gentle-pi 2.1.0 → 2.1.1

package/extensions/gentle-ai.ts

@@ -104,7 +104,9 @@ import {
 	nativeReviewLegacyAliasRepairAuthorization,
 	nativeReviewLegacyQuarantineAuthorization,
 	nativeReviewReconcileAuthorization,
+	normalizeNativeReviewCwd,
 	NativeReviewCliError,
+	NativeReviewConsentBindingError,
 	NativeReviewConsentRequiredError,
 	NATIVE_REVIEW_ERROR_CODE,
 	NATIVE_REVIEW_LEGACY_QUARANTINE,
@@ -2872,7 +2874,7 @@ export function resolveReviewLifecycleCommand(
 	}
 	if (words[0] !== "git") return null;
 	const gitGlobalArgs: string[] = [];
-	let resolvedCwd = resolve(defaultCwd);
+	let resolvedCwd = resolve(normalizeNativeReviewCwd(defaultCwd));
 	let index = 1;
 	while (index < words.length) {
 		const option = words[index];
@@ -2880,7 +2882,7 @@ export function resolveReviewLifecycleCommand(
 			const value = words[index + 1];
 			if (value === undefined) return null;
 			gitGlobalArgs.push(option, value);
-			if (option === "-C") resolvedCwd = resolve(resolvedCwd, value);
+			if (option === "-C") resolvedCwd = resolve(resolvedCwd, normalizeNativeReviewCwd(value));
 			else return null;
 			index += 2;
 			continue;
@@ -3917,6 +3919,14 @@ function asNativeReviewCliError(error: unknown): { code: string; diagnostics: Na
 	return diagnostics === undefined || value.code !== diagnostics.error_code ? undefined : { code: value.code, diagnostics };
 }
 
+// Same coexisting-module-instance caveat as asNativeReviewCliError above.
+function asNativeReviewConsentBindingError(error: unknown): { reason: string; message: string } | undefined {
+	if (error instanceof NativeReviewConsentBindingError) return { reason: error.reason, message: error.message };
+	if (!(error instanceof Error) || error.name !== "NativeReviewConsentBindingError") return undefined;
+	const reason = (error as unknown as { reason?: unknown }).reason;
+	return typeof reason !== "string" || reason.length === 0 ? undefined : { reason, message: error.message };
+}
+
 function nativeStatusFailed(operation: ReviewControllerOperation, error: unknown): Record<string, unknown> {
 	const cliError = asNativeReviewCliError(error);
 	if (cliError?.code === NATIVE_REVIEW_ERROR_CODE.VERSION_INCOMPATIBLE) return nativeStatusUnsupported(operation);
@@ -4550,6 +4560,7 @@ const PENDING_REVIEW_CONSENT_TTL_MS = 10 * 60 * 1000;
 interface PendingReviewConsent {
 	id: string;
 	repositoryCwd: string;
+	authorityCwd: string;
 	candidateView: CandidateView;
 	consent: ReviewConsentV2;
 	consentDigest: string;
@@ -4576,6 +4587,19 @@ function reviewConsentDigest(consent: ReviewConsentV2): string {
 	return createHash("sha256").update(JSON.stringify(consent)).digest("hex");
 }
 
+function assertNativeStartCandidateBinding(candidateView: CandidateView, target: ReviewStatusV3): void {
+	candidateView.verify();
+	if (
+		target.projection.projection !== "workspace" ||
+		target.projection.baseTree !== candidateView.baseTree ||
+		target.projection.initialReviewTree !== candidateView.candidateTree ||
+		target.projection.currentCandidateTree !== candidateView.candidateTree ||
+		JSON.stringify([...target.projection.paths].sort()) !== JSON.stringify([...candidateView.paths].sort())
+	) {
+		throw new CandidateViewError("native START workspace target does not match the immutable reviewer candidate view", "candidate-target-projection-drift");
+	}
+}
+
 function completeNativeStart(
 	operation: ReviewControllerOperation,
 	result: NativeStartResult,
@@ -4623,6 +4647,23 @@ function nativeOperationFailure(operation: ReviewControllerOperation, error: unk
 			...(typeof value.failureEnvelope.nextAction === "string" ? { next_action: value.failureEnvelope.nextAction } : {}),
 		};
 	}
+	// Every consent binding guard runs before the provider is launched, so this
+	// is a local mismatch with nothing to reconcile. Reporting it as a native
+	// operation failure hides the one fact that makes it fixable.
+	const consentBinding = asNativeReviewConsentBindingError(error);
+	if (consentBinding !== undefined) {
+		return {
+			operation,
+			status: "blocked",
+			outcome: "consent-binding-invalid",
+			native_invocation_attempted: false,
+			lineage_created: false,
+			mutation_performed: false,
+			mutation_outcome: "none" as const,
+			diagnostics: { code: consentBinding.reason, message: consentBinding.message },
+			next_action: "resolve-consent-binding",
+		};
+	}
 	const mutationOutcome = value.mutationOutcome === "unknown" ? "unknown" : "none";
 	const nativeDiagnostics = asNativeReviewCliError(error)?.diagnostics;
 	const diagnostics = operation === REVIEW_CONTROLLER_OPERATION.START && error instanceof CandidateViewError && value.candidateViewPreNative === true
@@ -5078,7 +5119,7 @@ async function executeReviewControllerOperation(
 		consumePendingReviewConsent(pending, pendingReviewConsents);
 		try {
 			const answered = await nativeReviewCli.answerConsent({
-				cwd: pending.candidateView.root,
+				cwd: pending.authorityCwd,
 				consent: pending.consent,
 				answer: input.answer,
 				...(signal === undefined ? {} : { signal }),
@@ -5098,7 +5139,7 @@ async function executeReviewControllerOperation(
 			const value = error as { mutationOutcome?: unknown };
 			if (value.mutationOutcome === "none") candidateViews?.cleanup(pending.candidateView.token);
 			return await reconcileNativeMutationFailure(parameters.operation, error, nativeReviewCli, {
-				cwd: pending.candidateView.root,
+				cwd: pending.authorityCwd,
 				...(pending.candidateView.committedOnly ? { baseRef: pending.candidateView.baseCommit } : {}),
 				projection: "workspace",
 			});
@@ -5137,8 +5178,9 @@ async function executeReviewControllerOperation(
 					return nativeStartRejection("base-ref-unresolvable");
 				}
 			}
+			let target: ReviewStatusV3;
 			try {
-				const target = await nativeReviewCli.targetStatus({
+				target = await nativeReviewCli.targetStatus({
 					cwd: defaultCwd,
 					...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
 					...(canonicalBaseRef === undefined ? {} : { baseRef: canonicalBaseRef }),
@@ -5153,14 +5195,17 @@ async function executeReviewControllerOperation(
 			let nativeStartAttempted = false;
 			try {
 				candidateView = candidateViews?.createOrReuse({ contributorRoot: defaultCwd, replayKey, ...(canonicalBaseRef === undefined ? {} : { baseRef: canonicalBaseRef, committedOnly: true }) });
-				nativeStartAttempted = true;
+				if (candidateView !== undefined) assertNativeStartCandidateBinding(candidateView, target);
 				let result: NativeStartResult;
 				try {
+					nativeStartAttempted = true;
 					result = await nativeReviewCli.start({
-						cwd: candidateView?.root ?? defaultCwd,
+						cwd: defaultCwd,
 						...(canonicalBaseRef === undefined
 							? {}
 							: { baseRef: candidateView?.baseCommit ?? canonicalBaseRef, committedOnly: true }),
+						targetIdentity: target.targetIdentity,
+						projection: target.projection.projection,
 						...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
 						...(policy.policyPath === undefined ? {} : { policyPath: policy.policyPath }),
 						...(signal === undefined ? {} : { signal }),
@@ -5175,7 +5220,7 @@ async function executeReviewControllerOperation(
 					if (existing === undefined) for (const pending of [...pendingReviewConsents.values()]) if (pending.candidateView.token === consentCandidateView.token) consumePendingReviewConsent(pending, pendingReviewConsents);
 					const id = existing?.id ?? randomUUID();
 					if (existing === undefined) {
-						const pending: PendingReviewConsent = { id, repositoryCwd, candidateView: consentCandidateView, consent: error.consent, consentDigest, expiresAt: Date.now() + PENDING_REVIEW_CONSENT_TTL_MS };
+						const pending: PendingReviewConsent = { id, repositoryCwd, authorityCwd: defaultCwd, candidateView: consentCandidateView, consent: error.consent, consentDigest, expiresAt: Date.now() + PENDING_REVIEW_CONSENT_TTL_MS };
 						pendingReviewConsents.set(id, pending);
 						pending.expiry = setTimeout(() => cleanupPendingReviewConsent(pending, pendingReviewConsents, candidateViews), PENDING_REVIEW_CONSENT_TTL_MS);
 						pending.expiry.unref();
@@ -5205,7 +5250,7 @@ async function executeReviewControllerOperation(
 							nextAction: "review.status",
 						});
 				return reconcileNativeMutationFailure(parameters.operation, failure, nativeReviewCli, {
-					cwd: candidateView?.root ?? defaultCwd,
+					cwd: defaultCwd,
 					...(parameters.lineageId === undefined ? {} : { lineageId: parameters.lineageId }),
 					...(canonicalBaseRef === undefined ? {} : { baseRef: candidateView?.baseCommit ?? canonicalBaseRef }),
 					projection: "workspace",

package/lib/native-review-cli.ts

@@ -371,7 +371,7 @@ export interface NativeReviewVerificationEvidenceV2 {
 	recordDigest: string;
 }
 
