gentle-pi 4.0.0 → 4.2.0

package/tests/native-review-cli.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtempSync, readFileSync, rmSync, symlinkSync } from "node:fs";
+import { mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
@@ -14,10 +14,14 @@ import {
 	NativeReviewCliV216,
 	NativeReviewIntegrationError,
 	createNodeExecFileAdapter,
+	createWindowsProcessTreeKiller,
+	windowsTaskkillPath,
+	gentleAiProcessEnvironment,
 	isNativeReviewUnachievableVerbRefused,
 	type ExecFileAdapter,
 	type NativeTargetStatusRequest,
 } from "../lib/native-review-cli.ts";
+import { setBundledInstallForTesting } from "../lib/gentle-shell-bundled.ts";
 
 const fixture = (name: string): Record<string, unknown> => JSON.parse(
 	readFileSync(join(process.cwd(), "tests", "fixtures", "devbinary", name), "utf8"),
@@ -418,6 +422,63 @@ test("native START queries STATUS then executes only the provider-rendered order
 	]);
 });
 
+// Captured from the released gentle-ai 4.0.0 binary, which predates START
+// lens selection (verify-always-rdd-high S8).
+const LENS_SELECTION_UNSUPPORTED_FAILURE = {
+	schema: "gentle-ai.review-integration.failure/v2", contract: "gentle-ai.review-integration/v2", operation: "review.status",
+	phase: "preflight", code: "invalid_request", message: "The negotiated review request is invalid.", mutation_outcome: "not_started",
+	authority_applicability: "not_evaluated", retry_safe: true, replayability: "not_replayable", required_inputs: [],
+	next_action: "correct_request", cause: "flag provided but not defined: -lenses",
+};
+
+test("native START preflights the agent lens selection through STATUS", async () => {
+	const tokens = [
+		"--contract=gentle-ai.review-integration/v2", "--cwd=/repo", `--target=${TARGET}`,
+		"--projection=workspace", "--agent=pi", "--consent=relay",
+		"--lenses=review-risk,review-reliability", "--lenses-reason=changes token parsing",
+	];
+	const queue = queuedAdapter([
+		{ stdout: JSON.stringify(negotiatedStartStatus(TARGET, tokens)) },
+		{ stdout: JSON.stringify(fixture("start-v3-zero-lens-closed.captured.json")) },
+	]);
+	await client(queue.adapter).start({ cwd: "/repo", targetIdentity: TARGET, lenses: ["review-risk", "review-reliability"], lensesReason: "changes token parsing" });
+	assert.deepEqual(queue.calls.map((call) => call.arguments), [
+		["review", "status", "--contract", "gentle-ai.review-integration/v2", "--cwd", "/repo", "--projection", "workspace", "--agent", "pi",
+			"--lenses", "review-risk,review-reliability", "--lenses-reason", "changes token parsing", "--next-transition"],
+		["review", "start", ...tokens],
+	]);
+});
+
+test("native START falls back to the tier default when the provider predates lens selection", async () => {
+	const tokens = [
+		"--contract=gentle-ai.review-integration/v2", "--cwd=/repo", `--target=${TARGET}`,
+		"--projection=workspace", "--agent=pi", "--consent=relay",
+	];
+	const queue = queuedAdapter([
+		{ stdout: JSON.stringify(LENS_SELECTION_UNSUPPORTED_FAILURE), exitCode: 1 },
+		{ stdout: JSON.stringify(negotiatedStartStatus(TARGET, tokens)) },
+		{ stdout: JSON.stringify(fixture("start-v3-zero-lens-closed.captured.json")) },
+	]);
+	const result = await client(queue.adapter).start({ cwd: "/repo", targetIdentity: TARGET, lenses: ["review-risk"], lensesReason: "changes token parsing" });
+	assert.equal(result.action, "closed");
+	assert.deepEqual(queue.calls.map((call) => call.arguments), [
+		["review", "status", "--contract", "gentle-ai.review-integration/v2", "--cwd", "/repo", "--projection", "workspace", "--agent", "pi",
+			"--lenses", "review-risk", "--lenses-reason", "changes token parsing", "--next-transition"],
+		["review", "status", "--contract", "gentle-ai.review-integration/v2", "--cwd", "/repo", "--projection", "workspace", "--agent", "pi", "--next-transition"],
+		["review", "start", ...tokens],
+	]);
+});
+
+test("native START never retries a selection refusal that is not an unknown lens flag", async () => {
+	const refusal = { ...LENS_SELECTION_UNSUPPORTED_FAILURE, cause: 'review status --lenses names unknown lens "security"' };
+	const queue = queuedAdapter([{ stdout: JSON.stringify(refusal), exitCode: 1 }]);
+	await assert.rejects(
+		() => client(queue.adapter).start({ cwd: "/repo", targetIdentity: TARGET, lenses: ["security"], lensesReason: "why" }),
+		(error: unknown) => error instanceof NativeReviewIntegrationError && error.failureEnvelope.cause === refusal.cause,
+	);
+	assert.equal(queue.calls.length, 1);
+});
+
 test("native START relays provider-owned intended-untracked selection and transition argv verbatim", async () => {
 	const selectionValue = JSON.stringify(["new.ts", "nested/other.ts"]);
 	const selectionTokens = ["--selection-kind=untracked", "--selection-json={{value}}", "--selection-proof=provider-issued"];
@@ -495,6 +556,85 @@ test("native consent completion decodes START/v4 and replays its provider argv u
 	assert.deepEqual(queue.calls[0]?.arguments, consent.choices[0].invocation.split(" ").slice(1));
 });
 
