gentle-pi 4.0.0 → 4.2.0

package/tests/review-agent-end-preflight.test.ts

@@ -7,7 +7,18 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test, { after, before } from "node:test";
 import type { ExtensionAPI, ExtensionContext, ExtensionToolContext } from "@earendil-works/pi-coding-agent";
-import { createGentleAiExtension } from "../extensions/gentle-ai.ts";
+import { __testing, createGentleAiExtension } from "../extensions/gentle-ai.ts";
+
+// S5 (startup-home-repo-and-changes): startup review negotiation runs after
+// session_start returns and passes its deadline signal to native STATUS.
+// These tests observe negotiation outcomes, so they wait for it, and they
+// compare request contracts without the per-call signal.
+const settleStartup = () => __testing.startupNegotiationSettled();
+function withoutSignal<T>(request: T): T {
+	if (request === null || typeof request !== "object" || !("signal" in request)) return request;
+	const { signal: _signal, ...rest } = request as Record<string, unknown>;
+	return rest as T;
+}
 import { NATIVE_REVIEW_ERROR_CODE, NativeReviewCliError, type NativeReviewCli } from "../lib/native-review-cli.ts";
 import type { ReviewStatusV3 } from "../lib/review-integration-v2.ts";
 
@@ -235,7 +246,7 @@ for (const scenario of ["same", "changed", "sibling-root", "nested-root", "faile
 		const native = {
 			reviewMode: onMode("on"),
 			targetStatus: async (request: unknown) => {
-				statusRequests.push(request);
+				statusRequests.push(withoutSignal(request));
 				return burned ? executeStartStatus(nextTarget) : approved;
 			},
 			acknowledgeApproved: async (request: unknown) => {
@@ -260,6 +271,7 @@ for (const scenario of ["same", "changed", "sibling-root", "nested-root", "faile
 		await directWrite(handlers, session);
 		const result = await review.execute("post-ack", { operation: "acknowledge-approved", lineageId }, undefined, undefined, toolContext(session));
 		if (unsuccessful) {
+			assert.ok(typeof result.details === "object" && result.details !== null && "outcome" in result.details && "mutation_outcome" in result.details);
 			assert.equal(result.details.outcome, scenario === "failed" ? "native-operation-failed" : "native-mutation-status-reconciled");
 			assert.equal(result.details.mutation_outcome, scenario === "failed" ? "none" : "unknown");
 		} else assert.deepEqual(result.details, {
@@ -300,6 +312,7 @@ test("passive session events outside Git with RDD off never invoke native STATUS
 		const { handlers } = harness(native);
 		const session = ctx("outside-git", true, cwd);
 		await handlers.get("session_start")!({ type: "session_start" }, session);
+		await settleStartup();
 		await handlers.get("agent_end")!(agentEndEvent, session);
 		assert.deepEqual(calls, [], "passive non-Git events need no native entry");
 		assert.equal(existsSync(join(cwd, ".git")), false, "passive events must not initialize Git");
@@ -311,7 +324,7 @@ test("agent_end performs no STATUS call and sends nothing when RDD is off", asyn
 	const native = {
 		reviewMode: onMode("off"),
 		targetStatus: async (request: unknown) => {
-			statusRequests.push(request);
+			statusRequests.push(withoutSignal(request));
 			throw new Error("targetStatus must not be called when RDD is off");
 		},
 	} as unknown as NativeReviewCli;
@@ -329,7 +342,7 @@ test("agent_end nudges exactly once when RDD is on and STATUS offers review.star
 	const native = {
 		reviewMode: onMode("on"),
 		targetStatus: async (request: { agent?: string }) => {
-			statusRequests.push(request);
+			statusRequests.push(withoutSignal(request));
 			return executeStartStatus(targetIdentity);
 		},
 	} as unknown as NativeReviewCli;
@@ -351,6 +364,30 @@ test("agent_end nudges exactly once when RDD is on and STATUS offers review.star
 	assert.equal(statusRequests[0]?.agent, "pi");
 });
 
