gentle-pi 2.3.0 → 2.5.0

package/tests/native-pointer-region.test.ts

@@ -0,0 +1,245 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { Box, Container, Text, type Component, type TuiMouseEvent } from "@earendil-works/pi-tui";
+import { createNativePointerScope } from "../lib/native-pointer-region.ts";
+
+function mouse(
+	type: TuiMouseEvent["type"], button: TuiMouseEvent["button"], y: number, height: number,
+): TuiMouseEvent {
+	return {
+		type, button, x: 0, y, screenX: 0, screenY: y, width: 40, height,
+		shift: false, alt: false, ctrl: false,
+	};
+}
+
+function dispatch(
+	root: Container,
+	observer: ReturnType<ReturnType<typeof createNativePointerScope>["createMouseObserver"]>,
+	event: TuiMouseEvent,
+) {
+	observer.beforeMouse(event);
+	try {
+		return root.handleMouse(event);
+	} finally {
+		observer.afterMouse(event);
+	}
+}
+
+type PublicCustomFactory = Parameters<ExtensionContext["ui"]["custom"]>[0];
+type PublicCustomOptions = NonNullable<Parameters<ExtensionContext["ui"]["custom"]>[1]>;
+
+// Typed callback harness, not proof of physical terminal overlay UX.
+async function mountOverlay(
+	factory: PublicCustomFactory,
+	options: PublicCustomOptions,
+): Promise<Component & { dispose?(): void }> {
+	assert.equal(options.overlay, true, "the public custom factory receives overlay mode");
+	return factory(
+		{} as Parameters<PublicCustomFactory>[0],
+		{} as Parameters<PublicCustomFactory>[1],
+		{} as Parameters<PublicCustomFactory>[2],
+		() => {},
+	);
+}
+
+test("pointer regions give a public Text hover, press, and click behavior without implicit focus", () => {
+	const scope = createNativePointerScope();
+	const calls: string[] = [];
+	const region = scope.wrap(new Text("Open editor", 0, 0), {
+		onHover: () => {
+			calls.push("hover");
+			return { handled: true, render: true };
+		},
+		onPress: () => {
+			calls.push("press");
+			return { handled: true };
+		},
+		onClick: () => {
+			calls.push("click");
+			return { handled: true };
+		},
+		onWheel: () => {
+			calls.push("wheel");
+			return { handled: true };
+		},
+	});
+	const root = new Container();
+	root.addChild(region);
+	const height = root.render(40).length;
+	const observer = scope.createMouseObserver();
+
+	assert.equal(dispatch(root, observer, mouse("move", "none", 0, height))?.render, true);
+	const press = dispatch(root, observer, mouse("press", "left", 0, height));
+	assert.equal(press?.handled, true);
+	assert.equal(press?.focus, undefined, "a Text region never claims keyboard focus by itself");
+	assert.equal(dispatch(root, observer, mouse("click", "left", 0, height))?.handled, true);
+	assert.equal(dispatch(root, observer, mouse("wheel", "none", 0, height))?.handled, true);
+	assert.deepEqual(calls, ["hover", "press", "click", "wheel"]);
+});
+
+test("pointer scopes clear hover only through observed lifecycle boundaries", () => {
+	const scope = createNativePointerScope();
+	const states: string[] = [];
+	const region = scope.wrap(new Text("Hover me", 0, 0), {
+		onHover: () => {
+			states.push("hover");
+			return { handled: true, render: true };
+		},
+		onLeave: () => states.push("leave"),
+	});
+	const root = new Container();
+	root.addChild(region);
+	const observer = scope.createMouseObserver();
+	const height = root.render(40).length;
+
+	dispatch(root, observer, mouse("move", "none", 0, height));
+	dispatch(root, observer, mouse("move", "none", height, height + 1));
+	assert.deepEqual(states, ["hover", "leave"], "an in-root empty move clears hover");
+
+	dispatch(root, observer, mouse("move", "none", 0, height));
+	region.render(30);
+	assert.deepEqual(states, ["hover", "leave", "hover", "leave"], "resize clears hover");
+
+	dispatch(root, observer, mouse("move", "none", 0, height));
+	region.invalidate();
+	region.setDisabled(true);
+	region.dispose();
+	scope.dispose();
+	dispatch(root, observer, mouse("move", "none", 0, height));
+	assert.deepEqual(
+		states,
+		["hover", "leave", "hover", "leave", "hover", "leave"],
+		"invalidate, disable, disposal, and late events cannot retain or restore hover",
+	);
+});
+
+test("a consuming public Box child keeps its exact native target and focus without outer callbacks", () => {
+	const scope = createNativePointerScope();
+	let outerClicks = 0;
+	const child: Component = {
+		render: () => ["native child"],
+		invalidate() {},
+		handleMouse: () => ({ handled: true, focus: true, render: true }),
+	};