-export interface NativeStartRequest { cwd: string; baseRef?: string; committedOnly?: boolean; lineageId?: string; policyPath?: string; focus?: string; projection?: "workspace" | "staged"; signal?: AbortSignal; }
+export interface NativeStartRequest { cwd: string; baseRef?: string; committedOnly?: boolean; lineageId?: string; policyPath?: string; focus?: string; targetIdentity?: string; projection?: "workspace" | "staged"; signal?: AbortSignal; }
 export const NATIVE_REVIEW_CONSENT_ANSWER = { GRANTED: "granted", DECLINED: "declined" } as const;
 export type NativeReviewConsentAnswer = (typeof NATIVE_REVIEW_CONSENT_ANSWER)[keyof typeof NATIVE_REVIEW_CONSENT_ANSWER];
 export interface NativeReviewConsentAnswerRequest { cwd: string; consent: ReviewConsentV2; answer: NativeReviewConsentAnswer; signal?: AbortSignal; }
@@ -1037,6 +1037,21 @@ function decodeNativeReviewStatus(value: unknown): NativeReviewStatusResult {
 	};
 }
 function isWindowsRepositoryPath(value: string): boolean { return /^[A-Za-z]:[\\/]/.test(value) || /^\\\\/.test(value); }
+export function normalizeNativeReviewCwd(value: string, platform: NodeJS.Platform = process.platform): string {
+	if (platform !== "win32") return value;
+	const gitBashDrive = /^\/([A-Za-z])(?:\/(.*))?$/.exec(value);
+	const windowsPath = gitBashDrive === null
+		? value
+		: `${gitBashDrive[1]!.toUpperCase()}:/${gitBashDrive[2] ?? ""}`;
+	if (!isWindowsRepositoryPath(windowsPath)) return windowsPath;
+	const normalized = win32.normalize(windowsPath);
+	return normalized.replace(/^([a-z]):/, (_match, drive: string) => `${drive.toUpperCase()}:`);
+}
+async function canonicalNativeReviewCwd(value: string): Promise<string> {
+	const normalized = normalizeNativeReviewCwd(value);
+	try { return await realpath(normalized); }
+	catch { return normalized; }
+}
 async function repositoryPathIdentity(value: string): Promise<string> {
 	const windowsPath = isWindowsRepositoryPath(value);
 	try { return `filesystem:${windowsPath ? (await realpath(value)).toLowerCase() : await realpath(value)}`; }
@@ -1360,12 +1375,13 @@ export class NativeReviewCliV214 {
 	// and always pass `--scope clone` so Pi's own kill-switch command surface
 	// never mutates the operator's global gentle-ai state across other clones.
 	async reviewMode(request: NativeReviewModeRequest): Promise<NativeReviewModeResult> {
-		await this.verifyVersion(request.cwd, request.signal, ["mode"]);
+		const cwd = await canonicalNativeReviewCwd(request.cwd);
+		await this.verifyVersion(cwd, request.signal, ["mode"]);
 		const mutating = request.operation !== NATIVE_REVIEW_MODE_OPERATION.STATUS;
 		const { body } = await this.execute(
 			NATIVE_REVIEW_OPERATION.MODE,
-			request.cwd,
-			["review", "mode", request.operation, "--cwd", request.cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
+			cwd,
+			["review", "mode", request.operation, "--cwd", cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
 			mutating,
 			request.signal,
 		);
@@ -1654,6 +1670,23 @@ export class NativeReviewConsentRequiredError extends Error {
 	}
 }
 
+// Raised when the provider-issued consent invocation no longer matches the
+// binding Pi is answering for. Every one of these guards runs before the
+// provider is launched, so the failure is local and nothing was mutated. It
+// carries its own identity precisely so callers never report it as a provider
+// outage: an opaque `native-operation-failed` here sent issue #247 chasing a
+// missing `--cwd` that Pi does forward.
+export class NativeReviewConsentBindingError extends Error {
+	readonly reason: string;
+	readonly launchAttempted = false;
+	readonly mutationOutcome = "none";
+	constructor(reason: string, message: string) {
+		super(message);
+		this.name = "NativeReviewConsentBindingError";
+		this.reason = reason;
+	}
+}
+
 function splitNativeConsentInvocation(invocation: string): readonly string[] {
 	const words: string[] = [];
 	let current = "";
@@ -1705,26 +1738,26 @@ function exactConsentOption(arguments_: readonly string[], name: string): string
 		const token = arguments_[index]!;
 		if (token === name) {
 			const value = arguments_[index + 1];
-			if (value === undefined) throw new TypeError(`Native consent invocation ${name} is missing its value`);
+			if (value === undefined) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation ${name} is missing its value`);
 			values.push(value);
 			index += 1;
 		} else if (token.startsWith(`${name}=`)) values.push(token.slice(name.length + 1));
 	}
-	if (values.length !== 1) throw new TypeError(`Native consent invocation requires exactly one ${name}`);
+	if (values.length !== 1) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation requires exactly one ${name}`);
 	return values[0]!;
 }
 
 function consentInvocationArguments(request: NativeReviewConsentAnswerRequest): readonly string[] {
 	const choice = request.consent.choices.find((candidate) => candidate.answer === request.answer);
-	if (choice === undefined) throw new TypeError("Native consent answer must be granted or declined");
+	if (choice === undefined) throw new NativeReviewConsentBindingError("consent-answer-unknown", "Native consent answer must be granted or declined");
 	const words = splitNativeConsentInvocation(choice.invocation);
-	if (words[0] !== "gentle-ai" || words[1] !== "review" || words[2] !== "start") throw new TypeError("Native consent invocation is not a provider review START");
+	if (words[0] !== "gentle-ai" || words[1] !== "review" || words[2] !== "start") throw new NativeReviewConsentBindingError("consent-invocation-not-start", "Native consent invocation is not a provider review START");
 	const arguments_ = words.slice(1);
-	if (exactConsentOption(arguments_, "--contract") !== REVIEW_INTEGRATION_CONTRACT) throw new TypeError("Native consent invocation contract changed");
-	if (exactConsentOption(arguments_, "--cwd") !== request.cwd) throw new TypeError("Native consent invocation repository binding changed");
-	if (exactConsentOption(arguments_, "--target") !== request.consent.targetIdentity) throw new TypeError("Native consent invocation target binding changed");
-	if (exactConsentOption(arguments_, "--projection") !== request.consent.projection) throw new TypeError("Native consent invocation projection binding changed");
-	if (exactConsentOption(arguments_, "--consent") !== request.answer || arguments_.at(-1) !== request.answer) throw new TypeError("Native consent invocation answer binding changed");
+	if (exactConsentOption(arguments_, "--contract") !== REVIEW_INTEGRATION_CONTRACT) throw new NativeReviewConsentBindingError("consent-invocation-contract-changed", "Native consent invocation contract changed");
+	if (exactConsentOption(arguments_, "--cwd") !== request.cwd) throw new NativeReviewConsentBindingError("consent-invocation-cwd-changed", "Native consent invocation repository binding changed");
+	if (exactConsentOption(arguments_, "--target") !== request.consent.targetIdentity) throw new NativeReviewConsentBindingError("consent-invocation-target-changed", "Native consent invocation target binding changed");
+	if (exactConsentOption(arguments_, "--projection") !== request.consent.projection) throw new NativeReviewConsentBindingError("consent-invocation-projection-changed", "Native consent invocation projection binding changed");
+	if (exactConsentOption(arguments_, "--consent") !== request.answer || arguments_.at(-1) !== request.answer) throw new NativeReviewConsentBindingError("consent-invocation-answer-changed", "Native consent invocation answer binding changed");
 	return arguments_;
 }
 
@@ -1937,24 +1970,21 @@ export class NativeReviewCliV216 implements NativeReviewCli {
 		if (request.baseRef !== undefined && !isCanonicalProcessString(request.baseRef)) throw new TypeError("Native START baseRef must be a non-empty, trimmed, NUL-free string");
 		if (request.baseRef !== undefined && request.committedOnly !== true) throw new TypeError("Native START baseRef requires explicit committedOnly acknowledgement");
 		if (request.baseRef === undefined && request.committedOnly !== undefined) throw new TypeError("Native START committedOnly requires an explicit baseRef");
-		// A negotiated START requires exactly one --contract, --target, and
-		// --projection. The target is resolved here, from the same root START is
-		// about to run in, rather than threaded in by the caller: the caller's
-		// root and START's root differ whenever a candidate view is in play, and
-		// a target frozen from the wrong root would name a snapshot this START
-		// never inspects. targetStatus is read-only, so this costs one extra
-		// read and cannot create authority.
+		if (request.targetIdentity !== undefined && !/^sha256:[0-9a-f]{64}$/.test(request.targetIdentity)) throw new TypeError("Native START targetIdentity must be a canonical sha256 identity");
+		// The controller supplies the target it already projected from the
+		// authority workspace after proving its immutable actor view is identical.
+		// Direct adapter callers may omit it and retain the same-root projection.
 		const projection = request.projection ?? "workspace";
-		const target = await this.targetStatus({
+		const targetIdentity = request.targetIdentity ?? (await this.targetStatus({
 			cwd: request.cwd,
 			projection,
 			...(request.baseRef === undefined ? {} : { baseRef: request.baseRef }),
 			...(request.lineageId === undefined ? {} : { lineageId: request.lineageId }),
 			...(request.signal === undefined ? {} : { signal: request.signal }),
-		});
+		})).targetIdentity;
 		const execution = await this.negotiated(NATIVE_REVIEW_OPERATION.START, request.cwd, [
 			"review", "start", "--contract", REVIEW_INTEGRATION_CONTRACT, "--cwd", request.cwd,
-			"--target", target.targetIdentity, "--projection", projection,
+			"--target", targetIdentity, "--projection", projection,
 			...(request.baseRef === undefined ? [] : ["--base-ref", request.baseRef, "--committed-only"]),
 			...(request.lineageId === undefined ? [] : ["--lineage", request.lineageId]),
 			...(request.policyPath === undefined ? [] : ["--policy", request.policyPath]),
@@ -1966,10 +1996,14 @@ export class NativeReviewCliV216 implements NativeReviewCli {
 		// explicit answer it cannot infer. Discriminate before decode and surface
 		// the complete envelope; only the caller can map a human answer.
 		if (execution.body.action === "consent_required") {
-			throw new NativeReviewConsentRequiredError(decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body)));
+			const consent = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body));
+			if (consent.targetIdentity !== targetIdentity || consent.projection !== projection) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native consent target binding mismatch");
+			throw new NativeReviewConsentRequiredError(consent);
 		}
 		const result = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewStartV3(execution.body));
 		if (request.lineageId !== undefined && result.lineageId !== request.lineageId) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start lineage mismatch");
+		const resultTarget = result.targetIdentity ?? result.repositoryContext?.targetIdentity;
+		if (resultTarget !== undefined && resultTarget !== targetIdentity) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start target mismatch");
 		return {
 			lineageId: result.lineageId,
 			state: result.state as NativeStartResult["state"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gentle-pi",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.",
   "license": "MIT",
   "type": "module",

