gentle-pi 4.0.0 → 4.2.0

package/tests/gentle-shell.test.ts

@@ -4,18 +4,23 @@ import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSy
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import test, { after } from "node:test";
+import test, { after, afterEach } from "node:test";
 import { initTheme, type ExtensionAPI, type ExtensionContext, type SlashCommandInfo, type SourceInfo } from "@earendil-works/pi-coding-agent";
-import { CURSOR_MARKER, visibleWidth, type TUI, type TuiMouseEvent } from "@earendil-works/pi-tui";
-import installGentleShell, { buildShellBarModel, createActiveProfileReader, changesShortcut, devBinaryCard, extractQueuedText, fetchCodexUsage, fetchNanUsage, loadFileDiff, shellGitRunner, openInExternalEditor, usageShortcut, GentlePromptEditor } from "../extensions/gentle-shell.ts";
+import { CURSOR_MARKER, matchesKey, stripTerminalSequences as stripAnsi, TuiMainScreen, visibleWidth, type TUI, type TuiMouseEvent } from "@earendil-works/pi-tui";
+import installGentleShell, { backgroundChangeRefreshesSettled, buildShellBarModel, createActiveProfileReader, changesShortcut, devBinaryCard, extractQueuedText, fetchCodexUsage, fetchNanUsage, loadFileDiff, shellGitRunner, openInExternalEditor, usageShortcut, GentlePromptEditor } from "../extensions/gentle-shell.ts";
 import { CODEX_USAGE_URL, NAN_QUOTA_URL, USAGE_SOURCE_EVENT, USAGE_SOURCE_SCHEMA } from "../lib/shell-usage.ts";
-import { createVimEditorAdapter } from "../lib/vim-editor-adapter.ts";
+import { bindSessionProfile, clearSessionProfileBinding, resetSessionProfileBindingsForTesting } from "../lib/session-profile-binding.ts";
+import { createVimEditorAdapter, isAuditedPiEditorVersion } from "../lib/vim-editor-adapter.ts";
+import { readFrozenInheritedProfile, resetFrozenInheritedProfilesForTesting } from "../lib/session-profile-freeze.ts";
+
+// Fixture sessions share ids across tests; the inherited-profile freeze is
+// process state keyed by session id (gentle-shell#1064 slice 3b-ii).
+afterEach(() => resetFrozenInheritedProfilesForTesting());
 import { buildCommandPaletteGroups } from "../lib/command-palette-catalog.ts";
-import { CHANGE_STATUS } from "../lib/shell-changes.ts";
+import { CHANGE_STATUS, DIFF_MAX_BYTES, DIFF_MAX_LINES, DIFF_TOO_LARGE } from "../lib/shell-changes.ts";
 import { sidebarPart, sidebarState, type SidebarRail } from "../lib/shell-sidebar.ts";
 import { renderTodoCard } from "../lib/shell-todo.ts";
 import type { ShellBarTheme } from "../lib/shell-bar.ts";
-import { stripAnsi } from "../lib/terminal-theme.ts";
 import { createGentleAiExtension } from "../extensions/gentle-ai.ts";
 import { decodeReviewStatusV3 } from "../lib/review-integration-v2.ts";
 import { REVIEW_SIDEBAR_EVENT } from "../lib/review-sidebar-state.ts";
@@ -24,11 +29,15 @@ import { resolveVisualSettings, writeVisualSettings } from "../lib/visual-custom
 import { resolveAnimationPolicy } from "../lib/animation-policy.ts";
 import { resolveVimPolicy, writeVimPolicy } from "../lib/vim-policy.ts";
 import { resolveHistoryCapturePolicy, writeHistoryCapturePolicy } from "../lib/history-capture-policy.ts";
+import { setBundledInstallForTesting } from "../lib/gentle-shell-bundled.ts";
 import { readBannerConfig } from "../extensions/startup-banner.ts";
 import { listVisualProfiles, saveVisualProfile } from "../lib/visual-profiles.ts";
 import { oddPhaseRegistry } from "../lib/odd-phase.ts";
 import { CARD_STYLE, cardStyle, setCardStyle } from "../lib/shell-card.ts";
 import { resolveCardStyle, writeCardStyle } from "../lib/card-style-policy.ts";
+import { CARD_CONTENT, cardContent, resolveCardContent, setCardContent, writeCardContent } from "../lib/card-content-policy.ts";
+import { claimNotificationOwner } from "../lib/notification-service.ts";
+import { DEFAULT_NOTIFICATION_SETTINGS } from "../lib/notification-policy.ts";
 
 
 // Vim fixtures claim the installed pi-tui release, which the adapter gate
@@ -52,7 +61,7 @@ function isolatedEnv(env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
 	isolatedConfigHomes.push(home);
 	return { ...env, GENTLE_PI_CONFIG_HOME: home };
 }
-const gentleShell: typeof installGentleShell = (pi, env, deps) => installGentleShell(pi, isolatedEnv(env), { resolveWorktree, gitRunner: (cwd) => async (args) => pi.exec("git", ["-C", cwd, ...args], { timeout: 5000 }), ...deps });
+const gentleShell: typeof installGentleShell = (pi, env, deps) => installGentleShell(pi, isolatedEnv(env), { resolveWorktree, gitRunner: (cwd) => async (args) => pi.exec("git", ["-C", cwd, ...args], { timeout: 5000 }), rootExists: () => true, ...deps });
 
 const plainTheme = {
 	fg(_color: string, value: string) {
@@ -151,6 +160,8 @@ function fakePi(script: GitScript[] = [{ numstat: "", porcelain: "" }], commands
 		async exec(_command: string, args: string[]) {
 			git.push(args);
 			if (args.includes("worktree")) return { stdout: "worktree /repo\0branch refs/heads/main\0\0", stderr: "", code: 0, killed: false };
+			// Roots outside the worktree list read as a detached HEAD.
+			if (args.includes("symbolic-ref")) return { stdout: "", stderr: "", code: 1, killed: false };
 			const isNumstat = args.includes("diff");
 			const step = script[Math.min(isNumstat ? round : round++, script.length - 1)];
 			return { stdout: isNumstat ? step.numstat : step.porcelain, stderr: "", code: 0, killed: false };
@@ -163,7 +174,7 @@ async function fire(handlers: Map<string, Array<(event: unknown, ctx: ExtensionC
 	for (const handler of handlers.get(event) ?? []) await handler({}, ctx);
 }
 
-function fakeContext(options: { hasUI?: boolean; entries?: unknown[]; oauth?: boolean; pending?: boolean; idle?: boolean; editorFactory?: unknown; token?: string; select?: (title: string, options: string[]) => Promise<string | undefined> } = {}): { ctx: ExtensionContext; ui: FakeUi; overlayReady: Promise<void> } {
+function fakeContext(options: { theme?: typeof plainTheme & { getBgAnsi?(): string }; hasUI?: boolean; entries?: unknown[]; oauth?: boolean; pending?: boolean; idle?: boolean; editorFactory?: unknown; token?: string; select?: (title: string, options: string[]) => Promise<string | undefined> } = {}): { ctx: ExtensionContext; ui: FakeUi; overlayReady: Promise<void> } {
 	const ui: FakeUi = { footerFactory: undefined, editorFactory: options.editorFactory, widgets: new Map(), widgetSets: 0, workingVisible: undefined, notices: [], overlay: undefined, overlayView: undefined, closeOverlay: undefined };
 	let resolveOverlay: () => void;
 	const overlayReady = new Promise<void>((resolve) => { resolveOverlay = resolve; });
@@ -184,7 +195,7 @@ function fakeContext(options: { hasUI?: boolean; entries?: unknown[]; oauth?: bo
 		modelRegistry: { isUsingOAuth: () => options.oauth ?? true, getApiKeyForProvider: async () => options.token },
 		getContextUsage: () => ({ tokens: 122_400, contextWindow: 272_000, percent: 45 }),
 		ui: {
-			theme: plainTheme,
+			theme: options.theme ?? plainTheme,
 			getAllThemes: () => [{ name: "dark", path: undefined }, { name: "light", path: undefined }],
 			getTheme: (name: string) => name === "dark" || name === "light" ? { name } : undefined,
 			setTheme: (name: string) => ({ success: name === "dark" || name === "light" }),
@@ -280,6 +291,63 @@ test("buildShellBarModel shortens the home directory and hides effort for non-re
 	assert.equal(built.branch, null);
 });
 
