+  let certPublished = false;
+  let committed = false;
+
+  try {
+    keyTemp = writeExclusiveTemp(ROOT_CA_KEY_PATH, privateKeyPem, 0o600, token);
+    certTemp = writeExclusiveTemp(ROOT_CA_CERT_PATH, certPem, 0o644, token);
+    if (hadKey) {
+      fs.renameSync(ROOT_CA_KEY_PATH, keyBackup);
+      keyBackedUp = true;
+      if (process.platform !== "win32") fs.chmodSync(keyBackup, 0o600);
+    }
+    if (hadCert) {
+      fs.renameSync(ROOT_CA_CERT_PATH, certBackup);
+      certBackedUp = true;
+      if (process.platform !== "win32") fs.chmodSync(certBackup, 0o644);
+    }
+    fs.renameSync(keyTemp, ROOT_CA_KEY_PATH);
+    keyPublished = true;
+    fs.renameSync(certTemp, ROOT_CA_CERT_PATH);
+    certPublished = true;
+    if (process.platform !== "win32") {
+      fs.chmodSync(ROOT_CA_KEY_PATH, 0o600);
+      fs.chmodSync(ROOT_CA_CERT_PATH, 0o644);
+    }
+    fsyncMitmDirectory();
+    committed = true;
+  } catch (error) {
+    if (!committed) {
+      if (keyPublished) {
+        try { fs.unlinkSync(ROOT_CA_KEY_PATH); } catch { /* ignore rollback cleanup */ }
+      }
+      if (certPublished) {
+        try { fs.unlinkSync(ROOT_CA_CERT_PATH); } catch { /* ignore rollback cleanup */ }
+      }
+      if (keyBackedUp) {
+        try { fs.renameSync(keyBackup, ROOT_CA_KEY_PATH); } catch { /* preserve original error */ }
+      }
+      if (certBackedUp) {
+        try { fs.renameSync(certBackup, ROOT_CA_CERT_PATH); } catch { /* preserve original error */ }
+      }
+      try { fsyncMitmDirectory(); } catch { /* preserve original error */ }
+    }
+    throw error;
+  } finally {
+    if (keyTemp) {
+      try { fs.unlinkSync(keyTemp); } catch { /* already published or absent */ }
+    }
+    if (certTemp) {
+      try { fs.unlinkSync(certTemp); } catch { /* already published or absent */ }
+    }
+  }
+
+  try {
+    const cleanupFailures = [];
+    for (const [backupPath, existed] of [[keyBackup, keyBackedUp], [certBackup, certBackedUp]]) {
+      if (!existed) continue;
+      try {
+        fs.unlinkSync(backupPath);
+      } catch (error) {
+        if (error.code !== "ENOENT") cleanupFailures.push(error);
+      }
+    }
+    if (cleanupFailures.length > 0) {
+      const error = new Error(`Root CA published but ${cleanupFailures.length} backup file(s) could not be removed`);
+      error.cause = cleanupFailures[0];
+      throw error;
+    }
+    fsyncMitmDirectory();
+  } catch (error) {
+    // Publication is already durable. Callers rotating system trust must keep
+    // the old-certificate journal for every post-commit failure, including the
+    // final directory fsync.
+    error.rootCAPublished = true;
+    throw error;
+  }
+}
+
+function listRootCAArtifacts() {
+  if (!fs.existsSync(MITM_DIR)) return [];
+  return fs.readdirSync(MITM_DIR).flatMap((name) => {
+    const match = name.match(/^rootCA\.(key|crt)\.(.+)\.(bak|tmp)$/);
+    if (!match) return [];
+    const filePath = path.join(MITM_DIR, name);
+    const stat = fs.lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error(`Unsafe Root CA artifact path: ${filePath}`);
+    }
+    return [{ filePath, kind: match[1], generation: `${match[2]}.${match[3]}`, mtimeMs: stat.mtimeMs }];
+  });
+}
+
+function cleanupRootCAArtifacts(artifacts = listRootCAArtifacts()) {
+  const failures = [];
+  for (const artifact of artifacts) {
+    try {
+      if (process.platform !== "win32" && artifact.kind === "key") fs.chmodSync(artifact.filePath, 0o600);
+      fs.unlinkSync(artifact.filePath);
+    } catch (error) {
+      if (error.code !== "ENOENT") failures.push(error);
+    }
+  }
+  if (failures.length > 0) {
+    const error = new Error(`Failed to clean ${failures.length} Root CA recovery artifact(s)`);
+    error.cause = failures[0];
+    throw error;
   }
 }
 
 /**
- * Generate Root CA certificate (only once, auto-regenerate if expired)
- * This Root CA will sign all dynamic leaf certificates
+ * Recover a matching pair left by a process death between pair-publication
+ * steps. Normal readers hold the OS-backed Root CA lock while this runs.
  */
-function generateRootCA() {
-  const exists = fs.existsSync(ROOT_CA_KEY_PATH) && fs.existsSync(ROOT_CA_CERT_PATH);
-  if (exists && !isCertExpired(ROOT_CA_CERT_PATH)) {
-    console.log("✅ Root CA already exists");
-    return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
+function recoverRootCAState() {
+  const artifacts = listRootCAArtifacts();
+  if (artifacts.length === 0) return false;
+  if (hasValidRootCA()) {
+    cleanupRootCAArtifacts(artifacts);
+    return false;
   }
-  if (exists) {
-    console.log("🔐 Root CA expired or expiring soon — regenerating...");
-    try { fs.unlinkSync(ROOT_CA_KEY_PATH); } catch { /* ignore */ }
-    try { fs.unlinkSync(ROOT_CA_CERT_PATH); } catch { /* ignore */ }
+
+  const generations = new Map();
+  for (const artifact of artifacts) {
+    const entry = generations.get(artifact.generation) || { mtimeMs: 0 };
+    entry[artifact.kind] = artifact.filePath;
+    entry.mtimeMs = Math.max(entry.mtimeMs, artifact.mtimeMs);
+    generations.set(artifact.generation, entry);
   }
 
-  if (!fs.existsSync(MITM_DIR)) {
-    fs.mkdirSync(MITM_DIR, { recursive: true });
+  const liveKey = fs.existsSync(ROOT_CA_KEY_PATH) ? ROOT_CA_KEY_PATH : null;
+  const liveCert = fs.existsSync(ROOT_CA_CERT_PATH) ? ROOT_CA_CERT_PATH : null;
+  const candidate = [...generations.values()]
+    .map((entry) => ({
+      key: entry.key || liveKey,
+      cert: entry.crt || liveCert,
+      mtimeMs: entry.mtimeMs,
+    }))
+    .filter((entry) => entry.key && entry.cert && rootCAFilesMatchPaths(entry.key, entry.cert))
+    .sort((left, right) => right.mtimeMs - left.mtimeMs)[0];
+
+  if (candidate) {
+    publishRootCAPair(
+      fs.readFileSync(candidate.key, "utf8"),
+      fs.readFileSync(candidate.cert, "utf8"),
+    );
   }
+  cleanupRootCAArtifacts();
+  return Boolean(candidate);
+}
 
-  console.log("🔐 Generating Root CA certificate...");
+/**
+ * Check if cert file is expired or expiring within 30 days
+ */
+function isCertExpired(certPath) {
+  try {
+    const cert = forge.pki.certificateFromPem(fs.readFileSync(certPath, "utf8"));
+    const expiryThreshold = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
+    return cert.validity.notAfter < expiryThreshold;
+  } catch {
+    return true; // treat unreadable cert as expired
+  }
+}
 
+function createRootCAMaterial() {
   // Generate RSA key pair
   const keys = forge.pki.rsa.generateKeyPair(2048);
 
@@ -81,14 +300,54 @@ function generateRootCA() {
   // Self-sign the certificate
   cert.sign(keys.privateKey, forge.md.sha256.create());
 
-  // Save to disk
-  const privateKeyPem = forge.pki.privateKeyToPem(keys.privateKey);
-  const certPem = forge.pki.certificateToPem(cert);
+  return {
+    privateKeyPem: forge.pki.privateKeyToPem(keys.privateKey),
+    certPem: forge.pki.certificateToPem(cert),
+  };
+}
 
-  fs.writeFileSync(ROOT_CA_KEY_PATH, privateKeyPem);
-  fs.writeFileSync(ROOT_CA_CERT_PATH, certPem);
+function secureExistingRootCA() {
+  ensurePrivateDirectory();
+  assertRegularFileOrMissing(ROOT_CA_KEY_PATH);
+  assertRegularFileOrMissing(ROOT_CA_CERT_PATH);
+  if (process.platform !== "win32") {
+    fs.chmodSync(ROOT_CA_KEY_PATH, 0o600);
+    fs.chmodSync(ROOT_CA_CERT_PATH, 0o644);
+  }
+}
+
+function ensureRootCAInternal({ existingMessage, generatingMessage, successMessage }) {
+  ensurePrivateDirectory();
+  assertRegularFileOrMissing(ROOT_CA_KEY_PATH);
+  assertRegularFileOrMissing(ROOT_CA_CERT_PATH);
+  recoverRootCAState();
+  assertRegularFileOrMissing(ROOT_CA_KEY_PATH);
+  assertRegularFileOrMissing(ROOT_CA_CERT_PATH);
+
+  if (hasValidRootCA()) {
+    secureExistingRootCA();
+    if (existingMessage) console.log(existingMessage);
+    return false;
+  }
 
-  console.log("✅ Root CA generated successfully");
+  if (generatingMessage) console.log(generatingMessage);
+  const { privateKeyPem, certPem } = createRootCAMaterial();
+  publishRootCAPair(privateKeyPem, certPem);
+  if (!hasValidRootCA()) throw new Error("Generated Root CA key and certificate do not match");
+  if (successMessage) console.log(successMessage);
+  return true;
+}
+
+/**
+ * Generate Root CA certificate (only once, auto-regenerate if expired).
+ * This Root CA will sign all dynamic leaf certificates.
+ */
+function generateRootCA() {
+  ensureRootCAInternal({
+    existingMessage: "✅ Root CA already exists",
+    generatingMessage: "🔐 Generating Root CA certificate...",
+    successMessage: "✅ Root CA generated successfully",
+  });
   return { key: ROOT_CA_KEY_PATH, cert: ROOT_CA_CERT_PATH };
 }
 
@@ -171,49 +430,10 @@ function generateLeafCert(domain, rootCA) {
  * still valid, throws on failure.
  */
 function ensureRootCASync() {
-  const exists = fs.existsSync(ROOT_CA_KEY_PATH) && fs.existsSync(ROOT_CA_CERT_PATH);
-  if (exists && !isCertExpired(ROOT_CA_CERT_PATH)) return false;
-
-  if (exists) {
-    console.log("[MITM] Root CA expired or expiring soon — regenerating...");
-    try { fs.unlinkSync(ROOT_CA_KEY_PATH); } catch { /* ignore */ }
-    try { fs.unlinkSync(ROOT_CA_CERT_PATH); } catch { /* ignore */ }
-  } else {
-    console.log("[MITM] Root CA not found — generating now...");
-  }
-
-  if (!fs.existsSync(MITM_DIR)) {
-    fs.mkdirSync(MITM_DIR, { recursive: true });
-  }
-
-  const keys = forge.pki.rsa.generateKeyPair(2048);
-
-  const cert = forge.pki.createCertificate();
-  cert.publicKey = keys.publicKey;
-  cert.serialNumber = "01";
-  cert.validity.notBefore = new Date();
-  cert.validity.notAfter = new Date();
-  cert.validity.notAfter.setFullYear(cert.validity.notBefore.getFullYear() + 10);
-
-  const attrs = [
-    { name: "commonName", value: "9Router MITM Root CA" },
-    { name: "organizationName", value: "9Router" },
-    { name: "countryName", value: "US" }
-  ];
-  cert.setSubject(attrs);
-  cert.setIssuer(attrs);
-  cert.setExtensions([
-    { name: "basicConstraints", cA: true, critical: true },
-    { name: "keyUsage", keyCertSign: true, cRLSign: true, critical: true },
-    { name: "subjectKeyIdentifier" }
-  ]);
-  cert.sign(keys.privateKey, forge.md.sha256.create());
-
-  fs.writeFileSync(ROOT_CA_KEY_PATH, forge.pki.privateKeyToPem(keys.privateKey));
-  fs.writeFileSync(ROOT_CA_CERT_PATH, forge.pki.certificateToPem(cert));
-
-  console.log("[MITM] Root CA generated successfully");
-  return true;
+  return ensureRootCAInternal({
+    generatingMessage: "[MITM] Root CA missing, invalid, or expiring — generating now...",
+    successMessage: "[MITM] Root CA generated successfully",
+  });
 }
 
 module.exports = {
@@ -223,5 +443,6 @@ module.exports = {
   generateLeafCert,
   isCertExpired,
   ROOT_CA_CERT_PATH,
-  ROOT_CA_KEY_PATH
+  ROOT_CA_KEY_PATH,
+  hasValidRootCA,
 };
diff --git a/src/mitm/config.js b/src/mitm/config.js
index e109ec956..03802183b 100644
--- a/src/mitm/config.js
+++ b/src/mitm/config.js
@@ -1,16 +1,20 @@
 // All intercepted domains + URL patterns per tool
 
-const fs = require("fs");
+const { resolveTrustedUnixBinary } = require("./trustedBinaries");
 
 const IS_DEV = process.env.NODE_ENV === "development";
+// Explicit argv marker survives sudo and esbuild's CommonJS wrapper, where
+// require.main may no longer identify the bundled MITM entry module.
+const MITM_ENTRY_ARG = "--durindoor-mitm-entry";
+// Loopback-only OS locks disappear automatically when their owner exits.
+const MITM_START_LOCK_PORT = 20443;
+const ROOT_CA_LOCK_PORT = 20444;
+const MITM_NODE_PORT = 8443;
 
 // Resolve lsof absolute path — packaged apps / sudo secure_path may strip /usr/sbin from PATH
 const LSOF_BIN = (() => {
   if (process.platform === "win32") return null;
-  for (const p of ["/usr/sbin/lsof", "/usr/bin/lsof", "/sbin/lsof"]) {
-    try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { /* try next */ }
-  }
-  return "lsof"; // last-resort fallback (depends on PATH)
+  return resolveTrustedUnixBinary("lsof", { required: false });
 })();
 
 const TARGET_HOSTS = [
@@ -86,4 +90,4 @@ function getToolForHost(host) {
   return null;
 }
 
-module.exports = { IS_DEV, LSOF_BIN, TARGET_HOSTS, URL_PATTERNS, MODEL_SYNONYMS, MODEL_PATTERNS, MODEL_NO_MAP, LOG_BLACKLIST_URL_PARTS, getToolForHost };
+module.exports = { IS_DEV, LSOF_BIN, MITM_ENTRY_ARG, MITM_START_LOCK_PORT, ROOT_CA_LOCK_PORT, MITM_NODE_PORT, TARGET_HOSTS, URL_PATTERNS, MODEL_SYNONYMS, MODEL_PATTERNS, MODEL_NO_MAP, LOG_BLACKLIST_URL_PARTS, getToolForHost };
diff --git a/src/mitm/controlProof.js b/src/mitm/controlProof.js
new file mode 100644
index 000000000..b24fe0cdf
--- /dev/null
+++ b/src/mitm/controlProof.js
@@ -0,0 +1,53 @@
+const crypto = require("crypto");
+
+const CONTROL_SECRET_ENV = "DURINDOOR_CONTROL_PROOF_SECRET";
+const CONTROL_PROOF_HEADER = "x-9r-owner-proof";
+const CONTROL_PORT_HEADER = "x-9r-owner-port";
+
+function normalizeMethod(method) {
+  return String(method || "GET").toUpperCase();
+}
+
+function normalizePathname(value) {
+  try {
+    return new URL(String(value || "/"), "http://localhost").pathname;
+  } catch {
+    return "/";
+  }
+}
+
+function normalizePort(port) {
+  const value = Number(port);
+  return Number.isSafeInteger(value) && value > 0 && value <= 65535 ? value : null;
+}
+
+function proofPayload({ method, pathname, remotePort }) {
+  const port = normalizePort(remotePort);
+  if (!port) return null;
+  return `${normalizeMethod(method)}\n${normalizePathname(pathname)}\n${port}`;
+}
+
+function isValidSecret(secret) {
+  return typeof secret === "string" && /^[a-f0-9]{64,128}$/i.test(secret);
+}
+
+function createControlProof({ method, pathname, remotePort, secret = process.env[CONTROL_SECRET_ENV] }) {
+  const payload = proofPayload({ method, pathname, remotePort });
+  if (!payload || !isValidSecret(secret)) return null;
+  return crypto.createHmac("sha256", secret).update(payload).digest("hex");
+}
+
+function verifyControlProof({ method, pathname, remotePort, proof, secret = process.env[CONTROL_SECRET_ENV] }) {
+  if (!/^[a-f0-9]{64}$/i.test(String(proof || ""))) return false;
+  const expected = createControlProof({ method, pathname, remotePort, secret });
+  if (!expected) return false;
+  return crypto.timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(String(proof), "hex"));
+}
+
+module.exports = {
+  CONTROL_PORT_HEADER,
+  CONTROL_PROOF_HEADER,
+  CONTROL_SECRET_ENV,
+  createControlProof,
+  verifyControlProof,
+};
diff --git a/src/mitm/dns/dnsConfig.js b/src/mitm/dns/dnsConfig.js
index ae1568a8d..3c681efe8 100644
--- a/src/mitm/dns/dnsConfig.js
+++ b/src/mitm/dns/dnsConfig.js
@@ -1,57 +1,43 @@
-const { exec, spawn, execSync } = require("child_process");
+const { spawn, execFileSync } = require("child_process");
 const fs = require("fs");
 const path = require("path");
 const os = require("os");
+const crypto = require("crypto");
 const { log, err } = require("../logger");
 const { TOOL_HOSTS } = require("../../shared/constants/mitmToolHosts.js");
-const { runElevatedPowerShell, isAdmin } = require("../winElevated.js");
-
-/**
- * Atomic-ish write for Windows hosts file with rollback on failure.
- * Strategy: write `.new` sibling → rename current to `.bak` → rename `.new` to target.
- * If anything fails mid-way, restore from `.bak`. Same-volume renames are atomic on NTFS.
- */
-function atomicWriteHostsWin(target, originalContent, newContent) {
-  const tmpNew = `${target}.9router.new`;
-  const tmpBak = `${target}.9router.bak`;
-  try {
-    fs.writeFileSync(tmpNew, newContent, "utf8");
-    try { fs.unlinkSync(tmpBak); } catch { /* none */ }
-    fs.renameSync(target, tmpBak);
-    try {
-      fs.renameSync(tmpNew, target);
-    } catch (e) {
-      // Rollback: restore original
-      try { fs.renameSync(tmpBak, target); } catch { fs.writeFileSync(target, originalContent, "utf8"); }
-      throw e;
-    }
-    try { fs.unlinkSync(tmpBak); } catch { /* best effort */ }
-  } finally {
-    try { fs.unlinkSync(tmpNew); } catch { /* already moved or never created */ }
-  }
-}
+const { runElevatedPowerShell, quotePs } = require("../winElevated.js");
+const {
+  FIXED_UNIX_PATH,
+  WINDOWS_SYSTEM_ROOT,
+  resolveTrustedUnixBinary,
+  resolveWindowsSystemBinary,
+} = require("../trustedBinaries.js");
 
 const IS_WIN = process.platform === "win32";
 const IS_MAC = process.platform === "darwin";
 const HOSTS_FILE = IS_WIN
-  ? path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts")
+  ? path.win32.join(WINDOWS_SYSTEM_ROOT, "System32", "drivers", "etc", "hosts")
   : "/etc/hosts";
+const OWNED_HOSTS_TAG = "durindoor-mitm";
+
+function quoteSh(value) {
+  return `'${String(value).replace(/'/g, `'"'"'`)}'`;
+}
 
 /** True when `sudo` exists (e.g. missing on minimal Docker images like Alpine). */
 function isSudoAvailable() {
   if (IS_WIN) return false;
-  try {
-    execSync("command -v sudo", { stdio: "ignore", windowsHide: true });
-    return true;
-  } catch {
-    return false;
-  }
+  return Boolean(resolveTrustedUnixBinary("sudo", { required: false }));
 }
 
 function canRunSudoWithoutPassword() {
   if (IS_WIN || !isSudoAvailable()) return true;
   try {
-    execSync("sudo -n true", { stdio: "ignore", windowsHide: true });
+    execFileSync(resolveTrustedUnixBinary("sudo"), ["-n", "true"], {
+      stdio: "ignore",
+      windowsHide: true,
+      env: { PATH: FIXED_UNIX_PATH, LANG: "C", LC_ALL: "C" },
+    });
     return true;
   } catch {
     return false;
@@ -66,21 +52,64 @@ function isSudoPasswordRequired() {
  * Execute command with sudo password via stdin (macOS/Linux only).
  * Without sudo in PATH (containers), runs via sh — same user, no elevation.
  */
-function execWithPassword(command, password) {
+function execWithPassword(command, password, { timeoutMs = 30000 } = {}) {
   return new Promise((resolve, reject) => {
-    const useSudo = isSudoAvailable();
+    const sudoBin = resolveTrustedUnixBinary("sudo", { required: false });
+    const shellBin = resolveTrustedUnixBinary("sh");
+    const useSudo = Boolean(sudoBin);
+    const trustedCommand = `PATH=${FIXED_UNIX_PATH}; export PATH; ${command}`;
+    const childOptions = {
+      stdio: useSudo ? ["pipe", "pipe", "pipe"] : ["ignore", "pipe", "pipe"],
+      windowsHide: true,
+      detached: !IS_WIN,
+      env: { PATH: FIXED_UNIX_PATH, LANG: "C", LC_ALL: "C" },
+    };
     const child = useSudo
-      ? spawn("sudo", ["-S", "sh", "-c", command], { stdio: ["pipe", "pipe", "pipe"], windowsHide: true })
-      : spawn("sh", ["-c", command], { stdio: ["ignore", "pipe", "pipe"], windowsHide: true });
+      ? spawn(sudoBin, ["-H", "-S", shellBin, "-c", trustedCommand], childOptions)
+      : spawn(shellBin, ["-c", trustedCommand], childOptions);
 
     let stdout = "";
     let stderr = "";
+    let settled = false;
+    let timedOut = false;
+    let forceTimer = null;
+    let abandonTimer = null;
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(forceTimer);
+      clearTimeout(abandonTimer);
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try { process.kill(-child.pid, "SIGTERM"); } catch {
+        try { child.kill("SIGTERM"); } catch { /* the child may already have exited */ }
+      }
+      forceTimer = setTimeout(() => {
+        try { process.kill(-child.pid, "SIGKILL"); } catch {
+          try { child.kill("SIGKILL"); } catch { /* the child may already have exited */ }
+        }
+      }, 500);
+      abandonTimer = setTimeout(() => {
+        const error = new Error(`Privileged command timed out after ${timeoutMs}ms and process-tree termination was not confirmed`);
+        error.code = "PRIVILEGED_TERMINATION_UNCONFIRMED";
+        finish(error);
+      }, 5000);
+    }, timeoutMs);
     child.stdout.on("data", (d) => { stdout += d; });
     child.stderr.on("data", (d) => { stderr += d; });
+    child.on("error", (error) => finish(error));
 
     child.on("close", (code) => {
-      if (code === 0) resolve(stdout);
-      else reject(new Error(stderr || `Exit code ${code}`));
+      if (timedOut) {
+        finish(new Error(`Privileged command timed out after ${timeoutMs}ms`));
+        return;
+      }
+      if (code === 0) finish(null, stdout);
+      else finish(new Error(stderr || `Exit code ${code}`));
     });
 
     if (useSudo) {
@@ -90,6 +119,153 @@ function execWithPassword(command, password) {
   });
 }
 
+/**
+ * Build a complete elevated Windows hosts-file mutation. The unelevated parent
+ * only reads the file for status; every write and DNS flush runs in the narrow
+ * UAC child.
+ */
+function buildWindowsHostsMutationScript({
+  action,
+  hosts = [],
+  tag = null,
+  ownedEntries = null,
+  hostsFile = HOSTS_FILE,
+  expectedSha256,
+}) {
+  if (!["add", "remove", "adopt-legacy", "remove-legacy"].includes(action)) throw new Error(`Unsupported hosts action: ${action}`);
+  if (!/^[a-f0-9]{64}$/.test(expectedSha256 || "")) throw new Error("A valid hosts snapshot digest is required");
+  const entries = ownedEntries || hosts.map((host) => ({ host, tag }));
+  if (entries.some((entry) => !entry.tag || !/^[a-z0-9_-]+$/i.test(entry.tag))) {
+    throw new Error("A safe DurinDoor hosts ownership tag is required");
+  }
+  const entryLiterals = entries
+    .map((entry) => `@{ Host = ${quotePs(entry.host)}; Tag = ${quotePs(entry.tag)} }`)
+    .join(", ");
+  const mutation = action === "add"
+    ? String.raw`
+      foreach ($entry in $entries) {
+        $foreign = @($lines | Where-Object {
+          (Test-ExactHostLine $_ $entry.Host) -and -not (Test-OwnedHostLine $_ $entry.Host $entry.Tag)
+        })
+        if ($foreign.Count -gt 0) { throw "Foreign hosts mapping exists for $($entry.Host)" }
+        if (-not ($lines | Where-Object { Test-OwnedHostLine $_ $entry.Host $entry.Tag })) {
+          $lines += "127.0.0.1 $($entry.Host) # ${OWNED_HOSTS_TAG}:$($entry.Tag)"
+        }
+      }
+    `
+    : action === "remove" ? String.raw`
+      $lines = @($lines | Where-Object {
+        $line = $_
+        -not ($entries | Where-Object { Test-OwnedHostLine $line $_.Host $_.Tag })
+      })
+    ` : action === "adopt-legacy" ? String.raw`
+      $lines = @($lines | ForEach-Object {
+        $line = $_
+        $entry = $entries | Where-Object { Test-LegacyHostLine $line $_.Host } | Select-Object -First 1
+        if ($null -ne $entry) { "127.0.0.1 $($entry.Host) # ${OWNED_HOSTS_TAG}:$($entry.Tag)" } else { $line }
+      })
+    ` : String.raw`
+      $lines = @($lines | Where-Object {
+        $line = $_
+        -not ($entries | Where-Object { Test-LegacyHostLine $line $_.Host })
+      })
+    `;
+
+  const ipconfigPath = resolveWindowsSystemBinary("ipconfig.exe", { verify: IS_WIN });
+  return String.raw`
+    $ErrorActionPreference = 'Stop'
+    $path = ${quotePs(hostsFile)}
+    $expectedSha256 = ${quotePs(expectedSha256)}
+    $entries = @(${entryLiterals})
+    function Get-FileSha256([string] $filePath) {
+      $algorithm = [System.Security.Cryptography.SHA256]::Create()
+      try {
+        return ([System.BitConverter]::ToString($algorithm.ComputeHash([System.IO.File]::ReadAllBytes($filePath)))).Replace('-', '').ToLowerInvariant()
+      } finally { $algorithm.Dispose() }
+    }
+    function Test-ExactHostLine([string] $line, [string] $hostName) {
+      $withoutComment = ($line -split '#', 2)[0].Trim()
+      if (-not $withoutComment) { return $false }
+      $fields = @($withoutComment -split '\s+' | Where-Object { $_ })
+      if ($fields.Count -lt 2) { return $false }
+      return @($fields[1..($fields.Count - 1)]) -contains $hostName
+    }
+    function Test-OwnedHostLine([string] $line, [string] $hostName, [string] $tag) {
+      $parts = $line -split '#', 2
+      if ($parts.Count -ne 2 -or $parts[1].Trim() -ne "${OWNED_HOSTS_TAG}:$tag") { return $false }
+      $fields = @($parts[0].Trim() -split '\s+' | Where-Object { $_ })
+      return $fields.Count -eq 2 -and $fields[0] -eq '127.0.0.1' -and $fields[1] -eq $hostName
+    }
+    function Test-LegacyHostLine([string] $line, [string] $hostName) {
+      if ($line -match '#') { return $false }
+      $fields = @($line.Trim() -split '\s+' | Where-Object { $_ })
+      return $fields.Count -eq 2 -and $fields[0] -eq '127.0.0.1' -and $fields[1] -eq $hostName
+    }
+    $sourceBytes = [System.IO.File]::ReadAllBytes($path)
+    $algorithm = [System.Security.Cryptography.SHA256]::Create()
+    try {
+      $sourceSha256 = ([System.BitConverter]::ToString($algorithm.ComputeHash($sourceBytes))).Replace('-', '').ToLowerInvariant()
+    } finally { $algorithm.Dispose() }
+    if ($sourceSha256 -ne $expectedSha256) { throw 'Hosts file changed before mutation' }
+    $content = [System.Text.Encoding]::UTF8.GetString($sourceBytes)
+    $lines = @($content -split '\r?\n')
+    ${mutation}
+    $eol = [Environment]::NewLine
+    $next = (($lines -join $eol).TrimEnd()) + $eol
+    $committedBackup = $null
+    if ($next -ne $content) {
+      $suffix = [Guid]::NewGuid().ToString('N')
+      $temp = "$path.durindoor.$suffix.tmp"
+      $backup = "$path.durindoor.$suffix.bak"
+      $published = $false
+      try {
+        [System.IO.File]::WriteAllText($temp, $next, [System.Text.UTF8Encoding]::new($false))
+        $tempStream = [System.IO.File]::Open(
+          $temp,
+          [System.IO.FileMode]::Open,
+          [System.IO.FileAccess]::ReadWrite,
+          [System.IO.FileShare]::Read
+        )
+        try { $tempStream.Flush($true) } finally { $tempStream.Dispose() }
+        if ([System.IO.File]::ReadAllText($temp) -ne $next) {
+          throw 'DurinDoor hosts temp-file verification failed'
+        }
+        if ((Get-FileSha256 $path) -ne $expectedSha256) {
+          throw 'Hosts file changed during mutation'
+        }
+        [System.IO.File]::Replace($temp, $path, $backup, $true)
+        $published = $true
+        if ([System.IO.File]::ReadAllText($path) -ne $next) {
+          [System.IO.File]::Replace($backup, $path, $null, $true)
+          $published = $false
+          throw 'DurinDoor hosts publication verification failed; original restored'
+        }
+        $published = $false
+      } finally {
+        Remove-Item -LiteralPath $temp -Force -ErrorAction SilentlyContinue
+        if ($published -and (Test-Path -LiteralPath $backup)) {
+          [System.IO.File]::Replace($backup, $path, $null, $true)
+          $published = $false
+        }
+      }
+      $committedBackup = $backup
+    }
+    try {
+      & ${quotePs(ipconfigPath)} /flushdns | Out-Null
+      if ($LASTEXITCODE -ne 0) { throw "ipconfig /flushdns failed with exit $LASTEXITCODE" }
+    } catch {
+      if ($null -ne $committedBackup -and (Test-Path -LiteralPath $committedBackup)) {
+        [System.IO.File]::Replace($committedBackup, $path, $null, $true)
+        $committedBackup = $null
+      }
+      throw
+    }
+    if ($null -ne $committedBackup) {
+      Remove-Item -LiteralPath $committedBackup -Force -ErrorAction Stop
+    }
+  `;
+}
+
 /**
  * Trim trailing blank lines/whitespace, ensure file ends with exactly one newline.
  */
@@ -98,6 +274,170 @@ function normalizeHostsContent(content) {
   return content.replace(/[\r\n\s]+$/g, "") + eol;
 }
 
+function lineHasExactHost(line, host) {
+  const withoutComment = String(line || "").split("#", 1)[0].trim();
+  if (!withoutComment) return false;
+  const fields = withoutComment.split(/\s+/).filter(Boolean);
+  return fields.length >= 2 && fields.slice(1).includes(host);
+}
+
+function lineHasOwnedHost(line, host, tag = null) {
+  const parts = String(line || "").split("#", 2);
+  if (parts.length !== 2) return false;
+  const comment = parts[1].trim();
+  if (tag ? comment !== `${OWNED_HOSTS_TAG}:${tag}` : !comment.startsWith(`${OWNED_HOSTS_TAG}:`)) return false;
+  const fields = parts[0].trim().split(/\s+/).filter(Boolean);
+  return fields.length === 2 && fields[0] === "127.0.0.1" && fields[1] === host;
+}
+
+function lineHasLegacyOwnedHost(line, host) {
+  const value = String(line || "");
+  if (value.includes("#")) return false;
+  const fields = value.trim().split(/\s+/).filter(Boolean);
+  return fields.length === 2 && fields[0] === "127.0.0.1" && fields[1] === host;
+}
+
+function readHostsSnapshot(hostsFile = HOSTS_FILE) {
+  const pathStat = fs.lstatSync(hostsFile);
+  if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
+    throw new Error(`Unsafe hosts file path: ${hostsFile}`);
+  }
+  const fd = fs.openSync(hostsFile, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+  try {
+    const fdStat = fs.fstatSync(fd);
+    if (!fdStat.isFile()
+      || String(fdStat.dev) !== String(pathStat.dev)
+      || String(fdStat.ino) !== String(pathStat.ino)) {
+      throw new Error(`Hosts file changed while opening: ${hostsFile}`);
+    }
+    const bytes = fs.readFileSync(fd);
+    return { bytes, sha256: crypto.createHash("sha256").update(bytes).digest("hex") };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+function buildUnixHostsMutationCommand({ currentSha256, nextBytes, hostsFile = HOSTS_FILE, isMac = IS_MAC }) {
+  if (!/^[a-f0-9]{64}$/.test(currentSha256)) throw new Error("Invalid hosts snapshot digest");
+  const nextBase64 = Buffer.from(nextBytes).toString("base64");
+  const nextSha256 = crypto.createHash("sha256").update(nextBytes).digest("hex");
+  const hash = isMac
+    ? `shasum -a 256 -- "$path" | awk '{print $1}'`
+    : `sha256sum -- "$path" | awk '{print $1}'`;
+  const decodeFlag = isMac ? "-D" : "-d";
+  const preserveCopy = isMac ? "cp -p" : "cp --preserve=all";
+  return `
+    set -eu
+    umask 077
+    path=${quoteSh(hostsFile)}
+    [ -f "$path" ] && [ ! -L "$path" ] || { echo 'Unsafe hosts file path' >&2; exit 72; }
+    current_hash=$(${hash})
+    [ "$current_hash" = ${quoteSh(currentSha256)} ] || { echo 'Hosts file changed before mutation' >&2; exit 73; }
+    dir=\${path%/*}
+    temp=$(mktemp "$dir/.durindoor-hosts.XXXXXX")
+    backup=$(mktemp "$dir/.durindoor-hosts-backup.XXXXXX")
+    published=0
+    cleanup() {
+      if [ "$published" -eq 1 ] && [ -f "$backup" ]; then mv -f -- "$backup" "$path" || true; fi
+      rm -f -- "$temp" "$backup"
+    }
+    trap cleanup EXIT HUP INT TERM
+    ${preserveCopy} -- "$path" "$temp"
+    ${preserveCopy} -- "$path" "$backup"
+    printf '%s' ${quoteSh(nextBase64)} | base64 ${decodeFlag} > "$temp"
+    sync
+    [ "$(${isMac ? `shasum -a 256 -- "$temp" | awk '{print $1}'` : `sha256sum -- "$temp" | awk '{print $1}'`})" = ${quoteSh(nextSha256)} ] || { echo 'Hosts temp verification failed' >&2; exit 74; }
+    [ "$(${hash})" = ${quoteSh(currentSha256)} ] || { echo 'Hosts file changed during mutation' >&2; exit 73; }
+    mv -f -- "$temp" "$path"
+    published=1
+    sync
+    [ "$(${hash})" = ${quoteSh(nextSha256)} ] || { echo 'Hosts publication verification failed' >&2; exit 75; }
+    published=0
+    rm -f -- "$backup"
+  `;
+}
+
+async function mutateUnixHosts(
+  nextContent,
+  sudoPassword,
+  snapshot = readHostsSnapshot(),
+  execute = execWithPassword,
+) {
+  const nextBytes = Buffer.from(nextContent, "utf8");
+  if (snapshot.bytes.equals(nextBytes)) return false;
+  await execute(buildUnixHostsMutationCommand({
+    currentSha256: snapshot.sha256,
+    nextBytes,
+  }), sudoPassword);
+  return true;
+}
+
+async function commitUnixHostsAndFlush(
+  nextContent,
+  sudoPassword,
+  snapshot,
+  { mutate = mutateUnixHosts, flush = flushDNS } = {},
+) {
+  const changed = await mutate(nextContent, sudoPassword, snapshot);
+  if (!changed) return false;
+  try {
+    await flush(sudoPassword);
+  } catch (error) {
+    // Roll back only if the hosts file still equals the content just committed.
+    // mutateUnixHosts' digest checks preserve any concurrent administrator edit.
+    const committedBytes = Buffer.from(nextContent, "utf8");
+    const committedSnapshot = {
+      bytes: committedBytes,
+      sha256: crypto.createHash("sha256").update(committedBytes).digest("hex"),
+    };
+    try {
+      await mutate(snapshot.bytes.toString("utf8"), sudoPassword, committedSnapshot);
+    } catch (rollbackError) {
+      error.rollbackError = rollbackError;
+    }
+    throw error;
+  }
+  return true;
+}
+
+async function reconcileLegacyDNSEntries({ action, tool = null }, sudoPassword) {
+  if (action !== "adopt-legacy" && action !== "remove-legacy") throw new Error("Invalid legacy DNS reconciliation action");
+  const selected = tool ? { [tool]: TOOL_HOSTS[tool] } : TOOL_HOSTS;
+  if (tool && !selected[tool]) throw new Error(`Unknown tool: ${tool}`);
+  const ownedEntries = Object.entries(selected).flatMap(([tag, hosts]) =>
+    hosts.map((host) => ({ host, tag }))
+  );
+  const snapshot = readHostsSnapshot();
+  const current = snapshot.bytes.toString("utf8");
+  const hasLegacy = ownedEntries.some(({ host }) => current.split(/\r?\n/).some((line) => lineHasLegacyOwnedHost(line, host)));
+  if (!hasLegacy) return false;
+  if (IS_WIN) {
+    await runElevatedPowerShell(buildWindowsHostsMutationScript({
+      action,
+      ownedEntries,
+      expectedSha256: snapshot.sha256,
+    }));
+  } else {
+    const nextLines = current.split(/\r?\n/).flatMap((line) => {
+      const entry = ownedEntries.find(({ host }) => lineHasLegacyOwnedHost(line, host));
+      if (!entry) return [line];
+      return action === "adopt-legacy"
+        ? [`127.0.0.1 ${entry.host} # ${OWNED_HOSTS_TAG}:${entry.tag}`]
+        : [];
+    });
+    await commitUnixHostsAndFlush(normalizeHostsContent(nextLines.join("\n")), sudoPassword, snapshot);
+  }
+  return true;
+}
+
+function adoptLegacyDNSEntries(tool, sudoPassword) {
+  return reconcileLegacyDNSEntries({ action: "adopt-legacy", tool }, sudoPassword);
+}
+
+function removeLegacyDNSEntries(sudoPassword) {
+  return reconcileLegacyDNSEntries({ action: "remove-legacy" }, sudoPassword);
+}
+
 /**
  * Flush DNS cache (macOS/Linux)
  */
@@ -113,12 +453,12 @@ async function flushDNS(sudoPassword) {
 /**
  * Check if DNS entry exists for a specific host
  */
-function checkDNSEntry(host = null) {
+function checkDNSEntry(host = null, tag = null) {
   try {
     const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
-    if (host) return hostsContent.includes(host);
+    if (host) return hostsContent.split(/\r?\n/).some((line) => lineHasOwnedHost(line, host, tag));
     // Legacy: check all antigravity hosts (backward compat)
-    return TOOL_HOSTS.antigravity.every(h => hostsContent.includes(h));
+    return TOOL_HOSTS.antigravity.every(h => hostsContent.split(/\r?\n/).some((line) => lineHasOwnedHost(line, h, "antigravity")));
   } catch {
     return false;
   }
@@ -132,7 +472,8 @@ function checkAllDNSStatus() {
     const hostsContent = fs.readFileSync(HOSTS_FILE, "utf8");
     const result = {};
     for (const [tool, hosts] of Object.entries(TOOL_HOSTS)) {
-      result[tool] = hosts.every(h => hostsContent.includes(h));
+      const lines = hostsContent.split(/\r?\n/);
+      result[tool] = hosts.every(h => lines.some((line) => lineHasOwnedHost(line, h, tool)));
     }
     return result;
   } catch {
@@ -147,7 +488,12 @@ async function addDNSEntry(tool, sudoPassword) {
   const hosts = TOOL_HOSTS[tool];
   if (!hosts) throw new Error(`Unknown tool: ${tool}`);
 
-  const entriesToAdd = hosts.filter(h => !checkDNSEntry(h));
+  const snapshot = readHostsSnapshot();
+  const current = snapshot.bytes.toString("utf8");
+  const currentLines = current.split(/\r?\n/);
+  const entriesToAdd = hosts.filter(h => !currentLines.some((line) => lineHasOwnedHost(line, h, tool)));
+  const foreign = entriesToAdd.find((host) => currentLines.some((line) => lineHasExactHost(line, host)));
+  if (foreign) throw new Error(`Foreign hosts mapping exists for ${foreign}; refusing to overwrite it`);
   if (entriesToAdd.length === 0) {
     log(`🌐 DNS ${tool}: already active`);
     return;
@@ -155,22 +501,17 @@ async function addDNSEntry(tool, sudoPassword) {
 
   try {
     if (IS_WIN) {
-      // Read → trim → append → atomic write (Node-side, no CLI size limit)
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
-      const trimmed = current.replace(/[\r\n\s]+$/g, "");
-      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\r\n");
-      const next = `${trimmed}\r\n${toAppend}\r\n`;
-      atomicWriteHostsWin(HOSTS_FILE, current, next);
-      await runElevatedPowerShell("ipconfig /flushdns | Out-Null");
+      await runElevatedPowerShell(buildWindowsHostsMutationScript({
+        action: "add",
+        hosts: entriesToAdd,
+        tag: tool,
+        expectedSha256: snapshot.sha256,
+      }));
     } else {
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
       const trimmed = current.replace(/[\r\n\s]+$/g, "");
-      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h}`).join("\n");
+      const toAppend = entriesToAdd.map(h => `127.0.0.1 ${h} # ${OWNED_HOSTS_TAG}:${tool}`).join("\n");
       const next = `${trimmed}\n${toAppend}\n`;
-      // Use tee via sudo to overwrite atomically — escape single quotes in content
-      const escaped = next.replace(/'/g, "'\\''");
-      await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
-      await flushDNS(sudoPassword);
+      await commitUnixHostsAndFlush(next, sudoPassword, snapshot);
     }
     log(`🌐 DNS ${tool}: ✅ added ${entriesToAdd.join(", ")}`);
   } catch (error) {
@@ -186,7 +527,10 @@ async function removeDNSEntry(tool, sudoPassword) {
   const hosts = TOOL_HOSTS[tool];
   if (!hosts) throw new Error(`Unknown tool: ${tool}`);
 
-  const entriesToRemove = hosts.filter(h => checkDNSEntry(h));
+  const snapshot = readHostsSnapshot();
+  const current = snapshot.bytes.toString("utf8");
+  const currentLines = current.split(/\r?\n/);
+  const entriesToRemove = hosts.filter(h => currentLines.some((line) => lineHasOwnedHost(line, h, tool)));
   if (entriesToRemove.length === 0) {
     log(`🌐 DNS ${tool}: already inactive`);
     return;
@@ -194,18 +538,16 @@ async function removeDNSEntry(tool, sudoPassword) {
 
   try {
     if (IS_WIN) {
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
-      const filtered = current.split(/\r?\n/).filter(l => !entriesToRemove.some(h => l.includes(h))).join("\r\n");
-      const next = filtered.replace(/[\r\n\s]+$/g, "") + "\r\n";
-      atomicWriteHostsWin(HOSTS_FILE, current, next);
-      await runElevatedPowerShell("ipconfig /flushdns | Out-Null");
+      await runElevatedPowerShell(buildWindowsHostsMutationScript({
+        action: "remove",
+        hosts: entriesToRemove,
+        tag: tool,
+        expectedSha256: snapshot.sha256,
+      }));
     } else {
-      const current = fs.readFileSync(HOSTS_FILE, "utf8");
-      const filtered = current.split(/\r?\n/).filter(l => !entriesToRemove.some(h => l.includes(h))).join("\n");
+      const filtered = current.split(/\r?\n/).filter(l => !entriesToRemove.some(h => lineHasOwnedHost(l, h, tool))).join("\n");
       const next = filtered.replace(/[\r\n\s]+$/g, "") + "\n";
-      const escaped = next.replace(/'/g, "'\\''");
-      await execWithPassword(`printf '%s' '${escaped}' | tee ${HOSTS_FILE} > /dev/null`, sudoPassword);
-      await flushDNS(sudoPassword);
+      await commitUnixHostsAndFlush(next, sudoPassword, snapshot);
     }
     log(`🌐 DNS ${tool}: ✅ removed ${entriesToRemove.join(", ")}`);
   } catch (error) {
@@ -218,13 +560,35 @@ async function removeDNSEntry(tool, sudoPassword) {
  * Remove ALL tool DNS entries (used when stopping server)
  */
 async function removeAllDNSEntries(sudoPassword) {
+  if (IS_WIN) {
+    const snapshot = readHostsSnapshot();
+    const lines = snapshot.bytes.toString("utf8").split(/\r?\n/);
+    const ownedEntries = Object.entries(TOOL_HOSTS).flatMap(([tag, hosts]) =>
+      hosts.filter((host) => lines.some((line) => lineHasOwnedHost(line, host, tag))).map((host) => ({ host, tag }))
+    );
+    if (ownedEntries.length > 0) {
+      await runElevatedPowerShell(buildWindowsHostsMutationScript({
+        action: "remove",
+        ownedEntries,
+        expectedSha256: snapshot.sha256,
+      }));
+    }
+    return;
+  }
+  const failures = [];
   for (const tool of Object.keys(TOOL_HOSTS)) {
     try {
       await removeDNSEntry(tool, sudoPassword);
     } catch (e) {
       err(`DNS ${tool}: failed to remove — ${e.message}`);
+      failures.push({ tool, error: e });
     }
   }
+  if (failures.length > 0) {
+    const error = new Error(`Failed to remove ${failures.length} MITM DNS entr${failures.length === 1 ? "y" : "ies"}`);
+    error.failures = failures;
+    throw error;
+  }
 }
 