package/runtime/native-review-cli.mjs

@@ -1038,6 +1038,21 @@ function decodeNativeReviewStatus(value         )                           {
 	};
 }
 function isWindowsRepositoryPath(value        )          { return /^[A-Za-z]:[\\/]/.test(value) || /^\\\\/.test(value); }
+export function normalizeNativeReviewCwd(value        , platform                  = process.platform)         {
+	if (platform !== "win32") return value;
+	const gitBashDrive = /^\/([A-Za-z])(?:\/(.*))?$/.exec(value);
+	const windowsPath = gitBashDrive === null
+		? value
+		: `${gitBashDrive[1] .toUpperCase()}:/${gitBashDrive[2] ?? ""}`;
+	if (!isWindowsRepositoryPath(windowsPath)) return windowsPath;
+	const normalized = win32.normalize(windowsPath);
+	return normalized.replace(/^([a-z]):/, (_match, drive        ) => `${drive.toUpperCase()}:`);
+}
+async function canonicalNativeReviewCwd(value        )                  {
+	const normalized = normalizeNativeReviewCwd(value);
+	try { return await realpath(normalized); }
+	catch { return normalized; }
+}
 async function repositoryPathIdentity(value        )                  {
 	const windowsPath = isWindowsRepositoryPath(value);
 	try { return `filesystem:${windowsPath ? (await realpath(value)).toLowerCase() : await realpath(value)}`; }
@@ -1361,12 +1376,13 @@ export class NativeReviewCliV214 {
 	// and always pass `--scope clone` so Pi's own kill-switch command surface
 	// never mutates the operator's global gentle-ai state across other clones.
 	async reviewMode(request                         )                                  {
-		await this.verifyVersion(request.cwd, request.signal, ["mode"]);
+		const cwd = await canonicalNativeReviewCwd(request.cwd);
+		await this.verifyVersion(cwd, request.signal, ["mode"]);
 		const mutating = request.operation !== NATIVE_REVIEW_MODE_OPERATION.STATUS;
 		const { body } = await this.execute(
 			NATIVE_REVIEW_OPERATION.MODE,
-			request.cwd,
-			["review", "mode", request.operation, "--cwd", request.cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
+			cwd,
+			["review", "mode", request.operation, "--cwd", cwd, ...(mutating ? ["--scope", "clone"] : []), "--json"],
 			mutating,
 			request.signal,
 		);
@@ -1655,6 +1671,23 @@ export class NativeReviewConsentRequiredError extends Error {
 	}
 }
 
+// Raised when the provider-issued consent invocation no longer matches the
+// binding Pi is answering for. Every one of these guards runs before the
+// provider is launched, so the failure is local and nothing was mutated. It
+// carries its own identity precisely so callers never report it as a provider
+// outage: an opaque `native-operation-failed` here sent issue #247 chasing a
+// missing `--cwd` that Pi does forward.
+export class NativeReviewConsentBindingError extends Error {
+	         reason        ;
+	         launchAttempted = false;
+	         mutationOutcome = "none";
+	constructor(reason        , message        ) {
+		super(message);
+		this.name = "NativeReviewConsentBindingError";
+		this.reason = reason;
+	}
+}
+
 function splitNativeConsentInvocation(invocation        )                    {
 	const words           = [];
 	let current = "";
@@ -1706,26 +1739,26 @@ function exactConsentOption(arguments_                   , name        )
 		const token = arguments_[index] ;
 		if (token === name) {
 			const value = arguments_[index + 1];
-			if (value === undefined) throw new TypeError(`Native consent invocation ${name} is missing its value`);
+			if (value === undefined) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation ${name} is missing its value`);
 			values.push(value);
 			index += 1;
 		} else if (token.startsWith(`${name}=`)) values.push(token.slice(name.length + 1));
 	}
-	if (values.length !== 1) throw new TypeError(`Native consent invocation requires exactly one ${name}`);
+	if (values.length !== 1) throw new NativeReviewConsentBindingError("consent-invocation-option-invalid", `Native consent invocation requires exactly one ${name}`);
 	return values[0] ;
 }
 
 function consentInvocationArguments(request                                  )                    {
 	const choice = request.consent.choices.find((candidate) => candidate.answer === request.answer);
-	if (choice === undefined) throw new TypeError("Native consent answer must be granted or declined");
+	if (choice === undefined) throw new NativeReviewConsentBindingError("consent-answer-unknown", "Native consent answer must be granted or declined");
 	const words = splitNativeConsentInvocation(choice.invocation);
-	if (words[0] !== "gentle-ai" || words[1] !== "review" || words[2] !== "start") throw new TypeError("Native consent invocation is not a provider review START");
+	if (words[0] !== "gentle-ai" || words[1] !== "review" || words[2] !== "start") throw new NativeReviewConsentBindingError("consent-invocation-not-start", "Native consent invocation is not a provider review START");
 	const arguments_ = words.slice(1);
-	if (exactConsentOption(arguments_, "--contract") !== REVIEW_INTEGRATION_CONTRACT) throw new TypeError("Native consent invocation contract changed");
-	if (exactConsentOption(arguments_, "--cwd") !== request.cwd) throw new TypeError("Native consent invocation repository binding changed");
-	if (exactConsentOption(arguments_, "--target") !== request.consent.targetIdentity) throw new TypeError("Native consent invocation target binding changed");
-	if (exactConsentOption(arguments_, "--projection") !== request.consent.projection) throw new TypeError("Native consent invocation projection binding changed");
-	if (exactConsentOption(arguments_, "--consent") !== request.answer || arguments_.at(-1) !== request.answer) throw new TypeError("Native consent invocation answer binding changed");
+	if (exactConsentOption(arguments_, "--contract") !== REVIEW_INTEGRATION_CONTRACT) throw new NativeReviewConsentBindingError("consent-invocation-contract-changed", "Native consent invocation contract changed");
+	if (exactConsentOption(arguments_, "--cwd") !== request.cwd) throw new NativeReviewConsentBindingError("consent-invocation-cwd-changed", "Native consent invocation repository binding changed");
+	if (exactConsentOption(arguments_, "--target") !== request.consent.targetIdentity) throw new NativeReviewConsentBindingError("consent-invocation-target-changed", "Native consent invocation target binding changed");
+	if (exactConsentOption(arguments_, "--projection") !== request.consent.projection) throw new NativeReviewConsentBindingError("consent-invocation-projection-changed", "Native consent invocation projection binding changed");
+	if (exactConsentOption(arguments_, "--consent") !== request.answer || arguments_.at(-1) !== request.answer) throw new NativeReviewConsentBindingError("consent-invocation-answer-changed", "Native consent invocation answer binding changed");
 	return arguments_;
 }
 