+// Builds a Pi-bound consent/v3 envelope whose choices carry `--lenses-reason`
+// rendered exactly as `rendered`, plus the argv Pi must replay for the granted
+// choice when that rendering splits into `reason`.
+function consentWithLensReason(rendered: string, reason: string): { consent: ReturnType<typeof decodeReviewConsentV3>; expected: readonly string[] } {
+	const rawConsent = fixture("consent-v3.captured.json");
+	rawConsent.agent = "pi";
+	const expected: string[][] = [];
+	for (const choice of rawConsent.choices as Record<string, unknown>[]) {
+		const bound = String(choice.invocation)
+			.replace(/--cwd \S+ --target/, "--cwd /repo --target")
+			.replace(" --consent ", " --agent pi --lenses-reason REASON --consent ");
+		choice.invocation = bound.replace("REASON", () => rendered);
+		expected.push(bound.split(" ").slice(1).map((word) => word === "REASON" ? reason : word));
+	}
+	const consent = decodeReviewConsentV3(rawConsent, "pi");
+	assert.ok(consent.choices[0].invocation.includes(` --lenses-reason ${rendered} `));
+	return { consent, expected: expected[0]! };
+}
+
+// Answers the granted choice and proves Pi launched the package binary exactly
+// once with the exact argv, through execFile and never through a shell.
+async function assertLensReasonReplay(rendered: string, reason: string): Promise<void> {
+	const { consent, expected } = consentWithLensReason(rendered, reason);
+	const queue = queuedAdapter([{ stdout: JSON.stringify(reviewingStartV4(consent.targetIdentity)) }]);
+	const answered = await client(queue.adapter).answerConsent({ cwd: "/repo", consent, answer: "granted" });
+	assert.equal(answered.kind, "started");
+	assert.equal(queue.calls.length, 1);
+	assert.equal(queue.calls[0]?.file, "/package/.gentle-ai/gentle-ai");
+	assert.deepEqual(queue.calls[0]?.arguments, expected);
+	const replayed = queue.calls[0]?.arguments ?? [];
+	const reasonIndex = replayed.indexOf("--lenses-reason");
+	assert.deepEqual(replayed.slice(reasonIndex, reasonIndex + 2), ["--lenses-reason", reason]);
+}
+
+// gentle-ai renders a lens reason with POSIX shell quoting, so an apostrophe
+// arrives as `'...'\''...'`. Pi splits it into exact argv and never runs a shell.
+test("native consent answer replays a POSIX-quoted apostrophe lens reason as one exact argument", async () => {
+	await assertLensReasonReplay("'touched the package'\\''s parser'", "touched the package's parser");
+});
+
+test("native consent answer treats a backslash before an apostrophe outside quotes as an escaped apostrophe", async () => {
+	await assertLensReasonReplay("package\\'s", "package's");
+});
+
+test("native consent answer treats a backslash before a double quote outside quotes as an escaped double quote", async () => {
+	await assertLensReasonReplay('say\\"x\\"', 'say"x"');
+});
+
+test("native consent answer joins a token across a backslash-escaped space outside quotes", async () => {
+	await assertLensReasonReplay("touched\\ parser", "touched parser");
+});
+
+test("native consent answer keeps a backslash before any other character verbatim outside quotes", async () => {
+	await assertLensReasonReplay("C:\\repo", "C:\\repo");
+	await assertLensReasonReplay("\\\\server\\share", "\\\\server\\share");
+	await assertLensReasonReplay("touched\\nparser", "touched\\nparser");
+});
+
+test("native consent answer keeps single quotes literal around double quotes and backslashes", async () => {
+	await assertLensReasonReplay("'say \"x\" and \\y'", 'say "x" and \\y');
+	await assertLensReasonReplay("'touched the package\\'", "touched the package\\");
+});
+
+test("native consent answer keeps backslashes verbatim inside double quotes", async () => {
+	await assertLensReasonReplay('"C:\\repo\\"', "C:\\repo\\");
+});
+
+test("native consent answer still rejects an unterminated quote before launching the provider", async () => {
+	for (const rendered of ["'touched the package'\\''s parser", "'touched the package", '"say x']) {
+		const { consent } = consentWithLensReason(rendered, "unused");
+		const queue = queuedAdapter([]);
+		await assert.rejects(
+			() => client(queue.adapter).answerConsent({ cwd: "/repo", consent, answer: "granted" }),
+			(error: unknown) => error instanceof TypeError && error.message === "Native consent invocation has invalid quoting",
+		);
+		assert.deepEqual(queue.calls, []);
+	}
+});
+
 test("native START refuses invalid committed-range and target bindings before STATUS", async () => {
 	for (const request of [
 		{ cwd: "/repo", baseRef: "origin/main" },
@@ -665,6 +805,76 @@ test("node execFile adapter passes AbortSignal to child_process", async () => {
 	await assert.rejects(pending, (error: unknown) => error instanceof Error && error.name === "AbortError");
 });
 
