gentle-pi 4.1.0 → 4.3.0

package/tests/headless-delivery-question.test.ts

@@ -0,0 +1,58 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { __testing } from "../extensions/gentle-ai.ts";
+import { INTERACTIVE_HOST_ENV } from "../lib/rpc-host.ts";
+
+// Bench gate-p53-r1-BS40 x6 run 3 (headless RPC): the ask-on-risk delivery
+// question ran before any code was written; ask_user_question answered
+// "unavailable outside the interactive TUI", the orchestrator printed the menu
+// and stopped, and the round ended with "No code changed yet". When no human
+// can answer, the delivery question resolves to the recommended chain instead.
+
+const HEADLESS_DELIVERY = "No human can answer questions in this session";
+
+function promptFor(mode: string | undefined): string {
+	return __testing.buildGentlePrompt("neutral", process.cwd(), undefined, undefined, mode);
+}
+
+function withInteractiveHost<T>(value: string | undefined, run: () => T): T {
+	const previous = process.env[INTERACTIVE_HOST_ENV];
+	if (value === undefined) delete process.env[INTERACTIVE_HOST_ENV];
+	else process.env[INTERACTIVE_HOST_ENV] = value;
+	try {
+		return run();
+	} finally {
+		if (previous === undefined) delete process.env[INTERACTIVE_HOST_ENV];
+		else process.env[INTERACTIVE_HOST_ENV] = previous;
+	}
+}
+
+test("headless host modes resolve the ask-on-risk delivery question to the feature-branch chain without asking", () => {
+	withInteractiveHost(undefined, () => {
+		for (const mode of ["rpc", "print", "json"]) {
+			const prompt = promptFor(mode);
+			assert.ok(prompt.includes(HEADLESS_DELIVERY), `${mode} must say no human can answer`);
+			assert.match(prompt, /ask-on-risk/, `${mode} must name the ask-on-risk delivery question`);
+			assert.match(prompt, /`feature-branch-chain`/, `${mode} must name the chain it resolves to`);
+			assert.match(prompt, /feature document/, `${mode} must record the choice in the feature document`);
+			assert.match(prompt, /consent/, `${mode} must keep consent prompts out of the default`);
+		}
+	});
+});
+
+test("interactive hosts keep asking the delivery question", () => {
+	withInteractiveHost(undefined, () => {
+		for (const mode of ["tui", undefined]) assert.ok(!promptFor(mode).includes(HEADLESS_DELIVERY), `${String(mode)} keeps the question`);
+	});
+	withInteractiveHost("1", () => {
+		assert.ok(!promptFor("rpc").includes(HEADLESS_DELIVERY), "an interactive RPC host keeps the question");
+	});
+});
+
+test("the reference documents the headless delivery default", async () => {
+	const { readFileSync } = await import("node:fs");
+	const reference = readFileSync(new URL("../docs/readme-reference.md", import.meta.url), "utf8");
+	for (const term of ["no human can answer questions", "`GENTLE_SHELL_INTERACTIVE_HOST=1`", "`ask-on-risk` does not ask", "`feature-branch-chain`"]) {
+		assert.ok(reference.includes(term), `docs/readme-reference.md is missing ${term}`);
+	}
+});

package/tests/herdr-activity.test.ts

@@ -4,7 +4,7 @@ import childProcess from "node:child_process";
 import fs from "node:fs";
 import { syncBuiltinESMExports } from "node:module";
 import { visibleWidth } from "@earendil-works/pi-tui";
-import { activitySummary, ActivityPublisher, createActivityColumns, metadataArgs, metadataTransport } from "../lib/herdr-activity.ts";
+import { activitySummary, ActivityPublisher, createActivityColumns, herdrDetected, herdrSetupHint, metadataArgs, metadataTransport } from "../lib/herdr-activity.ts";
 
 const tasks = [{ title: "Revisar integración Herdr", status: "in_progress" }];
 const project = (title: string, columns = 30) => activitySummary([{ title, status: "in_progress" }], columns);
@@ -241,3 +241,36 @@ test("geometry is cached, local/named, bounded and fail-safe without reading use
 		assert.equal(paths.length, before, "relative paths must not read arbitrary snapshots");
 	} finally { for (const stub of stubs) stub.mock.restore(); syncBuiltinESMExports(); }
 });
+
+const herdrEnv = { HERDR_ENV: "1", HERDR_PANE_ID: "pane", HERDR_SOCKET_PATH: "/herdr.sock" };
+
+test("Herdr detection uses the activity gate: HERDR_ENV=1 plus nonblank pane and socket", () => {
+	assert.equal(herdrDetected(herdrEnv), true);
+	for (const env of [{}, { ...herdrEnv, HERDR_ENV: "0" }, { ...herdrEnv, HERDR_PANE_ID: " " }, { ...herdrEnv, HERDR_SOCKET_PATH: "" }]) {
+		assert.equal(herdrDetected(env), false);
+		assert.deepEqual(herdrSetupHint(env, { interactive: true, isSocket: () => true }), []);
+	}
+});
+
+test("setup hint states active publishing and gives read-only sidebar guidance", () => {
+	const sockets: string[] = [];
+	const lines = herdrSetupHint(herdrEnv, { interactive: true, isSocket: (path) => { sockets.push(path); return true; } });
+	assert.deepEqual(sockets, ["/herdr.sock"]);
+	assert.deepEqual(lines, [
+		"Herdr",
+		"pass: Herdr task-summary publishing active",
+		"info: Herdr's default sidebar does not show task titles; add these two rows to the Agents sidebar rows in your Herdr config: ['$summary'], ['$summary2']",
+		"info: Sidebar rows belong to the config of the Herdr client that displays the session, including when Pi runs over SSH",
+		"info: After editing, reload or restart Herdr; Gentle Shell never changes Herdr config",
+		"info: Details: https://github.com/Gentleman-Programming/gentle-shell/blob/main/docs/readme-reference.md#herdr-active-work-summary",
+	]);
+});
+
+test("setup hint names why publishing is inactive and keeps the guidance", () => {
+	const reason = (env: NodeJS.ProcessEnv, interactive: boolean, socket: boolean) =>
+		herdrSetupHint(env, { interactive, isSocket: () => socket })[1];
+	assert.equal(reason({ ...herdrEnv, GENTLE_PI_AGENTS_CHILD: "1" }, true, true), "warn: Herdr task-summary publishing inactive: Gentle Agents child session");
+	assert.equal(reason(herdrEnv, false, true), "warn: Herdr task-summary publishing inactive: requires the interactive Pi TUI");
+	assert.equal(reason(herdrEnv, true, false), "warn: Herdr task-summary publishing inactive: HERDR_SOCKET_PATH is not a Unix socket");
+	assert.equal(herdrSetupHint(herdrEnv, { interactive: false, isSocket: () => true }).length, 6);
+});