@@ -1938,24 +1971,21 @@ export class NativeReviewCliV216                            {
 		if (request.baseRef !== undefined && !isCanonicalProcessString(request.baseRef)) throw new TypeError("Native START baseRef must be a non-empty, trimmed, NUL-free string");
 		if (request.baseRef !== undefined && request.committedOnly !== true) throw new TypeError("Native START baseRef requires explicit committedOnly acknowledgement");
 		if (request.baseRef === undefined && request.committedOnly !== undefined) throw new TypeError("Native START committedOnly requires an explicit baseRef");
-		// A negotiated START requires exactly one --contract, --target, and
-		// --projection. The target is resolved here, from the same root START is
-		// about to run in, rather than threaded in by the caller: the caller's
-		// root and START's root differ whenever a candidate view is in play, and
-		// a target frozen from the wrong root would name a snapshot this START
-		// never inspects. targetStatus is read-only, so this costs one extra
-		// read and cannot create authority.
+		if (request.targetIdentity !== undefined && !/^sha256:[0-9a-f]{64}$/.test(request.targetIdentity)) throw new TypeError("Native START targetIdentity must be a canonical sha256 identity");
+		// The controller supplies the target it already projected from the
+		// authority workspace after proving its immutable actor view is identical.
+		// Direct adapter callers may omit it and retain the same-root projection.
 		const projection = request.projection ?? "workspace";
-		const target = await this.targetStatus({
+		const targetIdentity = request.targetIdentity ?? (await this.targetStatus({
 			cwd: request.cwd,
 			projection,
 			...(request.baseRef === undefined ? {} : { baseRef: request.baseRef }),
 			...(request.lineageId === undefined ? {} : { lineageId: request.lineageId }),
 			...(request.signal === undefined ? {} : { signal: request.signal }),
-		});
+		})).targetIdentity;
 		const execution = await this.negotiated(NATIVE_REVIEW_OPERATION.START, request.cwd, [
 			"review", "start", "--contract", REVIEW_INTEGRATION_CONTRACT, "--cwd", request.cwd,
-			"--target", target.targetIdentity, "--projection", projection,
+			"--target", targetIdentity, "--projection", projection,
 			...(request.baseRef === undefined ? [] : ["--base-ref", request.baseRef, "--committed-only"]),
 			...(request.lineageId === undefined ? [] : ["--lineage", request.lineageId]),
 			...(request.policyPath === undefined ? [] : ["--policy", request.policyPath]),
@@ -1967,10 +1997,14 @@ export class NativeReviewCliV216                            {
 		// explicit answer it cannot infer. Discriminate before decode and surface
 		// the complete envelope; only the caller can map a human answer.
 		if (execution.body.action === "consent_required") {
-			throw new NativeReviewConsentRequiredError(decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body)));
+			const consent = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewConsentV2(execution.body));
+			if (consent.targetIdentity !== targetIdentity || consent.projection !== projection) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native consent target binding mismatch");
+			throw new NativeReviewConsentRequiredError(consent);
 		}
 		const result = decode(NATIVE_REVIEW_OPERATION.START, true, () => decodeReviewStartV3(execution.body));
 		if (request.lineageId !== undefined && result.lineageId !== request.lineageId) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start lineage mismatch");
+		const resultTarget = result.targetIdentity ?? result.repositoryContext?.targetIdentity;
+		if (resultTarget !== undefined && resultTarget !== targetIdentity) throw nativeError(NATIVE_REVIEW_ERROR_CODE.IDENTITY_MISMATCH, NATIVE_REVIEW_OPERATION.START, true, "native start target mismatch");
 		return {
 			lineageId: result.lineageId,
 			state: result.state                              ,

package/tests/native-review-consent.test.ts

@@ -5,6 +5,7 @@ import test from "node:test";
 import { GENTLE_AI_VERSION } from "../lib/gentle-ai-binary.ts";
 import {
 	NativeReviewCliV216,
+	NativeReviewConsentBindingError,
 	NativeReviewConsentRequiredError,
 	clearNativeReviewCapabilitiesCacheForTesting,
 	type ExecFileAdapter,
@@ -78,6 +79,22 @@ test("negotiated ordinary START declares relay and preserves the complete target
 		"review", "start", "--contract", "gentle-ai.review-integration/v2", "--cwd", "/repo",
 		"--target", target, "--projection", "workspace", "--consent", "relay",
 	]);
+	assert.equal(queue.calls.some((arguments_) => arguments_[1] === "status"), true);
+});
+
+test("controller-prebound START target is used without projecting a second workspace candidate", async () => {
+	const consent = fixture<Record<string, unknown>>("consent.fixture.json");
+	const target = String(consent.target_identity);
+	const queue = queuedAdapter([capabilities(), consent]);
+	await assert.rejects(
+		() => client(queue.adapter).start({ cwd: "/repo", targetIdentity: target, projection: "workspace" }),
+		(error: unknown) => error instanceof NativeReviewConsentRequiredError,
+	);
+	assert.deepEqual(queue.calls.at(-1), [
+		"review", "start", "--contract", "gentle-ai.review-integration/v2", "--cwd", "/repo",
+		"--target", target, "--projection", "workspace", "--consent", "relay",
+	]);
+	assert.equal(queue.calls.some((arguments_) => arguments_[1] === "status"), false, "a prebound START target must not be projected again");
 });
 
 test("consent follow-up executes the provider-named invocation exactly once and refuses a changed target binding", async () => {
@@ -100,6 +117,66 @@ test("consent follow-up executes the provider-named invocation exactly once and
 	);
 });
 
+// A binding mismatch is decided entirely inside Pi, before the provider is
+// launched, so it must not be reported as a provider failure (issue #247).
+test("a consent invocation binding mismatch is a typed pre-native error that never launches the provider", async () => {
+	const consent = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(fixture<Record<string, unknown>>("consent.fixture.json"));
+	const queue = queuedAdapter([]);
+	await assert.rejects(
+		() => client(queue.adapter).answerConsent!({ cwd: "/repo/.git/gentle-ai/candidate-views/a1c7fdae", consent, answer: "granted" }),
+		(error: unknown) => {
+			assert.ok(error instanceof NativeReviewConsentBindingError);
+			assert.equal(error.name, "NativeReviewConsentBindingError");
+			assert.equal(error.reason, "consent-invocation-cwd-changed");
+			assert.equal(error.launchAttempted, false);
+			assert.equal(error.mutationOutcome, "none");
+			assert.match(error.message, /repository binding changed/);
+			return true;
+		},
+	);
+	assert.deepEqual(queue.calls, []);
+});
+
+// `decodeReviewConsentV2` already rejects a malformed invocation, so these
+// guards defend against a consent object that drifted after decoding. Each one
+// must still name itself rather than collapse into a generic failure.
+test("every consent invocation binding guard reports its own reason without launching the provider", async () => {
+	const decoded = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(fixture<Record<string, unknown>>("consent.fixture.json"));
+	const drifted = (mutate: (consent: ReviewConsentV2) => void): ReviewConsentV2 => {
+		const value = structuredClone(decoded);
+		mutate(value);
+		return value;
+	};
+	const rewriteGranted = (consent: ReviewConsentV2, replace: (invocation: string) => string): void => {
+		const choice = consent.choices.find((candidate) => candidate.answer === "granted") as { invocation: string };
+		choice.invocation = replace(choice.invocation);
+	};
+	const cases = [
+		{
+			reason: "consent-answer-unknown",
+			consent: drifted((consent) => { (consent as { choices: unknown }).choices = consent.choices.filter((choice) => choice.answer !== "granted"); }),
+		},
+		{ reason: "consent-invocation-not-start", consent: drifted((consent) => rewriteGranted(consent, (value) => value.replace("review start", "review finalize"))) },
+		{ reason: "consent-invocation-contract-changed", consent: drifted((consent) => rewriteGranted(consent, (value) => value.replace("gentle-ai.review-integration/v2", "gentle-ai.review-integration/v1"))) },
+		{ reason: "consent-invocation-target-changed", consent: drifted((consent) => { (consent as { targetIdentity: string }).targetIdentity = `sha256:${"c".repeat(64)}`; }) },
+		{ reason: "consent-invocation-projection-changed", consent: drifted((consent) => { (consent as { projection: string }).projection = "staged"; }) },
+		{ reason: "consent-invocation-answer-changed", consent: drifted((consent) => rewriteGranted(consent, (value) => value.replace("--consent granted", "--consent declined"))) },
+		{ reason: "consent-invocation-option-invalid", consent: drifted((consent) => rewriteGranted(consent, (value) => `${value} --consent granted`)) },
+	] as const;
+	for (const scenario of cases) {
+		const queue = queuedAdapter([]);
+		await assert.rejects(
+			() => client(queue.adapter).answerConsent!({ cwd: "/repo", consent: scenario.consent, answer: "granted" }),
+			(error: unknown) => {
+				assert.ok(error instanceof NativeReviewConsentBindingError, `${scenario.reason} must be a typed binding error`);
+				assert.equal(error.reason, scenario.reason);
+				return true;
+			},
+		);
+		assert.deepEqual(queue.calls, [], `${scenario.reason} must not launch the provider`);
+	}
+});
+
 test("declined consent decodes the provider's explicit empty authority fields without creating a lineage", async () => {
 	const rawConsent = fixture<Record<string, unknown>>("consent.fixture.json");
 	const consent = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(rawConsent);

package/tests/native-review-parity.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -9,12 +9,16 @@ import { __testing, createGentleAiExtension } from "../extensions/gentle-ai.ts";
 import {
 	NATIVE_REVIEW_ERROR_CODE,
 	NativeReviewCliError,
+	NativeReviewConsentBindingError,
 	NativeReviewConsentRequiredError,
 	NativeReviewCliV213 as NativeReviewCliV213Production,
+	normalizeNativeReviewCwd,
 	setNativeCliContractForTesting,
 	type ExecFileAdapter,
 	type NativeReviewCli,
 	type NativeReviewConsentAnswer,
+	type NativeReviewConsentAnswerRequest,
+	type NativeStartRequest,
 } from "../lib/native-review-cli.ts";
 import { CandidateViewRegistry } from "../lib/review-candidate-view.ts";
 import { recordReviewConsentLatch } from "../lib/review-consent-latch.ts";
@@ -112,6 +116,26 @@ test("reviewMode status uses the exact fixed argv and decodes the effective mode
 	assert.equal(result.scope, "both");
 });
 
