diff --git a/.config/nextest.toml b/.config/nextest.toml
index e7779e12..f29a06d8 100644
--- a/.config/nextest.toml
+++ b/.config/nextest.toml
@@ -7,6 +7,8 @@
 retries = 1
 fail-fast = false
 failure-output = "immediate-final"
+# Bound each stalled test attempt as on Windows; timeouts still fail the run.
+slow-timeout = { period = "60s", terminate-after = 10 }
 
 # Windows runs one curated subset of the suite instead of the whole workspace: tests
 # that are not yet ported (Unix-only tools, transports and sandboxing) are left out. One
diff --git a/crates/cyber-server/tests/file_observations.rs b/crates/cyber-server/tests/file_observations.rs
index 761d0cfe..64b77a81 100644
--- a/crates/cyber-server/tests/file_observations.rs
+++ b/crates/cyber-server/tests/file_observations.rs
@@ -244,13 +244,30 @@ async fn exhausted_pinned_feedback_survives_alias_restart_and_requires_owned_use
 }
 
 #[cfg(unix)]
+fn directory_alias(target: &std::path::Path, alias: &std::path::Path) {
+    std::os::unix::fs::symlink(target, alias).unwrap();
+}
+#[cfg(windows)]
+fn directory_alias(target: &std::path::Path, alias: &std::path::Path) {
+    std::os::windows::fs::symlink_dir(target, alias).unwrap();
+}
+#[cfg(unix)]
+fn remove_directory_alias(alias: &std::path::Path) {
+    std::fs::remove_file(alias).unwrap();
+}
+#[cfg(windows)]
+fn remove_directory_alias(alias: &std::path::Path) {
+    std::fs::remove_dir(alias).unwrap();
+}
+
+#[cfg(any(unix, windows))]
 #[tokio::test]
 async fn unused_user_acknowledgement_cannot_follow_a_retargeted_alias() {
     let h = Harness::new(Setup::default());
     let alias = h.dir.path().join("alias");
     let other = h.dir.path().join("other");
     std::fs::create_dir(&other).unwrap();
-    std::os::unix::fs::symlink(&h.repo, &alias).unwrap();
+    directory_alias(&h.repo, &alias);
     let session = h
         .runtime
         .create_session(cyber_server::runtime::CreateSession {
@@ -266,8 +283,8 @@ async fn unused_user_acknowledgement_cannot_follow_a_retargeted_alias() {
         .await
         .unwrap();
     let original = admission_event(&h, &session.id, "user").await;
-    std::fs::remove_file(&alias).unwrap();
-    std::os::unix::fs::symlink(&other, &alias).unwrap();
+    remove_directory_alias(&alias);
+    directory_alias(&other, &alias);
     let mut current = h
         .runtime
         .claim_pinned_file_watch(other.clone(), opened_directory(&other), BTreeMap::new())
diff --git a/crates/cyber-tools/tests/file_observation_dispatch.rs b/crates/cyber-tools/tests/file_observation_dispatch.rs
index d370b25f..f928654c 100644
--- a/crates/cyber-tools/tests/file_observation_dispatch.rs
+++ b/crates/cyber-tools/tests/file_observation_dispatch.rs
@@ -1974,6 +1974,23 @@ async fn alias_joining_first_shares_the_canonical_owner_and_preserves_raw_sessio
 }
 
 #[cfg(unix)]
+fn directory_alias(target: &std::path::Path, alias: &std::path::Path) {
+    std::os::unix::fs::symlink(target, alias).unwrap();
+}
+#[cfg(windows)]
+fn directory_alias(target: &std::path::Path, alias: &std::path::Path) {
+    std::os::windows::fs::symlink_dir(target, alias).unwrap();
+}
+#[cfg(unix)]
+fn remove_directory_alias(alias: &std::path::Path) {
+    std::fs::remove_file(alias).unwrap();
+}
+#[cfg(windows)]
+fn remove_directory_alias(alias: &std::path::Path) {
+    std::fs::remove_dir(alias).unwrap();
+}
+
+#[cfg(any(unix, windows))]
 #[tokio::test]
 async fn symlink_retarget_loses_old_delivery_and_user_input_admits_the_new_physical_scope() {
     let flow = support::flow::Flow::new(vec![], false);
@@ -1983,7 +2000,7 @@ async fn symlink_retarget_loses_old_delivery_and_user_input_admits_the_new_physi
     initialize_project(&other, "https://example.test/alias-retarget.git");
     let new_project = cyber_core::project::identify(&other).id;
     let alias_path = flow.f.dir.path().join("location-alias");
-    std::os::unix::fs::symlink(&flow.f.repo, &alias_path).unwrap();
+    directory_alias(&flow.f.repo, &alias_path);
     let recorder = Recorder::start().await;
     automatic_hooks(&flow, &recorder);
     let alias = flow
@@ -2010,8 +2027,8 @@ async fn symlink_retarget_loses_old_delivery_and_user_input_admits_the_new_physi
             .any(|event| event["session_id"] == alias.id && event["file_path"] == "before-retarget")
     })
     .await;
-    std::fs::remove_file(&alias_path).unwrap();
-    std::os::unix::fs::symlink(&other, &alias_path).unwrap();
+    remove_directory_alias(&alias_path);
+    directory_alias(&other, &alias_path);
     std::fs::write(
         flow.f.repo.join("old-root-only"),
         "other Session still observes this",
diff --git a/docs/goal-delivery.md b/docs/goal-delivery.md
index fd6a54f0..5638603d 100644
--- a/docs/goal-delivery.md
+++ b/docs/goal-delivery.md
@@ -58,10 +58,18 @@ remaining required before activation. The original tested sources remain on
 `evidence/plugin-native-host-pre-76-merge`. Follow-up #80 merged at `2745b4f0`
 and #83 at `c3bd34c4` on 2026-10-31. These are foundations, diagnostics and the
 observer resource correction; production native admission remains incomplete.
-Continue the first workstream on one follow-up branch,
-`feat/plugin-native-admission-followup`, retaining the same review and acceptance
-gates. The raw datagram send-result correction strengthens measurement and does
-not authorize Linux support changes or production activation.
+PR #84 merged at `dd0c9279` after all 55 configured checks passed on
+`62a3068e`, with one intentional historical diagnostic skip. Its corrected
+native result witness and deterministic missing-guard regression passed Intel
+and arm64; that accepts the verifier correction rather than production native
+admission or the historical unknown race cause.
+
+Continue the first workstream on the single follow-up branch
+`test/file-observer-windows-alias-acceptance`: native Windows retarget acceptance,
+retained source-bound native evidence, and the DirectoryAdded prerequisite design
+for review. Keep native activation and Linux dependency changes behind their
+existing review/acceptance gates. The Setup marker choices and DirectoryAdded
+proposal also require their recorded review before implementation.
 
 Native confinement foundations and regressions exist, but
 production enforcement and the remaining plugin/hook scope are incomplete. The
diff --git a/openspec/changes/complete-plugin-hook-runtime/directory-added-design.md b/openspec/changes/complete-plugin-hook-runtime/directory-added-design.md
new file mode 100644
index 00000000..6622a7b4
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/directory-added-design.md
@@ -0,0 +1,129 @@
+# Additional directory admission and DirectoryAdded
+
+Status: proposal for review; no directory admission or producer implementation.
+This expands task 5.1's prerequisite. It does not complete the native plugin,
+Setup, daily-coding or binary-editor work, or approve their separate decisions.
+
+## Existing contract and inspected gap
+
+The canonical `permissions-modes` requirement "Additional working directories"
+requires repeatable `--add-dir`, `/add-dir` and
+`POST /api/v1/sessions/:id/directories`. An addition must cover the Session's
+ordinary external-directory checks, sandbox writable roots and instruction
+Context Sources, persist `session.directory.added.1`, emit DirectoryAdded and
+apply at the next Safe Boundary. Protected paths remain protected.
+
+At source `43158f31`, these components do not share such an admission:
+
+- `CreateSession`, `SessionInfo`, `TurnContext` and `Invocation` have a Location
+  and rules, but no committed additional-root snapshot or revision.
+- `Ctx::check_external_paths` in `cyber-tools/src/host.rs` compares paths with the
+  Location. File browsing has a separate check in `host/files.rs`. Updating one
+  path would leave attachments, browsing or ordinary tools inconsistent.
+- `sandboxing.rs` composes Location/configuration roots separately; adding a
+  permission rule alone cannot authorize the OS sandbox. Its isolated-solve
+  restriction deliberately clears additional configuration write roots.
+- `ContextInputs` observes the Location's instructions. Directory instructions
+  need their own provenance-bearing Context Source integration.
+- `runtime/drain.rs::boundary` owns Safe Boundary ordering. The existing
+  observational lifecycle hook captures Session scope under its lock and runs
+  handlers after releasing the lock.
+
+The CLI attachment refusal already suggests `--add-dir`, but that suggestion is
+not evidence that the flag, owner admission or effective directory exists. A
+standalone hook emitter would therefore report a transition that did not happen.
+
+## Proposed owner and durable model
+
+Use one Session-owned directory service for all three public entry points. It
+accepts user/owner intent, validates a bounded request ID and path, and refuses
+archived Sessions and requests outside the caller's Session authority. A prompt,
+model tool or hook decision cannot manufacture this owner operation. CLI creation
+inputs must use that same service rather than changing global configuration.
+
+Proposed bounds are 64 effective additional roots and 64 pending additions per
+Session, 4,096 UTF-8 bytes per path and 128 bytes per request ID. These are choices
+for review before schema implementation, not newly active limits.
+
+Record pending intent separately from an effective addition. Exact request
+retries inspect the original operation; reusing an ID with different input is
+refused. A request for an already effective root is an idempotent no-op rather
+than another grant or hook. Preserve the submitted spelling for display, while
+the effective grant binds the resolved root and its native identity. This is
+separate from Setup's proposed exact-stored-directory marker key.
+
+Projectors remain deterministic and perform no filesystem IO. Prepare and pin
+the directory outside writer/Session locks, then validate Session/configuration
+revision and ownership at admission. Retargeting or replacing a root cannot
+silently transfer an old grant to another physical directory. After restart,
+rebuild native proof before releasing a new tool dispatch; a durable path string
+alone is not that proof. Record unavailable scope instead of treating uncertainty
+as an acknowledged effective addition.
+
+## Safe Boundary publication
+
+Prepare one immutable Session scope revision covering ordinary file decisions,
+native sandbox roots and instruction-source inputs. Current Turns and tool
+batches retain their captured revision. A pending addition cannot widen an
+already running call or change another Session's scope.
+
+At the next Safe Boundary, revalidate the prepared root and current Session,
+commit the effective `session.directory.added.1` transition, and synchronously
+publish the prepared revision before permitting another tool dispatch. Publication
+must have no fallible preparation or asynchronous gap after the commit. If this
+cannot fit the current owner API, revise the transaction design before coding;
+do not publish independent mutable permission/context/sandbox lists.
+
+Capture DirectoryAdded from the committed event identity and resulting Session
+scope. Dispatch after releasing Session/writer locks, using existing durable
+handler receipts and observational outcome rules. A failed or merely pending
+request emits no successful addition. Duplicate delivery and unknown mutating
+handler outcomes do not launch the same effect again after restart.
+
+For an idle Session, an owner boundary may settle the addition without starting
+a model Turn. If instruction preparation or native root validation fails, report
+the pending/refused result explicitly; an API acknowledgement must distinguish
+queued intent from an effective addition.
+
+## Permission and context invariants
+
+- The grant satisfies the ordinary external-directory scope check only. Read,
+  edit, Mode, managed denial, trust, taint, hidden-path and protected-owner checks
+  retain their authority. Plan Mode is not made writable by adding a root.
+- Browsing, attachments, in-process editors and sandboxed shell/background tools
+  consume the same captured effective revision. Every target resolves against
+  actual authorized roots; a child symlink cannot borrow its parent's grant to
+  escape into an unrelated tree.
+- Preserve the isolated-solve boundary and parent/child permission ceilings.
+  Specify and review any child/fork propagation explicitly; copying a path list
+  or another Session's event is not admission authority.
+- Load additional directory instructions through bounded, permission-checked
+  Context Sources, with actual file provenance and existing InstructionsLoaded
+  semantics. DirectoryAdded does not replace instruction loading or move the
+  Session's Location/cwd/project identity.
+- This operation does not widen plugin manifest capabilities, publish arbitrary
+  native observer roots or mutate Location/global configuration.
+
+## Implementation and acceptance tasks
+
+- [ ] D1 Review this prerequisite, bounds, identity/deduplication, idle-boundary
+  and child/fork semantics; add the permissions-modes/CLI/API deltas before code.
+- [ ] D2 Add bounded pending/effective events and projections, request binding
+  and writer-atomic revision checks. Test duplicate/conflicting/concurrent
+  requests, archived Sessions, replay and transaction rollback with a real Store.
+- [ ] D3 Integrate pinned native root preparation and one Safe Boundary snapshot
+  into all ordinary file, attachment, sandbox and context paths. Test grants
+  during held tool calls, root replacement/retarget, protected aliases, restart,
+  failed instruction loading and preservation of Mode/managed/child ceilings.
+- [ ] D4 Add CLI, slash/TUI and owner HTTP inputs plus generated schema/SDK
+  artifacts. Exercise repeatable flags and actual owner requests, with no model
+  Turn or manufactured user presence for idle publication.
+- [ ] D5 Emit committed DirectoryAdded with stable source identity; verify scope,
+  order, idempotency and unknown-handler no-replay through actual HTTP/command
+  handlers. A control omitting effective publication must fail a named behavior
+  assertion rather than succeeding because a hook was emitted.
+- [ ] D6 Run native Linux/macOS/Windows checks and substantive security review;
+  reconcile public docs and task 5.1 only after complete acceptance.
+
+The approved goal is unchanged. This proposal exposes a required prerequisite;
+it neither substitutes a test-only hook for the feature nor closes a parent task.
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/file-observation-01535d49.json b/openspec/changes/complete-plugin-hook-runtime/evidence/file-observation-01535d49.json
new file mode 100644
index 00000000..d9eeae58
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/file-observation-01535d49.json
@@ -0,0 +1,152 @@
+{
+  "source_head": "01535d49e7a454536fdf66e788567e7442eb01c7",
+  "workflow_run": 41203255017,
+  "scope": "Real native file observation, Store/runtime and HTTP/platform execution, including both retarget cases on all platforms. Does not establish plugin confinement.",
+  "suite_order": [
+    "core records",
+    "core envelope",
+    "native/scanner/owner",
+    "runtime roots",
+    "Store/runtime",
+    "HTTP callbacks",
+    "AppHost forwarding",
+    "MCP"
+  ],
+  "jobs": [
+    {
+      "platform": "macos",
+      "job_id": 124543123187,
+      "url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41203255017/job/124543123187",
+      "actual_checkout_verified": "01535d49e7a454536fdf66e788567e7442eb01c7",
+      "job_log_sha256": "bc9ab9028485d8abad9c14cba211a9b66cf5dad141eb8eea040408152eb4142d",
+      "named_retarget_regressions_executed": [
+        "unused_user_acknowledgement_cannot_follow_a_retargeted_alias",
+        "symlink_retarget_loses_old_delivery_and_user_input_admits_the_new_physical_scope"
+      ],
+      "suites": [
+        {
+          "passed": 13,
+          "ignored": 0
+        },
+        {
+          "passed": 1,
+          "ignored": 0
+        },
+        {
+          "passed": 58,
+          "ignored": 1
+        },
+        {
+          "passed": 6,
+          "ignored": 1
+        },
+        {
+          "passed": 17,
+          "ignored": 0
+        },
+        {
+          "passed": 24,
+          "ignored": 0
+        },
+        {
+          "passed": 2,
+          "ignored": 0
+        },
+        {
+          "passed": 30,
+          "ignored": 0
+        }
+      ]
+    },
+    {
+      "platform": "linux",
+      "job_id": 124543123302,
+      "url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41203255017/job/124543123302",
+      "actual_checkout_verified": "01535d49e7a454536fdf66e788567e7442eb01c7",
+      "job_log_sha256": "9b0793e2d57ff9a23158634eaffae5f653069541cc815bc5178d0dcdbbacb5b4",
+      "named_retarget_regressions_executed": [
+        "unused_user_acknowledgement_cannot_follow_a_retargeted_alias",
+        "symlink_retarget_loses_old_delivery_and_user_input_admits_the_new_physical_scope"
+      ],
+      "suites": [
+        {
+          "passed": 13,
+          "ignored": 0
+        },
+        {
+          "passed": 1,
+          "ignored": 0
+        },
+        {
+          "passed": 58,
+          "ignored": 1
+        },
+        {
+          "passed": 7,
+          "ignored": 1
+        },
+        {
+          "passed": 17,
+          "ignored": 0
+        },
+        {
+          "passed": 24,
+          "ignored": 0
+        },
+        {
+          "passed": 2,
+          "ignored": 0
+        },
+        {
+          "passed": 30,
+          "ignored": 0
+        }
+      ]
+    },
+    {
+      "platform": "windows",
+      "job_id": 124543123309,
+      "url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41203255017/job/124543123309",
+      "actual_checkout_verified": "01535d49e7a454536fdf66e788567e7442eb01c7",
+      "job_log_sha256": "1c4f5e5585f5baf73092aa855e955334628ef4eced2cea4da4f0eb3737e5da4c",
+      "named_retarget_regressions_executed": [
+        "unused_user_acknowledgement_cannot_follow_a_retargeted_alias",
+        "symlink_retarget_loses_old_delivery_and_user_input_admits_the_new_physical_scope"
+      ],
+      "suites": [
+        {
+          "passed": 13,
+          "ignored": 0
+        },
+        {
+          "passed": 1,
+          "ignored": 0
+        },
+        {
+          "passed": 49,
+          "ignored": 0
+        },
+        {
+          "passed": 2,
+          "ignored": 0
+        },
+        {
+          "passed": 17,
+          "ignored": 0
+        },
+        {
+          "passed": 24,
+          "ignored": 0
+        },
+        {
+          "passed": 2,
+          "ignored": 0
+        },
+        {
+          "passed": 29,
+          "ignored": 0
+        }
+      ]
+    }
+  ]
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/file-observation-3f7067dd.json b/openspec/changes/complete-plugin-hook-runtime/evidence/file-observation-3f7067dd.json
new file mode 100644
index 00000000..9e6caed6
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/file-observation-3f7067dd.json
@@ -0,0 +1,164 @@
+{
+  "source_head": "3f7067dd058b91c11320c99c556b60451b103098",
+  "workflow_run": 41180219218,
+  "scope": "Composed production FileChanged verification; Unix-only retarget tests are not Windows evidence. New cross-platform test changes remain unverified on Windows.",
+  "jobs": [
+    {
+      "platform": "linux",
+      "job_id": 124475915323,
+      "url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41180219218/job/124475915323",
+      "job_log_sha256": "4c74000b505351140ac76acb60ef96aebef022799729039ea5524bd9c1ad59bb",
+      "actual_checkout_verified": "3f7067dd058b91c11320c99c556b60451b103098",
+      "suite_order": [
+        "core records",
+        "core envelope",
+        "native/scanner/owner",
+        "runtime roots",
+        "Store/runtime",
+        "HTTP callbacks",
+        "AppHost forwarding",
+        "MCP"
+      ],
+      "suites": [
+        {
+          "passed": 13,
+          "ignored": 0
+        },
+        {
+          "passed": 1,
+          "ignored": 0
+        },
+        {
+          "passed": 58,
+          "ignored": 1
+        },
+        {
+          "passed": 7,
+          "ignored": 1
+        },
+        {
+          "passed": 17,
+          "ignored": 0
+        },
+        {
+          "passed": 24,
+          "ignored": 0
+        },
+        {
+          "passed": 2,
+          "ignored": 0
+        },
+        {
+          "passed": 30,
+          "ignored": 0
+        }
+      ],
+      "retarget_tests_executed": true
+    },
+    {
+      "platform": "windows",
+      "job_id": 124475915393,
+      "url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41180219218/job/124475915393",
+      "job_log_sha256": "8aa590f3158101869f9756913e83c478a3b1486f1781b2367adbc94a96227f5c",
+      "actual_checkout_verified": "3f7067dd058b91c11320c99c556b60451b103098",
+      "suite_order": [
+        "core records",
+        "core envelope",
+        "native/scanner/owner",
+        "runtime roots",
+        "Store/runtime",
+        "HTTP callbacks",
+        "AppHost forwarding",
+        "MCP"
+      ],
+      "suites": [
+        {
+          "passed": 13,
+          "ignored": 0
+        },
+        {
+          "passed": 1,
+          "ignored": 0
+        },
+        {
+          "passed": 49,
+          "ignored": 0
+        },
+        {
+          "passed": 2,
+          "ignored": 0
+        },
+        {
+          "passed": 16,
+          "ignored": 0
+        },
+        {
+          "passed": 23,
+          "ignored": 0
+        },
+        {
+          "passed": 2,
+          "ignored": 0
+        },
+        {
+          "passed": 29,
+          "ignored": 0
+        }
+      ],
+      "retarget_tests_executed": false
+    },
+    {
+      "platform": "macos",
+      "job_id": 124475915480,
+      "url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41180219218/job/124475915480",
+      "job_log_sha256": "f270c3d64f7225bd8ac3a0b464ff8ad65f3c29b3fe9a2b5af67c4c230bf355ce",
+      "actual_checkout_verified": "3f7067dd058b91c11320c99c556b60451b103098",
+      "suite_order": [
+        "core records",
+        "core envelope",
+        "native/scanner/owner",
+        "runtime roots",
+        "Store/runtime",
+        "HTTP callbacks",
+        "AppHost forwarding",
+        "MCP"
+      ],
+      "suites": [
+        {
+          "passed": 13,
+          "ignored": 0
+        },
+        {
+          "passed": 1,
+          "ignored": 0
+        },
+        {
+          "passed": 58,
+          "ignored": 1
+        },
+        {
+          "passed": 6,
+          "ignored": 1
+        },
+        {
+          "passed": 17,
+          "ignored": 0
+        },
+        {
+          "passed": 24,
+          "ignored": 0
+        },
+        {
+          "passed": 2,
+          "ignored": 0
+        },
+        {
+          "passed": 30,
+          "ignored": 0
+        }
+      ],
+      "retarget_tests_executed": true
+    }
+  ],
+  "rust_inputs_unchanged_at": "62a3068e14ab0d54e980f21848a1c3a21af93597"
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/exec.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/exec.json
new file mode 100644
index 00000000..6c5e9970
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/exec.json
@@ -0,0 +1,82 @@
+{
+  "recorded_at": "2026-10-31T13:01:09.409Z",
+  "platform": "darwin",
+  "architecture": "arm64",
+  "kernel_release": "24.6.0",
+  "sources": [
+    "macos_signing_exec.mts",
+    "macos_exec.c",
+    "fixture_exec.c",
+    "macos_signature.c",
+    "macos_fds.c"
+  ],
+  "source_sha256": "7a06af58c27b8b134dd4833f6947b1a27623c4c3ef34c74542528d05ae284723",
+  "signing_identifier": "com.cyberdyne.probe.helperX.ae678cdf-98c4-41da-aa61-b5fd6d337c07",
+  "signature": {
+    "status": 0,
+    "signal": null,
+    "stdout": "",
+    "stderr": ""
+  },
+  "native_control": {
+    "initial_exec": true,
+    "self_exec": true
+  },
+  "native": {
+    "initial_exec": true,
+    "self_exec": false
+  },
+  "original_platform_image": {
+    "path": "/bin/bash",
+    "sha256": "87bec2413226d37381edf499a64277c9d9bcb9fdae555a844bf0480b48b6c3e3",
+    "control": {
+      "status": 0,
+      "signal": null,
+      "stdout": "initial-admitted\nself-exec",
+      "stderr": "Error: $HOME must be set to run brew.\nError: $HOME must be set to run brew.\n"
+    },
+    "restricted": {
+      "status": 1,
+      "signal": null,
+      "stdout": "initial-admitted\n",
+      "stderr": "/bin/bash: /bin/bash: Operation not permitted\n/bin/bash: /bin/bash: Undefined error: 0\n"
+    }
+  },
+  "same_identifier_counterexample": {
+    "initial_exec": true,
+    "self_exec": true
+  },
+  "detached_signature": {
+    "control": [
+      {
+        "initial_exec": true,
+        "add_signature_result": 0,
+        "add_signature_errno": 0
+      },
+      {
+        "self_exec": true
+      }
+    ],
+    "restricted": [
+      {
+        "initial_exec": true,
+        "add_signature_result": 0,
+        "add_signature_errno": 0
+      },
+      {
+        "self_exec": false,
+        "exec_errno": 1
+      }
+    ],
+    "original_image_unchanged": true
+  },
+  "inherited_above_soft_limit": {
+    "control": {
+      "inherited_descriptor": true
+    },
+    "launcher": {
+      "inherited_descriptor": false
+    }
+  },
+  "limitation": "Experimental exec-only candidate. Identifier collision is an observed bypass. Immutable package/helper identity admission across all slices, other kernel mutation interfaces, packaging and owner integration remain unproved; no production support change."