package/tests/install-wizard.test.ts

@@ -399,7 +399,7 @@ test("the review screen shows the notice about reused tools in folders another a
 });
 
 test("a recoverable stack is reviewed as completing setup, not as a reinstall", async () => {
-	const view = await serverPlanView({ pi: { available: true, version: "1.0.0", usable: true },
+	const view = await serverPlanView({ pi: { available: true, version: "1.2.0", usable: true },
 		shell: { available: true, version: requirements.shell, usable: true, global: true },
 		gentleAi: { available: true, version: requirements.gentleAi, usable: true, compatible: true },
 		setup: { available: true, recoverable: true } });
@@ -563,7 +563,7 @@ test("expectedSteps checks, updates and verifies an older Pi before any Gentle S
 test("a plan that only updates an older Pi is reviewed as a Pi update, with an Update Pi button", () => {
 	const document = new FakeDocument();
 	const model = wizard.planModel({ planId: "p", ready: false, channel: "release", blockers: [],
-		actions: [{ id: "update-pi", description: "Update Pi 0.87.1 to 1.0.0 with npm." }, { id: "verify-readiness", description: "Verify." }] });
+		actions: [{ id: "update-pi", description: "Update Pi 0.87.1 to 1.2.0 with npm." }, { id: "verify-readiness", description: "Verify." }] });
 	assert.equal(model.kind, "update-pi");
 	const view = wizard.renderPlan(document, model, { install: () => {}, reload: () => {}, close: () => {} });
 	assert.ok(headings(view)[0].textContent.includes("Update Pi"));

package/tests/installer-posix-bootstrap.test.ts

@@ -934,19 +934,19 @@ test("Go has no descriptor for other targets", () => {
 // The Engram release the bundled install ships (S9), from its checksums.txt and
 // the GitHub asset digests; every archive was downloaded and re-hashed.
 const engramPins = {
-	"darwin-arm64": ["darwin_arm64.tar.gz", "3d6b4ac0055883ec23d5b0a04a3cda041653cdf4916fd7e98944692e62fd0441", 7465858],
-	"darwin-x64": ["darwin_amd64.tar.gz", "3da8d7befe8500ff09aa44c48f493eda96513fd3f63c7e4bfb95e3ae85dfae52", 7952089],
-	"linux-x64": ["linux_amd64.tar.gz", "8694d3817b63c5fc5607b5919e88aa929bffa0bafda330513364e10c8ab61445", 7817468],
-	"linux-arm64": ["linux_arm64.tar.gz", "b4546b6e00f68e56da52064f1865c6cbae1d5b0633aeebc36e1a2f20b17683e7", 7168173],
-	"win32-x64": ["windows_amd64.zip", "e00afe91d1baade484d217606d78c2fd91e26a4f9823b603d050c1e4be78233c", 8013889],
-	"win32-arm64": ["windows_arm64.zip", "251d467017f88e4eb7fc186c635a9bf64db5aa39cfc251d35dd4035f38941454", 7224229],
+	"darwin-arm64": ["darwin_arm64.tar.gz", "d0aa59c9a83d17ae3fc7f5dd31fdab6a26fd8c00fc5e692195753cd0719294f7", 7470202],
+	"darwin-x64": ["darwin_amd64.tar.gz", "3c5bdc73d226af5629cf4f4a781e223142e37c1ebb443c4b596f2e284352e381", 7961674],
+	"linux-x64": ["linux_amd64.tar.gz", "715fda625556e46d65ddb4526bb7f88a3fee5339ca3c44ce44cc652f17fa57f1", 7821191],
+	"linux-arm64": ["linux_arm64.tar.gz", "3309e9c0bbb539d183fd5aa9f9a13cd7aa0e81ec2512b5bedefb8b2bdd35b3e5", 7176726],
+	"win32-x64": ["windows_amd64.zip", "3065736ec7ff8137eb3fc607275f542ea13bb743a5157318c8a8770f11ce3289", 8021225],
+	"win32-arm64": ["windows_arm64.zip", "7463872a85a5e5434cf958bdffc71dda1926bced30d3b6b38c80fec9bb98fbba", 7231641],
 } as const;
 test("fixed Engram descriptors are the GitHub release archives and checksums, and nothing else", () => {
 	for (const [target, [suffix, sha256, size]] of Object.entries(engramPins)) {
 		const [platform, arch] = target.split("-");
 		const artifact = artifactFor("engram", platform, arch);
-		assert.equal(artifact.version, "3.3.2");
-		assert.equal(artifact.url, `https://github.com/Gentleman-Programming/engram/releases/download/v3.3.2/engram_3.3.2_${suffix}`);
+		assert.equal(artifact.version, "3.4.0");
+		assert.equal(artifact.url, `https://github.com/Gentleman-Programming/engram/releases/download/v3.4.0/engram_3.4.0_${suffix}`);
 		assert.equal(artifact.integrity, `sha256-${sha256}`);
 		assert.deepEqual([artifact.size, artifact.maxBytes], [size, size]);
 		// GitHub serves release assets from its asset hosts.