 /**
@@ -232,35 +596,32 @@ async function removeAllDNSEntries(sudoPassword) {
  * when async ops aren't safe. Assumes caller already has root/admin rights.
  */
 function removeAllDNSEntriesSync() {
-  try {
-    if (!fs.existsSync(HOSTS_FILE)) return;
-    const allHosts = Object.values(TOOL_HOSTS).flat();
-    const content = fs.readFileSync(HOSTS_FILE, "utf8");
-    const eol = IS_WIN ? "\r\n" : "\n";
-    const filtered = content.split(/\r?\n/).filter(l => !allHosts.some(h => l.includes(h))).join(eol);
-    const next = filtered.replace(/[\r\n\s]+$/g, "") + eol;
-    if (next === content) return;
-    fs.writeFileSync(HOSTS_FILE, next, "utf8");
-    if (IS_WIN) {
-      try { execSync("ipconfig /flushdns", { windowsHide: true, stdio: "ignore" }); } catch { /* ignore */ }
-    } else if (IS_MAC) {
-      try { execSync("dscacheutil -flushcache && killall -HUP mDNSResponder", { stdio: "ignore" }); } catch { /* ignore */ }
-    } else {
-      try { execSync("resolvectl flush-caches 2>/dev/null || true", { stdio: "ignore" }); } catch { /* ignore */ }
-    }
-  } catch { /* best effort during shutdown */ }
+  // Deliberately inert. The unprivileged proxy cannot safely mutate a system
+  // hosts file during a synchronous exit hook; the owning manager performs the
+  // authenticated, privileged cleanup before terminating the worker.
+  return false;
 }
 
 module.exports = {
   TOOL_HOSTS,
   addDNSEntry,
+  adoptLegacyDNSEntries,
   removeDNSEntry,
   removeAllDNSEntries,
   removeAllDNSEntriesSync,
+  removeLegacyDNSEntries,
   execWithPassword,
+  buildUnixHostsMutationCommand,
+  buildWindowsHostsMutationScript,
   isSudoAvailable,
   canRunSudoWithoutPassword,
   isSudoPasswordRequired,
   checkDNSEntry,
   checkAllDNSStatus,
+  lineHasExactHost,
+  lineHasOwnedHost,
+  lineHasLegacyOwnedHost,
+  commitUnixHostsAndFlush,
+  mutateUnixHosts,
+  readHostsSnapshot,
 };
diff --git a/src/mitm/handlers/base.js b/src/mitm/handlers/base.js
index 5f2d3d126..dbacc3a16 100644
--- a/src/mitm/handlers/base.js
+++ b/src/mitm/handlers/base.js
@@ -6,21 +6,37 @@ const ROUTER_BASE = String(process.env.MITM_ROUTER_BASE || DEFAULT_LOCAL_ROUTER)
   .replace(/\/+$/, "") || DEFAULT_LOCAL_ROUTER;
 const API_KEY = process.env.ROUTER_API_KEY;
 
-// Headers that must not be forwarded to 9Router
-const STRIP_HEADERS = new Set([
-  "host", "content-length", "connection", "transfer-encoding",
-  "content-type", "authorization"
+// The intercepted client can carry upstream credentials in many non-standard
+// headers. Forward only harmless request metadata; DurinDoor supplies its own
+// content type and API authorization below.
+const FORWARDED_CLIENT_HEADERS = new Set([
+  "accept",
+  "accept-language",
+  "anthropic-beta",
+  "anthropic-version",
+  "openai-intent",
+  "user-agent",
+  "x-app",
+  "x-correlation-id",
+  "x-initiator",
+  "x-request-id",
 ]);
 
+function selectForwardedClientHeaders(clientHeaders = {}) {
+  const forwarded = {};
+  for (const [key, value] of Object.entries(clientHeaders || {})) {
+    if (value == null || !FORWARDED_CLIENT_HEADERS.has(key.toLowerCase())) continue;
+    forwarded[key] = Array.isArray(value) ? value.join(", ") : String(value);
+  }
+  return forwarded;
+}
+
 /**
  * Send body to 9Router at the given path and return the fetch Response object.
  * Optionally forwards client headers (stripped of hop-by-hop / overridden keys).
  */
 async function fetchRouter(openaiBody, path = "/v1/chat/completions", clientHeaders = {}) {
-  const forwarded = {};
-  for (const [k, v] of Object.entries(clientHeaders)) {
-    if (!STRIP_HEADERS.has(k.toLowerCase())) forwarded[k] = v;
-  }
+  const forwarded = selectForwardedClientHeaders(clientHeaders);
 
   const response = await fetch(`${ROUTER_BASE}${path}`, {
     method: "POST",
@@ -223,4 +239,10 @@ async function pipeTransformedEventStream(routerRes, res, transformFn, state) {
   res.end();
 }
 
-module.exports = { fetchRouter, pipeSSE, pipeTransformedSSE, pipeTransformedEventStream };
\ No newline at end of file
+module.exports = {
+  fetchRouter,
+  pipeSSE,
+  pipeTransformedSSE,
+  pipeTransformedEventStream,
+  selectForwardedClientHeaders,
+};
diff --git a/src/mitm/launchGate.js b/src/mitm/launchGate.js
new file mode 100644
index 000000000..bc0bef0b0
--- /dev/null
+++ b/src/mitm/launchGate.js
@@ -0,0 +1,68 @@
+const fs = require("fs");
+const path = require("path");
+const { readFileSnapshot, removeFileIfUnchanged } = require("./startLock");
+
+function fsyncDirectory(filePath, fsImpl = fs) {
+  if (process.platform === "win32") return;
+  const fd = fsImpl.openSync(path.dirname(filePath), "r");
+  try { fsImpl.fsyncSync(fd); } finally { fsImpl.closeSync(fd); }
+}
+
+function publishLaunchAuthorization(filePath, nonce, fsImpl = fs) {
+  if (!/^[a-f0-9]{48}$/.test(String(nonce || ""))) throw new Error("Invalid MITM launch nonce");
+  const fd = fsImpl.openSync(filePath, "wx", 0o600);
+  try {
+    fsImpl.writeFileSync(fd, `${nonce}\n`);
+    fsImpl.fsyncSync(fd);
+  } finally {
+    fsImpl.closeSync(fd);
+  }
+  if (process.platform !== "win32") fsImpl.chmodSync(filePath, 0o600);
+  fsyncDirectory(filePath, fsImpl);
+}
+
+function isParentAlive(pid, processImpl = process) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
+  try { processImpl.kill(pid, 0); return true; }
+  catch (error) { return error.code === "EPERM" || error.code === "EACCES"; }
+}
+
+async function waitForLaunchAuthorization({
+  filePath = process.env.MITM_LAUNCH_GATE_FILE,
+  nonce = process.env.MITM_INSTANCE_NONCE,
+  managerPid = Number(process.env.MITM_MANAGER_PID),
+  timeoutMs = 15000,
+  processImpl = process,
+  fsImpl = fs,
+} = {}) {
+  if (!filePath) throw new Error("MITM launch authorization file is required");
+  if (!/^[a-f0-9]{48}$/.test(String(nonce || ""))) {
+    throw new Error("MITM launch authorization nonce is invalid");
+  }
+  if (!Number.isSafeInteger(managerPid) || managerPid <= 0) {
+    throw new Error("MITM manager PID is invalid");
+  }
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (!isParentAlive(managerPid, processImpl)) {
+      throw new Error("MITM manager exited before authorizing child listen");
+    }
+    try {
+      const snapshot = readFileSnapshot(filePath, fsImpl);
+      if (snapshot.raw === `${nonce}\n`) {
+        if (!removeFileIfUnchanged(filePath, snapshot, fsImpl)) {
+          throw new Error("MITM launch authorization changed before consumption");
+        }
+        fsyncDirectory(filePath, fsImpl);
+        return true;
+      }
+      throw new Error("MITM launch authorization nonce mismatch");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  throw new Error("MITM launch authorization timed out");
+}
+
+module.exports = { isParentAlive, publishLaunchAuthorization, waitForLaunchAuthorization };
diff --git a/src/mitm/logger.js b/src/mitm/logger.js
index 34d43db4e..865bd83bd 100644
--- a/src/mitm/logger.js
+++ b/src/mitm/logger.js
@@ -3,6 +3,7 @@ const path = require("path");
 const zlib = require("zlib");
 const { DATA_DIR } = require("./paths");
 const { LOG_BLACKLIST_URL_PARTS } = require("./config");
+const { sanitizeHeaders } = require("./sanitizeHeaders");
 
 function time() {
   return new Date().toLocaleTimeString("en-US", { hour12: false });
@@ -12,12 +13,19 @@ const log = (msg) => console.log(`[${time()}] [MITM] ${msg}`);
 const err = (msg) => console.error(`[${time()}] ❌ [MITM] ${msg}`);
 
 const DUMP_DIR = path.join(DATA_DIR, "logs", "mitm");
-if (!fs.existsSync(DUMP_DIR)) fs.mkdirSync(DUMP_DIR, { recursive: true });
+
+function ensureDumpDir() {
+  if (!fs.existsSync(DUMP_DIR)) fs.mkdirSync(DUMP_DIR, { recursive: true });
+  const stat = fs.lstatSync(DUMP_DIR);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error(`Unsafe MITM dump directory: ${DUMP_DIR}`);
+}
 
 // Clear all files inside DUMP_DIR (called on MITM server start to avoid unbounded growth)
 function clearDumpDir() {
   try {
     if (!fs.existsSync(DUMP_DIR)) return;
+    const stat = fs.lstatSync(DUMP_DIR);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) return;
     for (const f of fs.readdirSync(DUMP_DIR)) {
       try { fs.rmSync(path.join(DUMP_DIR, f), { recursive: true, force: true }); } catch { /* ignore */ }
     }
@@ -47,20 +55,11 @@ function decodeBody(buf, encoding) {
   return buf;
 }
 
-const SENSITIVE_HEADERS = new Set(["set-cookie", "cookie", "authorization", "proxy-authorization"]);
-
-function sanitizeHeaders(headers) {
-  const copy = {};
-  for (const [k, v] of Object.entries(headers || {})) {
-    copy[k] = SENSITIVE_HEADERS.has(k.toLowerCase()) ? "[REDACTED]" : v;
-  }
-  return copy;
-}
-
 // Save raw request: method + url + headers + body
 function dumpRequest(req, bodyBuffer, tag = "raw") {
   if (isBlacklisted(req.url)) return null;
   try {
+    ensureDumpDir();
     const ts = new Date().toISOString().replace(/[:.]/g, "-");
     const slug = slugify((req.headers.host || "") + req.url);
     const file = path.join(DUMP_DIR, `${ts}_${tag}_${slug}.req.json`);
@@ -95,6 +94,7 @@ function createResponseDumper(req, tag = "raw") {
     },
     end: () => {
       try {
+        ensureDumpDir();
         const raw = Buffer.concat(chunks);
         const enc = headers["content-encoding"] || headers["Content-Encoding"];
         const decoded = decodeBody(raw, enc);
diff --git a/src/mitm/manager.js b/src/mitm/manager.js
index aad0cf6cf..3c7a1fd31 100644
--- a/src/mitm/manager.js
+++ b/src/mitm/manager.js
@@ -1,29 +1,59 @@
-const { exec, spawn, execSync } = require("child_process");
+const { execFile, execFileSync, spawn } = require("child_process");
 const path = require("path");
 const fs = require("fs");
 const os = require("os");
 const net = require("net");
 const https = require("https");
 const crypto = require("crypto");
-const { addDNSEntry, removeDNSEntry, removeAllDNSEntries, removeAllDNSEntriesSync, checkAllDNSStatus, TOOL_HOSTS, isSudoAvailable, isSudoPasswordRequired } = require("./dns/dnsConfig");
+const {
+  addDNSEntry,
+  adoptLegacyDNSEntries,
+  removeDNSEntry,
+  removeAllDNSEntries,
+  removeAllDNSEntriesSync,
+  removeLegacyDNSEntries,
+  checkAllDNSStatus,
+  TOOL_HOSTS,
+  isSudoAvailable,
+  isSudoPasswordRequired,
+} = require("./dns/dnsConfig");
 const { isAdmin } = require("./winElevated.js");
 
 const IS_WIN = process.platform === "win32";
 const IS_MAC = process.platform === "darwin";
-const { generateCert } = require("./cert/generate");
-const { installCert, uninstallCert } = require("./cert/install");
-const { isCertExpired } = require("./cert/rootCA");
+const { assertDurinDoorRootCertificate, installCert, uninstallCert } = require("./cert/install");
+const { ensureRootCASync, hasValidRootCA } = require("./cert/rootCA");
+const { withRootCALock } = require("./serverBootstrap");
+const {
+  acquireSocketLock,
+  createStartGate,
+  readFileSnapshot,
+  releaseSocketLock,
+  replaceFileIfUnchanged,
+  removeFileIfUnchanged,
+} = require("./startLock");
 const { DATA_DIR, MITM_DIR } = require("./paths");
 const { log, err } = require("./logger");
-const { LSOF_BIN } = require("./config");
+const { MITM_ENTRY_ARG, MITM_START_LOCK_PORT, MITM_NODE_PORT } = require("./config");
+const {
+  FIXED_UNIX_PATH,
+  buildMinimalWindowsEnv,
+  resolveTrustedUnixBinary,
+  resolveWindowsSystemBinary,
+} = require("./trustedBinaries");
+const {
+  buildLinuxRedirect,
+  buildMacRedirect,
+  buildWindowsRedirect,
+  requireNumericUid,
+  requireWindowsSid,
+} = require("./portRedirect");
+const { publishLaunchAuthorization } = require("./launchGate");
+const { ensureWindowsPrivateDirectorySync } = require("./windowsAcl");
+const { getProcessStartIdentity } = require("./processIdentity");
 
 const DEFAULT_MITM_ROUTER_BASE = "http://localhost:20128";
 
-function shellQuoteSingle(str) {
-  if (str == null || str === "") return "''";
-  return `'${String(str).replace(/'/g, "'\\''")}'`;
-}
-
 async function resolveMitmRouterBaseUrl() {
   if (!_getSettings) return DEFAULT_MITM_ROUTER_BASE;
   try {
@@ -39,9 +69,14 @@ async function resolveMitmRouterBaseUrl() {
 }
 
 const MITM_PORT = 443;
-const MITM_WIN_NODE_PORT = 8443;
+const MITM_INTERNAL_PORT = IS_WIN ? MITM_PORT : MITM_NODE_PORT;
 const PID_FILE = path.join(MITM_DIR, ".mitm.pid");
-const LOCK_FILE = path.join(MITM_DIR, ".mitm.lock");
+const GLOBAL_MITM_STATE_DIR = process.env.NODE_ENV !== "production" && process.env.MITM_GLOBAL_STATE_DIR
+  ? path.resolve(process.env.MITM_GLOBAL_STATE_DIR)
+  : process.platform === "win32"
+    ? path.win32.join(os.userInfo().homedir, "AppData", "Local", "DurinDoor", "mitm-state")
+    : path.join(os.userInfo().homedir, ".durindoor-mitm-state");
+const REDIRECT_JOURNAL_FILE = path.join(GLOBAL_MITM_STATE_DIR, "redirect.json");
 
 const MITM_MAX_RESTARTS = 5;
 const MITM_RESTART_DELAYS_MS = [5000, 10000, 20000, 30000, 60000];
@@ -50,68 +85,67 @@ const MITM_RESTART_RESET_MS = 60000;
 let mitmRestartCount = 0;
 let mitmLastStartTime = 0;
 let mitmIsRestarting = false;
-let mitmStarting = false; // prevents concurrent startServer() calls from the same process
-
-function resolveBundledServerPath() {
-  if (process.env.MITM_SERVER_PATH) return process.env.MITM_SERVER_PATH;
-  const sibling = path.join(__dirname, "server.js");
-  if (fs.existsSync(sibling)) return sibling;
-  const fromCwd = path.join(process.cwd(), "src", "mitm", "server.js");
-  if (fs.existsSync(fromCwd)) return fromCwd;
-  const fromNext = path.join(process.cwd(), "..", "src", "mitm", "server.js");
-  if (fs.existsSync(fromNext)) return fromNext;
-  return fromCwd;
-}
 
-// Copy bundled server.js into DATA_DIR so MITM doesn't lock node_modules
-// (prevents EBUSY on `npm i -g durindoor@latest` while MITM is running).
-function ensureRuntimeServer(bundledPath) {
-  try {
-    if (!bundledPath || !fs.existsSync(bundledPath)) return bundledPath;
-
-    // Dev mode: source file has relative requires (./logger, ./config...),
-    // only the bundled file inside node_modules is self-contained + safe to copy.
-    if (!bundledPath.includes(`${path.sep}node_modules${path.sep}`)) {
-      return bundledPath;
+const STANDALONE_ROOT_ENV = "DURINDOOR_STANDALONE_ROOT";
+
+function assertSafeServerEntrypoint(candidate, { trustedRoot = null } = {}) {
+  const stat = fs.lstatSync(candidate);
+  if (!stat.isFile() || stat.isSymbolicLink()) throw new Error(`Unsafe MITM server entrypoint: ${candidate}`);
+  const realCandidate = fs.realpathSync(candidate);
+  if (trustedRoot) {
+    const realRoot = fs.realpathSync(trustedRoot);
+    const relative = path.relative(realRoot, realCandidate);
+    if (relative.startsWith("..") || path.isAbsolute(relative)) {
+      throw new Error("Production MITM server entrypoint is outside the installed module directory");
     }
+  }
+  return realCandidate;
+}
 
-    const runtimeDir = path.join(DATA_DIR, "runtime", "mitm");
-    const runtimeServer = path.join(runtimeDir, "server.js");
-
-    // Skip copy if sizes match (bundle unchanged since last run)
-    if (fs.existsSync(runtimeServer)) {
-      try {
-        if (fs.statSync(bundledPath).size === fs.statSync(runtimeServer).size) return runtimeServer;
-      } catch { /* recopy */ }
+function resolveBundledServerPath({ allowOverride = process.env.NODE_ENV !== "production" } = {}) {
+  if (allowOverride && process.env.MITM_SERVER_PATH) {
+    return assertSafeServerEntrypoint(process.env.MITM_SERVER_PATH);
+  }
+  const sibling = path.join(__dirname, "server.js");
+  if (fs.existsSync(sibling)) return assertSafeServerEntrypoint(sibling, { trustedRoot: __dirname });
+  if (process.env.NODE_ENV === "production") {
+    const standaloneRoot = process.env[STANDALONE_ROOT_ENV];
+    if (standaloneRoot && path.isAbsolute(standaloneRoot)) {
+      const candidate = path.join(standaloneRoot, "src", "mitm", "server.js");
+      if (fs.existsSync(candidate)) {
+        return assertSafeServerEntrypoint(candidate, { trustedRoot: standaloneRoot });
+      }
     }
-
-    fs.mkdirSync(runtimeDir, { recursive: true });
-    fs.copyFileSync(bundledPath, runtimeServer);
-    return runtimeServer;
-  } catch (e) {
-    try { log(`[MITM] runtime copy failed: ${e.message}`); } catch { /* ignore */ }
-    return bundledPath;
+    throw new Error(`Trusted packaged MITM server entrypoint is missing: ${sibling}`);
   }
+  const fromCwd = path.join(process.cwd(), "src", "mitm", "server.js");
+  if (fs.existsSync(fromCwd)) return assertSafeServerEntrypoint(fromCwd);
+  const fromNext = path.join(process.cwd(), "..", "src", "mitm", "server.js");
+  if (fs.existsSync(fromNext)) return assertSafeServerEntrypoint(fromNext);
+  throw new Error(`MITM server entrypoint not found under ${process.cwd()}`);
 }
 
-const SERVER_PATH = ensureRuntimeServer(resolveBundledServerPath());
-const ENCRYPT_ALGO = "aes-256-gcm";
-const ENCRYPT_SALT = "9router-mitm-pwd";
-
 function getProcessUsingPort443() {
   try {
     if (IS_WIN) {
-      const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command ` +
-        `"$c = Get-NetTCPConnection -LocalPort 443 -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1; if ($c) { $c.OwningProcess } else { 0 }"`;
-      const pidStr = execSync(psCmd, { encoding: "utf8", windowsHide: true }).trim();
+      const powershell = resolveWindowsSystemBinary("powershell.exe");
+      const pidStr = execFileSync(powershell, ["-NoProfile", "-NonInteractive", "-Command",
+        "$c = Get-NetTCPConnection -LocalPort 443 -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1; if ($c) { $c.OwningProcess } else { 0 }"], {
+        encoding: "utf8", windowsHide: true, timeout: 5000, env: buildMinimalWindowsEnv(),
+      }).trim();
       const pid = parseInt(pidStr, 10);
       if (pid && pid > 4) {
-        const tasklistResult = execSync(`tasklist /FI "PID eq ${pid}" /FO CSV /NH`, { encoding: "utf8", windowsHide: true });
+        const tasklistResult = execFileSync(resolveWindowsSystemBinary("tasklist.exe"),
+          ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"],
+          { encoding: "utf8", windowsHide: true, timeout: 5000, env: buildMinimalWindowsEnv() });
         const processMatch = tasklistResult.match(/"([^"]+)"/);
         if (processMatch) return processMatch[1].replace(".exe", "");
       }
     } else {
-      const result = execSync(`${LSOF_BIN} -i :443`, { encoding: "utf8", windowsHide: true });
+      const result = execFileSync(resolveTrustedUnixBinary("lsof"), ["-nP", "-iTCP:443", "-sTCP:LISTEN"], {
+        encoding: "utf8", windowsHide: true, timeout: 5000,
+        env: { PATH: FIXED_UNIX_PATH, LANG: "C", LC_ALL: "C" },
+      });
       const lines = result.trim().split("\n");
       if (lines.length > 1) return lines[1].split(/\s+/)[0];
     }
@@ -123,67 +157,407 @@ function getProcessUsingPort443() {
 
 let serverProcess = null;
 let serverPid = null;
+let serverLauncherPid = null;
+let serverInstanceNonce = null;
+let serverLauncherStart = null;
+let serverProcessStart = null;
+let serverRedirectOwned = false;
+let serverLaunchGatePath = null;
 
 function getCachedPassword() { return globalThis.__mitmSudoPassword || null; }
 function setCachedPassword(pwd) { globalThis.__mitmSudoPassword = pwd; }
 
+function hasMitmCleanupState() {
+  const dnsStatus = checkAllDNSStatus();
+  return Boolean(
+    serverProcess
+    || serverRedirectOwned
+    || fs.existsSync(PID_FILE)
+    || fs.existsSync(REDIRECT_JOURNAL_FILE)
+    || Object.values(dnsStatus).some(Boolean)
+  );
+}
+
 function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
   } catch (err) {
-    return err.code === "EACCES";
+    // POSIX reports EPERM for a live process owned by another effective UID;
+    // Windows can surface EACCES. Both mean "alive but not signalable", not
+    // stale metadata.
+    return err.code === "EPERM" || err.code === "EACCES";
   }
 }
 
-function killProcess(pid, force = false, sudoPassword = null) {
-  if (IS_WIN) {
-    const flag = force ? "/F " : "";
-    exec(`taskkill ${flag}/PID ${pid}`, { windowsHide: true }, () => { });
-  } else {
-    const sig = force ? "SIGKILL" : "SIGTERM";
-    const cmd = `pkill -${sig} -P ${pid} 2>/dev/null; kill -${sig} ${pid} 2>/dev/null`;
-    if (sudoPassword || isSudoAvailable()) {
-      const { execWithPassword } = require("./dns/dnsConfig");
-      execWithPassword(cmd, sudoPassword || "").catch(() => exec(cmd, { windowsHide: true }, () => { }));
-    } else {
-      exec(cmd, { windowsHide: true }, () => { });
+function parsePidRecord(raw) {
+  const value = String(raw || "").trim();
+  if (/^[1-9]\d*$/.test(value)) {
+    const pid = Number(value);
+    return { version: 0, pid, launcherPid: pid, nonce: null, state: "legacy" };
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (parsed?.version !== 1) return null;
+    if (!Number.isSafeInteger(parsed?.pid) || parsed.pid <= 0) return null;
+    if (!Number.isSafeInteger(parsed?.launcherPid) || parsed.launcherPid <= 0) return null;
+    if (typeof parsed?.nonce !== "string" || !/^[a-f0-9]{48}$/.test(parsed.nonce)) return null;
+    if (parsed.state !== "starting" && parsed.state !== "running") return null;
+    if (typeof parsed.launcherStart !== "string" || parsed.launcherStart.length < 3 || parsed.launcherStart.length > 200) return null;
+    if (parsed.processStart != null
+      && (typeof parsed.processStart !== "string" || parsed.processStart.length < 3 || parsed.processStart.length > 200)) return null;
+    return {
+      version: 1,
+      pid: parsed.pid,
+      launcherPid: parsed.launcherPid,
+      nonce: parsed.nonce,
+      state: parsed.state,
+      launcherStart: parsed.launcherStart,
+      processStart: parsed.processStart || (parsed.pid === parsed.launcherPid ? parsed.launcherStart : null),
+    };
+  } catch {
+    return null;
+  }
+}
+
+function serializePidRecord(record) {
+  return `${JSON.stringify({
+    version: 1,
+    pid: record.pid,
+    launcherPid: record.launcherPid,
+    nonce: record.nonce,
+    state: record.state,
+    launcherStart: record.launcherStart,
+    processStart: record.processStart || (record.pid === record.launcherPid ? record.launcherStart : null),
+  })}\n`;
+}
+
+function fsyncParentDirectory(filePath) {
+  if (process.platform === "win32") return;
+  let fd;
+  try {
+    fd = fs.openSync(path.dirname(filePath), "r");
+    fs.fsyncSync(fd);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+function readPidRecord() {
+  const snapshot = readFileSnapshot(PID_FILE);
+  return { snapshot, record: parsePidRecord(snapshot.raw) };
+}
+
+function pidRecordsMatch(actual, expected) {
+  if (!actual || !expected) return false;
+  if (actual.pid !== expected.pid) return false;
+  if (expected.nonce != null && actual.nonce !== expected.nonce) return false;
+  if (expected.launcherStart != null && actual.launcherStart !== expected.launcherStart) return false;
+  if (expected.processStart != null && actual.processStart !== expected.processStart) return false;
+  return true;
+}
+
+function removePidFileIfMatches(expectedRecord) {
+  try {
+    const { snapshot, record } = readPidRecord();
+    if (!pidRecordsMatch(record, expectedRecord)) return false;
+    return removeFileIfUnchanged(PID_FILE, snapshot);
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+function replacePidFileIfMatches(expectedRecord, nextRecord) {
+  const { snapshot, record } = readPidRecord();
+  if (!pidRecordsMatch(record, expectedRecord)) return false;
+
+  const tempPath = `${PID_FILE}.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`;
+  let fd;
+  try {
+    fd = fs.openSync(tempPath, "wx", 0o600);
+    fs.writeFileSync(fd, serializePidRecord(nextRecord));
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = undefined;
+    if (process.platform !== "win32") fs.chmodSync(tempPath, 0o600);
+    if (!replaceFileIfUnchanged(PID_FILE, snapshot, tempPath)) return false;
+    fsyncParentDirectory(PID_FILE);
+    return true;
+  } finally {
+    if (fd !== undefined) {
+      try { fs.closeSync(fd); } catch { /* preserve the publication result */ }
     }
+    try { fs.unlinkSync(tempPath); } catch { /* published or absent */ }
   }
 }
 
-function deriveKey() {
+function writeInitialPidRecord(record) {
+  fs.mkdirSync(MITM_DIR, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") fs.chmodSync(MITM_DIR, 0o700);
+  const fd = fs.openSync(PID_FILE, "wx", 0o600);
   try {
-    const { machineIdSync } = require("node-machine-id");
-    const raw = machineIdSync();
-    return crypto.createHash("sha256").update(raw + ENCRYPT_SALT).digest();
-  } catch {
-    return crypto.createHash("sha256").update(ENCRYPT_SALT).digest();
+    fs.writeFileSync(fd, serializePidRecord(record));
+    fs.fsyncSync(fd);
+  } finally {
+    fs.closeSync(fd);
   }
+  if (process.platform !== "win32") fs.chmodSync(PID_FILE, 0o600);
+  fsyncParentDirectory(PID_FILE);
 }
 
-function encryptPassword(plaintext) {
-  const key = deriveKey();
-  const iv = crypto.randomBytes(12);
-  const cipher = crypto.createCipheriv(ENCRYPT_ALGO, key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${iv.toString("hex")}:${tag.toString("hex")}:${encrypted.toString("hex")}`;
+function currentRedirectOwner() {
+  return IS_WIN
+    ? { kind: "sid", value: requireWindowsSid() }
+    : { kind: "uid", value: String(requireNumericUid()) };
 }
 
-function decryptPassword(stored) {
+function parseRedirectJournal(raw) {
   try {
-    const [ivHex, tagHex, dataHex] = stored.split(":");
-    if (!ivHex || !tagHex || !dataHex) return null;
-    const key = deriveKey();
-    const decipher = crypto.createDecipheriv(ENCRYPT_ALGO, key, Buffer.from(ivHex, "hex"));
-    decipher.setAuthTag(Buffer.from(tagHex, "hex"));
-    return decipher.update(Buffer.from(dataHex, "hex")) + decipher.final("utf8");
+    const value = JSON.parse(String(raw || ""));
+    if (value?.version !== 1) return null;
+    if (!["installing", "installed", "uncertain"].includes(value.state)) return null;
+    if (value.ownerKind !== "uid" && value.ownerKind !== "sid") return null;
+    if (typeof value.ownerValue !== "string" || value.ownerValue.length < 1 || value.ownerValue.length > 200) return null;
+    if (!/^[a-f0-9]{48}$/.test(value.nonce || "")) return null;
+    if (value.publicPort !== MITM_PORT || value.internalPort !== MITM_INTERNAL_PORT) return null;
+    return value;
   } catch {
     return null;
   }
 }
 
+function serializeRedirectJournal(record) {
+  return `${JSON.stringify(record)}\n`;
+}
+
+function readRedirectJournal() {
+  const snapshot = readFileSnapshot(REDIRECT_JOURNAL_FILE);
+  return { snapshot, record: parseRedirectJournal(snapshot.raw) };
+}
+
+function assertRedirectJournalOwner(record) {
+  if (!record) return;
+  const owner = currentRedirectOwner();
+  if (record.ownerKind !== owner.kind || record.ownerValue !== owner.value) {
+    throw new Error("MITM redirect journal belongs to a different OS identity");
+  }
+}
+
+function createRedirectJournal() {
+  fs.mkdirSync(GLOBAL_MITM_STATE_DIR, { recursive: true, mode: 0o700 });
+  const directoryStat = fs.lstatSync(GLOBAL_MITM_STATE_DIR);
+  if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) {
+    throw new Error(`Unsafe global MITM state directory: ${GLOBAL_MITM_STATE_DIR}`);
+  }
+  if (process.platform !== "win32") {
+    const uid = requireNumericUid();
+    if (typeof directoryStat.uid === "number" && directoryStat.uid !== uid) {
+      throw new Error("Global MITM state directory belongs to a different user");
+    }
+    fs.chmodSync(GLOBAL_MITM_STATE_DIR, 0o700);
+  } else {
+    ensureWindowsPrivateDirectorySync(GLOBAL_MITM_STATE_DIR);
+  }
+  const owner = currentRedirectOwner();
+  const record = {
+    version: 1,
+    state: "installing",
+    ownerKind: owner.kind,
+    ownerValue: owner.value,
+    publicPort: MITM_PORT,
+    internalPort: MITM_INTERNAL_PORT,
+    nonce: crypto.randomBytes(24).toString("hex"),
+  };
+  const fd = fs.openSync(REDIRECT_JOURNAL_FILE, "wx", 0o600);
+  try {
+    fs.writeFileSync(fd, serializeRedirectJournal(record));
+    fs.fsyncSync(fd);
+  } finally {
+    fs.closeSync(fd);
+  }
+  if (process.platform !== "win32") fs.chmodSync(REDIRECT_JOURNAL_FILE, 0o600);
+  fsyncParentDirectory(REDIRECT_JOURNAL_FILE);
+  return record;
+}
+
+function replaceRedirectJournalIfMatches(expectedRecord, nextRecord) {
+  const { snapshot, record } = readRedirectJournal();
+  if (!record || record.nonce !== expectedRecord.nonce) return false;
+  const tempPath = `${REDIRECT_JOURNAL_FILE}.${process.pid}.${crypto.randomBytes(8).toString("hex")}.tmp`;
+  let fd;
+  try {
+    fd = fs.openSync(tempPath, "wx", 0o600);
+    fs.writeFileSync(fd, serializeRedirectJournal(nextRecord));
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = undefined;
+    if (!replaceFileIfUnchanged(REDIRECT_JOURNAL_FILE, snapshot, tempPath)) return false;
+    fsyncParentDirectory(REDIRECT_JOURNAL_FILE);
+    return true;
+  } finally {
+    if (fd !== undefined) try { fs.closeSync(fd); } catch { /* preserve result */ }
+    try { fs.unlinkSync(tempPath); } catch { /* published or absent */ }
+  }
+}
+
+function removeRedirectJournalSnapshot(snapshot, record) {
+  const removed = record
+    ? (() => {
+      const current = readRedirectJournal();
+      if (!current.record || current.record.nonce !== record.nonce) return false;
+      return removeFileIfUnchanged(REDIRECT_JOURNAL_FILE, current.snapshot);
+    })()
+    : removeFileIfUnchanged(REDIRECT_JOURNAL_FILE, snapshot);
+  if (removed) fsyncParentDirectory(REDIRECT_JOURNAL_FILE);
+  return removed;
+}
+
+const startGate = createStartGate({
+  acquire: () => acquireSocketLock({ port: MITM_START_LOCK_PORT }),
+  release: releaseSocketLock,
+  onCleanupError: async (error) => {
+    err(`[MITM] Failed to release startup lock: ${error.message}`);
+    await rollbackLaunchedInstance({ sudoPassword: getCachedPassword() });
+  },
+});
+
+function execFileCommand(command, args, { timeout = 5000, env } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, { windowsHide: true, timeout, encoding: "utf8", env }, (error, stdout, stderr) => {
+      if (error) {
+        error.stderr = stderr;
+        reject(error);
+      } else {
+        resolve(stdout);
+      }
+    });
+  });
+}
+
+async function waitForProcessExit(pid, timeoutMs = 1500) {
+  const deadline = Date.now() + timeoutMs;
+  while (isProcessAlive(pid) && Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  }
+  return !isProcessAlive(pid);
+}
+
+async function killProcess(pid, force = false, sudoPassword = null, expectedStartIdentity = null) {
+  const assertIdentity = () => {
+    if (expectedStartIdentity && getProcessStartIdentity(pid) !== expectedStartIdentity) {
+      const error = new Error(`MITM process ${pid} identity changed before termination`);
+      error.code = "MITM_PROCESS_IDENTITY_CHANGED";
+      throw error;
+    }
+  };
+  try {
+    assertIdentity();
+    if (IS_WIN) {
+      const args = ["/PID", String(pid), "/T"];
+      if (force) args.push("/F");
+      await execFileCommand(resolveWindowsSystemBinary("taskkill.exe"), args, {
+        timeout: 5000,
+        env: buildMinimalWindowsEnv(),
+      });
+    } else {
+      const sig = force ? "SIGKILL" : "SIGTERM";
+      const pkill = resolveTrustedUnixBinary("pkill", {
+        candidates: ["/usr/bin/pkill", "/bin/pkill"],
+        required: false,
+      });
+      if (pkill) {
+        try {
+          assertIdentity();
+          await execFileCommand(pkill, [`-${sig}`, "-P", String(pid)], {
+            timeout: 3000,
+            env: { PATH: FIXED_UNIX_PATH, LANG: "C", LC_ALL: "C" },
+          });
+        } catch (error) {
+          if (error.code === "MITM_PROCESS_IDENTITY_CHANGED") throw error;
+          // No child process matched; continue with the authenticated parent.
+        }
+      }
+      assertIdentity();
+      try { process.kill(pid, sig); }
+      catch (error) {
+        if (error.code === "EPERM" || error.code === "EACCES") {
+          throw new Error(`Refusing to elevate termination for unprivileged MITM process ${pid}`);
+        }
+        if (error.code !== "ESRCH") throw error;
+      }
+    }
+  } catch (error) {
+    // A process can exit between the liveness probe and the kill command.
+    if (isProcessAlive(pid)) throw error;
+  }
+
+  if (force && !(await waitForProcessExit(pid))) {
+    throw new Error(`MITM process ${pid} remained alive after forced termination`);
+  }
+}
+
+async function rollbackLaunchedInstance({
+  launchedProcess = serverProcess,
+  launcherPid = serverLauncherPid,
+  actualPid = serverPid,
+  nonce = serverInstanceNonce,
+  sudoPassword = null,
+  redirectOwned = serverRedirectOwned,
+  launchGatePath = serverLaunchGatePath,
+  launcherStart = serverLauncherStart,
+  actualStart = serverProcessStart,
+} = {}) {
+  if (launchGatePath) {
+    try { fs.unlinkSync(launchGatePath); } catch { /* consumed or absent */ }
+  }
+  const ownedProcesses = [];
+  if (Number.isSafeInteger(actualPid) && actualPid > 0) {
+    ownedProcesses.push({ pid: actualPid, start: actualStart || (actualPid === launcherPid ? launcherStart : null) });
+  }
+  if (Number.isSafeInteger(launcherPid) && launcherPid > 0 && launcherPid !== actualPid) {
+    ownedProcesses.push({ pid: launcherPid, start: launcherStart });
+  }
+  if (launchedProcess && !launchedProcess.killed) {
+    if (!launcherStart || getProcessStartIdentity(launchedProcess.pid) === launcherStart) {
+      try { launchedProcess.kill("SIGKILL"); } catch { /* verified below */ }
+    }
+  }
+  for (const owned of ownedProcesses) {
+    if (isProcessAlive(owned.pid)) {
+      if (!owned.start) throw new Error(`Missing process-start identity for MITM PID ${owned.pid}`);
+      await killProcess(owned.pid, true, sudoPassword, owned.start);
+    }
+  }
+  if (redirectOwned) {
+    await removeAllDNSEntries(sudoPassword || getCachedPassword());
+    await removePortRedirect(sudoPassword);
+  }
+  for (const owned of ownedProcesses) {
+    try { removePidFileIfMatches({ pid: owned.pid, nonce }); } catch { /* preserve rollback progress */ }
+  }
+
+  if (nonce == null || serverInstanceNonce === nonce || serverProcess === launchedProcess) {
+    serverProcess = null;
+    serverPid = null;
+    serverLauncherPid = null;
+    serverInstanceNonce = null;
+    serverLauncherStart = null;
+    serverProcessStart = null;
+    serverRedirectOwned = false;
+    serverLaunchGatePath = null;
+  }
+}
+
+async function throwAfterRollback(primaryError, rollbackOptions) {
+  try {
+    await rollbackLaunchedInstance(rollbackOptions);
+  } catch (cleanupError) {
+    primaryError.cleanupError = cleanupError;
+  }
+  throw primaryError;
+}
+
 let _getSettings = null;
 let _updateSettings = null;
 
@@ -192,14 +566,13 @@ function initDbHooks(getSettingsFn, updateSettingsFn) {
   _updateSettings = updateSettingsFn;
 }
 
-async function saveMitmSettings(enabled, password) {
+async function saveMitmSettings(enabled) {
   if (!_updateSettings) return;
   try {
-    const updates = { mitmEnabled: enabled };
-    if (password) updates.mitmSudoEncrypted = encryptPassword(password);
-    await _updateSettings(updates);
+    await _updateSettings({ mitmEnabled: enabled, mitmSudoEncrypted: null });
   } catch (e) {
     err(`Failed to save settings: ${e.message}`);
+    throw e;
   }
 }
 
@@ -208,7 +581,8 @@ async function clearEncryptedPassword() {
   try {
     await _updateSettings({ mitmSudoEncrypted: null });
   } catch (e) {
-    err(`Failed to clear encrypted password: ${e.message}`);
+    err(`Failed to clear legacy stored sudo credential: ${e.message}`);
+    throw e;
   }
 }
 
@@ -216,13 +590,22 @@ async function loadEncryptedPassword() {
   if (!_getSettings) return null;
   try {
     const settings = await _getSettings();
-    if (!settings.mitmSudoEncrypted) return null;
-    return decryptPassword(settings.mitmSudoEncrypted);
-  } catch {
+    if (settings.mitmSudoEncrypted) {
+      if (!_updateSettings) throw new Error("Settings writer unavailable for legacy sudo credential purge");
+      await _updateSettings({ mitmSudoEncrypted: null });
+    }
     return null;
+  } catch (error) {
+    err(`Failed to purge legacy stored sudo credential: ${error.message}`);
+    throw error;
   }
 }
 
+async function getInMemoryPassword(provided = null) {
+  await loadEncryptedPassword();
+  return provided || getCachedPassword() || null;
+}
+
 async function saveDnsToolState(tool, enabled) {
   if (!_updateSettings || !_getSettings) return;
   try {
@@ -231,6 +614,7 @@ async function saveDnsToolState(tool, enabled) {
     await _updateSettings({ dnsToolEnabled: next });
   } catch (e) {
     err(`Failed to save DNS state: ${e.message}`);
+    throw e;
   }
 }
 
@@ -248,31 +632,40 @@ async function loadDnsToolState() {
  * Re-apply DNS for tools previously enabled — called on app startup after MITM running.
  */
 async function restoreToolDNS(sudoPassword) {
-  const state = await loadDnsToolState();
-  const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
-  for (const [tool, enabled] of Object.entries(state)) {
-    if (!enabled || !TOOL_HOSTS[tool]) continue;
-    try {
-      await addDNSEntry(tool, password);
-    } catch (e) {
-      err(`DNS ${tool}: restore failed — ${e.message}`);
+  return startGate.runAfterIdle(async () => {
+    const status = await getMitmStatus();
+    if (!status.running) throw new Error("MITM server is not running; refusing to restore DNS entries");
+    const state = await loadDnsToolState();
+    const password = await getInMemoryPassword(sudoPassword);
+    for (const tool of Object.keys(TOOL_HOSTS)) {
+      const enabled = state[tool] === true;
+      try {
+        if (enabled) {
+          await adoptLegacyDNSEntries(tool, password);
+          await addDNSEntry(tool, password);
+        }
+        else await removeDNSEntry(tool, password);
+      } catch (e) {
+        err(`DNS ${tool}: restore failed — ${e.message}`);
+      }
     }
-  }
+  });
 }
 
 /**
  * Check if user has privilege to mutate hosts file.
- * Win: needs admin. Mac/Linux: root OR cached/encrypted sudo password.
+ * Windows: standard-user parent with narrow UAC. Mac/Linux: standard-user
+ * parent with passwordless sudo or an in-memory sudo credential.
  */
 async function hasDnsPrivilege() {
-  if (IS_WIN) return isAdmin();
-  if (isAdmin()) return true;
+  if (IS_WIN) return !isAdmin();
+  if (isAdmin()) return false;
   if (!isSudoPasswordRequired()) return true;
-  const pwd = getCachedPassword() || await loadEncryptedPassword();
+  const pwd = await getInMemoryPassword();
   return !!pwd;
 }
 
-function checkPort443Free() {
+function checkLoopbackPortFree(port) {
   return new Promise((resolve) => {
     const tester = net.createServer();
     tester.once("error", (err) => {
@@ -280,116 +673,241 @@ function checkPort443Free() {
       else resolve("no-permission");
     });
     tester.once("listening", () => { tester.close(() => resolve("free")); });
-    tester.listen(MITM_PORT, "127.0.0.1");
+    tester.listen(port, "127.0.0.1");
   });
 }
 