+test("buildShellBarModel reports auto effort for NaN models that manage their own depth", () => {
+	const { pi } = fakePi();
+	const { ctx } = fakeContext();
+	const model = ctx.model as unknown as { id: string; provider: string };
+	model.provider = "nan";
+	model.id = "deepseek-v4-flash";
+	const footerData = {
+		getGitBranch: () => null,
+		getExtensionStatuses: () => new Map(),
+		getAvailableProviderCount: () => 1,
+		onBranchChange: () => () => {},
+	};
+	assert.equal(buildShellBarModel(pi, ctx, footerData, { home: "/home/alan" }).effort, "auto");
+	// A NaN model that honors the level keeps reporting the selected one.
+	model.id = "glm5.3";
+	assert.equal(buildShellBarModel(pi, ctx, footerData, { home: "/home/alan" }).effort, "medium");
+});
+
+test("a self-managing NaN model announces its automatic depth once per session", async () => {
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, {});
+	const { ctx, ui } = fakeContext();
+	const adaptive = { id: "qwen3.8-flash", provider: "nan", name: "Qwen 3.8 Flash", reasoning: true };
+	const budget = { id: "glm5.3", provider: "nan", name: "GLM 5.3", reasoning: true };
+	(ctx as unknown as { model: unknown }).model = adaptive;
+	const emit = async (event: string, payload: unknown) => {
+		for (const handler of handlers.get(event) ?? []) await handler(payload, ctx);
+	};
+	await emit("thinking_level_select", { type: "thinking_level_select", level: "high", previousLevel: "medium" });
+	assert.deepEqual(ui.notices.filter((notice) => notice.includes("automatically")), [
+		"Qwen 3.8 Flash chooses its reasoning depth automatically; the selected thinking level is accepted but does not change it.",
+	]);
+	// Re-selecting the same model or level never repeats the notice.
+	await emit("model_select", { type: "model_select", model: adaptive, previousModel: budget, source: "set" });
+	assert.equal(ui.notices.filter((notice) => notice.includes("automatically")).length, 1);
+	// A model that applies the level never announces.
+	(ctx as unknown as { model: unknown }).model = budget;
+	await emit("model_select", { type: "model_select", model: budget, previousModel: adaptive, source: "set" });
+	assert.equal(ui.notices.filter((notice) => notice.includes("automatically")).length, 1);
+});
+
+test("a session that starts on a self-managing NaN model announces it once", async () => {
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, {});
+	const { ctx, ui } = fakeContext();
+	const adaptive = { id: "mimo-v2.6-flash", provider: "nan", name: "MiMo V2.6 Flash", reasoning: true };
+	(ctx as unknown as { model: unknown }).model = adaptive;
+	for (const handler of handlers.get("session_start") ?? []) await handler({}, ctx);
+	assert.deepEqual(ui.notices.filter((notice) => notice.includes("automatically")), [
+		"MiMo V2.6 Flash chooses its reasoning depth automatically; the selected thinking level is accepted but does not change it.",
+	]);
+	// A session that starts on a model which honors the level stays silent.
+	(ctx as unknown as { model: unknown }).model = { id: "gemma4", provider: "nan", name: "Gemma 4", reasoning: true };
+	for (const handler of handlers.get("session_start") ?? []) await handler({}, ctx);
+	assert.equal(ui.notices.filter((notice) => notice.includes("automatically")).length, 1);
+});
+
 test("gentleShell installs the footer on session_start when a UI exists", () => {
 	const { pi, handlers } = fakePi();
 	gentleShell(pi, {});
@@ -430,6 +498,71 @@ test("review sidebar rejects foreign-session events and unsubscribes on shutdown
 	}
 });
 
+test("jobs snapshots populate Status, use one compact fallback, and reject stale sessions", async () => {
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" });
+	const { ctx, ui } = fakeContext();
+	await fire(handlers, "session_start", ctx);
+	const statuses = new Map([["gentle-jobs", "⧗ 1 job"], ["mcp", "MCP: 3 servers"]]);
+	const data = { getGitBranch: () => "main", getExtensionStatuses: () => statuses, getAvailableProviderCount: () => 1, onBranchChange: () => () => {} };
+	const tui = { mode: "fullscreen", terminal: { rows: 40, columns: 160 }, requestRender() {} };
+	const factory = ui.footerFactory as (tui: unknown, theme: ShellBarTheme, footerData: unknown) => { render(width: number): string[]; dispose(): void };
+	const component = factory(tui, plainTheme, data);
+	const state = sidebarState(tui as unknown as TUI);
+	const rail = state.parts.get("footer")!;
+	const header = state.parts.get("header")!;
+	const publish = (sessionId: string, jobs: unknown) => pi.events.emit("gentle-ai:jobs-sidebar", { sessionId, snapshot: { jobs } });
+	try {
+		publish("shell-session", [{ id: "job-1", label: "CI for PR 1860", startedAt: 1 }]);
+		assert.match(rail.render(46).join("\n"), /Jobs[\s\S]*CI for PR 1860/);
+		assert.match(rail.render(46).join("\n"), /MCP: 3 servers/);
+		assert.doesNotMatch(rail.render(46).join("\n"), /1 job/, "Jobs replaces the generic integration counter");
+		state.active = true;
+		state.ownsHost = () => true;
+		assert.doesNotMatch(header.render(160).join("\n"), /1 job/, "the visible Status card owns jobs details");
+		state.active = false;
+		tui.terminal.columns = 80;
+		assert.match(header.render(80).join("\n"), /1 job/, "mobile topbar preserves the count");
+		const before = rail.digest?.();
+		publish("foreign", []);
+		publish("shell-session", [{ label: "invalid" }]);
+		assert.equal(rail.digest?.(), before);
+		publish("shell-session", []);
+		assert.doesNotMatch(rail.render(46).join("\n"), /Jobs|CI for PR/);
+		assert.doesNotMatch(header.render(80).join("\n"), /1 job/);
+		publish("shell-session", [{ id: "job-2", label: "Build runtime", startedAt: 2 }]);
+		await fire(handlers, "session_start", ctx);
+		assert.doesNotMatch(rail.render(46).join("\n"), /Build runtime/);
+		await fire(handlers, "session_shutdown", ctx);
+		publish("shell-session", [{ id: "job-3", label: "late", startedAt: 3 }]);
+		assert.doesNotMatch(rail.render(46).join("\n"), /late/);
+	} finally { component.dispose(); }
+});
+
+test("hidden Status leaves only a jobs count in regular bottom and fullscreen header chrome", async (t) => {
+	const home = scopedDoubleEscCancelConfigHome(t);
+	writeVisualSettings({ ...resolveVisualSettings({ gentlePiConfigHome: home }).settings, statusPlacement: "hidden" }, { gentlePiConfigHome: home });
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: home, GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" });
+	const { ctx, ui } = fakeContext();
+	await fire(handlers, "session_start", ctx);
+	const tui = { mode: "regular", terminal: { rows: 40, columns: 160 }, requestRender() {} };
+	const data = { getGitBranch: () => "main", getExtensionStatuses: () => new Map(), getAvailableProviderCount: () => 1, onBranchChange: () => () => {} };
+	const factory = ui.footerFactory as (tui: unknown, theme: ShellBarTheme, footerData: unknown) => { render(width: number): string[]; dispose(): void };
+	const component = factory(tui, plainTheme, data);
+	try {
+		pi.events.emit("gentle-ai:jobs-sidebar", { sessionId: "shell-session", snapshot: { jobs: [{ id: "job-1", label: "CI for PR 1860", startedAt: 1 }] } });
+		assert.equal(component.render(80).join("\n"), "⧗ 1 job");
+		assert.doesNotMatch(component.render(80).join("\n"), /CI for PR|gpt-5/);
+		tui.mode = "fullscreen";
+		const header = sidebarState(tui as unknown as TUI).parts.get("header")!;
+		assert.match(header.render(160).join("\n"), /⧗ 1 job/);
+		assert.doesNotMatch(component.render(160).join("\n"), /1 job/, "the hidden fullscreen footer does not duplicate the topbar count");
+		pi.events.emit("gentle-ai:jobs-sidebar", { sessionId: "shell-session", snapshot: { jobs: [] } });
+		assert.doesNotMatch(header.render(160).join("\n"), /jobs?/);
+	} finally { component.dispose(); await fire(handlers, "session_shutdown", ctx); }
+});
+
 test("the fullscreen Status rail carries a live digest so a profile switch refreshes it", async () => {
 	const { pi, handlers } = fakePi();
 	let profile: string | undefined = "team";
@@ -622,7 +755,9 @@ test("profile polling refreshes both fullscreen surfaces only on change and stop
 	t.mock.method(globalThis, "clearInterval", (handle: { timer: (typeof intervals)[number] }) => { handle.timer.stopped = true; });
 	const { pi, handlers } = fakePi();
 	let resolutions = 0;
-	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: home, GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, {
+	// follow mode keeps the live p → P → G resolution, so a pin edit reaches the
+	// open session through the poll (gentle-shell#1064 slice 3b-ii).
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: home, GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off", GENTLE_PI_PROFILE_FOLLOW: "1" }, {
 		resolveWorktree: () => { resolutions++; return { root: repo, commonDir }; },
 	});
 	const first = fakeContext();
@@ -736,6 +871,16 @@ test("T2 float prompt installed editor reads live toolSuccessBg and preserves Es
 	} finally { themeHost.theme = originalTheme; editor.dispose(); setCardStyle(previous); }
 });
 