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/job.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/job.log
new file mode 100644
index 00000000..975bfd54
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/job.log
@@ -0,0 +1,387 @@
+2026-10-31T13:00:57.2282420Z Current runner version: '2.338.2'
+2026-10-31T13:00:57.2313680Z ##[group]Runner Image Provisioner
+2026-10-31T13:00:57.2314500Z Hosted Compute Agent
+2026-10-31T13:00:57.2315000Z Version: 20261021.618
+2026-10-31T13:00:57.2315590Z Commit: 21505ad2541d5be6135ed84fc33697146cf75b8e
+2026-10-31T13:00:57.2316070Z Build Date: 2026-10-21T00:45:21Z
+2026-10-31T13:00:57.2316630Z Worker ID: {9f9c9216-0d40-495e-a478-a6b25f555241}
+2026-10-31T13:00:57.2317220Z Region: westus
+2026-10-31T13:00:57.2317630Z Cloud: MacCloud
+2026-10-31T13:00:57.2318120Z ##[endgroup]
+2026-10-31T13:00:57.2319900Z ##[group]Operating System
+2026-10-31T13:00:57.2320450Z macOS
+2026-10-31T13:00:57.2320850Z 15.8.2
+2026-10-31T13:00:57.2321210Z 24H232
+2026-10-31T13:00:57.2321550Z ##[endgroup]
+2026-10-31T13:00:57.2321990Z ##[group]Runner Image
+2026-10-31T13:00:57.2322430Z Image: macos-15-arm64
+2026-10-31T13:00:57.2322950Z Version: 20261028.0489.1
+2026-10-31T13:00:57.2323940Z Included Software: https://github.com/actions/runner-images/blob/macos-15-arm64/20261028.0489/images/macos/macos-15-arm64-Readme.md
+2026-10-31T13:00:57.2325160Z Image Release: https://github.com/actions/runner-images/releases/tag/macos-15-arm64%2F20261028.0489
+2026-10-31T13:00:57.2325850Z ##[endgroup]
+2026-10-31T13:00:57.2327890Z ##[group]GITHUB_TOKEN Permissions
+2026-10-31T13:00:57.2329940Z Contents: read
+2026-10-31T13:00:57.2330430Z Metadata: read
+2026-10-31T13:00:57.2330820Z ##[endgroup]
+2026-10-31T13:00:57.2332440Z Secret source: Actions
+2026-10-31T13:00:57.2333170Z Cache mode: write
+2026-10-31T13:00:57.2333840Z Prepare workflow directory
+2026-10-31T13:00:57.2764320Z Prepare all required actions
+2026-10-31T13:00:57.2851550Z Getting action download info
+2026-10-31T13:00:57.6540900Z Download action repository 'actions/checkout@v4' (SHA:11d5960a326750d5838078e36cf38b85af677262)
+2026-10-31T13:00:58.1225750Z Download action repository 'actions/setup-node@v4' (SHA:49933ea5288caeca8642d1e84afbd3f7d6820020)
+2026-10-31T13:00:58.2590050Z Download action repository 'actions/upload-artifact@v4' (SHA:ea165f8d65b6e75b540449e92b4886f43607fa02)
+2026-10-31T13:00:58.5351470Z Complete job name: Native signing-identity candidate (macos-15)
+2026-10-31T13:00:58.6164040Z ##[group]Run actions/checkout@v4
+2026-10-31T13:00:58.6165280Z with:
+2026-10-31T13:00:58.6165940Z   repository: CyberdyneCorp/cybercode-cli
+2026-10-31T13:00:58.6173210Z   token: ***
+2026-10-31T13:00:58.6173800Z   ssh-strict: true
+2026-10-31T13:00:58.6174440Z   ssh-user: git
+2026-10-31T13:00:58.6175070Z   persist-credentials: true
+2026-10-31T13:00:58.6175840Z   clean: true
+2026-10-31T13:00:58.6176460Z   sparse-checkout-cone-mode: true
+2026-10-31T13:00:58.6177250Z   fetch-depth: 1
+2026-10-31T13:00:58.6177820Z   fetch-tags: false
+2026-10-31T13:00:58.6178520Z   show-progress: true
+2026-10-31T13:00:58.6179110Z   lfs: false
+2026-10-31T13:00:58.6179660Z   submodules: false
+2026-10-31T13:00:58.6180260Z   set-safe-directory: true
+2026-10-31T13:00:58.6180910Z   allow-unsafe-pr-checkout: false
+2026-10-31T13:00:58.6182110Z ##[endgroup]
+2026-10-31T13:00:59.1154360Z Syncing repository: CyberdyneCorp/cybercode-cli
+2026-10-31T13:00:59.1156560Z ##[group]Getting Git version info
+2026-10-31T13:00:59.1157630Z Working directory is '/Users/runner/work/cybercode-cli/cybercode-cli'
+2026-10-31T13:00:59.1158980Z [command]/opt/homebrew/bin/git version
+2026-10-31T13:00:59.1558490Z git version 2.56.0
+2026-10-31T13:00:59.1576550Z ##[endgroup]
+2026-10-31T13:00:59.1589390Z Copying '/Users/runner/.gitconfig' to '/Users/runner/work/_temp/654ac601-7462-40a4-baf1-796e45ce0c64/.gitconfig'
+2026-10-31T13:00:59.1594620Z Temporarily overriding HOME='/Users/runner/work/_temp/654ac601-7462-40a4-baf1-796e45ce0c64' before making global git config changes
+2026-10-31T13:00:59.1600630Z Adding repository directory to the temporary git global config as a safe directory
+2026-10-31T13:00:59.1614930Z [command]/opt/homebrew/bin/git config --global --add safe.directory /Users/runner/work/cybercode-cli/cybercode-cli
+2026-10-31T13:00:59.1793190Z Deleting the contents of '/Users/runner/work/cybercode-cli/cybercode-cli'
+2026-10-31T13:00:59.1801190Z ##[group]Initializing the repository
+2026-10-31T13:00:59.1804560Z [command]/opt/homebrew/bin/git init /Users/runner/work/cybercode-cli/cybercode-cli
+2026-10-31T13:00:59.2108810Z hint: Using 'master' as the name for the initial branch. This default branch name
+2026-10-31T13:00:59.2111390Z hint: will change to "main" in Git 3.0. To configure the initial branch name
+2026-10-31T13:00:59.2112620Z hint: to use in all of your new repositories, which will suppress this warning,
+2026-10-31T13:00:59.2113790Z hint: call:
+2026-10-31T13:00:59.2115650Z hint:
+2026-10-31T13:00:59.2117870Z hint: 	git config --global init.defaultBranch <name>
+2026-10-31T13:00:59.2118760Z hint:
+2026-10-31T13:00:59.2119660Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
+2026-10-31T13:00:59.2120910Z hint: 'development'. The just-created branch can be renamed via this command:
+2026-10-31T13:00:59.2121900Z hint:
+2026-10-31T13:00:59.2122530Z hint: 	git branch -m <name>
+2026-10-31T13:00:59.2123300Z hint:
+2026-10-31T13:00:59.2124260Z hint: Disable this message with "git config set advice.defaultBranchName false"
+2026-10-31T13:00:59.2125720Z Initialized empty Git repository in /Users/runner/work/cybercode-cli/cybercode-cli/.git/
+2026-10-31T13:00:59.2128270Z [command]/opt/homebrew/bin/git remote add origin https://github.com/CyberdyneCorp/cybercode-cli
+2026-10-31T13:00:59.2222820Z ##[endgroup]
+2026-10-31T13:00:59.2225390Z ##[group]Disabling automatic garbage collection
+2026-10-31T13:00:59.2227790Z [command]/opt/homebrew/bin/git config --local gc.auto 0
+2026-10-31T13:00:59.2342850Z ##[endgroup]
+2026-10-31T13:00:59.2346300Z ##[group]Setting up auth
+2026-10-31T13:00:59.2347740Z [command]/opt/homebrew/bin/git config --local --name-only --get-regexp core\.sshCommand
+2026-10-31T13:00:59.2472860Z [command]/opt/homebrew/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
+2026-10-31T13:00:59.4082800Z [command]/opt/homebrew/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
+2026-10-31T13:00:59.4087720Z [command]/opt/homebrew/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
+2026-10-31T13:00:59.5670820Z [command]/opt/homebrew/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
+2026-10-31T13:00:59.5830390Z [command]/opt/homebrew/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
+2026-10-31T13:00:59.7157350Z [command]/opt/homebrew/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ***
+2026-10-31T13:00:59.7279160Z ##[endgroup]
+2026-10-31T13:00:59.7282360Z ##[group]Fetching the repository
+2026-10-31T13:00:59.7286590Z [command]/opt/homebrew/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +f7bf065227e72b37970feb2f4c6e6f45068e355b:refs/remotes/pull/84/merge
+2026-10-31T13:01:01.4731660Z From https://github.com/CyberdyneCorp/cybercode-cli
+2026-10-31T13:01:01.4737950Z  * [new ref]         f7bf065227e72b37970feb2f4c6e6f45068e355b -> pull/84/merge
+2026-10-31T13:01:01.4759990Z ##[endgroup]
+2026-10-31T13:01:01.4761660Z ##[group]Determining the checkout info
+2026-10-31T13:01:01.4769820Z ##[endgroup]
+2026-10-31T13:01:01.4781080Z [command]/opt/homebrew/bin/git sparse-checkout disable
+2026-10-31T13:01:01.4894720Z [command]/opt/homebrew/bin/git config --local --unset-all extensions.worktreeConfig
+2026-10-31T13:01:01.5014200Z ##[group]Checking out the ref
+2026-10-31T13:01:01.5016520Z [command]/opt/homebrew/bin/git checkout --progress --force refs/remotes/pull/84/merge
+2026-10-31T13:01:02.4804080Z HEAD is now at f7bf065 Merge 62a3068e14ab0d54e980f21848a1c3a21af93597 into c3bd34c48c990c2f72ab999153cff379e71c3b1c
+2026-10-31T13:01:02.4985700Z ##[endgroup]
+2026-10-31T13:01:02.4994270Z [command]/opt/homebrew/bin/git log -1 --format=%H
+2026-10-31T13:01:02.5076970Z f7bf065227e72b37970feb2f4c6e6f45068e355b
+2026-10-31T13:01:02.5984330Z ##[group]Run actions/setup-node@v4
+2026-10-31T13:01:02.5985390Z with:
+2026-10-31T13:01:02.5986040Z   node-version: 22
+2026-10-31T13:01:02.5986620Z   always-auth: false
+2026-10-31T13:01:02.5987320Z   check-latest: false
+2026-10-31T13:01:02.5994100Z   token: ***
+2026-10-31T13:01:02.5994680Z ##[endgroup]
+2026-10-31T13:01:02.9100480Z Found in cache @ /Users/runner/hostedtoolcache/node/22.23.4/arm64
+2026-10-31T13:01:02.9108900Z (node:2371) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
+2026-10-31T13:01:02.9111280Z (Use `node --trace-deprecation ...` to show where the warning was created)
+2026-10-31T13:01:02.9116320Z ##[group]Environment details
+2026-10-31T13:01:04.0447770Z node: v22.23.4
+2026-10-31T13:01:04.0552170Z npm: 10.9.9
+2026-10-31T13:01:04.0593950Z yarn: 1.22.22
+2026-10-31T13:01:04.0602480Z ##[endgroup]
+2026-10-31T13:01:04.1172150Z ##[group]Run set -euo pipefail
+2026-10-31T13:01:04.1173120Z set -euo pipefail
+2026-10-31T13:01:04.1174030Z # Acceptance requires original-image positive startup, denied self-exec,
+2026-10-31T13:01:04.1175330Z # matching-identity counterexamples and descriptor isolation.
+2026-10-31T13:01:04.1176370Z # The historical re-signing experiment remains an opt-in diagnostic;
+2026-10-31T13:01:04.1177460Z # its failed startup control is never counted as confinement.
+2026-10-31T13:01:04.1179700Z node --experimental-strip-types scripts/probes/plugin-confinement/run.mts --runtime native --macos-signing-native --macos-private-unix --report "$RUNNER_TEMP/matrix.json" > "$RUNNER_TEMP/matrix.log" 2>&1
+2026-10-31T13:01:04.1182540Z node --experimental-strip-types scripts/probes/plugin-confinement/macos_signing_exec.mts --report "$RUNNER_TEMP/exec.json" > "$RUNNER_TEMP/exec.log" 2>&1
+2026-10-31T13:01:04.1274040Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:01:04.1274350Z ##[endgroup]
+2026-10-31T13:01:09.4458400Z ##[group]Run set -euo pipefail
+2026-10-31T13:01:09.4458990Z set -euo pipefail
+2026-10-31T13:01:09.4459460Z control="$RUNNER_TEMP/macos-private-unix-missing-grant"
+2026-10-31T13:01:09.4459970Z python3 - "$control" <<'PYCONTROL'
+2026-10-31T13:01:09.4460350Z from pathlib import Path
+2026-10-31T13:01:09.4460610Z import shutil, sys
+2026-10-31T13:01:09.4461000Z target = Path(sys.argv[1])
+2026-10-31T13:01:09.4461570Z shutil.copytree('scripts/probes/plugin-confinement', target, ignore=shutil.ignore_patterns('evidence', '__pycache__'))
+2026-10-31T13:01:09.4462520Z driver = target / 'macos_policy.mts'
+2026-10-31T13:01:09.4462880Z text = driver.read_text()
+2026-10-31T13:01:09.4463160Z before = '  if (privateUnix) {'
+2026-10-31T13:01:09.4463580Z assert text.count(before) == 1
+2026-10-31T13:01:09.4464320Z driver.write_text(text.replace(before, '  if (false) { // Missing scratch UNIX grant control.'))