+function checkPort443Free() { return checkLoopbackPortFree(MITM_PORT); }
+
 function getPort443Owner(sudoPassword) {
   return new Promise((resolve) => {
     if (IS_WIN) {
-      const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command "` +
-        `$c = Get-NetTCPConnection -LocalPort 443 -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1; ` +
-        `if ($c) { $c.OwningProcess } else { 0 }"`;    
-      exec(psCmd, { windowsHide: true }, (err, stdout) => {
+      const powershell = resolveWindowsSystemBinary("powershell.exe");
+      execFile(powershell, ["-NoProfile", "-NonInteractive", "-Command",
+        "$c = Get-NetTCPConnection -LocalPort 443 -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1; if ($c) { $c.OwningProcess } else { 0 }"], {
+        windowsHide: true, timeout: 5000, encoding: "utf8", env: buildMinimalWindowsEnv(),
+      }, (err, stdout) => {
         if (err) return resolve(null);
         const pid = parseInt(stdout.trim(), 10);
         if (!pid || pid <= 4) return resolve(null);
-        exec(`tasklist /FI "PID eq ${pid}" /FO CSV /NH`, { windowsHide: true }, (e2, out2) => {
+        execFile(resolveWindowsSystemBinary("tasklist.exe"), ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"], {
+          windowsHide: true, timeout: 5000, encoding: "utf8", env: buildMinimalWindowsEnv(),
+        }, (e2, out2) => {
           const m = out2?.match(/"([^"]+)"/);
-          resolve({ pid, name: m ? m[1] : "unknown" });
+          const startIdentity = getProcessStartIdentity(pid);
+          resolve(startIdentity ? { pid, name: m ? m[1] : "unknown", startIdentity } : null);
         });
       });
     } else {
       // Only find process actually LISTENING on TCP port 443
-      exec(`${LSOF_BIN} -nP -iTCP:443 -sTCP:LISTEN -t`, { windowsHide: true }, (err, stdout) => {
+      let lsof;
+      try { lsof = resolveTrustedUnixBinary("lsof"); } catch { resolve(null); return; }
+      execFile(lsof, ["-nP", "-iTCP:443", "-sTCP:LISTEN", "-t"], {
+        windowsHide: true, timeout: 5000, encoding: "utf8",
+        env: { PATH: FIXED_UNIX_PATH, LANG: "C", LC_ALL: "C" },
+      }, (err, stdout) => {
         if (err || !stdout?.trim()) return resolve(null);
         const pid = parseInt(stdout.trim().split("\n")[0], 10);
         if (!pid || isNaN(pid)) return resolve(null);
-        exec(`ps -p ${pid} -o comm=`, { windowsHide: true }, (e2, out2) => {
-          resolve({ pid, name: (out2?.trim() || "unknown") });
+        execFile(resolveTrustedUnixBinary("ps"), ["-p", String(pid), "-o", "comm="], {
+          windowsHide: true, timeout: 5000, encoding: "utf8",
+          env: { PATH: FIXED_UNIX_PATH, LANG: "C", LC_ALL: "C" },
+        }, (e2, out2) => {
+          const startIdentity = getProcessStartIdentity(pid);
+          resolve(startIdentity ? { pid, name: (out2?.trim() || "unknown"), startIdentity } : null);
         });
       });
     }
   });
 }
 
-async function killLeftoverMitm(sudoPassword) {
-  if (serverProcess && !serverProcess.killed) {
-    try { serverProcess.kill("SIGKILL"); } catch { /* ignore */ }
-    serverProcess = null;
-    serverPid = null;
+async function killLeftoverMitm(sudoPassword, { preserveRedirectForRestart = mitmIsRestarting && serverRedirectOwned } = {}) {
+  if (!fs.existsSync(PID_FILE)) {
+    if (fs.existsSync(REDIRECT_JOURNAL_FILE)) {
+      await removeAllDNSEntries(sudoPassword || getCachedPassword());
+      await removePortRedirect(sudoPassword);
+      serverRedirectOwned = false;
+    }
+    return;
   }
-  try {
-    if (fs.existsSync(PID_FILE)) {
-      const savedPid = parseInt(fs.readFileSync(PID_FILE, "utf-8").trim(), 10);
-      if (savedPid && isProcessAlive(savedPid)) {
-        killProcess(savedPid, true, sudoPassword);
-        await new Promise(r => setTimeout(r, 500));
-      }
-      fs.unlinkSync(PID_FILE);
+
+  const { snapshot, record } = readPidRecord();
+  if (!record) {
+    await removeAllDNSEntries(sudoPassword || getCachedPassword());
+    await removePortRedirect(sudoPassword);
+    if (!removeFileIfUnchanged(PID_FILE, snapshot)) {
+      throw new Error("Malformed MITM PID metadata changed during cleanup");
     }
-  } catch { /* ignore */ }
-  if (!IS_WIN && SERVER_PATH) {
-    try {
-      const escaped = SERVER_PATH.replace(/'/g, "'\\''");
-      if (sudoPassword || isSudoAvailable()) {
-        const { execWithPassword } = require("./dns/dnsConfig");
-        await execWithPassword(`pkill -SIGKILL -f "${escaped}" 2>/dev/null || true`, sudoPassword || "").catch(() => { });
-      } else {
-        exec(`pkill -SIGKILL -f "${escaped}" 2>/dev/null || true`, { windowsHide: true }, () => { });
-      }
-      await new Promise(r => setTimeout(r, 500));
-    } catch { /* ignore */ }
+    serverRedirectOwned = false;
+    return;
+  }
+
+  if (record.version === 0) {
+    if (isProcessAlive(record.pid)) {
+      const error = new Error(`Legacy MITM process ${record.pid} is alive but lacks authenticated ownership metadata`);
+      error.code = "MITM_OWNERSHIP_UNVERIFIED";
+      throw error;
+    }
+    await removeLegacyDNSEntries(sudoPassword || getCachedPassword());
+    await removeAllDNSEntries(sudoPassword || getCachedPassword());
+    if (fs.existsSync(REDIRECT_JOURNAL_FILE)) await removePortRedirect(sudoPassword);
+    if (!removePidFileIfMatches(record)) throw new Error("Legacy MITM PID metadata changed during cleanup");
+    return;
+  }
+
+  const health = await pollMitmHealth(1500, MITM_INTERNAL_PORT, record.nonce);
+  const healthPid = Number.isSafeInteger(health?.pid) && health.pid > 0 ? health.pid : null;
+  const healthMatches = record.state === "starting" ? healthPid != null : healthPid === record.pid;
+  const launcherMatches = isProcessAlive(record.launcherPid)
+    && getProcessStartIdentity(record.launcherPid) === record.launcherStart;
+
+  if (healthMatches) {
+    const processStart = record.processStart
+      || await bindAuthenticatedProcessIdentity(healthPid, record.nonce, MITM_INTERNAL_PORT);
+    if (!processStart || getProcessStartIdentity(healthPid) !== processStart) {
+      throw new Error(`MITM process ${healthPid} start identity could not be authenticated`);
+    }
+    await killProcess(healthPid, true, sudoPassword, processStart);
+    if (record.launcherPid !== healthPid && launcherMatches) {
+      await killProcess(record.launcherPid, true, sudoPassword, record.launcherStart);
+    }
+  } else if (record.state === "starting" && launcherMatches) {
+    await killProcess(record.launcherPid, true, sudoPassword, record.launcherStart);
+  } else if (isProcessAlive(record.pid) || isProcessAlive(record.launcherPid)) {
+    const error = new Error(`MITM process ${record.pid} is alive but ownership is unverified`);
+    error.code = "MITM_OWNERSHIP_UNVERIFIED";
+    throw error;
+  }
+
+  const preserveOwnedRedirect = preserveRedirectForRestart;
+  if (!preserveOwnedRedirect) {
+    await removeAllDNSEntries(sudoPassword || getCachedPassword());
+    await removePortRedirect(sudoPassword);
+    serverRedirectOwned = false;
   }
+  if (!removePidFileIfMatches(record)) throw new Error("MITM PID metadata changed during cleanup");
+
+  serverProcess = null;
+  serverPid = null;
+  serverLauncherPid = null;
+  serverInstanceNonce = null;
+  serverLauncherStart = null;
+  serverProcessStart = null;
 }
 
-function pollMitmHealth(timeoutMs, port = MITM_PORT) {
+function pollMitmHealth(timeoutMs, port = MITM_PORT, expectedNonce = null) {
   return new Promise((resolve) => {
     const deadline = Date.now() + timeoutMs;
+    let settled = false;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      resolve(value);
+    };
     const check = () => {
+      const remaining = deadline - Date.now();
+      if (remaining <= 0) {
+        finish(null);
+        return;
+      }
+      let attemptComplete = false;
+      let wallTimer = null;
+      const challenge = expectedNonce ? crypto.randomBytes(32).toString("hex") : null;
+      const retry = () => {
+        if (attemptComplete || settled) return;
+        attemptComplete = true;
+        if (wallTimer) clearTimeout(wallTimer);
+        if (Date.now() < deadline) setTimeout(check, Math.min(100, Math.max(1, deadline - Date.now())));
+        else finish(null);
+      };
       const req = https.request(
-        { hostname: "127.0.0.1", port, path: "/_mitm_health", method: "GET", rejectUnauthorized: false },
+        {
+          hostname: "127.0.0.1",
+          port,
+          path: "/_mitm_health",
+          method: "GET",
+          rejectUnauthorized: false,
+          headers: challenge ? { "x-durindoor-mitm-challenge": challenge } : {},
+        },
         (res) => {
           let body = "";
-          res.on("data", (d) => { body += d; });
+          res.on("data", (d) => {
+            body += d;
+            if (body.length > 4096) req.destroy(new Error("MITM health response too large"));
+          });
           res.on("end", () => {
+            if (attemptComplete || settled) return;
+            attemptComplete = true;
+            if (wallTimer) clearTimeout(wallTimer);
             try {
               const json = JSON.parse(body);
-              resolve(json.ok === true ? { ok: true, pid: json.pid || null } : null);
-            } catch { resolve(null); }
+              let proofMatches = expectedNonce == null;
+              if (expectedNonce != null && /^[a-f0-9]{64}$/.test(json.proof || "")) {
+                const expectedProof = crypto.createHmac("sha256", expectedNonce).update(challenge).digest("hex");
+                proofMatches = crypto.timingSafeEqual(Buffer.from(json.proof), Buffer.from(expectedProof));
+              }
+              finish(json.ok === true && proofMatches
+                ? { ok: true, pid: json.pid || null }
+                : null);
+            } catch { finish(null); }
           });
+          res.on("error", retry);
         }
       );
-      req.on("error", () => {
-        if (Date.now() < deadline) setTimeout(check, 500);
-        else resolve(null);
+      req.setTimeout?.(Math.min(500, remaining), () => {
+        req.destroy?.(Object.assign(new Error("MITM health request timed out"), { code: "ETIMEDOUT" }));
+        retry();
       });
+      req.on("error", retry);
+      wallTimer = setTimeout(() => {
+        req.destroy?.(Object.assign(new Error("MITM health attempt deadline exceeded"), { code: "ETIMEDOUT" }));
+        retry();
+      }, Math.min(500, remaining));
       req.end();
     };
     check();
   });
 }
 
+async function bindAuthenticatedProcessIdentity(pid, nonce, port = MITM_INTERNAL_PORT) {
+  const startIdentity = getProcessStartIdentity(pid);
+  if (!startIdentity) return null;
+  const confirmation = await pollMitmHealth(1500, port, nonce);
+  if (confirmation?.pid !== pid || getProcessStartIdentity(pid) !== startIdentity) return null;
+  return startIdentity;
+}
+
 /**
  * Get full MITM status including per-tool DNS status
  */
 async function getMitmStatus() {
-  let running = serverProcess !== null && !serverProcess.killed;
-  let pid = serverPid;
+  let running = false;
+  let pid = null;
 
-  if (!running) {
-    try {
-      if (fs.existsSync(PID_FILE)) {
-        const savedPid = parseInt(fs.readFileSync(PID_FILE, "utf-8").trim(), 10);
-        if (savedPid && isProcessAlive(savedPid)) {
+  try {
+    if (fs.existsSync(PID_FILE)) {
+      const { record } = readPidRecord();
+      if (record?.nonce && (record.state === "starting" || isProcessAlive(record.pid))) {
+        const directHealth = await pollMitmHealth(1500, MITM_INTERNAL_PORT, record.nonce);
+        const directMatches = record.state === "starting"
+          ? Number.isSafeInteger(directHealth?.pid) && directHealth.pid > 0
+          : directHealth?.pid === record.pid;
+        const publicHealth = directMatches
+          ? await pollMitmHealth(1500, MITM_PORT, record.nonce)
+          : null;
+        if (directMatches && publicHealth?.pid === directHealth.pid) {
+          running = true;
+          pid = directHealth.pid;
+        }
+      } else if (record?.version === 0 && isProcessAlive(record.pid)) {
+        const health = await pollMitmHealth(1500, MITM_PORT, null);
+        if (health?.pid === record.pid) {
           running = true;
-          pid = savedPid;
-        } else {
-          fs.unlinkSync(PID_FILE);
+          pid = record.pid;
         }
       }
-    } catch { /* ignore */ }
-  }
+    }
+  } catch { /* status is fail-closed */ }
 
   const dnsStatus = checkAllDNSStatus();
   const rootCACertPath = path.join(MITM_DIR, "rootCA.crt");
@@ -411,6 +929,8 @@ async function scheduleMitmRestart(apiKey) {
 
   if (mitmRestartCount >= MITM_MAX_RESTARTS) {
     err("Max restart attempts reached. Giving up.");
+    try { await cleanupRestartTerminalState("restart attempts exhausted"); }
+    catch (error) { err(`Terminal restart cleanup failed; ownership state was retained: ${error.message}`); }
     mitmIsRestarting = false;
     return;
   }
@@ -426,12 +946,20 @@ async function scheduleMitmRestart(apiKey) {
     const settings = _getSettings ? await _getSettings() : null;
     if (settings && !settings.mitmEnabled) {
       log("MITM disabled, skipping restart");
+      await cleanupRestartTerminalState("MITM disabled during restart");
       mitmIsRestarting = false;
       return;
     }
-    const password = getCachedPassword() || await loadEncryptedPassword();
-    if (!password && !IS_WIN) {
-      err("No cached password, cannot auto-restart");
+    const password = getCachedPassword();
+    if (IS_WIN && !serverRedirectOwned) {
+      err("MITM isolation is no longer owned; a fresh user-approved Windows start is required");
+      await cleanupRestartTerminalState("Windows redirect ownership lost");
+      mitmIsRestarting = false;
+      return;
+    }
+    if (!serverRedirectOwned && !password && !IS_WIN && isSudoPasswordRequired()) {
+      err("No in-memory sudo credential is available to restore the MITM redirect");
+      await cleanupRestartTerminalState("sudo credential unavailable");
       mitmIsRestarting = false;
       return;
     }
@@ -447,133 +975,437 @@ async function scheduleMitmRestart(apiKey) {
   }
 }
 
+async function cleanupRestartTerminalState(reason) {
+  return startGate.runAfterIdle(async () => {
+    // Persist the terminal state before removing the live recovery surface.
+    // If persistence fails, retain every ownership artifact for a safe retry.
+    await saveMitmSettings(false);
+    await killLeftoverMitm(getCachedPassword(), { preserveRedirectForRestart: false });
+    setCachedPassword(null);
+    log(`MITM disabled after terminal restart state: ${reason}`);
+  });
+}
+
 /**
  * Start MITM server only (cert + server, no DNS)
  */
 async function killPort443Owner(owner, sudoPassword) {
   if (!owner || !owner.pid) return;
+  const currentOwner = await getPort443Owner(sudoPassword);
+  if (!currentOwner
+    || currentOwner.pid !== owner.pid
+    || currentOwner.startIdentity !== owner.startIdentity) {
+    const error = new Error("Port 443 ownership changed before the approved process could be stopped.");
+    error.code = "PORT_443_BUSY";
+    error.portOwner = currentOwner || null;
+    throw error;
+  }
+  await killProcess(owner.pid, true, sudoPassword, owner.startIdentity);
+  await new Promise(r => setTimeout(r, 800));
+  if (isProcessAlive(owner.pid)) throw new Error(`Approved port owner ${owner.pid} remained alive after termination`);
+}
+
+async function cleanupPendingTrustRotations(sudoPassword, { replacementTrusted = false } = {}) {
+  if (!replacementTrusted) {
+    throw new Error("Refusing to remove previous Root CA trust before replacement trust is verified");
+  }
+  if (!fs.existsSync(MITM_DIR)) return;
+  const pending = fs.readdirSync(MITM_DIR)
+    .filter((name) => /^\.rootCA\.previous\.[a-f0-9.]+\.crt$/.test(name));
+  for (const name of pending) {
+    const certPath = path.join(MITM_DIR, name);
+    const stat = fs.lstatSync(certPath);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+      throw new Error(`Unsafe pending Root CA trust journal: ${certPath}`);
+    }
+    const password = await getInMemoryPassword(sudoPassword);
+    await uninstallCert(password, certPath);
+    fs.unlinkSync(certPath);
+  }
+}
+
+function publishTrustRotationJournal(sourcePath, journalPath) {
+  const sourceStat = fs.lstatSync(sourcePath);
+  if (!sourceStat.isFile() || sourceStat.isSymbolicLink()) {
+    throw new Error(`Unsafe Root CA certificate path: ${sourcePath}`);
+  }
+  const sourceFd = fs.openSync(sourcePath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+  let journalFd;
+  try {
+    const openedStat = fs.fstatSync(sourceFd);
+    if (!openedStat.isFile()
+      || String(openedStat.dev) !== String(sourceStat.dev)
+      || String(openedStat.ino) !== String(sourceStat.ino)) {
+      throw new Error("Root CA certificate changed while journaling trust rotation");
+    }
+    const bytes = fs.readFileSync(sourceFd);
+    journalFd = fs.openSync(journalPath, "wx", 0o600);
+    fs.writeFileSync(journalFd, bytes);
+    fs.fsyncSync(journalFd);
+    fs.closeSync(journalFd);
+    journalFd = undefined;
+    if (process.platform !== "win32") fs.chmodSync(journalPath, 0o600);
+    fsyncParentDirectory(journalPath);
+  } catch (error) {
+    if (journalFd !== undefined) try { fs.closeSync(journalFd); } catch { /* preserve error */ }
+    try { fs.unlinkSync(journalPath); } catch { /* absent or cleanup failure */ }
+    throw error;
+  } finally {
+    fs.closeSync(sourceFd);
+  }
+}
+
+async function mutatePortRedirect(action, sudoPassword, { allowExisting = true } = {}) {
   if (IS_WIN) {
+    const { runElevatedPowerShell } = require("./winElevated.js");
+    const sid = requireWindowsSid();
+    await runElevatedPowerShell(buildWindowsRedirect({ sid, publicPort: MITM_PORT, allowExisting })[action]);
+    return;
+  }
+  if (!isSudoAvailable()) {
+    if (action === "remove") return;
+    throw new Error("sudo is required to redirect local port 443 to the unprivileged MITM server");
+  }
+  const { execWithPassword } = require("./dns/dnsConfig");
+  const uid = requireNumericUid();
+  const redirect = IS_MAC
+    ? buildMacRedirect({ uid, publicPort: MITM_PORT, internalPort: MITM_NODE_PORT, allowExisting })
+    : buildLinuxRedirect({ uid, publicPort: MITM_PORT, internalPort: MITM_NODE_PORT, allowExisting });
+  // The diagnostic operation tag is ignored by the production executor but
+  // lets platform-neutral tests inject install and rollback outcomes without
+  // guessing from shell text that legitimately contains its own cleanup trap.
+  await execWithPassword(redirect[action], sudoPassword || "", {
+    operation: action,
+    scope: "mitm-port-redirect",
+  });
+}
+
+async function installPortRedirect(sudoPassword) {
+  let journal;
+  let hadJournal = false;
+  let createdJournal = false;
+  let mutationDispatched = false;
+  try {
     try {
-      execSync(`powershell -NonInteractive -WindowStyle Hidden -Command "Stop-Process -Id ${owner.pid} -Force -ErrorAction SilentlyContinue"`, { windowsHide: true });
-    } catch { /* best effort */ }
-  } else {
+      ({ record: journal } = readRedirectJournal());
+      if (!journal) throw new Error("Malformed MITM redirect ownership journal");
+      assertRedirectJournalOwner(journal);
+      if (journal.state === "installing" || journal.state === "uncertain") {
+        if (journal.state === "installing") {
+          const quarantined = { ...journal, state: "uncertain" };
+          if (!replaceRedirectJournalIfMatches(journal, quarantined)) {
+            const changed = new Error("A stale installing journal changed before it could be quarantined");
+            changed.code = "MITM_PRIVILEGED_OPERATION_UNCERTAIN";
+            throw changed;
+          }
+          journal = quarantined;
+        }
+        const uncertain = new Error("A previous privileged MITM operation has an unconfirmed outcome; reboot and perform the documented manual recovery before retrying");
+        uncertain.code = "MITM_PRIVILEGED_OPERATION_UNCERTAIN";
+        throw uncertain;
+      }
+      hadJournal = true;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      journal = createRedirectJournal();
+      createdJournal = true;
+    }
+
+    mutationDispatched = true;
+    await mutatePortRedirect("install", sudoPassword, { allowExisting: hadJournal });
+    if (journal.state === "installing") {
+      const installed = { ...journal, state: "installed" };
+      if (!replaceRedirectJournalIfMatches(journal, installed)) {
+        throw new Error("MITM redirect journal changed before installation commit");
+      }
+      journal = installed;
+    }
+  } catch (error) {
+    if (error.code === "MITM_PRIVILEGED_OPERATION_UNCERTAIN") throw error;
+    if (error.code === "PRIVILEGED_TERMINATION_UNCONFIRMED") {
+      // The wrapper could have returned while a privileged descendant was
+      // still running. Persist an irreversible quarantine marker: neither a
+      // start nor a stop may race that process with an inverse mutation.
+      const uncertainJournal = { ...journal, state: "uncertain" };
+      let quarantineError = null;
+      if (!journal || !replaceRedirectJournalIfMatches(journal, uncertainJournal)) {
+        quarantineError = new Error("MITM redirect journal could not be quarantined after an unconfirmed privileged operation");
+      }
+      const uncertain = new Error("Privileged MITM mutation outcome is unconfirmed; reboot and perform the documented manual recovery before retrying");
+      uncertain.code = "MITM_PRIVILEGED_OPERATION_UNCERTAIN";
+      uncertain.cause = error;
+      if (quarantineError) uncertain.cleanupError = quarantineError;
+      throw uncertain;
+    }
     try {
-      const { execWithPassword } = require("./dns/dnsConfig");
-      if (sudoPassword || isSudoAvailable()) {
-        await execWithPassword(`kill -9 ${owner.pid}`, sudoPassword || "");
-      } else {
-        execSync(`kill -9 ${owner.pid}`, { windowsHide: true });
+      // A normal rejection means the privileged process tree has closed. It is
+      // now safe to run the exact inverse operation and discard our journal.
+      if (mutationDispatched) await mutatePortRedirect("remove", sudoPassword);
+      if ((mutationDispatched || createdJournal) && journal) {
+        const current = readRedirectJournal();
+        if (current.record?.nonce === journal.nonce
+          && !removeRedirectJournalSnapshot(current.snapshot, current.record)) {
+          throw new Error("MITM redirect journal changed during failed-install cleanup");
+        }
       }
-    } catch { /* best effort */ }
+    } catch (cleanupError) {
+      error.cleanupError = cleanupError;
+      // Preserve the journal as recovery authority when cleanup is incomplete.
+      throw error;
+    }
+    throw error;
+  }
+}
+
+async function removePortRedirect(sudoPassword) {
+  let snapshot = null;
+  let journal = null;
+  try {
+    ({ snapshot, record: journal } = readRedirectJournal());
+    if (journal) {
+      assertRedirectJournalOwner(journal);
+      if (journal.state === "installing" || journal.state === "uncertain") {
+        if (journal.state === "installing") {
+          const quarantined = { ...journal, state: "uncertain" };
+          if (!replaceRedirectJournalIfMatches(journal, quarantined)) {
+            const changed = new Error("A stale installing journal changed before it could be quarantined");
+            changed.code = "MITM_PRIVILEGED_OPERATION_UNCERTAIN";
+            throw changed;
+          }
+          journal = quarantined;
+        }
+        const uncertain = new Error("Refusing cleanup while a previous privileged MITM operation has an unconfirmed outcome; reboot and perform the documented manual recovery");
+        uncertain.code = "MITM_PRIVILEGED_OPERATION_UNCERTAIN";
+        throw uncertain;
+      }
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+
+  await mutatePortRedirect("remove", sudoPassword);
+  if (snapshot && !removeRedirectJournalSnapshot(snapshot, journal)) {
+    throw new Error("MITM redirect journal changed during cleanup");
   }
-  await new Promise(r => setTimeout(r, 800));
 }
 
 async function startServer(apiKey, sudoPassword, forceKillPort443 = false) {
+  return startGate.run(async () => {
+  // The full proxy and all user-owned files must stay unprivileged. Refuse an
+  // elevated parent before reading or mutating PID, CA, trust, DNS, redirect,
+  // or process state.
+  if (isAdmin()) {
+    const error = new Error("Refusing to run the full MITM proxy with an elevated parent; start DurinDoor as a standard user");
+    error.code = "MITM_ELEVATED_PARENT_UNSAFE";
+    throw error;
+  }
+
   if (!serverProcess || serverProcess.killed) {
     try {
       if (fs.existsSync(PID_FILE)) {
-        const savedPid = parseInt(fs.readFileSync(PID_FILE, "utf-8").trim(), 10);
-        if (savedPid && isProcessAlive(savedPid)) {
-          serverPid = savedPid;
-          log(`♻️ Reusing existing process (PID: ${savedPid})`);
-          await saveMitmSettings(true, sudoPassword);
-          if (sudoPassword) setCachedPassword(sudoPassword);
-          return { running: true, pid: savedPid };
-        } else {
-          fs.unlinkSync(PID_FILE);
+        const { snapshot, record } = readPidRecord();
+        if (record?.nonce) {
+          const health = await pollMitmHealth(1500, MITM_INTERNAL_PORT, record.nonce);
+          const runningMatches = record.state === "running" && health?.pid === record.pid;
+          const startingMatches = record.state === "starting"
+            && Number.isSafeInteger(health?.pid)
+            && health.pid > 0;
+          if (runningMatches || startingMatches) {
+            const reusableRecord = startingMatches
+              ? {
+                ...record,
+                pid: health.pid,
+                state: "running",
+                // A bootstrap manager and its serving child can have distinct
+                // PIDs. Never carry the launcher's identity onto that child.
+                processStart: health.pid === record.pid ? record.processStart : null,
+              }
+              : record;
+            const reusableProcessStart = reusableRecord.processStart
+              || await bindAuthenticatedProcessIdentity(reusableRecord.pid, reusableRecord.nonce, MITM_INTERNAL_PORT);
+            if (!reusableProcessStart
+              || getProcessStartIdentity(reusableRecord.pid) !== reusableProcessStart) {
+              throw new Error("Existing MITM process start identity could not be authenticated");
+            }
+            reusableRecord.processStart = reusableProcessStart;
+            if (startingMatches && !replacePidFileIfMatches(record, reusableRecord)) {
+              throw new Error("Recovered MITM server PID could not be recorded safely");
+            }
+            let installedHere = false;
+            try {
+              if (!serverRedirectOwned) {
+                await installPortRedirect(sudoPassword);
+                installedHere = true;
+              }
+              const publicHealth = await pollMitmHealth(1500, MITM_PORT, reusableRecord.nonce);
+              if (publicHealth?.pid !== reusableRecord.pid) {
+                const error = new Error("Existing MITM process is healthy, but its authenticated public-port redirect is not");
+                error.code = "MITM_REDIRECT_UNHEALTHY";
+                throw error;
+              }
+            } catch (error) {
+              if (installedHere) {
+                try { await removePortRedirect(sudoPassword); }
+                catch (cleanupError) { error.cleanupError = cleanupError; }
+              }
+              throw error;
+            }
+            serverPid = reusableRecord.pid;
+            serverLauncherPid = reusableRecord.launcherPid;
+            serverInstanceNonce = reusableRecord.nonce;
+            serverLauncherStart = reusableRecord.launcherStart;
+            serverProcessStart = reusableProcessStart;
+            serverRedirectOwned = true;
+            log(`♻️ Reusing existing process (PID: ${reusableRecord.pid})`);
+            try {
+              await saveMitmSettings(true);
+            } catch (error) {
+              await throwAfterRollback(error, {
+                actualPid: reusableRecord.pid,
+                launcherPid: reusableRecord.launcherPid,
+                nonce: reusableRecord.nonce,
+                sudoPassword,
+                redirectOwned: true,
+              });
+            }
+            if (sudoPassword) setCachedPassword(sudoPassword);
+            return { running: true, pid: reusableRecord.pid };
+          }
+          log(`[MITM] Refusing to reuse unverified PID ${record.pid}`);
+        } else if (record?.version === 0 && isProcessAlive(record.pid)) {
+          const error = new Error(`Legacy MITM PID ${record.pid} has no nonce/start identity and cannot be adopted safely`);
+          error.code = "MITM_OWNERSHIP_UNVERIFIED";
+          throw error;
         }
       }
-    } catch { /* ignore */ }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
   }
 
   if (serverProcess && !serverProcess.killed) {
     throw new Error("MITM server is already running");
   }
 
-  if (mitmStarting) {
-    throw new Error("MITM server is already starting");
-  }
-  mitmStarting = true;
-
-  // Atomically claim lock to prevent concurrent startServer across processes.
-  // O_EXCL (flag: "wx") fails with EEXIST if the file already exists.
-  try {
-    fs.writeFileSync(LOCK_FILE, String(process.pid), { flag: "wx" });
-  } catch (e) {
-    if (e.code === "EEXIST") {
-      let stale = false;
-      try {
-        const pid = parseInt(fs.readFileSync(LOCK_FILE, "utf-8").trim(), 10);
-        stale = !pid || !isProcessAlive(pid);
-      } catch { stale = true; } // unreadable lock → treat as stale
-      if (!stale) {
-        mitmStarting = false;
-        throw new Error("MITM server is already starting (lock contention)");
-      }
-      try { fs.unlinkSync(LOCK_FILE); } catch { /* ignore */ }
-      fs.writeFileSync(LOCK_FILE, String(process.pid), { flag: "wx" });
-    } else {
-      mitmStarting = false;
-      throw e;
+  if (!IS_WIN) {
+    const internalPortStatus = await checkLoopbackPortFree(MITM_INTERNAL_PORT);
+    if (internalPortStatus !== "free") {
+      const error = new Error(`Internal MITM port ${MITM_INTERNAL_PORT} is already in use; refusing cross-DATA_DIR redirect adoption`);
+      error.code = "MITM_INTERNAL_PORT_BUSY";
+      throw error;
+    }
+  } else {
+    const incumbentStatus = await checkPort443Free();
+    const hasRecoveryEvidence = fs.existsSync(PID_FILE)
+      || fs.existsSync(REDIRECT_JOURNAL_FILE)
+      || Object.values(checkAllDNSStatus()).some(Boolean);
+    if (incumbentStatus === "in-use" && hasRecoveryEvidence) {
+      const error = new Error("Port 443 is already occupied by an incumbent process; refusing stale cross-DATA_DIR cleanup");
+      error.code = "PORT_443_BUSY";
+      throw error;
     }
   }
 
-  try {
+  // Only reconcile stale local journals after proving that no incumbent proxy
+  // from another DATA_DIR is listening on the per-user global transport.
   await killLeftoverMitm(sudoPassword);
 
-  if (!IS_WIN) {
-    const portStatus = await checkPort443Free();
-    if (portStatus === "in-use" || portStatus === "no-permission") {
-      const owner = await getPort443Owner(sudoPassword);
-      if (owner) {
-        const shortName = owner.name.includes("/")
-          ? owner.name.split("/").filter(Boolean).pop()
-          : owner.name;
-        if (forceKillPort443) {
-          log(`Killing process on port 443 (PID ${owner.pid}, name=${shortName})...`);
-          await killPort443Owner(owner, sudoPassword);
-        } else {
-          const e = new Error(`Port 443 is already in use by "${shortName}" (PID ${owner.pid}).`);
-          e.code = "PORT_443_BUSY";
-          e.portOwner = { pid: owner.pid, name: shortName };
-          throw e;
-        }
+  if (!IS_WIN && await checkLoopbackPortFree(MITM_INTERNAL_PORT) !== "free") {
+    const error = new Error(`Internal MITM port ${MITM_INTERNAL_PORT} became busy during startup`);
+    error.code = "MITM_INTERNAL_PORT_BUSY";
+    throw error;
+  }
+
+  const portStatus = await checkPort443Free();
+  if (portStatus === "in-use" || portStatus === "no-permission") {
+    const owner = await getPort443Owner(sudoPassword);
+    if (owner) {
+      const shortName = owner.name.includes("/")
+        ? owner.name.split("/").filter(Boolean).pop()
+        : owner.name;
+      if (forceKillPort443) {
+        log(`Killing process on port 443 (PID ${owner.pid}, name=${shortName})...`);
+        await killPort443Owner(owner, sudoPassword);
+      } else {
+        const e = new Error(`Port 443 is already in use by "${shortName}" (PID ${owner.pid}).`);
+        e.code = "PORT_443_BUSY";
+        e.portOwner = { pid: owner.pid, name: shortName };
+        throw e;
       }
+    } else if (portStatus === "in-use") {
+      const error = new Error("Port 443 is in use, but its process identity could not be verified safely");
+      error.code = "PORT_443_BUSY";
+      error.portOwner = null;
+      throw error;
     }
   }
 
-  // Step 1: Generate Root CA if missing or expired
+  // Step 1: Generate Root CA if missing, invalid, mismatched, or expiring.
   const rootCACertPath = path.join(MITM_DIR, "rootCA.crt");
-  const rootCAKeyPath = path.join(MITM_DIR, "rootCA.key");
-  const certExists = fs.existsSync(rootCACertPath) && fs.existsSync(rootCAKeyPath);
+  const generatedRootCA = await withRootCALock(async () => {
+    const oldCertExists = fs.existsSync(rootCACertPath);
+    const needsReplacement = !hasValidRootCA();
+    let previousCertPath = null;
+    let replacementPublished = false;
+    try {
+      let oldCertIsTrustable = false;
+      if (needsReplacement && oldCertExists) {
+        try {
+          assertDurinDoorRootCertificate(rootCACertPath);
+          oldCertIsTrustable = true;
+        } catch (error) {
+          log(`🔐 Cert: invalid prior certificate will be replaced without trust cleanup (${error.message})`);
+        }
+      }
+      if (needsReplacement && oldCertIsTrustable) {
+        // Preserve the old certificate until the replacement pair is fully
+        // published. A generation failure must not remove the usable trust
+        // registration for the pair that rootCA.js restores on disk.
+        previousCertPath = path.join(
+          MITM_DIR,
+          `.rootCA.previous.${process.pid}.${crypto.randomBytes(8).toString("hex")}.crt`,
+        );
+        publishTrustRotationJournal(rootCACertPath, previousCertPath);
+      }
 
-  if (!certExists || isCertExpired(rootCACertPath)) {
-    if (certExists) {
-      // Uninstall expired cert from system store before regenerating
-      log("🔐 Cert expired — uninstalling old cert...");
-      const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
-      try { await uninstallCert(password, rootCACertPath); } catch { /* best effort */ }
+      let generated;
+      try {
+        generated = ensureRootCASync();
+        replacementPublished = generated;
+      } catch (error) {
+        replacementPublished = error?.rootCAPublished === true;
+        throw error;
+      }
+      return generated;
+    } finally {
+      if (previousCertPath && !replacementPublished) {
+        try { fs.unlinkSync(previousCertPath); } catch { /* public cert cleanup is best effort */ }
+      }
     }
-    log("🔐 Generating Root CA...");
-    await generateCert();
-  }
+  });
+  if (generatedRootCA) log("🔐 Generated Root CA");
 
   // Step 1.5: Auto-install Root CA if not trusted yet
   const { checkCertInstalled } = require("./cert/install");
-  const rootCATrusted = await checkCertInstalled(rootCACertPath);
+  let rootCATrusted = await checkCertInstalled(rootCACertPath);
   const linuxNoSystemTrust = !IS_WIN && !IS_MAC && !isSudoAvailable();
   if (!rootCATrusted) {
     log("🔐 Cert: not trusted → installing...");
-    const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
+    const password = await getInMemoryPassword(sudoPassword);
     if (linuxNoSystemTrust) {
-      log(`🔐 Cert: skipping system trust (no sudo). Install ${rootCACertPath} as a trusted CA on machines that use this proxy.`);
+      await installCert(null, rootCACertPath);
+      rootCATrusted = await checkCertInstalled(rootCACertPath);
+      if (!rootCATrusted) {
+        log(`🔐 Cert: no verifiable local trust store (no sudo). Install ${rootCACertPath} as a trusted CA on machines that use this proxy.`);
+      }
     } else {
       if (!password && isSudoPasswordRequired()) {
         throw new Error("Sudo password required to install Root CA certificate");
       }
       try {
         await installCert(password, rootCACertPath);
+        rootCATrusted = await checkCertInstalled(rootCACertPath);
+        if (!rootCATrusted) throw new Error("replacement trust could not be verified after installation");
         log("🔐 Cert: ✅ trusted");
       } catch (e) {
         throw new Error(`Failed to trust certificate: ${e.message}`);
@@ -583,118 +1415,122 @@ async function startServer(apiKey, sudoPassword, forceKillPort443 = false) {
     log("🔐 Cert: already trusted ✅");
   }
 
-  // Step 2: Spawn server (Root CA already installed in Step 1.5)
-  // Verify server.js exists — recopy if runtime file was deleted (antivirus/cleanup)
-  let effectiveServerPath = SERVER_PATH;
+  // Only after the replacement certificate is demonstrably trusted may the
+  // previous trust entry and its exact-certificate journal be removed. A UAC,
+  // sudo, or verification failure leaves the old trust available for retry.
+  if (rootCATrusted) {
+    await withRootCALock(() => cleanupPendingTrustRotations(sudoPassword, {
+      replacementTrusted: true,
+    }));
+  }
+
+  // Step 2: spawn the full proxy as the standard user after narrow system
+  // configuration has succeeded.
+  const effectiveServerPath = resolveBundledServerPath();
   if (!effectiveServerPath || !fs.existsSync(effectiveServerPath)) {
-    log(`[MITM] server.js missing at ${effectiveServerPath} → recopying`);
-    effectiveServerPath = ensureRuntimeServer(resolveBundledServerPath());
-    if (!effectiveServerPath || !fs.existsSync(effectiveServerPath)) {
-      throw new Error(`MITM server.js not found at ${effectiveServerPath}. Reinstall 9router.`);
-    }
+    throw new Error(`MITM server.js not found at ${effectiveServerPath}. Reinstall DurinDoor.`);
   }
   const mitmRouterBase = await resolveMitmRouterBaseUrl();
+  const instanceNonce = crypto.randomBytes(24).toString("hex");
+  serverLaunchGatePath = path.join(MITM_DIR, `.launch.${instanceNonce}.gate`);
+  let startError = null;
+  let spawnFailure = null;
+  const trackSpawn = (child) => {
+    child?.once("error", (error) => {
+      spawnFailure = error;
+      startError = error.message;
+      err(`[MITM] Server process error: ${error.message}`);
+    });
+    return child;
+  };
   log(`🚀 Starting server... (router: ${mitmRouterBase})`);
-  if (IS_WIN) {
-    // Check port 443 — ask user before killing
-    const winOwner = await getPort443Owner(sudoPassword);
-    if (winOwner) {
-      if (forceKillPort443) {
-        log(`Killing process on port 443 (PID ${winOwner.pid}, name=${winOwner.name})...`);
-        await killPort443Owner(winOwner, sudoPassword);
-      } else {
-        const e = new Error(`Port 443 is already in use by "${winOwner.name}" (PID ${winOwner.pid}).`);
-        e.code = "PORT_443_BUSY";
-        e.portOwner = { pid: winOwner.pid, name: winOwner.name };
-        throw e;
-      }
-    }
-
-    // Spawn directly — process already has admin rights
-    // cwd=tmpdir so process doesn't lock the install dir on Windows (EBUSY on update)
-    serverProcess = spawn(
-      process.execPath,
-      [effectiveServerPath],
-      {
-        detached: false,
-        windowsHide: true,
-        cwd: os.tmpdir(),
-        stdio: ["ignore", "pipe", "pipe"],
-        env: {
-          ...process.env,
-          ROUTER_API_KEY: apiKey,
-          NODE_ENV: "production",
-          MITM_ROUTER_BASE: mitmRouterBase,
-        },
-      }
-    );
-
-    if (_updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
-  } else if (isSudoAvailable()) {
-    // Pass HOME explicitly so os.homedir() resolves to the unprivileged user's home
-    // instead of /root when sudo resets the environment.
-    const inlineCmd = [
-      `HOME=${shellQuoteSingle(os.homedir())}`,
-      `ROUTER_API_KEY=${shellQuoteSingle(apiKey)}`,
-      `MITM_ROUTER_BASE=${shellQuoteSingle(mitmRouterBase)}`,
-      "NODE_ENV=production",
-      shellQuoteSingle(process.execPath),
-      shellQuoteSingle(effectiveServerPath),
-    ].join(" ");
-    serverProcess = spawn(
-      "sudo", ["-S", "-E", "sh", "-c", inlineCmd],
-      { detached: false, windowsHide: true, stdio: ["pipe", "pipe", "pipe"] }
-    );
-    serverProcess.stdin.write(`${sudoPassword}\n`);
-    serverProcess.stdin.end();
-  } else {
-    // Docker/minimal images: no sudo — same as Windows-style direct spawn
-    serverProcess = spawn(process.execPath, [effectiveServerPath], {
+  if (!serverRedirectOwned) {
+    await installPortRedirect(sudoPassword);
+    serverRedirectOwned = true;
+  }
+  const trustedChildPlatformEnv = IS_WIN
+    ? buildMinimalWindowsEnv()
+    : { PATH: FIXED_UNIX_PATH, LANG: "C", LC_ALL: "C" };
+  const childEnv = Object.fromEntries(Object.entries({
+    ...trustedChildPlatformEnv,
+    HOME: os.homedir(),
+    DATA_DIR,
+    TMPDIR: process.env.TMPDIR,
+    TEMP: process.env.TEMP,
+    TMP: process.env.TMP,
+    ROUTER_API_KEY: apiKey,
+    NODE_ENV: "production",
+    MITM_ROUTER_BASE: mitmRouterBase,
+    MITM_INSTANCE_NONCE: instanceNonce,
+    MITM_LAUNCH_GATE_FILE: serverLaunchGatePath,
+    MITM_MANAGER_PID: String(process.pid),
+    MITM_CA_PREPARED: "1",
+    MITM_LISTEN_PORT: String(MITM_INTERNAL_PORT),
+  }).filter(([, value]) => value != null));
+  try {
+    serverProcess = trackSpawn(spawn(process.execPath, [effectiveServerPath, MITM_ENTRY_ARG], {
       detached: false,
       windowsHide: true,
       cwd: os.tmpdir(),
       stdio: ["ignore", "pipe", "pipe"],
-      env: {
-        ...process.env,
-        ROUTER_API_KEY: apiKey,
-        NODE_ENV: "production",
-        MITM_ROUTER_BASE: mitmRouterBase,
-      },
-    });
+      env: childEnv,
+    }));
+  } catch (error) {
+    try {
+      await removePortRedirect(sudoPassword);
+      serverRedirectOwned = false;
+    } catch (cleanupError) {
+      error.cleanupError = cleanupError;
+    }
+    throw error;
   }
 
-  if (serverProcess) {
-    serverPid = serverProcess.pid;
-    fs.writeFileSync(PID_FILE, String(serverPid));
-    mitmLastStartTime = Date.now();
-  }
-
-  // Set NODE_EXTRA_CA_CERTS so Node-based GUI apps (Electron/AG language_server) trust MITM cert
-  if (IS_MAC) {
-    const rootCAPath = path.join(MITM_DIR, "rootCA.crt");
-    if (fs.existsSync(rootCAPath)) {
-      exec(`launchctl setenv NODE_EXTRA_CA_CERTS "${rootCAPath}"`, { windowsHide: true }, (e) => {
-        if (e) log(`[launchctl] Failed to set NODE_EXTRA_CA_CERTS: ${e.message}`);
-        else log(`[launchctl] NODE_EXTRA_CA_CERTS set to ${rootCAPath}`);
-      });
-    }
-  } else if (IS_WIN) {
-    const rootCAPath = path.join(MITM_DIR, "rootCA.crt");
-    if (fs.existsSync(rootCAPath)) {
-      exec(`setx NODE_EXTRA_CA_CERTS "${rootCAPath}"`, { windowsHide: true }, (e) => {
-        if (e) log(`[setx] Failed to set NODE_EXTRA_CA_CERTS: ${e.message}`);
-        else log(`[setx] NODE_EXTRA_CA_CERTS set for current user`);
-      });
-    }
+  const launchedProcess = serverProcess;
+  let startupComplete = false;
+  let exitedDuringStartup = false;
+
+  if (!launchedProcess?.pid) {
+    await throwAfterRollback(
+      new Error("MITM server process failed to spawn"),
+      { launchedProcess, nonce: instanceNonce, sudoPassword },
+    );
   }
 
-  let startError = null;
+  const launcherPid = launchedProcess.pid;
+  const launcherStart = getProcessStartIdentity(launcherPid);
+  if (!launcherStart) {
+    await throwAfterRollback(
+      new Error("MITM launcher process identity could not be established safely"),
+      { launchedProcess, launcherPid, nonce: instanceNonce, sudoPassword },
+    );
+  }
+  const startingRecord = {
+    pid: launcherPid,
+    launcherPid,
+    nonce: instanceNonce,
+    state: "starting",
+    launcherStart,
+    processStart: launcherStart,
+  };
+  serverPid = launcherPid;
+  serverLauncherPid = launcherPid;
+  serverInstanceNonce = instanceNonce;
+  serverLauncherStart = launcherStart;
+  serverProcessStart = launcherStart;
+  try {
+    writeInitialPidRecord(startingRecord);
+    publishLaunchAuthorization(serverLaunchGatePath, instanceNonce);
+  } catch (error) {
+    await throwAfterRollback(error, { launchedProcess, launcherPid, nonce: instanceNonce, sudoPassword });
+  }
+  mitmLastStartTime = Date.now();
+
   if (serverProcess) {
-    serverProcess.stdout.on("data", (data) => {
+    launchedProcess.stdout?.on("data", (data) => {
       // server.js already formats its own logs — print as-is
       process.stdout.write(data);
     });
-    serverProcess.stderr.on("data", (data) => {
+    launchedProcess.stderr?.on("data", (data) => {
       const msg = data.toString().trim();
       // Mac/Linux: filter sudo password prompt noise
       if (msg && (IS_WIN || (!msg.includes("Password:") && !msg.includes("password for")))) {
@@ -704,30 +1540,121 @@ async function startServer(apiKey, sudoPassword, forceKillPort443 = false) {
       // Detect wrong/missing password — clear cache and stop retry loop
       if (!IS_WIN && (msg.includes("incorrect password") || msg.includes("no password was provided"))) {
         setCachedPassword(null);
-        clearEncryptedPassword();
+        void clearEncryptedPassword().catch((error) => {
+          err(`[MITM] Legacy sudo credential purge failed: ${error.message}`);
+        });
         mitmIsRestarting = true; // prevent scheduleMitmRestart from firing
       }
     });
-    serverProcess.on("exit", (code) => {
+    launchedProcess.on("exit", (code) => {
+      if (!startupComplete) {
+        exitedDuringStartup = true;
+        startError ||= `Server exited during startup (code: ${code})`;
+        return;
+      }
+      if (serverProcess !== launchedProcess || serverInstanceNonce !== instanceNonce) return;
       log(`Server exited (code: ${code})`);
       serverProcess = null;
       serverPid = null;
-      try { fs.unlinkSync(PID_FILE); } catch { /* ignore */ }
-      try { fs.unlinkSync(LOCK_FILE); } catch { /* ignore */ }
-      // Auto-restart on unexpected exit
-      if (code !== 0 && !mitmIsRestarting) scheduleMitmRestart(apiKey);
+      serverLauncherPid = null;
+      serverInstanceNonce = null;
+      serverLauncherStart = null;
+      serverProcessStart = null;
+      if (!mitmIsRestarting) {
+        // Every unrequested exit, including code 0, is unexpected. Keep the
+        // durable PID/redirect journals and use the bounded restart policy;
+        // terminal exhaustion performs verified cleanup and disables state.
+        void scheduleMitmRestart(apiKey);
+      }
     });
   }
 