+// Herdr's native Pi manifest detects activity from Pi's standard loader row
+// ("⠋ Working..."); the petal frame alone reads as idle to it.
+test("gentleShell keeps Pi's native Working row inside Herdr so native detection sees activity", () => {
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, { HERDR_ENV: "1" });
+	const { ctx, ui } = fakeContext();
+	installedPrompt(ctx, ui, handlers);
+	assert.notEqual(ui.workingVisible, false, "Herdr needs Pi's standard Working row");
+});
+
 test("gentleShell frames the editor with the petal prompt and a hint while empty", () => {
 	const { pi, handlers } = fakePi();
 	gentleShell(pi, {});
@@ -1499,6 +1644,49 @@ test("GentlePromptEditor keeps visual selection when autocomplete offers printab
 	} finally { editor.dispose(); }
 });
 
+// gentle-shell#1565: in ordinary editing the Gentle Agents alt+a shortcut
+// must win over prompt select-all, for empty and non-empty drafts alike.
+test("GentlePromptEditor gives extension shortcuts precedence over selection chords", () => {
+	const { pi, handlers } = fakePi(); gentleShell(pi, {});
+	const { ctx, ui } = fakeContext(); const editor = installedPrompt(ctx, ui, handlers);
+	try {
+		const seen: string[] = [];
+		editor.onExtensionShortcut = (data) => { seen.push(data); return matchesKey(data, "alt+a"); };
+		for (const altA of ["\x1ba", "\x1b[97;3u", "\x1b[97;3:1u"]) {
+			seen.length = 0;
+			editor.setText("");
+			editor.handleInput(altA);
+			assert.deepEqual(seen, [altA], "empty draft dispatches the shortcut");
+			seen.length = 0;
+			editor.setText("abc\ndef");
+			editor.handleInput(altA);
+			assert.deepEqual(seen, [altA], "non-empty draft dispatches the shortcut");
+			assert.doesNotMatch(editor.render(40).join("\n"), /\x1b\[7mabc/);
+			editor.handleInput("\x7f");
+			assert.equal(editor.getText(), "abc\nde", "the draft was not selected");
+		}
+		// alt+e is the dedicated select-all chord while alt+a belongs to Agents.
+		editor.setText("abc\ndef");
+		editor.handleInput("\x1be");
+		assert.match(editor.render(40).join("\n"), /\x1b\[7mabc/);
+		editor.handleInput("\x7f");
+		assert.equal(editor.getText(), "");
+	} finally { editor.dispose(); }
+});
+
+test("GentlePromptEditor keeps alt+a select-all when no extension claims it", () => {
+	const { pi, handlers } = fakePi(); gentleShell(pi, {});
+	const { ctx, ui } = fakeContext(); const editor = installedPrompt(ctx, ui, handlers);
+	try {
+		editor.onExtensionShortcut = () => false;
+		editor.setText("abc\ndef");
+		editor.handleInput("\x1ba");
+		assert.match(editor.render(40).join("\n"), /\x1b\[7mabc/);
+		editor.handleInput("\x7f");
+		assert.equal(editor.getText(), "");
+	} finally { editor.dispose(); }
+});
+
 test("VISUAL autocomplete leaves app shortcut ownership ahead of c and p", () => {
 	const { pi, handlers } = fakePi(); gentleShell(pi, {});
 	const { ctx, ui } = fakeContext(); const editor = installedPrompt(ctx, ui, handlers);
@@ -1618,6 +1806,8 @@ function reverseColumns(row: string): number[] {
 	let inverse = false;
 	let column = 0;
 	const selected: number[] = [];
+	const host = TuiMainScreen.prototype as unknown as { resolveFakeCursors(rows: string[]): string[] };
+	row = host.resolveFakeCursors.call({ showHardwareCursor: false }, [row])[0]!;
 	const tokens = row.match(/\x1b\[[0-9;]*m|\x1b_pi:c\x07|[^\x1b]/g) ?? [];
 	assert.equal(tokens.join(""), row);
 	for (const token of tokens) {
@@ -1833,8 +2023,7 @@ test("GentlePromptEditor autocomplete respects narrow frame widths", () => {
 test("registered prompt stays transparent while idle, working, and queued", () => {
 	const { pi, handlers, tools } = fakePi();
 	gentleShell(pi, {});
-	const { ctx, ui } = fakeContext();
-	ctx.ui.theme = { ...plainTheme, getBgAnsi: () => "\x1b[44m" } as typeof ctx.ui.theme;
+	const { ctx, ui } = fakeContext({ theme: { ...plainTheme, getBgAnsi: () => "\x1b[44m" } });
 	const editor = installedPrompt(ctx, ui, handlers);
 	try {
 		for (const state of ["idle", "working", "queued"]) {
@@ -1895,8 +2084,8 @@ test("visual customization and Vim register once and remain independently discov
 	assert.equal(JSON.parse(readFileSync(join(home, "vim.json"), "utf8")).policy, "on");
 });
 
-test("actual Pi 1.0.0 enables a live prompt and enters NORMAL without a compatibility fallback", async () => {
- assert.equal(INSTALLED_PI, "1.0.0", "the shell audit must run against actual installed Pi 1.0.0");
+test(`actual Pi ${INSTALLED_PI} enables a live prompt and enters NORMAL without a compatibility fallback`, async () => {
+ assert.ok(isAuditedPiEditorVersion(INSTALLED_PI), `actual installed Pi ${INSTALLED_PI} must be audited`);
  const configHome = mkdtempSync(join(tmpdir(), "gentle-vim-shell-"));
  const { pi, handlers, commands } = fakePi();
  gentleShell(pi, { GENTLE_PI_CONFIG_HOME: configHome });
@@ -2810,7 +2999,7 @@ function scopedDoubleEscCancelConfigHome(t: { after(callback: () => void): void
 function findCustomizeRow(ui: FakeUi, label: string, width = 90): boolean {
 	const view = ui.overlayView!;
 	view.handleInput("\x1b[D");
-	for (let category = 0; category < 10; category++) {
+	for (let category = 0; category < 11; category++) {
 		view.handleInput("\x1b[C");
 		for (let index = 0; index < 35; index++) {
 			if (view.render(width).some((line) => line.includes(`▸ ${label}`))) return true;
@@ -2830,6 +3019,61 @@ async function customizeAction(ui: FakeUi, label: string): Promise<void> {
 	assert.ok(ui.notices.length > notices, `action did not finish: ${label}`);
 }
 
