@@ -311,7 +311,10 @@ The CI Coverage job runs the suite through `pnpm test:coverage:ci`
   runner (`scripts/vitest-runner-timeout-setup.ts`, a setup file on every project): the runner owns
   the controller behind `context.signal` and aborts it with the timeout error it raises, so a test
   that merely *throws* the exact timeout message — immediately, or after blocking the event loop past
-  its budget — never carries the mark. Error text is never consulted for eligibility;
+  its budget — never carries the mark. `task.meta` is writable by test code, so the mark is not a
+  flag but the run's secret: the lane mints it per run, and the setup file takes it out of the
+  environment as it loads — before any test module is imported — so a test writing the marker itself
+  has no value to write. Error text is never consulted for eligibility;
   `test/contention-retry-fixtures/` drives those forgeries through a real Vitest run in the gate. One
   assertion failure — in a listed file or not — fails the job on the first run, so a real regression
   can never be papered over.
 
@@ -15,7 +15,7 @@ import contentionRetryReporter, {
   runBlockers,
   writeFailureReport,
 } from './contention-retry-reporter.ts';
-import { RUNNER_TIMEOUT_META } from './runner-timeout-meta.ts';
+import { RUNNER_TIMEOUT_META, RUNNER_TIMEOUT_TOKEN_ENV } from './runner-timeout-meta.ts';
 import {
   CONTENTION_RETRY_FILES,
   expiredRetryEntries,
@@ -54,8 +54,11 @@ function assertionFailure(overrides: Partial<TestFailure> = {}): TestFailure {
   return failure({ message: ASSERTION_MESSAGE, timeout: false, ...overrides });
 }
 
+/** The run's secret, minted by the lane and never visible to a test module. */
+const TOKEN = 'a4ec0a4a-0f77-4f2e-9d4a-6d7f1d3f0d21';
+
 /** What the runner-timeout setup file writes on a test the runner aborted. */
-const RUNNER_ABORTED = { [RUNNER_TIMEOUT_META]: true };
+const RUNNER_ABORTED = { [RUNNER_TIMEOUT_META]: TOKEN };
 
 function testCaseStub(
   errors: ReadonlyArray<Record<string, unknown>>,
@@ -152,26 +155,34 @@ test('the expiry gate fails the run before any test executes', async () => {
 });
 
 test('only the runner-owned abort mark classifies a failure as a timeout', () => {
-  assert.ok(isRunnerTimeout([VITEST_TIMEOUT], RUNNER_ABORTED));
+  assert.ok(isRunnerTimeout([VITEST_TIMEOUT], RUNNER_ABORTED, TOKEN));
+  // `task.meta` is test-writable, so a mark that is not the run's secret is worthless.
+  for (const forged of [true, 'true', 'agentDeviceRunnerTimeout', '', undefined]) {
+    assert.ok(!isRunnerTimeout([VITEST_TIMEOUT], { [RUNNER_TIMEOUT_META]: forged }, TOKEN));
+  }
+  // No secret configured means nothing is eligible.
+  assert.ok(!isRunnerTimeout([VITEST_TIMEOUT], RUNNER_ABORTED, undefined));
+  assert.ok(!isRunnerTimeout([VITEST_TIMEOUT], RUNNER_ABORTED, ''));
   // Without the runner's mark, no message and no error shape can earn a retry.
   for (const impostor of [
     { name: 'Error', message: VITEST_TIMEOUT.message },
     { name: 'AssertionError', message: VITEST_TIMEOUT.message },
     { name: 'Error', message: 'connect ETIMEDOUT 127.0.0.1:8080' },
     { name: 'Error', message: 'Closing timeout while tearing down the daemon' },
   ]) {
-    assert.ok(!isRunnerTimeout([impostor], {}), `${impostor.name}: ${impostor.message}`);
-    assert.ok(!isRunnerTimeout([impostor], undefined));
-    assert.ok(!isRunnerTimeout([impostor], { [RUNNER_TIMEOUT_META]: 'yes' }));
+    assert.ok(!isRunnerTimeout([impostor], {}, TOKEN), `${impostor.name}: ${impostor.message}`);
+    assert.ok(!isRunnerTimeout([impostor], undefined, TOKEN));
+    assert.ok(!isRunnerTimeout([impostor], { [RUNNER_TIMEOUT_META]: 'yes' }, TOKEN));
   }
   // An aborted test that also produced an assertion diff is a regression.
   assert.ok(
     !isRunnerTimeout(
       [VITEST_TIMEOUT, { name: 'AssertionError', message: 'x', expected: 1, actual: 2 }],
       RUNNER_ABORTED,
+      TOKEN,
     ),
   );
-  assert.ok(!isRunnerTimeout([], RUNNER_ABORTED));
+  assert.ok(!isRunnerTimeout([], RUNNER_ABORTED, TOKEN));
 });
 