-  const health = await pollMitmHealth(8000, MITM_PORT);
-  if (!health) {
-    if (serverProcess && !serverProcess.killed) { try { serverProcess.kill(); } catch { /* ignore */ } serverProcess = null; }
+  const health = await pollMitmHealth(8000, MITM_INTERNAL_PORT, instanceNonce);
+  const authenticatedProcessStart = Number.isSafeInteger(health?.pid) && health.pid > 0
+    ? await bindAuthenticatedProcessIdentity(health.pid, instanceNonce, MITM_INTERNAL_PORT)
+    : null;
+  const publicHealth = health
+    ? await pollMitmHealth(3000, MITM_PORT, instanceNonce)
+    : null;
+  const launchEnded = exitedDuringStartup
+    || launchedProcess.exitCode != null
+    || launchedProcess.signalCode != null;
+  if (!health
+    || spawnFailure
+    || launchEnded
+    || publicHealth?.pid !== health?.pid
+    || serverProcess !== launchedProcess
+    || !Number.isSafeInteger(health.pid)
+    || health.pid <= 0
+    || !authenticatedProcessStart) {
     const processUsing443 = getProcessUsingPort443();
     const portInfo = processUsing443 ? ` Port 443 already in use by ${processUsing443}.` : "";
-    const reason = startError || `Check sudo password or port 443 access.${portInfo}`;
-    throw new Error(`MITM server failed to start. ${reason}`);
+    const reason = startError || `Check the local ${MITM_PORT}→${MITM_INTERNAL_PORT} redirect/isolation and port access.${portInfo}`;
+    await throwAfterRollback(
+      new Error(`MITM server failed to start. ${reason}`),
+      {
+        launchedProcess,
+        launcherPid,
+        actualPid: health?.pid || null,
+        nonce: instanceNonce,
+        sudoPassword,
+        launcherStart,
+        actualStart: authenticatedProcessStart
+          || (health?.pid === launcherPid ? launcherStart : null),
+      },
+    );
   }
 
+  const runningRecord = {
+    pid: health.pid,
+    launcherPid,
+    nonce: instanceNonce,
+    state: "running",
+    launcherStart,
+    processStart: null,
+  };
+  runningRecord.processStart = authenticatedProcessStart;
+  try {
+    if (!replacePidFileIfMatches(startingRecord, runningRecord)) {
+      throw new Error("MITM server health PID could not be recorded safely");
+    }
+  } catch (error) {
+    await throwAfterRollback(error, {
+      launchedProcess,
+      launcherPid,
+      actualPid: health.pid,
+      nonce: instanceNonce,
+      sudoPassword,
+      launcherStart,
+      actualStart: authenticatedProcessStart,
+    });
+  }
+  serverPid = health.pid;
+  serverLauncherPid = launcherPid;
+  serverInstanceNonce = instanceNonce;
+  serverLauncherStart = launcherStart;
+  serverProcessStart = authenticatedProcessStart;
+  try {
+    const launchSnapshot = readFileSnapshot(serverLaunchGatePath);
+    if (launchSnapshot.raw !== `${instanceNonce}\n`
+      || !removeFileIfUnchanged(serverLaunchGatePath, launchSnapshot)) {
+      throw new Error("MITM launch authorization was not consumed safely");
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      await throwAfterRollback(error, {
+        launchedProcess,
+        launcherPid,
+        actualPid: health.pid,
+        nonce: instanceNonce,
+        sudoPassword,
+        redirectOwned: true,
+      });
+    }
+  }
+  serverLaunchGatePath = null;
+  startupComplete = true;
+
   if (_updateSettings) await _updateSettings({ mitmCertInstalled: true }).catch(() => { });
 
   log(`✅ Server healthy (PID: ${serverPid || health.pid})`);
@@ -738,138 +1665,236 @@ async function startServer(apiKey, sudoPassword, forceKillPort443 = false) {
     log(`🌐 DNS ${tool}: ${active ? "✅ active" : "❌ inactive"}`);
   }
 
-  await saveMitmSettings(true, sudoPassword);
+  try {
+    await saveMitmSettings(true);
+  } catch (error) {
+    await throwAfterRollback(error, {
+      launchedProcess,
+      launcherPid,
+      actualPid: health.pid,
+      nonce: instanceNonce,
+      sudoPassword,
+      redirectOwned: true,
+    });
+  }
   if (sudoPassword) setCachedPassword(sudoPassword);
 
-  // Server is healthy — remove lock file (PID file persists as the marker)
-  try { fs.unlinkSync(LOCK_FILE); } catch { /* ignore */ }
-
   return { running: true, pid: serverPid };
-  } catch (e) {
-    // Clean up lock on any failure
-    try { fs.unlinkSync(LOCK_FILE); } catch { /* ignore */ }
-    mitmStarting = false;
-    throw e;
-  } finally {
-    mitmStarting = false;
-  }
+  });
 }
 
 /**
  * Stop MITM server — removes ALL tool DNS entries first, then kills server
  */
-async function stopServer(sudoPassword) {
+async function stopServer(sudoPassword, { preserveDesiredState = false } = {}) {
   // Prevent auto-restart from triggering on intentional stop
   mitmIsRestarting = true;
   mitmRestartCount = 0;
+  try {
+    return await startGate.runAfterIdle(async () => {
   log("⏹ Stopping server...");
 
   // Kill server process
   const proc = serverProcess;
-  const pidToKill = proc && !proc.killed
-    ? proc.pid
-    : (() => { try { return parseInt(fs.readFileSync(PID_FILE, "utf-8").trim(), 10); } catch { return null; } })();
-
-  if (pidToKill && isProcessAlive(pidToKill)) {
-    log(`Killing server (PID: ${pidToKill})...`);
-    killProcess(pidToKill, false, sudoPassword);
-    await new Promise(r => setTimeout(r, 1000));
-    if (isProcessAlive(pidToKill)) killProcess(pidToKill, true, sudoPassword);
+  let record = null;
+  let persistedSnapshot = null;
+  try { ({ record, snapshot: persistedSnapshot } = readPidRecord()); }
+  catch (error) { if (error.code !== "ENOENT") throw error; }
+  const persistedRecord = record;
+  const localRecord = serverInstanceNonce && serverPid
+    ? {
+      version: 1,
+      pid: serverPid,
+      launcherPid: serverLauncherPid || serverPid,
+      nonce: serverInstanceNonce,
+      state: "running",
+      launcherStart: serverLauncherStart,
+      processStart: serverProcessStart,
+    }
+    : null;
+  let candidate = localRecord || record;
+  let verified = false;
+  let targetPid = candidate?.pid || null;
+  let targetStart = candidate?.processStart
+    || (candidate?.pid === candidate?.launcherPid ? candidate?.launcherStart : null);
+  let forceOwnedLauncher = false;
+  const locallyOwnedLauncher = Boolean(
+    localRecord
+    && proc?.pid === localRecord.launcherPid
+    && getProcessStartIdentity(localRecord.launcherPid) === localRecord.launcherStart,
+  );
+
+  const candidateHasLiveProcess = candidate
+    && (isProcessAlive(candidate.pid) || isProcessAlive(candidate.launcherPid));
+  if (candidate && (candidate.state !== "starting" ? isProcessAlive(candidate.pid) : candidateHasLiveProcess)) {
+    if (candidate.version === 0) {
+      const error = new Error("Live legacy PID metadata cannot authenticate process ownership safely");
+      error.code = "MITM_OWNERSHIP_UNVERIFIED";
+      throw error;
+    }
+    const healthPort = candidate.version === 0 ? MITM_PORT : MITM_INTERNAL_PORT;
+    const health = await pollMitmHealth(1500, healthPort, candidate.nonce || null);
+    const healthPid = Number.isSafeInteger(health?.pid) && health.pid > 0 ? health.pid : null;
+    verified = candidate.state === "starting"
+      ? healthPid != null
+      : healthPid === candidate.pid;
+    if (verified && candidate.state === "starting") {
+      targetPid = healthPid;
+      if (healthPid !== candidate.pid) targetStart = null;
+    }
+    if (verified && !targetStart) {
+      targetStart = await bindAuthenticatedProcessIdentity(targetPid, candidate.nonce, healthPort);
+      if (!targetStart) verified = false;
+    }
+    if (!verified) log(`[MITM] Refusing to stop unverified PID ${candidate.pid}`);
+  } else if (candidate) {
+    // A dead running, starting, or legacy PID is stale metadata, not an owned
+    // process to kill. Privileged current-user state is still cleaned below.
+    verified = true;
+    targetPid = null;
   }
-  serverProcess = null;
-  serverPid = null;
 
-  if (IS_WIN) {
-    const hostsFile = path.join(process.env.SystemRoot || "C:\\Windows", "System32", "drivers", "etc", "hosts");
-    const allHosts = Object.values(TOOL_HOSTS).flat();
-    try {
-      const { isAdmin, runElevatedPowerShell, quotePs } = require("./winElevated.js");
-      if (isAdmin()) {
-        // Direct fs write — bypass PowerShell to avoid parser pitfalls
-        const content = fs.readFileSync(hostsFile, "utf8");
-        const filtered = content.split(/\r?\n/).filter(l => !allHosts.some(h => l.includes(h))).join("\r\n");
-        const next = filtered.replace(/[\r\n\s]+$/g, "") + "\r\n";
-        if (next !== content) fs.writeFileSync(hostsFile, next, "utf8");
-        try { require("child_process").execSync("ipconfig /flushdns", { windowsHide: true, stdio: "ignore" }); } catch { /* ignore */ }
-        log("🌐 DNS: ✅ all tool hosts removed");
-      } else {
-        const hostsList = allHosts.map(quotePs).join(",");
-        const script = `
-          $hosts = @(${hostsList})
-          $lines = Get-Content -LiteralPath ${quotePs(hostsFile)}
-          $filtered = $lines | Where-Object {
-            $line = $_
-            -not ($hosts | Where-Object { $line -match [regex]::Escape($_) })
-          }
-          Set-Content -LiteralPath ${quotePs(hostsFile)} -Value $filtered
-          ipconfig /flushdns | Out-Null
-        `;
-        await runElevatedPowerShell(script);
-      }
-    } catch (e) { err(`Failed to clean hosts: ${e.message}`); }
-  } else {
-    await removeAllDNSEntries(sudoPassword);
+  if (!verified && locallyOwnedLauncher) {
+    verified = true;
+    targetPid = localRecord.launcherPid;
+    targetStart = localRecord.launcherStart;
+    forceOwnedLauncher = true;
+  }
+  if (candidate && !verified) {
+    const error = new Error("MITM process ownership could not be verified; server metadata was preserved");
+    error.code = "MITM_OWNERSHIP_UNVERIFIED";
+    throw error;
   }
 
-  // Unset NODE_EXTRA_CA_CERTS so apps don't keep trusting stale MITM cert
-  if (IS_MAC) {
-    exec(`launchctl unsetenv NODE_EXTRA_CA_CERTS`, { windowsHide: true }, (e) => {
-      if (e) log(`[launchctl] Failed to unset NODE_EXTRA_CA_CERTS: ${e.message}`);
-      else log(`[launchctl] NODE_EXTRA_CA_CERTS unset`);
-    });
-  } else if (IS_WIN) {
-    exec(`reg delete HKCU\\Environment /F /V NODE_EXTRA_CA_CERTS`, { windowsHide: true }, (e) => {
-      if (e) log(`[reg] Failed to unset NODE_EXTRA_CA_CERTS: ${e.message}`);
-      else log(`[reg] NODE_EXTRA_CA_CERTS unset`);
-    });
+  const hasAuthenticatedLiveOwnership = Boolean(candidate?.version === 1 && verified && targetPid);
+  const hasCleanupEvidence = Boolean(
+    persistedSnapshot
+    || serverRedirectOwned
+    || fs.existsSync(REDIRECT_JOURNAL_FILE)
+    || Object.values(checkAllDNSStatus()).some(Boolean)
+  );
+  if (!hasAuthenticatedLiveOwnership && hasCleanupEvidence) {
+    const incumbentStatus = await checkLoopbackPortFree(IS_WIN ? MITM_PORT : MITM_INTERNAL_PORT);
+    if (incumbentStatus !== "free") {
+      const error = new Error("A live MITM transport exists without locally authenticated PID ownership; refusing cross-DATA_DIR cleanup");
+      error.code = "MITM_OWNERSHIP_UNVERIFIED";
+      throw error;
+    }
   }
 
-  try { fs.unlinkSync(PID_FILE); } catch { /* ignore */ }
-  try { fs.unlinkSync(LOCK_FILE); } catch { /* ignore */ }
-  await saveMitmSettings(false, null);
-  mitmIsRestarting = false;
+  // Disable durable desired state before privileged cleanup. If this write
+  // fails, leave the process, hosts, redirect, and metadata untouched so the
+  // caller can retry without a surprise auto-start on the next launch.
+  if (!preserveDesiredState) await saveMitmSettings(false);
+
+  // Restore global name resolution before taking the proxy away. If hosts
+  // cleanup is denied or cancelled, leave the verified process and all
+  // ownership metadata intact so the operator can retry safely.
+  await removeAllDNSEntries(sudoPassword || getCachedPassword());
+
+  if (verified && targetPid && isProcessAlive(targetPid)) {
+    if (!targetStart) throw new Error(`Missing authenticated process-start identity for MITM PID ${targetPid}`);
+    log(`Killing server (PID: ${targetPid})...`);
+    if (forceOwnedLauncher) {
+      await killProcess(targetPid, true, sudoPassword, targetStart);
+    } else {
+      await killProcess(targetPid, false, sudoPassword, targetStart);
+      await new Promise(r => setTimeout(r, 1000));
+      if (isProcessAlive(targetPid)) await killProcess(targetPid, true, sudoPassword, targetStart);
+    }
+  }
+  if (verified
+    && candidate?.launcherPid
+    && candidate.launcherPid !== targetPid
+    && isProcessAlive(candidate.launcherPid)
+    && getProcessStartIdentity(candidate.launcherPid) === candidate.launcherStart) {
+    await killProcess(candidate.launcherPid, true, sudoPassword, candidate.launcherStart);
+  }
+  const cleanupRecord = persistedRecord || localRecord;
+  const ownsRedirect = serverRedirectOwned
+    || cleanupRecord?.version === 1
+    || Boolean(persistedSnapshot && !persistedRecord)
+    || fs.existsSync(REDIRECT_JOURNAL_FILE);
+  if (ownsRedirect) await removePortRedirect(sudoPassword || getCachedPassword());
+  if (persistedSnapshot) {
+    const removed = persistedRecord
+      ? removePidFileIfMatches(persistedRecord)
+      : removeFileIfUnchanged(PID_FILE, persistedSnapshot);
+    if (!removed) throw new Error("MITM PID metadata changed during stop cleanup");
+  }
+  serverProcess = null;
+  serverPid = null;
+  serverLauncherPid = null;
+  serverInstanceNonce = null;
+  serverLauncherStart = null;
+  serverProcessStart = null;
+  serverRedirectOwned = false;
+  setCachedPassword(null);
 
   return { running: false, pid: null };
+    });
+  } finally {
+    mitmIsRestarting = false;
+  }
 }
 
 /**
  * Enable DNS for a specific tool (requires server running)
  */
 async function enableToolDNS(tool, sudoPassword) {
-  const status = await getMitmStatus();
-  if (!status.running) throw new Error("MITM server is not running. Start the server first.");
-
-  const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
-  await addDNSEntry(tool, password);
-  await saveDnsToolState(tool, true);
-  return { success: true };
+  return startGate.runAfterIdle(async () => {
+    const status = await getMitmStatus();
+    if (!status.running) throw new Error("MITM server is not running. Start the server first.");
+    const password = await getInMemoryPassword(sudoPassword);
+    await addDNSEntry(tool, password);
+    try {
+      await saveDnsToolState(tool, true);
+    } catch (error) {
+      try { await removeDNSEntry(tool, password); } catch (rollbackError) { error.rollbackError = rollbackError; }
+      throw error;
+    }
+    return { success: true };
+  });
 }
 
 /**
  * Disable DNS for a specific tool
  */
 async function disableToolDNS(tool, sudoPassword) {
-  const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
-  await removeDNSEntry(tool, password);
-  await saveDnsToolState(tool, false);
-  return { success: true };
+  return startGate.runAfterIdle(async () => {
+    const password = await getInMemoryPassword(sudoPassword);
+    await removeDNSEntry(tool, password);
+    try {
+      await saveDnsToolState(tool, false);
+    } catch (error) {
+      try { await addDNSEntry(tool, password); } catch (rollbackError) { error.rollbackError = rollbackError; }
+      throw error;
+    }
+    return { success: true };
+  });
 }
 
 /**
  * Install Root CA to system trust store (standalone, no server start)
  */
 async function trustCert(sudoPassword) {
-  const rootCACertPath = path.join(MITM_DIR, "rootCA.crt");
-  if (!fs.existsSync(rootCACertPath)) throw new Error("Root CA not found. Start server first to generate it.");
-  const { installCert } = require("./cert/install");
-  if (!IS_WIN && !IS_MAC && !isSudoAvailable()) {
-    log(`🔐 Cert: system trust unavailable (no sudo). Use file: ${rootCACertPath}`);
-    return;
-  }
-  const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();
-  if (!password && isSudoPasswordRequired()) throw new Error("Sudo password required to trust certificate");
-  await installCert(password, rootCACertPath);
-  if (password) setCachedPassword(password);
+  return startGate.runAfterIdle(() => withRootCALock(async () => {
+    const rootCACertPath = path.join(MITM_DIR, "rootCA.crt");
+    if (!fs.existsSync(rootCACertPath)) throw new Error("Root CA not found. Start server first to generate it.");
+    const { installCert } = require("./cert/install");
+    const password = await getInMemoryPassword(sudoPassword);
+    if (!IS_WIN && !IS_MAC && !isSudoAvailable()) {
+      await installCert(null, rootCACertPath);
+      const { checkCertInstalled } = require("./cert/install");
+      if (!await checkCertInstalled(rootCACertPath)) {
+        log(`🔐 Cert: system trust unavailable and no verifiable NSS database exists. Use file: ${rootCACertPath}`);
+      }
+      return;
+    }
+    if (!password && isSudoPasswordRequired()) throw new Error("Sudo password required to trust certificate");
+    await installCert(password, rootCACertPath);
+    if (password) setCachedPassword(password);
+  }));
 }
 
 // Legacy aliases for backward compatibility
@@ -894,5 +1919,7 @@ module.exports = {
   initDbHooks,
   restoreToolDNS,
   hasDnsPrivilege,
+  hasMitmCleanupState,
+  isAdmin,
   removeAllDNSEntriesSync,
 };
diff --git a/src/mitm/paths.js b/src/mitm/paths.js
index 892c2254c..406a4f9bc 100644
--- a/src/mitm/paths.js
+++ b/src/mitm/paths.js
@@ -14,12 +14,17 @@ function defaultDir() {
 function getDataDir() {
   const configured = process.env.DATA_DIR;
   if (!configured) return defaultDir();
+  if (process.platform === "win32" && /^\//.test(configured)) {
+    console.warn(`[DATA_DIR] '${configured}' is a Unix path on Windows → fallback to default`);
+    return defaultDir();
+  }
+  const resolved = path.resolve(configured);
   try {
-    fs.mkdirSync(configured, { recursive: true });
-    return configured;
+    fs.mkdirSync(resolved, { recursive: true });
+    return resolved;
   } catch (e) {
     if (e?.code === "EACCES" || e?.code === "EPERM") {
-      console.warn(`[DATA_DIR] '${configured}' not writable → fallback ~/.${APP_NAME}`);
+      console.warn(`[DATA_DIR] '${resolved}' not writable → fallback ~/.${APP_NAME}`);
       return defaultDir();
     }
     throw e;
diff --git a/src/mitm/peerOwner.js b/src/mitm/peerOwner.js
new file mode 100644
index 000000000..b1edc954e
--- /dev/null
+++ b/src/mitm/peerOwner.js
@@ -0,0 +1,126 @@
+const fs = require("fs");
+const { execFile } = require("child_process");
+const { LSOF_BIN } = require("./config");
+const { resolveWindowsSystemBinary } = require("./trustedBinaries");
+
+function isLoopbackAddress(address) {
+  return address === "127.0.0.1" || address === "::1" || address === "::ffff:127.0.0.1";
+}
+
+function parseProcTcpOwner(raw, { clientPort, targetPorts, ownerUid }) {
+  const clientHex = clientPort.toString(16).toUpperCase().padStart(4, "0");
+  const targetHex = new Set(targetPorts.map((port) => port.toString(16).toUpperCase().padStart(4, "0")));
+  for (const line of String(raw || "").split("\n").slice(1)) {
+    const fields = line.trim().split(/\s+/);
+    if (fields.length < 9 || fields[3] !== "01") continue;
+    const [localAddress, localPort] = (fields[1] || "").split(":");
+    const [remoteAddress, remotePort] = (fields[2] || "").split(":");
+    const uid = Number(fields[7]);
+    if (localAddress === "0100007F"
+      && remoteAddress === "0100007F"
+      && localPort === clientHex
+      && targetHex.has(remotePort)
+      && uid === ownerUid) return true;
+  }
+  return false;
+}
+
+function parseLsofOwner(raw, { clientPort, targetPorts, ownerUid }) {
+  let uid = null;
+  const targetPattern = targetPorts.join("|");
+  const endpoint = new RegExp(`^(?:127\\.0\\.0\\.1|\\[::1\\]):${clientPort}->(?:127\\.0\\.0\\.1|\\[::1\\]):(?:${targetPattern})$`);
+  for (const line of String(raw || "").split("\n")) {
+    if (line.startsWith("p")) uid = null;
+    else if (line.startsWith("u") && /^u\d+$/.test(line)) uid = Number(line.slice(1));
+    else if (line.startsWith("n") && uid === ownerUid && endpoint.test(line.slice(1))) return true;
+  }
+  return false;
+}
+
+function execFileText(command, args, { timeout = 3000, maxBuffer = 1024 * 1024 } = {}) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, { encoding: "utf8", windowsHide: true, timeout, maxBuffer }, (error, stdout) => {
+      if (error) reject(error);
+      else resolve(stdout);
+    });
+  });
+}
+
+function encodePowerShell(script) {
+  return Buffer.from(script, "utf16le").toString("base64");
+}
+
+function createPeerOwnerVerifier({
+  platform = process.platform,
+  processImpl = process,
+  readFile = fs.readFileSync,
+  execText = execFileText,
+  lsofBin = LSOF_BIN,
+  targetPorts = [443, 8443],
+} = {}) {
+  const verifiedSockets = new WeakSet();
+  const ownerUid = platform === "win32"
+    ? null
+    : typeof processImpl.geteuid === "function" ? processImpl.geteuid() : processImpl.getuid?.();
+
+  return async function verifyPeerOwner(socket) {
+    if (!socket || !isLoopbackAddress(socket.remoteAddress) || !isLoopbackAddress(socket.localAddress)) return false;
+    if (verifiedSockets.has(socket)) return true;
+    const clientPort = Number(socket.remotePort);
+    if (!Number.isSafeInteger(clientPort) || clientPort < 1 || clientPort > 65535) return false;
+
+    let verified = false;
+    try {
+      if (platform === "linux") {
+        if (!Number.isSafeInteger(ownerUid) || ownerUid < 0) return false;
+        verified = parseProcTcpOwner(readFile("/proc/net/tcp", "utf8"), {
+          clientPort,
+          targetPorts,
+          ownerUid,
+        });
+      } else if (platform === "darwin") {
+        if (!Number.isSafeInteger(ownerUid) || ownerUid < 0) return false;
+        const output = await execText(lsofBin, [
+          "-nP",
+          "-a",
+          `-iTCP:${clientPort}`,
+          "-sTCP:ESTABLISHED",
+          "-Fpun",
+        ]);
+        verified = parseLsofOwner(output, { clientPort, targetPorts, ownerUid });
+      } else if (platform === "win32") {
+        const ports = targetPorts.join(",");
+        const script = `
+          $ErrorActionPreference = 'Stop'
+          $connection = Get-NetTCPConnection -State Established -LocalAddress 127.0.0.1 -LocalPort ${clientPort} -RemoteAddress 127.0.0.1 -ErrorAction SilentlyContinue |
+            Where-Object { @(${ports}) -contains $_.RemotePort } |
+            Select-Object -First 1
+          if ($null -eq $connection) { exit 3 }
+          $ownerResult = Get-CimInstance Win32_Process -Filter "ProcessId = $($connection.OwningProcess)" |
+            Invoke-CimMethod -MethodName GetOwnerSid
+          $currentSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+          if ($ownerResult.Sid -ne $currentSid) { exit 4 }
+          [Console]::Out.Write('verified')
+        `;
+        verified = (await execText(resolveWindowsSystemBinary("powershell.exe"), [
+          "-NoProfile",
+          "-NonInteractive",
+          "-ExecutionPolicy", "Bypass",
+          "-EncodedCommand", encodePowerShell(script),
+        ])).trim() === "verified";
+      }
+    } catch {
+      verified = false;
+    }
+
+    if (verified) verifiedSockets.add(socket);
+    return verified;
+  };
+}
+
+module.exports = {
+  createPeerOwnerVerifier,
+  isLoopbackAddress,
+  parseLsofOwner,
+  parseProcTcpOwner,
+};
diff --git a/src/mitm/portRedirect.js b/src/mitm/portRedirect.js
new file mode 100644
index 000000000..38c9c7024
--- /dev/null
+++ b/src/mitm/portRedirect.js
@@ -0,0 +1,158 @@
+const { execFileSync } = require("child_process");
+const { resolveWindowsSystemBinary } = require("./trustedBinaries");
+
+function requireNumericUid(processImpl = process) {
+  const uid = typeof processImpl.geteuid === "function"
+    ? processImpl.geteuid()
+    : typeof processImpl.getuid === "function" ? processImpl.getuid() : null;
+  if (!Number.isSafeInteger(uid) || uid < 0) throw new Error("Unable to resolve the effective user ID for MITM isolation");
+  return uid;
+}
+
+function requireWindowsSid(execFileSyncImpl = execFileSync) {
+  const output = execFileSyncImpl(
+    resolveWindowsSystemBinary("powershell.exe", { verify: process.platform === "win32" }),
+    ["-NoProfile", "-NonInteractive", "-Command", "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value"],
+    { encoding: "utf8", windowsHide: true, timeout: 5000 },
+  );
+  const sid = String(output || "").trim();
+  if (!/^S-\d(?:-\d+){2,14}$/.test(sid)) throw new Error("Unable to resolve a safe Windows owner SID for MITM isolation");
+  return sid;
+}
+
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'"'"'`)}'`;
+}
+
+function buildMacRedirect({ uid, publicPort, internalPort, allowExisting = true }) {
+  const anchor = `com.apple/durindoor.mitm.${uid}`;
+  const rules = [
+    `rdr on lo0 inet proto tcp from any to 127.0.0.1 port ${publicPort} -> 127.0.0.1 port ${internalPort}`,
+    `block return out quick on lo0 inet proto tcp from any to 127.0.0.1 port { ${publicPort}, ${internalPort} } user != ${uid}`,
+  ].join("\n");
+  return {
+    anchor,
+    install: `set -eu; pfctl -s info 2>/dev/null | grep -q '^Status: Enabled'; ${allowExisting ? "" : `nat=$(pfctl -a ${anchor} -sn 2>/dev/null); filter=$(pfctl -a ${anchor} -sr 2>/dev/null); [ -z "$nat" ] && [ -z "$filter" ] || { echo 'A MITM PF rule already exists for this user' >&2; exit 76; };`} printf '%s\\n' ${shellQuote(rules)} | pfctl -a ${anchor} -f -`,
+    remove: `set -eu; pfctl -a ${anchor} -F all; nat=$(pfctl -a ${anchor} -sn 2>/dev/null); filter=$(pfctl -a ${anchor} -sr 2>/dev/null); [ -z "$nat" ] && [ -z "$filter" ] || { echo 'DurinDoor PF anchor remains active' >&2; exit 1; }`,
+  };
+}
+
+function linuxRuleParts({ uid, publicPort, internalPort }) {
+  const tag = `durindoor-mitm-${uid}`;
+  return {
+    tag,
+    nat: `-t nat -p tcp -d 127.0.0.1 --dport ${publicPort} -m owner --uid-owner ${uid} -m comment --comment ${tag} -j REDIRECT --to-ports ${internalPort}`,
+    deny: `-p tcp -d 127.0.0.1 -m multiport --dports ${publicPort},${internalPort} -m owner ! --uid-owner ${uid} -m comment --comment ${tag} -j REJECT --reject-with tcp-reset`,
+  };
+}
+
+function buildLinuxRedirect(options) {
+  const { nat, deny } = linuxRuleParts(options);
+  const allowExisting = options.allowExisting !== false;
+  return {
+    install: allowExisting ? [
+        "set -eu",
+        `iptables -w 5 -t nat -C OUTPUT ${nat.replace(/^-t nat /, "")} 2>/dev/null || iptables -w 5 -t nat -I OUTPUT 1 ${nat.replace(/^-t nat /, "")}`,
+        `iptables -w 5 -C OUTPUT ${deny} 2>/dev/null || iptables -w 5 -I OUTPUT 1 ${deny}`,
+        `iptables -w 5 -t nat -C OUTPUT ${nat.replace(/^-t nat /, "")} >/dev/null`,
+        `iptables -w 5 -C OUTPUT ${deny} >/dev/null`,
+      ].join("; ") : [
+        "set -eu",
+        `if iptables -w 5 -t nat -C OUTPUT ${nat.replace(/^-t nat /, "")} 2>/dev/null || iptables -w 5 -C OUTPUT ${deny} 2>/dev/null; then echo 'A MITM iptables rule already exists for this user' >&2; exit 76; fi`,
+        "nat_added=0; deny_added=0",
+        `cleanup() { if [ "$deny_added" -eq 1 ]; then iptables -w 5 -D OUTPUT ${deny} 2>/dev/null || true; fi; if [ "$nat_added" -eq 1 ]; then iptables -w 5 -t nat -D OUTPUT ${nat.replace(/^-t nat /, "")} 2>/dev/null || true; fi; }`,
+        "trap cleanup EXIT HUP INT TERM",
+        `iptables -w 5 -t nat -I OUTPUT 1 ${nat.replace(/^-t nat /, "")}; nat_added=1`,
+        `iptables -w 5 -I OUTPUT 1 ${deny}; deny_added=1`,
+        `iptables -w 5 -t nat -C OUTPUT ${nat.replace(/^-t nat /, "")} >/dev/null`,
+        `iptables -w 5 -C OUTPUT ${deny} >/dev/null`,
+        "deny_added=0; nat_added=0; trap - EXIT HUP INT TERM",
+      ].join("; "),
+    remove: [
+      "set -eu",
+      `if iptables -w 5 -t nat -C OUTPUT ${nat.replace(/^-t nat /, "")} 2>/dev/null; then iptables -w 5 -t nat -D OUTPUT ${nat.replace(/^-t nat /, "")}; fi`,
+      `if iptables -w 5 -C OUTPUT ${deny} 2>/dev/null; then iptables -w 5 -D OUTPUT ${deny}; fi`,
+      `if iptables -w 5 -t nat -C OUTPUT ${nat.replace(/^-t nat /, "")} 2>/dev/null; then echo 'DurinDoor MITM NAT rule remains installed' >&2; exit 1; fi`,
+      `if iptables -w 5 -C OUTPUT ${deny} 2>/dev/null; then echo 'DurinDoor MITM isolation rule remains installed' >&2; exit 1; fi`,
+    ].join("; "),
+  };
+}
+
+function quotePowerShell(value) {
+  return `'${String(value).replace(/'/g, "''")}'`;
+}
+
+function windowsFirewallIdentity(sid) {
+  return {
+    name: `DurinDoor-MITM-Isolation-${sid}`,
+    localUser: `D:(D;;CC;;;${sid})(A;;CC;;;WD)`,
+  };
+}
+
+function buildWindowsFirewallVerification({ name, localUser, publicPort }) {
+  return `
+    $rule = Get-NetFirewallRule -Name ${quotePowerShell(name)} -PolicyStore ActiveStore -ErrorAction SilentlyContinue
+    if ($null -eq $rule) { throw 'DurinDoor MITM isolation rule is missing' }
+    $portFilter = $rule | Get-NetFirewallPortFilter
+    $addressFilter = $rule | Get-NetFirewallAddressFilter
+    $securityFilter = $rule | Get-NetFirewallSecurityFilter
+    $expectedUserDescriptor = [System.Security.AccessControl.CommonSecurityDescriptor]::new($false, $false, ${quotePowerShell(localUser)}).GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)
+    $actualUserDescriptor = [System.Security.AccessControl.CommonSecurityDescriptor]::new($false, $false, [string]$securityFilter.LocalUser).GetSddlForm([System.Security.AccessControl.AccessControlSections]::All)
+    if ($rule.Direction -ne 'Outbound' -or $rule.Action -ne 'Block' -or $rule.Enabled -ne 'True'
+      -or [string]$portFilter.Protocol -notin @('TCP', '6')
+      -or [string]$portFilter.RemotePort -ne '${publicPort}'
+      -or [string]$addressFilter.RemoteAddress -ne '127.0.0.1'
+      -or $actualUserDescriptor -ne $expectedUserDescriptor) {
+      throw 'A foreign or malformed rule occupies the DurinDoor MITM isolation identity'
+    }
+  `;
+}
+
+function buildWindowsRedirect({ sid, publicPort, allowExisting = true }) {
+  const { name, localUser } = windowsFirewallIdentity(sid);
+  const verify = buildWindowsFirewallVerification({ name, localUser, publicPort });
+  return {
+    name,
+    install: `
+      $ErrorActionPreference = 'Stop'
+      $existing = Get-NetFirewallRule -Name ${quotePowerShell(name)} -PolicyStore ActiveStore -ErrorAction SilentlyContinue
+      $created = $false
+      if ($null -ne $existing -and ${allowExisting ? "$false" : "$true"}) {
+        throw 'A DurinDoor MITM firewall rule already exists for this user'
+      }
+      if ($null -eq $existing) {
+        New-NetFirewallRule -Name ${quotePowerShell(name)} -DisplayName 'DurinDoor MITM cross-user isolation' -Description 'Blocks non-owner loopback access to the user-owned MITM proxy.' -Direction Outbound -Action Block -Protocol TCP -RemoteAddress 127.0.0.1 -RemotePort ${publicPort} -LocalUser ${quotePowerShell(localUser)} -Profile Any -ErrorAction Stop | Out-Null
+        $created = $true
+      }
+      try {
+        ${verify}
+      } catch {
+        if ($created) {
+          Remove-NetFirewallRule -Name ${quotePowerShell(name)} -ErrorAction SilentlyContinue
+        }
+        throw
+      }
+    `,
+    remove: `
+      $ErrorActionPreference = 'Stop'
+      $existing = Get-NetFirewallRule -Name ${quotePowerShell(name)} -PolicyStore ActiveStore -ErrorAction SilentlyContinue
+      if ($null -ne $existing) {
+        ${verify}
+        Remove-NetFirewallRule -Name ${quotePowerShell(name)} -ErrorAction Stop
+        if ($null -ne (Get-NetFirewallRule -Name ${quotePowerShell(name)} -PolicyStore ActiveStore -ErrorAction SilentlyContinue)) {
+          throw 'DurinDoor MITM isolation rule removal could not be verified'
+        }
+      }
+    `,
+  };
+}
+
+module.exports = {
+  buildLinuxRedirect,
+  buildMacRedirect,
+  buildWindowsRedirect,
+  linuxRuleParts,
+  requireNumericUid,
+  requireWindowsSid,
+  windowsFirewallIdentity,
+};
diff --git a/src/mitm/processIdentity.js b/src/mitm/processIdentity.js
new file mode 100644
index 000000000..e8d533a7f
--- /dev/null
+++ b/src/mitm/processIdentity.js
@@ -0,0 +1,58 @@
+const crypto = require("crypto");
+const fs = require("fs");
+const { execFileSync } = require("child_process");
+const {
+  FIXED_UNIX_PATH,
+  buildMinimalWindowsEnv,
+  resolveTrustedUnixBinary,
+  resolveWindowsSystemBinary,
+} = require("./trustedBinaries");
+
+function canonicalizeProcessStartIdentity(platform, rawIdentity) {
+  const normalized = String(rawIdentity || "").trim().replace(/\s+/g, " ");
+  if (!normalized) return null;
+  if (platform === "win32") return `win32:${normalized}`;
+  if (platform === "darwin") {
+    return `darwin:sha256:${crypto.createHash("sha256").update(normalized).digest("hex")}`;
+  }
+  return normalized;
+}
+
+/**
+ * Return a bounded process-start identity suitable for durable PID ownership.
+ * PID plus this value prevents an exited proxy's PID from authorizing a later,
+ * unrelated process after PID reuse.
+ */
+function getProcessStartIdentity(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  try {
+    if (process.platform === "linux") {
+      const stat = fs.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const commandEnd = stat.lastIndexOf(")");
+      if (commandEnd < 0) return null;
+      const fieldsAfterCommand = stat.slice(commandEnd + 2).trim().split(/\s+/);
+      const startTicks = fieldsAfterCommand[19];
+      const bootId = fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      return startTicks && bootId ? `linux:${bootId}:${startTicks}` : null;
+    }
+
+    const output = process.platform === "win32"
+      ? execFileSync(resolveWindowsSystemBinary("powershell.exe"), [
+        "-NoProfile", "-NonInteractive", "-Command",
+        `(Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}').CreationDate`,
+      ], { encoding: "utf8", windowsHide: true, timeout: 5000, env: buildMinimalWindowsEnv() })
+      : execFileSync(resolveTrustedUnixBinary("ps"), [
+        "-p", String(pid), "-o", "lstart=", "-o", "comm=",
+      ], {
+        encoding: "utf8",
+        windowsHide: true,
+        timeout: 5000,
+        env: { PATH: FIXED_UNIX_PATH, LANG: "C", LC_ALL: "C" },
+      });
+    return canonicalizeProcessStartIdentity(process.platform, output);
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { canonicalizeProcessStartIdentity, getProcessStartIdentity };
diff --git a/src/mitm/sanitizeHeaders.js b/src/mitm/sanitizeHeaders.js
index c6095c91c..896a35f37 100644
--- a/src/mitm/sanitizeHeaders.js
+++ b/src/mitm/sanitizeHeaders.js
@@ -11,10 +11,18 @@ const SECRET_HEADER_NAMES = new Set([
   "x-subscription-token",
   "xi-api-key",
   "x-arcjet-key",
+  "x-amz-security-token",
+  "x-amz-session-token",
+  "x-auth-token",
+  "x-access-token",
+  "x-client-secret",
+  "proxy-authenticate",
 ]);
 
 function isSecretHeader(name) {
-  return SECRET_HEADER_NAMES.has(String(name || "").toLowerCase());
+  const normalized = String(name || "").toLowerCase();
+  return SECRET_HEADER_NAMES.has(normalized)
+    || /(?:^|[-_])(authorization|cookie|token|api[-_]?key|secret)(?:$|[-_])/.test(normalized);
 }
 
 function sanitizeHeaders(headers = {}) {
@@ -29,4 +37,4 @@ function sanitizeHeaders(headers = {}) {
   return result;
 }
 
-module.exports = { sanitizeHeaders };
+module.exports = { isSecretHeader, sanitizeHeaders };
diff --git a/src/mitm/server.js b/src/mitm/server.js
index 6d373bb5b..eff1f1860 100644
--- a/src/mitm/server.js
+++ b/src/mitm/server.js
@@ -2,23 +2,27 @@ const https = require("https");
 const http2 = require("http2");
 const tls = require("tls");
 const fs = require("fs");
-const path = require("path");
 const dns = require("dns");
+const crypto = require("crypto");
+const forge = require("node-forge");
 const { promisify } = require("util");
-const { execSync } = require("child_process");
 const { log, err, dumpRequest, createResponseDumper, clearDumpDir } = require("./logger");
-const { IS_DEV, LSOF_BIN, TARGET_HOSTS, URL_PATTERNS, MODEL_SYNONYMS, MODEL_PATTERNS, MODEL_NO_MAP, getToolForHost } = require("./config");
-const { DATA_DIR, MITM_DIR } = require("./paths");
-const { generateCert, getCertForDomain } = require("./cert/generate");
-const { ensureRootCASync } = require("./cert/rootCA");
+const { IS_DEV, MITM_ENTRY_ARG, MITM_NODE_PORT, TARGET_HOSTS, URL_PATTERNS, MODEL_SYNONYMS, MODEL_PATTERNS, MODEL_NO_MAP, getToolForHost } = require("./config");
+const { getCertForDomain } = require("./cert/generate");
+const { loadRootCATls } = require("./serverBootstrap");
 const { getMitmAlias } = require("./dbReader");
 const { applyAntigravityIdeVersionOverride } = require("./antigravityIdeVersion");
-const LOCAL_PORT = 443;
-const IS_WIN = process.platform === "win32";
+const { createPeerOwnerVerifier } = require("./peerOwner");
+const { waitForLaunchAuthorization } = require("./launchGate");
+const LOCAL_PORT = (() => {
+  const configured = Number(process.env.MITM_LISTEN_PORT || MITM_NODE_PORT);
+  const minimumExclusive = process.platform === "win32" ? 0 : 1024;
+  return Number.isInteger(configured) && configured > minimumExclusive && configured <= 65535
+    ? configured
+    : MITM_NODE_PORT;
+})();
 const ENABLE_FILE_LOG = IS_DEV;
 
-// Clear stale dump files on every MITM start (prevents unbounded disk usage)
-clearDumpDir();
 const INTERNAL_REQUEST_HEADER = { name: "x-request-source", value: "local" };
 
 // Host rewrite for upstream forward: PROD cloudcode-pa is rate-limited (429),
@@ -38,11 +42,24 @@ const handlers = {
 
 const certCache = new Map();
 let rootCAPem;
+let rootCAForLeaves;
+
+function isAllowedTargetHost(host) {
+  return TARGET_HOSTS.includes(String(host || "").split(":")[0].toLowerCase());
+}
+
+function createHealthProof(req) {
+  const nonce = process.env.MITM_INSTANCE_NONCE || "";
+  const challenge = String(req.headers["x-durindoor-mitm-challenge"] || "");
+  if (!/^[a-f0-9]{48}$/.test(nonce) || !/^[a-f0-9]{64}$/.test(challenge)) return null;
+  return crypto.createHmac("sha256", nonce).update(challenge).digest("hex");
+}
 
 function sniCallback(servername, cb) {
   try {
+    if (!isAllowedTargetHost(servername)) return cb(new Error("Unsupported MITM SNI hostname"));
     if (certCache.has(servername)) return cb(null, certCache.get(servername));
-    const certData = getCertForDomain(servername);
+    const certData = getCertForDomain(servername, rootCAForLeaves);
     if (!certData) return cb(new Error(`Failed to generate cert for ${servername}`));
     const ctx = require("tls").createSecureContext({
       key: certData.key,
@@ -56,32 +73,6 @@ function sniCallback(servername, cb) {
   }
 }
 