+test("customize Notifications applies audio controls directly in the same overlay, without nested menus or visual writes", async (t) => {
+	const home = scopedDoubleEscCancelConfigHome(t);
+	const { pi, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: home }); // Shell loads BEFORE owner.
+	const child = process.env.GENTLE_PI_AGENTS_CHILD;
+	process.env.GENTLE_PI_AGENTS_CHILD = "0";
+	t.after(() => { if (child === undefined) delete process.env.GENTLE_PI_AGENTS_CHILD; else process.env.GENTLE_PI_AGENTS_CHILD = child; });
+	let nested = 0; let writes = 0;
+	const { ctx, ui, overlayReady } = fakeContext({ select: async () => { nested++; return undefined; } });
+	const uiSpies = ctx.ui as unknown as Record<string, unknown>;
+	uiSpies.input = async () => { nested++; return undefined; };
+	uiSpies.confirm = async () => { nested++; return false; };
+	const owner = claimNotificationOwner(() => {}, { env: {},
+		read: () => ({ settings: structuredClone(DEFAULT_NOTIFICATION_SETTINGS), source: "default", globalFile: join(home, "notifications.json"), malformed: false, readError: false }),
+		write: () => { writes++; return join(home, "notifications.json"); } });
+	owner.attach(ctx); t.after(() => owner.retire());
+	let settled = false;
+	const pending = commands.get("gentle:customize")!.handler("", ctx).then(() => { settled = true; });
+	await overlayReady;
+	try {
+		assert.ok(findCustomizeRow(ui, "Audio notifications: off"), "global switch is a direct row");
+		assert.ok(findCustomizeRow(ui, "Audio: unmuted"), "mute is a direct row");
+		assert.equal(findCustomizeRow(ui, "Audio availability: check"), false, "availability row is removed from the card");
+		assert.equal(findCustomizeRow(ui, "Audio: restore preset"), false, "restore row is removed from the card");
+		assert.ok(findCustomizeRow(ui, "Success:"), "Success group is a direct row");
+		assert.ok(findCustomizeRow(ui, "Error:"), "Error group is a direct row");
+		assert.ok(findCustomizeRow(ui, "Attention:"), "Attention group is a direct row");
+		assert.match(ui.overlayView!.render(90).join("\n"), /Audio notifications/);
+		assert.equal(settled, false, "the overlay never closes to open a panel");
+		// Per-event exceptions stay folded until Advanced is expanded in the same overlay.
+		assert.ok(findCustomizeRow(ui, "Advanced:"), "Advanced toggle is a direct row");
+		assert.doesNotMatch(ui.overlayView!.render(90).join("\n"), /agent\.failed:/, "per-event rows stay folded by default");
+		ui.overlayView!.handleInput("\r");
+		// Let the toggle's busy microtask settle before activating a revealed row.
+		await new Promise<void>((resolve) => setImmediate(resolve));
+		const notices = ui.notices.length;
+		assert.ok(findCustomizeRow(ui, "agent.failed:"));
+		ui.overlayView!.handleInput("\r");
+		for (let attempt = 0; attempt < 100 && ui.notices.length === notices; attempt++) await new Promise<void>((resolve) => setTimeout(resolve, 5));
+		assert.ok(ui.notices.length > notices, "direct Enter action finished");
+		assert.equal(writes, 1);
+		assert.match(ui.overlayView!.render(90).join("\n"), /agent\.failed: builtin:attention/);
+		assert.equal(nested, 0, "no ctx.ui.select/input/confirm anywhere in the flow");
+		assert.equal(settled, false, "the notification action never closed the customize overlay");
+		assert.equal(existsSync(join(home, "visual.json")), false);
+		assert.equal(existsSync(join(home, "notifications.json")), false, "stubbed write left no file");
+	} finally { ui.closeOverlay?.(); await pending; }
+});
+
+test("production customize never wires the legacy notification panel", () => {
+	const source = readFileSync(new URL("../extensions/gentle-shell.ts", import.meta.url), "utf8");
+	assert.doesNotMatch(source, /openNotificationPanel|notification-ui\.ts/);
+	assert.match(source, /buildNotificationRows/);
+});
+
 test("customize Editor rows preview global preference without applying until Enter or Space", async (t) => {
 	const home = scopedDoubleEscCancelConfigHome(t);
 	const { pi, commands } = fakePi();
@@ -2886,7 +3130,7 @@ test("customize Cards rows persist the card style and switch live conversation c
 	const pending = commands.get("gentle:customize")!.handler("", ctx);
 	await overlayReady;
 	assert.ok(findCustomizeRow(ui, "Card style: float (current)"));
-	assert.match(ui.overlayView!.render(90).join("\n"), /Cards · 2\/2/);
+	assert.match(ui.overlayView!.render(90).join("\n"), /Cards · 2\/4/);
 	assert.ok(findCustomizeRow(ui, "Card style: neon"));
 	assert.ok(!ui.overlayView!.render(90).some((line) => line.includes("▸ Card style: neon (current)")), "neon is not current without a saved preference");
 	assert.equal(existsSync(join(home, "card-style.json")), false, "highlighting never applies");
@@ -2910,6 +3154,32 @@ test("customize Cards rows persist the card style and switch live conversation c
 	ui.overlayView!.handleInput("\x1b"); await pending;
 });
 
+test("customize Cards rows persist the card content level and switch the live quiet tools", async (t) => {
+	const home = scopedDoubleEscCancelConfigHome(t);
+	const previous = cardContent();
+	t.after(() => setCardContent(previous));
+	const { pi, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: home });
+	assert.equal(cardContent(), CARD_CONTENT.DEFAULT, "no preference file means default");
+	const { ctx, ui, overlayReady } = fakeContext();
+	const pending = commands.get("gentle:customize")!.handler("", ctx);
+	await overlayReady;
+	assert.ok(findCustomizeRow(ui, "Card content: default (current)"));
+	assert.ok(findCustomizeRow(ui, "Card content: minimal"));
+	assert.equal(existsSync(join(home, "card-content.json")), false, "highlighting never applies");
+	await customizeAction(ui, "Card content: minimal");
+	await new Promise<void>(resolve => setImmediate(resolve));
+	assert.equal(resolveCardContent({ gentlePiConfigHome: home }).content, "minimal");
+	assert.equal(cardContent(), CARD_CONTENT.MINIMAL, "the live slot follows the choice");
+	assert.match(ui.notices.at(-1)!, /Card content: minimal/);
+	assert.ok(findCustomizeRow(ui, "Card content: minimal (current)"));
+	assert.ok(findCustomizeRow(ui, "Card content: default"));
+	await customizeAction(ui, "Card content: default");
+	assert.equal(resolveCardContent({ gentlePiConfigHome: home }).content, "default");
+	assert.equal(cardContent(), CARD_CONTENT.DEFAULT);
+	ui.overlayView!.handleInput("\x1b"); await pending;
+});
+
 test("T3 live style Cards action refreshes cached TODO, header, footer and prompt in both directions", async (t) => {
 	const home = scopedDoubleEscCancelConfigHome(t);
 	const previous = cardStyle();
@@ -3032,6 +3302,20 @@ test("the saved card style applies at startup and on every session start", async
 	assert.equal(cardStyle(), CARD_STYLE.FLOAT);
 });
 
+test("the saved card content applies at startup and on every session start", async (t) => {
+	const home = scopedDoubleEscCancelConfigHome(t);
+	const found = cardContent();
+	t.after(() => setCardContent(found));
+	writeCardContent("minimal", { gentlePiConfigHome: home });
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: home });
+	assert.equal(cardContent(), CARD_CONTENT.MINIMAL);
+	writeCardContent("default", { gentlePiConfigHome: home });
+	const { ctx } = fakeContext({ hasUI: false });
+	for (const handler of handlers.get("session_start") ?? []) await handler({}, ctx);
+	assert.equal(cardContent(), CARD_CONTENT.DEFAULT);
+});
+
 test("customize Cards rows refuse to overwrite a malformed preference", async (t) => {
 	const home = scopedDoubleEscCancelConfigHome(t);
 	const found = cardStyle();
@@ -3143,7 +3427,7 @@ test("customize Vim reports a persistence error without changing the live prompt
 	chmodSync(home, 0o500);
 	try {
 		await customizeAction(ui, "Vim: enable");
-		assert.match(ui.notices.at(-1)!, /Visual customization:/);
+		assert.match(ui.notices.at(-1)!, /Customization:/);
 		assert.equal(editor.effectiveVimPolicy, "off");
 		assert.equal(resolveVimPolicy({ gentlePiConfigHome: home }).policy, "off");
 	} finally {
@@ -3277,7 +3561,7 @@ test("T4d unified float footer uses one live owner and restores legacy Changes o
 	const home = scopedDoubleEscCancelConfigHome(t);
 	writeCardStyle("float", { gentlePiConfigHome: home });
 	writeVisualSettings({ ...resolveVisualSettings({ gentlePiConfigHome: home }).settings, headerPlacement: "below-input" }, { gentlePiConfigHome: home });
-	const { pi, handlers, commands } = fakePi();
+	const { pi, handlers, commands } = fakePi([{ numstat: "2\t0\tlib/live.ts\n", porcelain: " M lib/live.ts\0" }, { numstat: "3\t0\tlib/live.ts\n", porcelain: " M lib/live.ts\0" }]);
 	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: home });
 	const { ctx, ui, overlayReady } = fakeContext();
 	await fire(handlers, "session_start", ctx);
@@ -3301,8 +3585,8 @@ test("T4d unified float footer uses one live owner and restores legacy Changes o
 		assert.equal(footer.handleMouse?.(click(initialUsageX, 3, 139)), undefined);
 		assert.equal(footer.handleMouse?.(click(initialUsageX, 2, 139))?.handled, true);
 		ui.closeOverlay?.();
-		sessionChange(ctx, "t4d-a", "/repo", "lib/live.ts", "", "one\ntwo\n");
 		await fire(handlers, "agent_end", ctx);
+		await changesSettled();
 		const changes = widget("gentle-shell-changes");
 		for (const width of [139, 140, 240]) {
 			tui.terminal.columns = width;
@@ -3325,9 +3609,9 @@ test("T4d unified float footer uses one live owner and restores legacy Changes o
 		statuses.set("mcp", "MCP updated");
 		assert.notEqual(railHeader.digest!(), digest, "live status changes update the grouped digest");
 		const statusDigest = railHeader.digest!();
-		sessionChange(ctx, "t4d-b", "/repo", "lib/live.ts", "one\ntwo\n", "one\ntwo\nthree\n");
 		await fire(handlers, "agent_end", ctx);
-		assert.notEqual(railHeader.digest!(), statusDigest, "captured changes update the grouped digest");
+		await changesSettled();
+		assert.notEqual(railHeader.digest!(), statusDigest, "Git changes update the grouped digest");
 		assert.match(stripAnsi(footer.render(240).join("\n")), /\+3 −0/);
 		assert.match(stripAnsi(footer.render(240).join("\n")), /MCP updated/);
 		state.active = true;
@@ -4390,49 +4674,69 @@ function renderFooter(ui: FakeUi): string {
 	return factory(fakeTui, plainTheme, footerData).render(160)[0];
 }
 