+// On Windows, killing gentle-ai alone leaves its git children running against
+// the repository index; abort and timeout must take the whole tree down.
+test("node execFile adapter kills the whole process tree on Windows abort and timeout", async () => {
+	const killed: number[] = [];
+	const killProcessTree = (pid: number) => { killed.push(pid); process.kill(pid); };
+	const adapter = createNodeExecFileAdapter({ platform: "win32", killProcessTree });
+	const request = { file: process.execPath, arguments: ["-e", "setTimeout(() => {}, 10_000)"], cwd: process.cwd(), maxBufferBytes: 1024 };
+
+	const controller = new AbortController();
+	const aborted = adapter({ ...request, timeoutMs: 30_000, signal: controller.signal });
+	setTimeout(() => controller.abort(), 50);
+	await assert.rejects(aborted, (error: unknown) => error instanceof Error && error.name === "AbortError");
+	assert.equal(killed.length, 1, "abort kills the tree once");
+
+	const timedOut = await adapter({ ...request, timeoutMs: 50 });
+	assert.equal(timedOut.timedOut, true);
+	assert.equal(killed.length, 2, "timeout kills the tree once");
+
+	const preAborted = new AbortController();
+	preAborted.abort();
+	await assert.rejects(adapter({ ...request, timeoutMs: 30_000, signal: preAborted.signal }), (error: unknown) => error instanceof Error && error.name === "AbortError");
+	assert.equal(killed.length, 2, "an already-aborted call spawns nothing");
+
+	const finished = await adapter({ ...request, arguments: ["-p", "'done'"], timeoutMs: 30_000 });
+	assert.deepEqual([finished.exitCode, finished.stdout.trim(), finished.timedOut], [0, "done", false]);
+	assert.equal(killed.length, 2, "a call that finishes kills nothing");
+});
+
+// taskkill can be unavailable (AppLocker, a broken PATH): the deadline must
+// still hold, through a direct kill of gentle-ai itself.
+test("node execFile adapter still enforces the timeout on Windows when the tree kill does nothing", async () => {
+	const adapter = createNodeExecFileAdapter({ platform: "win32", killProcessTree: () => {} });
+	const startedAt = Date.now();
+	const result = await adapter({ file: process.execPath, arguments: ["-e", "setTimeout(() => {}, 5_000)"], cwd: process.cwd(), maxBufferBytes: 1024, timeoutMs: 100 });
+	assert.equal(result.timedOut, true);
+	assert.ok(Date.now() - startedAt < 3_000, `settled after ${Date.now() - startedAt}ms`);
+});
+
+// A descendant that inherited gentle-ai's stdout/stderr keeps the pipes open
+// after gentle-ai itself exits; the deadline must still hold.
+test("node execFile adapter enforces the Windows timeout when a descendant holds the inherited pipes", async () => {
+	const directory = mkdtempSync(join(tmpdir(), "gentle-pi-tree-kill-"));
+	const pidFile = join(directory, "descendant.pid");
+	const script = `const { spawn } = require("node:child_process"); const d = spawn(process.execPath, ["-e", "setTimeout(() => {}, 30000)"], { stdio: "inherit" }); require("node:fs").writeFileSync(${JSON.stringify(pidFile)}, String(d.pid)); d.unref();`;
+	try {
+		const adapter = createNodeExecFileAdapter({ platform: "win32", killProcessTree: () => {} });
+		const startedAt = Date.now();
+		const pending = adapter({ file: process.execPath, arguments: ["-e", script], cwd: process.cwd(), maxBufferBytes: 1024, timeoutMs: 300 });