+	const box = new Box(0, 0);
+	box.addChild(child);
+	const region = scope.wrap(box, {
+		onClick: () => {
+			outerClicks++;
+			return { handled: true };
+		},
+	});
+	const root = new Container();
+	root.addChild(region);
+	const height = root.render(40).length;
+	const result = dispatch(root, scope.createMouseObserver(), mouse("click", "left", 0, height));
+
+	assert.equal(result?.target.component, child);
+	assert.equal(result?.focusTarget, child);
+	assert.equal(outerClicks, 0, "a consumed child prevents outer pointer callbacks");
+});
+
+test("the same composed region can open an input entry point without answering on press", () => {
+	const scope = createNativePointerScope();
+	let opened = 0;
+	const panel = new Container();
+	panel.addChild(scope.wrap(new Text("Open input", 0, 0), {
+		onPress: () => ({ handled: true }),
+		onClick: () => {
+			opened++;
+			return { handled: true };
+		},
+	}));
+	const root = new Container();
+	root.addChild(panel);
+	const height = root.render(40).length;
+	const observer = scope.createMouseObserver();
+
+	assert.equal(dispatch(root, observer, mouse("press", "left", 0, height))?.handled, true);
+	assert.equal(opened, 0, "press can prepare a control but cannot answer it");
+	assert.equal(dispatch(root, observer, mouse("click", "left", 0, height))?.handled, true);
+	assert.equal(opened, 1, "a caller-owned callback opens the input entry point");
+});
+
+test("a typed public custom overlay factory composes pointer content and disposes late events", async () => {
+	let opened = 0;
+	let leaves = 0;
+	const component = await mountOverlay(() => {
+		const scope = createNativePointerScope();
+		const panel = new Container();
+		panel.addChild(scope.wrap(new Text("Open overlay input", 0, 0), {
+			onHover: () => ({ handled: true, render: true }),
+			onLeave: () => { leaves++; },
+			onClick: () => {
+				opened++;
+				return { handled: true };
+			},
+		}));
+		const observer = scope.createMouseObserver();
+		return {
+			render: (width) => panel.render(width),
+			handleMouse: (event) => {
+				observer.beforeMouse(event);
+				try {
+					return panel.handleMouse(event);
+				} finally {
+					observer.afterMouse(event);
+				}
+			},
+			invalidate: () => panel.invalidate(),
+			dispose: () => scope.dispose(),
+		};
+	}, { overlay: true });
+	const height = component.render(40).length;
+	const hover = component.handleMouse?.(mouse("move", "none", 0, height));
+	const click = component.handleMouse?.(mouse("click", "left", 0, height));
+
+	assert.equal(hover?.render, true);
+	assert.equal(click?.focus, undefined, "overlay content does not claim focus without a caller result");
+	assert.equal(opened, 1, "the factory-returned component routes a native click to its callback");
+	component.dispose?.();
+	assert.equal(component.handleMouse?.(mouse("click", "left", 0, height)), undefined);
+	assert.deepEqual([opened, leaves], [1, 1], "disposal clears hover and rejects late overlay events");
+});
+
+test("scopes apply disabled and disposed state to later Text regions", () => {
+	const calls: string[] = [];
+	const disabled = createNativePointerScope();
+	disabled.setDisabled(true);
+	const disabledRoot = new Container();
+	disabledRoot.addChild(disabled.wrap(new Text("Disabled", 0, 0), {
+		onClick: () => {
+			calls.push("disabled");
+			return { handled: true };
+		},
+	}));
+	const disabledHeight = disabledRoot.render(40).length;
+	const disabledClick = dispatch(
+		disabledRoot, disabled.createMouseObserver(), mouse("click", "left", 0, disabledHeight),
+	);
+	disabled.setDisabled(false);
+	const reenabledClick = dispatch(
+		disabledRoot, disabled.createMouseObserver(), mouse("click", "left", 0, disabledHeight),
+	);
+
+	const disposed = createNativePointerScope();
+	disposed.dispose();
+	const disposedRoot = new Container();
+	disposedRoot.addChild(disposed.wrap(new Text("Disposed", 0, 0), {
+		onClick: () => {
+			calls.push("disposed");
+			return { handled: true };
+		},
+	}));
+	const disposedHeight = disposedRoot.render(40).length;
+	const disposedClick = dispatch(
+		disposedRoot, disposed.createMouseObserver(), mouse("click", "left", 0, disposedHeight),
+	);
+
+	assert.deepEqual(
+		[disabledClick?.handled, reenabledClick?.handled, disposedClick?.handled, calls],
+		[undefined, true, undefined, ["disabled"]],
+		"later regions inherit scope disable/disposal while a live scope can be re-enabled",
+	);
+});