 test('a real Vitest run marks only runner-aborted tests as retry-eligible', () => {
@@ -181,7 +192,11 @@ test('a real Vitest run marks only runner-aborted tests as retry-eligible', () =
   fs.rmSync(report, { force: true });
   runCmdSync('pnpm', ['exec', 'vitest', 'run', '--config', FIXTURE_CONFIG], {
     cwd: repoRoot,
-    env: { ...process.env, CONTENTION_RETRY_FAILURES: report },
+    env: {
+      ...process.env,
+      CONTENTION_RETRY_FAILURES: report,
+      [RUNNER_TIMEOUT_TOKEN_ENV]: TOKEN,
+    },
     allowFailure: true,
   });
   const { failures } = parseFailureReport(JSON.parse(fs.readFileSync(report, 'utf8')), repoRoot);
@@ -193,6 +208,11 @@ test('a real Vitest run marks only runner-aborted tests as retry-eligible', () =
     'timeout message thrown after blocking the event loop past the budget': false,
     'assertion failure after blocking the event loop past the budget': false,
     'plain assertion failure': false,
+    // `task.meta` is test-writable, but the mark is the run's secret and the
+    // setup file takes it out of the environment before any test module loads.
+    'test writes the provenance marker itself': false,
+    'test writes the marker after blocking the event loop past the budget': false,
+    'test writes the marker from the environment it can still read': false,
   });
   // Only the genuine timeout may reach a rerun.
   const listed = failures.map((entry) => ({ ...entry, file: LISTED }));
@@ -206,6 +226,7 @@ test('an assertion message quoting a timeout still fails on the first run', asyn
     testCaseStub([{ name: 'AssertionError', message: VITEST_TIMEOUT.message }], {
       meta: {},
     }) as never,
+    TOKEN,
   );
   assert.ok(impostor);
   assert.equal(impostor.timeout, false);
@@ -222,19 +243,20 @@ test('a test that timed out AND failed an assertion is not retry-eligible', () =
       VITEST_TIMEOUT,
       { name: 'AssertionError', message: 'expected 1 to be 2', expected: 2, actual: 1 },
     ]) as never,
+    TOKEN,
   );
   assert.equal(mixed?.timeout, false);
 });
 
 test('the lane reporter keeps the real error message a timeout is classified by', () => {
-  const failed = failedTestCase(testCaseStub([VITEST_TIMEOUT]) as never);
+  const failed = failedTestCase(testCaseStub([VITEST_TIMEOUT]) as never, TOKEN);
   assert.deepEqual(failed, {
     file: `${repoRoot}/${LISTED}`,
     testName: 'opens a session',
     message: TIMEOUT_MESSAGE,
     timeout: true,
   });
-  assert.equal(failedTestCase(testCaseStub([], { state: 'passed' }) as never), null);
+  assert.equal(failedTestCase(testCaseStub([], { state: 'passed' }) as never, TOKEN), null);
 
   const target = path.join(repoRoot, '.tmp/contention-retry/reporter-gate.json');
   writeFailureReport({ failures: [failure()], blockers: [] }, target);
 
@@ -8,21 +8,22 @@ import path from 'node:path';
 import type { Reporter, TestCase, TestModule } from 'vitest/node';
 import { isRunnerTimeout, type RunBlocker, type TestFailure } from './contention-retry.ts';
 import { drainRunBlockers } from './run-blocker-bus.ts';
+import { RUNNER_TIMEOUT_TOKEN_ENV } from './runner-timeout-meta.ts';
 
 export const FAILURE_FILE_ENV = 'CONTENTION_RETRY_FAILURES';
 
 export type FailureReport = { failures: TestFailure[]; blockers: RunBlocker[] };
 