-function sessionChange(ctx: ExtensionContext, id: string, root: string, path: string, before = "", after = "agent\n"): void {
- const entries = ctx.sessionManager.getEntries() as any[];
- entries.push({ type: "custom", customType: "gentle-pi.session-change/v1", data: {
-  sessionId: ctx.sessionManager.getSessionId(),
-  evidence: { id, root, path, before: before ? {kind:"text",text:before} : {kind:"absent"}, after:{kind:"text",text:after} },
- } });
-}
+// Changes refreshes from Git off the turn-end path; let the fake scan land.
+const changesSettled = () => backgroundChangeRefreshesSettled();
 
-test("captured changes update the widget and bar without repository scans", async () => {
- const { pi, handlers, git } = fakePi([{numstat:"999\t0\tforeign.ts\n",porcelain:"?? foreign.ts\0"}]);
+// Changes reads each root's Git state and nothing else: worktree labels,
+// status and numstat against HEAD, and a lazy diff of the selected file.
+const gitStateOnly = (git: readonly string[][]) => git.length > 0 && git.every((args) => {
+ const command = args[0] === "-C" ? args.slice(2) : args;
+ return (command[0] === "worktree" && command[1] === "list") || (command[0] === "status" && command.includes("--porcelain=v1"))
+  || (command[0] === "diff" && command.includes("HEAD")) || command[0] === "symbolic-ref" || (command[0] === "rev-parse" && command.includes("--verify"));
+});
+
+test("Changes lists the session root's Git state at turn end, never at startup", async () => {
+ const { pi, handlers, git } = fakePi([{numstat:"2\t0\tlib/b.ts\n",porcelain:" M lib/b.ts\0?? other.ts\0"},{numstat:"3\t0\tlib/b.ts\n",porcelain:" M lib/b.ts\0?? other.ts\0"}]);
  gentleShell(pi,{});
  const {ctx,ui}=fakeContext();
  await fire(handlers,"session_start",ctx);
  assert.equal(git.length,0);
  assert.equal(ui.widgets.has("gentle-shell-changes"),false);
- sessionChange(ctx,"a","/repo","lib/b.ts","","one\ntwo\n");
- pi.events.emit("gentle-pi:session-change",{sessionId:ctx.sessionManager.getSessionId()});
- await new Promise(resolve=>setImmediate(resolve));
+ await fire(handlers,"agent_end",ctx);
+ await changesSettled();
  const factory=ui.widgets.get("gentle-shell-changes") as any;
- assert.match(factory(fakeTui,plainTheme).render(140)[0],/1 file · \+2 −0/);
- assert.match(renderFooter(ui),/main ±1/);
+ assert.match(factory(fakeTui,plainTheme).render(140)[0],/2 files · \+2 −0/, "files no agent wrote are listed too: Git decides");
+ assert.match(renderFooter(ui),/main ±2/);
  const rail = sidebarState(fakeTui as unknown as TUI).parts.get("footer")!;
  const digest = rail.digest!();
- assert.match(rail.render(46).join("\n"), /1 file · \+2 −0/);
- sessionChange(ctx,"b","/repo","lib/b.ts","one\ntwo\n","one\ntwo\nthree\n");
+ assert.match(rail.render(46).join("\n"), /2 files · \+2 −0/);
  await fire(handlers,"agent_end",ctx);
+ await changesSettled();
  assert.notEqual(rail.digest!(), digest, "same-count line changes invalidate the unified Status");
- assert.match(rail.render(46).join("\n"), /1 file · \+3 −0/);
- assert.equal(git.length,0);
+ assert.match(rail.render(46).join("\n"), /2 files · \+3 −0/);
+ assert.ok(gitStateOnly(git), JSON.stringify(git));
+ assert.ok(git.every((args) => args[1] === "/repo"), "only the session's own root is scanned");
  await fire(handlers,"session_shutdown",ctx);
 });
 
+test("committed work leaves the widget and the footer counter at the next turn end", async () => {
+ const { handlers, git, pi } = fakePi([{numstat:"1\t0\tlib/b.ts\n",porcelain:" M lib/b.ts\0"},{numstat:"",porcelain:""}]);
+ gentleShell(pi,{});
+ const {ctx,ui}=fakeContext();
+ await fire(handlers,"session_start",ctx);
+ assert.equal(git.length,0,"startup never scans");
+ await fire(handlers,"agent_end",ctx);
+ await changesSettled();
+ assert.match(renderFooter(ui),/main ±1/);
+ await fire(handlers,"agent_end",ctx);
+ await changesSettled();
+ assert.doesNotMatch(renderFooter(ui),/±/);
+ assert.equal(ui.widgets.has("gentle-shell-changes"),false);
+ await fire(handlers,"session_shutdown",ctx);
+});
 
-// The changes overlay may ask Git for each captured root's HEAD label, and
-// nothing else: no status, diff, numstat or worktree scan behind the user's
-// back. Labelling is metadata, scanning is the behaviour these tests forbid.
-const onlyHeadLabels = (git: readonly string[][]) => git.every((args) => {
- const command = args[0] === "-C" ? args.slice(2) : args;
- return command[0] === "symbolic-ref" || (command[0] === "rev-parse" && command.includes("--verify"));
+test("a turn end never waits for Git", async () => {
+ const { pi, handlers } = fakePi();
+ (pi as unknown as { exec: () => Promise<never> }).exec = () => new Promise<never>(() => {});
+ gentleShell(pi,{});
+ const {ctx}=fakeContext();
+ await fire(handlers,"session_start",ctx);
+ await Promise.race([fire(handlers,"agent_end",ctx), new Promise((_, reject) => setTimeout(() => reject(new Error("agent_end waited for Git")), 100))]);
+ await fire(handlers,"session_shutdown",ctx);
 });
 
-test("same-session explicit registration after bootstrap does not claim Changes", async () => {
-	const { pi, handlers, commands, tools, git } = fakePi();
+test("explicit registration validates the clone, and a clean registered root shows no Changes", async () => {
+	const { pi, handlers, commands, tools } = fakePi();
 	let bootstrapped = false;
 	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, {
 		resolveWorktree: (path) => bootstrapped ? { root: path === "." ? "/repo" : path, commonDir: path === "/foreign" ? "/foreign/git" : "/repo/.git" } : undefined,
@@ -4446,70 +4750,45 @@ test("same-session explicit registration after bootstrap does not claim Changes"
 	await register.execute("after", { path: "/repo" }, undefined, undefined, ctx);
 	await register.execute("dedup", { path: "/repo" }, undefined, undefined, ctx);
 	await assert.rejects(register.execute("foreign", { path: "/foreign" }, undefined, undefined, ctx), /same Git clone/);
+	await assert.rejects(register.execute("foreign", { path: "/foreign" }, undefined, undefined, ctx), /subagent_run with repository_root/);
 	assert.equal(ctx.sessionManager, manager);
 	assert.equal(ctx.sessionManager.getEntries().length, 1);
 	await commands.get("gentle:changes")!.handler("", ctx);
-	assert.match(ui.notices.join("\n"), /No captured agent changes/);
+	assert.match(ui.notices.join("\n"), /No uncommitted changes/);
 	assert.equal(ui.overlay, undefined);
-	assert.deepEqual(git, []);
 	await fire(handlers, "session_shutdown", ctx);
 });
 