+// verify-always-rdd-high S2: automatic review is for high risk only. When the
+// native assessment reports review_due false (a medium or passive candidate),
+// agent_end never nudges; review_due true still nudges. An assessment that
+// cannot answer keeps the nudge, so a reminder is never lost to an error.
+test("agent_end nudges only when the native assessment reports review_due", async () => {
+	const targetIdentity = `sha256:${"b".repeat(64)}`;
+	for (const [label, assess, wantNudges] of [
+		["medium, not due", async () => ({ risk: "medium", reviewDue: false, reviewDueReason: "under_budget" }), 0],
+		["high, due", async () => ({ risk: "high", reviewDue: true, reviewDueReason: "high_risk" }), 1],
+		["assessment rejects", async () => { throw new Error("assess failed"); }, 1],
+	] as const) {
+		const native = {
+			reviewMode: onMode("on"),
+			targetStatus: async () => executeStartStatus(targetIdentity),
+			assess,
+		} as unknown as NativeReviewCli;
+		const { handlers, sent } = harness(native);
+		const session = ctx(`agent-end-review-due-${label.replace(/\W+/g, "-")}`);
+		await directWrite(handlers, session);
+		await handlers.get("agent_end")!(agentEndEvent, session);
+		assert.equal(sent.length, wantNudges, label);
+	}
+});
+
 test("agent_end nudges once per target identity and again for a fresh identity", async () => {
 	let targetIdentity = `sha256:${"b".repeat(64)}`;
 	const native = {
@@ -431,7 +468,7 @@ test("gentle-ai-worker agent_end never queries native review", async () => {
 	const native = {
 		reviewMode: onMode("on"),
 		targetStatus: async (request: unknown) => {
-			statusRequests.push(request);
+			statusRequests.push(withoutSignal(request));
 			throw new Error("a bounded worker must not own native review");
 		},
 	} as unknown as NativeReviewCli;
@@ -452,7 +489,7 @@ test("agent_end sends nothing and performs no STATUS call when GENTLE_PI_AGENTS_
 	const native = {
 		reviewMode: onMode("on"),
 		targetStatus: async (request: unknown) => {
-			statusRequests.push(request);
+			statusRequests.push(withoutSignal(request));
 			throw new Error("targetStatus must not be called in a child session");
 		},
 	} as unknown as NativeReviewCli;
@@ -538,12 +575,14 @@ for (const scenario of ["reload", "fork", "new", "off-branch"] as const) {
 			const first = harness(native, entries);
 			const session = ctx(`receipt-${scenario}`, true, cwd);
 			await first.handlers.get("session_start")!({}, session);
+			await settleStartup();
 			await directWrite(first.handlers, session);
 			await first.handlers.get("session_shutdown")!({ reason: "reload" }, session);
 			const resumed = harness(native, entries);
 			const next = ctx(scenario === "reload" || scenario === "off-branch" ? `receipt-${scenario}` : `replacement-${scenario}`, true, cwd);
 			if (scenario === "off-branch") next.sessionManager.getBranch = () => [];
 			await resumed.handlers.get("session_start")!({ reason: scenario }, next);
+			await settleStartup();
 			const beforeEnd = statusCalls;
 			await resumed.handlers.get("agent_end")!(agentEndEvent, next);
 			assert.equal(statusCalls - beforeEnd, scenario === "reload" ? 1 : 0);
@@ -624,6 +663,7 @@ for (const mode of ["on", "off", "unknown", "missing", "malformed", "incompatibl
 			const { handlers, sent } = harness(native);
 			const session = ctx(`non-git-${mode}`, true, cwd);
 			await handlers.get("session_start")!({}, session);
+			await settleStartup();
 			assert.equal(requests.length, 0, "passive startup cannot bootstrap");
 			assert.equal(existsSync(join(cwd, ".git")), false);
 			await handlers.get("agent_end")!(agentEndEvent, session);
@@ -643,6 +683,7 @@ for (const path of ["odd/tasks/feature.md", "README.md", ".pi/settings.json", "m
 			const h = harness({ reviewMode: onMode("on"), targetStatus: async () => { calls++; return stopStatus("unused"); } } as unknown as NativeReviewCli);
 			const session = ctx("non-source", false, cwd);
 			await h.handlers.get("session_start")!({}, session);
+			await settleStartup();
 			await h.handlers.get("tool_result")!({ toolName: "write", toolCallId: "bookkeeping", input: { path }, isError: false }, session);
 			assert.equal(calls, 0);
 			assert.equal(existsSync(join(cwd, ".git")), false);
@@ -659,6 +700,7 @@ for (const initiallyGit of [true, false]) {
 			} } as unknown as NativeReviewCli);
 			const session = ctx("established-source", false, cwd);
 			await h.handlers.get("session_start")!({}, session);
+			await settleStartup();
 			if (!initiallyGit) { await directWrite(h.handlers, session); assert.equal(calls, 1); }
 			await rename(join(cwd, ".git"), join(cwd, "saved-git"));
 			calls = 0;
@@ -677,6 +719,7 @@ test("headless successful source write prepares after binding without a reminder
 		} } as unknown as NativeReviewCli);
 		const session = ctx("headless-source", false, cwd);
 		await h.handlers.get("session_start")!({}, session);
+		await settleStartup();
 		await directWrite(h.handlers, session);
 		assert.equal(calls, 1);
 		assert.equal(existsSync(join(cwd, ".git")), true);
@@ -690,7 +733,7 @@ test("session_start negotiates the current target identity when RDD is on", asyn
 	const native = {
 		reviewMode: onMode("on"),
 		targetStatus: async (request: { agent?: string }) => {
-			statusRequests.push(request);
+			statusRequests.push(withoutSignal(request));
 			return executeStartStatus(targetIdentity);
 		},
 	} as unknown as NativeReviewCli;
@@ -701,9 +744,10 @@ test("session_start negotiates the current target identity when RDD is on", asyn
 		const notifications: Array<{ message: string; severity: string }> = [];
 		const session = {
 			...ctx("session-baseline-record", true, cwd),
-			ui: { notify: (message: string, severity: string) => notifications.push({ message, severity }) },
+			ui: { ...ctx("session-baseline-record", true, cwd).ui, notify: (message: string, severity: string) => { notifications.push({ message, severity }); } },
 		};
 		await sessionStart!({}, session);
+		await settleStartup();
 		assert.equal(statusRequests[0]?.agent, "pi");
 		assert.deepEqual(sent, []);
 		assert.deepEqual(notifications, []);
@@ -723,6 +767,8 @@ test("agent_end skips pre-session work, then nudges after an own mutation", asyn
 		const session = ctx("session-baseline-skip", true, cwd);
 