 /** The failed-test view of a Vitest test case, or null when it did not fail. */
-export function failedTestCase(testCase: TestCase): TestFailure | null {
+export function failedTestCase(testCase: TestCase, token: string | undefined): TestFailure | null {
   const result = testCase.result();
   if (result.state !== 'failed') return null;
   const errors = result.errors ?? [];
   return {
     file: (testCase.module as TestModule).moduleId,
     testName: testCase.fullName,
     message: errors.map((error) => `${error.name}: ${error.message}`).join('\n'),
-    timeout: isRunnerTimeout(errors, testCase.meta()),
+    timeout: isRunnerTimeout(errors, testCase.meta(), token),
   };
 }
 
@@ -59,7 +60,7 @@ export default function contentionRetryReporter(): Reporter {
   const failures: TestFailure[] = [];
   return {
     onTestCaseResult(testCase: TestCase): void {
-      const failed = failedTestCase(testCase);
+      const failed = failedTestCase(testCase, process.env[RUNNER_TIMEOUT_TOKEN_ENV]);
       if (failed) failures.push(failed);
     },
     onTestRunEnd(
 
@@ -14,6 +14,7 @@ import { runCmdStreaming, runCmdSync } from '../../src/utils/exec.ts';
 import { parseScriptArgs } from './cli-args.ts';
 import { runWithContentionRetry, type TestRun } from './contention-retry-lane.ts';
 import { FAILURE_FILE_ENV } from './contention-retry-reporter.ts';
+import { RUNNER_TIMEOUT_TOKEN_ENV } from './runner-timeout-meta.ts';
 import { processBlockers } from './contention-retry-blockers.ts';
 import { parseFailureReport, type RunBlocker, type TestFailure } from './contention-retry.ts';
 
@@ -42,6 +43,9 @@ const reportPath = path.resolve(repoRoot, args.report);
 const envelopePath = path.resolve(repoRoot, args.envelope);
 const summaryPath = args.summary ?? process.env.GITHUB_STEP_SUMMARY;
 
+/** The capability the runner needs to mark a timeout; test modules never see it. */
+const TIMEOUT_TOKEN = crypto.randomUUID();
+
 async function runVitest(extra: string[], report: string): Promise<TestRun> {
   fs.mkdirSync(path.dirname(report), { recursive: true });
   fs.rmSync(report, { force: true });
@@ -52,7 +56,7 @@ async function runVitest(extra: string[], report: string): Promise<TestRun> {
   };
   const result = await runCmdStreaming('pnpm', ['exec', 'vitest', 'run', ...extra], {
     cwd: repoRoot,
-    env: { ...process.env, [FAILURE_FILE_ENV]: report },
+    env: { ...process.env, [FAILURE_FILE_ENV]: report, [RUNNER_TIMEOUT_TOKEN_ENV]: TIMEOUT_TOKEN },
     allowFailure: true,
     onStdoutChunk: (chunk) => capture(chunk, (text) => process.stdout.write(text)),
     onStderrChunk: (chunk) => capture(chunk, (text) => process.stderr.write(text)),
 
@@ -195,8 +195,12 @@ export type ReportedError = {
 };
 
 /** A test the runner aborted at its timeout — the only failure this lane retries. */
-export function isRunnerTimeout(errors: readonly ReportedError[], meta: unknown): boolean {
-  return runnerTimedOut(meta) && errors.length > 0 && errors.every(hasNoAssertionDiff);
+export function isRunnerTimeout(
+  errors: readonly ReportedError[],
+  meta: unknown,
+  token: string | undefined,
+): boolean {
+  return runnerTimedOut(meta, token) && errors.length > 0 && errors.every(hasNoAssertionDiff);
 }
 
 /** A timeout that also failed an assertion is a regression, not contention. */
 
@@ -1,9 +1,24 @@
 // The provenance mark the runner-timeout setup file writes on a test, and the
 // contention retry lane (#1419) reads back through `TestCase.meta()`.
+//
+// `task.meta` is writable by test code, so the mark is not a boolean but a
+// per-run secret the lane generates. Setup files are imported before any test
+// module, and the setup file takes the secret out of the environment as it
+// loads, so no test body can read the value it would have to forge.
 
 export const RUNNER_TIMEOUT_META = 'agentDeviceRunnerTimeout';
 