-test("Changes opens only for captured mutations, not registered dirty roots", async () => {
- const {pi,handlers,commands,tools,git}=fakePi();
+test("a registered worktree opens Changes as its own group", async () => {
+ const {pi,handlers,commands,tools,git}=fakePi([{numstat:"",porcelain:" M file.ts\0?? dirty.ts\0"}]);
  gentleShell(pi,{});
  const {ctx,ui,overlayReady}=fakeContext();
  await fire(handlers,"session_start",ctx);
  await tools.get("session_worktree_register")!.execute("r",{path:"/linked"},undefined,undefined,ctx);
- await commands.get("gentle:changes")!.handler("",ctx);
- assert.match(ui.notices.join("\n"),/No captured agent changes/);
- assert.equal(ui.overlay,undefined);
- sessionChange(ctx,"a","/linked","file.ts");
- await fire(handlers,"agent_end",ctx);
- const opened=commands.get("gentle:changes")!.handler("",ctx);
- await overlayReady;
- assert.match(ui.overlayView!.render(140).join("\n"),/linked/);
- assert.ok(onlyHeadLabels(git), `overlay ran more than HEAD labelling: ${JSON.stringify(git)}`);
- ui.closeOverlay?.(); await opened;
- await fire(handlers,"session_shutdown",ctx);
-});
-
-test("overlay groups captured roots and refreshes same-count diffs without HEAD or external files", async () => {
- const {pi,handlers,commands,git}=fakePi();
- gentleShell(pi,{GENTLE_PI_SHELL_CHANGES_POLL_MS:"5"});
- const {ctx,ui,overlayReady}=fakeContext();
- sessionChange(ctx,"a","/repo","same.ts","old\n","first\n");
- sessionChange(ctx,"child:a","/linked","same.ts","old\n","child\n");
- await fire(handlers,"session_start",ctx);
  const opened=commands.get("gentle:changes")!.handler("",ctx);
  await overlayReady;
  try {
-  ui.overlayView!.handleInput("\r"); ui.overlayView!.handleInput("j");
-  await new Promise(resolve=>setTimeout(resolve,10));
-  assert.match(ui.overlayView!.render(140).join("\n"),/first/);
-  sessionChange(ctx,"b","/repo","same.ts","first\n","second\n");
-  pi.events.emit("gentle-pi:session-change",{sessionId:ctx.sessionManager.getSessionId()});
-  await new Promise(resolve=>setTimeout(resolve,20));
-  assert.match(ui.overlayView!.render(140).join("\n"),/second/);
-  assert.doesNotMatch(ui.overlayView!.render(140).join("\n"),/first/);
-  assert.ok(onlyHeadLabels(git), `overlay ran more than HEAD labelling: ${JSON.stringify(git)}`);
+  const rendered=ui.overlayView!.render(140).join("\n");
+  assert.match(rendered,/main · repo/);
+  assert.match(rendered,/detached · linked/, "a root outside the worktree list asks for its own HEAD");
+  assert.ok(gitStateOnly(git), JSON.stringify(git));
  } finally { ui.closeOverlay?.(); await opened; await fire(handlers,"session_shutdown",ctx); }
 });
 
-test("new sessions ignore inherited captures, while reload restores the same session", async () => {
+test("new sessions do not inherit another session's worktrees", async () => {
  const h=fakePi(); gentleShell(h.pi,{});
  const first=fakeContext();
- sessionChange(first.ctx,"a","/repo","own.ts");
- await fire(h.handlers,"session_start",first.ctx);
- assert.match(renderFooter(first.ui),/±1/);
  await fire(h.handlers,"session_start",first.ctx);
- assert.match(renderFooter(first.ui),/±1/);
+ await h.tools.get("session_worktree_register")!.execute("r",{path:"/linked"},undefined,undefined,first.ctx);
+ await fire(h.handlers,"session_shutdown",first.ctx);
  const next=fakeContext({entries:[...first.ctx.sessionManager.getEntries()]});
  (next.ctx.sessionManager as any).getSessionId=()=>"new-session";
  await fire(h.handlers,"session_start",next.ctx);
- h.pi.events.emit("gentle-pi:session-change",{sessionId:"shell-session"});
- assert.doesNotMatch(renderFooter(next.ui),/±1/);
- assert.equal(h.git.length,0);
+ h.git.length=0;
+ await fire(h.handlers,"agent_end",next.ctx);
+ await changesSettled();
+ assert.ok(h.git.length>0);
+ assert.ok(h.git.every((args)=>args[1]==="/repo"), JSON.stringify(h.git));
  await fire(h.handlers,"session_shutdown",next.ctx);
 });
 
@@ -4551,7 +4830,7 @@ test("registered canonical root governs real Git discovery, status and diff desp
 	installGentleShell(h.pi, isolatedEnv({ GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }), { devBinary: () => undefined, gitRunner: (cwd) => shellGitRunner(cwd, poisoned) });
 	await fire(h.handlers, "session_start", ctx);
 	t.after(() => fire(h.handlers, "session_shutdown", ctx));
-	assert.equal(ui.widgets.has("gentle-shell-changes"), false, "preexisting dirty files are not agent changes");
+	assert.equal(ui.widgets.has("gentle-shell-changes"), false, "startup never scans the repository");
 	const diff = await loadFileDiff(run, { path: "tracked.txt", added: 1, deleted: 1, status: CHANGE_STATUS.MODIFIED });
 	assert.match(diff, /\+selected change/);
 	assert.doesNotMatch(diff, /foreign change/);
@@ -4565,8 +4844,15 @@ test("registered canonical root governs real Git discovery, status and diff desp
 	assert.equal(largeDiff.code, 0);
 	assert.ok(largeDiff.stdout.length > 1024 * 1024, "output must not inherit execFile's default one MiB cap");
 	assert.match(largeDiff.stdout, /\+selected final marker/);
-	await h.commands.get("gentle:changes")!.handler("", ctx);
-	assert.equal(ui.overlay, undefined);
+	const bounded = shellGitRunner(selected, poisoned, execFile, DIFF_MAX_BYTES);
+	assert.equal((await bounded(["diff", "HEAD", "--", "tracked.txt"])).truncated, true, "the diff runner stops at its bound instead of buffering everything");
+	assert.ok(await loadFileDiff(bounded, { path: "tracked.txt", added: 70_001, deleted: 1, status: CHANGE_STATUS.MODIFIED }) === DIFF_TOO_LARGE);
+	const opened = h.commands.get("gentle:changes")!.handler("", ctx);
+	await overlayReady;
+	const trees = (ui.overlayView as unknown as { trees: Array<{ root: string; model: { files: Array<{ path: string }> } }> }).trees;
+	assert.deepEqual(trees.map((tree) => [tree.root, tree.model.files.map((file) => file.path)]), [[selected, ["selected-only.txt", "tracked.txt"]]], "inherited routing never lists the foreign repository");
+	ui.closeOverlay?.();
+	await opened;
 });
 
 test("loadFileDiff asks git for a HEAD diff, or a no-index diff for untracked files", async () => {
@@ -4583,9 +4869,20 @@ test("loadFileDiff asks git for a HEAD diff, or a no-index diff for untracked fi
 	]);
 });
 
+test("loadFileDiff replaces one oversized diff with a short open-in-editor line", async () => {
+	const answer = (stdout: string, truncated?: boolean) => async () => ({ stdout, code: 0, ...(truncated ? { truncated } : {}) });
+	const file = { path: "big.ts", added: 1, deleted: 0, status: CHANGE_STATUS.MODIFIED };
+	// assert.ok keeps a failure from printing megabytes of diff.
+	assert.ok(await loadFileDiff(answer("+x\n".repeat(DIFF_MAX_LINES + 1)), file) === DIFF_TOO_LARGE, "too many lines");
+	assert.ok(await loadFileDiff(answer("+" + "x".repeat(DIFF_MAX_BYTES)), file) === DIFF_TOO_LARGE, "too many bytes");
+	assert.ok(await loadFileDiff(answer("+partial", true), file) === DIFF_TOO_LARGE, "a runner that hit its buffer bound");
+	assert.match(DIFF_TOO_LARGE, /too large.*o.*editor/i);
+	assert.equal(await loadFileDiff(answer("+x\n".repeat(10)), file), "+x\n".repeat(10));
+});
+
 test("shell Git runner hides initial and repeated background polling children", async () => {
 	const calls: Array<{ command: string; args: readonly string[]; options: Record<string, unknown> }> = [];
-	const run = ((command: string, args: readonly string[], options: Record<string, unknown>, callback: (error: Error | null, stdout: string) => void) => {
+	const run = ((command: string, args: readonly string[], options: Record<string, unknown>, callback: (error: Error | null, stdout: string, stderr: string) => void) => {
 		calls.push({ command, args, options });
 		callback(null, "", "");
 	}) as typeof import("node:child_process").execFile;
@@ -4638,23 +4935,24 @@ test("gentleShell binds the changes shortcut to the same handler as the command"
 	const shortcut = shortcuts.get("alt+g");
 	assert.ok(shortcut, "alt+g not registered");
 	await shortcut.handler(ctx);
-	assert.match(ui.notices.join("\n"), /No captured agent changes/);
+	assert.match(ui.notices.join("\n"), /No uncommitted changes/);
 
 	const silent = fakePi();
 	gentleShell(silent.pi, { GENTLE_PI_SHELL_CHANGES_KEY: "off" });
 	assert.equal(silent.shortcuts.has("alt+g"), false, "the changes shortcut must not register when disabled");
 });
 
-test("external edits do not pollute Changes or trigger background Git scans", async () => {
+test("Changes never polls Git in the background; external edits appear at turn end", async () => {
  const {pi,handlers,git}=fakePi([{numstat:"4\t2\texternal.ts\n",porcelain:" M external.ts\0"}]);
  gentleShell(pi,{GENTLE_PI_SHELL_CHANGES_WATCH_MS:"5"});
  const {ctx,ui}=fakeContext();
  await fire(handlers,"session_start",ctx);
  await new Promise(resolve=>setTimeout(resolve,30));
- await fire(handlers,"agent_end",ctx);
  assert.equal(git.length,0);
  assert.equal(ui.widgets.has("gentle-shell-changes"),false);
- assert.doesNotMatch(renderFooter(ui),/±/);
+ await fire(handlers,"agent_end",ctx);
+ await changesSettled();
+ assert.match(renderFooter(ui),/±1/);
  await fire(handlers,"session_shutdown",ctx);
 });
 