+2026-10-31T13:01:09.4464820Z PYCONTROL
+2026-10-31T13:01:09.4465110Z log="$RUNNER_TEMP/private-unix-missing-grant.log"
+2026-10-31T13:01:09.4465950Z if node --experimental-strip-types "$control/run.mts" --runtime native --macos-signing-native --macos-private-unix --report "$control/result.json" > "$log" 2>&1; then
+2026-10-31T13:01:09.4466650Z   echo 'Missing private UNIX policy unexpectedly passed' >&2
+2026-10-31T13:01:09.4467060Z   exit 1
+2026-10-31T13:01:09.4467310Z fi
+2026-10-31T13:01:09.4467570Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:01:09.4467870Z from pathlib import Path
+2026-10-31T13:01:09.4468190Z import sys
+2026-10-31T13:01:09.4468420Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:01:09.4468950Z assert 'no-capabilities: private UNIX runtime exchange failed: [false,false]' in text, text
+2026-10-31T13:01:09.4475810Z PYCONTROL
+2026-10-31T13:01:09.4573160Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:01:09.4574620Z ##[endgroup]
+2026-10-31T13:01:10.6131290Z ##[group]Run set -euo pipefail
+2026-10-31T13:01:10.6131620Z set -euo pipefail
+2026-10-31T13:01:10.6132360Z node --experimental-strip-types scripts/probes/plugin-confinement/macos_private_ipc.mts --report "$RUNNER_TEMP/unix-boundary.json" > "$RUNNER_TEMP/unix-boundary.log" 2>&1
+2026-10-31T13:01:10.6170170Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:01:10.6170600Z ##[endgroup]
+2026-10-31T13:01:11.5304350Z ##[group]Run set -euo pipefail
+2026-10-31T13:01:11.5305120Z set -euo pipefail
+2026-10-31T13:01:11.5305760Z log="$RUNNER_TEMP/unix-missing-scope.log"
+2026-10-31T13:01:11.5307410Z if node --experimental-strip-types scripts/probes/plugin-confinement/macos_private_ipc.mts --missing-scope > "$log" 2>&1; then
+2026-10-31T13:01:11.5309060Z   echo 'Missing UNIX outbound scope unexpectedly passed' >&2
+2026-10-31T13:01:11.5309810Z   exit 1
+2026-10-31T13:01:11.5310270Z fi
+2026-10-31T13:01:11.5310750Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:01:11.5311350Z from pathlib import Path
+2026-10-31T13:01:11.5311910Z import sys
+2026-10-31T13:01:11.5312420Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:01:11.5313270Z assert 'macOS datagram endpoint escaped scratch:' in text, text
+2026-10-31T13:01:11.5314080Z import json, re
+2026-10-31T13:01:11.5315000Z match = re.search(r'macOS datagram endpoint escaped scratch: (\{[^\n]+\})', text)
+2026-10-31T13:01:11.5315950Z assert match, text
+2026-10-31T13:01:11.5316500Z entry = json.loads(match[1])
+2026-10-31T13:01:11.5317160Z race = entry['observed']['datagram_race']
+2026-10-31T13:01:11.5318080Z assert race['host_control'] and race['settled'] and not race['failed'], entry
+2026-10-31T13:01:11.5319210Z assert entry['datagram_receipts'] == 7 + race['host_acks'], entry
+2026-10-31T13:01:11.5320230Z for token in ['"owner_received_fixture":true', '"acknowledged":true',
+2026-10-31T13:01:11.5321440Z               '"owner_datagram_received_fixture":true', '"private_datagram":[true,true,true]',
+2026-10-31T13:01:11.5322650Z               '"private_aliases":[true,true]', '"private_peer_matches":true']:
+2026-10-31T13:01:11.5323510Z     assert token in text, text
+2026-10-31T13:01:11.5324110Z PYCONTROL
+2026-10-31T13:01:11.5388150Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:01:11.5388480Z ##[endgroup]
+2026-10-31T13:01:12.2019160Z ##[group]Run set -euo pipefail
+2026-10-31T13:01:12.2019590Z set -euo pipefail
+2026-10-31T13:01:12.2019870Z control="$RUNNER_TEMP/macos-datagram-bind-failure"
+2026-10-31T13:01:12.2020170Z python3 - "$control" <<'PYCONTROL'
+2026-10-31T13:01:12.2020500Z from pathlib import Path
+2026-10-31T13:01:12.2020710Z import shutil, sys
+2026-10-31T13:01:12.2020920Z target = Path(sys.argv[1])
+2026-10-31T13:01:12.2021390Z shutil.copytree('scripts/probes/plugin-confinement', target, ignore=shutil.ignore_patterns('evidence', '__pycache__'))
+2026-10-31T13:01:12.2021900Z fixture = target / 'macos_datagram_race.h'
+2026-10-31T13:01:12.2022170Z source = fixture.read_text()
+2026-10-31T13:01:12.2022440Z needle = 'int client = datagram_socket(client_path);'
+2026-10-31T13:01:12.2022750Z assert source.count(needle) == 1
+2026-10-31T13:01:12.2023180Z fixture.write_text(source.replace(needle, 'int client = datagram_socket(alias);'))
+2026-10-31T13:01:12.2023600Z PYCONTROL
+2026-10-31T13:01:12.2023880Z log="$RUNNER_TEMP/unix-datagram-bind-failure.log"
+2026-10-31T13:01:12.2024350Z if node --experimental-strip-types "$control/macos_private_ipc.mts" > "$log" 2>&1; then
+2026-10-31T13:01:12.2025290Z   echo 'Occupied datagram client bind unexpectedly passed' >&2
+2026-10-31T13:01:12.2025590Z   exit 1
+2026-10-31T13:01:12.2025880Z fi
+2026-10-31T13:01:12.2026040Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:01:12.2026280Z from pathlib import Path
+2026-10-31T13:01:12.2039200Z import errno, json, re, sys
+2026-10-31T13:01:12.2039540Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:01:12.2039960Z match = re.search(r'private datagram race control failed: (\{[^\n]+\})', text)
+2026-10-31T13:01:12.2041600Z assert match, text
+2026-10-31T13:01:12.2042310Z entry = json.loads(match[1])
+2026-10-31T13:01:12.2042990Z race = entry['observed']['datagram_race']
+2026-10-31T13:01:12.2044000Z assert entry['flags']['unrestricted'] and not race['private_control'], entry
+2026-10-31T13:01:12.2045040Z assert race['failure_stage'] == 'client_bind', entry
+2026-10-31T13:01:12.2046000Z assert race['failure_errno'] == errno.EADDRINUSE, entry
+2026-10-31T13:01:12.2046930Z assert race['refused'] == 0 and race['attempts'] == 0, entry
+2026-10-31T13:01:12.2047950Z diagnostic = entry['kernel_diagnostic']
+2026-10-31T13:01:12.2048820Z assert diagnostic['pid'] == entry['observed']['pid'] > 0, entry
+2026-10-31T13:01:12.2050030Z assert len(diagnostic['output']) <= 16384 and len(diagnostic['stderr']) <= 2048, entry
+2026-10-31T13:01:12.2050990Z PYCONTROL
+2026-10-31T13:01:12.2101320Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:01:12.2102170Z ##[endgroup]
+2026-10-31T13:01:15.4639510Z ##[group]Run set -euo pipefail
+2026-10-31T13:01:15.4640370Z set -euo pipefail
+2026-10-31T13:01:15.4640860Z source=scripts/probes/plugin-confinement
+2026-10-31T13:01:15.4641480Z xcrun clang -Wall -Wextra -Werror -pthread "$source/macos_datagram_send_test.c" -o "$RUNNER_TEMP/send-result-test"
+2026-10-31T13:01:15.4642420Z "$RUNNER_TEMP/send-result-test" > "$RUNNER_TEMP/unix-zero-send.log" 2>&1
+2026-10-31T13:01:15.4643870Z legacy="$RUNNER_TEMP/macos-stale-errno-guard"
+2026-10-31T13:01:15.4644960Z python3 - "$legacy" <<'PYCONTROL'
+2026-10-31T13:01:15.4645790Z from pathlib import Path
+2026-10-31T13:01:15.4646570Z import shutil, sys
+2026-10-31T13:01:15.4646910Z target = Path(sys.argv[1])
+2026-10-31T13:01:15.4647230Z target.mkdir()
+2026-10-31T13:01:15.4647680Z for name in ('macos_datagram_send.h', 'macos_datagram_send_test.c'):
+2026-10-31T13:01:15.4648350Z     shutil.copyfile(Path('scripts/probes/plugin-confinement') / name, target / name)
+2026-10-31T13:01:15.4648990Z fixture = target / 'macos_datagram_send.h'
+2026-10-31T13:01:15.4649290Z source = fixture.read_text()
+2026-10-31T13:01:15.4649620Z changes = {
+2026-10-31T13:01:15.4649980Z     'result.error = result.returned == -1 ? errno : 0;': 'result.error = errno;',
+2026-10-31T13:01:15.4650720Z     'sent.attempted && sent.returned == -1 && (sent.error == EACCES || sent.error == EPERM)': '(sent.error == EACCES || sent.error == EPERM)',
+2026-10-31T13:01:15.4651390Z }
+2026-10-31T13:01:15.4651630Z for needle, replacement in changes.items():
+2026-10-31T13:01:15.4652700Z     assert source.count(needle) == 1
+2026-10-31T13:01:15.4653110Z     source = source.replace(needle, replacement)
+2026-10-31T13:01:15.4653530Z fixture.write_text(source)
+2026-10-31T13:01:15.4653810Z PYCONTROL
+2026-10-31T13:01:15.4654350Z xcrun clang -Wall -Wextra -Werror -pthread "$legacy/macos_datagram_send_test.c" -o "$legacy/send-result-test"
+2026-10-31T13:01:15.4655000Z if "$legacy/send-result-test" > "$RUNNER_TEMP/unix-stale-errno-guard.log" 2>&1; then
+2026-10-31T13:01:15.4656640Z   echo 'Missing raw-return guards unexpectedly passed the verifier regression' >&2
+2026-10-31T13:01:15.4657150Z   exit 1
+2026-10-31T13:01:15.4657370Z fi
+2026-10-31T13:01:15.4657830Z python3 - "$RUNNER_TEMP" <<'PYCONTROL'
+2026-10-31T13:01:15.4658190Z from pathlib import Path
+2026-10-31T13:01:15.4658590Z import hashlib, json, sys
+2026-10-31T13:01:15.4658900Z root = Path(sys.argv[1])
+2026-10-31T13:01:15.4659470Z fixed = [json.loads(line) for line in (root / 'unix-zero-send.log').read_text().splitlines()]
+2026-10-31T13:01:15.4660370Z assert [row['case'] for row in fixed] == ['zero-stale-EPERM', 'short-stale-EACCES', 'failed-EACCES', 'failed-EPERM', 'failed-EINVAL', 'setup-with-stale-EPERM'], fixed
+2026-10-31T13:01:15.4661050Z text = (root / 'unix-stale-errno-guard.log').read_text()
+2026-10-31T13:01:15.4661730Z assert 'send-result regression failed: zero-stale-EPERM' in text, text
+2026-10-31T13:01:15.4662360Z legacy = json.loads(next(line for line in text.splitlines() if line.startswith('{')))
+2026-10-31T13:01:15.4663020Z assert legacy['case'] == 'zero-stale-EPERM' and legacy['returned'] == 0 and legacy['outcome'] == 'D', legacy
+2026-10-31T13:01:15.4663640Z paths = ['macos_datagram_send.h', 'macos_datagram_send_test.c']
+2026-10-31T13:01:15.4664080Z digest = hashlib.sha256()
+2026-10-31T13:01:15.4665430Z legacy_digest = hashlib.sha256()
+2026-10-31T13:01:15.4667070Z for name in paths:
+2026-10-31T13:01:15.4668440Z     digest.update((name + '\0').encode())
+2026-10-31T13:01:15.4672610Z     digest.update((Path('scripts/probes/plugin-confinement') / name).read_bytes())
+2026-10-31T13:01:15.4674050Z     legacy_digest.update((name + '\0').encode())
+2026-10-31T13:01:15.4675390Z     legacy_digest.update((root / 'macos-stale-errno-guard' / name).read_bytes())
+2026-10-31T13:01:15.4681570Z report = {'scope': 'Deterministic fault-injected verifier regression, not native confinement acceptance.', 'sources': paths, 'source_sha256': digest.hexdigest(), 'legacy_source_sha256': legacy_digest.hexdigest(), 'fixed': fixed, 'invalid_legacy_guard': legacy}
+2026-10-31T13:01:15.4684410Z (root / 'unix-send-result-control.json').write_text(json.dumps(report, indent=2) + '\n')
+2026-10-31T13:01:15.4685750Z PYCONTROL
+2026-10-31T13:01:15.4744670Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:01:15.4745150Z ##[endgroup]
+2026-10-31T13:01:16.0226760Z ##[group]Run set -euo pipefail
+2026-10-31T13:01:16.0227200Z set -euo pipefail
+2026-10-31T13:01:16.0227560Z log="$RUNNER_TEMP/unix-dropped-rights.log"
+2026-10-31T13:01:16.0228080Z if node --experimental-strip-types scripts/probes/plugin-confinement/macos_private_ipc.mts --drop-rights > "$log" 2>&1; then
+2026-10-31T13:01:16.0228710Z   echo 'Missing SCM_RIGHTS reception unexpectedly passed' >&2
+2026-10-31T13:01:16.0229120Z   exit 1
+2026-10-31T13:01:16.0229460Z fi
+2026-10-31T13:01:16.0229720Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:01:16.0229970Z from pathlib import Path
+2026-10-31T13:01:16.0230170Z import sys
+2026-10-31T13:01:16.0230360Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:01:16.0230800Z assert 'private SCM_RIGHTS exchange failed:' in text, text
+2026-10-31T13:01:16.0232330Z for token in ['"original_closed":true', '"sent":true', '"token":true',
+2026-10-31T13:01:16.0234200Z               '"received":false', '"rights_payload":"A"', '"private_aliases":[true,true]']:
+2026-10-31T13:01:16.0235270Z     assert token in text, text
+2026-10-31T13:01:16.0235990Z PYCONTROL
+2026-10-31T13:01:16.0314020Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:01:16.0314290Z ##[endgroup]
+2026-10-31T13:01:16.6053450Z ##[group]Run set -euo pipefail
+2026-10-31T13:01:16.6054080Z set -euo pipefail
+2026-10-31T13:01:16.6054350Z control="$RUNNER_TEMP/macos-rights-path-reader"
+2026-10-31T13:01:16.6054630Z python3 - "$control" <<'PYCONTROL'
+2026-10-31T13:01:16.6054890Z from pathlib import Path
+2026-10-31T13:01:16.6055140Z import shutil, sys
+2026-10-31T13:01:16.6055500Z target = Path(sys.argv[1])
+2026-10-31T13:01:16.6055960Z shutil.copytree('scripts/probes/plugin-confinement', target, ignore=shutil.ignore_patterns('evidence', '__pycache__'))
+2026-10-31T13:01:16.6056470Z driver = target / 'macos_private_ipc.mts'
+2026-10-31T13:01:16.6056730Z text = driver.read_text()
+2026-10-31T13:01:16.6057040Z before = '    const rights_payload = contents.subarray(0, count).toString();'
+2026-10-31T13:01:16.6057400Z assert text.count(before) == 1
+2026-10-31T13:01:16.6057930Z driver.write_text(text.replace(before, '    const rights_payload = readFileSync(join(paths.scratch, "rights.bin"), "utf8");'))
+2026-10-31T13:01:16.6058390Z PYCONTROL
+2026-10-31T13:01:16.6058610Z log="$RUNNER_TEMP/unix-rights-path-reader.log"
+2026-10-31T13:01:16.6059040Z if node --experimental-strip-types "$control/macos_private_ipc.mts" > "$log" 2>&1; then
+2026-10-31T13:01:16.6059470Z   echo 'Owner path re-resolution unexpectedly passed' >&2
+2026-10-31T13:01:16.6059750Z   exit 1
+2026-10-31T13:01:16.6059910Z fi
+2026-10-31T13:01:16.6060070Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:01:16.6060300Z from pathlib import Path
+2026-10-31T13:01:16.6060500Z import sys
+2026-10-31T13:01:16.6060700Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:01:16.6061000Z assert 'received descriptor file effect:' in text, text
+2026-10-31T13:01:16.6061380Z for token in ['"rights_path_replaced":true', '"rights_link_count":0',
+2026-10-31T13:01:16.6061810Z               '"rights_payload":"XX"', '"written":true', '"original_closed":true']:
+2026-10-31T13:01:16.6062140Z     assert token in text, text
+2026-10-31T13:01:16.6062360Z PYCONTROL
+2026-10-31T13:01:16.6099840Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:01:16.6100150Z ##[endgroup]
+2026-10-31T13:01:17.1708940Z ##[group]Run actions/upload-artifact@v4
+2026-10-31T13:01:17.1709250Z with:
+2026-10-31T13:01:17.1709440Z   name: native-signing-candidate-macos-15
+2026-10-31T13:01:17.1711360Z   path: /Users/runner/work/_temp/matrix.json
+/Users/runner/work/_temp/matrix.log
+/Users/runner/work/_temp/private-unix-missing-grant.log
+/Users/runner/work/_temp/unix-boundary.json
+/Users/runner/work/_temp/unix-boundary.log
+/Users/runner/work/_temp/unix-missing-scope.log
+/Users/runner/work/_temp/unix-datagram-bind-failure.log
+/Users/runner/work/_temp/unix-zero-send.log
+/Users/runner/work/_temp/unix-send-result-control.json
+/Users/runner/work/_temp/unix-stale-errno-guard.log
+/Users/runner/work/_temp/unix-dropped-rights.log
+/Users/runner/work/_temp/unix-rights-path-reader.log
+/Users/runner/work/_temp/exec.json
+/Users/runner/work/_temp/exec.log
+
+2026-10-31T13:01:17.1713300Z   if-no-files-found: error
+2026-10-31T13:01:17.1713490Z   retention-days: 14
+2026-10-31T13:01:17.1713690Z   compression-level: 6
+2026-10-31T13:01:17.1713930Z   overwrite: false
+2026-10-31T13:01:17.1714140Z   include-hidden-files: false
+2026-10-31T13:01:17.1714320Z ##[endgroup]
+2026-10-31T13:01:17.5097800Z (node:2852) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
+2026-10-31T13:01:17.5100600Z (Use `node --trace-deprecation ...` to show where the warning was created)
+2026-10-31T13:01:17.5187110Z Multiple search paths detected. Calculating the least common ancestor of all paths
+2026-10-31T13:01:17.5191160Z The least common ancestor is /Users/runner/work/_temp. This will be the root directory of the artifact
+2026-10-31T13:01:17.5191810Z With the provided path, there will be 14 files uploaded
+2026-10-31T13:01:17.5194140Z Artifact name is valid!
+2026-10-31T13:01:17.5194510Z Root directory input is valid!
+2026-10-31T13:01:17.8502180Z Beginning upload of artifact content to blob storage
+2026-10-31T13:01:17.9361580Z (node:2852) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
+2026-10-31T13:01:18.0656570Z Uploaded bytes 13696
+2026-10-31T13:01:18.1069780Z Finished uploading artifact content to blob storage!
+2026-10-31T13:01:18.1071500Z SHA256 digest of uploaded artifact zip is 10241c13c8e39c48e3719e80f79f5e84b5e3282b9e13819bdb524b91843374b4
+2026-10-31T13:01:18.1076390Z Finalizing artifact upload
+2026-10-31T13:01:18.5696100Z Artifact native-signing-candidate-macos-15.zip successfully finalized. Artifact ID 13043254184
+2026-10-31T13:01:18.5697200Z Artifact native-signing-candidate-macos-15 has been successfully uploaded! Final size is 13696 bytes. Artifact ID is 13043254184
+2026-10-31T13:01:18.5707780Z Artifact download URL: https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41202794586/artifacts/13043254184
+2026-10-31T13:01:18.5927960Z Post job cleanup.
+2026-10-31T13:01:18.7631150Z (node:2858) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
+2026-10-31T13:01:18.7633230Z (Use `node --trace-deprecation ...` to show where the warning was created)
+2026-10-31T13:01:18.7792600Z Post job cleanup.