+test("reviewMode canonicalizes an existing repository cwd before the version probe and status argv", async (t) => {
+	if (process.platform === "win32") return t.skip("directory symlink creation requires elevated Windows privileges");
+	const repository = mkdtempSync(join(tmpdir(), "gentle-pi-review-mode-cwd-"));
+	const alias = `${repository}-alias`;
+	symlinkSync(repository, alias, "dir");
+	t.after(() => { rmSync(alias, { force: true }); rmSync(repository, { recursive: true, force: true }); });
+	const queue = queuedAdapter([CAPABLE_VERSION_LINE, { stdout: JSON.stringify(reviewModeStatusBody("off", { global: "off", source: "global" })) }]);
+	const result = await new NativeReviewCliV213(queue.adapter).reviewMode({ cwd: alias, operation: "status" });
+	assert.equal(result.status.effective, "off");
+	assert.equal(queue.calls.every((call) => call.cwd === repository), true);
+	assert.deepEqual(queue.calls[1]?.arguments, ["review", "mode", "status", "--cwd", repository, "--json"]);
+});
+
+test("native review cwd normalization unifies Git Bash and drive-form Windows paths", () => {
+	const expected = "C:\\Users\\Alan\\worktree B";
+	assert.equal(normalizeNativeReviewCwd("/c/Users/Alan/worktree B", "win32"), expected);
+	assert.equal(normalizeNativeReviewCwd("c:/Users/Alan/worktree B", "win32"), expected);
+	assert.equal(normalizeNativeReviewCwd("/c/Users/Alan/worktree B", "linux"), "/c/Users/Alan/worktree B");
+});
+
 test("reviewMode status decodes an off effective mode with its deciding source", async () => {
 	const queue = queuedAdapter([CAPABLE_VERSION_LINE, { stdout: JSON.stringify(reviewModeStatusBody("off", { clone_local: "off", source: "clone_local", revision: "sha256:deadbeef" })) }]);
 	const result = await new NativeReviewCliV213(queue.adapter).reviewMode({ cwd: "/repo", operation: "status" });
@@ -292,18 +316,22 @@ const UNSUPPORTED_REPAIR_ASSESSMENT: AuthorityRepairAssessmentV1 = {
 	authorizationSchema: "gentle-ai.review-repair-authorization/v1",
 };
 
-function unrelatedStartTargetStatus(): ReviewStatusV3 {
+function unrelatedStartTargetStatus(cwd: string): ReviewStatusV3 {
 	const sha = `sha256:${"a".repeat(64)}`;
-	const tree = "b".repeat(40);
+	const candidate = new CandidateViewRegistry().create({ contributorRoot: cwd });
+	const tree = candidate.candidateTree;
+	const baseTree = candidate.baseTree;
+	const paths = candidate.paths;
+	candidate.cleanup();
 	const projection = {
 		schema: "gentle-ai.review-integration.projection/v1" as const,
 		kind: "current-changes" as const,
 		projection: "workspace" as const,
-		baseTree: tree,
+		baseTree,
 		initialReviewTree: tree,
 		currentCandidateTree: tree,
 		pathsDigest: sha,
-		paths: ["app.ts"],
+		paths,
 		intendedUntracked: [],
 		intendedUntrackedProof: sha,
 		initialSnapshotIdentity: sha,
@@ -333,7 +361,7 @@ function unrelatedStartTargetStatus(): ReviewStatusV3 {
 			schema: "gentle-ai.review-integration.status/v3", contract: "gentle-ai.review-integration/v2", operation: "review.status",
 			applicability: "unrelated", receipt: { status: "not_applicable" }, action: "start", replayability: "not_replayable", target_identity: sha,
 			repair: rawRepair,
-			projection: { schema: projection.schema, kind: projection.kind, projection: projection.projection, base_tree: tree, initial_review_tree: tree, current_candidate_tree: tree, paths_digest: sha, paths: ["app.ts"], intended_untracked: [], intended_untracked_proof: sha, initial_snapshot_identity: sha, current_snapshot_identity: sha },
+			projection: { schema: projection.schema, kind: projection.kind, projection: projection.projection, base_tree: baseTree, initial_review_tree: tree, current_candidate_tree: tree, paths_digest: sha, paths, intended_untracked: [], intended_untracked_proof: sha, initial_snapshot_identity: sha, current_snapshot_identity: sha },
 			candidates: [],
 		},
 	};
@@ -369,8 +397,8 @@ function fakeOrganicNative(options: FakeOrganicNativeOptions = {}): { native: Na
 		async bindSdd(): Promise<never> { throw new Error("bindSdd not used in this test"); },
 		async sddStatus(): Promise<never> { throw new Error("sddStatus not used in this test"); },
 		async reviewStatus(): Promise<never> { throw new Error("reviewStatus not used in this test"); },
-		async targetStatus() {
-			return unrelatedStartTargetStatus();
+		async targetStatus(request: { cwd: string }) {
+			return unrelatedStartTargetStatus(request.cwd);
 		},
 		...(reviewModeCapable
 			? {
@@ -534,17 +562,23 @@ function candidateConsent(cwd: string): ReviewConsentV2 {
 	return { schema: "gentle-ai.review-integration.consent/v2", contract: "gentle-ai.review-integration/v2", operation: "review.start", action: "consent_required", blocking: true, targetIdentity, projection: "workspace", riskLevel: "high", changedFiles: 1, changedLines: 1, headline: "Review this candidate", reason: "It changes a process boundary.", value: "Review catches regressions.", riskEvidence: ["shell process"], choices, offPath: { note: "Disable reviews separately.", command: "gentle-ai review mode disable" }, raw };
 }
 
-function relayedConsentNative(cwd: string): { native: NativeReviewCli; answers: NativeReviewConsentAnswer[] } {
+function relayedConsentNative(cwd: string): { native: NativeReviewCli; answers: NativeReviewConsentAnswer[]; startRequests: NativeStartRequest[]; answerRequests: NativeReviewConsentAnswerRequest[] } {
 	const { native } = fakeOrganicNative();
 	const consent = candidateConsent(cwd);
 	const answers: NativeReviewConsentAnswer[] = [];
-	native.start = async () => { throw new NativeReviewConsentRequiredError(consent); };
+	const startRequests: NativeStartRequest[] = [];
+	const answerRequests: NativeReviewConsentAnswerRequest[] = [];
+	native.start = async (request) => {
+		startRequests.push(request);
+		throw new NativeReviewConsentRequiredError(consent);
+	};
 	native.answerConsent = async (request) => {
 		answers.push(request.answer);
+		answerRequests.push(request);
 		if (request.answer === "declined") return { kind: "declined", targetIdentity: consent.targetIdentity, projection: "workspace", riskLevel: "high", changedFiles: 1, changedLines: 1, consent: "declined_this_candidate", raw: { operation: "review/start", action: "declined", consent: "declined_this_candidate" } };
 		return { kind: "started", start: { lineageId: "native-lineage", state: "reviewing", riskLevel: "high", selectedLenses: ["review-risk", "review-resilience", "review-readability", "review-reliability"], changedFiles: 1, changedLines: 1, correctionBudget: 1, action: "created", lensesRequired: true } };
 	};
-	return { native, answers };
+	return { native, answers, startRequests, answerRequests };
 }
 
 async function answerConsent(controller: RegisteredTool, binding: unknown, answer: unknown, ctx: ExtensionContext): Promise<Record<string, unknown>> {
@@ -578,13 +612,23 @@ test("consent relay returns the identical complete parent-visible envelope with
 test("explicit consent follow-up grants or declines exactly once", async (t) => {
 	const cwd = repository(t);
 	for (const answer of ["granted", "declined"] as const) {
-		const { native, answers } = relayedConsentNative(cwd);
+		const { native, answers, startRequests, answerRequests } = relayedConsentNative(cwd);
 		const { controller } = runtime(native);
 		const blocked = await blockedConsent(controller, `consent-${answer}`, headlessContext(cwd));
 		const result = await answerConsent(controller, blocked.consent_binding, answer, headlessContext(cwd));
 		assert.deepEqual(answers, [answer]);
-		if (answer === "granted") assert.ok(result.actor_binding);
-		else {
+		assert.equal(startRequests.length, 1);
+		assert.equal(startRequests[0]?.cwd, cwd);
+		assert.equal(startRequests[0]?.targetIdentity, candidateConsent(cwd).targetIdentity);
+		assert.equal(startRequests[0]?.projection, "workspace");
+		assert.equal(answerRequests.length, 1);
+		assert.equal(answerRequests[0]?.cwd, cwd);
+		assert.equal(answerRequests[0]?.consent.targetIdentity, startRequests[0]?.targetIdentity);
+		if (answer === "granted") {
+			const actorBinding = result.actor_binding as { workspace_root: string; candidate_root: string };
+			assert.equal(actorBinding.workspace_root, cwd);
+			assert.notEqual(actorBinding.candidate_root, cwd);
+		} else {
 			assert.equal(result.outcome, "consent-declined-this-candidate");
 			assert.equal(result.lineage_created, false);
 			assert.equal(result.actor_binding, undefined);
@@ -593,6 +637,28 @@ test("explicit consent follow-up grants or declines exactly once", async (t) =>
 	}
 });
 
+// Issue #247: a local binding mismatch was indistinguishable from a provider
+// outage, so the reporter diagnosed a missing --cwd that Pi does forward.
+test("a consent binding mismatch surfaces as an actionable local failure, not an opaque native operation failure", async (t) => {
+	const cwd = repository(t);
+	const { native, answers } = relayedConsentNative(cwd);
+	native.answerConsent = async () => {
+		throw new NativeReviewConsentBindingError("consent-invocation-cwd-changed", "Native consent invocation repository binding changed");
+	};
+	const { controller } = runtime(native);
+	const blocked = await blockedConsent(controller, "consent-binding", headlessContext(cwd));
+	const result = await answerConsent(controller, blocked.consent_binding, "granted", headlessContext(cwd));
+	assert.equal(result.status, "blocked");
+	assert.equal(result.outcome, "consent-binding-invalid");
+	assert.deepEqual(result.diagnostics, { code: "consent-invocation-cwd-changed", message: "Native consent invocation repository binding changed" });
+	assert.equal(result.native_invocation_attempted, false);
+	assert.equal(result.lineage_created, false);
+	assert.equal(result.mutation_performed, false);
+	assert.equal(result.mutation_outcome, "none");
+	assert.equal(result.next_action, "resolve-consent-binding");
+	assert.deepEqual(answers, []);
+});
+
 test("consent follow-up rejects invalid token, unknown id, changed cwd, and changed target binding", async (t) => {
 	const cwd = repository(t);
 	const consent = candidateConsent(cwd);

package/tests/package-manifest.test.ts

@@ -1137,9 +1137,9 @@ test("pi-pretty wrapper uses real package path resolution for pnpm symlink insta
 	assert.match(wrapper, /quietToolsEnabled/);
 });
 