@@ -5059,6 +5357,28 @@ test("gentleShell records SSE rate-limit headers from provider responses", async
 	assert.doesNotMatch(renderFooter(ui), /codex/);
 });
 
+test("gentleShell ignores incomplete Codex headers and retains the last real quota without assuming 5h", async () => {
+	const { pi, handlers } = fakePi();
+	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { fetch: fakeFetch({}, false).fetchFn, now: () => 0 });
+	const { ctx, ui } = fakeContext();
+	await fire(handlers, "session_start", ctx);
+	const respond = (headers: Record<string, string>) => {
+		for (const handler of handlers.get("after_provider_response") ?? []) handler({ status: 200, headers }, ctx);
+	};
+	respond({ "x-codex-primary-used-percent": "0" });
+	assert.doesNotMatch(renderFooter(ui), /codex|0m/, "missing duration is not a real quota");
+	respond({ "x-codex-secondary-used-percent": "31", "x-codex-secondary-window-minutes": "10080" });
+	const valid = renderFooter(ui);
+	assert.match(valid, /codex week .*31%/);
+	assert.doesNotMatch(valid, /5h|0m/);
+	for (const minutes of [undefined, "0", "invalid"]) {
+		const headers: Record<string, string> = { "x-codex-primary-used-percent": "0" };
+		if (minutes !== undefined) headers["x-codex-primary-window-minutes"] = minutes;
+		respond(headers);
+		assert.equal(renderFooter(ui), valid, "a malformed response must not replace the known weekly quota");
+	}
+});
+
 test("gentleShell registers /gentle:usage and opens the subscriptions overlay", async () => {
 	const { pi, handlers, commands } = fakePi();
 	gentleShell(pi, { GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { fetch: fakeFetch().fetchFn, now: () => 1_788_600_000_000 });
@@ -5209,14 +5529,14 @@ test("/gentle:commands shows only curated, registered commands, grouped, by thei
 	assert.match(rendered, /Skills/);
 	assert.doesNotMatch(rendered, /\bSDD\b/, "the SDD group has no registered commands and must not appear");
 	assert.match(rendered, /Assign models and effort/);
-	assert.match(rendered, /Browse captured changes/);
+	assert.match(rendered, /Browse changes/);
 	assert.match(rendered, /Gentle AI status/);
 	assert.match(rendered, /Refresh skill registry/);
 	assert.doesNotMatch(rendered, /gentle:models|gentle:changes|gentle:status|skill-registry:refresh/, "raw command names must not leak; only labels are shown");
 	assert.doesNotMatch(rendered, /gentle:not-in-catalog/);
 	assert.doesNotMatch(rendered, /skill:foo/);
-	const changesLine = lines.find((line) => line.includes("Browse captured changes"));
-	assert.match(changesLine ?? "", /alt\+g/, "expected the configured alt+g shortcut hint next to Browse captured changes");
+	const changesLine = lines.find((line) => line.includes("Browse changes"));
+	assert.match(changesLine ?? "", /alt\+g/, "expected the configured alt+g shortcut hint next to Browse changes");
 	ui.overlayView!.handleInput("\x1b");
 	await opened;
 });
@@ -5633,7 +5953,10 @@ test("after a profile switch the panel stops presenting the old profile's provid
 	ui.closeOverlay?.();
 	await opened;
 
-	writeProfilesStore(home, { team: { reviewer: { model: "nan/glm5.3" } }, solo: {} }, "solo");
+	// An open session changes profile only through its own Enter (gentle-shell#1064
+	// slice 3b-ii): a new global default would leave its frozen routing in place.
+	bindSessionProfile("shell-session", "solo", {});
+	t.after(() => resetSessionProfileBindingsForTesting());
 	const reopened = commands.get("gentle:usage")!.handler("", ctx);
 	await settle();
 	assert.equal(ui.overlayView!.render(90).map(stripAnsi).some((line) => line.includes("nan")), false, "a provider recorded under the previous profile's routing is not current scope");
@@ -5641,6 +5964,61 @@ test("after a profile switch the panel stops presenting the old profile's provid
 	await reopened;
 });
 