 		await sessionStart!({}, session);
+
+		await settleStartup();
 		await agentEnd!(agentEndEvent, session);
 		assert.deepEqual(sent, [], "the baseline candidate predates the session and is not nudged");
 
@@ -746,7 +792,7 @@ for (const ownsMutation of [false, true]) {
 		const native = {
 			reviewMode: onMode("on"),
 			targetStatus: async (request: unknown) => {
-				statusRequests.push(request);
+				statusRequests.push(withoutSignal(request));
 				return executeStartStatus(targetIdentity);
 			},
 		} as unknown as NativeReviewCli;
@@ -760,6 +806,8 @@ for (const ownsMutation of [false, true]) {
 			assert.equal(typeof agentEnd, "function");
 
 			await sessionStart!({}, session);
+
+			await settleStartup();
 			assert.deepEqual(statusRequests, [{ cwd, agent: "pi" }], "startup records targetA separately");
 			assert.deepEqual(sent, []);
 			// Like host event delivery, an event without a subscriber is a no-op.
@@ -810,7 +858,7 @@ test("agent_end reminds for an own write after startup with RDD off", async () =
 			status: { global: "", cloneLocal: mode === "on" ? "on" : "", effective: mode, source: "clone_local" },
 		}),
 		targetStatus: async (request: unknown) => {
-			statusRequests.push(request);
+			statusRequests.push(withoutSignal(request));
 			if (mode === "off") throw new Error("targetStatus must not be called when RDD is off");
 			return executeStartStatus(targetIdentity);
 		},
@@ -822,6 +870,8 @@ test("agent_end reminds for an own write after startup with RDD off", async () =
 		const session = ctx("session-baseline-rdd-off", true, cwd);
 
 		await sessionStart!({}, session);
+
+		await settleStartup();
 		assert.deepEqual(statusRequests, []);
 
 		mode = "on";
@@ -870,6 +920,8 @@ test("session_shutdown does not turn the baseline into an own mutation", async (
 		const session = ctx("session-baseline-shutdown", true, cwd);
 
 		await sessionStart!({}, session);
+
+		await settleStartup();
 		await agentEnd!(agentEndEvent, session);
 		assert.deepEqual(sent, [], "the baseline candidate is skipped");
 

package/tests/review-candidate-view.test.ts

@@ -364,6 +364,55 @@ test("candidate owner publication never removes a replaced marker", (t) => {
 	assert.equal(readdirSync(parent).some((name) => name.endsWith(".reaper-lock")), false);
 });
 