-test("v2.1.0 release package and runtime stop before publication", () => {
+test("v2.1.1 release package and runtime stop before publication", () => {
 	const packageJson = readPackageJson();
-	assert.equal(packageJson.version, "2.1.0", "the release manifest must remain explicitly pinned to v2.1.0");
+	assert.equal(packageJson.version, "2.1.1", "the release manifest must remain explicitly pinned to v2.1.1");
 	assert.equal(
 		packageJson.scripts?.test,
 		"node --experimental-strip-types --test tests/*.test.ts && pnpm run test:harness",

package/tests/review-controller-lock-status.test.ts

@@ -75,11 +75,27 @@ function nativeStatus(cwd: string, status: string, locks: readonly unknown[]): N
 	} as NativeReviewStatusResult;
 }
 
-function fakeNative(status: NativeReviewStatusResult, onStart?: () => void): NativeReviewCli {
+function fakeNative(status: NativeReviewStatusResult, onStart?: (request: Parameters<NativeReviewCli["start"]>[0]) => void): NativeReviewCli {
 	const blocking = status.locks.some((lock) => (lock as { status?: string }).status !== "released");
+	const tree = execFileSync("git", ["rev-parse", "HEAD^{tree}"], { cwd: status.repository, encoding: "utf8" }).trim();
+	const targetIdentity = `sha256:${"a".repeat(64)}`;
+	const projection = {
+		schema: "gentle-ai.review-integration.projection/v1",
+		kind: "current-changes",
+		projection: "workspace",
+		baseTree: tree,
+		initialReviewTree: tree,
+		currentCandidateTree: tree,
+		pathsDigest: targetIdentity,
+		paths: [],
+		intendedUntracked: [],
+		intendedUntrackedProof: targetIdentity,
+		initialSnapshotIdentity: targetIdentity,
+		currentSnapshotIdentity: targetIdentity,
+	};
 	return {
-		start: async () => {
-			onStart?.();
+		start: async (request) => {
+			onStart?.(request);
 			return { lineageId: "native-lineage", state: "reviewing", riskLevel: "medium", selectedLenses: ["review-reliability"], changedFiles: 1, changedLines: 2, correctionBudget: 1, action: "created", lensesRequired: true };
 		},
 		finalize: async () => { throw new Error("finalize must not run"); },
@@ -90,7 +106,9 @@ function fakeNative(status: NativeReviewStatusResult, onStart?: () => void): Nat
 		targetStatus: async () => ({
 			applicability: blocking ? "corrupted" : "unrelated",
 			action: blocking ? "repair_authority" : "start",
-			raw: { action: blocking ? "repair_authority" : "start", locks: status.locks },
+			targetIdentity,
+			projection,
+			raw: { action: blocking ? "repair_authority" : "start", locks: status.locks, target_identity: targetIdentity, projection: { projection: "workspace" } },
 		}),
 	} as unknown as NativeReviewCli;
 }
@@ -121,11 +139,11 @@ test("INSPECT treats released lock residue as non-blocking and still blocks on l
 test("START precondition ignores released lock residue and still blocks on live lock claims", async (t) => {
 	const cwd = repository(t);
 
-	let started = 0;
-	const proceeded = await runtime(fakeNative(nativeStatus(cwd, "clean", [RELEASED_LOCK]), () => { started += 1; }))
+	const startRequests: Parameters<NativeReviewCli["start"]>[0][] = [];
+	const proceeded = await runtime(fakeNative(nativeStatus(cwd, "clean", [RELEASED_LOCK]), (request) => { startRequests.push(request); }))
 		.execute("start-released", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, context(cwd));
 	const proceededDetails = proceeded.details as Record<string, unknown>;
-	assert.equal(started, 1);
+	assert.deepEqual(startRequests, [{ cwd, targetIdentity: `sha256:${"a".repeat(64)}`, projection: "workspace" }]);
 	assert.equal((proceededDetails.result as Record<string, unknown>).lineage_id, "native-lineage");
 	assert.notEqual(proceededDetails.outcome, "native-authority-lock-present");
 

package/tests/review-controller-native-routing.test.ts

@@ -1,9 +1,9 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmodSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { basename, dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import test from "node:test";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { __testing, createGentleAiExtension } from "../extensions/gentle-ai.ts";
@@ -267,7 +267,7 @@ function fakeNative(overrides: Partial<NativeReviewCli> = {}): NativeReviewCli {
 		targetStatus: async (request) => {
 			const lineageId = request.lineageId ?? "";
 			return lineageId === ""
-				? targetStatusFixture({ applicability: "unrelated", action: "start" })
+				? candidateStartTargetStatus(request)
 				: targetStatusFixture({ lineageId });
 		},
 		...overrides,
@@ -378,6 +378,28 @@ function targetStatusFixture(options: {
 	};
 }
 
+function candidateStartTargetStatus(request: Parameters<NonNullable<NativeReviewCli["targetStatus"]>>[0]): ReviewStatusV3 {
+	let candidate: ReturnType<CandidateViewRegistry["create"]> | undefined;
+	try {
+		candidate = new CandidateViewRegistry().create({
+			contributorRoot: request.cwd,
+			...(request.baseRef === undefined ? {} : { baseRef: request.baseRef, committedOnly: true }),
+		});
+		return targetStatusFixture({
+			applicability: "unrelated",
+			action: "start",
+			baseTree: candidate.baseTree,
+			currentCandidateTree: candidate.candidateTree,
+			paths: candidate.paths,
+			projection: request.projection ?? "workspace",
+		});
+	} catch {
+		return targetStatusFixture({ applicability: "unrelated", action: "start" });
+	} finally {
+		candidate?.cleanup();
+	}
+}
+
 function bindReviewerManifest(status: ReviewStatusV3, cwd: string, manifestHash = `sha256:${"7".repeat(64)}`): ReviewStatusV3 {
 	const manifest = deriveChangedPathManifest(cwd, status.projection.baseTree, status.projection.currentCandidateTree).map((entry) => ({
 		...entry,
@@ -613,7 +635,7 @@ test("fresh registry reload restores the native resumed lineage only while the l
 		stderr: "", exitCode: 0, signal: null, timedOut: false, outputLimitExceeded: false,
 	}));
 	native.targetStatus = async (request) => request.lineageId === undefined
-		? targetStatusFixture({ applicability: "unrelated", action: "start" })
+		? candidateStartTargetStatus(request)
 		: targetStatusFixture({ lineageId: request.lineageId });
 	const { controller, toolCall } = runtime(native, undefined, undefined, undefined, candidateViews);
 	await controller.execute("reload-start", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, context(cwd));
@@ -860,10 +882,10 @@ test("ambiguous native START runs target status first and follows only its decla
 	let statuses = 0;
 	const reconciled = targetStatusFixture({ action: "finalize", lineageId: "resumed-lineage" });
 	const { controller } = runtime(fakeNative({
-		targetStatus: async () => {
+		targetStatus: async (request) => {
 			calls.push("status");
 			statuses += 1;
-			return statuses === 1 ? targetStatusFixture({ applicability: "unrelated", action: "start" }) : reconciled;
+			return statuses === 1 ? candidateStartTargetStatus(request) : reconciled;
 		},
 		start: async (request) => {
 			calls.push("start");
@@ -886,7 +908,9 @@ test("ambiguous native START runs target status first and follows only its decla
 		authority_applicability: "current_target",
 		provider_action: "finalize",
 	});
-	candidateViews.cleanup(basename(requests[0]!.cwd));
+	assert.equal(requests[0]?.cwd, cwd);
+	const replayKey = JSON.stringify({ cwd, lineageId: null, input: request.input, inputPath: null });
+	candidateViews.createOrReuse({ contributorRoot: cwd, replayKey }).cleanup();
 });
 