-// Auto-generate Root CA on first run or when the files are missing/expired.
-// On Windows a fresh install (or deleted %APPDATA%\9router) leaves no rootCA.key,
-// which previously caused an immediate process.exit(1) (#2224).
-try {
-  ensureRootCASync();
-} catch (e) {
-  err(`Failed to generate Root CA: ${e.message}`);
-  process.exit(1);
-}
-
-let sslOptions;
-try {
-  if (!fs.existsSync(path.join(MITM_DIR, "rootCA.key")) || !fs.existsSync(path.join(MITM_DIR, "rootCA.crt"))) {
-    log("Root CA missing, generating...");
-    generateCert();
-  }
-
-  const rootKey = fs.readFileSync(path.join(MITM_DIR, "rootCA.key"));
-  const rootCert = fs.readFileSync(path.join(MITM_DIR, "rootCA.crt"));
-  rootCAPem = rootCert.toString("utf8");
-  sslOptions = { key: rootKey, cert: rootCert, SNICallback: sniCallback };
-} catch (e) {
-  err(`Failed to load Root CA after generation: ${e.message}`);
-  process.exit(1);
-}
-
 // ── Helpers ───────────────────────────────────────────────────
 
 const cachedTargetIPs = {};
@@ -208,7 +199,7 @@ async function negotiateAlpn(host) {
   return new Promise((resolve, reject) => {
     const socket = tls.connect({
       host: ip, port: 443, servername: host,
-      ALPNProtocols: ["h2", "http/1.1"], rejectUnauthorized: false,
+      ALPNProtocols: ["h2", "http/1.1"], rejectUnauthorized: true,
     }, () => {
       const proto = socket.alpnProtocol || "http/1.1";
       alpnCache.set(host, proto);
@@ -241,7 +232,7 @@ async function passthroughHttp2(req, res, bodyBuffer, headers, targetHost, onRes
     const client = http2.connect(`https://${targetHost}`, {
       createConnection: () => tls.connect({
         host: targetIP, port: 443, servername: targetHost,
-        ALPNProtocols: ["h2"], rejectUnauthorized: false,
+        ALPNProtocols: ["h2"], rejectUnauthorized: true,
       }),
     });
     client.once("error", (e) => {
@@ -303,7 +294,7 @@ async function passthroughHttps(req, res, bodyBuffer, headers, targetHost, onRes
     method: req.method,
     headers,
     servername: targetHost,
-    rejectUnauthorized: false
+    rejectUnauthorized: true
   }, (forwardRes) => {
     res.writeHead(forwardRes.statusCode, forwardRes.headers);
     if (dumper) dumper.writeHeader(forwardRes.statusCode, forwardRes.headers);
@@ -339,11 +330,31 @@ async function passthroughHttps(req, res, bodyBuffer, headers, targetHost, onRes
 
 // ── Request handler ───────────────────────────────────────────
 
-const server = https.createServer(sslOptions, async (req, res) => {
+async function handleRequest(req, res, {
+  verifyPeerOwner = createPeerOwnerVerifier({ targetPorts: [...new Set([443, LOCAL_PORT])] }),
+} = {}) {
   try {
+    if (!(await verifyPeerOwner(req.socket))) {
+      res.writeHead(403, { "Content-Type": "application/json", "Connection": "close" });
+      res.end(JSON.stringify({ error: "mitm_peer_owner_mismatch" }));
+      return;
+    }
+
     if (req.url === "/_mitm_health") {
+      const proof = createHealthProof(req);
+      if (!proof) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "not_found" }));
+        return;
+      }
       res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: true, pid: process.pid }));
+      res.end(JSON.stringify({ ok: true, pid: process.pid, proof }));
+      return;
+    }
+
+    if (!isAllowedTargetHost(req.headers.host)) {
+      res.writeHead(421, { "Content-Type": "application/json", "Connection": "close" });
+      res.end(JSON.stringify({ error: "unsupported_mitm_host" }));
       return;
     }
 
@@ -397,64 +408,89 @@ const server = https.createServer(sslOptions, async (req, res) => {
     if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
     res.end(JSON.stringify({ error: { message: e.message, type: "mitm_error" } }));
   }
-});
+}
 
-// Kill only processes LISTENING on LOCAL_PORT (not outbound connections)
-function killPort(port) {
-  try {
-    let pidList = [];
-    if (IS_WIN) {
-      const psCmd = `powershell -NonInteractive -WindowStyle Hidden -Command ` +
-        `"Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | Select-Object -ExpandProperty OwningProcess"`;
-      const out = execSync(psCmd, { encoding: "utf-8", windowsHide: true }).trim();
-      if (!out) return;
-      pidList = out.split(/\r?\n/).map(s => s.trim()).filter(p => p && Number(p) !== process.pid && Number(p) > 4);
-    } else {
-      const out = execSync(`${LSOF_BIN} -nP -iTCP:${port} -sTCP:LISTEN -t`, { encoding: "utf-8", windowsHide: true }).trim();
-      if (!out) return;
-      pidList = out.split("\n").filter(p => p && Number(p) !== process.pid);
-    }
-    if (pidList.length === 0) return;
-    pidList.forEach(pid => {
-      try {
-        if (IS_WIN) execSync(`taskkill /F /PID ${pid}`, { windowsHide: true });
-        else process.kill(Number(pid), "SIGKILL");
-      } catch (e) {
-        err(`Failed to kill PID ${pid}: ${e.message}`);
-      }
+function createMitmServer({
+  httpsModule = https,
+  tlsOptions,
+  peerVerifier = createPeerOwnerVerifier({ targetPorts: [...new Set([443, LOCAL_PORT])] }),
+}) {
+  const { key, cert, rootCAPem: loadedRootCAPem } = tlsOptions;
+  certCache.clear();
+  rootCAPem = loadedRootCAPem;
+  rootCAForLeaves = {
+    key: forge.pki.privateKeyFromPem(key.toString("utf8")),
+    cert: forge.pki.certificateFromPem(cert.toString("utf8")),
+  };
+  return httpsModule.createServer(
+    { key, cert, SNICallback: sniCallback },
+    (req, res) => handleRequest(req, res, { verifyPeerOwner: peerVerifier }),
+  );
+}
+
+function registerShutdownHandlers(server, {
+  processImpl = process,
+} = {}) {
+  let isShuttingDown = false;
+  const shutdown = () => {
+    if (isShuttingDown) return;
+    isShuttingDown = true;
+    // The child is intentionally unprivileged. Its owning manager serializes
+    // hosts/redirect cleanup and must remain alive until that cleanup succeeds.
+    const forceExit = setTimeout(() => processImpl.exit(0), 1500);
+    server.close(() => {
+      clearTimeout(forceExit);
+      processImpl.exit(0);
     });
-    log(`Killed ${pidList.length} process(es) on port ${port}`);
-  } catch (e) {
-    if (e.status !== 1) throw e;
-  }
+  };
+
+  processImpl.on("SIGTERM", shutdown);
+  processImpl.on("SIGINT", shutdown);
+  if (processImpl.platform === "win32") processImpl.on("SIGBREAK", shutdown);
+  return shutdown;
+}
+
+async function startMitmServer({
+  port = LOCAL_PORT,
+  httpsModule = https,
+  loadTls = loadRootCATls,
+  clearDumpDirFn = clearDumpDir,
+  processImpl = process,
+  peerVerifier = createPeerOwnerVerifier({ targetPorts: [...new Set([443, port])] }),
+  waitForAuthorization = waitForLaunchAuthorization,
+} = {}) {
+  await waitForAuthorization();
+  if (ENABLE_FILE_LOG) clearDumpDirFn();
+  const tlsOptions = await loadTls();
+  const server = createMitmServer({ httpsModule, tlsOptions, peerVerifier });
+
+  server.on("error", (error) => {
+    if (error.code === "EADDRINUSE") err(`Port ${port} already in use`);
+    else if (error.code === "EACCES") err(`Permission denied for port ${port}`);
+    else err(error.message);
+    processImpl.exit(1);
+  });
+  server.listen(port, "127.0.0.1", () => log(`🚀 Server ready on 127.0.0.1:${port}`));
+  const shutdown = registerShutdownHandlers(server, { processImpl });
+  return { server, shutdown };
 }
 
-try {
-  killPort(LOCAL_PORT);
-} catch (e) {
-  err(`Cannot kill process on port ${LOCAL_PORT}: ${e.message}`);
-  process.exit(1);
+async function runMain() {
+  try {
+    await startMitmServer();
+  } catch (error) {
+    err(`Failed to start MITM server: ${error.message}`);
+    process.exit(1);
+  }
 }
 
-server.listen(LOCAL_PORT, () => log(`🚀 Server ready on :${LOCAL_PORT}`));
-
-server.on("error", (e) => {
-  if (e.code === "EADDRINUSE") err(`Port ${LOCAL_PORT} already in use`);
-  else if (e.code === "EACCES") err(`Permission denied for port ${LOCAL_PORT}`);
-  else err(e.message);
-  process.exit(1);
-});
-
-const { removeAllDNSEntriesSync } = require("./dns/dnsConfig");
-let isShuttingDown = false;
-const shutdown = () => {
-  if (isShuttingDown) return;
-  isShuttingDown = true;
-  // Strip tool hosts from /etc/hosts so other apps aren't broken after exit
-  removeAllDNSEntriesSync();
-  const forceExit = setTimeout(() => process.exit(0), 1500);
-  server.close(() => { clearTimeout(forceExit); process.exit(0); });
+if (require.main === module || process.argv.includes(MITM_ENTRY_ARG)) void runMain();
+
+module.exports = {
+  createMitmServer,
+  handleRequest,
+  registerShutdownHandlers,
+  runMain,
+  sniCallback,
+  startMitmServer,
 };
-process.on("SIGTERM", shutdown);
-process.on("SIGINT", shutdown);
-if (process.platform === "win32") process.on("SIGBREAK", shutdown);
diff --git a/src/mitm/serverBootstrap.js b/src/mitm/serverBootstrap.js
new file mode 100644
index 000000000..c9ba53f30
--- /dev/null
+++ b/src/mitm/serverBootstrap.js
@@ -0,0 +1,77 @@
+const fs = require("fs");
+const { ensureRootCASync, ROOT_CA_CERT_PATH, ROOT_CA_KEY_PATH } = require("./cert/rootCA");
+const { ROOT_CA_LOCK_PORT } = require("./config");
+const { acquireSocketLock, releaseSocketLock } = require("./startLock");
+
+function readRegularFileNoFollow(filePath, fsImpl = fs) {
+  const pathStat = fsImpl.lstatSync(filePath);
+  if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
+    throw new Error(`Unsafe MITM TLS path: ${filePath}`);
+  }
+  const constants = fsImpl.constants || fs.constants;
+  const fd = fsImpl.openSync(filePath, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+  try {
+    const fileStat = fsImpl.fstatSync(fd);
+    if (!fileStat.isFile()
+      || String(pathStat.dev) !== String(fileStat.dev)
+      || String(pathStat.ino) !== String(fileStat.ino)) {
+      throw new Error(`MITM TLS file changed while opening: ${filePath}`);
+    }
+    return fsImpl.readFileSync(fd);
+  } finally {
+    fsImpl.closeSync(fd);
+  }
+}
+
+async function withRootCALock(operation, {
+  acquire = () => acquireSocketLock({ port: ROOT_CA_LOCK_PORT }),
+  release = releaseSocketLock,
+} = {}) {
+  const owner = await acquire();
+  let result;
+  let operationError;
+  try {
+    result = await operation();
+  } catch (error) {
+    operationError = error;
+  }
+  try {
+    await release(owner);
+  } catch (cleanupError) {
+    if (operationError) {
+      operationError.cleanupError = cleanupError;
+      throw operationError;
+    }
+    throw cleanupError;
+  }
+  if (operationError) throw operationError;
+  return result;
+}
+
+/**
+ * Ensure and read the Root CA for the executable MITM entrypoint. This helper
+ * deliberately does no logging, listening, signal registration, or exiting so
+ * imports and build analysis remain side-effect free.
+ */
+async function loadRootCATls({
+  ensureRootCA = ensureRootCASync,
+  readFile = readRegularFileNoFollow,
+  keyPath = ROOT_CA_KEY_PATH,
+  certPath = ROOT_CA_CERT_PATH,
+  withLock = withRootCALock,
+  caPrepared = process.env.MITM_CA_PREPARED === "1",
+} = {}) {
+  return withLock(async () => {
+    const generated = caPrepared ? false : await ensureRootCA();
+    const key = readFile(keyPath);
+    const cert = readFile(certPath);
+    return {
+      generated,
+      key,
+      cert,
+      rootCAPem: cert.toString("utf8"),
+    };
+  });
+}
+
+module.exports = { loadRootCATls, readRegularFileNoFollow, withRootCALock };
diff --git a/src/mitm/startLock.js b/src/mitm/startLock.js
new file mode 100644
index 000000000..b1fb66d3a
--- /dev/null
+++ b/src/mitm/startLock.js
@@ -0,0 +1,215 @@
+const fs = require("fs");
+const net = require("net");
+
+function createAlreadyStartingError(message = "MITM server is already starting") {
+  const error = new Error(message);
+  error.code = "MITM_START_IN_PROGRESS";
+  return error;
+}
+
+/**
+ * Use a loopback listener as the cross-process startup mutex. The operating
+ * system releases the port on process death, so there is no stale file to
+ * reclaim and no compare/unlink race that can delete a successor's lock.
+ */
+function acquireSocketLock({ port, host = "127.0.0.1", netImpl = net }) {
+  return new Promise((resolve, reject) => {
+    const server = netImpl.createServer();
+    const onError = (error) => {
+      if (error.code === "EADDRINUSE") {
+        reject(createAlreadyStartingError("MITM server is already starting (lock contention)"));
+      } else {
+        reject(error);
+      }
+    };
+
+    server.once("error", onError);
+    server.listen({ host, port, exclusive: true }, () => {
+      server.removeListener("error", onError);
+      // A later listener error must not become an unhandled process error.
+      server.on("error", () => {});
+      server.unref?.();
+      resolve({ server, host, port });
+    });
+  });
+}
+
+function releaseSocketLock(owner) {
+  return new Promise((resolve, reject) => {
+    try {
+      owner.server.close((error) => {
+        if (error) reject(error);
+        else resolve(true);
+      });
+    } catch (error) {
+      if (error.code === "ERR_SERVER_NOT_RUNNING") resolve(false);
+      else reject(error);
+    }
+  });
+}
+
+function statIdentity(stat) {
+  return {
+    dev: String(stat.dev),
+    ino: String(stat.ino),
+    size: stat.size,
+    mtimeMs: stat.mtimeMs,
+  };
+}
+
+/**
+ * Read a regular file without following a symlink. These helpers protect PID
+ * metadata only; startup mutual exclusion is provided by acquireSocketLock.
+ */
+function readFileSnapshot(filePath, fsImpl = fs) {
+  const pathStat = fsImpl.lstatSync(filePath);
+  if (!pathStat.isFile() || pathStat.isSymbolicLink()) {
+    const error = new Error(`Unsafe MITM metadata path: ${filePath}`);
+    error.code = "EINVAL";
+    throw error;
+  }
+
+  const constants = fsImpl.constants || fs.constants;
+  const noFollow = constants.O_NOFOLLOW || 0;
+  const fd = fsImpl.openSync(filePath, constants.O_RDONLY | noFollow);
+  try {
+    const fileStat = fsImpl.fstatSync(fd);
+    if (String(pathStat.dev) !== String(fileStat.dev) || String(pathStat.ino) !== String(fileStat.ino)) {
+      const error = new Error("MITM metadata changed while opening");
+      error.code = "EAGAIN";
+      throw error;
+    }
+    return {
+      identity: statIdentity(fileStat),
+      raw: fsImpl.readFileSync(fd, "utf8"),
+    };
+  } finally {
+    fsImpl.closeSync(fd);
+  }
+}
+
+function sameSnapshot(left, right) {
+  return left.raw === right.raw
+    && left.identity.dev === right.identity.dev
+    && left.identity.ino === right.identity.ino
+    && left.identity.size === right.identity.size
+    && left.identity.mtimeMs === right.identity.mtimeMs;
+}
+
+function removeFileIfUnchanged(filePath, snapshot, fsImpl = fs) {
+  let current;
+  try {
+    current = readFileSnapshot(filePath, fsImpl);
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+  if (!sameSnapshot(snapshot, current)) return false;
+  try {
+    fsImpl.unlinkSync(filePath);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+/**
+ * Atomically replace metadata only when the record observed by the caller is
+ * still current. Legitimate writers hold the OS operation gate; this identity
+ * check additionally refuses unexpected same-directory changes.
+ */
+function replaceFileIfUnchanged(filePath, snapshot, replacementPath, fsImpl = fs) {
+  let current;
+  try {
+    current = readFileSnapshot(filePath, fsImpl);
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+  if (!sameSnapshot(snapshot, current)) return false;
+  fsImpl.renameSync(replacementPath, filePath);
+  return true;
+}
+
+/**
+ * Coordinate the process-local operation latch with the OS-backed lock. Start
+ * calls reject concurrent local work; stop calls can wait and then claim the
+ * same local/cross-process operation gate through runAfterIdle().
+ */
+function createStartGate({ acquire, release, onCleanupError = async () => {} }) {
+  let starting = false;
+  let idlePromise = Promise.resolve();
+
+  async function execute(start, waitForCurrent) {
+    if (waitForCurrent) {
+      while (starting) await idlePromise;
+    } else if (starting) {
+      throw createAlreadyStartingError();
+    }
+
+    // No await occurs between the state check and claim, making this atomic
+    // with respect to other JavaScript callbacks in this process.
+    if (starting) throw createAlreadyStartingError();
+    starting = true;
+    let resolveIdle;
+    idlePromise = new Promise((resolve) => { resolveIdle = resolve; });
+
+    let owner;
+    let value;
+    let operationError;
+    let cleanupError;
+    try {
+      owner = await acquire();
+      value = await start(owner);
+    } catch (error) {
+      operationError = error;
+    }
+
+    try {
+      if (owner) await release(owner);
+    } catch (error) {
+      cleanupError = error;
+      try {
+        await onCleanupError(error);
+      } catch (rollbackError) {
+        cleanupError.rollbackError = rollbackError;
+      }
+    } finally {
+      starting = false;
+      resolveIdle();
+    }
+
+    if (operationError) {
+      if (cleanupError) operationError.cleanupError = cleanupError;
+      throw operationError;
+    }
+    if (cleanupError) throw cleanupError;
+    return value;
+  }
+
+  return {
+    run(start) {
+      return execute(start, false);
+    },
+    runAfterIdle(operation) {
+      return execute(operation, true);
+    },
+    isStarting() {
+      return starting;
+    },
+    waitForIdle() {
+      return idlePromise;
+    },
+  };
+}
+
+module.exports = {
+  acquireSocketLock,
+  createAlreadyStartingError,
+  createStartGate,
+  readFileSnapshot,
+  releaseSocketLock,
+  replaceFileIfUnchanged,
+  removeFileIfUnchanged,
+};
diff --git a/src/mitm/trustedBinaries.js b/src/mitm/trustedBinaries.js
new file mode 100644
index 000000000..6b896a031
--- /dev/null
+++ b/src/mitm/trustedBinaries.js
@@ -0,0 +1,94 @@
+const fs = require("fs");
+const path = require("path");
+
+const FIXED_UNIX_PATH = "/usr/sbin:/usr/bin:/sbin:/bin";
+// Fail closed on non-standard Windows installations rather than trusting the
+// mutable SystemRoot/WINDIR environment across a UAC boundary. The canonical
+// system installation path is protected by Windows ACLs.
+const WINDOWS_SYSTEM_ROOT = "C:\\Windows";
+
+const UNIX_CANDIDATES = Object.freeze({
+  sh: ["/bin/sh", "/bin/dash", "/usr/bin/dash", "/bin/bash", "/bin/ash"],
+  sudo: ["/usr/bin/sudo", "/bin/sudo"],
+  lsof: ["/usr/sbin/lsof", "/usr/bin/lsof", "/sbin/lsof"],
+  ps: ["/bin/ps", "/usr/bin/ps"],
+  kill: ["/bin/kill", "/usr/bin/kill"],
+  launchctl: ["/bin/launchctl"],
+  security: ["/usr/bin/security"],
+});
+
+function isTrustedUnixFile(filePath, { fsImpl = fs } = {}) {
+  try {
+    const linkStat = fsImpl.lstatSync(filePath);
+    if (!linkStat.isFile() && !linkStat.isSymbolicLink?.()) return false;
+    if (typeof linkStat.uid === "number" && linkStat.uid !== 0) return false;
+    const resolved = fsImpl.realpathSync(filePath);
+    const stat = fsImpl.statSync(resolved);
+    if (!stat.isFile()) return false;
+    if (typeof stat.uid === "number" && stat.uid !== 0) return false;
+    if ((stat.mode & 0o022) !== 0) return false;
+    fsImpl.accessSync(filePath, fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function resolveTrustedUnixBinary(name, {
+  candidates = UNIX_CANDIDATES[name] || [],
+  fsImpl = fs,
+  required = true,
+} = {}) {
+  const match = candidates.find((candidate) => isTrustedUnixFile(candidate, { fsImpl }));
+  if (match) return fsImpl.realpathSync(match);
+  if (!required) return null;
+  throw new Error(`No trusted root-owned ${name} binary is available`);
+}
+
+function resolveWindowsSystemBinary(name, {
+  fsImpl = fs,
+  verify = process.platform === "win32",
+  systemRoot = WINDOWS_SYSTEM_ROOT,
+} = {}) {
+  if (!/^[A-Za-z0-9_.-]+\.exe$/i.test(String(name || ""))) {
+    throw new Error("Unsafe Windows system binary name");
+  }
+  const root = String(systemRoot);
+  if (!path.win32.isAbsolute(root) || /[\r\n"']/u.test(root)) {
+    throw new Error("Unsafe Windows system root");
+  }
+  const binary = path.win32.join(path.win32.normalize(root), "System32", name);
+  if (verify) {
+    const stat = fsImpl.lstatSync(binary);
+    if (!stat.isFile() || stat.isSymbolicLink?.()) {
+      throw new Error(`Unsafe Windows system binary: ${binary}`);
+    }
+  }
+  return binary;
+}
+
+function buildMinimalWindowsEnv(env = process.env) {
+  const systemRoot = WINDOWS_SYSTEM_ROOT;
+  const system32 = path.win32.join(systemRoot, "System32");
+  const modules = path.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "Modules");
+  return Object.fromEntries(Object.entries({
+    SystemRoot: systemRoot,
+    WINDIR: systemRoot,
+    ComSpec: path.win32.join(system32, "cmd.exe"),
+    PATH: `${system32};${path.win32.join(systemRoot, "System32", "Wbem")}`,
+    PSModulePath: modules,
+    TEMP: env.TEMP,
+    TMP: env.TMP,
+    USERPROFILE: env.USERPROFILE,
+  }).filter(([, value]) => value));
+}
+
+module.exports = {
+  buildMinimalWindowsEnv,
+  FIXED_UNIX_PATH,
+  WINDOWS_SYSTEM_ROOT,
+  UNIX_CANDIDATES,
+  isTrustedUnixFile,
+  resolveTrustedUnixBinary,
+  resolveWindowsSystemBinary,
+};
diff --git a/src/mitm/winElevated.js b/src/mitm/winElevated.js
index 38acfa5a9..05eaa02ac 100644
--- a/src/mitm/winElevated.js
+++ b/src/mitm/winElevated.js
@@ -1,21 +1,41 @@
-const { exec, execSync } = require("child_process");
+const { execFile, execFileSync } = require("child_process");
+const { buildMinimalWindowsEnv, resolveWindowsSystemBinary } = require("./trustedBinaries");
 
 const IS_WIN = process.platform === "win32";
+const PRIVILEGED_UNCONFIRMED_EXIT_CODE = 86;
 
 /**
  * Detect if current Windows process has admin rights (no UAC popup needed).
  * Uses `net session` which only succeeds when elevated.
  */
-function isAdmin() {
-  if (IS_WIN) {
+function isAdmin({ platform = process.platform, execFileSyncImpl = execFileSync } = {}) {
+  if (platform === "win32") {
     try {
-      execSync("fltmc", { windowsHide: true, stdio: "ignore" });
+      execFileSyncImpl(resolveWindowsSystemBinary("fltmc.exe", { verify: platform === process.platform }), [], {
+        windowsHide: true,
+        stdio: "ignore",
+        timeout: 5000,
+        env: buildMinimalWindowsEnv(),
+      });
       return true;
     } catch {
       return false;
     }
   }
-  return typeof process.getuid === "function" && process.getuid() === 0;
+  const realUid = typeof process.getuid === "function" ? process.getuid() : null;
+  const effectiveUid = typeof process.geteuid === "function" ? process.geteuid() : realUid;
+  return realUid === 0 || effectiveUid === 0;
+}
+
+function wrapElevatedExecError(error, stderr) {
+  const wrapped = new Error(stderr || error.message);
+  if (Number(error?.code) === PRIVILEGED_UNCONFIRMED_EXIT_CODE
+    || error?.code === "ETIMEDOUT"
+    || error?.killed === true
+    || error?.signal) {
+    wrapped.code = "PRIVILEGED_TERMINATION_UNCONFIRMED";
+  }
+  return wrapped;
 }
 
 /**
@@ -25,6 +45,36 @@ function quotePs(value) {
   return `'${String(value).replace(/'/g, "''")}'`;
 }
 
+function buildElevatedSupervisorScript(encodedCommand, timeoutMs, {
+  powershellPath = resolveWindowsSystemBinary("powershell.exe", { verify: false }),
+  taskkillPath = resolveWindowsSystemBinary("taskkill.exe", { verify: false }),
+  startDeadlineMs = null,
+} = {}) {
+  if (!/^[A-Za-z0-9+/=]+$/.test(encodedCommand)) throw new Error("Unsafe encoded PowerShell command");
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1000 || timeoutMs > 300000) {
+    throw new Error("Invalid elevated command timeout");
+  }
+  return `
+    $ErrorActionPreference = 'Stop'
+    $env:PSModulePath = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\Modules'
+    $env:PATH = (Join-Path $env:SystemRoot 'System32') + ';' + (Join-Path $env:SystemRoot 'System32\\Wbem')
+    ${startDeadlineMs == null ? "" : `if ([DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds() -gt ${startDeadlineMs}) { throw 'UAC approval deadline expired before privileged mutation began' }`}
+    $child = Start-Process ${quotePs(powershellPath)} -ArgumentList @(
+      '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass',
+      '-WindowStyle','Hidden','-EncodedCommand','${encodedCommand}'
+    ) -PassThru -WindowStyle Hidden
+    if (-not $child.WaitForExit(${timeoutMs})) {
+      & ${quotePs(taskkillPath)} /PID $child.Id /T /F | Out-Null
+      if (-not $child.WaitForExit(5000)) {
+        [Console]::Error.WriteLine("Elevated command process tree could not be terminated")
+        exit ${PRIVILEGED_UNCONFIRMED_EXIT_CODE}
+      }
+      throw "Elevated command timed out after ${timeoutMs}ms"
+    }
+    if ($child.ExitCode -ne 0) { throw "Elevated command exited with code $($child.ExitCode)" }
+  `;
+}
+
 /**
  * Run PowerShell script — escalated via UAC popup if not already admin.
  * Returns Promise resolving on exit code 0, rejecting otherwise.
@@ -32,45 +82,65 @@ function quotePs(value) {
  * IMPORTANT: each call triggers ONE UAC popup. Batch multiple admin tasks
  * into a single script string to minimize popups.
  */
-function runElevatedPowerShell(script) {
+function runElevatedPowerShell(script, { commandTimeoutMs = 30000, uacTimeoutMs = 120000 } = {}) {
   if (!IS_WIN) return Promise.reject(new Error("Windows-only"));
 
-  const encoded = Buffer.from(script, "utf16le").toString("base64");
+  const powershellPath = resolveWindowsSystemBinary("powershell.exe");
+  const taskkillPath = resolveWindowsSystemBinary("taskkill.exe");
+  const hardenedScript = `
+    $env:PSModulePath = Join-Path $env:SystemRoot 'System32\\WindowsPowerShell\\v1.0\\Modules'
+    $env:PATH = (Join-Path $env:SystemRoot 'System32') + ';' + (Join-Path $env:SystemRoot 'System32\\Wbem')
+    ${script}
+  `;
+  const encoded = Buffer.from(hardenedScript, "utf16le").toString("base64");
+  const startDeadlineMs = Date.now() + uacTimeoutMs;
+  const supervisor = buildElevatedSupervisorScript(encoded, commandTimeoutMs, {
+    powershellPath,
+    taskkillPath,
+    startDeadlineMs,
+  });
+  const encodedSupervisor = Buffer.from(supervisor, "utf16le").toString("base64");
+  const childEnv = buildMinimalWindowsEnv();
 
-  // If already admin, run directly — zero popup
+  // If already admin, run the same bounded supervisor directly — zero popup.
   if (isAdmin()) {
     return new Promise((resolve, reject) => {
-      exec(
-        `powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encoded}`,
-        { windowsHide: true },
+      execFile(
+        powershellPath,
+        ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encodedSupervisor],
+        { windowsHide: true, timeout: commandTimeoutMs + 15000, env: childEnv },
         (error, stdout, stderr) => {
-          if (error) reject(new Error(stderr || error.message));
+          if (error) reject(wrapElevatedExecError(error, stderr));
           else resolve(stdout);
         }
       );
     });
   }
 
-  // Not admin — wrap with Start-Process -Verb RunAs (UAC popup)
+  // Not admin — elevate only the bounded supervisor. It owns and terminates
+  // the entire privileged command tree before returning any timeout.
   const wrapper = `
-    $proc = Start-Process powershell -ArgumentList @(
+    $proc = Start-Process ${quotePs(powershellPath)} -ArgumentList @(
       '-NoProfile','-NonInteractive','-ExecutionPolicy','Bypass',
-      '-WindowStyle','Hidden','-EncodedCommand','${encoded}'
+      '-WindowStyle','Hidden','-EncodedCommand','${encodedSupervisor}'
     ) -Verb RunAs -Wait -PassThru -WindowStyle Hidden;
+    if ($proc.ExitCode -eq ${PRIVILEGED_UNCONFIRMED_EXIT_CODE}) { exit ${PRIVILEGED_UNCONFIRMED_EXIT_CODE} }
     if ($proc.ExitCode -ne 0) { throw "Elevated command exited with code $($proc.ExitCode)" }
   `;
+  const encodedWrapper = Buffer.from(wrapper, "utf16le").toString("base64");
 
   return new Promise((resolve, reject) => {
-    exec(
-      `powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command ${quotePs(wrapper)}`,
-      { windowsHide: true },
+    execFile(
+      powershellPath,
+      ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encodedWrapper],
+      { windowsHide: true, timeout: uacTimeoutMs + commandTimeoutMs + 15000, env: childEnv },
       (error, stdout, stderr) => {
         if (error) {
           const msg = stderr || error.message;
           if (msg.includes("canceled by the user") || msg.includes("operation was canceled")) {
             reject(new Error("User canceled UAC prompt"));
           } else {
-            reject(new Error(msg));
+            reject(wrapElevatedExecError(error, stderr));
           }
         } else resolve(stdout);
       }
@@ -78,4 +148,11 @@ function runElevatedPowerShell(script) {
   });
 }
 
-module.exports = { isAdmin, runElevatedPowerShell, quotePs };
+module.exports = {
+  buildElevatedSupervisorScript,
+  isAdmin,
+  runElevatedPowerShell,
+  quotePs,
+  PRIVILEGED_UNCONFIRMED_EXIT_CODE,
+  wrapElevatedExecError,
+};
diff --git a/src/mitm/windowsAcl.js b/src/mitm/windowsAcl.js
new file mode 100644
index 000000000..7e39420fb
--- /dev/null
+++ b/src/mitm/windowsAcl.js
@@ -0,0 +1,81 @@
+const { execFileSync } = require("child_process");
+const fs = require("fs");
+const {
+  buildMinimalWindowsEnv,
+  resolveWindowsSystemBinary,
+} = require("./trustedBinaries");
+
+function quotePs(value) {
+  return `'${String(value).replace(/'/g, "''")}'`;
+}
+
+function buildPrivateDirectoryAclScript(directory) {
+  return `
+    $ErrorActionPreference = 'Stop'
+    $path = ${quotePs(directory)}
+    $item = Get-Item -LiteralPath $path -Force
+    if (-not $item.PSIsContainer -or ($item.Attributes -band [IO.FileAttributes]::ReparsePoint)) {
+      throw 'Unsafe MITM directory path'
+    }
+    $current = [Security.Principal.WindowsIdentity]::GetCurrent().User
+    $system = [Security.Principal.SecurityIdentifier]::new('S-1-5-18')
+    $admins = [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544')
+    $acl = Get-Acl -LiteralPath $path
+    $acl.SetAccessRuleProtection($true, $false)
+    foreach ($rule in @($acl.Access)) { [void]$acl.RemoveAccessRuleSpecific($rule) }
+    $inheritance = [Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+    $propagation = [Security.AccessControl.PropagationFlags]::None
+    foreach ($sid in @($current, $system, $admins)) {
+      $rule = [Security.AccessControl.FileSystemAccessRule]::new(
+        $sid,
+        [Security.AccessControl.FileSystemRights]::FullControl,
+        $inheritance,
+        $propagation,
+        [Security.AccessControl.AccessControlType]::Allow
+      )
+      [void]$acl.AddAccessRule($rule)
+    }
+    $acl.SetOwner($current)
+    Set-Acl -LiteralPath $path -AclObject $acl
+
+    $verified = Get-Acl -LiteralPath $path
+    if (-not $verified.AreAccessRulesProtected) { throw 'MITM directory ACL still inherits foreign access' }
+    $allowed = @($current.Value, $system.Value, $admins.Value)
+    $hasCurrentFull = $false
+    foreach ($rule in @($verified.Access)) {
+      $sid = $rule.IdentityReference.Translate([Security.Principal.SecurityIdentifier]).Value
+      if ($sid -notin $allowed -or $rule.AccessControlType -ne 'Allow') {
+        throw "Unexpected MITM directory ACL principal: $sid"
+      }
+      if ($sid -eq $current.Value -and ($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl)) {
+        $hasCurrentFull = $true
+      }
+    }
+    if (-not $hasCurrentFull) { throw 'MITM directory owner lacks full control' }
+  `;
+}
+
+function ensureWindowsPrivateDirectorySync(directory, {
+  platform = process.platform,
+  fsImpl = fs,
+  execFile = execFileSync,
+} = {}) {
+  if (platform !== "win32") return;
+  const stat = fsImpl.lstatSync(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error(`Unsafe MITM directory: ${directory}`);
+  const powershell = resolveWindowsSystemBinary("powershell.exe");
+  const encoded = Buffer.from(buildPrivateDirectoryAclScript(directory), "utf16le").toString("base64");
+  execFile(powershell, [
+    "-NoProfile",
+    "-NonInteractive",
+    "-ExecutionPolicy", "Bypass",
+    "-EncodedCommand", encoded,
+  ], {
+    windowsHide: true,
+    stdio: "pipe",
+    timeout: 15000,
+    env: buildMinimalWindowsEnv(),
+  });
+}
+
+module.exports = { buildPrivateDirectoryAclScript, ensureWindowsPrivateDirectorySync };
diff --git a/src/shared/constants/processExitCodes.js b/src/shared/constants/processExitCodes.js
new file mode 100644
index 000000000..47bcf9d11
--- /dev/null
+++ b/src/shared/constants/processExitCodes.js
@@ -0,0 +1,8 @@
+// Reserved worker exit codes shared by the standalone server and its CLI parent.
+// A normal code 0 remains restartable because an unexplained clean worker exit
+// must not silently abandon MITM ownership.
+const INTENTIONAL_HANDOFF_EXIT_CODE = 75;
+
+module.exports = Object.freeze({
+  INTENTIONAL_HANDOFF_EXIT_CODE,
+});
diff --git a/src/shared/services/initializeApp.js b/src/shared/services/initializeApp.js
index e2914e0d3..81a49c9f5 100644
--- a/src/shared/services/initializeApp.js
+++ b/src/shared/services/initializeApp.js
@@ -13,7 +13,7 @@ import {
   RESTART_COOLDOWN_MS, NETWORK_SETTLE_MS,
   WATCHDOG_INTERVAL_MS, NETWORK_CHECK_INTERVAL_MS, VIRTUAL_IFACE_REGEX,
 } from "@/lib/tunnel";
-import { getMitmStatus, startMitm, loadEncryptedPassword, initDbHooks, restoreToolDNS, removeAllDNSEntriesSync } from "@/mitm/manager";
+import { getMitmStatus, startMitm, stopMitm, loadEncryptedPassword, initDbHooks, restoreToolDNS, isSudoPasswordRequired } from "@/mitm/manager";
 import { startQuotaAutoPing } from "@/shared/services/quotaAutoPing";
 import { syncToJson as syncMitmAliasCache } from "@/lib/mitmAliasCache";
 
@@ -65,14 +65,27 @@ export async function initializeApp() {
     }
 
     if (!g.signalHandlersRegistered) {
-      const cleanup = () => {
-        try { removeAllDNSEntriesSync(); } catch { /* best effort */ }
-        killCloudflared();
-        process.exit();
+      let cleanupInProgress = false;
+      const cleanup = async () => {
+        if (cleanupInProgress) return;
+        cleanupInProgress = true;
+        try {
+          // The manager gives each privileged helper its own bounded deadline
+          // and quarantines any unconfirmed outcome. Do not abandon this
+          // promise with an outer race: Windows stop can require two serial UAC
+          // operations, and a late success must still reach the exit path.
+          await stopMitm(undefined, { preserveDesiredState: true });
+          killCloudflared();
+          process.exit(0);
+        } catch (error) {
+          // Do not exit and orphan system-wide hosts/firewall/PF state. The CLI
+          // parent can retry the authenticated manager stop.
+          cleanupInProgress = false;
+          console.error("[InitApp] Refusing unsafe shutdown:", error.message);
+        }
       };
-      process.on("SIGINT", cleanup);
-      process.on("SIGTERM", cleanup);
-      process.on("exit", () => { try { removeAllDNSEntriesSync(); } catch { /* ignore */ } });
+      process.on("SIGINT", () => { void cleanup(); });
+      process.on("SIGTERM", () => { void cleanup(); });
       g.signalHandlersRegistered = true;
     }
 
@@ -99,14 +112,22 @@ async function autoStartMitm() {
   if (g.mitmStartInProgress) return;
   g.mitmStartInProgress = true;
   try {
+    // Purge legacy ciphertext on every startup, even when MITM is disabled.
+    await loadEncryptedPassword();
     const settings = await getSettings();
     if (!settings.mitmEnabled) return;
     const mitmStatus = await getMitmStatus();
     if (mitmStatus.running) return;
 
-    const password = await loadEncryptedPassword();
-    if (!password && process.platform !== "win32") {
-      console.log("[InitApp] MITM was enabled but no saved password found, skipping auto-start");
+    // Clear any legacy stored ciphertext; sudo/UAC credentials are never
+    // persisted. Cold Windows starts require an explicit user-approved UAC
+    // action, and Unix starts proceed only when sudo is passwordless.
+    if (process.platform === "win32") {
+      console.log("[InitApp] MITM requires a fresh UAC-approved start after app restart");
+      return;
+    }
+    if (isSudoPasswordRequired()) {
+      console.log("[InitApp] MITM requires a fresh in-memory sudo credential after app restart");
       return;
     }
 
@@ -114,10 +135,10 @@ async function autoStartMitm() {
     const activeKey = keys.find(k => k.isActive !== false);
 
     console.log("[InitApp] MITM was enabled, auto-starting...");
-    await startMitm(activeKey?.key || "sk_9router", password);
+    await startMitm(activeKey?.key || "sk_9router", "");
     console.log("[InitApp] MITM auto-started");
     try {
-      await restoreToolDNS(password);
+      await restoreToolDNS("");
       console.log("[InitApp] DNS restored from saved state");
     } catch (e) {
       console.log("[InitApp] DNS restore failed:", e.message);
diff --git a/tests/unit/custom-server.test.js b/tests/unit/custom-server.test.js
index 3684fb8ce..f0cd40d54 100644
--- a/tests/unit/custom-server.test.js
+++ b/tests/unit/custom-server.test.js
@@ -1,4 +1,4 @@
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, vi } from "vitest";
 import { createRequire } from "module";
 import path from "path";
 import fs from "fs";
@@ -27,8 +27,8 @@ describe("Next.js Server Process Title", () => {
     };
 
     try {
-      // Require custom-server.js
-      require("../../custom-server.js");
+      const { setProcessTitle } = require("../../custom-server.js");
+      setProcessTitle();
 
       // Verify process.title is updated
       expect(process.title).toBe("9router next-server");
@@ -59,4 +59,25 @@ describe("Next.js Server Process Title", () => {
       } catch {}
     }
   });
+
+  it("dispatches a mutating request once when proof lookup or the handler rejects", async () => {
+    const fakeHttp = {
+      createServer: vi.fn((handler) => ({ handler })),
+    };
+    const verifyPeerOwner = vi.fn(async () => { throw new Error("lookup failed"); });
+    const handler = vi.fn(async () => { throw new Error("application failed"); });
+    const { installRequestWrapper } = require("../../custom-server.js");
+    installRequestWrapper({ httpModule: fakeHttp, secret: "a".repeat(64), verifyPeerOwner });
+    const server = fakeHttp.createServer(handler);
+    const response = { writeHead: vi.fn(), end: vi.fn(), headersSent: false, writableEnded: false };
+    server.handler({
+      method: "POST",
+      url: "/api/cli-tools/antigravity-mitm",
+      headers: {},
+      socket: { localAddress: "127.0.0.1", remoteAddress: "127.0.0.1", remotePort: 45000 },
+    }, response);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(handler).toHaveBeenCalledOnce();
+    expect(response.end).toHaveBeenCalledWith("Internal Server Error");
+  });
 });
diff --git a/tests/unit/dashboard-guard.test.js b/tests/unit/dashboard-guard.test.js
index 6e3addac1..43e5e1cf2 100644
--- a/tests/unit/dashboard-guard.test.js
+++ b/tests/unit/dashboard-guard.test.js
@@ -1,4 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
+import { createControlProof } from "../../src/mitm/controlProof.js";
+
+process.env.DURINDOOR_CONTROL_PROOF_SECRET = "a".repeat(64);
 
 const mocks = vi.hoisted(() => ({
   nextResponse: Symbol("next"),
@@ -35,11 +38,12 @@ vi.mock("@/lib/auth/dashboardSession", () => ({
 
 const { proxy, __test__ } = await import("../../src/dashboardGuard.js");
 
-function request(pathname, headers = {}) {
+function request(pathname, headers = {}, method = "GET") {
   const normalizedHeaders = new Headers(headers);
   return {
     nextUrl: { pathname, searchParams: new URL(`http://localhost${pathname}`).searchParams },
     headers: normalizedHeaders,
+    method,
     cookies: { get: vi.fn(() => undefined) },
     url: `http://localhost${pathname}`,
   };
@@ -216,7 +220,7 @@ describe("dashboard guard local-only access", () => {
     expect(response.body.error).toBe("Local only: CLI token required");
   });
 
-  it("allows local-only route on loopback when requireLogin=false", async () => {
+  it("allows read-only MITM status on loopback when requireLogin=false", async () => {
     mocks.getSettings.mockResolvedValue({ requireLogin: false });
 
     const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
@@ -227,6 +231,134 @@ describe("dashboard guard local-only access", () => {
     expect(response).toBe(mocks.nextResponse);
   });
 