+		const result = await Promise.race([pending, new Promise<"unsettled">((resolve) => setTimeout(() => resolve("unsettled"), 6_000).unref())]);
+		assert.notEqual(result, "unsettled", "the call settles while the descendant still holds the pipes");
+		if (result === "unsettled") return;
+		assert.equal(result.timedOut, true);
+		assert.ok(Date.now() - startedAt < 4_000, `settled after ${Date.now() - startedAt}ms`);
+	} finally {
+		try { process.kill(Number(readFileSync(pidFile, "utf8"))); } catch { /* Already gone. */ }
+		rmSync(directory, { recursive: true, force: true });
+	}
+});
+
+// A bare "taskkill" resolves from the current directory first on Windows, so a
+// repository shipping its own taskkill.exe would run on any abort or timeout.
+test("Windows tree kill runs taskkill by its absolute System32 path from a trusted cwd", () => {
+	const calls: Array<{ file: string; args: readonly string[]; cwd: string }> = [];
+	const kill = createWindowsProcessTreeKiller({ SystemRoot: "D:\\Windows" }, (file, args, options) => { calls.push({ file, args, cwd: options.cwd }); return { on() {} }; });
+	kill(42);
+	assert.deepEqual(calls, [{ file: "D:\\Windows\\System32\\taskkill.exe", args: ["/pid", "42", "/T", "/F"], cwd: "D:\\Windows\\System32" }]);
+	assert.equal(windowsTaskkillPath({}), "C:\\Windows\\System32\\taskkill.exe");
+	assert.equal(windowsTaskkillPath({ SystemRoot: "relative\\dir" }), "C:\\Windows\\System32\\taskkill.exe", "a relative SystemRoot is never trusted");
+});
+
 test("capture-result receives the controller AbortSignal without an automatic mutation timeout", async () => {
 	const controller = new AbortController();
 	controller.abort();
@@ -909,3 +1119,28 @@ test("acknowledge-approved keeps its fail-closed stderr and typed refusal discip
 		(error: unknown) => error instanceof NativeReviewCliError && error.code === NATIVE_REVIEW_ERROR_CODE.EMPTY_OUTPUT,
 	);
 });
+
+// S9: this package running from a bundled install (the testing overlay stands
+// in for its location; the detection itself is tested with real installs in
+// gentle-ai-binary-isolation.test.ts) and the launcher's GENTLE_SHELL_PREFIX.
+function bundledIsolation(t: { after: (fn: () => void) => void }): { prefix: string; env: NodeJS.ProcessEnv } {
+	const prefix = realpathSync(mkdtempSync(join(tmpdir(), "gentle-ai-isolation-site-")));
+	setBundledInstallForTesting({ root: prefix });
+	t.after(() => {
+		setBundledInstallForTesting(undefined);
+		rmSync(prefix, { recursive: true, force: true });
+	});
+	return { prefix, env: { PATH: "/usr/bin", GENTLE_SHELL_PREFIX: prefix } };
+}
+
+test("the central gentle-ai environment carries Gentle AI's isolation variables only in a bundled install", (t) => {
+	const { prefix, env } = bundledIsolation(t);
+	const bundled = gentleAiProcessEnvironment(env);
+	assert.equal(bundled.GENTLE_AI_HOME, join(prefix, "gentle-ai"));
+	assert.equal(bundled.GENTLE_AI_PI_CONFIG_DIR, join(prefix, "config", "gentle-ai"));
+	assert.equal(bundled.GENTLE_PI_CONFIG_HOME, join(prefix, "config"), "the parent Gentle AI 4.0.0 reads it as");
+	assert.equal(bundled.GENTLE_AI_NO_SELF_UPDATE, "1");
+	assert.equal(bundled.GENTLE_PI_REVIEW_RELAY_CONTRACT, "gentle-pi.review-relay/v1");
+	const ordinary = gentleAiProcessEnvironment({ PATH: "/usr/bin" });
+	assert.deepEqual(ordinary, { PATH: "/usr/bin", GENTLE_PI_REVIEW_RELAY_CONTRACT: "gentle-pi.review-relay/v1" });
+});