+2026-10-31T13:01:18.8907080Z [command]/opt/homebrew/bin/git version
+2026-10-31T13:01:18.9111470Z git version 2.56.0
+2026-10-31T13:01:18.9130660Z Copying '/Users/runner/.gitconfig' to '/Users/runner/work/_temp/f15ef2f3-c4a5-4b01-ab72-9a98fe7f798f/.gitconfig'
+2026-10-31T13:01:18.9140260Z Temporarily overriding HOME='/Users/runner/work/_temp/f15ef2f3-c4a5-4b01-ab72-9a98fe7f798f' before making global git config changes
+2026-10-31T13:01:18.9141290Z Adding repository directory to the temporary git global config as a safe directory
+2026-10-31T13:01:18.9160720Z [command]/opt/homebrew/bin/git config --global --add safe.directory /Users/runner/work/cybercode-cli/cybercode-cli
+2026-10-31T13:01:18.9269490Z [command]/opt/homebrew/bin/git config --local --name-only --get-regexp core\.sshCommand
+2026-10-31T13:01:18.9334630Z [command]/opt/homebrew/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
+2026-10-31T13:01:19.0268220Z [command]/opt/homebrew/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
+2026-10-31T13:01:19.0325280Z http.https://github.com/.extraheader
+2026-10-31T13:01:19.0332440Z [command]/opt/homebrew/bin/git config --local --unset-all http.https://github.com/.extraheader
+2026-10-31T13:01:19.0409410Z [command]/opt/homebrew/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
+2026-10-31T13:01:19.1426280Z [command]/opt/homebrew/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
+2026-10-31T13:01:19.1644780Z [command]/opt/homebrew/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
+2026-10-31T13:01:19.2643040Z Cleaning up orphan processes
+2026-10-31T13:01:19.7540640Z ##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/matrix.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/matrix.json
new file mode 100644
index 00000000..9a2841da
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/matrix.json
@@ -0,0 +1,548 @@
+{
+  "recorded_at": "2026-10-31T13:01:08.593Z",
+  "kernel_release": "24.6.0",
+  "sources": [
+    "run.mts",
+    "macos_policy.mts",
+    "macos_rights.h",
+    "macos_datagram_send.h",
+    "macos_datagram.h",
+    "macos_datagram_race.h",
+    "macos_python.c",
+    "macos_node.c",
+    "native_exec.c",
+    "node_bootstrap.cjs",
+    "fixture.py",
+    "fixture.cjs",
+    "private_unix.cjs",
+    "process_policy.h",
+    "linux_filter.h",
+    "linux_exec.c",
+    "linux_initial_exec.h",
+    "fixture_native.c",
+    "macos_exec.c",
+    "macos_stage.mts"
+  ],
+  "source_sha256": "b7b415bfc2d330ef9833c3b818e58db84b3f1676f1fded955940ff5cc53d4fab",
+  "platform": "darwin",
+  "architecture": "arm64",
+  "runtime": "native",
+  "version": "fixture-v2",
+  "signing_identifier": "com.cyberdyne.probe.bootstrap.6c7bb803-d4e1-4816-8975-0bce1ef638db",
+  "socket_broker_candidate": false,
+  "private_stream_candidate": false,
+  "macos_private_unix_candidate": true,
+  "mechanism": "fresh signing identifier on trusted launcher + exact-target Seatbelt exec rule before any runtime instruction; target signature unchanged; experimental subject-identity candidate",
+  "limitation": "experimental native mechanisms; macOS uses deprecated Seatbelt API; not production packaging or Windows acceptance",
+  "unsupported_cases": [],
+  "rows": [
+    {
+      "name": "unconfined-control",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": true,
+        "unrestricted": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": true,
+        "written_project_read": true,
+        "private_read": true,
+        "private_list": true,
+        "private_write": true,
+        "protected_read": true,
+        "protected_write": true,
+        "symlink_private_read": true,
+        "hardlink_private": true,
+        "project_rename": true,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": true,
+        "package_alias_write": true,
+        "thread_reads": [
+          true,
+          true
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          true,
+          true
+        ],
+        "native_child_reads": [
+          true,
+          true
+        ],
+        "cannot_relax": null,
+        "constructor_private_read": true,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    },
+    {
+      "name": "no-capabilities",
+      "flags": {
+        "read": false,
+        "write": false,
+        "shell": false
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": false,
+        "project_list": false,
+        "project_write": false,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          false,
+          false
+        ],
+        "thread_shell": false,
+        "shell": false,
+        "native_fork": false,
+        "child_reads": null,
+        "native_child_reads": null,
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": false,
+        "native_spawn": false,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": false,
+      "constructor_self_exec": false,
+      "constructor_spawn": false
+    },
+    {
+      "name": "read-only",
+      "flags": {
+        "read": true,
+        "write": false,
+        "shell": false
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": false,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          true,
+          false
+        ],
+        "thread_shell": false,
+        "shell": false,
+        "native_fork": false,
+        "child_reads": null,
+        "native_child_reads": null,
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": false,
+        "native_spawn": false,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": false,
+      "constructor_self_exec": false,
+      "constructor_spawn": false
+    },
+    {
+      "name": "write-without-read",
+      "flags": {
+        "read": false,
+        "write": true,
+        "shell": false
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": false,
+        "project_list": false,
+        "project_write": true,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          false,
+          false
+        ],
+        "thread_shell": false,
+        "shell": false,
+        "native_fork": false,
+        "child_reads": null,
+        "native_child_reads": null,
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": false,
+        "native_spawn": false,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": false,
+      "constructor_self_exec": false,
+      "constructor_spawn": false
+    },
+    {
+      "name": "shell-without-read",
+      "flags": {
+        "read": false,
+        "write": false,
+        "shell": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": false,
+        "project_list": false,
+        "project_write": false,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          false,
+          false
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          false,
+          false
+        ],
+        "native_child_reads": [
+          false,
+          false
+        ],
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    },
+    {
+      "name": "read-write-without-shell",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": false
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": true,
+        "written_project_read": true,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          true,
+          false
+        ],
+        "thread_shell": false,
+        "shell": false,
+        "native_fork": false,
+        "child_reads": null,
+        "native_child_reads": null,
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": false,
+        "native_spawn": false,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": false,
+      "constructor_self_exec": false,
+      "constructor_spawn": false
+    },
+    {
+      "name": "read-shell-without-write",
+      "flags": {
+        "read": true,
+        "write": false,
+        "shell": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": false,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          true,
+          false
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          true,
+          false
+        ],
+        "native_child_reads": [
+          true,
+          false
+        ],
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    },
+    {
+      "name": "write-shell-without-read",
+      "flags": {
+        "read": false,
+        "write": true,
+        "shell": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": false,
+        "project_list": false,
+        "project_write": true,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          false,
+          false
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          false,
+          false
+        ],
+        "native_child_reads": [
+          false,
+          false
+        ],
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    },
+    {
+      "name": "declared-read-write-shell",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": true,
+        "written_project_read": true,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          true,
+          false
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          true,
+          false
+        ],
+        "native_child_reads": [
+          true,
+          false
+        ],
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    }
+  ]
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/private-unix-missing-grant.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/private-unix-missing-grant.log
new file mode 100644
index 00000000..dcc00a68
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/private-unix-missing-grant.log
@@ -0,0 +1,31 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: no-capabilities: private UNIX runtime exchange failed: [false,false]
++ actual - expected
+
+  [
++   false,
++   false
+-   true,
+-   true
+  ]
+
+    at check (file:///Users/runner/work/_temp/macos-private-unix-missing-grant/run.mts:298:12)
+    at file:///Users/runner/work/_temp/macos-private-unix-missing-grant/run.mts:402:31
+    at Array.map (<anonymous>)
+    at main (file:///Users/runner/work/_temp/macos-private-unix-missing-grant/run.mts:402:8)
+    at file:///Users/runner/work/_temp/macos-private-unix-missing-grant/run.mts:425:1
+    at ModuleJob.run (node:internal/modules/esm/module_job:343:25)
+    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:681:26)
+    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:117:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: [ false, false ],
+  expected: [ true, true ],
+  operator: 'deepStrictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.4
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/source-binding.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/source-binding.json
new file mode 100644
index 00000000..ea4f55ba
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/source-binding.json
@@ -0,0 +1,10 @@
+{
+  "head": "62a3068e14ab0d54e980f21848a1c3a21af93597",
+  "tested_merge": "f7bf065227e72b37970feb2f4c6e6f45068e355b",
+  "verified_tested_tree": "e3d7bbf7b2d76bbc4c309ed14e6931198a4aa865",
+  "artifact_id": 13043254184,
+  "artifact_sha256": "10241c13c8e39c48e3719e80f79f5e84b5e3282b9e13819bdb524b91843374b4",
+  "job_id": 124541775744,
+  "run_id": 41202794586,
+  "scope": "Both native positive and counterexample steps passed for this source. All declared normal and fixed/legacy control source bytes independently verified against the Git inputs. Does not complete native plugin enforcement or resolve historical unknown race outcomes."
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-boundary.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-boundary.json
new file mode 100644
index 00000000..038e9f01
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-boundary.json
@@ -0,0 +1,992 @@
+{
+  "recorded_at": "2026-10-31T13:01:11.488Z",
+  "platform": "darwin",
+  "architecture": "arm64",
+  "kernel_release": "24.6.0",
+  "sources": [
+    "macos_private_ipc.mts",
+    "macos_policy.mts",
+    "macos_rights.h",
+    "macos_datagram_send.h",
+    "macos_datagram.h",
+    "macos_datagram_race.h",
+    "macos_datagram_owner.mts",
+    "macos_datagram_owner.c",
+    "fixture_native.c",
+    "process_policy.h",
+    "macos_exec.c"
+  ],
+  "source_sha256": "cea84ef0e7df78eb6397dcc9c7e7c1a83516f140b683ad76eafbec8e55386e80",
+  "target_sha256": "357232f577b97eb6e95b3aa830f96580ceb70eb855f86d389b165c369808ce15",
+  "receiver_startup_controls": {
+    "missing_program_refused": true,
+    "failed_bind_refused": true
+  },
+  "rows": [
+    {
+      "name": "unconfined",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": true,
+        "unrestricted": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 2642,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": true,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": true,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 7,
+          "host_acks": 9,
+          "refused": 0,
+          "swaps": 18,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_alias_connect": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": true,
+          "acknowledged": true
+        },
+        "direct": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        },
+        "hardlink": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        },
+        "symlink": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 3,
+      "owner_received_fixture": true,
+      "datagram_receipts": 16,
+      "owner_datagram_received_fixture": true
+    },
+    {
+      "name": "r0w0s0",
+      "flags": {
+        "read": false,
+        "write": false,
+        "shell": false
+      },
+      "observed": {
+        "started": true,
+        "pid": 2645,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 16,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r0w0s1",
+      "flags": {
+        "read": false,
+        "write": false,
+        "shell": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 2647,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 16,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r0w1s0",
+      "flags": {
+        "read": false,
+        "write": true,
+        "shell": false
+      },
+      "observed": {
+        "started": true,
+        "pid": 2650,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 16,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r0w1s1",
+      "flags": {
+        "read": false,
+        "write": true,
+        "shell": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 2652,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 7,
+          "host_acks": 0,
+          "refused": 9,
+          "swaps": 17,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r1w0s0",
+      "flags": {
+        "read": true,
+        "write": false,
+        "shell": false
+      },
+      "observed": {
+        "started": true,
+        "pid": 2655,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 16,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r1w0s1",
+      "flags": {
+        "read": true,
+        "write": false,
+        "shell": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 2659,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 16,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r1w1s0",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": false
+      },
+      "observed": {
+        "started": true,
+        "pid": 2662,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 16,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r1w1s1",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 2664,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 7,
+          "host_acks": 0,
+          "refused": 9,
+          "swaps": 17,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    }
+  ],
+  "scope": "Experimental pre-runtime native UNIX stream/datagram/descriptor controls; complete IPC/proxy/ownership and App acceptance remain required."
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-datagram-bind-failure.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-datagram-bind-failure.log
new file mode 100644
index 00000000..f02b74e8
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-datagram-bind-failure.log
@@ -0,0 +1,20 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: private datagram race control failed: {"name":"unconfined","flags":{"read":true,"write":true,"shell":true,"unrestricted":true},"observed":{"started":true,"pid":2706,"private_unix":[true,true],"private_peer_checks":8,"private_peer_matches":true,"hardlink_created":true,"symlink_created":true,"private_aliases":[true,true],"rights":{"sent":true,"original_closed":true,"token":true,"truncated":false,"received":true,"same_inode":true,"readable":true,"written":true,"cloexec":true},"rights_path_replaced":true,"private_datagram":[true,true,true],"datagram_symlink_created":true,"datagram_race":{"private_control":false,"host_control":false,"settled":false,"failed":false,"attempts":0,"private_acks":0,"host_acks":0,"refused":0,"swaps":0,"failure_stage":"client_bind","failure_errno":48,"failure_return":null},"dgram_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_alias_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"direct":{"connected":true,"sent":true,"acknowledged":true},"hardlink":{"connected":true,"sent":true,"acknowledged":true},"symlink":{"connected":true,"sent":true,"acknowledged":true}},"rights_payload":"AB","rights_link_count":0,"kernel_diagnostic":{"pid":2706,"status":0,"signal":null,"error":"","stderr":"","output":"[]"},"owner_receipts":3,"owner_received_fixture":true,"datagram_receipts":6,"owner_datagram_received_fixture":true}
+
+false !== true
+
+    at check (file:///Users/runner/work/_temp/macos-datagram-bind-failure/macos_private_ipc.mts:150:10)
+    at file:///Users/runner/work/_temp/macos-datagram-bind-failure/macos_private_ipc.mts:207:5
+    at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: false,
+  expected: true,
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.4
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-dropped-rights.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-dropped-rights.log
new file mode 100644
index 00000000..80ac2633
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-dropped-rights.log
@@ -0,0 +1,56 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: private SCM_RIGHTS exchange failed: {"name":"r0w0s0","flags":{"read":false,"write":false,"shell":false},"observed":{"started":true,"pid":2830,"private_unix":[true,true],"private_peer_checks":8,"private_peer_matches":true,"hardlink_created":false,"symlink_created":true,"private_aliases":[true,true],"rights":{"sent":true,"original_closed":true,"token":true,"truncated":false,"received":false,"same_inode":false,"readable":false,"written":false,"cloexec":false},"rights_path_replaced":true,"private_datagram":[true,true,true],"datagram_symlink_created":true,"datagram_race":{"private_control":true,"host_control":false,"settled":true,"failed":false,"attempts":16,"private_acks":8,"host_acks":0,"refused":8,"swaps":17,"failure_stage":"","failure_errno":0,"failure_return":null},"dgram_connect":{"connected":false,"sent":false,"acknowledged":false},"dgram_sendto":{"connected":false,"sent":false,"acknowledged":false},"dgram_sendmsg":{"connected":false,"sent":false,"acknowledged":false},"dgram_alias_connect":{"connected":false,"sent":false,"acknowledged":false},"dgram_alias_sendto":{"connected":false,"sent":false,"acknowledged":false},"dgram_alias_sendmsg":{"connected":false,"sent":false,"acknowledged":false},"direct":{"connected":false,"sent":false,"acknowledged":false},"hardlink":{"connected":false,"sent":false,"acknowledged":false},"symlink":{"connected":false,"sent":false,"acknowledged":false}},"rights_payload":"A","rights_link_count":0,"owner_receipts":0,"owner_received_fixture":false,"datagram_receipts":0,"owner_datagram_received_fixture":false}
++ actual - expected
+
+  {
++   cloexec: false,
+-   cloexec: true,
+    original_closed: true,
++   readable: false,
++   received: false,
++   same_inode: false,
+-   readable: true,
+-   received: true,
+-   same_inode: true,
+    sent: true,
+    token: true,
+    truncated: false,
++   written: false
+-   written: true
+  }
+
+    at check (file:///Users/runner/work/cybercode-cli/cybercode-cli/scripts/probes/plugin-confinement/macos_private_ipc.mts:142:10)
+    at file:///Users/runner/work/cybercode-cli/cybercode-cli/scripts/probes/plugin-confinement/macos_private_ipc.mts:207:5
+    at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: {
+    sent: true,
+    original_closed: true,
+    token: true,
+    truncated: false,
+    received: false,
+    same_inode: false,
+    readable: false,
+    written: false,
+    cloexec: false
+  },
+  expected: {
+    sent: true,
+    original_closed: true,
+    token: true,
+    truncated: false,
+    received: true,
+    same_inode: true,
+    readable: true,
+    written: true,
+    cloexec: true
+  },
+  operator: 'deepStrictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.4
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-missing-scope.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-missing-scope.log
new file mode 100644
index 00000000..2b69e43a
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-missing-scope.log
@@ -0,0 +1,20 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: macOS datagram endpoint escaped scratch: {"name":"r0w0s0","flags":{"read":false,"write":false,"shell":false},"observed":{"started":true,"pid":2685,"private_unix":[true,true],"private_peer_checks":8,"private_peer_matches":true,"hardlink_created":false,"symlink_created":true,"private_aliases":[true,true],"rights":{"sent":true,"original_closed":true,"token":true,"truncated":false,"received":true,"same_inode":true,"readable":true,"written":true,"cloexec":true},"rights_path_replaced":true,"private_datagram":[true,true,true],"datagram_symlink_created":true,"datagram_race":{"private_control":true,"host_control":true,"settled":true,"failed":false,"attempts":16,"private_acks":8,"host_acks":8,"refused":0,"swaps":16,"failure_stage":"","failure_errno":0,"failure_return":null},"dgram_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_alias_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"direct":{"connected":true,"sent":true,"acknowledged":true},"hardlink":{"connected":false,"sent":false,"acknowledged":false},"symlink":{"connected":true,"sent":true,"acknowledged":true}},"rights_payload":"AB","rights_link_count":0,"owner_receipts":2,"owner_received_fixture":true,"datagram_receipts":15,"owner_datagram_received_fixture":true}
+
+15 !== 0
+
+    at check (file:///Users/runner/work/cybercode-cli/cybercode-cli/scripts/probes/plugin-confinement/macos_private_ipc.mts:159:10)
+    at file:///Users/runner/work/cybercode-cli/cybercode-cli/scripts/probes/plugin-confinement/macos_private_ipc.mts:207:5
+    at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: 15,
+  expected: 0,
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.4
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-rights-path-reader.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-rights-path-reader.log
new file mode 100644
index 00000000..e1a92b9e
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-rights-path-reader.log
@@ -0,0 +1,20 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: received descriptor file effect: {"name":"unconfined","flags":{"read":true,"write":true,"shell":true,"unrestricted":true},"observed":{"started":true,"pid":2849,"private_unix":[true,true],"private_peer_checks":8,"private_peer_matches":true,"hardlink_created":true,"symlink_created":true,"private_aliases":[true,true],"rights":{"sent":true,"original_closed":true,"token":true,"truncated":false,"received":true,"same_inode":true,"readable":true,"written":true,"cloexec":true},"rights_path_replaced":true,"private_datagram":[true,true,true],"datagram_symlink_created":true,"datagram_race":{"private_control":true,"host_control":true,"settled":true,"failed":false,"attempts":16,"private_acks":8,"host_acks":8,"refused":0,"swaps":16,"failure_stage":"","failure_errno":0,"failure_return":null},"dgram_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_alias_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"direct":{"connected":true,"sent":true,"acknowledged":true},"hardlink":{"connected":true,"sent":true,"acknowledged":true},"symlink":{"connected":true,"sent":true,"acknowledged":true}},"rights_payload":"XX","rights_link_count":0,"owner_receipts":3,"owner_received_fixture":true,"datagram_receipts":15,"owner_datagram_received_fixture":true}
+
+'XX' !== 'AB'
+
+    at check (file:///Users/runner/work/_temp/macos-rights-path-reader/macos_private_ipc.mts:146:10)
+    at file:///Users/runner/work/_temp/macos-rights-path-reader/macos_private_ipc.mts:207:5
+    at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: 'XX',
+  expected: 'AB',
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.4
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-send-result-control.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-send-result-control.json
new file mode 100644
index 00000000..03675563
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-send-result-control.json
@@ -0,0 +1,79 @@
+{
+  "scope": "Deterministic fault-injected verifier regression, not native confinement acceptance.",
+  "sources": [
+    "macos_datagram_send.h",
+    "macos_datagram_send_test.c"
+  ],
+  "source_sha256": "53afe42b7a5657591f70ac305745a29ab7633b61c793f145a5d8b6a017eeddf3",
+  "legacy_source_sha256": "38f398f51a6a7ce4bed476a76d8cffb1236c53f160a36c6711e1c74889cb8292",
+  "fixed": [
+    {
+      "case": "zero-stale-EPERM",
+      "attempted": 1,
+      "calls": 1,
+      "returned": 0,
+      "error": 0,
+      "outcome": "E",
+      "stage": "send_size",
+      "has_return": 1
+    },
+    {
+      "case": "short-stale-EACCES",
+      "attempted": 1,
+      "calls": 1,
+      "returned": 7,
+      "error": 0,
+      "outcome": "E",
+      "stage": "send_size",
+      "has_return": 1
+    },
+    {
+      "case": "failed-EACCES",
+      "attempted": 1,
+      "calls": 1,
+      "returned": -1,
+      "error": 13,
+      "outcome": "D",
+      "stage": "",
+      "has_return": 0
+    },
+    {
+      "case": "failed-EPERM",
+      "attempted": 1,
+      "calls": 1,
+      "returned": -1,
+      "error": 1,
+      "outcome": "D",
+      "stage": "",
+      "has_return": 0
+    },
+    {
+      "case": "failed-EINVAL",
+      "attempted": 1,
+      "calls": 1,
+      "returned": -1,
+      "error": 22,
+      "outcome": "E",
+      "stage": "send",
+      "has_return": 1
+    },
+    {
+      "case": "setup-with-stale-EPERM",
+      "attempted": 0,
+      "calls": 0,
+      "outcome": "E",
+      "stage": "send_setup",
+      "has_return": 0
+    }
+  ],
+  "invalid_legacy_guard": {
+    "case": "zero-stale-EPERM",
+    "attempted": 1,
+    "calls": 1,
+    "returned": 0,
+    "error": 1,
+    "outcome": "D",
+    "stage": "",
+    "has_return": 0
+  }
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-stale-errno-guard.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-stale-errno-guard.log
new file mode 100644
index 00000000..0ca8db30
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-stale-errno-guard.log
@@ -0,0 +1,2 @@
+send-result regression failed: zero-stale-EPERM
+{"case":"zero-stale-EPERM","attempted":1,"calls":1,"returned":0,"error":1,"outcome":"D","stage":"","has_return":0}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-zero-send.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-zero-send.log
new file mode 100644
index 00000000..3f64213d
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/arm64/unix-zero-send.log
@@ -0,0 +1,6 @@
+{"case":"zero-stale-EPERM","attempted":1,"calls":1,"returned":0,"error":0,"outcome":"E","stage":"send_size","has_return":1}
+{"case":"short-stale-EACCES","attempted":1,"calls":1,"returned":7,"error":0,"outcome":"E","stage":"send_size","has_return":1}
+{"case":"failed-EACCES","attempted":1,"calls":1,"returned":-1,"error":13,"outcome":"D","stage":"","has_return":0}
+{"case":"failed-EPERM","attempted":1,"calls":1,"returned":-1,"error":1,"outcome":"D","stage":"","has_return":0}
+{"case":"failed-EINVAL","attempted":1,"calls":1,"returned":-1,"error":22,"outcome":"E","stage":"send","has_return":1}
+{"case":"setup-with-stale-EPERM","attempted":0,"calls":0,"outcome":"E","stage":"send_setup","has_return":0}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/exec.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/exec.json
new file mode 100644
index 00000000..b7ff0c04
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/exec.json
@@ -0,0 +1,82 @@
+{
+  "recorded_at": "2026-10-31T13:21:03.710Z",
+  "platform": "darwin",
+  "architecture": "x64",
+  "kernel_release": "24.6.0",
+  "sources": [
+    "macos_signing_exec.mts",
+    "macos_exec.c",
+    "fixture_exec.c",
+    "macos_signature.c",
+    "macos_fds.c"
+  ],
+  "source_sha256": "7a06af58c27b8b134dd4833f6947b1a27623c4c3ef34c74542528d05ae284723",
+  "signing_identifier": "com.cyberdyne.probe.helperX.6cc3d457-996f-4da8-b85d-4dc8a78e9492",
+  "signature": {
+    "status": 0,
+    "signal": null,
+    "stdout": "",
+    "stderr": ""
+  },
+  "native_control": {
+    "initial_exec": true,
+    "self_exec": true
+  },
+  "native": {
+    "initial_exec": true,
+    "self_exec": false
+  },
+  "original_platform_image": {
+    "path": "/bin/bash",
+    "sha256": "c372d1d6d4f07e0a917f3660aa79df00cbb50323972c22c3d90ec17d2096d039",
+    "control": {
+      "status": 0,
+      "signal": null,
+      "stdout": "initial-admitted\nself-exec",
+      "stderr": ""
+    },
+    "restricted": {
+      "status": 1,
+      "signal": null,
+      "stdout": "initial-admitted\n",
+      "stderr": "/bin/bash: /bin/bash: Operation not permitted\n/bin/bash: /bin/bash: Undefined error: 0\n"
+    }
+  },
+  "same_identifier_counterexample": {
+    "initial_exec": true,
+    "self_exec": true
+  },
+  "detached_signature": {
+    "control": [
+      {
+        "initial_exec": true,
+        "add_signature_result": 0,
+        "add_signature_errno": 0
+      },
+      {
+        "self_exec": true
+      }
+    ],
+    "restricted": [
+      {
+        "initial_exec": true,
+        "add_signature_result": 0,
+        "add_signature_errno": 0
+      },
+      {
+        "self_exec": false,
+        "exec_errno": 1
+      }
+    ],
+    "original_image_unchanged": true
+  },
+  "inherited_above_soft_limit": {
+    "control": {
+      "inherited_descriptor": true
+    },
+    "launcher": {
+      "inherited_descriptor": false
+    }
+  },
+  "limitation": "Experimental exec-only candidate. Identifier collision is an observed bypass. Immutable package/helper identity admission across all slices, other kernel mutation interfaces, packaging and owner integration remain unproved; no production support change."