+  it("rejects a loopback MITM mutation without an owner proof when login is disabled", async () => {
+    mocks.getSettings.mockResolvedValue({ requireLogin: false });
+
+    const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
+      host: "localhost:20128",
+      origin: "http://localhost:20128",
+      "x-9r-real-ip": "127.0.0.1",
+    }, "POST"));
+
+    expect(response.status).toBe(403);
+  });
+
+  it("allows a JWT-authenticated, same-owner loopback MITM mutation", async () => {
+    mocks.getSettings.mockResolvedValue({ requireLogin: false });
+    mocks.verifyDashboardAuthToken.mockResolvedValue(true);
+    const remotePort = 54321;
+    const proof = createControlProof({
+      method: "POST",
+      pathname: "/api/cli-tools/antigravity-mitm",
+      remotePort,
+    });
+
+    const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
+      host: "localhost:20128",
+      origin: "http://localhost:20128",
+      "x-9r-real-ip": "127.0.0.1",
+      "x-9r-owner-port": String(remotePort),
+      "x-9r-owner-proof": proof,
+    }, "POST"));
+
+    expect(response).toBe(mocks.nextResponse);
+  });
+
+  it("rejects an owner-stamped mutation without an explicit loopback Origin", async () => {
+    mocks.getSettings.mockResolvedValue({ requireLogin: false });
+    mocks.verifyDashboardAuthToken.mockResolvedValue(true);
+    const remotePort = 54321;
+    const proof = createControlProof({
+      method: "POST",
+      pathname: "/api/cli-tools/antigravity-mitm",
+      remotePort,
+    });
+
+    const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
+      host: "localhost:20128",
+      "x-9r-real-ip": "127.0.0.1",
+      "x-9r-owner-port": String(remotePort),
+      "x-9r-owner-proof": proof,
+    }, "POST"));
+
+    expect(response.status).toBe(403);
+  });
+
+  it("rejects an owner proof without JWT or CLI authentication", async () => {
+    mocks.getSettings.mockResolvedValue({ requireLogin: false });
+    const remotePort = 54321;
+    const proof = createControlProof({
+      method: "POST",
+      pathname: "/api/cli-tools/antigravity-mitm",
+      remotePort,
+    });
+
+    const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
+      host: "localhost:20128",
+      origin: "http://localhost:20128",
+      "x-9r-real-ip": "127.0.0.1",
+      "x-9r-owner-port": String(remotePort),
+      "x-9r-owner-proof": proof,
+    }, "POST"));
+
+    expect(response.status).toBe(403);
+  });
+
+  it("rejects a JWT and owner proof from a different loopback origin", async () => {
+    mocks.getSettings.mockResolvedValue({ requireLogin: false });
+    mocks.verifyDashboardAuthToken.mockResolvedValue(true);
+    const remotePort = 54321;
+    const proof = createControlProof({
+      method: "POST",
+      pathname: "/api/cli-tools/antigravity-mitm",
+      remotePort,
+    });
+    const baseHeaders = {
+      host: "localhost:20128",
+      "x-9r-real-ip": "127.0.0.1",
+      "x-9r-owner-port": String(remotePort),
+      "x-9r-owner-proof": proof,
+    };
+
+    for (const origin of ["http://localhost:9999", "http://127.0.0.1:20128"]) {
+      const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
+        ...baseHeaders,
+        origin,
+      }, "POST"));
+      expect(response.status).toBe(403);
+    }
+  });
+
+  it("rejects a forged or method-replayed owner proof", async () => {
+    mocks.getSettings.mockResolvedValue({ requireLogin: false });
+    const remotePort = 54321;
+    const proof = createControlProof({
+      method: "PATCH",
+      pathname: "/api/cli-tools/antigravity-mitm",
+      remotePort,
+    });
+
+    const response = await proxy(request("/api/cli-tools/antigravity-mitm", {
+      host: "localhost:20128",
+      origin: "http://localhost:20128",
+      "x-9r-real-ip": "127.0.0.1",
+      "x-9r-owner-port": String(remotePort),
+      "x-9r-owner-proof": proof,
+    }, "DELETE"));
+
+    expect(response.status).toBe(403);
+  });
+
+  it("requires an owner-bound proof for mutating MITM alias subroutes", async () => {
+    mocks.getSettings.mockResolvedValue({ requireLogin: false });
+    const response = await proxy(request("/api/cli-tools/antigravity-mitm/alias", {
+      host: "localhost:20128",
+      origin: "http://localhost:20128",
+      "x-9r-real-ip": "127.0.0.1",
+    }, "PUT"));
+    expect(response.status).toBe(403);
+  });
+
   it("rejects local-only route from tunnel host even when requireLogin=false", async () => {
     mocks.getSettings.mockResolvedValue({ requireLogin: false });
 
diff --git a/tests/unit/mitm-app-updater.test.js b/tests/unit/mitm-app-updater.test.js
new file mode 100644
index 000000000..01841e83e
--- /dev/null
+++ b/tests/unit/mitm-app-updater.test.js
@@ -0,0 +1,63 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import processExitCodes from "../../src/shared/constants/processExitCodes.js";
+
+const { stopServer, getCachedPassword, loadEncryptedPassword } = vi.hoisted(() => ({
+  stopServer: vi.fn(),
+  getCachedPassword: vi.fn(),
+  loadEncryptedPassword: vi.fn(),
+}));
+
+vi.mock("@/mitm/manager", () => ({
+  stopServer,
+  getCachedPassword,
+  loadEncryptedPassword,
+}));
+
+const { scheduleIntentionalHandoffExit, stopMitmForUpdate } = await import("../../src/lib/appUpdater.js");
+
+describe("application updater MITM shutdown", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    stopServer.mockResolvedValue({ running: false, pid: null });
+    getCachedPassword.mockReturnValue(null);
+    loadEncryptedPassword.mockResolvedValue("stored-password");
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+  });
+
+  it("uses the manager's gated authenticated stop path", async () => {
+    await expect(stopMitmForUpdate()).resolves.toBeUndefined();
+    expect(loadEncryptedPassword).toHaveBeenCalledTimes(1);
+    expect(stopServer).toHaveBeenCalledWith(null, { preserveDesiredState: true });
+  });
+
+  it("uses only the in-memory cached password after purging legacy storage", async () => {
+    getCachedPassword.mockReturnValue("cached-password");
+
+    await expect(stopMitmForUpdate()).resolves.toBeUndefined();
+
+    expect(stopServer).toHaveBeenCalledWith("cached-password", { preserveDesiredState: true });
+    expect(stopServer).not.toHaveBeenCalledWith("stored-password", expect.anything());
+  });
+
+  it("propagates ownership failures instead of falling back to a raw PID kill", async () => {
+    const failure = Object.assign(new Error("ownership unverified"), {
+      code: "MITM_OWNERSHIP_UNVERIFIED",
+    });
+    stopServer.mockRejectedValue(failure);
+    await expect(stopMitmForUpdate()).rejects.toBe(failure);
+  });
+
+  it("uses the reserved CLI handoff code for an intentional worker exit", async () => {
+    vi.useFakeTimers();
+    const exit = vi.spyOn(process, "exit").mockImplementation(() => {});
+
+    scheduleIntentionalHandoffExit(25);
+    await vi.advanceTimersByTimeAsync(25);
+
+    expect(exit).toHaveBeenCalledWith(processExitCodes.INTENTIONAL_HANDOFF_EXIT_CODE);
+  });
+});
diff --git a/tests/unit/mitm-cert-install.test.js b/tests/unit/mitm-cert-install.test.js
new file mode 100644
index 000000000..53c7e1b4c
--- /dev/null
+++ b/tests/unit/mitm-cert-install.test.js
@@ -0,0 +1,116 @@
+import { describe, expect, it } from "vitest";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import childProcess from "node:child_process";
+import forge from "node-forge";
+
+const require = createRequire(import.meta.url);
+const {
+  assertDurinDoorRootCertificate,
+  certificatesMatch,
+  quoteSh,
+  readNssCertificate,
+  replaceNssCertificate,
+} = require("../../src/mitm/cert/install.js");
+
+function findCertutil() {
+  try {
+    return childProcess.execFileSync("/bin/sh", ["-c", "command -v certutil"], {
+      encoding: "utf8",
+      env: { ...process.env, PATH: `/opt/homebrew/bin:/usr/local/bin:${process.env.PATH || ""}` },
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+function createCertificate(commonName = "9Router MITM Root CA") {
+  const keys = forge.pki.rsa.generateKeyPair(1024);
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = "01";
+  cert.validity.notBefore = new Date(Date.now() - 60_000);
+  cert.validity.notAfter = new Date(Date.now() + 86_400_000);
+  const attrs = [{ name: "commonName", value: commonName }];
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs);
+  cert.setExtensions([{ name: "basicConstraints", cA: true, critical: true }]);
+  cert.sign(keys.privateKey, forge.md.sha256.create());
+  return forge.pki.certificateToPem(cert);
+}
+
+describe("MITM certificate command argument quoting", () => {
+  it.each([
+    ["/tmp/cert with spaces.crt", "'/tmp/cert with spaces.crt'"],
+    ["/tmp/$(touch marker).crt", "'/tmp/$(touch marker).crt'"],
+    ["/tmp/`touch marker`.crt", "'/tmp/`touch marker`.crt'"],
+    ["/tmp/cert'quote.crt", "'/tmp/cert'\"'\"'quote.crt'"],
+  ])("quotes %s as one inert shell argument", (input, expected) => {
+    expect(quoteSh(input)).toBe(expected);
+  });
+
+  it("compares validated X.509 DER instead of paths, names, or malformed text", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-cert-compare-"));
+    try {
+      const source = path.join(tmpDir, "source.crt");
+      const same = path.join(tmpDir, "same.crt");
+      const stale = path.join(tmpDir, "stale.crt");
+      const malformed = path.join(tmpDir, "malformed.crt");
+      const pem = createCertificate();
+      fs.writeFileSync(source, pem);
+      fs.writeFileSync(same, pem);
+      fs.writeFileSync(stale, createCertificate());
+      fs.writeFileSync(malformed, "not a certificate");
+
+      expect(certificatesMatch(source, same)).toBe(true);
+      expect(certificatesMatch(source, stale)).toBe(false);
+      expect(certificatesMatch(malformed, malformed)).toBe(false);
+      expect(certificatesMatch(source, path.join(tmpDir, "missing.crt"))).toBe(false);
+      expect(assertDurinDoorRootCertificate(source)).toBeTruthy();
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("refuses trust-store mutation for an arbitrary self-signed CA", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-cert-identity-"));
+    try {
+      const certPath = path.join(tmpDir, "foreign.crt");
+      fs.writeFileSync(certPath, createCertificate("Corporate Root CA"));
+      expect(() => assertDurinDoorRootCertificate(certPath)).toThrow(
+        "not a DurinDoor MITM root",
+      );
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  const certutil = findCertutil();
+  (certutil ? it : it.skip)("replaces an existing NSS nickname with the exact new Root CA", async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-nss-rotation-"));
+    const dbDir = path.join(tmpDir, "nssdb");
+    const oldPath = path.join(tmpDir, "old.crt");
+    const newPath = path.join(tmpDir, "new.crt");
+    fs.mkdirSync(dbDir);
+    fs.writeFileSync(oldPath, createCertificate());
+    fs.writeFileSync(newPath, createCertificate());
+    const spec = `sql:${dbDir}`;
+    try {
+      childProcess.execFileSync(certutil, ["-d", spec, "-N", "--empty-password"]);
+      childProcess.execFileSync(certutil, [
+        "-d", spec, "-A", "-t", "C,,", "-n", "9Router MITM Root CA", "-i", oldPath,
+      ]);
+
+      const expected = assertDurinDoorRootCertificate(newPath);
+      await replaceNssCertificate(certutil, spec, newPath, expected);
+
+      const installed = await readNssCertificate(certutil, spec);
+      expect(installed.cert.raw.equals(expected.cert.raw)).toBe(true);
+      expect(installed.cert.raw.equals(assertDurinDoorRootCertificate(oldPath).cert.raw)).toBe(false);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/tests/unit/mitm-cli-data-dir.test.js b/tests/unit/mitm-cli-data-dir.test.js
new file mode 100644
index 000000000..baca0c807
--- /dev/null
+++ b/tests/unit/mitm-cli-data-dir.test.js
@@ -0,0 +1,45 @@
+import { describe, expect, it, vi } from "vitest";
+import { createRequire } from "node:module";
+import path from "node:path";
+
+const require = createRequire(import.meta.url);
+const { getAppDataDir } = require("../../cli/src/cli/appDataDir.js");
+
+describe("CLI data-directory resolution", () => {
+  it.each([
+    ["linux", "/fixture/work", "/fixture/work/relative-fixture-data"],
+    ["win32", "C:\\fixture\\work", "C:\\fixture\\work\\relative-fixture-data"],
+  ])("canonicalizes configured DATA_DIR before worker cwd changes on %s", (platform, cwd, expected) => {
+    const mkdir = vi.fn();
+    expect(getAppDataDir({
+      env: { DATA_DIR: "relative-fixture-data" },
+      platform,
+      homedir: () => "/fixture/home",
+      cwd: () => cwd,
+      mkdir,
+    })).toBe(expected);
+    expect(mkdir).toHaveBeenCalledWith(expected, { recursive: true });
+  });
+
+  it("uses the Windows home fallback when APPDATA is absent", () => {
+    expect(getAppDataDir({
+      env: {},
+      platform: "win32",
+      homedir: () => "C:\\Users\\fixture",
+    })).toBe(path.win32.join("C:\\Users\\fixture", "AppData", "Roaming", "9router"));
+  });
+
+  it("falls back from a Unix path on Windows without creating it", () => {
+    const mkdir = vi.fn();
+    const warn = vi.fn();
+    expect(getAppDataDir({
+      env: { DATA_DIR: "/var/lib/9router", APPDATA: "C:\\FixtureData" },
+      platform: "win32",
+      homedir: () => "C:\\Users\\fixture",
+      mkdir,
+      warn,
+    })).toBe(path.win32.join("C:\\FixtureData", "9router"));
+    expect(mkdir).not.toHaveBeenCalled();
+    expect(warn).toHaveBeenCalledOnce();
+  });
+});
diff --git a/tests/unit/mitm-cli-manager-stop.test.js b/tests/unit/mitm-cli-manager-stop.test.js
new file mode 100644
index 000000000..17c8a32bc
--- /dev/null
+++ b/tests/unit/mitm-cli-manager-stop.test.js
@@ -0,0 +1,48 @@
+import { describe, expect, it, vi } from "vitest";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const require = createRequire(import.meta.url);
+const { stopMitmViaManagerSync } = require("../../cli/src/cli/mitmManagerStop.js");
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+
+describe("CLI MITM manager shutdown", () => {
+  it("requests manager-owned cleanup without putting credentials in argv", () => {
+    const execFile = vi.fn();
+    expect(stopMitmViaManagerSync(20128, {
+      execFile,
+      nodePath: "/trusted/node",
+      cliToken: "fixture-cli-token",
+    })).toBe(true);
+    expect(execFile).toHaveBeenCalledTimes(1);
+    expect(execFile.mock.calls[0][0]).toBe("/trusted/node");
+    expect(execFile.mock.calls[0][1].join(" ")).not.toContain("20128");
+    expect(execFile.mock.calls[0][1].join(" ")).not.toContain("fixture-cli-token");
+    expect(JSON.parse(execFile.mock.calls[0][2].input)).toEqual({
+      port: 20128,
+      token: "fixture-cli-token",
+      preserveDesiredState: true,
+    });
+    expect(execFile.mock.calls[0][2].timeout).toBe(370000);
+    const managerScript = execFile.mock.calls[0][1][1];
+    expect(managerScript).toContain("req.setTimeout(360000");
+  });
+
+  it("fails closed when manager cleanup cannot be confirmed", () => {
+    const execFile = vi.fn(() => { throw new Error("manager unavailable"); });
+    expect(stopMitmViaManagerSync(20128, { execFile, cliToken: "fixture-cli-token" })).toBe(false);
+  });
+
+  it("restarts after an unexpected clean app-worker exit instead of orphaning MITM", () => {
+    const cliSource = fs.readFileSync(path.join(repoRoot, "cli", "cli.js"), "utf8");
+    const closeHandler = cliSource.slice(
+      cliSource.indexOf('server.on("close"'),
+      cliSource.indexOf("function tryRestart"),
+    );
+    expect(closeHandler).toContain("tryRestart(code || 1)");
+    expect(closeHandler).not.toContain("code === 0");
+    expect(cliSource).toMatch(/if\s*\(!cleanup\(\)\)\s*\{/);
+  });
+});
diff --git a/tests/unit/mitm-hosts-ownership.test.js b/tests/unit/mitm-hosts-ownership.test.js
new file mode 100644
index 000000000..a8ae2e5d1
--- /dev/null
+++ b/tests/unit/mitm-hosts-ownership.test.js
@@ -0,0 +1,101 @@
+import { describe, expect, it } from "vitest";
+import { createRequire } from "node:module";
+import crypto from "node:crypto";
+import { vi } from "vitest";
+
+const require = createRequire(import.meta.url);
+const {
+  buildWindowsHostsMutationScript,
+  commitUnixHostsAndFlush,
+  lineHasLegacyOwnedHost,
+  lineHasOwnedHost,
+  mutateUnixHosts,
+} = require("../../src/mitm/dns/dnsConfig.js");
+
+describe("MITM hosts ownership", () => {
+  const host = "generativelanguage.googleapis.com";
+
+  it("recognizes only an exact, single-host DurinDoor-owned line", () => {
+    expect(lineHasOwnedHost(
+      `127.0.0.1 ${host} # durindoor-mitm:antigravity`,
+      host,
+      "antigravity",
+    )).toBe(true);
+    expect(lineHasOwnedHost(`127.0.0.1 ${host}`, host, "antigravity")).toBe(false);
+    expect(lineHasOwnedHost(
+      `127.0.0.1 ${host} foreign.example # durindoor-mitm:antigravity`,
+      host,
+      "antigravity",
+    )).toBe(false);
+    expect(lineHasOwnedHost(
+      `127.0.0.1 ${host} # operator-note`,
+      host,
+      "antigravity",
+    )).toBe(false);
+  });
+
+  it("adopts or removes only the exact two-field legacy mapping", () => {
+    expect(lineHasLegacyOwnedHost(`127.0.0.1 ${host}`, host)).toBe(true);
+    expect(lineHasLegacyOwnedHost(`127.0.0.1 ${host} foreign.example`, host)).toBe(false);
+    expect(lineHasLegacyOwnedHost(`127.0.0.1 ${host} # old override`, host)).toBe(false);
+    expect(lineHasLegacyOwnedHost(`::1 ${host}`, host)).toBe(false);
+  });
+
+  it("uses the same exact ownership predicate in Windows removal", () => {
+    const script = buildWindowsHostsMutationScript({
+      action: "remove",
+      hosts: [host],
+      tag: "antigravity",
+      hostsFile: "C:\\Windows\\System32\\drivers\\etc\\hosts",
+      expectedSha256: "a".repeat(64),
+    });
+
+    expect(script).toContain("$fields.Count -eq 2");
+    expect(script).toContain("$fields[1] -eq $hostName");
+    expect(script).toContain("Test-OwnedHostLine $line $_.Host $_.Tag");
+    expect(script).toContain("Hosts file changed before mutation");
+    expect(script).toContain("Hosts file changed during mutation");
+    expect(script).not.toContain("-not ($entries | Where-Object { Test-ExactHostLine");
+  });
+
+  it("binds a Unix mutation to the snapshot used to compute the next content", async () => {
+    const original = Buffer.from(`127.0.0.1 localhost\n`);
+    const snapshot = {
+      bytes: original,
+      sha256: crypto.createHash("sha256").update(original).digest("hex"),
+    };
+    const execute = vi.fn(async () => {});
+
+    await mutateUnixHosts(
+      `127.0.0.1 localhost\n127.0.0.1 ${host} # durindoor-mitm:antigravity\n`,
+      "fixture-password",
+      snapshot,
+      execute,
+    );
+
+    expect(execute).toHaveBeenCalledOnce();
+    expect(execute.mock.calls[0][0]).toContain(snapshot.sha256);
+  });
+
+  it("rolls back the exact Unix hosts commit when DNS cache flush fails", async () => {
+    const original = Buffer.from("127.0.0.1 localhost\n");
+    const next = `127.0.0.1 localhost\n127.0.0.1 ${host} # durindoor-mitm:antigravity\n`;
+    const snapshot = {
+      bytes: original,
+      sha256: crypto.createHash("sha256").update(original).digest("hex"),
+    };
+    const mutate = vi.fn(async () => true);
+    const flushError = new Error("mDNSResponder unavailable");
+
+    await expect(commitUnixHostsAndFlush(next, "fixture-password", snapshot, {
+      mutate,
+      flush: vi.fn(async () => { throw flushError; }),
+    })).rejects.toBe(flushError);
+
+    expect(mutate).toHaveBeenCalledTimes(2);
+    expect(mutate.mock.calls[1][0]).toBe(original.toString("utf8"));
+    expect(mutate.mock.calls[1][2].sha256).toBe(
+      crypto.createHash("sha256").update(next).digest("hex"),
+    );
+  });
+});
diff --git a/tests/unit/mitm-launch-gate.test.js b/tests/unit/mitm-launch-gate.test.js
new file mode 100644
index 000000000..2acc36149
--- /dev/null
+++ b/tests/unit/mitm-launch-gate.test.js
@@ -0,0 +1,83 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const require = createRequire(import.meta.url);
+const {
+  publishLaunchAuthorization,
+  waitForLaunchAuthorization,
+} = require("../../src/mitm/launchGate.js");
+
+describe("MITM pre-listen launch authorization", () => {
+  let temp;
+  let filePath;
+  const nonce = "a".repeat(48);
+
+  beforeEach(() => {
+    temp = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-launch-gate-"));
+    filePath = path.join(temp, ".launch.gate");
+  });
+
+  afterEach(() => fs.rmSync(temp, { recursive: true, force: true }));
+
+  it("fsyncs the authorization file and directory before returning", () => {
+    const fsyncSync = vi.fn(fs.fsyncSync.bind(fs));
+    publishLaunchAuthorization(filePath, nonce, { ...fs, constants: fs.constants, fsyncSync });
+    expect(fsyncSync).toHaveBeenCalledTimes(process.platform === "win32" ? 1 : 2);
+    expect(fs.readFileSync(filePath, "utf8")).toBe(`${nonce}\n`);
+  });
+
+  it("rejects executable startup without manager authorization metadata", async () => {
+    await expect(waitForLaunchAuthorization({
+      filePath: null,
+      nonce: null,
+      managerPid: null,
+    })).rejects.toThrow("authorization file is required");
+  });
+
+  it("consumes the exact nonce with compare-and-remove semantics", async () => {
+    publishLaunchAuthorization(filePath, nonce);
+    await expect(waitForLaunchAuthorization({
+      filePath,
+      nonce,
+      managerPid: 42,
+      processImpl: { kill: vi.fn() },
+      timeoutMs: 100,
+    })).resolves.toBe(true);
+    expect(fs.existsSync(filePath)).toBe(false);
+  });
+
+  it("fails closed when the manager dies before authorization", async () => {
+    await expect(waitForLaunchAuthorization({
+      filePath,
+      nonce,
+      managerPid: 42,
+      processImpl: { kill: () => { throw Object.assign(new Error("dead"), { code: "ESRCH" }); } },
+      timeoutMs: 100,
+    })).rejects.toThrow("manager exited");
+  });
+
+  it("rejects a mismatched nonce without deleting the evidence", async () => {
+    publishLaunchAuthorization(filePath, "b".repeat(48));
+    await expect(waitForLaunchAuthorization({
+      filePath,
+      nonce,
+      managerPid: 42,
+      processImpl: { kill: vi.fn() },
+      timeoutMs: 100,
+    })).rejects.toThrow("nonce mismatch");
+    expect(fs.existsSync(filePath)).toBe(true);
+  });
+
+  it("times out without authorizing a listener", async () => {
+    await expect(waitForLaunchAuthorization({
+      filePath,
+      nonce,
+      managerPid: 42,
+      processImpl: { kill: vi.fn() },
+      timeoutMs: 30,
+    })).rejects.toThrow("timed out");
+  });
+});
diff --git a/tests/unit/mitm-logger-redaction.test.js b/tests/unit/mitm-logger-redaction.test.js
new file mode 100644
index 000000000..e7ea91ff9
--- /dev/null
+++ b/tests/unit/mitm-logger-redaction.test.js
@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const require = createRequire(import.meta.url);
+
+describe("MITM dump logger redaction", () => {
+  it("writes shared-sanitizer output instead of intercepted credentials", () => {
+    const temp = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-mitm-log-"));
+    const previousDataDir = process.env.DATA_DIR;
+    process.env.DATA_DIR = temp;
+    for (const id of ["../../src/mitm/logger.js", "../../src/mitm/paths.js"]) {
+      delete require.cache[require.resolve(id)];
+    }
+    const { dumpRequest } = require("../../src/mitm/logger.js");
+
+    try {
+      const file = dumpRequest({
+        method: "POST",
+        url: "/v1/chat/completions",
+        headers: {
+          host: "api.example.test",
+          cookie: "sid=cookie-secret",
+          "x-api-key": "provider-secret",
+          "x-goog-api-key": "google-secret",
+          "x-amz-security-token": "aws-secret",
+          "content-type": "application/json",
+        },
+      }, Buffer.from("{}"));
+      const output = fs.readFileSync(file, "utf8");
+      expect(output).not.toMatch(/cookie-secret|provider-secret|google-secret|aws-secret/);
+      expect(JSON.parse(output).headers).toMatchObject({
+        cookie: "[REDACTED]",
+        "x-api-key": "[REDACTED]",
+        "x-goog-api-key": "[REDACTED]",
+        "x-amz-security-token": "[REDACTED]",
+        "content-type": "application/json",
+      });
+    } finally {
+      if (previousDataDir === undefined) delete process.env.DATA_DIR;
+      else process.env.DATA_DIR = previousDataDir;
+      fs.rmSync(temp, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/tests/unit/mitm-manager-startup.test.js b/tests/unit/mitm-manager-startup.test.js
new file mode 100644
index 000000000..c18233781
--- /dev/null
+++ b/tests/unit/mitm-manager-startup.test.js
@@ -0,0 +1,1314 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createRequire } from "node:module";
+import childProcess from "node:child_process";
+import crypto from "node:crypto";
+import { EventEmitter } from "node:events";
+import fs from "node:fs";
+import https from "node:https";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+
+const require = createRequire(import.meta.url);
+const managerPath = require.resolve("../../src/mitm/manager.js");
+
+function deferred() {
+  let resolve;
+  let reject;
+  const promise = new Promise((res, rej) => { resolve = res; reject = rej; });
+  return { promise, resolve, reject };
+}
+
+function cacheModule(modulePath, exports, restorers) {
+  const resolved = require.resolve(modulePath);
+  const previous = require.cache[resolved];
+  require.cache[resolved] = { id: resolved, filename: resolved, loaded: true, exports };
+  restorers.push(() => {
+    if (previous) require.cache[resolved] = previous;
+    else delete require.cache[resolved];
+  });
+}
+
+function installLifecycleHarness({
+  tmpDir,
+  restorers,
+  healthPid = null,
+  launcherPid = 424242,
+  launcherAlive = true,
+  launcherProbeDenied = false,
+  spawnError = null,
+  lockReleaseError = null,
+  lockContention = false,
+  initialNonce = null,
+  exitBeforeHealth = false,
+  existingRootCA = false,
+  rootCAValid = true,
+  rootCAGenerationError = null,
+  killBarrier = null,
+  healthServerNonce = null,
+  hangingHealth = false,
+  parentIsAdmin = false,
+  publicHealthFailure = false,
+  internalPortBusy = false,
+  uninstallError = null,
+  installError = null,
+  certInstalled = true,
+  redirectInstallError = null,
+  redirectRemovalError = null,
+  dnsRemovalError = null,
+}) {
+  const dataDir = path.join(tmpDir, "data");
+  const mitmDir = path.join(dataDir, "mitm");
+  const commands = [];
+  const killedPids = [];
+  const alivePids = new Set(Number.isSafeInteger(launcherPid) && launcherAlive ? [launcherPid] : []);
+  const processStartFor = (pid) => `fixture-start-${pid}`;
+  const launcherStart = processStartFor(launcherPid);
+  if (healthPid) alivePids.add(healthPid);
+  let instanceNonce = initialNonce;
+
+  if (existingRootCA) {
+    fs.mkdirSync(mitmDir, { recursive: true });
+    fs.writeFileSync(path.join(mitmDir, "rootCA.crt"), "existing-cert");
+    if (existingRootCA !== "cert-only") {
+      fs.writeFileSync(path.join(mitmDir, "rootCA.key"), "existing-key");
+    }
+  }
+
+  cacheModule("../../src/mitm/paths.js", { DATA_DIR: dataDir, MITM_DIR: mitmDir }, restorers);
+  cacheModule("../../src/mitm/logger.js", { log: vi.fn(), err: vi.fn() }, restorers);
+  cacheModule("../../src/mitm/config.js", {
+    LSOF_BIN: "lsof",
+    MITM_ENTRY_ARG: "--durindoor-mitm-entry",
+    MITM_START_LOCK_PORT: 20443,
+    MITM_NODE_PORT: 8443,
+  }, restorers);
+  cacheModule("../../src/mitm/serverBootstrap.js", {
+    withRootCALock: async (operation) => operation(),
+  }, restorers);
+  cacheModule("../../src/mitm/processIdentity.js", {
+    getProcessStartIdentity: (pid) => alivePids.has(pid) ? processStartFor(pid) : null,
+  }, restorers);
+  cacheModule("../../src/mitm/winElevated.js", {
+    isAdmin: () => parentIsAdmin,
+    runElevatedPowerShell: vi.fn(),
+  }, restorers);
+  const ensureRootCASync = vi.fn(() => {
+    if (rootCAGenerationError) throw rootCAGenerationError;
+    if (!rootCAValid) {
+      fs.writeFileSync(path.join(mitmDir, "rootCA.key"), "generated-key");
+      fs.writeFileSync(path.join(mitmDir, "rootCA.crt"), "generated-cert");
+      return true;
+    }
+    return false;
+  });
+  cacheModule("../../src/mitm/cert/rootCA.js", {
+    ensureRootCASync,
+    hasValidRootCA: () => rootCAValid,
+  }, restorers);
+  const uninstallCert = vi.fn(async () => {
+    if (uninstallError) throw uninstallError;
+  });
+  let trusted = certInstalled;
+  const installCert = vi.fn(async () => {
+    if (installError) throw installError;
+    trusted = true;
+  });
+  cacheModule("../../src/mitm/cert/install.js", {
+    assertDurinDoorRootCertificate: vi.fn((certPath) => {
+      if (fs.readFileSync(certPath, "utf8") === "corrupt-cert") {
+        throw new Error("invalid certificate bytes");
+      }
+      return { cert: {} };
+    }),
+    installCert,
+    uninstallCert,
+    checkCertInstalled: vi.fn(() => trusted),
+  }, restorers);
+  const execWithPassword = vi.fn((command, _password, metadata = {}) => {
+    commands.push(command);
+    const isRedirectRemoval = metadata.scope === "mitm-port-redirect"
+      ? metadata.operation === "remove"
+      : command.includes("-F all") || command.includes("-D OUTPUT");
+    if (redirectInstallError && !isRedirectRemoval) {
+      return Promise.reject(redirectInstallError);
+    }
+    if (redirectRemovalError && isRedirectRemoval) {
+      return Promise.reject(redirectRemovalError);
+    }
+    const completeKill = () => {
+      for (const pid of alivePids) {
+        if (command.includes(String(pid))) alivePids.delete(pid);
+      }
+      if (command.includes(`-P ${launcherPid}`)) alivePids.clear();
+    };
+    if (killBarrier && (/\bkill\b|\bpkill\b/.test(command) || isRedirectRemoval)) {
+      return killBarrier.promise.then(completeKill);
+    }
+    completeKill();
+    return Promise.resolve();
+  });
+  const removeAllDNSEntries = vi.fn(async () => {
+    if (dnsRemovalError) throw dnsRemovalError;
+  });
+  const removeLegacyDNSEntries = vi.fn();
+  cacheModule("../../src/mitm/dns/dnsConfig.js", {
+    addDNSEntry: vi.fn(),
+    adoptLegacyDNSEntries: vi.fn(),
+    removeDNSEntry: vi.fn(),
+    removeAllDNSEntries,
+    removeAllDNSEntriesSync: vi.fn(),
+    removeLegacyDNSEntries,
+    checkAllDNSStatus: () => ({}),
+    TOOL_HOSTS: {},
+    isSudoAvailable: () => true,
+    isSudoPasswordRequired: () => false,
+    execWithPassword,
+  }, restorers);
+
+  const child = new EventEmitter();
+  child.pid = launcherPid;
+  child.killed = false;
+  child.stdout = new EventEmitter();
+  child.stderr = new EventEmitter();
+  child.stdin = { write: vi.fn(), end: vi.fn() };
+  child.kill = vi.fn(() => {
+    child.killed = true;
+    alivePids.delete(launcherPid);
+    return true;
+  });
+
+  const originalExec = childProcess.exec;
+  const originalExecFile = childProcess.execFile;
+  const originalExecFileSync = childProcess.execFileSync;
+  const originalExecSync = childProcess.execSync;
+  const originalSpawn = childProcess.spawn;
+  childProcess.exec = vi.fn((command, options, callback) => {
+    if (typeof options === "function") options(null, "", "");
+    else callback?.(null, "", "");
+    return { on: vi.fn() };
+  });
+  childProcess.execFile = vi.fn((command, args, options, callback) => {
+    const complete = () => callback?.(null, "", "");
+    if (killBarrier && String(command).endsWith("pkill")) {
+      void killBarrier.promise.then(complete);
+    } else {
+      complete();
+    }
+    return { on: vi.fn() };
+  });
+  childProcess.execFileSync = vi.fn((command, args) => {
+    if (args?.includes("lstart=")) return `${launcherStart}\n`;
+    throw new Error("no port owner");
+  });
+  childProcess.execSync = vi.fn((command) => {
+    if (String(command).includes(" lstart=")) return `${launcherStart}\n`;
+    throw new Error("no port owner");
+  });
+  childProcess.spawn = vi.fn((command, args, options) => {
+    const bootstrapIndex = args?.indexOf("--durindoor-mitm-bootstrap") ?? -1;
+    if (bootstrapIndex >= 0) {
+      const bootstrap = JSON.parse(fs.readFileSync(args[bootstrapIndex + 1], "utf8"));
+      instanceNonce = bootstrap.nonce;
+    } else {
+      instanceNonce = options?.env?.MITM_INSTANCE_NONCE || instanceNonce;
+    }
+    if (spawnError) queueMicrotask(() => child.emit("error", spawnError));
+    return child;
+  });
+  restorers.push(() => {
+    childProcess.exec = originalExec;
+    childProcess.execFile = originalExecFile;
+    childProcess.execFileSync = originalExecFileSync;
+    childProcess.execSync = originalExecSync;
+    childProcess.spawn = originalSpawn;
+  });
+
+  const originalCreateServer = net.createServer;
+  let serverCount = 0;
+  net.createServer = vi.fn(() => {
+    serverCount += 1;
+    const serverId = serverCount;
+    const callbacks = {};
+    return {
+      once(event, callback) { callbacks[event] = callback; return this; },
+      on() { return this; },
+      removeListener() { return this; },
+      unref() { return this; },
+      listen(...args) {
+        if (serverId === 1 && lockContention) {
+          callbacks.error?.(Object.assign(new Error("address in use"), { code: "EADDRINUSE" }));
+          return;
+        }
+        if (serverId === 2 && internalPortBusy) {
+          callbacks.error?.(Object.assign(new Error("address in use"), { code: "EADDRINUSE" }));
+          return;
+        }
+        const callback = args.at(-1);
+        if (typeof callback === "function") callback();
+        else callbacks.listening?.();
+      },
+      close(callback) {
+        callback?.(serverId === 1 ? lockReleaseError : null);
+      },
+    };
+  });
+  restorers.push(() => { net.createServer = originalCreateServer; });
+
+  const originalRequest = https.request;
+  https.request = vi.fn((options, callback) => {
+    const request = new EventEmitter();
+    request.setTimeout = vi.fn();
+    request.destroy = (error) => request.emit("error", error);
+    if (hangingHealth) {
+      request.end = vi.fn();
+      return request;
+    }
+    request.end = () => queueMicrotask(() => {
+      if (exitBeforeHealth) child.emit("exit", 1);
+      const response = new EventEmitter();
+      callback(response);
+      const challenge = options.headers?.["x-durindoor-mitm-challenge"];
+      const healthNonce = healthServerNonce || instanceNonce;
+      const proof = challenge && healthNonce
+        ? crypto.createHmac("sha256", healthNonce).update(challenge).digest("hex")
+        : undefined;
+      const healthAvailable = healthPid && !(publicHealthFailure && options.port === 443);
+      response.emit("data", JSON.stringify(healthAvailable
+        ? { ok: true, pid: healthPid, proof }
+        : { ok: false }));
+      response.emit("end");
+    });
+    return request;
+  });
+  restorers.push(() => { https.request = originalRequest; });
+
+  const originalKill = process.kill;
+  process.kill = vi.fn((pid, signal) => {
+    if (signal === 0 && launcherProbeDenied && pid === launcherPid) {
+      throw Object.assign(new Error("operation not permitted"), { code: "EPERM" });
+    }
+    if (signal === 0 && alivePids.has(pid)) return true;
+    if (signal !== 0 && alivePids.has(pid)) {
+      alivePids.delete(pid);
+      killedPids.push(pid);
+      return true;
+    }
+    throw Object.assign(new Error("not alive"), { code: "ESRCH" });
+  });
+  restorers.push(() => { process.kill = originalKill; });
+
+  return {
+    child,
+    commands,
+    ensureRootCASync,
+    installCert,
+    get instanceNonce() { return instanceNonce; },
+    launcherStart,
+    killedPids,
+    processStartFor,
+    mitmDir,
+    removeAllDNSEntries,
+    removeLegacyDNSEntries,
+    uninstallCert,
+  };
+}
+
+describe("MITM manager startup coordination", () => {
+  let tmpDir;
+  let restorers;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-mitm-manager-"));
+    process.env.MITM_GLOBAL_STATE_DIR = path.join(tmpDir, "global-state");
+    restorers = [];
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    delete require.cache[managerPath];
+    for (const restore of restorers.reverse()) restore();
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+    delete process.env.MITM_GLOBAL_STATE_DIR;
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it("rejects a concurrent start, releases its owned lock on failure, and permits retry", async () => {
+    const dataDir = path.join(tmpDir, "data");
+    const mitmDir = path.join(dataDir, "mitm");
+    const firstGeneration = deferred();
+    const ensureRootCASync = vi.fn()
+      .mockImplementationOnce(() => firstGeneration.promise)
+      .mockRejectedValue(new Error("retry reached certificate generation"));
+
+    cacheModule("../../src/mitm/paths.js", { DATA_DIR: dataDir, MITM_DIR: mitmDir }, restorers);
+    cacheModule("../../src/mitm/logger.js", { log: vi.fn(), err: vi.fn() }, restorers);
+    cacheModule("../../src/mitm/config.js", {
+      LSOF_BIN: "lsof",
+      MITM_ENTRY_ARG: "--durindoor-mitm-entry",
+      MITM_START_LOCK_PORT: 20443,
+      MITM_NODE_PORT: 8443,
+    }, restorers);
+    cacheModule("../../src/mitm/serverBootstrap.js", {
+      withRootCALock: async (operation) => operation(),
+    }, restorers);
+    cacheModule("../../src/mitm/winElevated.js", { isAdmin: () => false }, restorers);
+    cacheModule("../../src/mitm/cert/rootCA.js", {
+      ensureRootCASync,
+      hasValidRootCA: () => false,
+    }, restorers);
+    cacheModule("../../src/mitm/cert/install.js", {
+      installCert: vi.fn(),
+      uninstallCert: vi.fn(),
+      checkCertInstalled: vi.fn(() => false),
+    }, restorers);
+    cacheModule("../../src/mitm/dns/dnsConfig.js", {
+      addDNSEntry: vi.fn(),
+      adoptLegacyDNSEntries: vi.fn(),
+      removeDNSEntry: vi.fn(),
+      removeAllDNSEntries: vi.fn(),
+      removeAllDNSEntriesSync: vi.fn(),
+      removeLegacyDNSEntries: vi.fn(),
+      checkAllDNSStatus: () => ({}),
+      TOOL_HOSTS: {},
+      isSudoAvailable: () => true,
+      isSudoPasswordRequired: () => false,
+      execWithPassword: vi.fn(() => Promise.resolve()),
+    }, restorers);
+
+    const originalExec = childProcess.exec;
+    const originalExecSync = childProcess.execSync;
+    const originalSpawn = childProcess.spawn;
+    childProcess.exec = vi.fn((command, options, callback) => {
+      if (typeof options === "function") options(null, "", "");
+      else callback?.(null, "", "");
+      return { on: vi.fn() };
+    });
+    childProcess.execSync = vi.fn();
+    childProcess.spawn = vi.fn(() => { throw new Error("spawn must not be reached"); });
+    restorers.push(() => {
+      childProcess.exec = originalExec;
+      childProcess.execSync = originalExecSync;
+      childProcess.spawn = originalSpawn;
+    });
+
+    const originalCreateServer = net.createServer;
+    net.createServer = vi.fn(() => {
+      const callbacks = {};
+      return {
+        once(event, callback) { callbacks[event] = callback; return this; },
+        on() { return this; },
+        removeListener() { return this; },
+        unref() { return this; },
+        listen(...args) {
+          const callback = args.at(-1);
+          if (typeof callback === "function") callback();
+          else callbacks.listening?.();
+        },
+        close(callback) { callback?.(); },
+      };
+    });
+    restorers.push(() => { net.createServer = originalCreateServer; });
+
+    const { startServer } = require("../../src/mitm/manager.js");
+    const first = startServer("fixture-key", "fixture-password");
+    await vi.advanceTimersByTimeAsync(500);
+    expect(ensureRootCASync).toHaveBeenCalledTimes(1);
+
+    await expect(startServer("other-key", "other-password")).rejects.toMatchObject({
+      code: "MITM_START_IN_PROGRESS",
+    });
+
+    firstGeneration.reject(new Error("first generation failed"));
+    await expect(first).rejects.toThrow("first generation failed");
+    expect(fs.existsSync(path.join(mitmDir, ".mitm.pid"))).toBe(false);
+
+    const retry = startServer("fixture-key", "fixture-password");
+    const retryFailure = expect(retry).rejects.toThrow("retry reached certificate generation");
+    await vi.advanceTimersByTimeAsync(500);
+    await retryFailure;
+    expect(ensureRootCASync).toHaveBeenCalledTimes(2);
+    expect(fs.existsSync(path.join(mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("does not remove another DATA_DIR instance's global rule when its transport is live", async () => {
+    const harness = installLifecycleHarness({ tmpDir, restorers, internalPortBusy: true });
+    const globalDir = path.join(tmpDir, "global-state");
+    fs.mkdirSync(globalDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(globalDir, "redirect.json"), `${JSON.stringify({
+      version: 1,
+      state: "installed",
+      ownerKind: "uid",
+      ownerValue: String(process.geteuid?.() ?? process.getuid()),
+      publicPort: 443,
+      internalPort: 8443,
+      nonce: "c".repeat(48),
+    })}\n`, { mode: 0o600 });
+
+    const { startServer } = require("../../src/mitm/manager.js");
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toMatchObject({
+      code: "MITM_INTERNAL_PORT_BUSY",
+    });
+    expect(harness.removeAllDNSEntries).not.toHaveBeenCalled();
+    expect(harness.commands.some((command) => command.includes("-F all") || command.includes("-D OUTPUT"))).toBe(false);
+    expect(fs.existsSync(path.join(globalDir, "redirect.json"))).toBe(true);
+  });
+
+  it("refuses a cross-DATA_DIR stop when only a global journal and live incumbent exist", async () => {
+    const harness = installLifecycleHarness({ tmpDir, restorers, internalPortBusy: true });
+    const globalDir = path.join(tmpDir, "global-state");
+    fs.mkdirSync(globalDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(globalDir, "redirect.json"), `${JSON.stringify({
+      version: 1,
+      state: "installed",
+      ownerKind: "uid",
+      ownerValue: String(process.geteuid?.() ?? process.getuid()),
+      publicPort: 443,
+      internalPort: 8443,
+      nonce: "d".repeat(48),
+    })}\n`, { mode: 0o600 });
+
+    const { stopServer } = require("../../src/mitm/manager.js");
+    await expect(stopServer("fixture-password")).rejects.toMatchObject({
+      code: "MITM_OWNERSHIP_UNVERIFIED",
+    });
+    expect(harness.removeAllDNSEntries).not.toHaveBeenCalled();
+    expect(fs.existsSync(path.join(globalDir, "redirect.json"))).toBe(true);
+  });
+
+  it("quarantines an unconfirmed privileged redirect mutation and refuses inverse cleanup", async () => {
+    const redirectInstallError = Object.assign(new Error("privileged wrapper timed out"), {
+      code: "PRIVILEGED_TERMINATION_UNCONFIRMED",
+    });
+    const harness = installLifecycleHarness({ tmpDir, restorers, redirectInstallError });
+    const manager = require("../../src/mitm/manager.js");
+
+    await expect(manager.startServer("fixture-key", "fixture-password")).rejects.toMatchObject({
+      code: "MITM_PRIVILEGED_OPERATION_UNCERTAIN",
+    });
+    const journalPath = path.join(tmpDir, "global-state", "redirect.json");
+    expect(JSON.parse(fs.readFileSync(journalPath, "utf8"))).toMatchObject({ state: "uncertain" });
+    const commandCount = harness.commands.length;
+
+    await expect(manager.stopServer("fixture-password")).rejects.toMatchObject({
+      code: "MITM_PRIVILEGED_OPERATION_UNCERTAIN",
+    });
+    expect(harness.commands).toHaveLength(commandCount);
+    expect(JSON.parse(fs.readFileSync(journalPath, "utf8"))).toMatchObject({ state: "uncertain" });
+  });
+
+  it("quarantines a crash-residue installing journal before dispatching a mutation", async () => {
+    const harness = installLifecycleHarness({ tmpDir, restorers });
+    const globalDir = path.join(tmpDir, "global-state");
+    fs.mkdirSync(globalDir, { recursive: true, mode: 0o700 });
+    const journalPath = path.join(globalDir, "redirect.json");
+    fs.writeFileSync(journalPath, `${JSON.stringify({
+      version: 1,
+      state: "installing",
+      ownerKind: "uid",
+      ownerValue: String(process.geteuid?.() ?? process.getuid()),
+      publicPort: 443,
+      internalPort: 8443,
+      nonce: "e".repeat(48),
+    })}\n`, { mode: 0o600 });
+
+    const { startServer } = require("../../src/mitm/manager.js");
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toMatchObject({
+      code: "MITM_PRIVILEGED_OPERATION_UNCERTAIN",
+    });
+    expect(harness.commands).toEqual([]);
+    expect(JSON.parse(fs.readFileSync(journalPath, "utf8"))).toMatchObject({ state: "uncertain" });
+  });
+
+  it("quarantines a crash-residue installing journal on direct stop", async () => {
+    const harness = installLifecycleHarness({ tmpDir, restorers });
+    const globalDir = path.join(tmpDir, "global-state");
+    fs.mkdirSync(globalDir, { recursive: true, mode: 0o700 });
+    const journalPath = path.join(globalDir, "redirect.json");
+    fs.writeFileSync(journalPath, `${JSON.stringify({
+      version: 1,
+      state: "installing",
+      ownerKind: "uid",
+      ownerValue: String(process.geteuid?.() ?? process.getuid()),
+      publicPort: 443,
+      internalPort: 8443,
+      nonce: "f".repeat(48),
+    })}\n`, { mode: 0o600 });
+
+    const { stopServer } = require("../../src/mitm/manager.js");
+    await expect(stopServer("fixture-password")).rejects.toMatchObject({
+      code: "MITM_PRIVILEGED_OPERATION_UNCERTAIN",
+    });
+    expect(harness.commands).toEqual([]);
+    expect(JSON.parse(fs.readFileSync(journalPath, "utf8"))).toMatchObject({ state: "uncertain" });
+  });
+
+  it("reverses a confirmed redirect-install failure before deleting its journal", async () => {
+    const redirectInstallError = new Error("confirmed PF install failure");
+    const harness = installLifecycleHarness({ tmpDir, restorers, redirectInstallError });
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toBe(redirectInstallError);
+    expect(harness.commands.some((command) => command.includes("-F all") || command.includes("-D OUTPUT"))).toBe(true);
+    expect(fs.existsSync(path.join(tmpDir, "global-state", "redirect.json"))).toBe(false);
+  });
+
+  it("rolls back the launcher and owned PID record after health failure", async () => {
+    const harness = installLifecycleHarness({ tmpDir, restorers, healthPid: null });
+    const { startServer } = require("../../src/mitm/manager.js");
+    const start = startServer("fixture-key", "fixture-password");
+    const failure = expect(start).rejects.toThrow("MITM server failed to start");
+
+    await vi.advanceTimersByTimeAsync(250);
+    await failure;
+
+    expect(harness.child.kill).toHaveBeenCalled();
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("rejects a health response that cannot prove knowledge of the instance nonce", async () => {
+    const healthPid = 535354;
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid,
+      healthServerNonce: "d".repeat(48),
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+    const start = expect(startServer("fixture-key", "fixture-password")).rejects.toThrow(
+      "MITM server failed to start",
+    );
+
+    await vi.runAllTimersAsync();
+    await start;
+    expect(harness.child.kill).toHaveBeenCalled();
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("bounds a health peer that never ends its response", async () => {
+    const harness = installLifecycleHarness({ tmpDir, restorers, hangingHealth: true });
+    const { startServer } = require("../../src/mitm/manager.js");
+    const start = expect(startServer("fixture-key", "fixture-password")).rejects.toThrow(
+      "MITM server failed to start",
+    );
+
+    await vi.runAllTimersAsync();
+    await start;
+    expect(https.request).toHaveBeenCalled();
+    expect(harness.child.kill).toHaveBeenCalled();
+  });
+
+  it("rolls back when the authenticated public-port redirect is ineffective", async () => {
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid: 535355,
+      publicHealthFailure: true,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+    const start = expect(startServer("fixture-key", "fixture-password")).rejects.toThrow(
+      "MITM server failed to start",
+    );
+
+    await vi.runAllTimersAsync();
+    await start;
+    expect(harness.child.kill).toHaveBeenCalled();
+    expect(harness.commands.some((command) => command.includes("-F all") || command.includes("-D OUTPUT"))).toBe(true);
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("keeps the operation gate held until privileged redirect rollback completes", async () => {
+    const killBarrier = deferred();
+    const harness = installLifecycleHarness({ tmpDir, restorers, healthPid: null, killBarrier });
+    const { startServer } = require("../../src/mitm/manager.js");
+    const first = startServer("fixture-key", "fixture-password");
+    const firstFailure = expect(first).rejects.toThrow("MITM server failed to start");
+    await vi.advanceTimersByTimeAsync(50);
+
+    await expect(startServer("other-key", "other-password")).rejects.toMatchObject({
+      code: "MITM_START_IN_PROGRESS",
+    });
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(true);
+
+    killBarrier.resolve();
+    await vi.runAllTimersAsync();
+    await firstFailure;
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("retains PID ownership metadata when redirect rollback fails", async () => {
+    const redirectError = new Error("injected PF anchor removal failure");
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid: null,
+      redirectRemovalError: redirectError,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+    const start = startServer("fixture-key", "fixture-password");
+    const failure = expect(start).rejects.toMatchObject({ cleanupError: redirectError });
+
+    await vi.runAllTimersAsync();
+    await failure;
+    expect(harness.child.kill).toHaveBeenCalled();
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(true);
+  });
+
+  it("keeps the previous trust entry when Root CA replacement generation fails", async () => {
+    const generationError = new Error("injected Root CA generation failure");
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      existingRootCA: true,
+      rootCAValid: false,
+      rootCAGenerationError: generationError,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toBe(generationError);
+
+    expect(harness.uninstallCert).not.toHaveBeenCalled();
+    expect(fs.readFileSync(path.join(harness.mitmDir, "rootCA.key"), "utf8")).toBe("existing-key");
+    expect(fs.readFileSync(path.join(harness.mitmDir, "rootCA.crt"), "utf8")).toBe("existing-cert");
+    expect(fs.readdirSync(harness.mitmDir).some((name) => name.startsWith(".rootCA.previous."))).toBe(false);
+  });
+
+  it("uninstalls a cert-only stale trust entry after successful replacement", async () => {
+    const healthPid = 545454;
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid,
+      existingRootCA: "cert-only",
+      rootCAValid: false,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+    const start = expect(startServer("fixture-key", "fixture-password")).resolves.toMatchObject({
+      running: true,
+      pid: healthPid,
+    });
+    await vi.runAllTimersAsync();
+    await start;
+
+    expect(harness.uninstallCert).toHaveBeenCalledTimes(1);
+    expect(harness.uninstallCert.mock.calls[0][1]).toContain(".rootCA.previous.");
+    expect(fs.readFileSync(path.join(harness.mitmDir, "rootCA.crt"), "utf8")).toBe("generated-cert");
+  });
+
+  it("retains the previous trust journal when replacement trust installation fails", async () => {
+    const installError = new Error("injected replacement trust failure");
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      existingRootCA: true,
+      rootCAValid: false,
+      certInstalled: false,
+      installError,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toThrow(
+      `Failed to trust certificate: ${installError.message}`,
+    );
+
+    expect(harness.installCert).toHaveBeenCalledTimes(1);
+    expect(harness.uninstallCert).not.toHaveBeenCalled();
+    const journals = fs.readdirSync(harness.mitmDir)
+      .filter((name) => name.startsWith(".rootCA.previous."));
+    expect(journals).toHaveLength(1);
+    expect(fs.readFileSync(path.join(harness.mitmDir, journals[0]), "utf8")).toBe("existing-cert");
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+  });
+
+  it("regenerates a corrupt Root CA without journaling it as a trust entry", async () => {
+    const healthPid = 565656;
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid,
+      existingRootCA: true,
+      rootCAValid: false,
+    });
+    fs.writeFileSync(path.join(harness.mitmDir, "rootCA.crt"), "corrupt-cert");
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    const start = expect(startServer("fixture-key", "fixture-password")).resolves.toMatchObject({
+      running: true,
+      pid: healthPid,
+    });
+    await vi.runAllTimersAsync();
+    await start;
+
+    expect(harness.uninstallCert).not.toHaveBeenCalled();
+    expect(fs.readFileSync(path.join(harness.mitmDir, "rootCA.crt"), "utf8")).toBe("generated-cert");
+    expect(fs.readdirSync(harness.mitmDir).some((name) => name.startsWith(".rootCA.previous."))).toBe(false);
+  });
+
+  it("retains a trust-rotation journal when old-certificate removal fails", async () => {
+    const uninstallError = new Error("injected trust-store removal failure");
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      existingRootCA: true,
+      rootCAValid: false,
+      uninstallError,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toBe(uninstallError);
+    const journals = fs.readdirSync(harness.mitmDir)
+      .filter((name) => name.startsWith(".rootCA.previous."));
+    expect(journals).toHaveLength(1);
+    expect(fs.readFileSync(path.join(harness.mitmDir, journals[0]), "utf8")).toBe("existing-cert");
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+  });
+
+  it("acquires the cross-process gate before reusing a healthy PID record", async () => {
+    const healthPid = 556677;
+    const nonce = "a".repeat(48);
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid,
+      launcherPid: healthPid,
+      lockContention: true,
+      initialNonce: nonce,
+    });
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    const pidPath = path.join(harness.mitmDir, ".mitm.pid");
+    fs.writeFileSync(pidPath, `${JSON.stringify({
+      version: 1,
+      pid: healthPid,
+      launcherPid: healthPid,
+      nonce,
+      state: "running",
+      launcherStart: harness.launcherStart,
+      processStart: harness.processStartFor(healthPid),
+    })}\n`);
+
+    const { startServer } = require("../../src/mitm/manager.js");
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toMatchObject({
+      code: "MITM_START_IN_PROGRESS",
+    });
+
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+    expect(fs.existsSync(pidPath)).toBe(true);
+  });
+
+  it("removes malformed regular PID metadata under the gate before publishing", async () => {
+    const healthPid = 565656;
+    const harness = installLifecycleHarness({ tmpDir, restorers, healthPid });
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    const pidPath = path.join(harness.mitmDir, ".mitm.pid");
+    fs.writeFileSync(pidPath, "malformed-pid-record\n");
+
+    const { startServer } = require("../../src/mitm/manager.js");
+    const start = expect(startServer("fixture-key", "fixture-password")).resolves.toEqual({
+      running: true,
+      pid: healthPid,
+    });
+    await vi.runAllTimersAsync();
+    await start;
+
+    expect(JSON.parse(fs.readFileSync(pidPath, "utf8"))).toMatchObject({
+      version: 1,
+      pid: healthPid,
+      nonce: harness.instanceNonce,
+      state: "running",
+    });
+  });
+
+  it("keeps starting PID metadata when a concurrent status read is not yet healthy", async () => {
+    const launcherPid = 585858;
+    const nonce = "b".repeat(48);
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      launcherPid,
+      initialNonce: nonce,
+    });
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    const pidPath = path.join(harness.mitmDir, ".mitm.pid");
+    const startingRecord = {
+      version: 1,
+      pid: launcherPid,
+      launcherPid,
+      nonce,
+      state: "starting",
+      launcherStart: harness.launcherStart,
+    };
+    fs.writeFileSync(pidPath, `${JSON.stringify(startingRecord)}\n`);
+
+    const { getMitmStatus } = require("../../src/mitm/manager.js");
+    await expect(getMitmStatus()).resolves.toMatchObject({ running: false, pid: null });
+    expect(JSON.parse(fs.readFileSync(pidPath, "utf8"))).toEqual(startingRecord);
+  });
+
+  it("promotes a nonce-authenticated unprivileged child after its launcher manager crashes", async () => {
+    const launcherPid = 595959;
+    const healthPid = 606060;
+    const nonce = "c".repeat(48);
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      launcherPid,
+      healthPid,
+      initialNonce: nonce,
+    });
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    const pidPath = path.join(harness.mitmDir, ".mitm.pid");
+    fs.writeFileSync(pidPath, `${JSON.stringify({
+      version: 1,
+      pid: launcherPid,
+      launcherPid,
+      nonce,
+      state: "starting",
+      launcherStart: harness.launcherStart,
+    })}\n`);
+
+    const { startServer } = require("../../src/mitm/manager.js");
+    await expect(startServer("fixture-key", "fixture-password")).resolves.toEqual({
+      running: true,
+      pid: healthPid,
+    });
+
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+    expect(JSON.parse(fs.readFileSync(pidPath, "utf8"))).toEqual({
+      version: 1,
+      pid: healthPid,
+      launcherPid,
+      nonce,
+      state: "running",
+      launcherStart: harness.launcherStart,
+      processStart: harness.processStartFor(healthPid),
+    });
+  });
+
+  it("reports a v1 process stopped when its authenticated public redirect is unavailable", async () => {
+    const healthPid = 606061;
+    const nonce = "f".repeat(48);
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      launcherPid: healthPid,
+      healthPid,
+      initialNonce: nonce,
+      publicHealthFailure: true,
+    });
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    fs.writeFileSync(path.join(harness.mitmDir, ".mitm.pid"), `${JSON.stringify({
+      version: 1,
+      pid: healthPid,
+      launcherPid: healthPid,
+      nonce,
+      state: "running",
+      launcherStart: harness.launcherStart,
+    })}\n`);
+
+    const { getMitmStatus } = require("../../src/mitm/manager.js");
+    await expect(getMitmStatus()).resolves.toMatchObject({ running: false, pid: null });
+    expect(https.request.mock.calls.map(([options]) => options.port)).toEqual([8443, 443]);
+  });
+
+  it("rejects reuse when public redirect verification fails and preserves the live PID record", async () => {
+    const healthPid = 606062;
+    const nonce = "1".repeat(48);
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      launcherPid: healthPid,
+      healthPid,
+      initialNonce: nonce,
+      publicHealthFailure: true,
+    });
+    const pidPath = path.join(harness.mitmDir, ".mitm.pid");
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    fs.writeFileSync(pidPath, `${JSON.stringify({
+      version: 1,
+      pid: healthPid,
+      launcherPid: healthPid,
+      nonce,
+      state: "running",
+      launcherStart: harness.launcherStart,
+    })}\n`);
+    const updateSettings = vi.fn();
+    const manager = require("../../src/mitm/manager.js");
+    manager.initDbHooks(async () => ({}), updateSettings);
+
+    await expect(manager.startServer("fixture-key", "fixture-password")).rejects.toMatchObject({
+      code: "MITM_REDIRECT_UNHEALTHY",
+    });
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+    expect(fs.existsSync(pidPath)).toBe(true);
+    expect(harness.commands.some((command) => command.includes("-F all") || command.includes("-D OUTPUT"))).toBe(true);
+    expect(updateSettings).not.toHaveBeenCalled();
+  });
+
+  it("preserves a live PID record whose process ownership cannot be authenticated", async () => {
+    const pid = 606063;
+    const nonce = "2".repeat(48);
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      launcherPid: pid,
+      healthPid: pid,
+      initialNonce: nonce,
+      healthServerNonce: "3".repeat(48),
+    });
+    const pidPath = path.join(harness.mitmDir, ".mitm.pid");
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    fs.writeFileSync(pidPath, `${JSON.stringify({
+      version: 1,
+      pid,
+      launcherPid: pid,
+      nonce,
+      state: "running",
+      launcherStart: harness.launcherStart,
+    })}\n`);
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toMatchObject({
+      code: "MITM_OWNERSHIP_UNVERIFIED",
+    });
+    expect(fs.existsSync(pidPath)).toBe(true);
+    expect(harness.commands).toEqual([]);
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+  });
+
+  it("removes a dead v1 redirect and PID before later certificate work fails", async () => {
+    const pid = 606064;
+    const nonce = "4".repeat(48);
+    const generationError = new Error("injected CA failure after stale cleanup");
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      launcherPid: pid,
+      launcherAlive: false,
+      initialNonce: nonce,
+      rootCAValid: false,
+      rootCAGenerationError: generationError,
+    });
+    const pidPath = path.join(harness.mitmDir, ".mitm.pid");
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    fs.writeFileSync(pidPath, `${JSON.stringify({
+      version: 1,
+      pid,
+      launcherPid: pid,
+      nonce,
+      state: "running",
+      launcherStart: harness.launcherStart,
+    })}\n`);
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toBe(generationError);
+    expect(harness.commands.some((command) => command.includes("-F all") || command.includes("-D OUTPUT"))).toBe(true);
+    expect(fs.existsSync(pidPath)).toBe(false);
+  });
+
+  it("handles an asynchronous spawn error before rejecting a missing PID", async () => {
+    const spawnError = Object.assign(new Error("sudo not found"), { code: "ENOENT" });
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      launcherPid: null,
+      spawnError,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toThrow(
+      "MITM server process failed to spawn",
+    );
+    await Promise.resolve();
+
+    expect(harness.child.kill).toHaveBeenCalled();
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("rejects a child that exits before its matching health response completes", async () => {
+    const healthPid = 575757;
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid,
+      exitBeforeHealth: true,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+    const start = expect(startServer("fixture-key", "fixture-password")).rejects.toThrow(
+      "Server exited during startup",
+    );
+
+    await vi.runAllTimersAsync();
+    await start;
+
+    expect(harness.child.kill).toHaveBeenCalled();
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("rolls back a healthy child when the OS startup lock cannot be released", async () => {
+    const lockReleaseError = new Error("injected socket-close failure");
+    const healthPid = 535353;
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid,
+      lockReleaseError,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+    const start = expect(startServer("fixture-key", "fixture-password")).rejects.toBe(lockReleaseError);
+
+    await vi.runAllTimersAsync();
+    await start;
+
+    expect(harness.killedPids).toContain(healthPid);
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("tracks sudo launcher and healthy child PIDs separately through stop", async () => {
+    const launcherPid = 515151;
+    const healthPid = 525252;
+    const harness = installLifecycleHarness({ tmpDir, restorers, launcherPid, healthPid });
+    const { startServer, stopServer } = require("../../src/mitm/manager.js");
+
+    const start = expect(startServer("fixture-key", "fixture-password")).resolves.toEqual({
+      running: true,
+      pid: healthPid,
+    });
+    await vi.runAllTimersAsync();
+    await start;
+    const record = JSON.parse(fs.readFileSync(path.join(harness.mitmDir, ".mitm.pid"), "utf8"));
+    expect(record).toMatchObject({
+      pid: healthPid,
+      launcherPid,
+      nonce: harness.instanceNonce,
+      state: "running",
+    });
+
+    const stop = stopServer("fixture-password");
+    await vi.advanceTimersByTimeAsync(1000);
+    await expect(stop).resolves.toEqual({ running: false, pid: null });
+
+    expect(harness.killedPids).toContain(healthPid);
+    expect(harness.killedPids).toContain(launcherPid);
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("keeps a verified server running when DNS cleanup fails before stop", async () => {
+    const dnsError = new Error("injected hosts cleanup failure");
+    const healthPid = 525253;
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid,
+      dnsRemovalError: dnsError,
+    });
+    const { startServer, stopServer } = require("../../src/mitm/manager.js");
+    const start = expect(startServer("fixture-key", "fixture-password")).resolves.toMatchObject({ pid: healthPid });
+    await vi.runAllTimersAsync();
+    await start;
+    const removalCount = harness.commands.filter((command) => command.includes("-F all")).length;
+
+    await expect(stopServer("fixture-password")).rejects.toBe(dnsError);
+    expect(harness.child.kill).not.toHaveBeenCalled();
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(true);
+    expect(harness.commands.filter((command) => command.includes("-F all"))).toHaveLength(removalCount);
+  });
+
+  it("treats an unexpected clean child exit as restartable without discarding ownership", async () => {
+    const healthPid = 525254;
+    const harness = installLifecycleHarness({ tmpDir, restorers, healthPid });
+    const updateSettings = vi.fn(async () => {});
+    const manager = require("../../src/mitm/manager.js");
+    manager.initDbHooks(async () => ({ mitmEnabled: true }), updateSettings);
+    const start = expect(manager.startServer("fixture-key", "fixture-password")).resolves.toMatchObject({ pid: healthPid });
+    await vi.runAllTimersAsync();
+    await start;
+
+    harness.child.emit("exit", 0);
+    await vi.runAllTimersAsync();
+    await Promise.resolve();
+
+    expect(harness.removeAllDNSEntries).not.toHaveBeenCalled();
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(true);
+    expect(updateSettings).not.toHaveBeenCalledWith(expect.objectContaining({ mitmEnabled: false }));
+  });
+
+  it("clears legacy stored sudo ciphertext and never returns it", async () => {
+    installLifecycleHarness({ tmpDir, restorers });
+    const updateSettings = vi.fn(async () => {});
+    const manager = require("../../src/mitm/manager.js");
+    manager.initDbHooks(
+      async () => ({ mitmSudoEncrypted: "legacy-ciphertext" }),
+      updateSettings,
+    );
+
+    await expect(manager.loadEncryptedPassword()).resolves.toBeNull();
+    expect(updateSettings).toHaveBeenCalledWith({ mitmSudoEncrypted: null });
+    expect(updateSettings.mock.calls.flatMap(([value]) => Object.values(value))).not.toContain(
+      "legacy-ciphertext",
+    );
+  });
+
+  it("fails closed when legacy sudo ciphertext cannot be purged", async () => {
+    installLifecycleHarness({ tmpDir, restorers });
+    const purgeError = new Error("settings write failed");
+    const manager = require("../../src/mitm/manager.js");
+    manager.initDbHooks(
+      async () => ({ mitmSudoEncrypted: "legacy-ciphertext" }),
+      vi.fn(async () => { throw purgeError; }),
+    );
+
+    await expect(manager.loadEncryptedPassword()).rejects.toBe(purgeError);
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+  });
+
+  it("runs the full proxy unprivileged with a sanitized child environment", async () => {
+    const previousNodeOptions = process.env.NODE_OPTIONS;
+    const previousNodePath = process.env.NODE_PATH;
+    process.env.NODE_OPTIONS = "--require=/tmp/hostile.js";
+    process.env.NODE_PATH = "/tmp/hostile-modules";
+    try {
+      const healthPid = 666666;
+      const harness = installLifecycleHarness({ tmpDir, restorers, healthPid });
+      const { startServer } = require("../../src/mitm/manager.js");
+      const start = expect(startServer("super-secret-router-key", "fixture-password")).resolves.toMatchObject({ pid: healthPid });
+      await vi.runAllTimersAsync();
+      await start;
+
+      const [command, args, options] = childProcess.spawn.mock.calls[0];
+      expect(command).toBe(process.execPath);
+      expect(args).toContain("--durindoor-mitm-entry");
+      expect(args.join(" ")).not.toContain("super-secret-router-key");
+      expect(args.join(" ")).not.toContain(harness.instanceNonce);
+      expect(options.env).toMatchObject({
+        ROUTER_API_KEY: "super-secret-router-key",
+        MITM_INSTANCE_NONCE: harness.instanceNonce,
+        MITM_CA_PREPARED: "1",
+        MITM_LISTEN_PORT: "8443",
+      });
+      expect(options.env).not.toHaveProperty("NODE_OPTIONS");
+      expect(options.env).not.toHaveProperty("NODE_PATH");
+      expect(harness.commands.some((entry) => entry.includes("8443"))).toBe(true);
+    } finally {
+      if (previousNodeOptions === undefined) delete process.env.NODE_OPTIONS;
+      else process.env.NODE_OPTIONS = previousNodeOptions;
+      if (previousNodePath === undefined) delete process.env.NODE_PATH;
+      else process.env.NODE_PATH = previousNodePath;
+    }
+  });
+
+  it("refuses to spawn the full proxy from an elevated parent", async () => {
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      healthPid: 676767,
+      parentIsAdmin: true,
+      existingRootCA: true,
+      rootCAValid: false,
+    });
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toThrow(
+      "Refusing to run the full MITM proxy with an elevated parent",
+    );
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+    expect(harness.ensureRootCASync).not.toHaveBeenCalled();
+    expect(harness.installCert).not.toHaveBeenCalled();
+    expect(harness.uninstallCert).not.toHaveBeenCalled();
+    expect(harness.commands).toEqual([]);
+    expect(harness.child.kill).not.toHaveBeenCalled();
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("stops a nonce-authenticated child from a fresh-manager starting record", async () => {
+    const launcherPid = 616161;
+    const healthPid = 626262;
+    const nonce = "e".repeat(48);
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      launcherPid,
+      healthPid,
+      initialNonce: nonce,
+    });
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    const pidPath = path.join(harness.mitmDir, ".mitm.pid");
+    fs.writeFileSync(pidPath, `${JSON.stringify({
+      version: 1,
+      pid: launcherPid,
+      launcherPid,
+      nonce,
+      state: "starting",
+      launcherStart: harness.launcherStart,
+    })}\n`);
+
+    const { stopServer } = require("../../src/mitm/manager.js");
+    const stop = stopServer("fixture-password");
+    await vi.runAllTimersAsync();
+    await expect(stop).resolves.toEqual({ running: false, pid: null });
+
+    expect(harness.killedPids).toContain(healthPid);
+    expect(harness.killedPids).toContain(launcherPid);
+    expect(fs.existsSync(pidPath)).toBe(false);
+  });
+
+  it("does not mutate global redirect state when stop has no ownership record", async () => {
+    const harness = installLifecycleHarness({ tmpDir, restorers });
+    const { stopServer } = require("../../src/mitm/manager.js");
+
+    await expect(stopServer("fixture-password")).resolves.toEqual({ running: false, pid: null });
+    expect(harness.commands).toEqual([]);
+    expect(harness.child.kill).not.toHaveBeenCalled();
+  });
+
+  it("kills a locally tracked launcher tree when health is unavailable", async () => {
+    const launcherPid = 636363;
+    const healthPid = 646464;
+    const harness = installLifecycleHarness({ tmpDir, restorers, launcherPid, healthPid });
+    const { startServer, stopServer } = require("../../src/mitm/manager.js");
+    const start = expect(startServer("fixture-key", "fixture-password")).resolves.toMatchObject({ pid: healthPid });
+    await vi.runAllTimersAsync();
+    await start;
+
+    https.request = vi.fn((options, callback) => {
+      const request = new EventEmitter();
+      request.setTimeout = vi.fn();
+      request.destroy = (error) => request.emit("error", error);
+      request.end = () => queueMicrotask(() => {
+        const response = new EventEmitter();
+        callback(response);
+        response.emit("data", JSON.stringify({ ok: false }));
+        response.emit("end");
+      });
+      return request;
+    });
+
+    await expect(stopServer("fixture-password")).resolves.toEqual({ running: false, pid: null });
+    expect(harness.killedPids).toContain(launcherPid);
+    expect(harness.removeLegacyDNSEntries).not.toHaveBeenCalled();
+    expect(fs.existsSync(path.join(harness.mitmDir, ".mitm.pid"))).toBe(false);
+  });
+
+  it("rejects and preserves a live legacy integer PID record", async () => {
+    const legacyPid = 656565;
+    const harness = installLifecycleHarness({
+      tmpDir,
+      restorers,
+      launcherPid: legacyPid,
+      healthPid: legacyPid,
+      launcherProbeDenied: true,
+    });
+    fs.mkdirSync(harness.mitmDir, { recursive: true });
+    const pidPath = path.join(harness.mitmDir, ".mitm.pid");
+    fs.writeFileSync(pidPath, `${legacyPid}\n`);
+    const { startServer } = require("../../src/mitm/manager.js");
+
+    await expect(startServer("fixture-key", "fixture-password")).rejects.toMatchObject({
+      code: "MITM_OWNERSHIP_UNVERIFIED",
+    });
+    expect(childProcess.spawn).not.toHaveBeenCalled();
+    expect(harness.killedPids).toEqual([]);
+    expect(harness.commands).toEqual([]);
+    expect(fs.existsSync(pidPath)).toBe(true);
+  });
+});
diff --git a/tests/unit/mitm-peer-owner.test.js b/tests/unit/mitm-peer-owner.test.js
new file mode 100644
index 000000000..21bb377aa
--- /dev/null
+++ b/tests/unit/mitm-peer-owner.test.js
@@ -0,0 +1,100 @@
+import { describe, expect, it, vi } from "vitest";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const {
+  createPeerOwnerVerifier,
+  parseLsofOwner,
+  parseProcTcpOwner,
+} = require("../../src/mitm/peerOwner.js");
+
+describe("MITM peer process ownership", () => {
+  it("matches only the owner UID and exact Linux loopback tuple", () => {
+    const fixture = [
+      "  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode",
+      "   0: 0100007F:C350 0100007F:20FB 01 00000000:00000000 00:00000000 00000000   501 0 12345",
+    ].join("\n");
+    expect(parseProcTcpOwner(fixture, {
+      clientPort: 50000,
+      targetPorts: [443, 8443],
+      ownerUid: 501,
+    })).toBe(true);
+    expect(parseProcTcpOwner(fixture, {
+      clientPort: 50000,
+      targetPorts: [443, 8443],
+      ownerUid: 502,
+    })).toBe(false);
+  });
+
+  it("matches the client-side macOS lsof record, not another user", () => {
+    const fixture = [
+      "p111",
+      "u502",
+      "n127.0.0.1:50000->127.0.0.1:443",
+      "p222",
+      "u501",
+      "n127.0.0.1:50000->127.0.0.1:443",
+    ].join("\n");
+    expect(parseLsofOwner(fixture, {
+      clientPort: 50000,
+      targetPorts: [443, 8443],
+      ownerUid: 501,
+    })).toBe(true);
+    expect(parseLsofOwner(fixture, {
+      clientPort: 50000,
+      targetPorts: [443, 8443],
+      ownerUid: 503,
+    })).toBe(false);
+  });
+
+  it("fails closed for a different Linux UID and caches an accepted socket", async () => {
+    const readFile = vi.fn(() => [
+      "header",
+      "0: 0100007F:C350 0100007F:01BB 01 0:0 0:0 0 501 0 1",
+    ].join("\n"));
+    const verify = createPeerOwnerVerifier({
+      platform: "linux",
+      processImpl: { geteuid: () => 501 },
+      readFile,
+      targetPorts: [443, 8443],
+    });
+    const socket = {
+      localAddress: "127.0.0.1",
+      remoteAddress: "127.0.0.1",
+      remotePort: 50000,
+    };
+    await expect(verify(socket)).resolves.toBe(true);
+    await expect(verify(socket)).resolves.toBe(true);
+    expect(readFile).toHaveBeenCalledOnce();
+  });
+
+  it("uses a bounded SID ownership query on Windows", async () => {
+    const execText = vi.fn(async (command, args) => {
+      expect(command).toBe("C:\\Windows\\System32\\powershell.exe");
+      expect(args).toContain("-EncodedCommand");
+      return "verified";
+    });
+    const verify = createPeerOwnerVerifier({
+      platform: "win32",
+      execText,
+      targetPorts: [443],
+    });
+    await expect(verify({
+      localAddress: "127.0.0.1",
+      remoteAddress: "::ffff:127.0.0.1",
+      remotePort: 50001,
+    })).resolves.toBe(true);
+    expect(execText).toHaveBeenCalledOnce();
+  });
+
+  it("rejects non-loopback peers before invoking platform discovery", async () => {
+    const execText = vi.fn();
+    const verify = createPeerOwnerVerifier({ platform: "darwin", execText });
+    await expect(verify({
+      localAddress: "127.0.0.1",
+      remoteAddress: "192.0.2.4",
+      remotePort: 50002,
+    })).resolves.toBe(false);
+    expect(execText).not.toHaveBeenCalled();
+  });
+});
diff --git a/tests/unit/mitm-platform-privilege.test.js b/tests/unit/mitm-platform-privilege.test.js
new file mode 100644
index 000000000..83d6c518e
--- /dev/null
+++ b/tests/unit/mitm-platform-privilege.test.js
@@ -0,0 +1,137 @@
+import { describe, expect, it } from "vitest";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const require = createRequire(import.meta.url);
+const { buildUnixHostsMutationCommand, buildWindowsHostsMutationScript } = require("../../src/mitm/dns/dnsConfig.js");
+const {
+  buildElevatedSupervisorScript,
+  isAdmin,
+  PRIVILEGED_UNCONFIRMED_EXIT_CODE,
+  wrapElevatedExecError,
+} = require("../../src/mitm/winElevated.js");
+const { buildPrivateDirectoryAclScript } = require("../../src/mitm/windowsAcl.js");
+const {
+  buildMinimalWindowsEnv,
+  resolveTrustedUnixBinary,
+  resolveWindowsSystemBinary,
+} = require("../../src/mitm/trustedBinaries.js");
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+
+describe("MITM platform privilege boundaries", () => {
+  it("builds an atomic, exact-token Windows hosts mutation inside UAC", () => {
+    const script = buildWindowsHostsMutationScript({
+      action: "add",
+      hosts: ["api.example.test", "quote'fixture.example"],
+      tag: "fixture",
+      hostsFile: "C:\\Windows\\System32\\drivers\\etc\\hosts",
+      expectedSha256: "a".repeat(64),
+    });
+    expect(script).toContain("Test-ExactHostLine");
+    expect(script).toContain("[System.IO.File]::Replace($temp, $path, $backup, $true)");
+    expect(script).toContain("publication verification failed; original restored");
+    expect(script).toContain("quote''fixture.example");
+    expect(script).not.toContain("WriteAllText($path");
+  });
+
+  it("supervises and terminates the whole elevated PowerShell command tree", () => {
+    const script = buildElevatedSupervisorScript(Buffer.from("fixture", "utf16le").toString("base64"), 30000);
+    expect(script).toContain("WaitForExit(30000)");
+    expect(script).toContain("'C:\\Windows\\System32\\taskkill.exe' /PID $child.Id /T /F");
+    expect(script).toContain("process tree could not be terminated");
+    expect(script).toContain(`exit ${PRIVILEGED_UNCONFIRMED_EXIT_CODE}`);
+  });
+
+  it("bounds Windows elevation detection and fails closed on timeout", () => {
+    const execFileSyncImpl = (command, args, options) => {
+      expect(command).toBe("C:\\Windows\\System32\\fltmc.exe");
+      expect(args).toEqual([]);
+      expect(options.timeout).toBe(5000);
+      expect(options.env.PATH).toBe("C:\\Windows\\System32;C:\\Windows\\System32\\Wbem");
+      throw Object.assign(new Error("timed out"), { code: "ETIMEDOUT" });
+    };
+
+    expect(isAdmin({ platform: "win32", execFileSyncImpl })).toBe(false);
+  });
+
+  it("marks an outer elevated-wrapper timeout as an unconfirmed mutation", () => {
+    const error = wrapElevatedExecError(
+      Object.assign(new Error("wrapper timeout"), { killed: true, signal: "SIGTERM" }),
+      "",
+    );
+    expect(error).toMatchObject({ code: "PRIVILEGED_TERMINATION_UNCONFIRMED" });
+  });
+
+  it("maps the direct-admin and UAC supervisor exit code to quarantine", () => {
+    for (const code of [PRIVILEGED_UNCONFIRMED_EXIT_CODE, String(PRIVILEGED_UNCONFIRMED_EXIT_CODE)]) {
+      const error = wrapElevatedExecError(Object.assign(new Error("exit"), { code }), "");
+      expect(error).toMatchObject({ code: "PRIVILEGED_TERMINATION_UNCONFIRMED" });
+    }
+    const source = fs.readFileSync(path.join(repoRoot, "src/mitm/winElevated.js"), "utf8");
+    expect(source).toContain("$proc.ExitCode -eq ${PRIVILEGED_UNCONFIRMED_EXIT_CODE}");
+    expect(source).toContain("exit ${PRIVILEGED_UNCONFIRMED_EXIT_CODE}");
+  });
+
+  it("uses trusted absolute entrypoints and drops hostile loader environment", () => {
+    expect(resolveWindowsSystemBinary("powershell.exe", {
+      env: { SystemRoot: "C:\\Users\\attacker\\fake-windows" },
+      verify: false,
+    })).toBe("C:\\Windows\\System32\\powershell.exe");
+    expect(resolveTrustedUnixBinary("sh")).toMatch(/^\/(?:usr\/)?bin\/(?:sh|dash|bash|ash)$/);
+    const env = buildMinimalWindowsEnv({
+      LD_PRELOAD: "/tmp/evil",
+      DYLD_INSERT_LIBRARIES: "/tmp/evil",
+      PSModulePath: "C:\\Users\\attacker\\Modules",
+    });
+    expect(env.LD_PRELOAD).toBeUndefined();
+    expect(env.DYLD_INSERT_LIBRARIES).toBeUndefined();
+    expect(env.PSModulePath).toBe("C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules");
+  });
+
+  it("builds compare-and-swap Unix hosts publication without tee truncation", () => {
+    const command = buildUnixHostsMutationCommand({
+      currentSha256: "a".repeat(64),
+      nextBytes: Buffer.from("127.0.0.1 fixture # durindoor-mitm:test\n"),
+      hostsFile: "/etc/hosts",
+      isMac: false,
+    });
+    expect(command).toContain("Hosts file changed during mutation");
+    expect(command).toContain("mv -f -- \"$temp\" \"$path\"");
+    expect(command).toContain("cp --preserve=all -- \"$path\" \"$temp\"");
+    expect(command).not.toMatch(/\btee\b/);
+  });
+
+  it("replaces Windows MITM directory inheritance with an owner-only ACL", () => {
+    const script = buildPrivateDirectoryAclScript("C:\\Users\\fixture\\.9router\\mitm");
+    expect(script).toContain("SetAccessRuleProtection($true, $false)");
+    expect(script).toContain("S-1-5-18");
+    expect(script).toContain("S-1-5-32-544");
+    expect(script).toContain("Unexpected MITM directory ACL principal");
+  });
+
+  it("keeps the Windows dashboard standard-user policy consistent with the API", () => {
+    const serverCard = fs.readFileSync(path.join(
+      repoRoot,
+      "src/app/(dashboard)/dashboard/cli-tools/components/MitmServerCard.js",
+    ), "utf8");
+    const toolCard = fs.readFileSync(path.join(
+      repoRoot,
+      "src/app/(dashboard)/dashboard/cli-tools/components/AntigravityToolCard.js",
+    ), "utf8");
+    expect(serverCard).toContain("Restart DurinDoor as a standard user");
+    expect(serverCard).toContain("proxy stays unprivileged");
+    expect(toolCard).toContain("standard-user mode");
+    expect(`${serverCard}\n${toolCard}`).not.toContain("as Administrator");
+  });
+
+  it("documents the fail-closed privileged-operation recovery contract", () => {
+    const troubleshooting = fs.readFileSync(path.join(repoRoot, "docs/troubleshooting.md"), "utf8");
+    expect(troubleshooting).toContain("MITM_PRIVILEGED_OPERATION_UNCERTAIN");
+    expect(troubleshooting).toContain("~/.durindoor-mitm-state/redirect.json");
+    expect(troubleshooting).toContain("%USERPROFILE%\\AppData\\Local\\DurinDoor\\mitm-state\\redirect.json");
+    expect(troubleshooting).toContain("Close every DurinDoor process and reboot");
+    expect(troubleshooting).toContain("Never raw-kill the recorded PID");
+  });
+});
diff --git a/tests/unit/mitm-port-redirect.test.js b/tests/unit/mitm-port-redirect.test.js
new file mode 100644
index 000000000..1e7987291
--- /dev/null
+++ b/tests/unit/mitm-port-redirect.test.js
@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+import { createRequire } from "node:module";
+import { spawnSync } from "node:child_process";
+
+const require = createRequire(import.meta.url);
+const {
+  buildLinuxRedirect,
+  buildMacRedirect,
+  buildWindowsRedirect,
+  requireWindowsSid,
+} = require("../../src/mitm/portRedirect.js");
+
+describe("MITM owner-scoped redirect rules", () => {
+  it("uses bounded, symmetric Linux UID rules", () => {
+    const redirect = buildLinuxRedirect({ uid: 501, publicPort: 443, internalPort: 8443 });
+    expect(redirect.install).toContain("iptables -w 5");
+    expect(redirect.install).toContain("--uid-owner 501");
+    expect(redirect.install).toContain("! --uid-owner 501");
+    expect(redirect.install).toContain("--dports 443,8443");
+    expect(redirect.remove).not.toContain("while ");
+    expect(redirect.remove).toContain("DurinDoor MITM NAT rule remains installed");
+  });
+
+  it("loads a non-pass macOS redirect plus a user filter without enabling PF", () => {
+    const redirect = buildMacRedirect({ uid: 501, publicPort: 443, internalPort: 8443 });
+    expect(redirect.anchor).toBe("com.apple/durindoor.mitm.501");
+    expect(redirect.install).toContain("rdr on lo0");
+    expect(redirect.install).not.toContain("rdr pass");
+    expect(redirect.install).toContain("user != 501");
+    expect(redirect.install).not.toContain("pfctl -E");
+    expect(redirect.remove).not.toContain("|| true");
+
+    if (process.platform === "darwin") {
+      const match = redirect.install.match(/printf '%s\\n' '([\s\S]+)' \| pfctl/);
+      expect(match).not.toBeNull();
+      const parsed = spawnSync("/sbin/pfctl", ["-vnf", "-"], {
+        input: `${match[1]}\n`,
+        encoding: "utf8",
+      });
+      expect(parsed.status, parsed.stderr).toBe(0);
+    }
+  });
+
+  it("uses a Windows LocalUser firewall rule and never portproxy", () => {
+    const redirect = buildWindowsRedirect({ sid: "S-1-5-21-123", publicPort: 443 });
+    expect(redirect.install).toContain("New-NetFirewallRule");
+    expect(redirect.install).toContain("-LocalUser");
+    expect(redirect.install).toContain("127.0.0.1");
+    expect(redirect.install).not.toContain("portproxy");
+    expect(redirect.remove).toContain("removal could not be verified");
+  });
+
+  it("strictly validates the Windows owner SID", () => {
+    expect(requireWindowsSid(() => "S-1-5-21-123\n")).toBe("S-1-5-21-123");
+    expect(() => requireWindowsSid(() => "'; Remove-NetFirewallRule *\n")).toThrow(
+      "safe Windows owner SID",
+    );
+  });
+});
diff --git a/tests/unit/mitm-process-identity.test.js b/tests/unit/mitm-process-identity.test.js
new file mode 100644
index 000000000..80fac968b
--- /dev/null
+++ b/tests/unit/mitm-process-identity.test.js
@@ -0,0 +1,16 @@
+import { describe, expect, it } from "vitest";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const { canonicalizeProcessStartIdentity } = require("../../src/mitm/processIdentity.js");
+
+describe("MITM process identity", () => {
+  it("hashes a long macOS start/executable tuple into the PID-record bound", () => {
+    const raw = `Fri Jul 10 10:00:00 2026 /Applications/${"very-long-worktree/".repeat(20)}node`;
+    const identity = canonicalizeProcessStartIdentity("darwin", raw);
+
+    expect(identity).toMatch(/^darwin:sha256:[a-f0-9]{64}$/);
+    expect(identity.length).toBeLessThanOrEqual(200);
+    expect(canonicalizeProcessStartIdentity("darwin", raw)).toBe(identity);
+  });
+});
diff --git a/tests/unit/mitm-rootca-autogen.test.js b/tests/unit/mitm-rootca-autogen.test.js
index c827bbc45..e231670f4 100644
--- a/tests/unit/mitm-rootca-autogen.test.js
+++ b/tests/unit/mitm-rootca-autogen.test.js
@@ -3,6 +3,7 @@ import { createRequire } from "node:module";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import forge from "node-forge";
 