package/tests/native-review-consent.test.ts

@@ -87,11 +87,11 @@ function queuedAdapter(outputs: readonly Record<string, unknown>[]): { adapter:
 }
 
 function client(adapter: ExecFileAdapter): NativeReviewCliV216 {
-	return new NativeReviewCliV216(adapter, "/package/.gentle-ai/gentle-ai", 30_000, 1024 * 1024, async () => undefined, () => executableDigest);
+	return new NativeReviewCliV216(adapter, "/package/.gentle-ai/gentle-ai", 30_000, 1024 * 1024, async () => undefined);
 }
 
 function runtimeClient(adapter: ExecFileAdapter): RuntimeNativeReviewCliV216 {
-	return new RuntimeNativeReviewCliV216(adapter, "/package/.gentle-ai/gentle-ai", 30_000, 1024 * 1024, async () => undefined, () => executableDigest);
+	return new RuntimeNativeReviewCliV216(adapter, "/package/.gentle-ai/gentle-ai", 30_000, 1024 * 1024, async () => undefined);
 }
 
 test("negotiated ordinary START executes the complete STATUS-rendered relay vector and preserves the consent envelope", async () => {

package/tests/native-review-parity-runtime.test.ts

@@ -44,7 +44,7 @@ const resolvedBinary = (() => {
 	}
 })();
 const nativeBinaryGate = requireNativeBinary({ resolvedBinary, digestsPinned: true, env: process.env });
-if (!nativeBinaryGate.run) console.log(`native-review-parity-runtime: ${nativeBinaryGate.reason}`);
+if (nativeBinaryGate.run === false) console.log(`native-review-parity-runtime: ${nativeBinaryGate.reason}`);
 const test = nativeBinaryGate.run ? baseTest : baseTest.skip;
 const binary = resolvedBinary ?? "";
 

package/tests/native-review-parity.test.ts

@@ -181,8 +181,6 @@ interface ParityRuntime {
 interface ParityRuntimeOptions {
 	candidateViews?: CandidateViewRegistry;
 	pendingReviewConsentRegistry?: PendingReviewConsentRegistry;
-	now?: () => number;
-	scheduleTimer?: (callback: () => void, delayMs: number) => { unref: () => void };
 }
 