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/job.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/job.log
new file mode 100644
index 00000000..c2c6dfa2
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/job.log
@@ -0,0 +1,418 @@
+2026-10-31T13:20:47.4384140Z Current runner version: '2.338.2'
+2026-10-31T13:20:47.4420660Z ##[group]Runner Image Provisioner
+2026-10-31T13:20:47.4422180Z Hosted Compute Agent
+2026-10-31T13:20:47.4422980Z Version: 20260819.586
+2026-10-31T13:20:47.4424190Z Commit: 3cc4a88dfa507ef76119ad1bb3eccc6378bb2b76
+2026-10-31T13:20:47.4425600Z Build Date: 2026-08-18T23:20:18Z
+2026-10-31T13:20:47.4426640Z Worker ID: {fd17d4d0-2b4c-44d3-88bd-2df67bd2cb39}
+2026-10-31T13:20:47.4427900Z Azure Region: westus
+2026-10-31T13:20:47.4428680Z ##[endgroup]
+2026-10-31T13:20:47.4431220Z ##[group]Operating System
+2026-10-31T13:20:47.4432040Z macOS
+2026-10-31T13:20:47.4433180Z 15.7.9
+2026-10-31T13:20:47.4434150Z 24G830
+2026-10-31T13:20:47.4435480Z ##[endgroup]
+2026-10-31T13:20:47.4436730Z ##[group]Runner Image
+2026-10-31T13:20:47.4437550Z Image: macos-15
+2026-10-31T13:20:47.4438300Z Version: 20260824.0482.1
+2026-10-31T13:20:47.4440010Z Included Software: https://github.com/actions/runner-images/blob/macos-15/20260824.0482/images/macos/macos-15-Readme.md
+2026-10-31T13:20:47.4442230Z Image Release: https://github.com/actions/runner-images/releases/tag/macos-15%2F20260824.0482
+2026-10-31T13:20:47.4444340Z ##[endgroup]
+2026-10-31T13:20:47.4446200Z ##[group]GITHUB_TOKEN Permissions
+2026-10-31T13:20:47.4449040Z Contents: read
+2026-10-31T13:20:47.4449840Z Metadata: read
+2026-10-31T13:20:47.4450570Z ##[endgroup]
+2026-10-31T13:20:47.4453080Z Secret source: Actions
+2026-10-31T13:20:47.4455480Z Cache mode: write
+2026-10-31T13:20:47.4458010Z Prepare workflow directory
+2026-10-31T13:20:47.5175990Z Prepare all required actions
+2026-10-31T13:20:47.5262790Z Getting action download info
+2026-10-31T13:20:47.7512160Z Download action repository 'actions/checkout@v4' (SHA:11d5960a326750d5838078e36cf38b85af677262)
+2026-10-31T13:20:48.0016660Z Download action repository 'actions/setup-node@v4' (SHA:49933ea5288caeca8642d1e84afbd3f7d6820020)
+2026-10-31T13:20:48.3400440Z Download action repository 'actions/upload-artifact@v4' (SHA:ea165f8d65b6e75b540449e92b4886f43607fa02)
+2026-10-31T13:20:48.6581330Z Complete job name: Native signing-identity candidate (macos-15-intel)
+2026-10-31T13:20:48.7754130Z ##[group]Run actions/checkout@v4
+2026-10-31T13:20:48.7755530Z with:
+2026-10-31T13:20:48.7756400Z   repository: CyberdyneCorp/cybercode-cli
+2026-10-31T13:20:48.7762730Z   token: ***
+2026-10-31T13:20:48.7763400Z   ssh-strict: true
+2026-10-31T13:20:48.7764090Z   ssh-user: git
+2026-10-31T13:20:48.7764870Z   persist-credentials: true
+2026-10-31T13:20:48.7765680Z   clean: true
+2026-10-31T13:20:48.7766730Z   sparse-checkout-cone-mode: true
+2026-10-31T13:20:48.7768040Z   fetch-depth: 1
+2026-10-31T13:20:48.7770080Z   fetch-tags: false
+2026-10-31T13:20:48.7770860Z   show-progress: true
+2026-10-31T13:20:48.7771720Z   lfs: false
+2026-10-31T13:20:48.7772510Z   submodules: false
+2026-10-31T13:20:48.7773240Z   set-safe-directory: true
+2026-10-31T13:20:48.7774170Z   allow-unsafe-pr-checkout: false
+2026-10-31T13:20:48.7775800Z ##[endgroup]
+2026-10-31T13:20:49.2440930Z Syncing repository: CyberdyneCorp/cybercode-cli
+2026-10-31T13:20:49.2445520Z ##[group]Getting Git version info
+2026-10-31T13:20:49.2447480Z Working directory is '/Users/runner/work/cybercode-cli/cybercode-cli'
+2026-10-31T13:20:49.2449290Z [command]/usr/local/bin/git version
+2026-10-31T13:20:49.2796010Z git version 2.55.0
+2026-10-31T13:20:49.2824920Z ##[endgroup]
+2026-10-31T13:20:49.2841110Z Copying '/Users/runner/.gitconfig' to '/Users/runner/work/_temp/f4650490-cb87-41cf-b691-d41201d6c826/.gitconfig'
+2026-10-31T13:20:49.2860150Z Temporarily overriding HOME='/Users/runner/work/_temp/f4650490-cb87-41cf-b691-d41201d6c826' before making global git config changes
+2026-10-31T13:20:49.2863850Z Adding repository directory to the temporary git global config as a safe directory
+2026-10-31T13:20:49.2869730Z [command]/usr/local/bin/git config --global --add safe.directory /Users/runner/work/cybercode-cli/cybercode-cli
+2026-10-31T13:20:49.3043790Z Deleting the contents of '/Users/runner/work/cybercode-cli/cybercode-cli'
+2026-10-31T13:20:49.3052160Z ##[group]Initializing the repository
+2026-10-31T13:20:49.3057660Z [command]/usr/local/bin/git init /Users/runner/work/cybercode-cli/cybercode-cli
+2026-10-31T13:20:49.3441350Z hint: Using 'master' as the name for the initial branch. This default branch name
+2026-10-31T13:20:49.3444200Z hint: will change to "main" in Git 3.0. To configure the initial branch name
+2026-10-31T13:20:49.3446080Z hint: to use in all of your new repositories, which will suppress this warning,
+2026-10-31T13:20:49.3447570Z hint: call:
+2026-10-31T13:20:49.3448280Z hint:
+2026-10-31T13:20:49.3449180Z hint: 	git config --global init.defaultBranch <name>
+2026-10-31T13:20:49.3450660Z hint:
+2026-10-31T13:20:49.3451620Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
+2026-10-31T13:20:49.3453410Z hint: 'development'. The just-created branch can be renamed via this command:
+2026-10-31T13:20:49.3454690Z hint:
+2026-10-31T13:20:49.3455610Z hint: 	git branch -m <name>
+2026-10-31T13:20:49.3456390Z hint:
+2026-10-31T13:20:49.3457610Z hint: Disable this message with "git config set advice.defaultBranchName false"
+2026-10-31T13:20:49.3459450Z Initialized empty Git repository in /Users/runner/work/cybercode-cli/cybercode-cli/.git/
+2026-10-31T13:20:49.3471740Z [command]/usr/local/bin/git remote add origin https://github.com/CyberdyneCorp/cybercode-cli
+2026-10-31T13:20:49.3616150Z ##[endgroup]
+2026-10-31T13:20:49.3617450Z ##[group]Disabling automatic garbage collection
+2026-10-31T13:20:49.3624240Z [command]/usr/local/bin/git config --local gc.auto 0
+2026-10-31T13:20:49.3734610Z ##[endgroup]
+2026-10-31T13:20:49.3736320Z ##[group]Setting up auth
+2026-10-31T13:20:49.3748390Z [command]/usr/local/bin/git config --local --name-only --get-regexp core\.sshCommand
+2026-10-31T13:20:49.3882210Z [command]/usr/local/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
+2026-10-31T13:20:49.5376740Z [command]/usr/local/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
+2026-10-31T13:20:49.5514960Z [command]/usr/local/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
+2026-10-31T13:20:49.9664830Z [command]/usr/local/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
+2026-10-31T13:20:50.0060670Z [command]/usr/local/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
+2026-10-31T13:20:50.3068160Z [command]/usr/local/bin/git config --local http.https://github.com/.extraheader AUTHORIZATION: basic ***
+2026-10-31T13:20:50.3080050Z ##[endgroup]
+2026-10-31T13:20:50.3081740Z ##[group]Fetching the repository
+2026-10-31T13:20:50.3083920Z [command]/usr/local/bin/git -c protocol.version=2 fetch --no-tags --prune --no-recurse-submodules --depth=1 origin +f7bf065227e72b37970feb2f4c6e6f45068e355b:refs/remotes/pull/84/merge
+2026-10-31T13:20:52.8777900Z From https://github.com/CyberdyneCorp/cybercode-cli
+2026-10-31T13:20:52.8781600Z  * [new ref]         f7bf065227e72b37970feb2f4c6e6f45068e355b -> pull/84/merge
+2026-10-31T13:20:52.8787940Z ##[endgroup]
+2026-10-31T13:20:52.8790520Z ##[group]Determining the checkout info
+2026-10-31T13:20:52.8793460Z ##[endgroup]
+2026-10-31T13:20:52.8795370Z [command]/usr/local/bin/git sparse-checkout disable
+2026-10-31T13:20:52.8982410Z [command]/usr/local/bin/git config --local --unset-all extensions.worktreeConfig
+2026-10-31T13:20:52.9093260Z ##[group]Checking out the ref
+2026-10-31T13:20:52.9098730Z [command]/usr/local/bin/git checkout --progress --force refs/remotes/pull/84/merge
+2026-10-31T13:20:54.0776570Z Updating files:  70% (2854/4072)
+2026-10-31T13:20:54.0937010Z Updating files:  71% (2892/4072)
+2026-10-31T13:20:54.1117240Z Updating files:  72% (2932/4072)
+2026-10-31T13:20:54.1289470Z Updating files:  73% (2973/4072)
+2026-10-31T13:20:54.1420370Z Updating files:  74% (3014/4072)
+2026-10-31T13:20:54.1567340Z Updating files:  75% (3054/4072)
+2026-10-31T13:20:54.1720710Z Updating files:  76% (3095/4072)
+2026-10-31T13:20:54.1894820Z Updating files:  77% (3136/4072)
+2026-10-31T13:20:54.2043200Z Updating files:  78% (3177/4072)
+2026-10-31T13:20:54.2177590Z Updating files:  79% (3217/4072)
+2026-10-31T13:20:54.2315850Z Updating files:  80% (3258/4072)
+2026-10-31T13:20:54.2481720Z Updating files:  81% (3299/4072)
+2026-10-31T13:20:54.2769020Z Updating files:  82% (3340/4072)
+2026-10-31T13:20:54.2896300Z Updating files:  83% (3380/4072)
+2026-10-31T13:20:54.3120530Z Updating files:  84% (3421/4072)
+2026-10-31T13:20:54.3348330Z Updating files:  85% (3462/4072)
+2026-10-31T13:20:54.3518600Z Updating files:  86% (3502/4072)
+2026-10-31T13:20:54.3684440Z Updating files:  87% (3543/4072)
+2026-10-31T13:20:54.3834160Z Updating files:  88% (3584/4072)
+2026-10-31T13:20:54.3997430Z Updating files:  89% (3625/4072)
+2026-10-31T13:20:54.4140130Z Updating files:  90% (3665/4072)
+2026-10-31T13:20:54.4294880Z Updating files:  91% (3706/4072)
+2026-10-31T13:20:54.4423090Z Updating files:  92% (3747/4072)
+2026-10-31T13:20:54.4586220Z Updating files:  93% (3787/4072)
+2026-10-31T13:20:54.4797670Z Updating files:  94% (3828/4072)
+2026-10-31T13:20:54.5138410Z Updating files:  95% (3869/4072)
+2026-10-31T13:20:54.6170450Z Updating files:  96% (3910/4072)
+2026-10-31T13:20:54.6690190Z Updating files:  97% (3950/4072)
+2026-10-31T13:20:54.6856700Z Updating files:  98% (3991/4072)
+2026-10-31T13:20:54.7019910Z Updating files:  99% (4032/4072)
+2026-10-31T13:20:54.7020810Z Updating files: 100% (4072/4072)
+2026-10-31T13:20:54.7021510Z Updating files: 100% (4072/4072), done.
+2026-10-31T13:20:54.7198570Z HEAD is now at f7bf065 Merge 62a3068e14ab0d54e980f21848a1c3a21af93597 into c3bd34c48c990c2f72ab999153cff379e71c3b1c
+2026-10-31T13:20:54.7232180Z ##[endgroup]
+2026-10-31T13:20:54.7403450Z [command]/usr/local/bin/git log -1 --format=%H
+2026-10-31T13:20:54.7521860Z f7bf065227e72b37970feb2f4c6e6f45068e355b
+2026-10-31T13:20:54.9481330Z ##[group]Run actions/setup-node@v4
+2026-10-31T13:20:54.9482100Z with:
+2026-10-31T13:20:54.9483080Z   node-version: 22
+2026-10-31T13:20:54.9483710Z   always-auth: false
+2026-10-31T13:20:54.9484300Z   check-latest: false
+2026-10-31T13:20:54.9491770Z   token: ***
+2026-10-31T13:20:54.9492350Z ##[endgroup]
+2026-10-31T13:20:55.2928280Z Found in cache @ /Users/runner/hostedtoolcache/node/22.23.2/x64
+2026-10-31T13:20:55.2936780Z (node:4867) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
+2026-10-31T13:20:55.2941300Z ##[group]Environment details
+2026-10-31T13:20:55.2943600Z (Use `node --trace-deprecation ...` to show where the warning was created)
+2026-10-31T13:20:56.5865290Z node: v22.23.2
+2026-10-31T13:20:56.5956830Z npm: 10.9.8
+2026-10-31T13:20:56.5974550Z yarn: 1.22.22
+2026-10-31T13:20:56.5976470Z ##[endgroup]
+2026-10-31T13:20:56.6180010Z ##[group]Run set -euo pipefail
+2026-10-31T13:20:56.6181690Z set -euo pipefail
+2026-10-31T13:20:56.6182810Z # Acceptance requires original-image positive startup, denied self-exec,
+2026-10-31T13:20:56.6184340Z # matching-identity counterexamples and descriptor isolation.
+2026-10-31T13:20:56.6185740Z # The historical re-signing experiment remains an opt-in diagnostic;
+2026-10-31T13:20:56.6187270Z # its failed startup control is never counted as confinement.
+2026-10-31T13:20:56.6190060Z node --experimental-strip-types scripts/probes/plugin-confinement/run.mts --runtime native --macos-signing-native --macos-private-unix --report "$RUNNER_TEMP/matrix.json" > "$RUNNER_TEMP/matrix.log" 2>&1
+2026-10-31T13:20:56.6194020Z node --experimental-strip-types scripts/probes/plugin-confinement/macos_signing_exec.mts --report "$RUNNER_TEMP/exec.json" > "$RUNNER_TEMP/exec.log" 2>&1
+2026-10-31T13:20:56.6310120Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:20:56.6311350Z ##[endgroup]
+2026-10-31T13:21:03.7714230Z ##[group]Run set -euo pipefail
+2026-10-31T13:21:03.7715400Z set -euo pipefail
+2026-10-31T13:21:03.7716080Z control="$RUNNER_TEMP/macos-private-unix-missing-grant"
+2026-10-31T13:21:03.7717000Z python3 - "$control" <<'PYCONTROL'
+2026-10-31T13:21:03.7717630Z from pathlib import Path
+2026-10-31T13:21:03.7718180Z import shutil, sys
+2026-10-31T13:21:03.7718710Z target = Path(sys.argv[1])
+2026-10-31T13:21:03.7719960Z shutil.copytree('scripts/probes/plugin-confinement', target, ignore=shutil.ignore_patterns('evidence', '__pycache__'))
+2026-10-31T13:21:03.7721340Z driver = target / 'macos_policy.mts'
+2026-10-31T13:21:03.7721990Z text = driver.read_text()
+2026-10-31T13:21:03.7722590Z before = '  if (privateUnix) {'
+2026-10-31T13:21:03.7723230Z assert text.count(before) == 1
+2026-10-31T13:21:03.7724380Z driver.write_text(text.replace(before, '  if (false) { // Missing scratch UNIX grant control.'))