package/tests/installer-preflight.test.ts

@@ -253,7 +253,7 @@ test("a missing Pi is installed before an existing Gentle Shell is updated", ()
 });
 
 test("an existing compatible Pi from any installation is reused and only Gentle Shell is installed", () => {
-	for (const pi of [tool("1.2.0"), { ...tool("1.0.4"), external: true }]) {
+	for (const pi of [tool("1.2.0"), { ...tool("1.2.4"), external: true }]) {
 		const plan = planPreflight({ ...installed(), pi, shell: absent, gentleAi: absent, setup: false });
 		assert.equal(plan.tools.pi.status, "reusable");
 		assert.deepEqual(updateIds(plan), ["install-shell", "setup-shell", "verify-readiness"]);
@@ -261,7 +261,7 @@ test("an existing compatible Pi from any installation is reused and only Gentle
 });
 
 test("a pnpm Pi newer than the installer's pin never blocks: Gentle Shell is added or updated beside it", () => {
-	const newer = { ...tool("1.1.0") };
+	const newer = { ...tool("1.2.1") };
 	const install = planPreflight({ ...installed(), pi: newer, shell: absent, gentleAi: absent, setup: false });
 	assert.deepEqual([install.blockers, updateIds(install)], [[], ["install-shell", "setup-shell", "verify-readiness"]]);
 	const update = planPreflight({ ...installed(), pi: newer, shell: owned("3.9.0"), gentleAi: unchecked, setup: unchecked });
@@ -363,7 +363,7 @@ test("missing Windows Go is acquired before reprovisioning an existing Shell", (
 // A pinned stack this pnpm installed whose setup did not finish (setup probe: recoverable).
 const recoverable = { available: true, recoverable: true };
 function partial(change: object = {}) {
-	return { ...installed(), pi: tool("1.0.0"), shell: { ...tool(requirements.shell), global: true }, setup: recoverable, ...change };
+	return { ...installed(), pi: tool("1.2.0"), shell: { ...tool(requirements.shell), global: true }, setup: recoverable, ...change };
 }
 
 test("a recoverable stack only reruns setup, with PATH setup when the global bin is off PATH", () => {

package/tests/installer-probes.test.ts

@@ -657,11 +657,11 @@ test("clean global list: Pi, Shell and Gentle AI absent and setup needed, from o
 });
 
 test("pnpm-global Pi and Shell report versions; verified package-native Gentle AI is compatible", async () => {
-	const stdout = listing({ "@earendil-works/pi-coding-agent": { version: "1.0.0", path: `${PNPM_HOME}/global/v11/def/node_modules/pi` },
+	const stdout = listing({ "@earendil-works/pi-coding-agent": { version: PI_INSTALL_VERSION, path: `${PNPM_HOME}/global/v11/def/node_modules/pi` },
 		"gentle-pi": { version: requirements.shell, path: SHELL_ROOT } });
 	const files = [TOOLS_PNPM, `${BIN}/gentle-shell`, gentleAiBinaryPath(SHELL_ROOT, "linux")];
 	const h = probes({ files, dirs: [HOME, PNPM_HOME, SHELL_ROOT], texts: besidePi(PI_INSTALL_VERSION), results: { [`${TOOLS_PNPM} ${LIST}`]: { code: 0, stdout } } });
-	assert.deepEqual(await h.probes.pi(), { available: true, version: "1.0.0", usable: true });
+	assert.deepEqual(await h.probes.pi(), { available: true, version: PI_INSTALL_VERSION, usable: true });
 	assert.deepEqual(await h.probes.shell(), { available: true, version: requirements.shell, usable: true, global: true, owner: "pnpm" });
 	assert.deepEqual(await h.probes.gentleAi(), { available: true, version: requirements.gentleAi, usable: true, compatible: true });
 	assert.deepEqual(h.integrityCalls, [{ packageRoot: SHELL_ROOT, platform: "linux", env: bootstrapEnv, home: HOME }]);
@@ -684,7 +684,7 @@ test("setup is recoverable only for the pinned Pi and Shell owned by one pnpm pr
 	const persisted = { dependencies: { npm: { version: "11.19.0" }, pnpm: { version: "11.1.1" } } };
 	assert.deepEqual(await setup(JSON.stringify([persisted, { dependencies: { [PI]: pi, "gentle-pi": shell } }])), recoverable);
 	const foreign = [
-		listing({ [PI]: { ...pi, version: "1.2.0" }, "gentle-pi": shell }),
+		listing({ [PI]: { ...pi, version: "1.2.1" }, "gentle-pi": shell }),
 		listing({ [PI]: pi, "gentle-pi": { ...shell, version: "3.0.0" } }),
 		listing({ "gentle-pi": shell }),
 		JSON.stringify([{ dependencies: { [PI]: pi, "gentle-pi": shell } }, { dependencies: { [PI]: pi } }]),
@@ -698,7 +698,7 @@ test("setup is recoverable only for the pinned Pi and Shell owned by one pnpm pr
 	assert.deepEqual(await setup(listing({ [PI]: pi, "gentle-pi": shell }), { realpaths: { [SHELL_ROOT]: "/elsewhere/gentle-pi" } }),
 		{ available: null });
 	// The Pi beside gentle-pi, which the launcher runs, may be pnpm's newer peer, but never below the minimum, unreadable or missing.
-	assert.deepEqual(await setup(listing({ [PI]: pi, "gentle-pi": shell }), { texts: besidePi("1.1.0") }), recoverable);
+	assert.deepEqual(await setup(listing({ [PI]: pi, "gentle-pi": shell }), { texts: besidePi("1.2.1") }), recoverable);
 	for (const texts of [besidePi("0.99.0"), { [BESIDE_PI]: "not json" }, { [`${PNPM_HOME}/elsewhere`]: "" }]) {
 		assert.deepEqual(await setup(listing({ [PI]: pi, "gentle-pi": shell }), { texts }), { available: null }, JSON.stringify(texts));
 	}
@@ -741,7 +741,7 @@ test("a pnpm-global Shell from the main channel is present with its main version
 
 const NPM_ROOT = "/usr/local/lib/node_modules";
 const NPM_SHELL = `${NPM_ROOT}/gentle-pi`;
-const outside = (shellVersion: string, { linked = false, piOutput = "1.0.4\n" } = {}) => probes({
+const outside = (shellVersion: string, { linked = false, piOutput = "1.2.4\n" } = {}) => probes({
 	env: { HOME, PATH: `${TOOLS}/pnpm/bin:/usr/local/bin:/usr/bin` },
 	files: [TOOLS_PNPM, "/usr/local/bin/pi", "/usr/local/bin/gentle-shell", "/usr/local/bin/npm"],
 	dirs: [HOME, NPM_ROOT, "/home/u/work/gentle-pi"],
@@ -752,7 +752,7 @@ const outside = (shellVersion: string, { linked = false, piOutput = "1.0.4\n" }
 });
 
 test("a Pi on PATH that pnpm does not manage is reused with the version it reports", async () => {
-	assert.deepEqual(await outside("3.9.0").probes.pi(), { available: true, version: "1.0.4", usable: true, external: true });
+	assert.deepEqual(await outside("3.9.0").probes.pi(), { available: true, version: "1.2.4", usable: true, external: true });
 	for (const piOutput of ["", "pi dev build\n"]) {
 		assert.deepEqual(await outside("3.9.0", { piOutput }).probes.pi(), { available: null, outsidePnpm: true }, piOutput);
 	}
@@ -791,13 +791,13 @@ test("an older pnpm-global Pi reports pnpm as its owner, and locatePi finds its
 });
 