+export const RUNNER_TIMEOUT_TOKEN_ENV = 'CONTENTION_RETRY_TIMEOUT_TOKEN';
+
+/** Reads the run's secret and removes it from `env`, leaving nothing for a test to find. */
+export function takeRunnerTimeoutToken(env: NodeJS.ProcessEnv): string | undefined {
+  const token = env[RUNNER_TIMEOUT_TOKEN_ENV];
+  delete env[RUNNER_TIMEOUT_TOKEN_ENV];
+  return token;
+}
+
 /** True when the runner itself aborted the test with its own timeout error. */
-export function runnerTimedOut(meta: unknown): boolean {
-  return (meta as Record<string, unknown> | undefined)?.[RUNNER_TIMEOUT_META] === true;
+export function runnerTimedOut(meta: unknown, token: string | undefined): boolean {
+  if (!token) return false;
+  return (meta as Record<string, unknown> | undefined)?.[RUNNER_TIMEOUT_META] === token;
 }
@@ -5,21 +5,27 @@
 // controller, and it aborts with the timeout error it raised. A test body can
 // throw whatever it likes, including the runner's exact timeout text, without
 // ever aborting the signal.
+//
+// The mark is the run's secret, taken out of the environment here — before any
+// test module is imported — so a test writing `task.meta` has nothing to write.
 
 import { beforeEach, onTestFailed } from 'vitest';
-import { RUNNER_TIMEOUT_META } from './lib/runner-timeout-meta.ts';
+import { RUNNER_TIMEOUT_META, takeRunnerTimeoutToken } from './lib/runner-timeout-meta.ts';
+
+const TOKEN = takeRunnerTimeoutToken(process.env);
 
 /** Distinguishes the timeout abort from a run cancellation, on the runner's own reason. */
 const RUNNER_TIMEOUT_REASON = /^(Test|Hook) timed out in \d+ms\./;
 
+function abortedByRunnerTimeout(signal: AbortSignal): boolean {
+  if (!signal.aborted || !(signal.reason instanceof Error)) return false;
+  return RUNNER_TIMEOUT_REASON.test(signal.reason.message);
+}
+
 beforeEach(({ signal, task }) => {
   onTestFailed(() => {
-    if (
-      signal.aborted &&
-      signal.reason instanceof Error &&
-      RUNNER_TIMEOUT_REASON.test(signal.reason.message)
-    ) {
-      task.meta[RUNNER_TIMEOUT_META] = true;
+    if (TOKEN && abortedByRunnerTimeout(signal)) {
+      (task.meta as Record<string, unknown>)[RUNNER_TIMEOUT_META] = TOKEN;
     }
   });
 });
@@ -3,10 +3,19 @@
 // and never by the normal suites. Each name is asserted there.
 
 import { expect, test } from 'vitest';
+import {
+  RUNNER_TIMEOUT_META,
+  RUNNER_TIMEOUT_TOKEN_ENV,
+} from '../../scripts/lib/runner-timeout-meta.ts';
 
 const RUNNER_TIMEOUT_MESSAGE =
   'Test timed out in 50ms.\nIf this is a long-running test, pass a timeout value as the last argument or configure it globally with "testTimeout".';
 
+/** What a test body can do to `task.meta`, which the policy must not trust. */
+function forgeMark(task: { meta: object }, value: unknown): void {
+  (task.meta as Record<string, unknown>)[RUNNER_TIMEOUT_META] = value;
+}
+
 function blockPastBudget(): void {
   const until = Date.now() + 200;
   while (Date.now() < until) {
@@ -35,3 +44,19 @@ test('assertion failure after blocking the event loop past the budget', () => {
 test('plain assertion failure', () => {
   expect('DEVICE_IN_USE').toBe('OK');
 });
+
+test('test writes the provenance marker itself', ({ task }) => {
+  forgeMark(task, true);
+  throw new Error('DEVICE_IN_USE');
+});
+
+test('test writes the marker after blocking the event loop past the budget', ({ task }) => {
+  forgeMark(task, true);
+  blockPastBudget();
+  throw new Error(RUNNER_TIMEOUT_MESSAGE);
+}, 50);
+
+test('test writes the marker from the environment it can still read', ({ task }) => {
+  forgeMark(task, process.env[RUNNER_TIMEOUT_TOKEN_ENV] ?? 'guess');
+  throw new Error(RUNNER_TIMEOUT_MESSAGE);
+});