+2026-10-31T13:21:03.7725450Z PYCONTROL
+2026-10-31T13:21:03.7726030Z log="$RUNNER_TEMP/private-unix-missing-grant.log"
+2026-10-31T13:21:03.7727810Z if node --experimental-strip-types "$control/run.mts" --runtime native --macos-signing-native --macos-private-unix --report "$control/result.json" > "$log" 2>&1; then
+2026-10-31T13:21:03.7729700Z   echo 'Missing private UNIX policy unexpectedly passed' >&2
+2026-10-31T13:21:03.7730500Z   exit 1
+2026-10-31T13:21:03.7730900Z fi
+2026-10-31T13:21:03.7731330Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:21:03.7731920Z from pathlib import Path
+2026-10-31T13:21:03.7732450Z import sys
+2026-10-31T13:21:03.7732940Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:21:03.7734010Z assert 'no-capabilities: private UNIX runtime exchange failed: [false,false]' in text, text
+2026-10-31T13:21:03.7735060Z PYCONTROL
+2026-10-31T13:21:03.7797390Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:21:03.7798080Z ##[endgroup]
+2026-10-31T13:21:05.2082900Z ##[group]Run set -euo pipefail
+2026-10-31T13:21:05.2084440Z set -euo pipefail
+2026-10-31T13:21:05.2087800Z node --experimental-strip-types scripts/probes/plugin-confinement/macos_private_ipc.mts --report "$RUNNER_TEMP/unix-boundary.json" > "$RUNNER_TEMP/unix-boundary.log" 2>&1
+2026-10-31T13:21:05.2278880Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:21:05.2280160Z ##[endgroup]
+2026-10-31T13:21:06.8489380Z ##[group]Run set -euo pipefail
+2026-10-31T13:21:06.8490060Z set -euo pipefail
+2026-10-31T13:21:06.8490640Z log="$RUNNER_TEMP/unix-missing-scope.log"
+2026-10-31T13:21:06.8492060Z if node --experimental-strip-types scripts/probes/plugin-confinement/macos_private_ipc.mts --missing-scope > "$log" 2>&1; then
+2026-10-31T13:21:06.8494090Z   echo 'Missing UNIX outbound scope unexpectedly passed' >&2
+2026-10-31T13:21:06.8494900Z   exit 1
+2026-10-31T13:21:06.8495350Z fi
+2026-10-31T13:21:06.8495780Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:21:06.8496370Z from pathlib import Path
+2026-10-31T13:21:06.8496900Z import sys
+2026-10-31T13:21:06.8497410Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:21:06.8498230Z assert 'macOS datagram endpoint escaped scratch:' in text, text
+2026-10-31T13:21:06.8499050Z import json, re
+2026-10-31T13:21:06.8499940Z match = re.search(r'macOS datagram endpoint escaped scratch: (\{[^\n]+\})', text)
+2026-10-31T13:21:06.8500880Z assert match, text
+2026-10-31T13:21:06.8501390Z entry = json.loads(match[1])
+2026-10-31T13:21:06.8502010Z race = entry['observed']['datagram_race']
+2026-10-31T13:21:06.8502920Z assert race['host_control'] and race['settled'] and not race['failed'], entry
+2026-10-31T13:21:06.8504040Z assert entry['datagram_receipts'] == 7 + race['host_acks'], entry
+2026-10-31T13:21:06.8505640Z for token in ['"owner_received_fixture":true', '"acknowledged":true',
+2026-10-31T13:21:06.8506860Z               '"owner_datagram_received_fixture":true', '"private_datagram":[true,true,true]',
+2026-10-31T13:21:06.8508280Z               '"private_aliases":[true,true]', '"private_peer_matches":true']:
+2026-10-31T13:21:06.8509380Z     assert token in text, text
+2026-10-31T13:21:06.8509940Z PYCONTROL
+2026-10-31T13:21:06.8581420Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:21:06.8582130Z ##[endgroup]
+2026-10-31T13:21:07.9358410Z ##[group]Run set -euo pipefail
+2026-10-31T13:21:07.9359360Z set -euo pipefail
+2026-10-31T13:21:07.9360140Z control="$RUNNER_TEMP/macos-datagram-bind-failure"
+2026-10-31T13:21:07.9361120Z python3 - "$control" <<'PYCONTROL'
+2026-10-31T13:21:07.9361750Z from pathlib import Path
+2026-10-31T13:21:07.9362340Z import shutil, sys
+2026-10-31T13:21:07.9362980Z target = Path(sys.argv[1])
+2026-10-31T13:21:07.9364340Z shutil.copytree('scripts/probes/plugin-confinement', target, ignore=shutil.ignore_patterns('evidence', '__pycache__'))
+2026-10-31T13:21:07.9365850Z fixture = target / 'macos_datagram_race.h'
+2026-10-31T13:21:07.9366580Z source = fixture.read_text()
+2026-10-31T13:21:07.9367320Z needle = 'int client = datagram_socket(client_path);'
+2026-10-31T13:21:07.9368260Z assert source.count(needle) == 1
+2026-10-31T13:21:07.9369490Z fixture.write_text(source.replace(needle, 'int client = datagram_socket(alias);'))
+2026-10-31T13:21:07.9370520Z PYCONTROL
+2026-10-31T13:21:07.9371130Z log="$RUNNER_TEMP/unix-datagram-bind-failure.log"
+2026-10-31T13:21:07.9372300Z if node --experimental-strip-types "$control/macos_private_ipc.mts" > "$log" 2>&1; then
+2026-10-31T13:21:07.9373580Z   echo 'Occupied datagram client bind unexpectedly passed' >&2
+2026-10-31T13:21:07.9374540Z   exit 1
+2026-10-31T13:21:07.9375010Z fi
+2026-10-31T13:21:07.9375530Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:21:07.9376160Z from pathlib import Path
+2026-10-31T13:21:07.9376810Z import errno, json, re, sys
+2026-10-31T13:21:07.9377470Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:21:07.9378520Z match = re.search(r'private datagram race control failed: (\{[^\n]+\})', text)
+2026-10-31T13:21:07.9380050Z assert match, text
+2026-10-31T13:21:07.9380660Z entry = json.loads(match[1])
+2026-10-31T13:21:07.9381490Z race = entry['observed']['datagram_race']
+2026-10-31T13:21:07.9382670Z assert entry['flags']['unrestricted'] and not race['private_control'], entry
+2026-10-31T13:21:07.9383790Z assert race['failure_stage'] == 'client_bind', entry
+2026-10-31T13:21:07.9384750Z assert race['failure_errno'] == errno.EADDRINUSE, entry
+2026-10-31T13:21:07.9385780Z assert race['refused'] == 0 and race['attempts'] == 0, entry
+2026-10-31T13:21:07.9386820Z diagnostic = entry['kernel_diagnostic']
+2026-10-31T13:21:07.9387770Z assert diagnostic['pid'] == entry['observed']['pid'] > 0, entry
+2026-10-31T13:21:07.9388960Z assert len(diagnostic['output']) <= 16384 and len(diagnostic['stderr']) <= 2048, entry
+2026-10-31T13:21:07.9389970Z PYCONTROL
+2026-10-31T13:21:07.9466430Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:21:07.9467200Z ##[endgroup]
+2026-10-31T13:21:12.6166050Z ##[group]Run set -euo pipefail
+2026-10-31T13:21:12.6167170Z set -euo pipefail
+2026-10-31T13:21:12.6168290Z source=scripts/probes/plugin-confinement
+2026-10-31T13:21:12.6170860Z xcrun clang -Wall -Wextra -Werror -pthread "$source/macos_datagram_send_test.c" -o "$RUNNER_TEMP/send-result-test"
+2026-10-31T13:21:12.6174370Z "$RUNNER_TEMP/send-result-test" > "$RUNNER_TEMP/unix-zero-send.log" 2>&1
+2026-10-31T13:21:12.6177700Z legacy="$RUNNER_TEMP/macos-stale-errno-guard"
+2026-10-31T13:21:12.6178800Z python3 - "$legacy" <<'PYCONTROL'
+2026-10-31T13:21:12.6179790Z from pathlib import Path
+2026-10-31T13:21:12.6180730Z import shutil, sys
+2026-10-31T13:21:12.6181590Z target = Path(sys.argv[1])
+2026-10-31T13:21:12.6182580Z target.mkdir()
+2026-10-31T13:21:12.6183680Z for name in ('macos_datagram_send.h', 'macos_datagram_send_test.c'):
+2026-10-31T13:21:12.6185780Z     shutil.copyfile(Path('scripts/probes/plugin-confinement') / name, target / name)
+2026-10-31T13:21:12.6187520Z fixture = target / 'macos_datagram_send.h'
+2026-10-31T13:21:12.6188500Z source = fixture.read_text()
+2026-10-31T13:21:12.6189510Z changes = {
+2026-10-31T13:21:12.6190600Z     'result.error = result.returned == -1 ? errno : 0;': 'result.error = errno;',
+2026-10-31T13:21:12.6193340Z     'sent.attempted && sent.returned == -1 && (sent.error == EACCES || sent.error == EPERM)': '(sent.error == EACCES || sent.error == EPERM)',
+2026-10-31T13:21:12.6195500Z }
+2026-10-31T13:21:12.6196240Z for needle, replacement in changes.items():
+2026-10-31T13:21:12.6197470Z     assert source.count(needle) == 1
+2026-10-31T13:21:12.6198510Z     source = source.replace(needle, replacement)
+2026-10-31T13:21:12.6199880Z fixture.write_text(source)
+2026-10-31T13:21:12.6200950Z PYCONTROL
+2026-10-31T13:21:12.6202770Z xcrun clang -Wall -Wextra -Werror -pthread "$legacy/macos_datagram_send_test.c" -o "$legacy/send-result-test"
+2026-10-31T13:21:12.6205190Z if "$legacy/send-result-test" > "$RUNNER_TEMP/unix-stale-errno-guard.log" 2>&1; then
+2026-10-31T13:21:12.6207210Z   echo 'Missing raw-return guards unexpectedly passed the verifier regression' >&2
+2026-10-31T13:21:12.6208630Z   exit 1
+2026-10-31T13:21:12.6209550Z fi
+2026-10-31T13:21:12.6210250Z python3 - "$RUNNER_TEMP" <<'PYCONTROL'
+2026-10-31T13:21:12.6211480Z from pathlib import Path
+2026-10-31T13:21:12.6212310Z import hashlib, json, sys
+2026-10-31T13:21:12.6213630Z root = Path(sys.argv[1])
+2026-10-31T13:21:12.6215050Z fixed = [json.loads(line) for line in (root / 'unix-zero-send.log').read_text().splitlines()]
+2026-10-31T13:21:12.6219200Z assert [row['case'] for row in fixed] == ['zero-stale-EPERM', 'short-stale-EACCES', 'failed-EACCES', 'failed-EPERM', 'failed-EINVAL', 'setup-with-stale-EPERM'], fixed
+2026-10-31T13:21:12.6221520Z text = (root / 'unix-stale-errno-guard.log').read_text()
+2026-10-31T13:21:12.6223140Z assert 'send-result regression failed: zero-stale-EPERM' in text, text
+2026-10-31T13:21:12.6225860Z legacy = json.loads(next(line for line in text.splitlines() if line.startswith('{')))
+2026-10-31T13:21:12.6228060Z assert legacy['case'] == 'zero-stale-EPERM' and legacy['returned'] == 0 and legacy['outcome'] == 'D', legacy
+2026-10-31T13:21:12.6230020Z paths = ['macos_datagram_send.h', 'macos_datagram_send_test.c']
+2026-10-31T13:21:12.6231380Z digest = hashlib.sha256()
+2026-10-31T13:21:12.6232190Z legacy_digest = hashlib.sha256()
+2026-10-31T13:21:12.6233200Z for name in paths:
+2026-10-31T13:21:12.6233990Z     digest.update((name + '\0').encode())
+2026-10-31T13:21:12.6236600Z     digest.update((Path('scripts/probes/plugin-confinement') / name).read_bytes())
+2026-10-31T13:21:12.6238080Z     legacy_digest.update((name + '\0').encode())
+2026-10-31T13:21:12.6239640Z     legacy_digest.update((root / 'macos-stale-errno-guard' / name).read_bytes())
+2026-10-31T13:21:12.6243640Z report = {'scope': 'Deterministic fault-injected verifier regression, not native confinement acceptance.', 'sources': paths, 'source_sha256': digest.hexdigest(), 'legacy_source_sha256': legacy_digest.hexdigest(), 'fixed': fixed, 'invalid_legacy_guard': legacy}
+2026-10-31T13:21:12.6249300Z (root / 'unix-send-result-control.json').write_text(json.dumps(report, indent=2) + '\n')
+2026-10-31T13:21:12.6250690Z PYCONTROL
+2026-10-31T13:21:12.6375200Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:21:12.6376420Z ##[endgroup]
+2026-10-31T13:21:13.2006550Z ##[group]Run set -euo pipefail
+2026-10-31T13:21:13.2007510Z set -euo pipefail
+2026-10-31T13:21:13.2008340Z log="$RUNNER_TEMP/unix-dropped-rights.log"
+2026-10-31T13:21:13.2010330Z if node --experimental-strip-types scripts/probes/plugin-confinement/macos_private_ipc.mts --drop-rights > "$log" 2>&1; then
+2026-10-31T13:21:13.2012480Z   echo 'Missing SCM_RIGHTS reception unexpectedly passed' >&2
+2026-10-31T13:21:13.2013530Z   exit 1
+2026-10-31T13:21:13.2014110Z fi
+2026-10-31T13:21:13.2014730Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:21:13.2015660Z from pathlib import Path
+2026-10-31T13:21:13.2016390Z import sys
+2026-10-31T13:21:13.2017030Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:21:13.2018160Z assert 'private SCM_RIGHTS exchange failed:' in text, text
+2026-10-31T13:21:13.2019610Z for token in ['"original_closed":true', '"sent":true', '"token":true',
+2026-10-31T13:21:13.2021220Z               '"received":false', '"rights_payload":"A"', '"private_aliases":[true,true]']:
+2026-10-31T13:21:13.2022500Z     assert token in text, text
+2026-10-31T13:21:13.2023300Z PYCONTROL
+2026-10-31T13:21:13.2119920Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:21:13.2120840Z ##[endgroup]
+2026-10-31T13:21:14.2759630Z ##[group]Run set -euo pipefail
+2026-10-31T13:21:14.2760540Z set -euo pipefail
+2026-10-31T13:21:14.2761320Z control="$RUNNER_TEMP/macos-rights-path-reader"
+2026-10-31T13:21:14.2762190Z python3 - "$control" <<'PYCONTROL'
+2026-10-31T13:21:14.2762840Z from pathlib import Path
+2026-10-31T13:21:14.2763410Z import shutil, sys
+2026-10-31T13:21:14.2764570Z target = Path(sys.argv[1])
+2026-10-31T13:21:14.2766650Z shutil.copytree('scripts/probes/plugin-confinement', target, ignore=shutil.ignore_patterns('evidence', '__pycache__'))
+2026-10-31T13:21:14.2768280Z driver = target / 'macos_private_ipc.mts'
+2026-10-31T13:21:14.2769320Z text = driver.read_text()
+2026-10-31T13:21:14.2770450Z before = '    const rights_payload = contents.subarray(0, count).toString();'
+2026-10-31T13:21:14.2771710Z assert text.count(before) == 1
+2026-10-31T13:21:14.2773540Z driver.write_text(text.replace(before, '    const rights_payload = readFileSync(join(paths.scratch, "rights.bin"), "utf8");'))
+2026-10-31T13:21:14.2774910Z PYCONTROL
+2026-10-31T13:21:14.2775650Z log="$RUNNER_TEMP/unix-rights-path-reader.log"
+2026-10-31T13:21:14.2777160Z if node --experimental-strip-types "$control/macos_private_ipc.mts" > "$log" 2>&1; then
+2026-10-31T13:21:14.2778500Z   echo 'Owner path re-resolution unexpectedly passed' >&2
+2026-10-31T13:21:14.2779400Z   exit 1
+2026-10-31T13:21:14.2779820Z fi
+2026-10-31T13:21:14.2780240Z python3 - "$log" <<'PYCONTROL'
+2026-10-31T13:21:14.2781010Z from pathlib import Path
+2026-10-31T13:21:14.2781700Z import sys
+2026-10-31T13:21:14.2782300Z text = Path(sys.argv[1]).read_text()
+2026-10-31T13:21:14.2783230Z assert 'received descriptor file effect:' in text, text
+2026-10-31T13:21:14.2784300Z for token in ['"rights_path_replaced":true', '"rights_link_count":0',
+2026-10-31T13:21:14.2785540Z               '"rights_payload":"XX"', '"written":true', '"original_closed":true']:
+2026-10-31T13:21:14.2786560Z     assert token in text, text
+2026-10-31T13:21:14.2788010Z PYCONTROL
+2026-10-31T13:21:14.2849930Z shell: /bin/bash --noprofile --norc -e -o pipefail {0}
+2026-10-31T13:21:14.2850600Z ##[endgroup]
+2026-10-31T13:21:15.4060160Z ##[group]Run actions/upload-artifact@v4
+2026-10-31T13:21:15.4060840Z with:
+2026-10-31T13:21:15.4061370Z   name: native-signing-candidate-macos-15-intel
+2026-10-31T13:21:15.4067060Z   path: /Users/runner/work/_temp/matrix.json
+/Users/runner/work/_temp/matrix.log
+/Users/runner/work/_temp/private-unix-missing-grant.log
+/Users/runner/work/_temp/unix-boundary.json
+/Users/runner/work/_temp/unix-boundary.log
+/Users/runner/work/_temp/unix-missing-scope.log
+/Users/runner/work/_temp/unix-datagram-bind-failure.log
+/Users/runner/work/_temp/unix-zero-send.log
+/Users/runner/work/_temp/unix-send-result-control.json
+/Users/runner/work/_temp/unix-stale-errno-guard.log
+/Users/runner/work/_temp/unix-dropped-rights.log
+/Users/runner/work/_temp/unix-rights-path-reader.log
+/Users/runner/work/_temp/exec.json
+/Users/runner/work/_temp/exec.log
+
+2026-10-31T13:21:15.4072860Z   if-no-files-found: error
+2026-10-31T13:21:15.4073310Z   retention-days: 14
+2026-10-31T13:21:15.4073770Z   compression-level: 6
+2026-10-31T13:21:15.4074350Z   overwrite: false
+2026-10-31T13:21:15.4074800Z   include-hidden-files: false
+2026-10-31T13:21:15.4075300Z ##[endgroup]
+2026-10-31T13:21:15.7475250Z (node:5446) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
+2026-10-31T13:21:15.7540240Z (Use `node --trace-deprecation ...` to show where the warning was created)
+2026-10-31T13:21:15.8534500Z Multiple search paths detected. Calculating the least common ancestor of all paths
+2026-10-31T13:21:15.8627240Z The least common ancestor is /Users/runner/work/_temp. This will be the root directory of the artifact
+2026-10-31T13:21:15.8628770Z With the provided path, there will be 14 files uploaded
+2026-10-31T13:21:15.8630130Z Artifact name is valid!
+2026-10-31T13:21:15.8630780Z Root directory input is valid!
+2026-10-31T13:21:16.0844450Z (node:5446) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
+2026-10-31T13:21:16.1537520Z Beginning upload of artifact content to blob storage
+2026-10-31T13:21:16.1615890Z Uploaded bytes 13637
+2026-10-31T13:21:16.1651030Z Finished uploading artifact content to blob storage!
+2026-10-31T13:21:16.1687340Z SHA256 digest of uploaded artifact zip is 49e691e322855d02ab6afabebab79a8fddd5e5ec2fe2e9ded295c7b2909fdb3d
+2026-10-31T13:21:16.1708300Z Finalizing artifact upload
+2026-10-31T13:21:16.5464990Z Artifact native-signing-candidate-macos-15-intel.zip successfully finalized. Artifact ID 13043873525
+2026-10-31T13:21:16.5468460Z Artifact native-signing-candidate-macos-15-intel has been successfully uploaded! Final size is 13637 bytes. Artifact ID is 13043873525
+2026-10-31T13:21:16.5488450Z Artifact download URL: https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41202794586/artifacts/13043873525
+2026-10-31T13:21:16.5739760Z Post job cleanup.
+2026-10-31T13:21:16.8488660Z (node:5449) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
+2026-10-31T13:21:16.8551050Z (Use `node --trace-deprecation ...` to show where the warning was created)
+2026-10-31T13:21:16.8752440Z Post job cleanup.