package/tests/native-review-capability-contract.test.ts

@@ -150,11 +150,43 @@ test("2.5.0 repeats 2.5.0-rc.3 because the stable lane Pi consumes is unchanged"
 	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["2.5.0-rc.3"] as Record<string, boolean>);
 });
 
+test("2.6.0 repeats 2.5.0 because the negotiated lane Pi consumes is unchanged", () => {
+	// Ground-truthed against the published v2.6.0 binary installed from its
+	// signed archive: the v2 lane advertises capabilities/v2.5 and answers
+	// status/v7, consent/v3, and the `start/v4` continuation, all already
+	// decoded. `review mode status --json` and `review validate --gate
+	// pre-commit` were re-run against the binary and still answer
+	// `gentle-ai.rdd-mode-status/v1` and `gentle-ai.review-gate-result/v1`
+	// respectively. Declining the consent/v3 prompt during `review start`
+	// still surfaces `risk_evidence` only on that blocking envelope, not on
+	// the negotiated `start/v4` continuation, so riskEvidence and hint stay
+	// dark: still not proven to reach the negotiated START path Pi consumes.
+	const contract = NATIVE_CLI_CONTRACTS["2.6.0"] as Record<string, boolean>;
+	assert.equal(contract.riskEvidence, false);
+	assert.equal(contract.hint, false);
+	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["2.5.0"] as Record<string, boolean>);
+});
+
+test("2.7.0 repeats 2.6.0 because the negotiated lane Pi consumes is unchanged", () => {
+	// Ground-truthed against the published v2.7.0 binary installed from its
+	// signed archive: the v2 lane still advertises capabilities/v2.5 and
+	// answers status/v7, consent/v3, and the `start/v4` continuation, all
+	// already decoded. `review mode status --json` and `review validate --gate
+	// pre-commit` were re-run against the binary and still answer
+	// `gentle-ai.rdd-mode-status/v1` and `gentle-ai.review-gate-result/v1`
+	// respectively. riskEvidence and hint stay dark: still not proven to reach
+	// the negotiated START path Pi consumes.
+	const contract = NATIVE_CLI_CONTRACTS["2.7.0"] as Record<string, boolean>;
+	assert.equal(contract.riskEvidence, false);
+	assert.equal(contract.hint, false);
+	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["2.6.0"] as Record<string, boolean>);
+});
+
 test("no shipped version key was added beyond the pin bump", () => {
 	// Rows are promises to consumers, so a new key only ever appears in a
 	// dedicated commit alongside a pin bump, never as a side effect. v2.2.4 and
 	// v2.3.0 shipped upstream while Pi stayed on 2.2.3 and were never pinned,
 	// so they get no row: a row asserts ground truth measured against a binary
 	// Pi actually ran, and the table only has to be ascending, not gapless.
-	assert.deepEqual(Object.keys(NATIVE_CLI_CONTRACTS), [...DARK_VERSIONS, "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.4.0", "2.5.0-rc.3", "2.5.0"]);
+	assert.deepEqual(Object.keys(NATIVE_CLI_CONTRACTS), [...DARK_VERSIONS, "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.4.0", "2.5.0-rc.3", "2.5.0", "2.6.0", "2.7.0"]);
 });

