[nniiovoo]

Protected Companion launches could publish delegated authority before owning the listener, reuse standalone tokens, and race token cleanup with a successor launch. Bind before publication, issue a fresh token per launch, hold the listener through owned-token cleanup, and keep provider admission closed until publication validation and the final grant check finish.

Also close the earlier reviewed local handling gaps:

• Replace Agent Key files through a fresh private inode so a descriptor opened before replacement cannot read the new key.
• Refresh foreground state from the latest focus flag while holding the core mutex before Show/Copy authorization.
• Publish Emergency Reader builds exclusively, refusing existing files, links and special files; create new key-input examples with mktemp.
• Record product UI direction and accessibility requirements for subsequent private Agent Key work.

Regression coverage includes competing starts, stale cleanup, publication failures, cancellation, retained descriptors, delayed focus loss and late output-path creation. No dependencies, entitlement changes, provider-policy changes or new Vault/WebView networking.

Validation: fresh ./scripts/check.sh passed on head 28a010cf47c7610f08bdbec4cea050603e6a249b: Rust tests/fmt/clippy, all 98 Companion tests and 4 Reader-publication tests with no failures/skips, Swift helper typecheck, secret scan, entitlement/policy pins, network/import checks, cargo-deny and production TypeScript/Vite build. Independent scoped and final integration reviews found no open merge-blocking findings. All development uses fictional data. An initial run correctly refused fixtures under the shared system temporary directory; the successful run used a preflight-verified private folder with protected ancestors, without changing source or weakening checks.

Scope: this PR does not implement encrypted native Agent Key entry or the new ChatGPT setup tools. The fictional native encryption/Touch ID proof and later integration remain pending. Existing plaintext custody and unverified account, tunnel and provider controls remain disclosed. Local plans and the fictional prototype remain ignored and preserved in the worktree.