Constraint: Finder launch must supervise Java and ngrok in one visible Terminal Rejected: LaunchAgent | obscures ownership and makes safe cleanup harder Confidence: high Scope-risk: narrow Directive: Never kill listeners not recorded as launcher-owned PIDs Tested: Shell unit suite, repeat-start reuse, cold start, local/public login and protected API smoke Not-tested: Finder Gatekeeper behavior on a different Mac