package/tests/native-review-cli.test.ts

@@ -609,6 +609,46 @@ test("current native process boundary preserves caps, timeout classes, and sanit
 	);
 });
 
+test("authority inventory accepts compact discarded work and historical entry statuses", async () => {
+	const repository = process.cwd();
+	const discardedWork = { captured_lens_results: [], findings_present: false };
+	const statuses = ["incomplete-store-entry", "historical-pre-receipt", "invalidated"] as const;
+	const body = {
+		schema: "gentle-ai.review-authority-status/v1",
+		operation: "review/status",
+		repository,
+		complete: true,
+		authoritative: true,
+		status: "active",
+		entries: statuses.map((status) => ({
+			version: "compact-v2",
+			lineage_id: `review-${status}`,
+			path: `${repository}/.git/gentle-ai/${status}`,
+			status,
+			discarded_work: discardedWork,
+			problems: [],
+		})),
+		locks: [],
+		diagnostics: [],
+	};
+	const decoded = await client(queuedAdapter([{ stdout: JSON.stringify(body) }]).adapter).reviewStatus({ cwd: repository });
+	assert.deepEqual(decoded.entries.map((entry) => ({ status: entry.status, discardedWork: entry.discardedWork })), statuses.map((status) => ({
+		status,
+		discardedWork: { capturedLensResults: [], findingsPresent: false },
+	})));
+
+	for (const entry of [
+		{ ...body.entries[0], discarded_work: { captured_lens_results: "not-an-array", findings_present: false } },
+		{ ...body.entries[0], discarded_work: { ...discardedWork, unexpected: true } },
+		{ ...body.entries[0], status: "future-status" },
+	]) {
+		await assert.rejects(
+			() => client(queuedAdapter([{ stdout: JSON.stringify({ ...body, entries: [entry] }) }]).adapter).reviewStatus({ cwd: repository }),
+			(error: unknown) => error instanceof NativeReviewCliError && error.code === NATIVE_REVIEW_ERROR_CODE.SCHEMA_INCOMPATIBLE,
+		);
+	}
+});
+
 test("current review STATUS retains compact snapshot and released-lock wire fields", async (t) => {
 	const repository = process.cwd();
 	const snapshotIdentity = `sha256:${"d".repeat(64)}`;

package/tests/native-review-consent.test.ts

@@ -176,6 +176,97 @@ test("consent follow-up executes the provider-named invocation exactly once and
 