+test("candidate owner publication preserves a replaced marker with 64-bit identity precision loss", (t) => {
+	mockWindowsAcl(t);
+	// The registry canonicalizes the contributor root (e.g. /var -> /private/var on macOS).
+	const cwd = repository(t), parent = join(realpathSync(cwd), ".git", "gentle-ai", "candidate-views");
+	const originalLstat = fs.lstatSync, fsync = fs.fsyncSync, write = fs.writeFileSync;
+	// Modeled identities, not measured NTFS values: distinct 64-bit indices round to one Number.
+	const high = 2n ** 53n;
+	assert.notEqual(high, high + 1n);
+	assert.equal(Number(high), Number(high + 1n));
+	let marker: string | undefined, replaced = false, faults = 0, adds = 0;
+	let savedContent: string | undefined;
+	t.mock.method(fs, "lstatSync", (path: Parameters<typeof fs.lstatSync>[0], ...args: unknown[]) => {
+		const stat = (originalLstat as (...arguments_: unknown[]) => ReturnType<typeof fs.lstatSync>)(path, ...args);
+		if (marker === undefined && typeof path === "string" && path.endsWith(".owner.json") && path === join(parent, readdirSync(parent).find((name) => name.endsWith(".owner.json")) ?? "")) marker = path;
+		if (path !== marker) return stat;
+		const bigint = (args[0] as { bigint?: boolean } | undefined)?.bigint === true;
+		const ino = replaced ? high + 1n : high;
+		// Retain real metadata and Stats methods; only the identity pair is synthetic.
+		return Object.assign(Object.create(Object.getPrototypeOf(stat)), stat, {
+			dev: bigint ? high : Number(high), ino: bigint ? ino : Number(ino),
+		});
+	});
+	t.mock.method(fs, "fsyncSync", (fd: number) => {
+		// The reaper lock is synced before marker publication; it is not this fault's boundary.
+		if (marker === undefined || replaced) return fsync(fd);
+		assert.ok(marker, "owned marker identity must be captured before the fault");
+		faults++;
+		savedContent = readFileSync(marker, "utf8");
+		renameSync(marker, `${marker}.saved`);
+		write(marker, "replacement", { mode: 0o600 });
+		replaced = true;
+		throw new Error("fixture marker fsync failure after 64-bit identity replacement");
+	});
+	syncBuiltinESMExports();
+	t.after(() => { t.mock.restoreAll(); syncBuiltinESMExports(); });
+	const registry = new CandidateViewRegistry((file, args, options) => {
+		if (args[0] === "worktree" && args[1] === "add") adds++;
+		return execFileSync(file, args, options);
+	}, "win32");
+	assert.throws(() => registry.create({ contributorRoot: cwd }), (error: unknown) => error instanceof CandidateViewError && error.reason === "candidate-owner-preparation-failed");
+	assert.equal(faults, 1, "replacement fault must be reached exactly once");
+	assert.equal(adds, 0);
+	assert.ok(marker);
+	assert.equal(readFileSync(`${marker}.saved`, "utf8"), savedContent);
+	assert.equal(readdirSync(parent).some((name) => name.endsWith(".reaper-lock")), false);
+	assert.equal(existsSync(marker), true, "publication rollback deleted the replacement after distinct 64-bit identities rounded to the same Number");
+	assert.equal(readFileSync(marker, "utf8"), "replacement");
+});
+
 test("public POSIX candidate-views parent reports bounded privacy guidance without changing permissions or adding a worktree", { skip: process.platform === "win32" }, (t) => {
 	const cwd = repository(t);
 	const parent = join(cwd, ".git", "gentle-ai", "candidate-views");
@@ -721,6 +770,47 @@ for (const race of ["root", "registration", "lock"] as const) {
 	});
 }
 