 test("a pnpm-global Pi newer than the installer's pin reports no owner: it is reused as it is", async () => {
-	for (const version of ["1.0.1", "1.1.0", "2.0.0"]) {
+	for (const version of ["1.2.1", "1.3.0", "2.0.0"]) {
 		const newer = probes({ files: [TOOLS_PNPM], dirs: [HOME, PI_ROOT], results: { [`${TOOLS_PNPM} ${LIST}`]: { code: 0,
 			stdout: listing({ [PI_PACKAGE]: { version, path: PI_ROOT } }) } } });
 		assert.deepEqual(await newer.probes.pi(), { available: true, version, usable: true }, version);
 	}
 	// A newer Pi from elsewhere is reused as it is: pnpm does not own it.
-	assert.deepEqual(await outsidePi("1.1.0").probes.pi(), { available: true, version: "1.1.0", usable: true, external: true });
+	assert.deepEqual(await outsidePi("1.2.1").probes.pi(), { available: true, version: "1.2.1", usable: true, external: true });
 });
 
 test("an older Pi in npm's global root reports npm as its owner; one elsewhere has no owner", async () => {

package/tests/installer-runner.test.ts

@@ -724,7 +724,7 @@ test("install nonzero, signal or deadline fails and reports completed steps", as
 test("an existing global Pi or gentle-pi blocks before installation regardless of the plan", async () => {
 	const existing = [
 		listing(),
-		JSON.stringify([{ dependencies: { "@earendil-works/pi-coding-agent": { version: "1.2.0" } } }]),
+		JSON.stringify([{ dependencies: { "@earendil-works/pi-coding-agent": { version: "1.2.1" } } }]),
 		JSON.stringify([{ dependencies: {} }, { dependencies: { "gentle-pi": { version: "3.0.0" } } }]),
 		JSON.stringify([{ optionalDependencies: { "gentle-pi": { version: "4.0.0" } } }]),
 	];
@@ -1390,7 +1390,7 @@ test("setup recovery blocks when the installed stack changed between plan and ru
 	const stack = JSON.parse(listing());
 	const changed = [
 		"[]",
-		listing("1.2.0"),
+		listing("1.2.1"),
 		listing(PI_INSTALL_VERSION, "3.0.0"),
 		listing(PI_INSTALL_VERSION, requirements.shell, "/elsewhere/gentle-pi"),
 		JSON.stringify([...stack, { dependencies: { "gentle-pi": { version: requirements.shell, path: PACKAGE_ROOT } } }]),
@@ -1640,7 +1640,7 @@ const NPM_SHELL_ROOT = "/usr/local/lib/node_modules/gentle-pi";
 
 test("with a compatible Pi already installed, only Gentle Shell is added and Pi is left as it is", async () => {
 	// A pnpm Pi newer than PI_INSTALL_VERSION is kept too: gentle-pi gets its own pnpm group, nothing is replaced.
-	for (const version of ["1.2.0", PI_INSTALL_VERSION]) {
+	for (const version of ["1.2.1", PI_INSTALL_VERSION]) {
 		const h = harness({ results: { [LIST]: [piOnlyList(version), { code: 0, stdout: listing(version) }], [SHELL_ONLY_ADD]: { code: 0 } } });
 		const result = await runStandardInstall({ plan: existingPlan({ pi: tool(version) }), consent: true }, h.adapters);
 		assert.equal(result.outcome, "ready", version);
@@ -1652,7 +1652,7 @@ test("with a compatible Pi already installed, only Gentle Shell is added and Pi
 });
 
 test("adding only Gentle Shell still refuses a gentle-pi that pnpm already lists", async () => {
-	const h = harness({ results: { [LIST]: { code: 0, stdout: listing("1.2.0") } } });
+	const h = harness({ results: { [LIST]: { code: 0, stdout: listing("1.2.1") } } });
 	const result = await runStandardInstall({ plan: existingPlan({}), consent: true }, h.adapters);
 	assert.deepEqual([result.outcome, result.reason], ["blocked", "existing-stack"]);
 	assert.equal(h.calls.some((call) => call.args[1] === "add"), false);
@@ -1674,19 +1674,20 @@ test("Pi and gentle-pi are added as separate pnpm groups, so a later `pi update`
 
 test("verify-global-list accepts the Pi the launcher runs beside gentle-pi at the minimum or newer, and reports one other than the pin", async () => {
 	// pnpm's latest peer beside gentle-pi (or nested in it): Gentle Shell runs it, and the outcome says which.
-	for (const texts of [{ [besidePi(PACKAGE_ROOT)]: piPackage("1.1.0") }, { [nestedPi(PACKAGE_ROOT)]: piPackage("1.1.0") },
+	for (const texts of [{ [besidePi(PACKAGE_ROOT)]: piPackage("1.2.1") }, { [nestedPi(PACKAGE_ROOT)]: piPackage("1.2.1") },
 		{ [besidePi(PACKAGE_ROOT)]: piPackage(requirements.pi) }]) {
 		const h = harness({ texts });
 		const result = await runStandardInstall({ plan: plan(), consent: true }, h.adapters);
 		assert.equal(result.outcome, "ready", JSON.stringify(texts));
-		assert.equal(result.piVersion, Object.values(texts)[0].includes("1.1.0") ? "1.1.0" : requirements.pi);
+		const selectedVersion = JSON.parse(Object.values(texts)[0]).version;
+		assert.equal(result.piVersion, selectedVersion === PI_INSTALL_VERSION ? undefined : selectedVersion);
 	}
 	// The pin itself adds nothing to the outcome.
 	assert.equal("piVersion" in (await runStandardInstall({ plan: plan(), consent: true }, harness().adapters)), false);
 	const wrong = [
 		{ [besidePi(PACKAGE_ROOT)]: piPackage("0.99.0") },
 		// A Pi nested in gentle-pi resolves first, even below the minimum.
-		{ [nestedPi(PACKAGE_ROOT)]: piPackage("0.99.0"), [besidePi(PACKAGE_ROOT)]: piPackage("1.1.0") },
+		{ [nestedPi(PACKAGE_ROOT)]: piPackage("0.99.0"), [besidePi(PACKAGE_ROOT)]: piPackage("1.2.1") },
 		{ [besidePi(PACKAGE_ROOT)]: piPackage("1.2.0-beta.1") },
 		{ [besidePi(PACKAGE_ROOT)]: JSON.stringify({ name: "not-pi", version: PI_INSTALL_VERSION }) },
 		{ [besidePi(PACKAGE_ROOT)]: "not json" },
@@ -1706,10 +1707,10 @@ test("verify-global-list accepts the Pi the launcher runs beside gentle-pi at th
 });
 