 // A binding mismatch is decided entirely inside Pi, before the provider is
 // launched, so it must not be reported as a provider failure (issue #247).
+test("consent answer preserves quoted Windows provider cwd tokens and launches the provider exactly once", async () => {
+	const windowsCwd = "C:\\Users\\x\\repo with spaces";
+	const gitBashCwd = "/c/Users/x/repo with spaces";
+	const cwdPairs = process.platform === "win32"
+		? [{ providerCwd: windowsCwd, requestedCwd: gitBashCwd }, { providerCwd: gitBashCwd, requestedCwd: windowsCwd }, { providerCwd: gitBashCwd, requestedCwd: gitBashCwd }, { providerCwd: windowsCwd, requestedCwd: windowsCwd }]
+		: [{ providerCwd: windowsCwd, requestedCwd: windowsCwd }];
+	for (const { providerCwd, requestedCwd } of cwdPairs) {
+		const decoded = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(fixture<Record<string, unknown>>("consent.fixture.json"));
+		const lineage = "windows-cwd-lineage";
+		for (const choice of decoded.choices) {
+			choice.invocation = choice.invocation
+				.replace("--cwd /repo", `--cwd "${providerCwd}"`)
+				.replace("review-consent-fixture", lineage);
+		}
+		const started = JSON.parse(JSON.stringify(fixture<Record<string, unknown>>("start.fixture.json")).replaceAll("review-start-fixture", lineage)) as Record<string, unknown>;
+		const expected = [
+			"review", "start", "--contract", "gentle-ai.review-integration/v2", "--cwd", providerCwd,
+			"--target", decoded.targetIdentity, "--projection", "workspace", "--lineage", lineage, "--consent", "granted",
+		];
+		for (const createClient of [client, runtimeClient]) {
+			const queue = queuedAdapter([capabilities(), structuredClone(started)]);
+			const result = await createClient(queue.adapter).answerConsent({ cwd: requestedCwd, consent: decoded, answer: "granted" });
+			assert.equal(result.kind, "started");
+			assert.deepEqual(queue.calls, [expected]);
+		}
+	}
+});
+
+test("consent answer preserves quoted UNC and drive-root cwd tokens", async () => {
+	for (const providerCwd of ["\\\\server\\share", "C:\\"]) {
+		const decoded = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(fixture<Record<string, unknown>>("consent.fixture.json"));
+		const lineage = "windows-root-lineage";
+		for (const choice of decoded.choices) {
+			choice.invocation = choice.invocation
+				.replace("--cwd /repo", `--cwd "${providerCwd}"`)
+				.replace("review-consent-fixture", lineage);
+		}
+		const started = JSON.parse(JSON.stringify(fixture<Record<string, unknown>>("start.fixture.json")).replaceAll("review-start-fixture", lineage)) as Record<string, unknown>;
+		const expected = [
+			"review", "start", "--contract", "gentle-ai.review-integration/v2", "--cwd", providerCwd,
+			"--target", decoded.targetIdentity, "--projection", "workspace", "--lineage", lineage, "--consent", "granted",
+		];
+		for (const createClient of [client, runtimeClient]) {
+			const queue = queuedAdapter([capabilities(), structuredClone(started)]);
+			const result = await createClient(queue.adapter).answerConsent({ cwd: providerCwd, consent: decoded, answer: "granted" });
+			assert.equal(result.kind, "started");
+			assert.deepEqual(queue.calls, [expected]);
+		}
+	}
+});
+
+test("unmatched consent invocation quotes reject before provider launch", async () => {
+	for (const quote of ["'", '"']) {
+		const decoded = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(fixture<Record<string, unknown>>("consent.fixture.json"));
+		const choice = decoded.choices.find((candidate) => candidate.answer === "granted") as { invocation: string };
+		choice.invocation = `${choice.invocation} ${quote}`;
+		for (const createClient of [client, runtimeClient]) {
+			const queue = queuedAdapter([]);
+			await assert.rejects(
+				() => createClient(queue.adapter).answerConsent({ cwd: "/repo", consent: decoded, answer: "granted" }),
+				(error: unknown) => error instanceof TypeError && error.message === "Native consent invocation has invalid quoting",
+			);
+			assert.deepEqual(queue.calls, []);
+		}
+	}
+});
+
+test("different, duplicate, missing, and malformed consent cwd options reject before provider launch", async () => {
+	const decoded = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(fixture<Record<string, unknown>>("consent.fixture.json"));
+	const drifted = (replace: (invocation: string) => string): ReviewConsentV2 => {
+		const consent = structuredClone(decoded);
+		const choice = consent.choices.find((candidate) => candidate.answer === "granted") as { invocation: string };
+		choice.invocation = replace(choice.invocation);
+		return consent;
+	};
+	const cases = [
+		{ label: "different", reason: "consent-invocation-cwd-changed", consent: drifted((value) => value.replace("--cwd /repo", "--cwd /another-repo")) },
+		{ label: "duplicate", reason: "consent-invocation-option-invalid", consent: drifted((value) => `${value} --cwd /repo`) },
+		{ label: "missing", reason: "consent-invocation-option-invalid", consent: drifted((value) => value.replace("--cwd /repo ", "")) },
+		{ label: "malformed", reason: "consent-invocation-cwd-changed", consent: drifted((value) => value.replace("--cwd /repo", '--cwd ""')) },
+	] as const;
+	for (const scenario of cases) {
+		const queue = queuedAdapter([]);
+		await assert.rejects(
+			() => client(queue.adapter).answerConsent!({ cwd: "/repo", consent: scenario.consent, answer: "granted" }),
+			(error: unknown) => error instanceof NativeReviewConsentBindingError && error.reason === scenario.reason,
+		);
+		assert.deepEqual(queue.calls, [], `${scenario.label} cwd must not launch the provider`);
+	}
+});
+
 test("a consent invocation binding mismatch is a typed pre-native error that never launches the provider", async () => {
 	const consent = (await import("../lib/review-integration-v2.ts")).decodeReviewConsentV2(fixture<Record<string, unknown>>("consent.fixture.json"));
 	const queue = queuedAdapter([]);