+test("an open session keeps its frozen profile in the status and Usage scope when the defaults change", async (t) => {
+	const home = mkdtempSync(join(tmpdir(), "shell-frozen-"));
+	const commonDir = mkdtempSync(join(tmpdir(), "shell-frozen-git-"));
+	t.after(() => {
+		rmSync(home, { recursive: true, force: true });
+		rmSync(commonDir, { recursive: true, force: true });
+	});
+	mkdirSync(join(commonDir, "gentle-ai"), { recursive: true });
+	writeProfilesStore(home, { team: { reviewer: { model: "nan/glm5.3" } }, solo: { reviewer: { model: "openai-codex/gpt-5.5" } } }, "team");
+	const { pi, handlers, commands } = fakePi();
+	gentleShell(pi, { GENTLE_PI_CONFIG_HOME: home, GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { fetch: fakeFetch(NAN_QUOTA_PAYLOAD).fetchFn, now: () => 1_788_600_000_000, resolveWorktree: () => ({ root: "/repo", commonDir }) });
+	const { ctx, ui } = fakeContext({ token: JWT });
+	await fire(handlers, "session_start", ctx);
+	assert.equal(readFrozenInheritedProfile("shell-session")?.profile?.name, "team", "the session froze the global active profile at start");
+	writeProfilesStore(home, { team: { reviewer: { model: "nan/glm5.3" } }, solo: { reviewer: { model: "openai-codex/gpt-5.5" } } }, "solo");
+	writeFileSync(join(commonDir, "gentle-ai", "profile-pin.json"), JSON.stringify({ kind: "gentle-pi.agent_model_profile_pin", version: 1, profile: "solo" }));
+	const opened = commands.get("gentle:usage")!.handler("", ctx);
+	await settle();
+	assert.ok(openPanelLines(ui).some((line) => /^│ nan ·/.test(line)), "Usage keeps the frozen profile's nan route");
+	ui.closeOverlay?.();
+	await opened;
+	const factory = ui.footerFactory as (tui: unknown, theme: ShellBarTheme, data: unknown) => { dispose(): void };
+	const tui = { terminal: { rows: 40, columns: 160 }, requestRender() {} };
+	const component = factory(tui, plainTheme, { getGitBranch: () => "main", getExtensionStatuses: () => new Map(), getAvailableProviderCount: () => 1, onBranchChange: () => () => {} });
+	try {
+		const status = (sidebarState(tui as unknown as TUI).parts.get("footer") as SidebarRail).render(60).join("\n");
+		assert.match(status, /Profile.*team/, "the status keeps the bare global name of the frozen profile");
+		assert.doesNotMatch(status, /solo/);
+	} finally {
+		component.dispose();
+	}
+});
+
+test("active profile reader: a bound session shows its frozen profile, and follow shows the live default", (t) => {
+	const root = mkdtempSync(join(tmpdir(), "shell-profile-frozen-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	const commonDir = join(root, "git");
+	mkdirSync(join(commonDir, "gentle-ai"), { recursive: true });
+	writeFileSync(join(root, "profiles.json"), JSON.stringify({ kind: "gentle-pi.agent_model_profiles", version: 1, active: "team", profiles: { team: {}, other: {} } }));
+	const pin = (profile: string) => writeFileSync(join(commonDir, "gentle-ai", "profile-pin.json"), JSON.stringify({ kind: "gentle-pi.agent_model_profile_pin", version: 1, profile }));
+	pin("other");
+	const frozen = createActiveProfileReader({ GENTLE_PI_CONFIG_HOME: root });
+	frozen.bind(root, () => ({ root, commonDir }), "session-frozen");
+	assert.equal(frozen(), "other (local)");
+	const follow = createActiveProfileReader({ GENTLE_PI_CONFIG_HOME: root, GENTLE_PI_PROFILE_FOLLOW: "1" });
+	follow.bind(root, () => ({ root, commonDir }), "session-follow");
+	assert.equal(follow(), "other (local)");
+	rmSync(join(commonDir, "gentle-ai", "profile-pin.json"));
+	assert.equal(frozen.refresh(), false, "the frozen label does not move");
+	assert.equal(frozen(), "other (local)");
+	assert.equal(follow.refresh(), true);
+	assert.equal(follow(), "team", "follow falls to the global active profile");
+	assert.equal(readFrozenInheritedProfile("session-follow"), undefined);
+});
+
 function openPanelLines(ui: FakeUi): string[] {
 	return ui.overlayView!.render(90).map(stripAnsi);
 }
@@ -5832,3 +6210,136 @@ test("an older overlapping refresh cannot mark a provider failed after a newer o
 	ui.closeOverlay?.();
 	await opened;
 });
+
+test("active profile reader prefers a session binding, labels it (session), and falls back when it clears", (t) => {
+	const root = mkdtempSync(join(tmpdir(), "shell-profile-session-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	const path = join(root, "profiles.json");
+	writeFileSync(path, JSON.stringify({ kind: "gentle-pi.agent_model_profiles", version: 1, active: "team", profiles: { team: {}, work: {} } }));
+	resetSessionProfileBindingsForTesting();
+	bindSessionProfile("session-1", "work", { worker: { model: "zai/glm-4.7" } });
+	const read = createActiveProfileReader({ GENTLE_PI_CONFIG_HOME: root });
+	assert.equal(read(), "team", "an unbound reader still reads the global active profile");
+	read.bind(root, () => undefined, "session-1");
+	assert.equal(read(), "work (session)", "a bound session outranks the global active profile");
+	assert.equal(read(), "work (session)", "the session label is stable across reads");
+	clearSessionProfileBinding("session-1");
+	assert.equal(read.refresh(), true, "refresh detects the cleared binding");
+	assert.equal(read(), "team", "the read falls back once the binding clears");
+	read.reset();
+	assert.equal(read(), "team", "reset keeps the global read working");
+	resetSessionProfileBindingsForTesting();
+});
+
+test("active profile reader keeps the pin label when a different session is bound", (t) => {
+	const root = mkdtempSync(join(tmpdir(), "shell-profile-session-pin-"));
+	t.after(() => rmSync(root, { recursive: true, force: true }));
+	writeFileSync(join(root, "profiles.json"), JSON.stringify({ kind: "gentle-pi.agent_model_profiles", version: 1, active: "team", profiles: { team: {}, work: {} } }));
+	resetSessionProfileBindingsForTesting();
+	bindSessionProfile("session-other", "work", { worker: { model: "zai/glm-4.7" } });
+	const read = createActiveProfileReader({ GENTLE_PI_CONFIG_HOME: root });
+	read.bind(root, () => ({ root, commonDir: root }), "session-1");
+	assert.equal(read(), "team", "no pin file and no binding for this session: the global active profile governs");
+	clearSessionProfileBinding("session-other");
+	resetSessionProfileBindingsForTesting();
+});
+
+test("an explicit session binding routes the Usage scope ahead of the pin and the global layers", async (t) => {
+	const home = mkdtempSync(join(tmpdir(), "shell-usage-session-"));
+	const commonDir = mkdtempSync(join(tmpdir(), "shell-usage-session-git-"));
+	t.after(() => {
+		rmSync(home, { recursive: true, force: true });
+		rmSync(commonDir, { recursive: true, force: true });
+	});
+	mkdirSync(join(commonDir, "gentle-ai"), { recursive: true });
+	// Every shared layer points at openai-codex (the pin wins over the global
+	// active profile), while the session binds nan explicitly: the Usage panel
+	// must refresh the binding's provider, not the layers underneath it.
+	writeProfilesStore(home, {
+		team: { reviewer: { model: "openai-codex/gpt-5.5" } },
+		solo: { reviewer: { model: "openai-codex/gpt-5.5" } },
+		bound: { reviewer: { model: "nan/glm5.3" } },
+	}, "team");
+	writeFileSync(join(commonDir, "gentle-ai", "profile-pin.json"), JSON.stringify({ kind: "gentle-pi.agent_model_profile_pin", version: 1, profile: "solo" }));
+	resetSessionProfileBindingsForTesting();
+	bindSessionProfile("shell-session", "bound", { reviewer: { model: "nan/glm5.3" } });
+	try {
+		const { pi, commands } = fakePi();
+		gentleShell(pi, { GENTLE_PI_CONFIG_HOME: home, GENTLE_PI_SHELL_CHANGES_WATCH_MS: "off" }, { fetch: fakeFetch(NAN_QUOTA_PAYLOAD).fetchFn, now: () => 1_788_600_000_000, resolveWorktree: () => ({ root: "/repo", commonDir }) });
+		const { ctx, ui } = fakeContext({ token: JWT });
+		const opened = commands.get("gentle:usage")!.handler("", ctx);
+		await settle();
+		const lines = openPanelLines(ui).join("\n");
+		assert.ok(lines.split("\n").some((line) => /^│ nan ·/.test(line)), "the Usage panel refreshes the session binding's nan provider");
+		assert.ok(!lines.split("\n").some((line) => /^│ openai-codex ·/.test(line)), "the pinned codex route stays out of the bound session's Usage scope");
+		ui.closeOverlay?.();
+		await opened;
+	} finally {
+		resetSessionProfileBindingsForTesting();
+	}
+});
+
+// S9: the config home each of these reads resolves, per case. The OS home is
+// a temporary folder in every case, so no case can reach the real one.
+// "unset" and "empty" are exactly as before: an empty GENTLE_PI_CONFIG_HOME
+// names the current folder. "bundled" stands in for this package running from
+// a bundled install (testing overlay) whose prefix the launcher passed; the
+// user's own GENTLE_PI_CONFIG_HOME is then not this install's.
+type ConfigHomeCase = "unset" | "empty" | "bundled";
+function configHomeCase(t: { after: (fn: () => void) => void }, kind: ConfigHomeCase): { env: NodeJS.ProcessEnv; dir: string; userConfig: string } {
+	const base = realpathSync(mkdtempSync(join(tmpdir(), `config-home-${kind}-`)));
+	const saved = { HOME: process.env.HOME, USERPROFILE: process.env.USERPROFILE, GENTLE_PI_CONFIG_HOME: process.env.GENTLE_PI_CONFIG_HOME, GENTLE_SHELL_PREFIX: process.env.GENTLE_SHELL_PREFIX };
+	const cwd = process.cwd();
+	process.env.HOME = join(base, "home");
+	process.env.USERPROFILE = join(base, "home");
+	delete process.env.GENTLE_PI_CONFIG_HOME;
+	delete process.env.GENTLE_SHELL_PREFIX;
+	t.after(() => {
+		process.chdir(cwd);
+		setBundledInstallForTesting(undefined);
+		for (const [name, value] of Object.entries(saved)) {
+			if (value === undefined) delete process.env[name];
+			else process.env[name] = value;
+		}
+		rmSync(base, { recursive: true, force: true });
+	});
+	const userConfig = join(base, "user-config");
+	if (kind === "unset") return { env: {}, dir: join(base, "home", ".pi", "gentle-ai"), userConfig };
+	if (kind === "empty") {
+		mkdirSync(join(base, "cwd"));
+		process.chdir(join(base, "cwd"));
+		return { env: { GENTLE_PI_CONFIG_HOME: "" }, dir: join(base, "cwd"), userConfig };
+	}
+	const prefix = join(base, "prefix");
+	mkdirSync(prefix);
+	setBundledInstallForTesting({ root: prefix });
+	return { env: { GENTLE_SHELL_PREFIX: prefix, GENTLE_PI_CONFIG_HOME: userConfig }, dir: join(prefix, "config", "gentle-ai"), userConfig };
+}
+
+function profileStore(dir: string, active: string, names: string[]) {
+	mkdirSync(dir, { recursive: true });
+	writeFileSync(join(dir, "profiles.json"), JSON.stringify({ kind: "gentle-pi.agent_model_profiles", version: 1, active, profiles: Object.fromEntries(names.map((name) => [name, {}])) }));
+}
+
+for (const kind of ["unset", "empty", "bundled"] as const) {
+	test(`the profile reader reads the global store from the ${kind} config home`, (t) => {
+		const { env, dir, userConfig } = configHomeCase(t, kind);
+		// The user's own store names another profile: only the bundled case must ignore it.
+		profileStore(userConfig, "team", ["team"]);
+		profileStore(dir, "other", ["team", "other"]);
+		assert.equal(createActiveProfileReader(env)(), "other");
+	});
+
+	test(`the bound profile reader resolves pins against the ${kind} config home`, (t) => {
+		const { env, dir, userConfig } = configHomeCase(t, kind);
+		profileStore(userConfig, "team", ["team"]);
+		profileStore(dir, "team", ["team", "other"]);
+		const repo = join(dir, "..", `repo-${kind}`);
+		mkdirSync(join(repo, ".pi", "gentle-ai"), { recursive: true });
+		writeFileSync(join(repo, ".pi", "gentle-ai", "profile.json"), JSON.stringify({ kind: "gentle-pi.agent_model_profile_pin", version: 1, profile: "other" }));
+		const read = createActiveProfileReader(env);
+		read.bind(repo, () => ({ root: repo, commonDir: join(repo, ".git-common") }));
+		read.refresh();
+		assert.equal(read(), "other (repo)", "the pinned profile exists only in that config home's store");
+	});
+}