 test("the main Shell is added alone and its adjacent Pi is verified like the release one", async () => {
-	const h = mainHarness(undefined, { texts: { [besidePi(MAIN_ROOT)]: piPackage("1.1.0") } });
+	const h = mainHarness(undefined, { texts: { [besidePi(MAIN_ROOT)]: piPackage("1.2.1") } });
 	const result = await runStandardInstall({ plan: mainPlan(), consent: true }, h.adapters);
 	assert.equal(result.outcome, "ready");
-	assert.equal(result.piVersion, "1.1.0");
+	assert.equal(result.piVersion, "1.2.1");
 	assert.deepEqual(h.calls.filter((call) => call.args[1] === "add").map((call) => call.args.slice(1)),
 		[INSTALL.split(" "), MAIN_ADD.split(" ")]);
 	const below = mainHarness(undefined, { texts: { [besidePi(MAIN_ROOT)]: piPackage("0.99.0") } });
@@ -1722,10 +1723,10 @@ test("a pnpm-owned Gentle Shell update is verified with a Pi at the minimum or n
 	const fixed = existingPlan({ shell: { available: true, version: "3.9.0", usable: true, global: true, owner: "pnpm" },
 		gentleAi: { available: null }, setup: { available: null } });
 	const located = [{ root: OLD_ROOT, version: "3.9.0", owner: "pnpm" }, { root: PACKAGE_ROOT, version: requirements.shell, owner: "pnpm" }];
-	const h = updateHarness({ located, texts: { [besidePi(PACKAGE_ROOT)]: piPackage("1.1.0") } });
+	const h = updateHarness({ located, texts: { [besidePi(PACKAGE_ROOT)]: piPackage("1.2.1") } });
 	const result = await runStandardInstall({ plan: fixed, consent: true }, h.adapters);
 	assert.equal(result.outcome, "ready");
-	assert.equal(result.piVersion, "1.1.0");
+	assert.equal(result.piVersion, "1.2.1");
 	assert.deepEqual(result.completed.slice(3, 5), ["update-shell", "verify-updated-shell"]);
 	for (const texts of [{ [besidePi(PACKAGE_ROOT)]: piPackage("0.99.0") }, { [nestedPi(PACKAGE_ROOT)]: piPackage("0.99.0") }]) {
 		const wrong = updateHarness({ located, texts });
@@ -1740,7 +1741,7 @@ test("a pnpm-owned Gentle Shell update is verified with a Pi at the minimum or n
 });
 
 test("a setup recovery accepts a newer Pi beside gentle-pi but not one below the minimum", async () => {
-	const newer = harness({ results: installedList, texts: { [besidePi(PACKAGE_ROOT)]: piPackage("1.1.0") } });
+	const newer = harness({ results: installedList, texts: { [besidePi(PACKAGE_ROOT)]: piPackage("1.2.1") } });
 	assert.equal((await runStandardInstall({ plan: recoveryPlan(), consent: true }, newer.adapters)).outcome, "ready");
 	const h = harness({ results: installedList, texts: { [besidePi(PACKAGE_ROOT)]: piPackage("0.99.0") } });
 	const result = await runStandardInstall({ plan: recoveryPlan(), consent: true }, h.adapters);
@@ -1942,7 +1943,7 @@ test("a Pi update is refused before any change when the installed Pi is not the
 	const plan = existingPlan({ pi: olderPi("pnpm") });
 	// Gone, unattributed, another version, another owner, or already current: never reinstalled, never downgraded.
 	for (const before of [null, { ...piBefore, owner: null }, { ...piBefore, version: "0.90.0" }, { ...piBefore, owner: "npm" },
-		{ ...piBefore, version: "1.2.0" }, { ...piBefore, version: PI_INSTALL_VERSION }, { ...piBefore, root: "relative/pi" }]) {
+		{ ...piBefore, version: "1.2.1" }, { ...piBefore, version: PI_INSTALL_VERSION }, { ...piBefore, root: "relative/pi" }]) {
 		const h = locatingPi(harness({ results: { [LIST]: piOnlyList("0.87.1") } }), [before]);
 		const result = await runStandardInstall({ plan, consent: true }, h.adapters);
 		assert.deepEqual([result.outcome, result.reason], ["blocked", "existing-stack-unverified"], JSON.stringify(before));

package/tests/installer-server.test.ts

@@ -298,7 +298,7 @@ test("/api/plan reports blockers with guidance and no profile change when alread
 
 test("/api/plan names the found and required version of an older Gentle Shell and how to resolve it", async () => {
 	const { host, port, login } = await start({ collect: async () => collected({
-		pi: { available: true, version: "1.0.4", usable: true },
+		pi: { available: true, version: "1.2.4", usable: true },
 		shell: { available: true, version: "3.4.0", usable: false, global: true },
 		gentleAi: { available: null }, setup: { available: null },
 	}) });
@@ -306,8 +306,8 @@ test("/api/plan names the found and required version of an older Gentle Shell an
 		const view = await plan(port, await login());
 		assert.deepEqual(view.blockers.map((blocker: { code: string; tool: string }) => [blocker.code, blocker.tool]), [["incompatible-tool", "shell"]]);
 		assert.equal(view.blockers[0].guidance,
-			"Gentle Shell 3.4.0 is installed globally with pnpm, but this installer needs 4.1.0 or newer. Nothing was replaced. " +
-			"Update it with `pnpm add -g gentle-pi@4.1.0`, or remove it with `pnpm remove -g gentle-pi`, then select Check again.");
+			"Gentle Shell 3.4.0 is installed globally with pnpm, but this installer needs 4.3.0 or newer. Nothing was replaced. " +
+			"Update it with `pnpm add -g gentle-pi@4.3.0`, or remove it with `pnpm remove -g gentle-pi`, then select Check again.");
 		assert.deepEqual(view.actions, []);
 	} finally {
 		await host.close("test");
@@ -449,7 +449,7 @@ test("/api/plan explains a pnpm in $PNPM_HOME/bin that the installer will not re
 