+test("ordinary cleanup preserves a replaced root with 64-bit identity precision loss", (t) => {
+	mockWindowsAcl(t);
+	const cwd = repository(t), high = 2n ** 53n;
+	const originalLstat = fs.lstatSync;
+	let root = "", replaced = false, lists = 0, removes = 0;
+	const registry = new CandidateViewRegistry((file, args, options) => {
+		// Never allow Git to delete the replacement, even on the failing implementation.
+		if (args[0] === "worktree" && args[1] === "remove") { removes++; return ""; }
+		const result = execFileSync(file, args, options);
+		if (root && args[0] === "worktree" && args[1] === "list" && ++lists === 2) {
+			const pointer = readFileSync(join(root, ".git"));
+			renameSync(root, `${root}.saved`);
+			mkdirSync(root);
+			writeFileSync(join(root, ".git"), pointer);
+			writeFileSync(join(root, "replacement.txt"), "replacement");
+			replaced = true;
+		}
+		return result;
+	});
+	const view = registry.create({ contributorRoot: cwd });
+	root = view.root;
+	t.mock.method(fs, "lstatSync", (path: Parameters<typeof fs.lstatSync>[0], ...args: unknown[]) => {
+		const stat = (originalLstat as (...arguments_: unknown[]) => ReturnType<typeof fs.lstatSync>)(path, ...args);
+		if (path !== root) return stat;
+		const bigint = (args[0] as { bigint?: boolean } | undefined)?.bigint === true;
+		const ino = replaced ? high + 1n : high;
+		return Object.assign(Object.create(Object.getPrototypeOf(stat)), stat, {
+			dev: bigint ? high : Number(high), ino: bigint ? ino : Number(ino),
+		});
+	});
+	syncBuiltinESMExports();
+	t.after(() => { t.mock.restoreAll(); syncBuiltinESMExports(); });
+	assert.throws(() => view.cleanup());
+	assert.equal(replaced, true);
+	assert.equal(readFileSync(join(root, "replacement.txt"), "utf8"), "replacement");
+	assert.equal(existsSync(`${root}.saved`), true);
+	assert.equal(existsSync(ownerMarker(root)), true);
+	assert.equal(existsSync(`${root}.reaper-lock`), false);
+	assert.equal(removes, 0, "distinct 64-bit directory identities must stop cleanup before Git removal");
+});
+
 test("ordinary cleanup never unlinks a replaced sidecar after Git removal", (t) => {
 	const cwd = repository(t);
 	let marker = "";
@@ -1193,22 +1283,21 @@ test("candidate view skips a shared index that disappears during stat or copy",
 	for (const phase of ["stat", "copy"] as const) {
 		const originalLstatSync = fs.lstatSync;
 		const originalCopyFileSync = fs.copyFileSync;
-		fs.lstatSync = ((path: string | Buffer, options?: Parameters<typeof lstatSync>[1]) => {
+		t.mock.method(fs, "lstatSync", (path: string | Buffer, options?: Parameters<typeof lstatSync>[1]) => {
 			if (phase === "stat" && path === sharedIndexPath) throw Object.assign(new Error("shared index disappeared"), { code: "ENOENT" });
 			return originalLstatSync(path, options);
-		}) as typeof fs.lstatSync;
-		fs.copyFileSync = ((source: string | Buffer, destination: string | Buffer) => {
+		});
+		t.mock.method(fs, "copyFileSync", (source: string | Buffer, destination: string | Buffer) => {
 			if (phase === "copy" && source === sharedIndexPath) throw Object.assign(new Error("shared index disappeared"), { code: "ENOENT" });
 			return originalCopyFileSync(source, destination);
-		}) as typeof fs.copyFileSync;
+		});
 		syncBuiltinESMExports();
 		let view: ReturnType<typeof createCandidateView> | undefined;
 		try {
 			view = createCandidateView({ contributorRoot, intendedUntracked: [] });
 			assert.equal(view.paths.includes("staged-addition.txt"), true, phase);
 		} finally {
-			fs.lstatSync = originalLstatSync;
-			fs.copyFileSync = originalCopyFileSync;
+			t.mock.restoreAll();
 			syncBuiltinESMExports();
 			view?.cleanup();
 		}
@@ -1435,13 +1524,13 @@ test("corrected views stay within frozen scope and replace projections only when
 	const registry = new CandidateViewRegistry();
 	const initial = registry.create({ contributorRoot }); registry.bind({ token: initial.token, lineageId: "correction", selectedLenses: ["review-risk"] });
 	writeFileSync(join(contributorRoot, "tracked.txt"), "corrected\n");
-	const corrected = registry.createCorrected("correction", contributorRoot);
+	const corrected = registry.createCorrected("correction", contributorRoot, "corrected-1");
 	assert.notEqual(corrected.candidateTree, initial.candidateTree);
 	assert.equal(registry.resolveProjection("correction", contributorRoot).candidateTree, initial.candidateTree);
 	registry.promoteCorrected("correction", corrected.token);
 	assert.equal(registry.resolveProjection("correction", contributorRoot).candidateTree, corrected.candidateTree);
 	writeFileSync(join(contributorRoot, "escaped.txt"), "outside scope\n");
-	assert.throws(() => registry.createCorrected("correction", contributorRoot), /escapes the frozen genesis paths/);
+	assert.throws(() => registry.createCorrected("correction", contributorRoot, "escaped-2"), /escapes the frozen genesis paths/);
 	registry.cleanupTerminal("correction", "approved");
 });
 