package/tests/native-review-parity-runtime.test.ts

@@ -140,6 +140,8 @@ test("generated runtime decoder consumes the captured terminal closure directly"
 
 test("registered gentle_review surfaces the package-pinned Pi transport refusal before native START for a safe internal symlink candidate", async (t) => {
 	await reviewEnabledHome(t);
+	const handshakeLessEnvironment = { ...process.env };
+	delete handshakeLessEnvironment.GENTLE_PI_REVIEW_RELAY_CONTRACT;
 	const workspace = await realpath(await mkdtemp(join(tmpdir(), "gentle-pi-v215-symlink-candidate-")));
 	const repository = join(workspace, "repository");
 	t.after(async () => {
@@ -174,11 +176,15 @@ test("registered gentle_review surfaces the package-pinned Pi transport refusal
 	// refusal happens before native START, regardless of candidate materialization.
 	const native = new NativeReviewCliV216(async (request) => {
 		if (request.arguments[0] === "review" && request.arguments[1] === "start") nativeStartReached = true;
-		const command = await run(binary, request.arguments, request.cwd, true);
+		const command = await run(binary, request.arguments, request.cwd, true, handshakeLessEnvironment);
 		return { ...command, signal: null, timedOut: false, outputLimitExceeded: false };
 	});
 	const tools = new Map<string, RegisteredController>();
-	createGentleAiExtension({ nativeReviewCli: native, candidateViews } as Parameters<typeof createGentleAiExtension>[0])({
+	// The extension declares the relay handshake in the session environment on
+	// load (gentle-pi#550). Keep registration isolated in a throwaway environment
+	// and spawn the pinned binary with an explicit handshake-less environment so
+	// ambient valid relay configuration cannot change this fixture's behavior.
+	createGentleAiExtension({ nativeReviewCli: native, candidateViews, processEnv: {} } as Parameters<typeof createGentleAiExtension>[0])({
 		on() {},
 		registerTool(definition: RegisteredController & { name: string }) { tools.set(definition.name, definition); },
 		registerCommand() {},