+2026-10-31T13:21:17.1636130Z [command]/usr/local/bin/git version
+2026-10-31T13:21:17.1651720Z git version 2.55.0
+2026-10-31T13:21:17.1708280Z Copying '/Users/runner/.gitconfig' to '/Users/runner/work/_temp/f24ac0d8-f0b2-4539-a00b-bf9f3d5f302c/.gitconfig'
+2026-10-31T13:21:17.1730210Z Temporarily overriding HOME='/Users/runner/work/_temp/f24ac0d8-f0b2-4539-a00b-bf9f3d5f302c' before making global git config changes
+2026-10-31T13:21:17.1749790Z Adding repository directory to the temporary git global config as a safe directory
+2026-10-31T13:21:17.1754040Z [command]/usr/local/bin/git config --global --add safe.directory /Users/runner/work/cybercode-cli/cybercode-cli
+2026-10-31T13:21:17.1763070Z [command]/usr/local/bin/git config --local --name-only --get-regexp core\.sshCommand
+2026-10-31T13:21:17.1776270Z [command]/usr/local/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
+2026-10-31T13:21:17.3961140Z [command]/usr/local/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
+2026-10-31T13:21:17.4369390Z http.https://github.com/.extraheader
+2026-10-31T13:21:17.4406630Z [command]/usr/local/bin/git config --local --unset-all http.https://github.com/.extraheader
+2026-10-31T13:21:17.4466930Z [command]/usr/local/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
+2026-10-31T13:21:17.5925910Z [command]/usr/local/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
+2026-10-31T13:21:17.6163360Z [command]/usr/local/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
+2026-10-31T13:21:17.8357600Z Cleaning up orphan processes
+2026-10-31T13:21:18.4027690Z ##[warning]Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/matrix.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/matrix.json
new file mode 100644
index 00000000..9ced5c33
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/matrix.json
@@ -0,0 +1,548 @@
+{
+  "recorded_at": "2026-10-31T13:21:02.478Z",
+  "kernel_release": "24.6.0",
+  "sources": [
+    "run.mts",
+    "macos_policy.mts",
+    "macos_rights.h",
+    "macos_datagram_send.h",
+    "macos_datagram.h",
+    "macos_datagram_race.h",
+    "macos_python.c",
+    "macos_node.c",
+    "native_exec.c",
+    "node_bootstrap.cjs",
+    "fixture.py",
+    "fixture.cjs",
+    "private_unix.cjs",
+    "process_policy.h",
+    "linux_filter.h",
+    "linux_exec.c",
+    "linux_initial_exec.h",
+    "fixture_native.c",
+    "macos_exec.c",
+    "macos_stage.mts"
+  ],
+  "source_sha256": "b7b415bfc2d330ef9833c3b818e58db84b3f1676f1fded955940ff5cc53d4fab",
+  "platform": "darwin",
+  "architecture": "x64",
+  "runtime": "native",
+  "version": "fixture-v2",
+  "signing_identifier": "com.cyberdyne.probe.bootstrap.42c50c51-c8e3-43bf-8a94-abcb81ded335",
+  "socket_broker_candidate": false,
+  "private_stream_candidate": false,
+  "macos_private_unix_candidate": true,
+  "mechanism": "fresh signing identifier on trusted launcher + exact-target Seatbelt exec rule before any runtime instruction; target signature unchanged; experimental subject-identity candidate",
+  "limitation": "experimental native mechanisms; macOS uses deprecated Seatbelt API; not production packaging or Windows acceptance",
+  "unsupported_cases": [],
+  "rows": [
+    {
+      "name": "unconfined-control",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": true,
+        "unrestricted": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": true,
+        "written_project_read": true,
+        "private_read": true,
+        "private_list": true,
+        "private_write": true,
+        "protected_read": true,
+        "protected_write": true,
+        "symlink_private_read": true,
+        "hardlink_private": true,
+        "project_rename": true,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": true,
+        "package_alias_write": true,
+        "thread_reads": [
+          true,
+          true
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          true,
+          true
+        ],
+        "native_child_reads": [
+          true,
+          true
+        ],
+        "cannot_relax": null,
+        "constructor_private_read": true,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    },
+    {
+      "name": "no-capabilities",
+      "flags": {
+        "read": false,
+        "write": false,
+        "shell": false
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": false,
+        "project_list": false,
+        "project_write": false,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          false,
+          false
+        ],
+        "thread_shell": false,
+        "shell": false,
+        "native_fork": false,
+        "child_reads": null,
+        "native_child_reads": null,
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": false,
+        "native_spawn": false,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": false,
+      "constructor_self_exec": false,
+      "constructor_spawn": false
+    },
+    {
+      "name": "read-only",
+      "flags": {
+        "read": true,
+        "write": false,
+        "shell": false
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": false,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          true,
+          false
+        ],
+        "thread_shell": false,
+        "shell": false,
+        "native_fork": false,
+        "child_reads": null,
+        "native_child_reads": null,
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": false,
+        "native_spawn": false,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": false,
+      "constructor_self_exec": false,
+      "constructor_spawn": false
+    },
+    {
+      "name": "write-without-read",
+      "flags": {
+        "read": false,
+        "write": true,
+        "shell": false
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": false,
+        "project_list": false,
+        "project_write": true,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          false,
+          false
+        ],
+        "thread_shell": false,
+        "shell": false,
+        "native_fork": false,
+        "child_reads": null,
+        "native_child_reads": null,
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": false,
+        "native_spawn": false,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": false,
+      "constructor_self_exec": false,
+      "constructor_spawn": false
+    },
+    {
+      "name": "shell-without-read",
+      "flags": {
+        "read": false,
+        "write": false,
+        "shell": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": false,
+        "project_list": false,
+        "project_write": false,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          false,
+          false
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          false,
+          false
+        ],
+        "native_child_reads": [
+          false,
+          false
+        ],
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    },
+    {
+      "name": "read-write-without-shell",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": false
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": true,
+        "written_project_read": true,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          true,
+          false
+        ],
+        "thread_shell": false,
+        "shell": false,
+        "native_fork": false,
+        "child_reads": null,
+        "native_child_reads": null,
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": false,
+        "native_spawn": false,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": false,
+      "constructor_self_exec": false,
+      "constructor_spawn": false
+    },
+    {
+      "name": "read-shell-without-write",
+      "flags": {
+        "read": true,
+        "write": false,
+        "shell": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": false,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          true,
+          false
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          true,
+          false
+        ],
+        "native_child_reads": [
+          true,
+          false
+        ],
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    },
+    {
+      "name": "write-shell-without-read",
+      "flags": {
+        "read": false,
+        "write": true,
+        "shell": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": false,
+        "project_list": false,
+        "project_write": true,
+        "written_project_read": false,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          false,
+          false
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          false,
+          false
+        ],
+        "native_child_reads": [
+          false,
+          false
+        ],
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    },
+    {
+      "name": "declared-read-write-shell",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": true
+      },
+      "observations": {
+        "stdio_tool": true,
+        "package_read": true,
+        "scratch_write": true,
+        "scratch_read": true,
+        "project_read": true,
+        "project_list": true,
+        "project_write": true,
+        "written_project_read": true,
+        "private_read": false,
+        "private_list": false,
+        "private_write": false,
+        "protected_read": false,
+        "protected_write": false,
+        "symlink_private_read": false,
+        "hardlink_private": false,
+        "project_rename": false,
+        "inherited_descriptor": false,
+        "thread": true,
+        "package_hardlink": false,
+        "package_alias_write": false,
+        "thread_reads": [
+          true,
+          false
+        ],
+        "thread_shell": true,
+        "shell": true,
+        "native_fork": true,
+        "child_reads": [
+          true,
+          false
+        ],
+        "native_child_reads": [
+          true,
+          false
+        ],
+        "cannot_relax": true,
+        "constructor_private_read": false,
+        "constructor_fork": true,
+        "native_spawn": true,
+        "platform_status_known": true,
+        "platform_before": false,
+        "platform_after_set": false,
+        "private_unix": [
+          true,
+          true
+        ]
+      },
+      "self_exec": true,
+      "constructor_self_exec": true,
+      "constructor_spawn": true
+    }
+  ]
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/private-unix-missing-grant.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/private-unix-missing-grant.log
new file mode 100644
index 00000000..fa187351
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/private-unix-missing-grant.log
@@ -0,0 +1,31 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: no-capabilities: private UNIX runtime exchange failed: [false,false]
++ actual - expected
+
+  [
++   false,
++   false
+-   true,
+-   true
+  ]
+
+    at check (file:///Users/runner/work/_temp/macos-private-unix-missing-grant/run.mts:298:12)
+    at file:///Users/runner/work/_temp/macos-private-unix-missing-grant/run.mts:402:31
+    at Array.map (<anonymous>)
+    at main (file:///Users/runner/work/_temp/macos-private-unix-missing-grant/run.mts:402:8)
+    at file:///Users/runner/work/_temp/macos-private-unix-missing-grant/run.mts:425:1
+    at ModuleJob.run (node:internal/modules/esm/module_job:343:25)
+    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:681:26)
+    at async asyncRunEntryPointWithESMLoader (node:internal/modules/run_main:117:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: [ false, false ],
+  expected: [ true, true ],
+  operator: 'deepStrictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.2
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/source-binding.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/source-binding.json
new file mode 100644
index 00000000..24184074
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/source-binding.json
@@ -0,0 +1,10 @@
+{
+  "head": "62a3068e14ab0d54e980f21848a1c3a21af93597",
+  "tested_merge": "f7bf065227e72b37970feb2f4c6e6f45068e355b",
+  "verified_tested_tree": "e3d7bbf7b2d76bbc4c309ed14e6931198a4aa865",
+  "artifact_id": 13043873525,
+  "artifact_sha256": "49e691e322855d02ab6afabebab79a8fddd5e5ec2fe2e9ded295c7b2909fdb3d",
+  "job_id": 124541776102,
+  "run_id": 41202794586,
+  "scope": "Both native positive and counterexample steps passed for this source. All declared normal and fixed/legacy control source bytes independently verified against the Git inputs. Does not complete native plugin enforcement or resolve historical unknown race outcomes."
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-boundary.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-boundary.json
new file mode 100644
index 00000000..1e844c71
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-boundary.json
@@ -0,0 +1,992 @@
+{
+  "recorded_at": "2026-10-31T13:21:06.796Z",
+  "platform": "darwin",
+  "architecture": "x64",
+  "kernel_release": "24.6.0",
+  "sources": [
+    "macos_private_ipc.mts",
+    "macos_policy.mts",
+    "macos_rights.h",
+    "macos_datagram_send.h",
+    "macos_datagram.h",
+    "macos_datagram_race.h",
+    "macos_datagram_owner.mts",
+    "macos_datagram_owner.c",
+    "fixture_native.c",
+    "process_policy.h",
+    "macos_exec.c"
+  ],
+  "source_sha256": "cea84ef0e7df78eb6397dcc9c7e7c1a83516f140b683ad76eafbec8e55386e80",
+  "target_sha256": "066bb5d1793f998d38b6260638087b761b2c6d1309760a7e9108c9d215313606",
+  "receiver_startup_controls": {
+    "missing_program_refused": true,
+    "failed_bind_refused": true
+  },
+  "rows": [
+    {
+      "name": "unconfined",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": true,
+        "unrestricted": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 5210,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": true,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": true,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 8,
+          "refused": 0,
+          "swaps": 18,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_alias_connect": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": true,
+          "acknowledged": true
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": true,
+          "acknowledged": true
+        },
+        "direct": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        },
+        "hardlink": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        },
+        "symlink": {
+          "connected": true,
+          "sent": true,
+          "acknowledged": true
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 3,
+      "owner_received_fixture": true,
+      "datagram_receipts": 15,
+      "owner_datagram_received_fixture": true
+    },
+    {
+      "name": "r0w0s0",
+      "flags": {
+        "read": false,
+        "write": false,
+        "shell": false
+      },
+      "observed": {
+        "started": true,
+        "pid": 5213,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 20,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r0w0s1",
+      "flags": {
+        "read": false,
+        "write": false,
+        "shell": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 5215,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 17,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r0w1s0",
+      "flags": {
+        "read": false,
+        "write": true,
+        "shell": false
+      },
+      "observed": {
+        "started": true,
+        "pid": 5218,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 18,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r0w1s1",
+      "flags": {
+        "read": false,
+        "write": true,
+        "shell": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 5222,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 7,
+          "host_acks": 0,
+          "refused": 9,
+          "swaps": 17,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r1w0s0",
+      "flags": {
+        "read": true,
+        "write": false,
+        "shell": false
+      },
+      "observed": {
+        "started": true,
+        "pid": 5225,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 7,
+          "host_acks": 0,
+          "refused": 9,
+          "swaps": 17,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r1w0s1",
+      "flags": {
+        "read": true,
+        "write": false,
+        "shell": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 5227,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 16,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r1w1s0",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": false
+      },
+      "observed": {
+        "started": true,
+        "pid": 5230,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 7,
+          "host_acks": 0,
+          "refused": 9,
+          "swaps": 17,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    },
+    {
+      "name": "r1w1s1",
+      "flags": {
+        "read": true,
+        "write": true,
+        "shell": true
+      },
+      "observed": {
+        "started": true,
+        "pid": 5232,
+        "private_unix": [
+          true,
+          true
+        ],
+        "private_peer_checks": 8,
+        "private_peer_matches": true,
+        "hardlink_created": false,
+        "symlink_created": true,
+        "private_aliases": [
+          true,
+          true
+        ],
+        "rights": {
+          "sent": true,
+          "original_closed": true,
+          "token": true,
+          "truncated": false,
+          "received": true,
+          "same_inode": true,
+          "readable": true,
+          "written": true,
+          "cloexec": true
+        },
+        "rights_path_replaced": true,
+        "private_datagram": [
+          true,
+          true,
+          true
+        ],
+        "datagram_symlink_created": true,
+        "datagram_race": {
+          "private_control": true,
+          "host_control": false,
+          "settled": true,
+          "failed": false,
+          "attempts": 16,
+          "private_acks": 8,
+          "host_acks": 0,
+          "refused": 8,
+          "swaps": 16,
+          "failure_stage": "",
+          "failure_errno": 0,
+          "failure_return": null
+        },
+        "dgram_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_connect": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendto": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "dgram_alias_sendmsg": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "direct": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "hardlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        },
+        "symlink": {
+          "connected": false,
+          "sent": false,
+          "acknowledged": false
+        }
+      },
+      "rights_payload": "AB",
+      "rights_link_count": 0,
+      "owner_receipts": 0,
+      "owner_received_fixture": false,
+      "datagram_receipts": 0,
+      "owner_datagram_received_fixture": false
+    }
+  ],
+  "scope": "Experimental pre-runtime native UNIX stream/datagram/descriptor controls; complete IPC/proxy/ownership and App acceptance remain required."