 const require = createRequire(import.meta.url);
 const rootCAPath = require.resolve("../../src/mitm/cert/rootCA.js");
@@ -45,6 +46,12 @@ describe("MITM Root CA auto-generation (#2224)", () => {
     expect(fs.existsSync(ROOT_CA_KEY_PATH)).toBe(true);
     expect(fs.existsSync(ROOT_CA_CERT_PATH)).toBe(true);
     expect(isCertExpired(ROOT_CA_CERT_PATH)).toBe(false);
+    if (process.platform !== "win32") {
+      expect(fs.statSync(path.dirname(ROOT_CA_KEY_PATH)).mode & 0o777).toBe(0o700);
+      expect(fs.statSync(ROOT_CA_KEY_PATH).mode & 0o777).toBe(0o600);
+      expect(fs.statSync(ROOT_CA_CERT_PATH).mode & 0o777).toBe(0o644);
+    }
+    expect(fs.readdirSync(path.dirname(ROOT_CA_KEY_PATH)).filter((name) => /\.(tmp|bak)$/.test(name))).toEqual([]);
   });
 
   it("is idempotent when valid cert already exists (returns false)", () => {
@@ -84,6 +91,125 @@ describe("MITM Root CA auto-generation (#2224)", () => {
     expect(fs.existsSync(ROOT_CA_CERT_PATH)).toBe(true);
   });
 