package/tests/native-review-parity.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -183,7 +183,6 @@ interface ParityRuntimeOptions {
 	pendingReviewConsentRegistry?: PendingReviewConsentRegistry;
 	now?: () => number;
 	scheduleTimer?: (callback: () => void, delayMs: number) => { unref: () => void };
-	writeConsentLatch?: (cwd: string) => void;
 }
 
 function parityRuntime(nativeReviewCli: NativeReviewCli | null, options: ParityRuntimeOptions = {}): ParityRuntime {
@@ -197,7 +196,7 @@ function parityRuntime(nativeReviewCli: NativeReviewCli | null, options: ParityR
 		now: options.now,
 		scheduleTimer: options.scheduleTimer,
 	} as unknown as Parameters<typeof createGentleAiExtension>[0];
-	__testing.createGentleAiExtension(dependencies, options.writeConsentLatch ?? (() => {}))({
+	__testing.createGentleAiExtension(dependencies)({
 		on(name: string, handler: RegisteredEvent) { events.set(name, handler); },
 		registerTool(definition: RegisteredControllerTool & { name: string }) { tools.set(definition.name, definition); },
 		registerCommand(name: string, definition: RegisteredCommand) { commands.set(name, definition); },
@@ -401,7 +400,7 @@ test("public gentle:review-mode handler reports current operations, global-off w
 	assert.deepEqual(unavailableNotices, [{ message: "Gentle AI review mode is not available with the currently negotiated native version.", type: "info" }]);
 });
 
-test("public consent relay is session-bound, one-shot, and candidate-scoped", async (t) => {
+test("public consent relay allows any active session to resolve a live binding, is one-shot, and is candidate-scoped", async (t) => {
 	const cwd = repository(t);
 	const sharedRegistry = new PendingReviewConsentRegistry();
 	const fixture = consentNative(cwd);
@@ -411,14 +410,22 @@ test("public consent relay is session-bound, one-shot, and candidate-scoped", as
 	const sameSessionResult = await answerConsent(second, cwd, sameSession.consent_binding, "declined", "same-session");
 	assert.equal(sameSessionResult.outcome, "consent-declined-this-candidate");
 
+	// gentle-pi#455: a binding is answerable by whichever active Pi session
+	// presents it, not only the session whose START created it.
 	const blockedA = await beginConsent(first, cwd, "session-a");
 	assert.deepEqual(blockedA.consent, decodeReviewConsentV3(captured("consent-v3.captured.json")).raw);
-	const staleOtherSession = await answerConsent(second, cwd, blockedA.consent_binding, "declined", "session-b");
-	assert.equal(staleOtherSession.operation, "answer-consent");
-	// gentle-pi#516: a binding this session does not hold must never read as
-	// a healthy pre-start STATUS; it names itself and the exit.
-	assertStaleConsentBinding(staleOtherSession, blockedA.consent_binding, "consent-binding-unknown");
-	assert.deepEqual(fixture.answers, ["declined"]);
+	const declinedFromOtherSession = await answerConsent(second, cwd, blockedA.consent_binding, "declined", "session-b");
+	assert.equal(declinedFromOtherSession.operation, "answer-consent");
+	assert.equal(declinedFromOtherSession.outcome, "consent-declined-this-candidate");
+	assert.deepEqual(fixture.answers, ["declined", "declined"]);
+
+	// Cross-session resolution still enforces single use: once answered, no
+	// session -- including the one whose START created it -- may answer it again.
+	const staleAfterCrossSessionAnswer = await answerConsent(first, cwd, blockedA.consent_binding, "declined", "session-a");
+	assert.equal(staleAfterCrossSessionAnswer.operation, "answer-consent");
+	assertStaleConsentBinding(staleAfterCrossSessionAnswer, blockedA.consent_binding, "consent-binding-already-consumed");
+	assert.deepEqual(fixture.answers, ["declined", "declined"]);
+
 	const blockedB = await beginConsent(second, cwd, "session-b");
 	const declined = await answerConsent(second, cwd, blockedB.consent_binding, "declined", "session-b");
 	assert.equal(declined.outcome, "consent-declined-this-candidate");
@@ -426,15 +433,19 @@ test("public consent relay is session-bound, one-shot, and candidate-scoped", as
 	const staleConsumed = await answerConsent(second, cwd, blockedB.consent_binding, "declined", "session-b");
 	assert.equal(staleConsumed.operation, "answer-consent");
 	assertStaleConsentBinding(staleConsumed, blockedB.consent_binding, "consent-binding-already-consumed");
-	assert.deepEqual(fixture.answers, ["declined", "declined"]);
+	assert.deepEqual(fixture.answers, ["declined", "declined", "declined"]);
 