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-datagram-bind-failure.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-datagram-bind-failure.log
new file mode 100644
index 00000000..cddc152b
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-datagram-bind-failure.log
@@ -0,0 +1,20 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: private datagram race control failed: {"name":"unconfined","flags":{"read":true,"write":true,"shell":true,"unrestricted":true},"observed":{"started":true,"pid":5284,"private_unix":[true,true],"private_peer_checks":8,"private_peer_matches":true,"hardlink_created":true,"symlink_created":true,"private_aliases":[true,true],"rights":{"sent":true,"original_closed":true,"token":true,"truncated":false,"received":true,"same_inode":true,"readable":true,"written":true,"cloexec":true},"rights_path_replaced":true,"private_datagram":[true,true,true],"datagram_symlink_created":true,"datagram_race":{"private_control":false,"host_control":false,"settled":false,"failed":false,"attempts":0,"private_acks":0,"host_acks":0,"refused":0,"swaps":0,"failure_stage":"client_bind","failure_errno":48,"failure_return":null},"dgram_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_alias_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"direct":{"connected":true,"sent":true,"acknowledged":true},"hardlink":{"connected":true,"sent":true,"acknowledged":true},"symlink":{"connected":true,"sent":true,"acknowledged":true}},"rights_payload":"AB","rights_link_count":0,"kernel_diagnostic":{"pid":5284,"status":0,"signal":null,"error":"","stderr":"","output":"[]"},"owner_receipts":3,"owner_received_fixture":true,"datagram_receipts":6,"owner_datagram_received_fixture":true}
+
+false !== true
+
+    at check (file:///Users/runner/work/_temp/macos-datagram-bind-failure/macos_private_ipc.mts:150:10)
+    at file:///Users/runner/work/_temp/macos-datagram-bind-failure/macos_private_ipc.mts:207:5
+    at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: false,
+  expected: true,
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.2
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-dropped-rights.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-dropped-rights.log
new file mode 100644
index 00000000..5923019a
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-dropped-rights.log
@@ -0,0 +1,56 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: private SCM_RIGHTS exchange failed: {"name":"r0w0s0","flags":{"read":false,"write":false,"shell":false},"observed":{"started":true,"pid":5416,"private_unix":[true,true],"private_peer_checks":8,"private_peer_matches":true,"hardlink_created":false,"symlink_created":true,"private_aliases":[true,true],"rights":{"sent":true,"original_closed":true,"token":true,"truncated":false,"received":false,"same_inode":false,"readable":false,"written":false,"cloexec":false},"rights_path_replaced":true,"private_datagram":[true,true,true],"datagram_symlink_created":true,"datagram_race":{"private_control":true,"host_control":false,"settled":true,"failed":false,"attempts":16,"private_acks":8,"host_acks":0,"refused":8,"swaps":16,"failure_stage":"","failure_errno":0,"failure_return":null},"dgram_connect":{"connected":false,"sent":false,"acknowledged":false},"dgram_sendto":{"connected":false,"sent":false,"acknowledged":false},"dgram_sendmsg":{"connected":false,"sent":false,"acknowledged":false},"dgram_alias_connect":{"connected":false,"sent":false,"acknowledged":false},"dgram_alias_sendto":{"connected":false,"sent":false,"acknowledged":false},"dgram_alias_sendmsg":{"connected":false,"sent":false,"acknowledged":false},"direct":{"connected":false,"sent":false,"acknowledged":false},"hardlink":{"connected":false,"sent":false,"acknowledged":false},"symlink":{"connected":false,"sent":false,"acknowledged":false}},"rights_payload":"A","rights_link_count":0,"owner_receipts":0,"owner_received_fixture":false,"datagram_receipts":0,"owner_datagram_received_fixture":false}
++ actual - expected
+
+  {
++   cloexec: false,
+-   cloexec: true,
+    original_closed: true,
++   readable: false,
++   received: false,
++   same_inode: false,
+-   readable: true,
+-   received: true,
+-   same_inode: true,
+    sent: true,
+    token: true,
+    truncated: false,
++   written: false
+-   written: true
+  }
+
+    at check (file:///Users/runner/work/cybercode-cli/cybercode-cli/scripts/probes/plugin-confinement/macos_private_ipc.mts:142:10)
+    at file:///Users/runner/work/cybercode-cli/cybercode-cli/scripts/probes/plugin-confinement/macos_private_ipc.mts:207:5
+    at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: {
+    sent: true,
+    original_closed: true,
+    token: true,
+    truncated: false,
+    received: false,
+    same_inode: false,
+    readable: false,
+    written: false,
+    cloexec: false
+  },
+  expected: {
+    sent: true,
+    original_closed: true,
+    token: true,
+    truncated: false,
+    received: true,
+    same_inode: true,
+    readable: true,
+    written: true,
+    cloexec: true
+  },
+  operator: 'deepStrictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.2
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-missing-scope.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-missing-scope.log
new file mode 100644
index 00000000..5cfea37f
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-missing-scope.log
@@ -0,0 +1,20 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: macOS datagram endpoint escaped scratch: {"name":"r0w0s0","flags":{"read":false,"write":false,"shell":false},"observed":{"started":true,"pid":5259,"private_unix":[true,true],"private_peer_checks":8,"private_peer_matches":true,"hardlink_created":false,"symlink_created":true,"private_aliases":[true,true],"rights":{"sent":true,"original_closed":true,"token":true,"truncated":false,"received":true,"same_inode":true,"readable":true,"written":true,"cloexec":true},"rights_path_replaced":true,"private_datagram":[true,true,true],"datagram_symlink_created":true,"datagram_race":{"private_control":true,"host_control":true,"settled":true,"failed":false,"attempts":16,"private_acks":7,"host_acks":9,"refused":0,"swaps":17,"failure_stage":"","failure_errno":0,"failure_return":null},"dgram_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_alias_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"direct":{"connected":true,"sent":true,"acknowledged":true},"hardlink":{"connected":false,"sent":false,"acknowledged":false},"symlink":{"connected":true,"sent":true,"acknowledged":true}},"rights_payload":"AB","rights_link_count":0,"owner_receipts":2,"owner_received_fixture":true,"datagram_receipts":16,"owner_datagram_received_fixture":true}
+
+16 !== 0
+
+    at check (file:///Users/runner/work/cybercode-cli/cybercode-cli/scripts/probes/plugin-confinement/macos_private_ipc.mts:159:10)
+    at file:///Users/runner/work/cybercode-cli/cybercode-cli/scripts/probes/plugin-confinement/macos_private_ipc.mts:207:5
+    at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: 16,
+  expected: 0,
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.2
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-rights-path-reader.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-rights-path-reader.log
new file mode 100644
index 00000000..ca65fc85
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-rights-path-reader.log
@@ -0,0 +1,20 @@
+node:internal/modules/run_main:123
+    triggerUncaughtException(
+    ^
+
+AssertionError [ERR_ASSERTION]: received descriptor file effect: {"name":"unconfined","flags":{"read":true,"write":true,"shell":true,"unrestricted":true},"observed":{"started":true,"pid":5440,"private_unix":[true,true],"private_peer_checks":8,"private_peer_matches":true,"hardlink_created":true,"symlink_created":true,"private_aliases":[true,true],"rights":{"sent":true,"original_closed":true,"token":true,"truncated":false,"received":true,"same_inode":true,"readable":true,"written":true,"cloexec":true},"rights_path_replaced":true,"private_datagram":[true,true,true],"datagram_symlink_created":true,"datagram_race":{"private_control":true,"host_control":true,"settled":true,"failed":false,"attempts":16,"private_acks":7,"host_acks":9,"refused":0,"swaps":20,"failure_stage":"","failure_errno":0,"failure_return":null},"dgram_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_connect":{"connected":true,"sent":true,"acknowledged":true},"dgram_alias_sendto":{"connected":false,"sent":true,"acknowledged":true},"dgram_alias_sendmsg":{"connected":false,"sent":true,"acknowledged":true},"direct":{"connected":true,"sent":true,"acknowledged":true},"hardlink":{"connected":true,"sent":true,"acknowledged":true},"symlink":{"connected":true,"sent":true,"acknowledged":true}},"rights_payload":"XX","rights_link_count":0,"owner_receipts":3,"owner_received_fixture":true,"datagram_receipts":16,"owner_datagram_received_fixture":true}
+
+'XX' !== 'AB'
+
+    at check (file:///Users/runner/work/_temp/macos-rights-path-reader/macos_private_ipc.mts:146:10)
+    at file:///Users/runner/work/_temp/macos-rights-path-reader/macos_private_ipc.mts:207:5
+    at process.processTicksAndRejections (node:internal/process/task_queues:103:5) {
+  generatedMessage: false,
+  code: 'ERR_ASSERTION',
+  actual: 'XX',
+  expected: 'AB',
+  operator: 'strictEqual',
+  diff: 'simple'
+}
+
+Node.js v22.23.2
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-send-result-control.json b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-send-result-control.json
new file mode 100644
index 00000000..03675563
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-send-result-control.json
@@ -0,0 +1,79 @@
+{
+  "scope": "Deterministic fault-injected verifier regression, not native confinement acceptance.",
+  "sources": [
+    "macos_datagram_send.h",
+    "macos_datagram_send_test.c"
+  ],
+  "source_sha256": "53afe42b7a5657591f70ac305745a29ab7633b61c793f145a5d8b6a017eeddf3",
+  "legacy_source_sha256": "38f398f51a6a7ce4bed476a76d8cffb1236c53f160a36c6711e1c74889cb8292",
+  "fixed": [
+    {
+      "case": "zero-stale-EPERM",
+      "attempted": 1,
+      "calls": 1,
+      "returned": 0,
+      "error": 0,
+      "outcome": "E",
+      "stage": "send_size",
+      "has_return": 1
+    },
+    {
+      "case": "short-stale-EACCES",
+      "attempted": 1,
+      "calls": 1,
+      "returned": 7,
+      "error": 0,
+      "outcome": "E",
+      "stage": "send_size",
+      "has_return": 1
+    },
+    {
+      "case": "failed-EACCES",
+      "attempted": 1,
+      "calls": 1,
+      "returned": -1,
+      "error": 13,
+      "outcome": "D",
+      "stage": "",
+      "has_return": 0
+    },
+    {
+      "case": "failed-EPERM",
+      "attempted": 1,
+      "calls": 1,
+      "returned": -1,
+      "error": 1,
+      "outcome": "D",
+      "stage": "",
+      "has_return": 0
+    },
+    {
+      "case": "failed-EINVAL",
+      "attempted": 1,
+      "calls": 1,
+      "returned": -1,
+      "error": 22,
+      "outcome": "E",
+      "stage": "send",
+      "has_return": 1
+    },
+    {
+      "case": "setup-with-stale-EPERM",
+      "attempted": 0,
+      "calls": 0,
+      "outcome": "E",
+      "stage": "send_setup",
+      "has_return": 0
+    }
+  ],
+  "invalid_legacy_guard": {
+    "case": "zero-stale-EPERM",
+    "attempted": 1,
+    "calls": 1,
+    "returned": 0,
+    "error": 1,
+    "outcome": "D",
+    "stage": "",
+    "has_return": 0
+  }
+}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-stale-errno-guard.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-stale-errno-guard.log
new file mode 100644
index 00000000..0ca8db30
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-stale-errno-guard.log
@@ -0,0 +1,2 @@
+send-result regression failed: zero-stale-EPERM
+{"case":"zero-stale-EPERM","attempted":1,"calls":1,"returned":0,"error":1,"outcome":"D","stage":"","has_return":0}
diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-zero-send.log b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-zero-send.log
new file mode 100644
index 00000000..3f64213d
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/evidence/macos-send-result-62a3068e/x64/unix-zero-send.log
@@ -0,0 +1,6 @@
+{"case":"zero-stale-EPERM","attempted":1,"calls":1,"returned":0,"error":0,"outcome":"E","stage":"send_size","has_return":1}
+{"case":"short-stale-EACCES","attempted":1,"calls":1,"returned":7,"error":0,"outcome":"E","stage":"send_size","has_return":1}
+{"case":"failed-EACCES","attempted":1,"calls":1,"returned":-1,"error":13,"outcome":"D","stage":"","has_return":0}
+{"case":"failed-EPERM","attempted":1,"calls":1,"returned":-1,"error":1,"outcome":"D","stage":"","has_return":0}
+{"case":"failed-EINVAL","attempted":1,"calls":1,"returned":-1,"error":22,"outcome":"E","stage":"send","has_return":1}
+{"case":"setup-with-stale-EPERM","attempted":0,"calls":0,"outcome":"E","stage":"send_setup","has_return":0}
diff --git a/openspec/changes/complete-plugin-hook-runtime/file-observation-acceptance.md b/openspec/changes/complete-plugin-hook-runtime/file-observation-acceptance.md
new file mode 100644
index 00000000..9f481662
--- /dev/null
+++ b/openspec/changes/complete-plugin-hook-runtime/file-observation-acceptance.md
@@ -0,0 +1,93 @@
+# FileChanged acceptance audit
+
+Task 5.2 is implemented and under final acceptance review. This audit does not
+close native plugin enforcement, the remaining producers, or the full goal.
+
+## Requirements and direct evidence
+
+| Requirement | Production path and regression evidence | Current result |
+| --- | --- | --- |
+| Built-in and formatter effects | `tool_hooks.rs`/`owner.rs`; `builtin_write_and_edit_produce_observations_without_language_services`, `native_formatter_settlement_produces_a_file_observation` | Composed platform suite passes. |
+| External, foreground and background edits; rename/delete | `native.rs`/`scan.rs`/`owner.rs`; `native_owner_delivers_external_edits_rename_removal_to_shared_sessions_and_joins`, `native_foreground_and_background_shell_writes_are_observed_after_the_turn` | Composed platform suite passes. |
+| Bounded observation, queue loss, partial inventory and recovery | Native queue/registration component cases; real-runtime `location_limit_is_visible_without_disabling_other_location_observations`, `session_limit_is_visible_and_released_membership_admits_a_waiting_session`, `directory_registration_limit_is_visible_and_reconciliation_covers_its_tail`, `long_path_inventory_publishes_a_partial_baseline_and_keeps_existing_files_live` | Composed platform suite passes; incomplete coverage remains visible and is not treated as absence. |
+| Private state, symlinks and hard-link scope | Pinned root/private identities, no-follow metadata scanner and link accounting; actual AppHost moved-private-root check, `hard_link_scope_allows_owned_aliases_and_suppresses_private_state_aliases`, both known-private retirement HTTP regressions | Composed platform suite passes. |
+| Session scope, aliases and current project identity | Native leases, writer-validated scope records and admission-time physical input; alias-first sharing, root replacement, archive/resume and idle return regressions | Spelling aliases and both retarget/unused-old-ack cases pass on Linux, macOS and Windows at 01535d49. |
+| Feedback, deduplication and unknown-effect recovery | Durable finite credit and owned user-ack validation; `hook_writes_stop_at_the_durable_feedback_limit_after_quiet_time`, `native_owner_feedback_renews_only_for_new_committed_user_input`, exhausted-credit/restart and unknown-handler Store regressions | Composed platform suite passes; quiet time or replay cannot manufacture renewal. |
+| Cancellation and bounded resource lifetime | Per-membership cancellation, held-batch identity, joined scanner/observer shutdown and pending-owner reuse; all held-member HTTP cases and `readmission_reuses_one_pending_replacement_until_previous_owner_settles` | Composed platform suite passes; Linux missing-fix controls also pass their required failure assertions. |
+
+These refer to the real suites in `cyber-tools/tests/file_observation_dispatch.rs`,
+`cyber-server/tests/file_observations.rs`, their native component modules and
+`cyber-app/src/host/tests.rs`, executed by the focused workflow. They are not
+claims based solely on test names: the workflow results, actual checkout and
+source composition are inspected separately. Native observations supply metadata
+and scoped handler admission, never permission or authenticated writer identity.
+
+## Platform evidence and outstanding check
+
+The [verified job receipt](evidence/file-observation-3f7067dd.json) records actual
+checkout checks, original log hashes, suite counts and platform exclusions.
+Linux/macOS ran 24 HTTP and 17 Store/runtime cases; Windows ran 23 and 16.
+The omitted cases are the two retarget tests extended by this increment.
+Unix parent suites intentionally ignore subprocess entry helpers that their
+SQLite-lock regressions invoke separately; Windows omits Unix-specific components.
+
+[Run 41180219218](https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41180219218)
+passes Linux, macOS and Windows at exact head
+`3f7067dd058b91c11320c99c556b60451b103098`, after the main integrations. The
+subsequent `62a3068e` correction changes only confinement probes, their workflow
+and documentation; all Rust/Cargo inputs remain identical. The earlier d689d2f3
+platform results are historical and do not by themselves prove this composition.
+
+The audit found that `unused_user_acknowledgement_cannot_follow_a_retargeted_alias`
+and `symlink_retarget_loses_old_delivery_and_user_input_admits_the_new_physical_scope`
+were Unix-only. They now use native directory symlinks and correct link removal
+on Windows as well. Their assertions remain unchanged: old-root delivery and an
+unused old-root acknowledgement must lose authority, while fresh owned input
+admits the new physical root and project identity. Creating/removing the alias
+uses filesystem APIs, not a shell command or a recursive target deletion.
+
+The [new platform run](https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41203255017)
+passes all three platforms at `01535d49e7a454536fdf66e788567e7442eb01c7`.
+The [verified receipt](evidence/file-observation-01535d49.json) binds each actual
+checkout and original log hash, and explicitly confirms both named tests executed
+and passed on every platform. Windows now runs 17 Store/runtime and 24 HTTP cases,
+matching the corresponding Unix suites. This is actual Windows execution, not
+cross-compilation or an optional skip. Local Windows execution was unavailable.
+
+Current-source relevant PR checks and final merge review remain required before
+task 5.2 is closed. Parent plugin/native support and other producer tasks stay open.
+
+## Review and local checks
+
+This increment changes two test adapters and documents acceptance evidence; it
+changes no production permissions, receipt format or alias admission behavior.
+Review checked that Windows removal deletes only the directory symlink, that the
+old-root refusal and fresh-root positive assertions remain, and that neither a
+link-creation error nor an absent Windows test is reported as acceptance. No
+blocking code/security findings remain in the local diff.
+
+The two named regressions pass on macOS arm64. Scoped Clippy with warnings
+denied passes both actual test targets (`cyber-server --test file_observations`
+and `cyber-tools --test file_observation_dispatch`); Rust formatting and whitespace
+checks pass. Strict OpenSpec passes 114 items; spec lint reports zero errors and
+25 warnings. The subsequent native platform run above verifies the revised tests
+on Linux/macOS/Windows. It retains the existing intentional Unix subprocess-helper
+parent ignores and platform-specific component counts explicitly in the receipt.
+
+## Superseded workspace run and bounded attempts
+
+The old [Linux workspace job](https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41207519002/job/124555564239)
+was cancelled by the CI concurrency policy after PR #85 required a task-ledger
+conflict resolution against merged main. Its log reports
+`messages_cli::stats_separate_message_driven_usage` still running beyond 9,180
+seconds; cancellation supplies no completed assertion result or proven cause.
+The same named case passed in PR #87's Linux/macOS runs (4.464/1.850 seconds),
+which also does not establish why the earlier attempt stalled.
+
+The `ci` nextest profile now uses the existing `ci-windows` ten-minute
+per-attempt slow timeout. The existing single retry is retained, so a retried
+case can consume two attempts. Timeouts remain failures; this bounds future
+stalls without claiming an application deadlock fix or FileChanged acceptance.
+The largest reported passing-test times in those PR #87 runs were 99.147 seconds
+on Linux and 75.484 on macOS. Current-revision CI and final review remain
+required before task 5.2 closes.
diff --git a/openspec/changes/complete-plugin-hook-runtime/file-observation-implementation.md b/openspec/changes/complete-plugin-hook-runtime/file-observation-implementation.md
index 90d6bb93..4ad1c9b8 100644
--- a/openspec/changes/complete-plugin-hook-runtime/file-observation-implementation.md
+++ b/openspec/changes/complete-plugin-hook-runtime/file-observation-implementation.md
@@ -6,6 +6,13 @@ this is not an event without a producer. The #76 foundations milestone merged at
 contract. The [goal delivery record](../../../docs/goal-delivery.md) distinguishes
 that milestone from native plugin activation and the remaining producer work.
 
+The [acceptance audit](file-observation-acceptance.md) now records the complete
+producer contract and composed native results. At `01535d49`, Linux/macOS/Windows
+pass the full focused workflow, including both formerly Unix-only alias-retarget
+cases, 17 Store/runtime cases and 24 HTTP cases on every platform. Relevant PR
+checks and final merge review remain required before closing task 5.2. The
+sections below retain historical implementation and incremental results.
+
 The [pending-owner correction](file-observation-pending-owner.md) passed 58
 file-observation library tests and 24 actual HTTP lifecycle tests locally,
 including after integration with main at `550e9b39`. Its missing-fix control
diff --git a/openspec/changes/complete-plugin-hook-runtime/macos-send-result-validation.md b/openspec/changes/complete-plugin-hook-runtime/macos-send-result-validation.md
index ca6b7727..01680c6a 100644
--- a/openspec/changes/complete-plugin-hook-runtime/macos-send-result-validation.md
+++ b/openspec/changes/complete-plugin-hook-runtime/macos-send-result-validation.md
@@ -112,3 +112,27 @@ failed); spec lint (zero errors, 25 warnings). The evidence report source hashes
 were independently recomputed against the actual fixture bytes. No Rust tests
 were run for this probe-only change. Hosted macOS arm64/x64 and the configured
 Linux checks have not yet been run on this revision.
+
+## Corrected hosted result at 62a3068e
+
+Both [Intel](https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41202794586/job/124541776102)
+and [arm64](https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41202794586/job/124541775744)
+native signing jobs pass all eight steps. Each has nine real IPC cases and all
+six deterministic send-result cases, plus the precise missing-guard failure and
+original scope, scratch, descriptor and path controls. No native assertion,
+unknown-error rule or concurrent mutation was relaxed, and no retry was added.
+
+Original reports and logs are retained under
+`evidence/macos-send-result-62a3068e/{x64,arm64}`. Downloaded archive digests
+match GitHub metadata. Both actual tested merges have tree
+`e3d7bbf7b2d76bbc4c309ed14e6931198a4aa865`, equal to source head
+`62a3068e14ab0d54e980f21848a1c3a21af93597`. All declared IPC, native matrix,
+signing/exec and deterministic fixed/legacy source manifests were independently
+recomputed from those Git bytes. The six fixed cases and the invalid legacy
+classification were inspected separately from the real IPC positive evidence.
+
+This accepts the verifier correction for the named platform runs. The historical
+unknown native race cause remains unresolved, and full IPC/runtime compatibility,
+production native admission and the Linux design decision remain open. The
+remaining broad PR checks and merge review are recorded separately; these native
+results do not imply they completed.
diff --git a/openspec/changes/complete-plugin-hook-runtime/tasks.md b/openspec/changes/complete-plugin-hook-runtime/tasks.md
index 6c5bd4b3..05521751 100644
--- a/openspec/changes/complete-plugin-hook-runtime/tasks.md
+++ b/openspec/changes/complete-plugin-hook-runtime/tasks.md
@@ -55,10 +55,13 @@ also have source-bound native receipts. Its [trusted-worker capacity/recovery ca
 passed on x64/arm64 in run 41049265434, with source-bound receipts retained. These
 experiments change no production policy or accepted support floor.
 
-The [raw datagram send-result correction](macos-send-result-validation.md) adds a
-real copied-fixture regression for stale errno after a zero return and retains
-current-source local evidence. Hosted verification and native admission remain
-required; this correction does not close tasks 2.1–2.4.
+The [raw datagram send-result correction](macos-send-result-validation.md) retains
+raw syscall results and tests the shared verifier helpers with six deterministic
+fault-injection cases and a precise missing-guard control. Both corrected hosted
+macOS jobs at `62a3068e` passed those controls and the unchanged real IPC matrix.
+The control is verifier evidence, not native confinement acceptance. The historical
+unknown race cause and production native admission remain open; this correction
+does not close tasks 2.1–2.4.
 
 ## 3. Host contribution lifecycle
 
@@ -92,6 +95,11 @@ Unix-only and hosted acceptance remains required; task 5.3 stays open.
 
 Task 5.2 is in progress. The full focused suite at `3e852288` passed Linux/macOS/Windows. At `c0cc40e3`, complete Linux/Windows jobs also passed all 18 HTTP/runtime scenarios, including idle-return ownership, archive/resume and native burst recovery; macOS remained queued. Review then reproduced an oversized metadata baseline within the count/path limits. The new publication/batch byte-budget fix passes 63 local source-library tests and scoped Clippy, and its focused owner/application regression workflow at `5aa08018` now passes on Linux/macOS/Windows. Combined producer acceptance is pending on this integration branch. Remaining resource/lifecycle acceptance, broader workspace checks and substantive review are still open. See [the scope integration design](file-observation-scope-design.md) and [implementation notes](file-observation-implementation.md).
 
+The [DirectoryAdded prerequisite proposal](directory-added-design.md) maps the
+unimplemented additional-directory owner operation to permission, sandbox and
+Context Source publication at a Safe Boundary. Tasks D1–D6 require review and
+implementation; no standalone emitter or successful addition is claimed.
+
 Setup ownership is expanded in [setup-design.md](setup-design.md). Its Store
 epoch and exact-directory marker choices are proposed for review; marker/schema
 and init behavior are not implemented by this specification. Tasks S1–S6 there
@@ -115,3 +123,11 @@ The [pending observer owner correction](file-observation-pending-owner.md) bound
 remove/readmit replacement behind a settling owner while retaining cancellation
 and joined shutdown. Focused and platform acceptance remain required; task 5.2
 stays open.
+
+## FileChanged acceptance after main integration
+
+Task 5.2 is in progress. The [acceptance audit](file-observation-acceptance.md) maps the full producer contract to actual native/runtime evidence and records verified Windows retarget coverage and the remaining PR/merge acceptance.
+
+PR #85 now incorporates the accepted Setup design and CwdChanged regression from
+main. Fresh checks of this composed revision and final merge review remain
+required; the earlier focused receipts do not close task 5.2 by themselves.