 function parityRuntime(nativeReviewCli: NativeReviewCli | null, options: ParityRuntimeOptions = {}): ParityRuntime {
@@ -193,8 +191,6 @@ function parityRuntime(nativeReviewCli: NativeReviewCli | null, options: ParityR
 		nativeReviewCli,
 		candidateViews: options.candidateViews ?? new CandidateViewRegistry(),
 		pendingReviewConsentRegistry: options.pendingReviewConsentRegistry ?? new PendingReviewConsentRegistry(),
-		now: options.now,
-		scheduleTimer: options.scheduleTimer,
 	} as unknown as Parameters<typeof createGentleAiExtension>[0];
 	__testing.createGentleAiExtension(dependencies)({
 		on(name: string, handler: RegisteredEvent) { events.set(name, handler); },
@@ -330,7 +326,7 @@ async function answerConsent(runtime: ParityRuntime, cwd: string, binding: unkno
 // that names itself and its exit. It still carries the current negotiated
 // STATUS as reconciliation context, but it never reads as a healthy
 // pre-start "ready".
-function assertStaleConsentBinding(outcome: Record<string, unknown>, binding: unknown, code: "consent-binding-unknown" | "consent-binding-expired" | "consent-binding-already-consumed"): void {
+function assertStaleConsentBinding(outcome: Record<string, unknown>, binding: unknown, code: "consent-binding-unknown" | "consent-binding-already-consumed"): void {
 	assert.equal(outcome.status, "blocked");
 	assert.equal(outcome.outcome, "consent-binding-stale");
 	assert.equal(outcome.consent_binding, binding);
@@ -677,7 +673,7 @@ test("unavailable and ambiguous consent follow-ups never replay a consumed bindi
 	assert.equal(statusCalls, callsBeforeStaleReconciliation + 1, "already-consumed binding reconciliation performs exactly one additional STATUS call");
 });
 
-test("concurrent answers atomically claim consent before review-mode gating and ignore a queued expiry callback", async (t) => {
+test("concurrent answers atomically claim consent before review-mode gating", async (t) => {
 	const cwd = repository(t);
 	const fixture = consentNative(cwd);
 	const candidateViews = new CandidateViewRegistry();
@@ -687,7 +683,6 @@ test("concurrent answers atomically claim consent before review-mode gating and
 		cleanupCalls += 1;
 		cleanup(token);
 	};
-	const scheduled: Array<() => void> = [];
 	let releaseModeGate: (() => void) | undefined;
 	const modeGate = new Promise<void>((resolve) => { releaseModeGate = resolve; });
 	let modeCalls = 0;
@@ -702,13 +697,12 @@ test("concurrent answers atomically claim consent before review-mode gating and
 	let nativeAnswerCalls = 0;
 	fixture.native.answerConsent = async (request) => {
 		nativeAnswerCalls += 1;
-		assert.equal(cleanupCalls, 0, "a queued expiry callback must not clean claimed candidate authority before the provider answer");
+		assert.equal(cleanupCalls, 0, "candidate authority remains live before the provider answer");
 		await providerGate;
 		return await nativeAnswer(request);
 	};
 	const runtime = parityRuntime(fixture.native, {
 		candidateViews,
-		scheduleTimer: (callback) => { scheduled.push(callback); return { unref() {} }; },
 	});
 	const blocked = await beginConsent(runtime, cwd);
 	fixture.native.reviewMode = async () => {
@@ -726,9 +720,7 @@ test("concurrent answers atomically claim consent before review-mode gating and
 	assert.equal(modeCalls, 1, "the first answer pauses at the asynchronous review-mode gate");
 	const second = answerConsent(runtime, cwd, blocked.consent_binding, "declined");
 	await new Promise<void>((resolve) => setImmediate(resolve));
-	assert.equal(scheduled.length, 1);
-	scheduled[0]!();
-	assert.equal(cleanupCalls, 0, "a queued expiry callback is a harmless no-op after the answer claim");
+	assert.equal(cleanupCalls, 0, "claimed consent retains candidate authority until the answer settles");
 
 	releaseModeGate!();
 	releaseProvider!();
@@ -741,47 +733,19 @@ test("concurrent answers atomically claim consent before review-mode gating and
 	assert.equal(cleanupCalls, 1, "only the answered binding cleans candidate authority");
 });
 
