gentle-pi 4.3.0 → 4.4.0

package/tests/auto-permission-runtime.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { mkdtempSync, mkdirSync, symlinkSync, rmSync, writeFileSync } from "node:fs";
+import { mkdtempSync, mkdirSync, symlinkSync, linkSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { AutoPermissionRuntime } from "../lib/auto-permission-runtime.ts";
@@ -258,6 +258,90 @@ test("Native consent, human questions and delegation remain with their original
  f.setMode("auto");assert.equal((await f.execute("custom_tool",{},false)).executions,1);assert.equal(f.requests.length,0);
 });
 
+test("Companion update files are not permission authority and still receive ordinary checks", async t=>{
+ const f=fixture(t);f.input("Update the installed companion tools from main.");
+ for(const mode of ["normal","auto","yolo"]) {
+  f.setMode(mode);
+  for(const path of ["dev-binary.json","channel.json","main/gentle-ai","tools/go/bin/go"]) {
+   const input={path:join(f.cwd,"config",path),content:"updated companion data"};
+   for(const toolName of ["write","edit"]) {
+    assert.equal(f.runtime.guard({toolName,input},f.ctx),undefined,`${mode}: ${path} is not policy`);
+    assert.equal((await f.execute(toolName,input)).executions,1);
+   }
+  }
+ }
+ assert.equal(f.requests.length,8,"only Auto requests are classified; other modes keep their own behavior");
+ f.setMode("auto");f.setResponse({status:"available",decision:"deny",reason:"Update not authorized"});
+ assert.equal((await f.execute("write",{path:join(f.cwd,"config","dev-binary.json"),content:"unapproved"})).executions,0);
+ assert.equal(f.requests.length,9,"an update path is not an automatic allow");
+});
+
+test("Permission authority, aliases and parent directories remain protected in every mode", async t=>{
+ const f=fixture(t);f.input("Update companion tools without changing permissions.");
+ const home=join(f.cwd,"config");mkdirSync(home);
+ const projectHome=join(f.cwd,".pi","gentle-ai");mkdirSync(projectHome,{recursive:true});
+ for(const name of ["permission-mode.json","runtime-guardrails.json"])writeFileSync(join(home,name),"{}");
+ writeFileSync(join(projectHome,"runtime-guardrails.json"),"{}");
+ symlinkSync(home,join(f.cwd,"config-alias"));
+ symlinkSync(join(home,"permission-mode.json"),join(f.cwd,"policy-alias"));
+ symlinkSync(join(home,"runtime-guardrails.json"),join(home,"dev-binary.json"));
+ for(const mode of ["normal","auto","yolo"]) {
+  f.setMode(mode);
+  for(const path of [join(home,"permission-mode.json"),join(home,"runtime-guardrails.json"),
+   join(f.cwd,"config-alias","permission-mode.json"),join(f.cwd,"policy-alias"),join(home,"dev-binary.json"),
+   join(projectHome,"runtime-guardrails.json"),projectHome,home,f.cwd,
+   ...["profiles.json","models.json","background-subagents.json","persona.json","builtin-codemode-optout.json",
+    "history-capture.json","scratch/session.json","tools/other-tool"].map(path=>join(home,path))]) {
+   for(const toolName of ["write","edit"]) {
+    const input={path,content:"{}"};
+    assert.equal(f.runtime.guard({toolName,input},f.ctx)?.block,true,`${mode}: ${path} stays protected`);
+    assert.equal((await f.execute(toolName,input)).executions,0);
+   }
+  }
+  for(const toolName of ["bash","bash_background","monitor"]) {
+   for(const command of [`rm -rf '${home}'`,`rm -rf '${home}/'`,`rm -rf '${home}'/*`,
+    `printf '{}' > '${join(home,"permission-mode.json")}'`,`printf '{}' > '${join(home,"runtime-guardrails.json")}'`,
+    `printf '{}' > '${join(projectHome,"runtime-guardrails.json")}'`]) {
+    assert.equal(f.runtime.guard({toolName,input:{command}},f.ctx)?.block,true);
+    assert.equal((await f.execute(toolName,{command})).executions,0);
+   }
+  }
+ }
+ assert.equal(f.requests.length,0,"a classifier allow never overrides the policy guard");
+});
+
+test("Updater exceptions cannot overwrite authority through hardlinks", async t=>{
+ const f=fixture(t);f.input("Update companion tools without changing permission or routing policy.");
+ const home=join(f.cwd,"config");mkdirSync(join(home,"main"),{recursive:true});
+ for(const [policy,alias] of [["permission-mode.json","dev-binary.json"],["models.json","main/routing-alias"]]) {
+  writeFileSync(join(home,policy),"{}");linkSync(join(home,policy),join(home,alias));
+  for(const toolName of ["write","edit"]) {
+   const input={path:join(home,alias),content:"{}"};
+   assert.equal(f.runtime.guard({toolName,input},f.ctx)?.block,true,alias);
+   assert.equal((await f.execute(toolName,input)).executions,0);
+  }
+ }
+ assert.equal(f.requests.length,0);
+});
+
+test("Dangling updater aliases cannot create absent permission authority", async t=>{
+ const f=fixture(t);f.input("Update companion tools without creating or changing permission policy.");
+ const home=join(f.cwd,"config");mkdirSync(join(home,"tools"),{recursive:true});
+ for(const [alias,policy] of [["dev-binary.json","permission-mode.json"],["channel.json","runtime-guardrails.json"],
+  ["main","permission-mode.json"],["tools/go","runtime-guardrails.json"]]) {
+  symlinkSync(join(home,policy),join(home,alias));
+  for(const mode of ["normal","auto","yolo"]) {
+   f.setMode(mode);
+   for(const toolName of ["write","edit"]) {
+    const input={path:join(home,alias),content:"{}"};
+    assert.equal(f.runtime.guard({toolName,input},f.ctx)?.block,true,`${mode}: ${alias} stays protected`);
+    assert.equal((await f.execute(toolName,input)).executions,0);
+   }
+  }
+ }
+ assert.equal(f.requests.length,0,"unresolved aliases never reach an allowing classifier");
+});
+
 test("Policy files cannot be modified by model file tools; symlink escapes are reviewed", async t=>{
  const f=fixture(t);f.input("Edit source code");mkdirSync(join(f.cwd,"config"));
  assert.equal((await f.execute("write",{path:join(f.cwd,"config","permission-mode.json"),content:"yolo"})).executions,0);