+  it("generates when only rootCA.crt exists (partial state)", () => {
+    const { ensureRootCASync, ROOT_CA_KEY_PATH, ROOT_CA_CERT_PATH } =
+      loadRootCAWithDataDir(tmpDir);
+
+    fs.mkdirSync(path.dirname(ROOT_CA_CERT_PATH), { recursive: true });
+    fs.writeFileSync(ROOT_CA_CERT_PATH, "partial-cert");
+
+    expect(ensureRootCASync()).toBe(true);
+    expect(fs.readFileSync(ROOT_CA_KEY_PATH, "utf8")).toContain("BEGIN RSA PRIVATE KEY");
+    expect(fs.readFileSync(ROOT_CA_CERT_PATH, "utf8")).toContain("BEGIN CERTIFICATE");
+  });
+
+  it("regenerates a mismatched key and certificate pair", () => {
+    const first = loadRootCAWithDataDir(path.join(tmpDir, "first"));
+    first.ensureRootCASync();
+    const originalKey = fs.readFileSync(first.ROOT_CA_KEY_PATH, "utf8");
+
+    const second = loadRootCAWithDataDir(path.join(tmpDir, "second"));
+    second.ensureRootCASync();
+    fs.copyFileSync(second.ROOT_CA_CERT_PATH, first.ROOT_CA_CERT_PATH);
+
+    expect(first.hasValidRootCA()).toBe(false);
+    expect(first.ensureRootCASync()).toBe(true);
+    expect(first.hasValidRootCA()).toBe(true);
+    expect(fs.readFileSync(first.ROOT_CA_KEY_PATH, "utf8")).not.toBe(originalKey);
+  });
+
+  it("restores the previous pair when publishing replacement files fails", () => {
+    const rootCA = loadRootCAWithDataDir(tmpDir);
+    rootCA.ensureRootCASync();
+
+    const privateKeyPem = fs.readFileSync(rootCA.ROOT_CA_KEY_PATH, "utf8");
+    const privateKey = forge.pki.privateKeyFromPem(privateKeyPem);
+    const expiredCert = forge.pki.certificateFromPem(fs.readFileSync(rootCA.ROOT_CA_CERT_PATH, "utf8"));
+    expiredCert.validity.notAfter = new Date(Date.now() - 60_000);
+    expiredCert.sign(privateKey, forge.md.sha256.create());
+    const expiredCertPem = forge.pki.certificateToPem(expiredCert);
+    fs.writeFileSync(rootCA.ROOT_CA_CERT_PATH, expiredCertPem);
+
+    const renameSync = fs.renameSync.bind(fs);
+    vi.spyOn(fs, "renameSync").mockImplementation((from, to) => {
+      if (String(from).endsWith(".tmp") && to === rootCA.ROOT_CA_CERT_PATH) {
+        throw Object.assign(new Error("injected publish failure"), { code: "EIO" });
+      }
+      return renameSync(from, to);
+    });
+
+    expect(() => rootCA.ensureRootCASync()).toThrow("injected publish failure");
+    expect(fs.readFileSync(rootCA.ROOT_CA_KEY_PATH, "utf8")).toBe(privateKeyPem);
+    expect(fs.readFileSync(rootCA.ROOT_CA_CERT_PATH, "utf8")).toBe(expiredCertPem);
+    expect(fs.readdirSync(path.dirname(rootCA.ROOT_CA_KEY_PATH)).filter((name) => /\.(tmp|bak)$/.test(name))).toEqual([]);
+  });
+
+  it("removes the private-key temp when certificate-temp creation fails", () => {
+    const rootCA = loadRootCAWithDataDir(tmpDir);
+    const openSync = fs.openSync.bind(fs);
+    vi.spyOn(fs, "openSync").mockImplementation((filePath, ...args) => {
+      if (String(filePath).includes("rootCA.crt.") && String(filePath).endsWith(".tmp")) {
+        throw Object.assign(new Error("injected cert-temp failure"), { code: "EIO" });
+      }
+      return openSync(filePath, ...args);
+    });
+
+    expect(() => rootCA.ensureRootCASync()).toThrow("injected cert-temp failure");
+    const mitmDir = path.dirname(rootCA.ROOT_CA_KEY_PATH);
+    expect(fs.readdirSync(mitmDir).filter((name) => /rootCA\..*\.tmp$/.test(name))).toEqual([]);
+    expect(fs.existsSync(rootCA.ROOT_CA_KEY_PATH)).toBe(false);
+    expect(fs.existsSync(rootCA.ROOT_CA_CERT_PATH)).toBe(false);
+  });
+
+  it("surfaces a backup cleanup failure without discarding the published pair", () => {
+    const rootCA = loadRootCAWithDataDir(tmpDir);
+    rootCA.ensureRootCASync();
+    fs.writeFileSync(rootCA.ROOT_CA_CERT_PATH, "force-replacement");
+
+    const unlinkSync = fs.unlinkSync.bind(fs);
+    vi.spyOn(fs, "unlinkSync").mockImplementation((filePath) => {
+      if (String(filePath).includes("rootCA.key.") && String(filePath).endsWith(".bak")) {
+        throw Object.assign(new Error("injected backup cleanup failure"), { code: "EACCES" });
+      }
+      return unlinkSync(filePath);
+    });
+
+    expect(() => rootCA.ensureRootCASync()).toThrow(/backup file\(s\) could not be removed/);
+    expect(rootCA.hasValidRootCA()).toBe(true);
+    const keyBackup = fs.readdirSync(path.dirname(rootCA.ROOT_CA_KEY_PATH))
+      .find((name) => /^rootCA\.key\..*\.bak$/.test(name));
+    expect(keyBackup).toBeTruthy();
+    if (process.platform !== "win32") {
+      expect(fs.statSync(path.join(path.dirname(rootCA.ROOT_CA_KEY_PATH), keyBackup)).mode & 0o777).toBe(0o600);
+    }
+  });
+
+  it("recovers a matching pair left in backup files by an interrupted publish", () => {
+    const rootCA = loadRootCAWithDataDir(tmpDir);
+    rootCA.ensureRootCASync();
+    const originalKey = fs.readFileSync(rootCA.ROOT_CA_KEY_PATH, "utf8");
+    const originalCert = fs.readFileSync(rootCA.ROOT_CA_CERT_PATH, "utf8");
+    const generation = "interrupted.bak";
+    fs.renameSync(rootCA.ROOT_CA_KEY_PATH, `${rootCA.ROOT_CA_KEY_PATH}.${generation}`);
+    fs.renameSync(rootCA.ROOT_CA_CERT_PATH, `${rootCA.ROOT_CA_CERT_PATH}.${generation}`);
+
+    expect(rootCA.ensureRootCASync()).toBe(false);
+    expect(fs.readFileSync(rootCA.ROOT_CA_KEY_PATH, "utf8")).toBe(originalKey);
+    expect(fs.readFileSync(rootCA.ROOT_CA_CERT_PATH, "utf8")).toBe(originalCert);
+    expect(fs.readdirSync(path.dirname(rootCA.ROOT_CA_KEY_PATH)).filter((name) => /\.(tmp|bak)$/.test(name))).toEqual([]);
+  });
+
+  it.skipIf(process.platform === "win32")("rejects a symlinked private-key path", () => {
+    const { ensureRootCASync, ROOT_CA_KEY_PATH } = loadRootCAWithDataDir(tmpDir);
+    const target = path.join(tmpDir, "outside-key");
+    fs.mkdirSync(path.dirname(ROOT_CA_KEY_PATH), { recursive: true });
+    fs.writeFileSync(target, "do-not-overwrite");
+    fs.symlinkSync(target, ROOT_CA_KEY_PATH);
+
+    expect(() => ensureRootCASync()).toThrow(/Unsafe Root CA path/);
+    expect(fs.readFileSync(target, "utf8")).toBe("do-not-overwrite");
+  });
+
   it("creates the MITM directory when it does not exist", () => {
     const missingDataDir = path.join(tmpDir, "nested", "data");
     const { ensureRootCASync, ROOT_CA_KEY_PATH, ROOT_CA_CERT_PATH } =
diff --git a/tests/unit/mitm-route-startup.test.js b/tests/unit/mitm-route-startup.test.js
new file mode 100644
index 000000000..00913b3f0
--- /dev/null
+++ b/tests/unit/mitm-route-startup.test.js
@@ -0,0 +1,95 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  getMitmStatus: vi.fn(),
+  loadEncryptedPassword: vi.fn(),
+  startServer: vi.fn(),
+  trustCert: vi.fn(),
+}));
+
+vi.mock("next/server", () => ({
+  NextResponse: {
+    json: (data, init = {}) => ({
+      status: init.status || 200,
+      json: async () => data,
+    }),
+  },
+}));
+
+vi.mock("@/mitm/manager", () => ({
+  getMitmStatus: mocks.getMitmStatus,
+  startServer: mocks.startServer,
+  stopServer: vi.fn(),
+  enableToolDNS: vi.fn(),
+  disableToolDNS: vi.fn(),
+  trustCert: mocks.trustCert,
+  getCachedPassword: () => null,
+  setCachedPassword: vi.fn(),
+  loadEncryptedPassword: mocks.loadEncryptedPassword,
+  isSudoPasswordRequired: () => false,
+  hasMitmCleanupState: () => false,
+  isAdmin: () => false,
+  initDbHooks: vi.fn(),
+}));
+
+vi.mock("@/lib/localDb", () => ({
+  getSettings: vi.fn(() => ({})),
+  updateSettings: vi.fn(),
+}));
+
+import { PATCH, POST } from "../../src/app/api/cli-tools/antigravity-mitm/route.js";
+
+describe("MITM startup route contention", () => {
+  beforeEach(() => {
+    mocks.startServer.mockReset();
+    mocks.trustCert.mockReset();
+    mocks.getMitmStatus.mockReset();
+    mocks.loadEncryptedPassword.mockReset();
+    mocks.loadEncryptedPassword.mockResolvedValue(null);
+  });
+
+  it("returns a stable HTTP 409 for an in-progress startup", async () => {
+    mocks.startServer.mockRejectedValue(Object.assign(
+      new Error("MITM server is already starting (lock contention)"),
+      { code: "MITM_START_IN_PROGRESS" },
+    ));
+
+    const response = await POST({
+      json: async () => ({ apiKey: "fixture-api-key" }),
+    });
+
+    expect(response.status).toBe(409);
+    await expect(response.json()).resolves.toEqual({
+      error: "MITM server is already starting (lock contention)",
+      code: "MITM_START_IN_PROGRESS",
+    });
+  });
+
+  it("purges legacy credentials before accepting a provided sudo password", async () => {
+    const purgeError = new Error("legacy credential purge failed");
+    mocks.loadEncryptedPassword.mockRejectedValue(purgeError);
+
+    const response = await POST({
+      json: async () => ({
+        apiKey: "fixture-api-key",
+        sudoPassword: "provided-password",
+      }),
+    });
+
+    expect(response.status).toBe(500);
+    expect(mocks.startServer).not.toHaveBeenCalled();
+    await expect(response.json()).resolves.toEqual({ error: purgeError.message });
+  });
+
+  it("allows the certificate trust action without a DNS tool identifier", async () => {
+    mocks.getMitmStatus.mockResolvedValue({ certTrusted: true });
+
+    const response = await PATCH({
+      json: async () => ({ action: "trust-cert" }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(mocks.trustCert).toHaveBeenCalledWith("");
+    await expect(response.json()).resolves.toEqual({ success: true, certTrusted: true });
+  });
+});
diff --git a/tests/unit/mitm-router-header-forwarding.test.js b/tests/unit/mitm-router-header-forwarding.test.js
new file mode 100644
index 000000000..470d02d4d
--- /dev/null
+++ b/tests/unit/mitm-router-header-forwarding.test.js
@@ -0,0 +1,71 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+const {
+  fetchRouter,
+  selectForwardedClientHeaders,
+} = require("../../src/mitm/handlers/base.js");
+
+describe("MITM router header forwarding", () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it("uses a harmless metadata allowlist", () => {
+    expect(selectForwardedClientHeaders({
+      Accept: "text/event-stream",
+      "User-Agent": "client/1",
+      "Anthropic-Beta": "interleaved-thinking-2025-05-14",
+      "Anthropic-Version": "2023-06-01",
+      "OpenAI-Intent": "conversation-panel",
+      "X-App": "cli",
+      "X-Initiator": "user",
+      Cookie: "sid=secret",
+      Authorization: "Bearer upstream",
+      "Proxy-Authorization": "Basic secret",
+      "X-Api-Key": "provider-secret",
+      "X-Goog-Api-Key": "google-secret",
+      "X-Amz-Security-Token": "aws-secret",
+      "X-Custom-Token": "other-secret",
+    })).toEqual({
+      Accept: "text/event-stream",
+      "User-Agent": "client/1",
+      "Anthropic-Beta": "interleaved-thinking-2025-05-14",
+      "Anthropic-Version": "2023-06-01",
+      "OpenAI-Intent": "conversation-panel",
+      "X-App": "cli",
+      "X-Initiator": "user",
+    });
+  });
+
+  it("does not put intercepted credentials on the router fetch", async () => {
+    const fetchMock = vi.fn(async () => new Response("{}", { status: 200 }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await fetchRouter({ model: "test" }, "/v1/chat/completions", {
+      Accept: "text/event-stream",
+      "Anthropic-Beta": "interleaved-thinking-2025-05-14",
+      "Anthropic-Version": "2023-06-01",
+      "OpenAI-Intent": "conversation-panel",
+      "X-App": "cli",
+      "X-Initiator": "user",
+      Cookie: "sid=secret",
+      Authorization: "Bearer upstream",
+      "X-Api-Key": "provider-secret",
+      "X-Goog-Api-Key": "google-secret",
+      "X-Amz-Security-Token": "aws-secret",
+    });
+
+    const headers = fetchMock.mock.calls[0][1].headers;
+    expect(headers.Accept).toBe("text/event-stream");
+    expect(headers["Anthropic-Beta"]).toBe("interleaved-thinking-2025-05-14");
+    expect(headers["Anthropic-Version"]).toBe("2023-06-01");
+    expect(headers["OpenAI-Intent"]).toBe("conversation-panel");
+    expect(headers["X-App"]).toBe("cli");
+    expect(headers["X-Initiator"]).toBe("user");
+    expect(headers.Cookie).toBeUndefined();
+    expect(headers["X-Api-Key"]).toBeUndefined();
+    expect(headers["X-Goog-Api-Key"]).toBeUndefined();
+    expect(headers["X-Amz-Security-Token"]).toBeUndefined();
+    expect(headers.Authorization).toBeUndefined();
+  });
+});
diff --git a/tests/unit/mitm-runtime-lifecycle.test.js b/tests/unit/mitm-runtime-lifecycle.test.js
new file mode 100644
index 000000000..e99be197d
--- /dev/null
+++ b/tests/unit/mitm-runtime-lifecycle.test.js
@@ -0,0 +1,109 @@
+import { describe, expect, it } from "vitest";
+import childProcess from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+
+describe("MITM runtime lifecycle packaging", () => {
+  it("restarts ordinary clean exits but recognizes only the reserved handoff code", () => {
+    const { INTENTIONAL_HANDOFF_EXIT_CODE } = require("../../src/shared/constants/processExitCodes.js");
+    const { isIntentionalWorkerHandoff } = require("../../cli/src/cli/workerExit.js");
+
+    expect(isIntentionalWorkerHandoff(0, INTENTIONAL_HANDOFF_EXIT_CODE, false)).toBe(false);
+    expect(isIntentionalWorkerHandoff(1, INTENTIONAL_HANDOFF_EXIT_CODE, false)).toBe(false);
+    expect(isIntentionalWorkerHandoff(
+      INTENTIONAL_HANDOFF_EXIT_CODE,
+      INTENTIONAL_HANDOFF_EXIT_CODE,
+      true,
+    )).toBe(false);
+    expect(isIntentionalWorkerHandoff(
+      INTENTIONAL_HANDOFF_EXIT_CODE,
+      INTENTIONAL_HANDOFF_EXIT_CODE,
+      false,
+    )).toBe(true);
+  });
+  it("imports the production manager without resolving its child entrypoint eagerly", () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-manager-import-"));
+    try {
+      const managerPath = path.join(repoRoot, "src", "mitm", "manager.js");
+      const output = childProcess.execFileSync(process.execPath, [
+        "-e",
+        `require(${JSON.stringify(managerPath)}); process.stdout.write("loaded")`,
+      ], {
+        cwd: tmp,
+        encoding: "utf8",
+        env: {
+          ...process.env,
+          NODE_ENV: "production",
+          HOME: path.join(tmp, "home"),
+          DATA_DIR: path.join(tmp, "data"),
+          APPDATA: path.join(tmp, "appdata"),
+        },
+      });
+      expect(output).toBe("loaded");
+    } finally {
+      fs.rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it("copies the CLI worker handoff constant into the standalone runtime", () => {
+    const buildScript = fs.readFileSync(path.join(repoRoot, "scripts", "build-app.mjs"), "utf8");
+    expect(buildScript).toContain('"processExitCodes.js"');
+    expect(buildScript).toContain("sharedConstantsDir");
+  });
+
+  it("canonicalizes relative DATA_DIR before the standalone server loads", () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-data-dir-"));
+    try {
+      const wrapperPath = path.join(repoRoot, "custom-server.js");
+      const output = childProcess.execFileSync(process.execPath, [
+        "-e",
+        `const wrapper=require(${JSON.stringify(wrapperPath)}); process.stdout.write(wrapper.canonicalizeRuntimePaths())`,
+      ], {
+        cwd: tmp,
+        encoding: "utf8",
+        env: { ...process.env, DATA_DIR: "./relative-data" },
+      });
+      expect(output).toBe(fs.realpathSync(path.join(tmp, "relative-data")));
+    } finally {
+      fs.rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps the owner-aware wrapper dependency closure in CLI builds", () => {
+    const buildMitm = fs.readFileSync(path.join(repoRoot, "cli/scripts/buildMitm.js"), "utf8");
+    const buildCli = fs.readFileSync(path.join(repoRoot, "cli/scripts/build-cli.js"), "utf8");
+    const cli = fs.readFileSync(path.join(repoRoot, "cli/cli.js"), "utf8");
+
+    expect(buildMitm).toContain("cleanPlainFiles: false");
+    expect(buildCli).toContain("custom-server.js is required");
+    expect(cli).toContain("owner-aware custom-server.js is missing");
+    expect(cli).not.toContain(": path.join(standaloneDir, \"server.js\")");
+    expect(cli).toContain('stdio: "ignore"');
+    expect(JSON.parse(fs.readFileSync(path.join(repoRoot, "cli/package.json"), "utf8")).engines.node).toBe("20.20.2");
+    expect(buildMitm).toContain('target: "node20"');
+  });
+
+  it("wires development WebSocket upgrades before loading Next", () => {
+    const source = fs.readFileSync(path.join(repoRoot, "scripts/next-owner-server.cjs"), "utf8");
+    expect(source).toContain('process.env.NODE_ENV = "development"');
+    expect(source).toContain('server.on("upgrade", app.getUpgradeHandler())');
+    expect(source).toContain("webpack: true");
+    expect(source.indexOf('process.env.NODE_ENV = "development"')).toBeLessThan(source.indexOf('require("next")'));
+  });
+
+  it("lets the central MITM handler own process exit after DB signal flush", () => {
+    for (const file of ["betterSqliteAdapter.js", "nodeSqliteAdapter.js", "bunSqliteAdapter.js"]) {
+      const source = fs.readFileSync(path.join(repoRoot, "src/lib/db/adapters", file), "utf8");
+      expect(source).not.toMatch(/SIG(?:INT|TERM)[\s\S]{0,100}process\.exit/);
+      expect(source).toContain('process.once("SIGINT", onSignal)');
+      expect(source).toContain('process.once("SIGTERM", onSignal)');
+    }
+  });
+});
diff --git a/tests/unit/mitm-sanitize-headers.test.js b/tests/unit/mitm-sanitize-headers.test.js
index dc3d92dcd..e89951ac2 100644
--- a/tests/unit/mitm-sanitize-headers.test.js
+++ b/tests/unit/mitm-sanitize-headers.test.js
@@ -28,6 +28,9 @@ describe("MITM sanitizeHeaders", () => {
       "x-goog-api-key": "google-key",
       "x-subscription-token": "sub-token",
       "xi-api-key": "xi-key",
+      "x-amz-security-token": "aws-session",
+      "x-client-secret": "oauth-client-secret",
+      "custom-auth-token": "custom-token",
       "content-type": "application/json",
     });
     expect(out.authorization).toBe("[REDACTED]");
@@ -37,6 +40,9 @@ describe("MITM sanitizeHeaders", () => {
     expect(out["x-goog-api-key"]).toBe("[REDACTED]");
     expect(out["x-subscription-token"]).toBe("[REDACTED]");
     expect(out["xi-api-key"]).toBe("[REDACTED]");
+    expect(out["x-amz-security-token"]).toBe("[REDACTED]");
+    expect(out["x-client-secret"]).toBe("[REDACTED]");
+    expect(out["custom-auth-token"]).toBe("[REDACTED]");
     expect(out["content-type"]).toBe("application/json");
   });
 });
diff --git a/tests/unit/mitm-server-bootstrap.test.js b/tests/unit/mitm-server-bootstrap.test.js
new file mode 100644
index 000000000..f719a2e36
--- /dev/null
+++ b/tests/unit/mitm-server-bootstrap.test.js
@@ -0,0 +1,304 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import https from "node:https";
+import crypto from "node:crypto";
+import os from "node:os";
+import path from "node:path";
+
+const require = createRequire(import.meta.url);
+const modulePaths = [
+  "../../src/mitm/server.js",
+  "../../src/mitm/serverBootstrap.js",
+  "../../src/mitm/cert/generate.js",
+  "../../src/mitm/cert/rootCA.js",
+  "../../src/mitm/logger.js",
+  "../../src/mitm/dbReader.js",
+  "../../src/mitm/paths.js",
+].map((modulePath) => require.resolve(modulePath));
+
+function clearMitmModules() {
+  for (const modulePath of modulePaths) delete require.cache[modulePath];
+}
+
+function loadServer(dataDir) {
+  const previousDataDir = process.env.DATA_DIR;
+  process.env.DATA_DIR = dataDir;
+  clearMitmModules();
+  try {
+    return require("../../src/mitm/server.js");
+  } finally {
+    if (previousDataDir === undefined) delete process.env.DATA_DIR;
+    else process.env.DATA_DIR = previousDataDir;
+  }
+}
+
+function loadBootstrap(dataDir) {
+  const previousDataDir = process.env.DATA_DIR;
+  process.env.DATA_DIR = dataDir;
+  clearMitmModules();
+  try {
+    return require("../../src/mitm/serverBootstrap.js");
+  } finally {
+    if (previousDataDir === undefined) delete process.env.DATA_DIR;
+    else process.env.DATA_DIR = previousDataDir;
+  }
+}
+
+function createFakeServer() {
+  return {
+    close: vi.fn((callback) => callback?.()),
+    listen: vi.fn((...args) => {
+      const callback = args.at(-1);
+      if (typeof callback === "function") callback();
+    }),
+    on: vi.fn(),
+  };
+}
+
+function createResponseRecorder() {
+  return {
+    status: null,
+    headers: null,
+    body: "",
+    writeHead(status, headers) { this.status = status; this.headers = headers; },
+    end(body = "") { this.body += body; },
+  };
+}
+
+const trustedPeer = { verifyPeerOwner: async () => true };
+
+describe("MITM executable bootstrap", () => {
+  let tmpDir;
+
+  beforeEach(() => {
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-mitm-bootstrap-"));
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+    clearMitmModules();
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  });
+
+  it("keeps server imports free of certificate, listener, and signal side effects", () => {
+    const createServer = vi.spyOn(https, "createServer");
+    const sigintBefore = process.listenerCount("SIGINT");
+    const sigtermBefore = process.listenerCount("SIGTERM");
+
+    const serverModule = loadServer(path.join(tmpDir, "data"));
+
+    expect(serverModule.startMitmServer).toBeTypeOf("function");
+    expect(createServer).not.toHaveBeenCalled();
+    expect(process.listenerCount("SIGINT")).toBe(sigintBefore);
+    expect(process.listenerCount("SIGTERM")).toBe(sigtermBefore);
+    expect(fs.existsSync(path.join(tmpDir, "data", "mitm", "rootCA.key"))).toBe(false);
+    expect(fs.existsSync(path.join(tmpDir, "data", "mitm", "rootCA.crt"))).toBe(false);
+  });
+
+  it("uses the canonical Root CA helper once before reading TLS material", async () => {
+    const { loadRootCATls } = loadBootstrap(path.join(tmpDir, "data"));
+    const order = [];
+    const ensureRootCA = vi.fn(() => { order.push("ensure"); return true; });
+    const readFile = vi.fn((filePath) => {
+      order.push(path.basename(filePath));
+      return Buffer.from(filePath.endsWith(".key") ? "key" : "cert");
+    });
+
+    await expect(loadRootCATls({
+      ensureRootCA,
+      readFile,
+      keyPath: "/fixture/rootCA.key",
+      certPath: "/fixture/rootCA.crt",
+      withLock: async (operation) => operation(),
+    })).resolves.toEqual({
+      generated: true,
+      key: Buffer.from("key"),
+      cert: Buffer.from("cert"),
+      rootCAPem: "cert",
+    });
+    expect(order).toEqual(["ensure", "rootCA.key", "rootCA.crt"]);
+  });
+
+  it("reads a manager-prepared CA without mutating it again", async () => {
+    const { loadRootCATls } = loadBootstrap(path.join(tmpDir, "data"));
+    const ensureRootCA = vi.fn();
+    const readFile = vi.fn((filePath) => Buffer.from(filePath.endsWith(".key") ? "key" : "cert"));
+
+    await expect(loadRootCATls({
+      ensureRootCA,
+      readFile,
+      keyPath: "/fixture/rootCA.key",
+      certPath: "/fixture/rootCA.crt",
+      withLock: async (operation) => operation(),
+      caPrepared: true,
+    })).resolves.toMatchObject({ generated: false, rootCAPem: "cert" });
+    expect(ensureRootCA).not.toHaveBeenCalled();
+  });
+
+  it("rejects a symlinked prepared TLS path without changing its target", () => {
+    const { readRegularFileNoFollow } = loadBootstrap(path.join(tmpDir, "data"));
+    const outside = path.join(tmpDir, "outside-sentinel");
+    const link = path.join(tmpDir, "rootCA.key");
+    fs.writeFileSync(outside, "sentinel", { mode: 0o600 });
+    fs.symlinkSync(outside, link);
+    const beforeMode = fs.statSync(outside).mode & 0o777;
+
+    expect(() => readRegularFileNoFollow(link)).toThrow("Unsafe MITM TLS path");
+    expect(fs.readFileSync(outside, "utf8")).toBe("sentinel");
+    expect(fs.statSync(outside).mode & 0o777).toBe(beforeMode);
+  });
+
+  it("preserves the primary CA operation error when lock release also fails", async () => {
+    const { withRootCALock } = loadBootstrap(path.join(tmpDir, "data"));
+    const operationError = new Error("operation failed");
+    const cleanupError = new Error("release failed");
+
+    await expect(withRootCALock(
+      async () => { throw operationError; },
+      { acquire: async () => ({ owner: true }), release: async () => { throw cleanupError; } },
+    )).rejects.toBe(operationError);
+    expect(operationError.cleanupError).toBe(cleanupError);
+  });
+
+  it("does not read, create, listen, or exit when Root CA generation fails", async () => {
+    const serverModule = loadServer(path.join(tmpDir, "data"));
+    const fakeServer = createFakeServer();
+    const httpsModule = { createServer: vi.fn(() => fakeServer) };
+    const processImpl = { exit: vi.fn(), on: vi.fn(), platform: process.platform };
+    const failure = new Error("fixture CA failure");
+
+    await expect(serverModule.startMitmServer({
+      httpsModule,
+      loadTls: () => { throw failure; },
+      clearDumpDirFn: vi.fn(),
+      processImpl,
+      waitForAuthorization: async () => true,
+    })).rejects.toThrow(failure);
+    expect(httpsModule.createServer).not.toHaveBeenCalled();
+    expect(fakeServer.listen).not.toHaveBeenCalled();
+    expect(processImpl.exit).not.toHaveBeenCalled();
+  });
+
+  it("generates a real first-run CA before one injected HTTPS listen", async () => {
+    const dataDir = path.join(tmpDir, "data");
+    const serverModule = loadServer(dataDir);
+    const { loadRootCATls } = loadBootstrap(dataDir);
+    const fakeServer = createFakeServer();
+    const httpsModule = { createServer: vi.fn(() => fakeServer) };
+    const processImpl = { exit: vi.fn(), on: vi.fn(), platform: process.platform };
+
+    const result = await serverModule.startMitmServer({
+      httpsModule,
+      loadTls: () => loadRootCATls({ withLock: async (operation) => operation() }),
+      clearDumpDirFn: vi.fn(),
+      processImpl,
+      removeDnsEntries: vi.fn(),
+      waitForAuthorization: async () => true,
+    });
+
+    expect(fs.readFileSync(path.join(dataDir, "mitm", "rootCA.key"), "utf8")).toContain("BEGIN RSA PRIVATE KEY");
+    expect(fs.readFileSync(path.join(dataDir, "mitm", "rootCA.crt"), "utf8")).toContain("BEGIN CERTIFICATE");
+    expect(httpsModule.createServer).toHaveBeenCalledTimes(1);
+    expect(fakeServer.listen).toHaveBeenCalledWith(8443, "127.0.0.1", expect.any(Function));
+    expect(processImpl.on).toHaveBeenCalledTimes(process.platform === "win32" ? 3 : 2);
+    expect(result.server).toBe(fakeServer);
+  });
+
+  it("registers an idempotent shutdown callback", () => {
+    const serverModule = loadServer(path.join(tmpDir, "data"));
+    const fakeServer = createFakeServer();
+    const removeDnsEntries = vi.fn();
+    const processImpl = { exit: vi.fn(), on: vi.fn(), platform: "linux" };
+    const shutdown = serverModule.registerShutdownHandlers(fakeServer, {
+      processImpl,
+      removeDnsEntries,
+    });
+
+    shutdown();
+    shutdown();
+
+    expect(removeDnsEntries).not.toHaveBeenCalled();
+    expect(fakeServer.close).toHaveBeenCalledTimes(1);
+    expect(processImpl.exit).toHaveBeenCalledTimes(1);
+  });
+
+  it("requires a health challenge and returns only an HMAC proof", async () => {
+    const serverModule = loadServer(path.join(tmpDir, "data"));
+    const nonce = "a".repeat(48);
+    const challenge = "b".repeat(64);
+    const previousNonce = process.env.MITM_INSTANCE_NONCE;
+    process.env.MITM_INSTANCE_NONCE = nonce;
+    try {
+      for (const supplied of [undefined, "wrong", "é".repeat(48)]) {
+        const response = createResponseRecorder();
+        await serverModule.handleRequest({
+          url: "/_mitm_health",
+          headers: supplied ? { "x-durindoor-mitm-challenge": supplied } : {},
+        }, response, trustedPeer);
+        expect(response.status).toBe(404);
+      }
+
+      const response = createResponseRecorder();
+      await serverModule.handleRequest({
+        url: "/_mitm_health",
+        headers: { "x-durindoor-mitm-challenge": challenge },
+      }, response, trustedPeer);
+      expect(response.status).toBe(200);
+      const body = JSON.parse(response.body);
+      expect(body).toEqual({
+        ok: true,
+        pid: process.pid,
+        proof: crypto.createHmac("sha256", nonce).update(challenge).digest("hex"),
+      });
+      expect(response.body).not.toContain(nonce);
+    } finally {
+      if (previousNonce === undefined) delete process.env.MITM_INSTANCE_NONCE;
+      else process.env.MITM_INSTANCE_NONCE = previousNonce;
+    }
+  });
+
+  it("rejects unsupported Host and SNI names and keeps one CA snapshot for allowed SNI", async () => {
+    const dataDir = path.join(tmpDir, "data");
+    const serverModule = loadServer(dataDir);
+    const { loadRootCATls } = loadBootstrap(dataDir);
+    const tlsOptions = await loadRootCATls({ withLock: async (operation) => operation() });
+    const fakeServer = createFakeServer();
+    serverModule.createMitmServer({
+      httpsModule: { createServer: vi.fn(() => fakeServer) },
+      tlsOptions,
+    });
+
+    const hostResponse = createResponseRecorder();
+    await serverModule.handleRequest(
+      { url: "/v1/models", headers: { host: "attacker.example" } },
+      hostResponse,
+      trustedPeer,
+    );
+    expect(hostResponse.status).toBe(421);
+
+    const peerResponse = createResponseRecorder();
+    await serverModule.handleRequest(
+      { url: "/v1/models", headers: { host: "api2.cursor.sh" }, socket: {} },
+      peerResponse,
+      { verifyPeerOwner: async () => false },
+    );
+    expect(peerResponse.status).toBe(403);
+
+    await expect(new Promise((resolve, reject) => {
+      serverModule.sniCallback("attacker.example", (error, context) => {
+        if (error) reject(error);
+        else resolve(context);
+      });
+    })).rejects.toThrow("Unsupported MITM SNI hostname");
+
+    fs.unlinkSync(path.join(dataDir, "mitm", "rootCA.key"));
+    fs.unlinkSync(path.join(dataDir, "mitm", "rootCA.crt"));
+    await expect(new Promise((resolve, reject) => {
+      serverModule.sniCallback("api2.cursor.sh", (error, context) => {
+        if (error) reject(error);
+        else resolve(context);
+      });
+    })).resolves.toBeTruthy();
+  });
+});
diff --git a/tests/unit/mitm-settings-secret.test.js b/tests/unit/mitm-settings-secret.test.js
new file mode 100644
index 000000000..f58210bc5
--- /dev/null
+++ b/tests/unit/mitm-settings-secret.test.js
@@ -0,0 +1,57 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  getSettings: vi.fn(),
+  updateSettings: vi.fn(),
+}));
+
+vi.mock("next/server", () => ({
+  NextResponse: {
+    json: (body, init = {}) => ({ body, status: init.status || 200 }),
+  },
+}));
+vi.mock("@/lib/localDb", () => mocks);
+vi.mock("@/lib/network/outboundProxy", () => ({ applyOutboundProxyEnv: vi.fn() }));
+vi.mock("open-sse/services/combo.js", () => ({
+  resetComboRotation: vi.fn(),
+  resetComboScoring: vi.fn(),
+}));
+vi.mock("@/shared/services/quotaAutoPing", () => ({ runQuotaAutoPingTick: vi.fn() }));
+
+const settingsRoute = await import("../../src/app/api/settings/route.js");
+
+describe("settings API legacy MITM secret filtering", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("never returns legacy sudo ciphertext from GET", async () => {
+    mocks.getSettings.mockResolvedValue({
+      theme: "dark",
+      password: "password-hash",
+      oidcClientSecret: "oidc-secret",
+      mitmSudoEncrypted: "machine-decryptable-ciphertext",
+    });
+
+    const response = await settingsRoute.GET();
+
+    expect(response.status).toBe(200);
+    expect(response.body).toMatchObject({ theme: "dark", hasPassword: true });
+    expect(response.body).not.toHaveProperty("password");
+    expect(response.body).not.toHaveProperty("oidcClientSecret");
+    expect(response.body).not.toHaveProperty("mitmSudoEncrypted");
+  });
+
+  it("never returns legacy sudo ciphertext from PATCH", async () => {
+    mocks.updateSettings.mockResolvedValue({
+      theme: "light",
+      mitmSudoEncrypted: "machine-decryptable-ciphertext",
+    });
+
+    const response = await settingsRoute.PATCH({
+      json: async () => ({ theme: "light" }),
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body).toEqual(expect.objectContaining({ theme: "light" }));
+    expect(response.body).not.toHaveProperty("mitmSudoEncrypted");
+  });
+});
diff --git a/tests/unit/mitm-shutdown-routes.test.js b/tests/unit/mitm-shutdown-routes.test.js
new file mode 100644
index 000000000..549198ff4
--- /dev/null
+++ b/tests/unit/mitm-shutdown-routes.test.js
@@ -0,0 +1,85 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  killAppProcesses: vi.fn(),
+  spawnUpdaterAndExit: vi.fn(),
+  scheduleIntentionalHandoffExit: vi.fn(),
+  stopMitmForUpdate: vi.fn(),
+  exit: vi.fn(),
+}));
+
+vi.mock("next/server", () => ({
+  NextResponse: {
+    json: (body, init = {}) => ({ body, status: init.status || 200 }),
+  },
+}));
+vi.mock("next/headers", () => ({
+  headers: () => ({ get: () => "Bearer fixture-secret" }),
+}));
+vi.mock("@/lib/appUpdater", () => ({
+  killAppProcesses: mocks.killAppProcesses,
+  spawnUpdaterAndExit: mocks.spawnUpdaterAndExit,
+  scheduleIntentionalHandoffExit: mocks.scheduleIntentionalHandoffExit,
+  stopMitmForUpdate: mocks.stopMitmForUpdate,
+}));
+
+const updateRoute = await import("../../src/app/api/version/update/route.js");
+const versionShutdownRoute = await import("../../src/app/api/version/shutdown/route.js");
+const devShutdownRoute = await import("../../src/app/api/shutdown/route.js");
+
+describe("MITM-aware shutdown routes", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers();
+    vi.spyOn(process, "exit").mockImplementation(mocks.exit);
+  });
+
+  it("does not launch the updater when authenticated cleanup fails", async () => {
+    const previous = process.env.NODE_ENV;
+    process.env.NODE_ENV = "production";
+    mocks.killAppProcesses.mockRejectedValue(new Error("ownership unverified"));
+    try {
+      const response = await updateRoute.POST();
+      expect(response.status).toBe(500);
+      expect(mocks.spawnUpdaterAndExit).not.toHaveBeenCalled();
+    } finally {
+      process.env.NODE_ENV = previous;
+    }
+  });
+
+  it("does not exit for manual-update shutdown when cleanup fails", async () => {
+    mocks.killAppProcesses.mockRejectedValue(new Error("redirect quarantine"));
+    const response = await versionShutdownRoute.POST();
+    await vi.runAllTimersAsync();
+    expect(response.status).toBe(500);
+    expect(mocks.exit).not.toHaveBeenCalled();
+    expect(mocks.scheduleIntentionalHandoffExit).not.toHaveBeenCalled();
+  });
+
+  it("uses the intentional worker handoff path after safe manual-update cleanup", async () => {
+    mocks.killAppProcesses.mockResolvedValue(undefined);
+
+    const response = await versionShutdownRoute.POST();
+
+    expect(response.status).toBe(200);
+    expect(mocks.scheduleIntentionalHandoffExit).toHaveBeenCalledWith(500);
+  });
+
+  it("does not exit the development server when MITM cleanup fails", async () => {
+    const previousNodeEnv = process.env.NODE_ENV;
+    const previousSecret = process.env.SHUTDOWN_SECRET;
+    process.env.NODE_ENV = "development";
+    process.env.SHUTDOWN_SECRET = "fixture-secret";
+    mocks.stopMitmForUpdate.mockRejectedValue(new Error("hosts cleanup denied"));
+    try {
+      const response = await devShutdownRoute.POST();
+      await vi.runAllTimersAsync();
+      expect(response.status).toBe(500);
+      expect(mocks.exit).not.toHaveBeenCalled();
+    } finally {
+      process.env.NODE_ENV = previousNodeEnv;
+      if (previousSecret === undefined) delete process.env.SHUTDOWN_SECRET;
+      else process.env.SHUTDOWN_SECRET = previousSecret;
+    }
+  });
+});
diff --git a/tests/unit/mitm-start-lock.test.js b/tests/unit/mitm-start-lock.test.js
new file mode 100644
index 000000000..244867a43
--- /dev/null
+++ b/tests/unit/mitm-start-lock.test.js
@@ -0,0 +1,194 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createRequire } from "node:module";
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+
+const require = createRequire(import.meta.url);
+const {
+  acquireSocketLock,
+  createStartGate,
+  readFileSnapshot,
+  releaseSocketLock,
+  replaceFileIfUnchanged,
+  removeFileIfUnchanged,
+} = require("../../src/mitm/startLock.js");
+
+async function reserveFreePort() {
+  const probe = net.createServer();
+  await new Promise((resolve, reject) => {
+    probe.once("error", reject);
+    probe.listen({ host: "127.0.0.1", port: 0 }, resolve);
+  });
+  const { port } = probe.address();
+  await new Promise((resolve) => probe.close(resolve));
+  return port;
+}
+
+describe("MITM OS-backed startup lock", () => {
+  const owners = [];
+
+  afterEach(async () => {
+    vi.restoreAllMocks();
+    while (owners.length > 0) {
+      await releaseSocketLock(owners.pop()).catch(() => {});
+    }
+  });
+
+  it("binds loopback exclusively, reports contention, and is reusable after release", async () => {
+    const port = await reserveFreePort();
+    const first = await acquireSocketLock({ port });
+    owners.push(first);
+
+    expect(first.server.address()).toMatchObject({ address: "127.0.0.1", port });
+    await expect(acquireSocketLock({ port })).rejects.toMatchObject({
+      code: "MITM_START_IN_PROGRESS",
+    });
+
+    await releaseSocketLock(owners.pop());
+    const second = await acquireSocketLock({ port });
+    owners.push(second);
+    expect(second.server.address()).toMatchObject({ port });
+  });
+
+  it("propagates non-contention listen failures", async () => {
+    const failure = Object.assign(new Error("permission denied"), { code: "EACCES" });
+    const fakeServer = {
+      once: vi.fn((event, callback) => { if (event === "error") fakeServer.onError = callback; }),
+      listen: vi.fn(() => fakeServer.onError(failure)),
+    };
+    await expect(acquireSocketLock({
+      port: 20443,
+      netImpl: { createServer: () => fakeServer },
+    })).rejects.toBe(failure);
+  });
+
+  it("surfaces listener cleanup failures", async () => {
+    const failure = new Error("injected close failure");
+    await expect(releaseSocketLock({
+      server: { close: (callback) => callback(failure) },
+    })).rejects.toBe(failure);
+  });
+});
+
+describe("MITM in-process operation gate", () => {
+  it("rejects a concurrent start and resolves waiters after cleanup", async () => {
+    let resolveStart;
+    const pending = new Promise((resolve) => { resolveStart = resolve; });
+    const release = vi.fn(() => Promise.resolve());
+    const gate = createStartGate({
+      acquire: vi.fn(() => Promise.resolve({ token: "owner" })),
+      release,
+    });
+
+    const first = gate.run(() => pending);
+    let idle = false;
+    const idleWait = gate.waitForIdle().then(() => { idle = true; });
+    await expect(gate.run(() => Promise.resolve("second"))).rejects.toMatchObject({
+      code: "MITM_START_IN_PROGRESS",
+    });
+    expect(idle).toBe(false);
+
+    resolveStart("started");
+    await expect(first).resolves.toBe("started");
+    await idleWait;
+    expect(idle).toBe(true);
+    expect(release).toHaveBeenCalledTimes(1);
+  });
+
+  it("serializes a stop-style operation with an active start", async () => {
+    let resolveStart;
+    const pending = new Promise((resolve) => { resolveStart = resolve; });
+    const order = [];
+    const gate = createStartGate({
+      acquire: vi.fn(async () => ({ token: "owner" })),
+      release: vi.fn(async () => { order.push("release"); }),
+    });
+
+    const start = gate.run(async () => {
+      order.push("start");
+      await pending;
+      order.push("start-done");
+    });
+    const stop = gate.runAfterIdle(async () => { order.push("stop"); });
+    await Promise.resolve();
+    expect(order).toEqual(["start"]);
+
+    resolveStart();
+    await Promise.all([start, stop]);
+    expect(order).toEqual(["start", "start-done", "release", "stop", "release"]);
+  });
+
+  it("makes an owned-lock release failure visible and invokes rollback", async () => {
+    const cleanupFailure = new Error("release failed");
+    const rollback = vi.fn(async () => {});
+    const gate = createStartGate({
+      acquire: async () => ({ token: "owner" }),
+      release: async () => { throw cleanupFailure; },
+      onCleanupError: rollback,
+    });
+
+    await expect(gate.run(async () => "started")).rejects.toBe(cleanupFailure);
+    expect(rollback).toHaveBeenCalledWith(cleanupFailure);
+    expect(gate.isStarting()).toBe(false);
+  });
+});
+
+describe("MITM PID metadata snapshots", () => {
+  it("does not remove a metadata replacement seen before cleanup", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-mitm-pid-"));
+    const pidFile = path.join(tmpDir, ".mitm.pid");
+    try {
+      fs.writeFileSync(pidFile, "first");
+      const snapshot = readFileSnapshot(pidFile);
+      fs.unlinkSync(pidFile);
+      fs.writeFileSync(pidFile, "replacement");
+      expect(removeFileIfUnchanged(pidFile, snapshot)).toBe(false);
+      expect(fs.readFileSync(pidFile, "utf8")).toBe("replacement");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps the current record when atomic replacement fails", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-mitm-pid-"));
+    const pidFile = path.join(tmpDir, ".mitm.pid");
+    const replacement = path.join(tmpDir, ".mitm.pid.next");
+    try {
+      fs.writeFileSync(pidFile, "current");
+      fs.writeFileSync(replacement, "next");
+      const snapshot = readFileSnapshot(pidFile);
+      const failure = new Error("injected rename failure");
+      const fsImpl = new Proxy(fs, {
+        get(target, property) {
+          if (property === "renameSync") return () => { throw failure; };
+          return Reflect.get(target, property);
+        },
+      });
+
+      expect(() => replaceFileIfUnchanged(pidFile, snapshot, replacement, fsImpl)).toThrow(failure);
+      expect(fs.readFileSync(pidFile, "utf8")).toBe("current");
+      expect(fs.readFileSync(replacement, "utf8")).toBe("next");
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+
+  it("atomically replaces the current record", () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "durindoor-mitm-pid-"));
+    const pidFile = path.join(tmpDir, ".mitm.pid");
+    const replacement = path.join(tmpDir, ".mitm.pid.next");
+    try {
+      fs.writeFileSync(pidFile, "current");
+      fs.writeFileSync(replacement, "next");
+      const snapshot = readFileSnapshot(pidFile);
+
+      expect(replaceFileIfUnchanged(pidFile, snapshot, replacement)).toBe(true);
+      expect(fs.readFileSync(pidFile, "utf8")).toBe("next");
+      expect(fs.existsSync(replacement)).toBe(false);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/tests/unit/security-audit.test.js b/tests/unit/security-audit.test.js
index 81de832ad..40001a93c 100644
--- a/tests/unit/security-audit.test.js
+++ b/tests/unit/security-audit.test.js
@@ -215,35 +215,40 @@ describe("AUDIT-018: XSS escaping in OAuth callback", () => {
 });
 
 // ============================================================
-// AUDIT-004 (#1963): TOCTOU race - atomic lock file
+// AUDIT-004 (#1963): TOCTOU-free OS-backed startup lock
 // ============================================================
-describe("AUDIT-004: Atomic lock file for MITM startup", () => {
-  it("manager.js should define LOCK_FILE constant", () => {
+describe("AUDIT-004: OS-backed MITM startup lock", () => {
+  it("manager.js should acquire the configured loopback socket lock", () => {
     const source = fs.readFileSync(
       path.resolve(repoRoot, "src/mitm/manager.js"),
       "utf-8"
     );
-    expect(source).toContain("LOCK_FILE");
-    expect(source).toContain(".mitm.lock");
+    expect(source).toContain("acquireSocketLock({ port: MITM_START_LOCK_PORT })");
+    expect(source).not.toContain(".mitm.lock");
   });
 
-  it("should use O_EXCL flag (wx) for atomic creation", () => {
+  it("should bind only loopback with an exclusive listener", () => {
     const source = fs.readFileSync(
-      path.resolve(repoRoot, "src/mitm/manager.js"),
+      path.resolve(repoRoot, "src/mitm/startLock.js"),
       "utf-8"
     );
-    expect(source).toContain('"wx"');
-    expect(source).toContain("EEXIST");
+    expect(source).toContain('host = "127.0.0.1"');
+    expect(source).toContain("exclusive: true");
+    expect(source).toContain("EADDRINUSE");
   });
 
-  it("should clean up lock file on all exit paths", () => {
-    const source = fs.readFileSync(
+  it("should release through the listener handle without lock-file unlink", () => {
+    const managerSource = fs.readFileSync(
       path.resolve(repoRoot, "src/mitm/manager.js"),
       "utf-8"
     );
-    const matches = source.match(/unlinkSync\(LOCK_FILE\)/g);
-    expect(matches).not.toBeNull();
-    expect(matches.length).toBeGreaterThanOrEqual(4);
+    const lockSource = fs.readFileSync(
+      path.resolve(repoRoot, "src/mitm/startLock.js"),
+      "utf-8"
+    );
+    expect(managerSource).toContain("release: releaseSocketLock");
+    expect(managerSource).not.toContain("unlinkSync(LOCK_FILE)");
+    expect(lockSource).toContain("owner.server.close");
   });
 });
 
@@ -294,7 +299,7 @@ describe("AUDIT-001: Synchronous restart guard", () => {
     const maxRestartsIdx = funcBody.indexOf("Max restart attempts reached");
     expect(maxRestartsIdx).toBeGreaterThan(-1);
 
-    const afterMax = funcBody.substring(maxRestartsIdx, maxRestartsIdx + 200);
+    const afterMax = funcBody.substring(maxRestartsIdx, maxRestartsIdx + 600);
     expect(afterMax).toContain("mitmIsRestarting = false");
   });
 });