@@ -1664,7 +1753,7 @@ test("candidate view compacts an oversized non-ASCII scope losslessly and determ
 		assert.throws(() => readCandidateContextManifestPage(compact.encoded, compact.sha256, actorEntries.length + 1), /cursor/);
 		const nonCanonicalBytes = Buffer.from(JSON.stringify({ gitlinks: decoded.manifest.gitlinks, scopeByMode: decoded.manifest.scopeByMode, version: 1 }), "utf8");
 		assert.throws(
-			() => decodeCandidateContextManifest(gzipSync(nonCanonicalBytes, { mtime: 0 }).toString("base64url"), createHash("sha256").update(nonCanonicalBytes).digest("hex")),
+			() => decodeCandidateContextManifest(gzipSync(nonCanonicalBytes).toString("base64url"), createHash("sha256").update(nonCanonicalBytes).digest("hex")),
 			/canonical/,
 		);
 	} finally {
@@ -1682,7 +1771,7 @@ test("candidate context manifest decoder accepts canonical numeric-looking gitli
 		scopeByMode: { "160000": ["10", "2"] },
 		gitlinks,
 	}), "utf8");
-	const encoded = gzipSync(bytes, { mtime: 0 }).toString("base64url");
+	const encoded = gzipSync(bytes).toString("base64url");
 	assert.deepEqual(decodeCandidateContextManifest(encoded, createHash("sha256").update(bytes).digest("hex")).manifest, {
 		version: 1,
 		scopeByMode: { "160000": ["10", "2"] },
@@ -1701,7 +1790,7 @@ test("candidate context manifest decoder rejects noncanonical nonnumeric gitlink
 		gitlinks,
 	}), "utf8");
 	assert.throws(
-		() => decodeCandidateContextManifest(gzipSync(bytes, { mtime: 0 }).toString("base64url"), createHash("sha256").update(bytes).digest("hex")),
+		() => decodeCandidateContextManifest(gzipSync(bytes).toString("base64url"), createHash("sha256").update(bytes).digest("hex")),
 		/canonical/,
 	);
 });
@@ -1709,7 +1798,7 @@ test("candidate context manifest decoder rejects noncanonical nonnumeric gitlink
 test("candidate context manifest decoder rejects noncanonical gzip transport for verified bytes", () => {
 	const bytes = Buffer.from(JSON.stringify({ version: 1, scopeByMode: { "100644": ["file.ts"] }, gitlinks: {} }), "utf8");
 	const sha256 = createHash("sha256").update(bytes).digest("hex");
-	const canonical = gzipSync(bytes, { mtime: 0 });
+	const canonical = gzipSync(bytes);
 	const noncanonical = Buffer.from(canonical);
 	noncanonical[4] = (noncanonical[4]! + 1) & 0xff;
 	assert.throws(() => decodeCandidateContextManifest(noncanonical.toString("base64url"), sha256), /canonical/);

package/tests/review-contract-prompt.test.ts

@@ -6,7 +6,7 @@ import { join } from "node:path";
 import test, { after, before } from "node:test";
 import { pathToFileURL } from "node:url";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { createGentleAiExtension } from "../extensions/gentle-ai.ts";
+import { createGentleAiExtension, __testing } from "../extensions/gentle-ai.ts";
 import type { NativeReviewCli } from "../lib/native-review-cli.ts";
 