+	// A binding still pending when its owning session shuts down is discarded
+	// and becomes unreachable to every session -- cross-session resolution
+	// included.
+	const blockedShutdown = await beginConsent(first, cwd, "session-a");
 	const shutdown = first.events.get("session_shutdown");
 	assert.ok(shutdown);
 	await shutdown!({}, context(cwd, "session-a"));
 	await shutdown!({}, context(cwd, "session-a"));
-	const staleShutdown = await answerConsent(first, cwd, blockedA.consent_binding, "declined", "session-a");
+	const staleShutdown = await answerConsent(second, cwd, blockedShutdown.consent_binding, "declined", "session-b");
 	assert.equal(staleShutdown.operation, "answer-consent");
-	assertStaleConsentBinding(staleShutdown, blockedA.consent_binding, "consent-binding-unknown");
+	assertStaleConsentBinding(staleShutdown, blockedShutdown.consent_binding, "consent-binding-unknown");
 
 	writeFileSync(join(cwd, "app.ts"), "export const value = 3;\n");
 	const nextCandidate = await beginConsent(second, cwd, "session-b");
@@ -450,7 +461,7 @@ test("public consent relay is session-bound, one-shot, and candidate-scoped", as
 	const staleModeCleared = await answerConsent(second, cwd, nextCandidate.consent_binding, "declined", "session-b");
 	assert.equal(staleModeCleared.operation, "answer-consent");
 	assertStaleConsentBinding(staleModeCleared, nextCandidate.consent_binding, "consent-binding-unknown");
-	assert.equal(fixture.starts.count, 4);
+	assert.equal(fixture.starts.count, 5);
 });
 
 test("already-consumed local consent bindings reconcile exactly once with the native status transition", async (t) => {
@@ -783,18 +794,14 @@ test("native START maps only provider facts and omits absent evidence", async (t
 	assert.equal(rendered.next_transition, nextTransition);
 });
 
-test("consent completion stays authoritative when local latch recording fails", async (t) => {
+test("candidate consent completion writes no persistent asked latch", async (t) => {
 	const cwd = repository(t);
 	const fixture = consentNative(cwd);
-	const notices: Array<{ message: string; type?: string }> = [];
-	const runtime = parityRuntime(fixture.native, {
-		writeConsentLatch: () => { throw new Error("injected latch failure"); },
-	});
+	const runtime = parityRuntime(fixture.native);
 	const blocked = await beginConsent(runtime, cwd);
 	const completed = await answerConsent(runtime, cwd, blocked.consent_binding, "granted");
 	assert.equal((completed.result as { lineage_id?: string }).lineage_id, "consent-lineage");
 	assert.deepEqual(fixture.answers, ["granted"]);
-	assert.deepEqual(notices, []);
-	// The extension handler owns UI reporting; the controller's successful native
-	// result remains authoritative even when the local best-effort latch fails.
+	const commonDir = execFileSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd, encoding: "utf8" }).trim();
+	assert.equal(existsSync(join(commonDir, "gentle-pi", "review-consent", "asked.json")), false);
 });