 test("ambiguous native FINALIZE returns the target-status action without a second mutation", async (t) => {
@@ -1558,8 +1582,8 @@ test("native START uses the default policy or a canonical safe policy path, and
 	await controller.execute("default-policy", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, context(cwd));
 	await controller.execute("custom-policy", { operation: "start", input: JSON.stringify({ mode: "ordinary", policyPath: ".gentle-ai/policies/team policy.json" }) }, undefined, undefined, context(cwd));
 	assert.deepEqual(requests, [
-		{ cwd },
-		{ cwd, policyPath },
+		{ cwd, targetIdentity: `sha256:${"a".repeat(64)}`, projection: "workspace" },
+		{ cwd, policyPath, targetIdentity: `sha256:${"a".repeat(64)}`, projection: "workspace" },
 	]);
 	for (const [input, outcome, reason] of [
 		[{ mode: "ordinary", policyHash: "legacy" }, "native-start-legacy-policy-hash-unsupported", "legacy-policy-hash-unsupported"],
@@ -1595,12 +1619,18 @@ test("native START preserves the default dirty-inclusive candidate without base
 			return { lineageId: "default-dirty-lineage", state: "reviewing", riskLevel: "medium", selectedLenses: ["review-reliability"], changedFiles: 2, changedLines: 2, correctionBudget: 1, action: "created", lensesRequired: true };
 		},
 	}), undefined, undefined, undefined, candidateViews);
-	await controller.execute("default-dirty", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, context(cwd));
+	const started = await controller.execute("default-dirty", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, context(cwd));
 	const view = candidateViews.resolveForLens("default-dirty-lineage", "review-reliability");
 	try {
 		assert.deepEqual(view.paths, ["app.ts", "untracked.ts"]);
 		assert.equal(view.committedOnly, false);
-		assert.deepEqual(requests, [{ cwd: view.root }]);
+		assert.deepEqual(requests, [{ cwd, targetIdentity: `sha256:${"a".repeat(64)}`, projection: "workspace" }]);
+		const actorBinding = (started.details as { actor_binding: { workspace_root: string; candidate_root: string; candidate_tree: string; candidate_paths: readonly string[] } }).actor_binding;
+		assert.equal(actorBinding.workspace_root, cwd);
+		assert.equal(actorBinding.candidate_root, view.root);
+		assert.notEqual(actorBinding.candidate_root, requests[0]?.cwd);
+		assert.equal(actorBinding.candidate_tree, view.candidateTree);
+		assert.deepEqual(actorBinding.candidate_paths, view.paths);
 	} finally {
 		view.cleanup();
 	}
@@ -1626,12 +1656,68 @@ test("native START binds an acknowledged committed range and native identity to
 		assert.deepEqual(view.paths, ["committed-after-base.ts"]);
 		assert.equal(view.committedOnly, true);
 		assert.equal(view.baseCommit, baseCommit);
-		assert.deepEqual(requests, [{ cwd: view.root, baseRef: view.baseCommit, committedOnly: true }]);
+		assert.deepEqual(requests, [{ cwd, baseRef: view.baseCommit, committedOnly: true, targetIdentity: `sha256:${"a".repeat(64)}`, projection: "workspace" }]);
 	} finally {
 		view.cleanup();
 	}
 });
 
+test("native START fails closed before mutation when the workspace target and immutable candidate view differ", async (t) => {
+	const cwd = repository(t);
+	writeFileSync(join(cwd, "app.ts"), "export const value = 2;\n");
+	let starts = 0;
+	const { controller } = runtime(fakeNative({
+		targetStatus: async () => targetStatusFixture({
+			applicability: "unrelated",
+			action: "start",
+			baseTree: git(cwd, "rev-parse", "HEAD^{tree}"),
+			currentCandidateTree: "b".repeat(40),
+			paths: ["app.ts"],
+		}),
+		start: async () => {
+			starts += 1;
+			return { lineageId: "must-not-start", state: "reviewing", riskLevel: "medium", selectedLenses: ["review-reliability"], changedFiles: 1, changedLines: 1, correctionBudget: 1, action: "created", lensesRequired: true };
+		},
+	}), undefined, undefined, undefined, new CandidateViewRegistry());
+	const result = await controller.execute("target-view-drift", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, context(cwd));
+	assert.equal((result.details as { outcome: string }).outcome, "native-operation-failed");
+	assert.deepEqual((result.details as { diagnostics: unknown }).diagnostics, {
+		code: "candidate-target-projection-drift",
+		message: "candidate view rejected before native START",
+	});
+	assert.equal(starts, 0);
+});
+
+test("native START re-verifies candidate-view integrity before granting workspace authority", async (t) => {
+	const cwd = repository(t);
+	writeFileSync(join(cwd, "app.ts"), "export const value = 2;\n");
+	class DriftingCandidateViewRegistry extends CandidateViewRegistry {
+		override createOrReuse(request: Parameters<CandidateViewRegistry["createOrReuse"]>[0]): ReturnType<CandidateViewRegistry["createOrReuse"]> {
+			const candidate = super.createOrReuse(request);
+			chmodSync(candidate.root, 0o755);
+			chmodSync(join(candidate.root, "app.ts"), 0o644);
+			writeFileSync(join(candidate.root, "app.ts"), "corrupted frozen content\n");
+			chmodSync(join(candidate.root, "app.ts"), 0o444);
+			chmodSync(candidate.root, 0o555);
+			return candidate;
+		}
+	}
+	let starts = 0;
+	const { controller } = runtime(fakeNative({
+		start: async () => {
+			starts += 1;
+			return { lineageId: "must-not-start", state: "reviewing", riskLevel: "medium", selectedLenses: ["review-reliability"], changedFiles: 1, changedLines: 1, correctionBudget: 1, action: "created", lensesRequired: true };
+		},
+	}), undefined, undefined, undefined, new DriftingCandidateViewRegistry());
+	const result = await controller.execute("candidate-view-drift", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, context(cwd));
+	assert.equal((result.details as { outcome: string }).outcome, "native-operation-failed");
+	assert.deepEqual((result.details as { diagnostics: unknown }).diagnostics, {
+		code: "candidate-view-invalid",
+		message: "candidate view rejected before native START",
+	});
+	assert.equal(starts, 0);
+});
+
 test("native START rejects an unresolvable explicit base before native mutation", async (t) => {
 	const cwd = repository(t);
 	let starts = 0;
@@ -1698,7 +1784,7 @@ test("native START forwards an acknowledged base ref and rejects invalid values
 		},
 	}));
 	await controller.execute("committed-base", { operation: "start", input: JSON.stringify({ mode: "ordinary", baseRef: "refs/heads/main", committedOnly: true }) }, undefined, undefined, context(cwd));
-	assert.deepEqual(requests, [{ cwd, baseRef: git(cwd, "rev-parse", "refs/heads/main"), committedOnly: true }]);
+	assert.deepEqual(requests, [{ cwd, baseRef: git(cwd, "rev-parse", "refs/heads/main"), committedOnly: true, targetIdentity: `sha256:${"a".repeat(64)}`, projection: "workspace" }]);
 	for (const baseRef of ["", "   ", " origin/main", "origin/main ", "origin\0main", "origin\nmain", "origin\rmain", "origin\tmain", "origin\u007fmain", 42, [], {}]) {
 		const rejected = await controller.execute("invalid-base", { operation: "start", input: JSON.stringify({ mode: "ordinary", baseRef }) }, undefined, undefined, context(cwd));
 		assert.deepEqual(rejected.details, {
@@ -4032,7 +4118,7 @@ test("RECOVER rechecks a committed range against its frozen base instead of the
 	const { controller } = runtime(fakeNative({
 		targetStatus: async (request) => {
 			statusRequests.push(request as Record<string, unknown>);
-			if (request.lineageId === undefined) return targetStatusFixture({ applicability: "unrelated", action: "start" });
+			if (request.lineageId === undefined) return candidateStartTargetStatus(request);
 			assert.equal(request.baseRef, baseRef);
 			const status = targetStatusFixture({ lineageId: "native-lineage", action: "recover" });
 			return { ...status, actionDisposition: "invalidated", authority: { ...status.authority!, revision: "rev-1" } };
@@ -4097,6 +4183,78 @@ test("out-of-band review-mode disable discards stale lifecycle authorization and
 	assert.equal(validations, 1, "disabled organic delivery must not reuse or revalidate stale review authority");
 });
 
+test("RDD-off commit and push canonicalize a git -C linked-worktree target before native mode reconsult", async (t) => {
+	const sessionCwd = repository(t);
+	const worktreeParent = mkdtempSync(join(tmpdir(), "gentle-pi-lifecycle-worktrees-"));
+	const worktree = join(worktreeParent, "worktree B");
+	const worktreeAlias = join(worktreeParent, "worktree B alias");
+	git(sessionCwd, "worktree", "add", "-b", "issue-246-worktree", worktree);
+	const windowsDrive = /^([A-Za-z]):[\\/](.*)$/.exec(worktree);
+	const worktreeSpelling = process.platform === "win32"
+		? `/${windowsDrive?.[1]?.toLowerCase()}/${windowsDrive?.[2]?.replaceAll("\\", "/")}`
+		: worktreeAlias;
+	if (process.platform === "win32") assert.ok(windowsDrive, "Windows worktree must have a drive-qualified path");
+	else symlinkSync(worktree, worktreeAlias, "dir");
+	t.after(() => {
+		try { git(sessionCwd, "worktree", "remove", "--force", worktree); } catch {}
+		rmSync(worktreeParent, { recursive: true, force: true });
+	});
+	const canonicalWorktree = realpathSync(worktree);
+	const commonDirectory = (cwd: string): string => realpathSync(resolve(cwd, git(cwd, "rev-parse", "--git-common-dir")));
+	assert.equal(commonDirectory(sessionCwd), commonDirectory(canonicalWorktree));
+	const parsed = __testing.resolveReviewLifecycleCommand(`git -C "${worktreeSpelling}" commit -m "issue 246"`, sessionCwd);
+	assert.deepEqual(parsed?.gitGlobalArgs, ["-C", worktreeSpelling], "cwd canonicalization must preserve the exact typed Git selector");
+
+	const nativeCalls: Array<{ arguments: readonly string[]; cwd: string }> = [];
+	const native = new NativeReviewCliV214(async (request) => {
+		nativeCalls.push({ arguments: request.arguments, cwd: request.cwd });
+		if (request.cwd !== canonicalWorktree) throw new Error(`native process cwd was not canonical: ${request.cwd}`);
+		if (request.arguments[0] === "version") {
+			return { stdout: "gentle-ai 2.2.2\n", stderr: "", exitCode: 0, signal: null, timedOut: false, outputLimitExceeded: false };
+		}
+		if (request.arguments[0] === "review" && request.arguments[1] === "mode") {
+			return {
+				stdout: JSON.stringify({
+					schema: "gentle-ai.review-mode/v1",
+					operation: "status",
+					scope: "both",
+					status: { schema: "gentle-ai.rdd-mode-status/v1", global: "off", clone_local: "off", effective: "off", source: "clone_local" },
+				}),
+				stderr: "",
+				exitCode: 0,
+				signal: null,
+				timedOut: false,
+				outputLimitExceeded: false,
+			};
+		}
+		throw new Error(`unexpected native review operation: ${request.arguments.join(" ")}`);
+	});
+	const { toolCall } = runtime(native);
+	for (const command of [
+		`git -C "${worktreeSpelling}" commit -m "issue 246"`,
+		`git -C "${worktreeSpelling}" push origin issue-246-worktree`,
+	]) {
+		assert.equal(await toolCall({ toolName: "bash", input: { command } }, interactiveContext(sessionCwd)), undefined);
+	}
+	assert.equal(nativeCalls.length, 4);
+	assert.equal(nativeCalls.every((call) => call.cwd === canonicalWorktree), true);
+	assert.deepEqual(nativeCalls.filter((call) => call.arguments[0] === "review").map((call) => call.arguments), [
+		["review", "mode", "status", "--cwd", canonicalWorktree, "--json"],
+		["review", "mode", "status", "--cwd", canonicalWorktree, "--json"],
+	]);
+	assert.equal(nativeCalls.some((call) => call.arguments.includes("validate")), false);
+});
+
+test("git -C linked-worktree lifecycle commands remain fail-closed when mode reconsult genuinely fails", async (t) => {
+	const sessionCwd = repository(t);
+	const { toolCall } = runtime(fakeNative({ reviewMode: async () => { throw new Error("mode unavailable"); } }));
+	for (const command of ["git -C . commit -m failure", "git -C . push origin main"]) {
+		const result = await toolCall({ toolName: "bash", input: { command } }, interactiveContext(sessionCwd)) as { block: boolean; reason: string };
+		assert.equal(result.block, true);
+		assert.match(result.reason, /could not reconsult review mode and failed closed/);
+	}
+});
+
 test("successful /gentle:review-mode disable clears pending authorizations even after mode is re-enabled", async (t) => {
 	const cwd = repository(t);
 	let effective: "on" | "off" = "on";