 test("/api/plan explains a Gentle Shell that neither pnpm nor npm manages", async () => {
 	const { host, port, login } = await start({ collect: async () => collected({
-		pi: { available: true, version: "1.0.4", usable: true },
+		pi: { available: true, version: "1.2.4", usable: true },
 		shell: { available: null, outsidePnpm: true }, gentleAi: { available: null }, setup: { available: null },
 	}) });
 	try {
@@ -514,7 +514,7 @@ test("the outcome says which Pi Gentle Shell runs only when it is not the instal
 
 test("/api/plan describes updating an existing Gentle Shell on either channel", async () => {
 	const shell = { available: true, version: "3.9.0", usable: true, global: true, owner: "npm" };
-	const { host, port, login } = await start({ collect: async (channel) => collectedFor(channel, { pi: { available: true, version: "1.0.4", usable: true },
+	const { host, port, login } = await start({ collect: async (channel) => collectedFor(channel, { pi: { available: true, version: "1.2.4", usable: true },
 		shell, go: { available: true, version: "1.26.0", usable: true }, gentleAi: { available: null }, setup: { available: null } }) });
 	try {
 		const cookie = await login();
@@ -934,6 +934,10 @@ test("a failed setup passes only its bounded detail through, with rate-limit gui
 	for (const [step, detail, expected] of [
 		["install-global", ".../gentle-pi postinstall:   root cause Error: go: open ~/x: The directory name is invalid.", guidance.failed["install-global"]],
 		["install-global", rateLimited, guidance.githubRateLimit],
+		// Windows code integrity (Smart App Control) refused the gentle-ai.exe the postinstall built.
+		["install-global", ".../node_modules/gentle-pi postinstall: caused by Error: spawn UNKNOWN (code UNKNOWN)", guidance.codeIntegrityBlocked],
+		["install-version", ".../node_modules/gentle-pi postinstall: caused by Error: spawn UNKNOWN (code UNKNOWN)", guidance.codeIntegrityBlocked],
+		["install-version", "ERR_PNPM_FETCH_401 GET https://npm.acme.dev/x: Unauthorized", guidance.failed["install-version"]],
 		["install-shell-main", mainLimited, guidance.githubRateLimit],
 		["install-shell-main", "main-commit-unavailable: GitHub did not return the latest main commit of Gentleman-Programming/gentle-shell (HTTP 500)", guidance.failed["install-shell-main"]],
 		["build-gentle-ai-main", "main-commit-unavailable: GitHub did not return the latest main commit of Gentleman-Programming/gentle-ai (HTTP 403)", guidance.githubRateLimit],
@@ -957,6 +961,10 @@ test("a failed setup passes only its bounded detail through, with rate-limit gui
 	assert.match(guidance.githubRateLimit, /GitHub/);
 	assert.match(guidance.githubRateLimit, /hour/);
 	assert.doesNotMatch(guidance.githubRateLimit, /gentle-shell setup|token|credential|password|log in|sign in/i);
+	assert.match(guidance.codeIntegrityBlocked, /Smart App Control/);
+	assert.match(guidance.codeIntegrityBlocked, /WSL/);
+	assert.match(guidance.codeIntegrityBlocked, /cannot be turned back on/);
+	assert.doesNotMatch(guidance.codeIntegrityBlocked, /network|registry/);
 	assert.match(guidance.goDestinationConflict, /earlier/);
 	assert.match(guidance.goDestinationConflict, /Remove that folder/);
 	assert.doesNotMatch(guidance.goDestinationConflict, /network/);

package/tests/installer-windows-bootstrap.test.ts

@@ -653,13 +653,14 @@ test("native Windows entry: spaces, Unicode, CMD metacharacters and early missin
 		const scripts = join(f.root, "scripts"); mkdirSync(scripts);
 		// Observe the copied production entry's first PowerShell handle so the
 		// existing ownership-checked guard can reap it if the fixture times out.
-		writeFileSync(join(scripts, "bootstrap.cmd"), observeStage(readFileSync(new URL("../scripts/bootstrap.cmd", import.meta.url), "utf8")));
+		writeFileSync(join(scripts, "bootstrap.cmd"), observeStage(readFileSync(new URL("../scripts/bootstrap.cmd", import.meta.url), "utf8"), true));
 		const local = join(f.root, "home"); mkdirSync(local);
 		const env = { ...nativeEnv(f.root), LOCALAPPDATA: local };
 		// The same outer bound as every other production fragment (nativeCmd): a cold
 		// cmd.exe plus Windows PowerShell 5.1 start can exceed 5 s while the CI step runs
 		// the installer suites in parallel. The bundle stage itself has no deadline.
 		console.error("WINDOWS_ENTRY_PROBE_START timeoutMs=14000");
+		const startedAt = Date.now();
 		const started = performance.now();
 		const result = await nativeCmdFile(f.root, "scripts\\bootstrap.cmd", env, 14000);
 		console.error("WINDOWS_ENTRY_PROBE_RESULT", JSON.stringify({ elapsedMs: performance.now() - started, status: result.status, guardKilled: result.guardKilled, expectedDiagnostic: /No acquisition attempted/.test(result.stderr) }));
@@ -668,6 +669,8 @@ test("native Windows entry: spaces, Unicode, CMD metacharacters and early missin
 		assertNative(result, 1);
 		assert.match(result.stderr, /No acquisition attempted/);
 		assert.match(readFileSync(join(f.root, "process-records"), "utf8").trim(), /^[1-9][0-9]*\|[1-9][0-9]*$/, "the copied entry must expose its first PowerShell handle to fixture cleanup");
+		const readyMs = Number(readFileSync(join(f.root, "powershell-ready-ms"), "utf8"));
+		assert.ok(Number.isSafeInteger(readyMs) && readyMs >= startedAt && readyMs <= Date.now(), "the fixture must timestamp PowerShell executing its body");
 		assert.deepEqual(readdirSync(local), []);
 	} finally {
 		try { cleanNativeProcesses(f.root); } finally { f.cleanup(); }
@@ -1199,11 +1202,14 @@ test("production and fixture PowerShell never depend on autoloading Microsoft.Po
 	}
 });
 const psRecordLine = '  "$record = [Diagnostics.Process]::GetCurrentProcess(); [IO.File]::AppendAllText($env:GENTLE_FIXTURE_RECORDS,([string]$record.Id + [char]124 + [string]$record.StartTime.ToUniversalTime().Ticks + [Environment]::NewLine));" ^';
-function observeStage(stage: string) {
+// Entry-only telemetry: this timestamps execution of the PowerShell body, not
+// merely process creation. Keep it separate from the guard's PID/ticks records.
+const psReadyLine = '  "[IO.File]::WriteAllText([IO.Path]::Combine($env:GENTLE_FIXTURE_ROOT,\'powershell-ready-ms\'),[string][DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds());" ^';
+function observeStage(stage: string, entryReadiness = false) {
 	const lines = stage.split("\n");
 	const index = lines.findIndex((line) => line.includes("LanguageMode"));
 	assert.ok(index >= 0);
-	lines.splice(index + 1, 0, psRecordLine);
+	lines.splice(index + 1, 0, psRecordLine, ...(entryReadiness ? [psReadyLine] : []));
 	return lines.join("\n");
 }
 function cmdComposition(stages: string[]) {
@@ -1234,6 +1240,16 @@ test("native entry observation preserves the complete production batch", () => {
 	assert.equal(observed.filter((line) => line !== psRecordLine).join("\n"), source);
 });
 