-test("timer-cleaned and synchronously pruned consent bindings remain expired within their session", async (t) => {
+test("unanswered consent remains reusable after the former deadline and answers only once", async (t) => {
 	const cwd = repository(t);
 	const fixture = consentNative(cwd);
-	const registry = new PendingReviewConsentRegistry();
-	const start = 1_000;
-	let now = start;
-	const scheduled: Array<() => void> = [];
-	const runtime = parityRuntime(fixture.native, {
-		pendingReviewConsentRegistry: registry,
-		now: () => now,
-		scheduleTimer: (callback) => { scheduled.push(callback); return { unref() {} }; },
-	});
+	const runtime = parityRuntime(fixture.native);
+	let now = 1_000;
+	t.mock.method(Date, "now", () => now);
 	const first = await beginConsent(runtime, cwd);
+	now += 24 * 60 * 60 * 1000;
 	const reused = await beginConsent(runtime, cwd);
 	assert.equal(reused.consent_binding, first.consent_binding);
-	assert.equal(scheduled.length, 1);
-	now += 10 * 60 * 1000;
-	// The real TTL callback drops the frozen candidate immediately. Its
-	// session-local disposition remains only to classify this stale answer.
-	scheduled[0]!();
-	const timerExpired = await answerConsent(runtime, cwd, first.consent_binding, "declined");
-	assert.equal(timerExpired.operation, "answer-consent");
-	assertStaleConsentBinding(timerExpired, first.consent_binding, "consent-binding-expired");
-	assert.match(String((timerExpired.diagnostics as { message?: unknown }).message), /expired after 10 minutes/);
-	const second = await beginConsent(runtime, cwd);
-	assert.notEqual(second.consent_binding, first.consent_binding);
-	assert.equal(scheduled.length, 2);
-	assertStaleConsentBinding(await answerConsent(runtime, cwd, first.consent_binding, "declined"), first.consent_binding, "consent-binding-expired");
-
-	// No second callback runs: START synchronously prunes this unused binding
-	// before it can reuse the frozen candidate, and its answer stays typed expiry.
-	now += 10 * 60 * 1000;
-	const third = await beginConsent(runtime, cwd);
-	assert.notEqual(third.consent_binding, second.consent_binding);
-	assertStaleConsentBinding(await answerConsent(runtime, cwd, second.consent_binding, "declined"), second.consent_binding, "consent-binding-expired");
-
-	const reloaded = parityRuntime(fixture.native, { pendingReviewConsentRegistry: new PendingReviewConsentRegistry() });
-	assertStaleConsentBinding(await answerConsent(reloaded, cwd, first.consent_binding, "declined"), first.consent_binding, "consent-binding-unknown");
-	const afterReload = await beginConsent(reloaded, cwd);
-	assert.notEqual(afterReload.consent_binding, third.consent_binding);
-	assert.equal(fixture.starts.count, 5);
+	const answered = await answerConsent(runtime, cwd, first.consent_binding, "declined");
+	assert.equal(answered.outcome, "consent-declined-this-candidate");
+	assertStaleConsentBinding(await answerConsent(runtime, cwd, first.consent_binding, "declined"), first.consent_binding, "consent-binding-already-consumed");
 });
 
 test("native START maps only provider facts and omits absent evidence", async (t) => {

package/tests/native-risk-evidence-parity.test.ts

@@ -89,3 +89,24 @@ test("an empty file is named before it is described", () => {
 test("a reason with no path contributes no phrase", () => {
 	assert.deepEqual(nativeRiskEvidencePhrases("high", [{ code: "empty_content" }]), []);
 });
+
+// Field truth from gentle-ai main (4.1.0-dev): one committed high-risk
+// candidate's consent/v3 `risk_evidence` beside its START/v4 `risk_reasons`.
+test("dangerous sink and agent escalation reasons render the gentle-ai phrases", () => {
+	assert.deepEqual(
+		nativeRiskEvidencePhrases("high", [
+			{ code: "dangerous_sink", signal: "dangerous_sink", path: "auth/session.py" },
+			{ code: "hot_path", signal: "auth", path: "auth/session.py" },
+			{ code: "process_boundary", signal: "shell_process", path: "auth/session.py" },
+		]),
+		[
+			"a dangerous code pattern in auth/session.py",
+			"authentication in auth/session.py",
+			"code that starts other processes in auth/session.py",
+		],
+	);
+	assert.deepEqual(
+		nativeRiskEvidencePhrases("high", [{ code: "agent_escalation", signal: "agent_escalation" }]),
+		["the agent that made this change flagged it as high risk"],
+	);
+});