package/tests/review-controller-workspace-root.test.ts

@@ -84,7 +84,7 @@ function fakeNative(overrides: Partial<NativeReviewCli> = {}): NativeReviewCli {
 		sddStatus: async () => ({ ready: false }),
 		reviewStatus: async () => ({ schema: "gentle-ai.review-authority-status/v1", repository: "/repo", complete: true, authoritative: true, status: "clean", entries: [], locks: [], diagnostics: [], raw: { schema: "gentle-ai.review-authority-status/v1", operation: "review/status", repository: "/repo", complete: true, authoritative: true, status: "clean", entries: [], locks: [], diagnostics: [] } }),
 		targetStatus: async (request) => request.lineageId === undefined
-			? targetStatusFixture({ applicability: "unrelated", action: "start" })
+			? candidateStartTargetStatus(request)
 			: targetStatusFixture({ lineageId: request.lineageId }),
 		...overrides,
 	};
@@ -102,21 +102,26 @@ function targetStatusFixture(options: {
 	applicability?: "current_target" | "unrelated";
 	action?: ReviewStatusV3["action"];
 	lineageId?: string;
+	baseTree?: string;
+	currentCandidateTree?: string;
+	paths?: readonly string[];
 } = {}): ReviewStatusV3 {
 	const applicability = options.applicability ?? "current_target";
 	const action = options.action ?? (applicability === "current_target" ? "finalize" : "start");
 	const lineageId = options.lineageId ?? "native-lineage";
 	const sha = `sha256:${"a".repeat(64)}`;
-	const tree = "b".repeat(40);
+	const tree = options.currentCandidateTree ?? "b".repeat(40);
+	const baseTree = options.baseTree ?? tree;
+	const paths = options.paths ?? ["app.ts"];
 	const projection = {
 		schema: "gentle-ai.review-integration.projection/v1" as const,
 		kind: "current-changes" as const,
 		projection: "workspace" as const,
-		baseTree: tree,
+		baseTree,
 		initialReviewTree: tree,
 		currentCandidateTree: tree,
 		pathsDigest: sha,
-		paths: ["app.ts"],
+		paths,
 		intendedUntracked: [],
 		intendedUntrackedProof: sha,
 		initialSnapshotIdentity: sha,
@@ -146,11 +151,11 @@ function targetStatusFixture(options: {
 			schema: projection.schema,
 			kind: projection.kind,
 			projection: projection.projection,
-			base_tree: tree,
+			base_tree: baseTree,
 			initial_review_tree: tree,
 			current_candidate_tree: tree,
 			paths_digest: sha,
-			paths: projection.paths,
+			paths,
 			intended_untracked: [],
 			intended_untracked_proof: sha,
 			initial_snapshot_identity: sha,
@@ -178,6 +183,25 @@ function targetStatusFixture(options: {
 	};
 }
 
+function candidateStartTargetStatus(request: Parameters<NonNullable<NativeReviewCli["targetStatus"]>>[0]): ReviewStatusV3 {
+	let candidate: ReturnType<CandidateViewRegistry["create"]> | undefined;
+	try {
+		candidate = new CandidateViewRegistry().create({
+			contributorRoot: request.cwd,
+			...(request.baseRef === undefined ? {} : { baseRef: request.baseRef, committedOnly: true }),
+		});
+		return targetStatusFixture({
+			applicability: "unrelated",
+			action: "start",
+			baseTree: candidate.baseTree,
+			currentCandidateTree: candidate.candidateTree,
+			paths: candidate.paths,
+		});
+	} finally {
+		candidate?.cleanup();
+	}
+}
+
 test("INSPECT and STATUS operate on the explicit workspace root while the session cwd stays elsewhere", async (t) => {
 	const sessionCwd = repository(t);
 	const worktree = addWorktree(t, sessionCwd, "feat-binding");
@@ -200,10 +224,10 @@ test("START freezes the candidate from the explicit workspace root and returns t
 	const worktree = addWorktree(t, sessionCwd, "feat-candidate");
 	writeFileSync(join(worktree, "app.ts"), "export const value = 2; // worktree candidate\n");
 	const candidateViews = new CandidateViewRegistry();
-	const startCwds: string[] = [];
+	const startRequests: Parameters<NativeReviewCli["start"]>[0][] = [];
 	const { controller, toolCall } = runtime(fakeNative({
 		start: async (request) => {
-			startCwds.push(request.cwd);
+			startRequests.push(request);
 			return { lineageId: "worktree-lineage", state: "reviewing", riskLevel: "medium", selectedLenses: ["review-reliability"], changedFiles: 1, changedLines: 1, correctionBudget: 1, action: "created", lensesRequired: true };
 		},
 	}), candidateViews);
@@ -219,7 +243,8 @@ test("START freezes the candidate from the explicit workspace root and returns t
 	const view = candidateViews.resolveForLens("worktree-lineage", "review-reliability");
 	assert.equal(details.actor_binding.candidate_root, view.root);
 	assert.equal(details.actor_binding.candidate_tree, view.candidateTree);
-	assert.deepEqual(startCwds, [view.root]);
+	assert.deepEqual(startRequests, [{ cwd: root, targetIdentity: `sha256:${"a".repeat(64)}`, projection: "workspace" }]);
+	assert.notEqual(startRequests[0]?.cwd, view.root);
 	assert.equal(readFileSync(join(view.root, "app.ts"), "utf8"), "export const value = 2; // worktree candidate\n");
 	assert.equal(view.paths.includes("unrelated.ts"), false);
 	const dispatch = { agent: "review-reliability", task: "review the change", mode: "task" };
@@ -234,8 +259,12 @@ test("absent workspaceRoot keeps the session-cwd flow and still reports the acto
 	const sessionCwd = repository(t);
 	writeFileSync(join(sessionCwd, "app.ts"), "export const value = 3;\n");
 	const candidateViews = new CandidateViewRegistry();
+	const startRequests: Parameters<NativeReviewCli["start"]>[0][] = [];
 	const { controller } = runtime(fakeNative({
-		start: async () => ({ lineageId: "session-lineage", state: "reviewing", riskLevel: "medium", selectedLenses: ["review-reliability"], changedFiles: 1, changedLines: 1, correctionBudget: 1, action: "created", lensesRequired: true }),
+		start: async (request) => {
+			startRequests.push(request);
+			return { lineageId: "session-lineage", state: "reviewing", riskLevel: "medium", selectedLenses: ["review-reliability"], changedFiles: 1, changedLines: 1, correctionBudget: 1, action: "created", lensesRequired: true };
+		},
 	}), candidateViews);
 	const started = await controller.execute("start-session", { operation: "start", input: JSON.stringify({ mode: "ordinary" }) }, undefined, undefined, context(sessionCwd));
 	const details = started.details as {
@@ -245,6 +274,7 @@ test("absent workspaceRoot keeps the session-cwd flow and still reports the acto
 	assert.equal(details.workspace_root, sessionCwd);
 	assert.equal(details.actor_binding.workspace_root, sessionCwd);
 	assert.deepEqual(details.actor_binding.candidate_paths, ["app.ts"]);
+	assert.deepEqual(startRequests, [{ cwd: sessionCwd, targetIdentity: `sha256:${"a".repeat(64)}`, projection: "workspace" }]);
 	const view = candidateViews.resolveForLens("session-lineage", "review-reliability");
 	assert.equal(details.actor_binding.candidate_root, view.root);
 	candidateViews.cleanup(view.token);