[4/4] Enforce per-session mount security transactions - #20

Review status and dependency

Summary

This final PR hardens installation, discovery, external-unmount recovery, and privileged PF/VPN cleanup around a per-mount security transaction.

Its relative contribution after #19:

• replaces signed runtime files atomically instead of mutating live installed binaries in place;
• combines filesystem discovery probes so GUI refreshes do not serialize avoidable subprocess delays;
• reconciles externally removed mounts and keeps cleanup retryable when lower-layer teardown is incomplete;
• gives every root mount its own measured PF anchor, PF enable reference, and optional exact VPN-bypass route;
• tears down only resources owned by that session and fails closed when ownership/effective state cannot be proven;
• adds reason-coded tests, live verification helpers, and documentation for both proven and still-open hardware gates.

Motivation and root causes

Installed runtime replacement

Replacing a signed helper or runtime file in place can leave a partially written or signature-invalid executable if installation is interrupted. The installed destination should only change after a complete staged replacement has been validated.

Discovery and external unmounts

Drive/filesystem discovery used independent subprocess probes that could compound latency. Separately, Finder or command-line unmounts can remove the kernel mount without passing through the app's normal teardown path, leaving backend/PF/route cleanup pending. The GUI must reflect kernel truth promptly while retaining enough state to retry owned cleanup.

PF/VPN ownership

PF enablement, child anchors, and VPN-bypass routes are host-global facilities shared by potentially concurrent mounts and unrelated software. Cleanup cannot safely flush broad PF state, delete a default route, or release another active mount's resources. Each mount therefore needs explicit ownership plus measured effective-state checks before it can be reported ready.

Implementation

Atomic signed-runtime installation

• Stages replacement files beside the destination.
• Verifies the staged artifact before the final rename.
• Uses an atomic replacement boundary so interruption does not expose a partially written runtime.
• Extends package/install tests for failure and replacement behavior.

Combined discovery and external teardown

• Runs compatible filesystem discovery probes together and merges their results deterministically.
• Keeps the main actor responsive and preserves existing bounded-probe behavior.
• Detects when an expected kernel mount disappears outside the app.
• Requests cleanup through the privileged helper while keeping unresolved cleanup retryable rather than reporting a false clean state.

Per-session security transaction

• Creates a unique transaction and PF child anchor for each root mount.
• Acquires and records the PF enable reference owned by that transaction.
• Adds only an exact VPN-bypass route when the measured routing state requires it.
• Verifies anchor, PF, route, private endpoint, and NFS readiness evidence before mount completion.
• Releases only the transaction's exact route, child anchor, and PF reference during unmount, rollback, uninstall, or retry.
• Never flushes global PF rules and never deletes a default route.
• Keeps cleanup fail-closed and retryable when effective ownership cannot be demonstrated.

Evidence boundaries

• CLI/live gates expose privacy-safe reason codes rather than raw network or device identity.
• The GUI's three SECURITY rows intentionally remain unknown until the reason-coded transaction evidence is wired into that presentation. Lower-layer enforcement is tested, but the UI does not manufacture a green claim.

Compatibility and safety

• The SMJobBless XPC helper remains the privilege boundary for GUI operations.
• Device identifiers remain allow-listed before shell invocation.
• NFS remains private-vmnet-only and soft; no SMB, loopback fallback, or hard mount is introduced.
• ntfs-3g remains the default filesystem driver; ntfs3 remains opt-in.
• Concurrent sessions cannot intentionally release each other's PF or route resources.
• Existing app signing remains ad hoc; this PR does not claim notarization.

Verified testing

Validated on the exact submitted cumulative tip 2f7e509e90192e84afc4bd290f9a9ea714942fe4:

• GitHub CI passed: ShellCheck + Bats, Swift build/tests, and vendored Cargo tests
• 263/263 Bats tests passed via the full shell test suite
• 222/222 Swift tests passed
• ShellCheck passed for every tracked shell script and .command file
• complete GUI source build passed, including Rust tests and vendored-source verification
• packaged arm64 application signature verification passed
• DMG verification passed
• verified DMG SHA-256: d9b7b53ef03dc8965233e0ccbb242fbc0d90ee8004c1e0459697db059c898e6a
• relative delta: 36 files changed, 2,534 insertions, 327 deletions
• added-line audit found no BinaryBears roadmap, branding, screenshot, or origin/dev references
• range-diff confirmed all five relative commits are patch-equivalent to the originally reviewed series; the only inherited tree change is the deterministic predecessor test

Hardware evidence and remaining gates

The packaged NTFS/VPN-on transaction path has recorded hardware evidence. That evidence does not close the full release matrix.

The following scenarios remain explicit release gates and must be rerun on the refreshed final candidate:

• VPN off;
• concurrent physical drives/sessions;
• restart and crash recovery;
• physical hot-unplug and subsequent cleanup/retry.

Series order

1. [1/4] Pin the Alpine runtime and report installed state #17 — immutable Alpine runtime and installed-state diagnostics
2. [2/4] Make mount state and NFS transport authoritative #18 — authoritative mount state and NFS transport
3. [3/4] Add an audited anylinuxfs update workflow #19 — audited anylinuxfs update workflow
4. This PR — per-session security transactions and cleanup hardening