 // gentle-pi#560 / gentle-ai#4056, #4057: since 2026-08-01 Gentle AI stopped
@@ -103,7 +103,7 @@ test("before_agent_start injects the mirrored review execution contract for the
 	assert.equal(result, undefined, "the handler must not return a replacement systemPrompt");
 	const appended = event.systemPromptOptions.appendSystemPrompt;
 	const expected = mirroredPiOrchestrationText();
-	assert.match(appended, /Substantial authorized work: use ODD/);
+	assert.match(appended, /large tasks get ODD tracking and workers/);
 	assert.match(appended, /For behavior changes with applicable runnable deterministic tests and a clear expected outcome, use test-first by default: observe RED, GREEN, then refactor with focused checks/);
 	assert.match(appended, /Test presence alone does not establish applicability; no chat or TUI toggle activates it/);
 	assert.match(appended, /no meaningful RED, explain why and run proportionate ordinary functional or structural verification/);
@@ -111,7 +111,7 @@ test("before_agent_start injects the mirrored review execution contract for the
 	assert.doesNotMatch(appended, /If tests exist, use strict TDD/);
 	assert.match(appended, /ODD \(Default Workflow, harness section above\) is mandatory on every request/);
 	assert.doesNotMatch(appended, /Prefer SDD\/OpenSpec artifacts/);
-	assert.match(appended, /## Gentle AI review execution contract \(mirrored provider bundle 1\.2\.0\)/);
+	assert.match(appended, /## Gentle AI review execution contract \(mirrored provider bundle 1\.3\.0\)/);
 	assert.ok(appended.includes(expected), "the mirrored orchestration/pi.md text must appear verbatim");
 	assert.match(appended, /call `gentle_review` with {"operation":"inspect"}/);
 	assert.match(appended, /call `gentle_review` with operation `status`, the exact retained `lineageId`, and `workspaceRoot`/);
@@ -162,7 +162,7 @@ test("before_agent_start does not let legacy prompt text bypass primary ODD and
 	const event = primaryEvent({ systemPrompt: "SDD apply executor body" });
 	await beforeAgentStart(event, ctx());
 	const appended = event.systemPromptOptions.appendSystemPrompt;
-	assert.match(appended, /Substantial authorized work: use ODD/);
+	assert.match(appended, /large tasks get ODD tracking and workers/);
 	assert.match(appended, /Gentle AI review execution contract/);
 	assert.doesNotMatch(appended, /### 3\. SDD \(optional\)/);
 });
@@ -228,3 +228,32 @@ test("rejects a tampered mirror, accepts a matching one, and warns once", async
 		rmSync(matching, { recursive: true, force: true });
 	}
 });
+
+// gentle-shell#1494 F2: when receipt-driven development is off, the review
+// execution contract is irrelevant to the session, so it is not loaded. On and
+// unknown keep it (unknown fails safe toward the reviewed path).
+function rddCli(effective: "on" | "off" | "throws"): NativeReviewCli {
+	return {
+		reviewMode: async () => {
+			if (effective === "throws") throw new Error("native review mode is unavailable");
+			return { operation: "status", scope: "clone", status: { global: effective, cloneLocal: "", effective, source: "global" } };
+		},
+	} as unknown as NativeReviewCli;
+}
+
+for (const [effective, injected] of [["off", false], ["on", true], ["throws", true]] as const) {
+	test(`before_agent_start ${injected ? "injects" : "skips"} the review execution contract when RDD is ${effective === "throws" ? "unknown" : effective}`, async () => {
+		__testing.clearRddStatusMemoForTesting();
+		try {
+			const { beforeAgentStart } = harness(rddCli(effective));
+			const event = primaryEvent();
+			await beforeAgentStart(event, ctx());
+			const appended = event.systemPromptOptions.appendSystemPrompt;
+			assert.match(appended, /# el Gentleman Orchestrator/, "the harness itself is always injected");
+			if (injected) assert.match(appended, /Gentle AI review execution contract/);
+			else assert.doesNotMatch(appended, /Gentle AI review execution contract/);
+		} finally {
+			__testing.clearRddStatusMemoForTesting();
+		}
+	});
+}