+test("native entry readiness observation is opt-in and preserves production and ownership records", () => {
+	const source = readFileSync(new URL("../scripts/bootstrap.cmd", import.meta.url), "utf8");
+	const observed = observeStage(source, true).split("\n");
+	assert.equal(observed.filter((line) => line.includes("powershell-ready-ms")).length, 1);
+	assert.equal(observed.filter((line) => line === psRecordLine).length, 1);
+	assert.equal(observed.filter((line) => line !== psRecordLine && !line.includes("powershell-ready-ms")).join("\n"), source);
+	assert.doesNotMatch(observeStage(source), /powershell-ready-ms/);
+	assert.ok(observed.findIndex((line) => line.includes("powershell-ready-ms")) > observed.indexOf(psRecordLine));
+});
+
 test("native fixture compositions retain exact production fragments and no transport command", () => {
 	for (const marker of Object.values(stageMarkers)) {
 		const original = cmdStage(marker);
@@ -1314,10 +1330,22 @@ async function nativeCmd(root: string, stages: string[], env: NodeJS.ProcessEnv
 	return nativeCmdFile(root, "fixture.cmd", env, limit);
 }
 async function nativeCmdFile(root: string, file: string, env: NodeJS.ProcessEnv, limit = 5000): Promise<NativeResult> {
+	const startedAt = Date.now();
 	const started = performance.now();
 	const trace = (phase: string, detail: Record<string, unknown> = {}) => {
 		if (file === "scripts\\bootstrap.cmd") console.error("WINDOWS_ENTRY_PHASE", JSON.stringify({ phase, elapsedMs: performance.now() - started, limit, ...detail }));
 	};
+	// Wall-clock timestamps share an epoch with PowerShell. These measurements
+	// are diagnostic only; the monotonic outer deadline is never reset. Emit
+	// the split before synchronous guard cleanup can inflate execution time.
+	const traceEntryTiming = () => {
+		if (file !== "scripts\\bootstrap.cmd") return;
+		const readyPath = join(root, "powershell-ready-ms");
+		const finishedAt = Date.now();
+		const readyMs = existsSync(readyPath) ? Number(readFileSync(readyPath, "utf8")) : NaN;
+		const valid = Number.isSafeInteger(readyMs) && readyMs >= startedAt && readyMs <= finishedAt;
+		trace("entry-timing", { readyObserved: valid, startupMs: valid ? readyMs - startedAt : null, executionMs: valid ? finishedAt - readyMs : null });
+	};
 	trace("spawn-request");
 	const child = spawn(join(process.env.SystemRoot!, "System32/cmd.exe"), ["/d", "/c", file], { cwd: root, env, stdio: ["ignore", "pipe", "pipe"] });
 	let stdout = ""; let stderr = ""; let guardKilled = false;
@@ -1327,6 +1355,7 @@ async function nativeCmdFile(root: string, file: string, env: NodeJS.ProcessEnv,
 	const result = await new Promise<NativeResult>((resolveChild, reject) => {
 		const timer = setTimeout(() => {
 			guardKilled = true;
+			traceEntryTiming();
 			trace("guard-fired", { recordExists: existsSync(join(root, "process-records")), diagnosticSeen: /No acquisition attempted/.test(stderr) });
 			try { cleanNativeProcesses(root); } catch (error) { guardError = error; }
 			child.kill("SIGKILL");
@@ -1341,7 +1370,7 @@ async function nativeCmdFile(root: string, file: string, env: NodeJS.ProcessEnv,
 			if (!/No acquisition attempted/.test(before) && /No acquisition attempted/.test(stderr)) trace("missing-bundle-diagnostic");
 			if (stderr.length > 1048576) { guardError = new Error("Fixture output limit"); child.kill("SIGKILL"); } });
 		child.once("error", (error) => { clearTimeout(timer); reject(error); });
-		child.once("close", (status) => { trace("cmd-close", { status, guardKilled }); clearTimeout(timer); resolveChild({ status, stdout, stderr, guardKilled }); });
+		child.once("close", (status) => { if (!guardKilled) traceEntryTiming(); trace("cmd-close", { status, guardKilled }); clearTimeout(timer); resolveChild({ status, stdout, stderr, guardKilled }); });
 	});
 	const residualReaped = cleanNativeProcesses(root);
 	assert.equal(residualReaped, false, "production must reap its own recorded children; fixture cleanup cannot mask a failure");

package/tests/main-channel-upgrade.test.ts

@@ -5,6 +5,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import test from "node:test";
 import { CHANNEL_SCHEMA, MainChannelError, ownerManager, readChannel, removeGlobalShell, runUpgrade, writeChannel } from "../scripts/main-channel.mjs";
+import { requirements } from "../scripts/installer-preflight.mjs";
 
