Open credential files with O_NOFOLLOW, validate and read the same descriptor, and reject pathname substitutions. Record lock dev/ino alongside mtime locally without changing Pi's proper-lockfile on-disk protocol; check these before renewal, release, and normal-exit cleanup. Report release-discovered compromise and retain the before-rename write fence. Document the remaining non-atomic stat-to-operation race.

Add deterministic read swaps, stale successor and colliding-mtime lease tests plus nine version-neutral mutation rows. Existing tests retain their contracts; mutation substitutions and anchors were updated for internal hooks and directory identity tracking. The acquisition-bypass mutant borrows the observed identity so the new release fence does not mask the original exclusion failure.