package/tests/no-self-pause-contract.test.ts

@@ -0,0 +1,87 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import test from "node:test";
+
+// gentle-shell#1731 T13 (evidence L24): in bench task x4 the user wrote "I may
+// stop you between the two and pick the second part up later"; every Gentle
+// cell delivered only the first part and paused by itself. Hedged delivery
+// wording asks for resumable notes and separate commits, never a stop, and
+// the close step must not leave tracked tasks pending without a user stop.
+
+const REPO_ROOT = join(import.meta.dirname, "..");
+const read = (relative: string): string => readFileSync(join(REPO_ROOT, relative), "utf8");
+
+const tracking = read("assets/orchestrator-tracking.md");
+const core = read("assets/orchestrator.md");
+
+function authorizationSection(): string {
+	const start = tracking.indexOf("#### Authorization and progress");
+	assert.ok(start !== -1, "tracking module must keep its Authorization and progress section");
+	const next = tracking.indexOf("\n#### ", start + 1);
+	return tracking.slice(start, next === -1 ? undefined : next);
+}
+
+test("T13: conditional change intent is narrowed to whether a change is authorized at all", () => {
+	const section = authorizationSection();
+	assert.ok(
+		section.includes(
+			"Ambiguous or conditional change intent (unclear whether a change is authorized at all) requires one clarification; stop and wait.",
+		),
+		"the clarification clause must be scoped to authorization itself",
+	);
+	assert.ok(
+		!section.includes("Ambiguous or conditional change intent requires one clarification"),
+		"the unscoped clarification clause must be gone",
+	);
+});
+
+test("T13: hedged delivery wording asks for resumable notes and separate commits, not a stop", () => {
+	const section = authorizationSection();
+	for (const clause of [
+		"Hedged delivery wording (the user may stop you, review commits one at a time, or pick the work up later)",
+		"asks for resumable notes and separate commits, not a stop",
+		"complete every authorized task in the current turn unless the user explicitly says to wait",
+	]) {
+		assert.ok(section.includes(clause), `tracking module is missing: ${clause}`);
+	}
+	const hedge = section.slice(section.indexOf("Hedged delivery wording"));
+	const sentence = hedge.slice(0, hedge.indexOf(". ") + 1);
+	assert.doesNotMatch(sentence, /\bask (?:one|a|the user)\b|question/i, "the hedge rule must not add a product or design question");
+});
+
+test("T13: the Close gate requires continuing or quoting the user's explicit stop", () => {
+	const section = authorizationSection();
+	assert.ok(
+		section.includes(
+			"Close gate: before the final answer, if any tracked task in the feature document or `todo` is still pending, continue it or quote the exact user sentence that orders the stop.",
+		),
+		"tracking module must carry the Close gate",
+	);
+});
+
+test("T13: budgets hold and the pinned human-control line is untouched", () => {
+	const bytes = Buffer.byteLength(tracking, "utf8");
+	assert.ok(bytes <= 12_600, `orchestrator-tracking.md is ${bytes} B, over its 12,600 B budget`);
+	assert.ok(core.includes("- Preserve human control: user decisions beat agent momentum."), "core human-control line must stay verbatim");
+	assert.ok(core.includes("4. **Track**") && core.includes("`orchestrator-tracking.md`"), "Track must still load the tracking module");
+});
+
+test("T13: the always-on harness narrows conditional intent and gates Close on pending tasks", () => {
+	// The harness ODD steps are injected on every request, including the small
+	// path that never loads the tracking module, so the narrowing must live there too.
+	const harness = read("extensions/gentle-ai.ts");
+	assert.ok(
+		harness.includes("Ambiguous or conditional change intent (unclear whether a change is authorized at all) gets one clarification; stop and wait."),
+		"harness Authorize step must narrow conditional intent",
+	);
+	assert.ok(!harness.includes("Ambiguous or conditional change intent gets one clarification"), "the broad harness wording must be gone");
+	assert.ok(
+		harness.includes("A user saying they may stop you or resume later asks for notes and separate commits, not a stop."),
+		"harness must say hedged delivery wording is not a stop",
+	);
+	assert.ok(
+		harness.includes("Never end with a tracked task pending unless you quote the user's explicit stop."),
+		"harness Close step must gate pending tracked tasks",
+	);
+});