 const AI_SHA = "1f9d5e6423e37f7d2316859045f379ba9b5d8c3a";
 const SHELL_SHA = "6e7e3a18f794223396527a54c7c36d19c7d236c6";
@@ -53,6 +54,9 @@ function world({ owner = "pnpm", latest = "4.1.0", commits = { ai: AI_SHA, shell
 			for (const name of ["gentle-ai", "gentle-ai.exe"]) writeFileSync(join(options.env!.GOBIN, name), "#!/bin/sh\n", { mode: 0o755 });
 			return { code: 0, stdout: "" };
 		}
+		if (argv[0] === "version" && command === `${bin}/go`) {
+			return { code: 0, stdout: `go version go${requirements.go} ${platform}/amd64\n` };
+		}
 		if (argv[0] === "version") {
 			const sha = command.split("/").at(-2) ?? "";
 			return { code: 0, stdout: `gentle-ai 4.0.1-0.20261008202137-${sha.slice(0, 12)}\n` };
@@ -69,7 +73,9 @@ function world({ owner = "pnpm", latest = "4.1.0", commits = { ai: AI_SHA, shell
 	};
 	const which = async (name: string) => (tools.includes(name) ? `${bin}/${name}${name === "go" ? "" : suffix}` : null);
 	const upgrade = (args: string[], currentVersion = "4.0.0") => runUpgrade({ args, ctx, platform, packageRoot, currentVersion,
-		adapters: { fetch, run, fs, which, ...(invocation ? { invocation } : {}), ...(migrate ? { migrate } : {}) }, out: (line: string) => lines.push(line) });
+		adapters: { fetch, run, fs, which,
+			acquireGo: async () => { throw new Error("Unexpected Go acquisition in sandboxed upgrade fixture"); },
+			...(invocation ? { invocation } : {}), ...(migrate ? { migrate } : {}) }, out: (line: string) => lines.push(line) });
 	const installs = () => calls.filter((call) => call.argv.some((arg) => ["add", "install"].includes(arg)) && !call.argv.some((arg) => arg.includes("cmd/gentle-ai@")))
 		.map((call) => `${call.command} ${call.argv.join(" ")}`);
 	const manager = (command?: string) => ownerManager({ ctx, platform, packageRoot, adapters: { fs, run, which, ...(invocation ? { invocation } : {}) },

package/tests/native-review-capability-contract.test.ts

@@ -379,11 +379,17 @@ test("4.1.1 explicitly repeats 4.0.0 because capabilities/v2.6 is unchanged desp
 	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["4.0.0"] as Record<string, boolean>);
 });
 
+test("4.2.0 explicitly repeats 4.1.1 because capabilities/v2.6 is unchanged despite provider contract 1.4.0", () => {
+	const contract = NATIVE_CLI_CONTRACTS["4.2.0"] as Record<string, boolean>;
+	assert.ok(contract);
+	assert.deepEqual(contract, NATIVE_CLI_CONTRACTS["4.1.1"] as Record<string, boolean>);
+});
+
 test("no shipped version key was added beyond the pin bump", () => {
 	// Rows are promises to consumers, so a new key only ever appears in a
 	// dedicated commit alongside a pin bump, never as a side effect. v2.2.4 and
 	// v2.3.0 shipped upstream while Pi stayed on 2.2.3 and were never pinned,
 	// so they get no row: a row asserts ground truth measured against a binary
 	// Pi actually ran, and the table only has to be ascending, not gapless.
-	assert.deepEqual(Object.keys(NATIVE_CLI_CONTRACTS), [...DARK_VERSIONS, "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.4.0", "2.5.0-rc.3", "2.5.0", "2.6.0", "2.7.0", "2.8.0", "2.8.1", "2.8.2", "2.9.0", "2.9.1", "3.0.0", "3.0.1", "3.1.0", "3.2.1", "3.4.0", "3.5.0", "3.6.0", "3.6.1", "3.7.0", "4.0.0", "4.1.1"]);
+	assert.deepEqual(Object.keys(NATIVE_CLI_CONTRACTS), [...DARK_VERSIONS, "2.2.0", "2.2.1", "2.2.2", "2.2.3", "2.4.0", "2.5.0-rc.3", "2.5.0", "2.6.0", "2.7.0", "2.8.0", "2.8.1", "2.8.2", "2.9.0", "2.9.1", "3.0.0", "3.0.1", "3.1.0", "3.2.1", "3.4.0", "3.5.0", "3.6.0", "3.6.1", "3.7.0", "4.0.0", "4.1.1", "4.2.0"]);
 });

package/tests/native-review-parity.test.ts

@@ -3,7 +3,8 @@ import { execFileSync } from "node:child_process";
 import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import test from "node:test";
+import test, { after, before } from "node:test";
+import { setWindowsAclAuthorityForTesting } from "../lib/review-candidate-view-owner.ts";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { __testing, createGentleAiExtension, PendingReviewConsentRegistry } from "../extensions/gentle-ai.ts";
 import { CandidateViewRegistry } from "../lib/review-candidate-view.ts";
@@ -28,6 +29,24 @@ import {
 	type ReviewStatusV3,
 } from "../lib/review-integration-v2.ts";
 
+// Coordination tests use fixture authority; real Windows ACL coverage lives
+// in review-candidate-view.test.ts, in a separate test process.
+let fixtureAclChecks = 0;
+before(() => {
+	if (process.platform === "win32") {
+		setWindowsAclAuthorityForTesting(() => { fixtureAclChecks++; });
+	}
+});
+after(() => setWindowsAclAuthorityForTesting());
+
+test("coordination suites isolate Windows ACL authority with teardown", () => {
+	for (const file of ["native-review-parity", "review-controller-native-routing", "review-session-standing-permission-controller"]) {
+		const source = readFileSync(new URL(`./${file}.test.ts`, import.meta.url), "utf8");
+		assert.match(source, /import \{ setWindowsAclAuthorityForTesting \} from/, file);
+		assert.match(source, /after\(\(\) => setWindowsAclAuthorityForTesting\(\)\)/, file);
+	}
+});
+
 const CAPTURED_FIXTURES = join(process.cwd(), "tests", "fixtures", "devbinary");
 
 function captured(name: string): unknown {
@@ -218,7 +237,9 @@ function repository(t: test.TestContext): string {
 
 function startStatus(cwd: string): ReviewStatusV3 {
 	const candidates = new CandidateViewRegistry();
+	const checksBefore = fixtureAclChecks;
 	const candidate = candidates.create({ contributorRoot: cwd });
+	if (process.platform === "win32") assert.ok(fixtureAclChecks > checksBefore, "coordination candidates must use the fixture ACL authority");
 	try {
 		return {
 			contract: "gentle-ai.review-integration/v2",