package/tests/autonomous-guard.test.ts

@@ -910,3 +910,23 @@ test("loadRuntimeGuardrailsConfig: autonomousMode:{} (object) in JSON does NOT a
 		rmSync(dir, { recursive: true, force: true });
 	}
 });
+
+test("evaluateSuperYoloCommand: waives data-loss and configured confirmations, keeps only catastrophic denies", () => {
+	const { evaluateSuperYoloCommand } = __testing;
+	// Ordinary data-loss commands run without confirmation.
+	assert.equal(evaluateSuperYoloCommand("rm -rf node_modules build"), "allow");
+	assert.equal(evaluateSuperYoloCommand("git rebase origin/main"), "allow");
+	assert.equal(evaluateSuperYoloCommand("git branch -D feature/x"), "allow");
+	assert.equal(evaluateSuperYoloCommand("npm publish"), "allow");
+	assert.equal(evaluateSuperYoloCommand("git push -u origin feature"), "allow");
+	// Code-level catastrophic denies survive: root/home removal and hard-coded
+	// destructive Git forms (reset --hard, forced clean, force push).
+	assert.equal(evaluateSuperYoloCommand("rm -rf /"), "block");
+	assert.equal(evaluateSuperYoloCommand("rm -rf ~"), "block");
+	assert.equal(evaluateSuperYoloCommand("rm -rf --no-preserve-root /"), "block");
+	assert.equal(evaluateSuperYoloCommand("git reset --hard HEAD~1"), "block");
+	assert.equal(evaluateSuperYoloCommand("git push --force origin main"), "block");
+	assert.equal(evaluateSuperYoloCommand("git clean -fd"), "block");
+	// Harmless commands are unaffected.
+	assert.equal(evaluateSuperYoloCommand("git status && npm test"), "allow");
+});

package/tests/bundled-install.test.ts

@@ -17,7 +17,7 @@ const posixTest = (name: string, fn: (t: TestContext) => void | Promise<void>) =
 const NODE = "24.21.0";
 const PNPM = "11.1.1";
 const NPM = "11.19.0";
-const ENGRAM = "3.4.0";
+const ENGRAM = "3.5.2";
 
 // Every temporary home this file creates is removed when the file's tests end.
 const roots: string[] = [];
@@ -373,8 +373,8 @@ posixTest("ensureEngram downloads nothing when the prefix is missing", async ()
 });
 
 test("engramExecutable takes only the top-level engram from the tarball and engram.exe from the zip, regular files only", () => {
-	const tarball = { url: "https://github.com/Gentleman-Programming/engram/releases/download/v3.4.0/engram_3.4.0_linux_amd64.tar.gz" };
-	const zipped = { url: "https://github.com/Gentleman-Programming/engram/releases/download/v3.4.0/engram_3.4.0_windows_amd64.zip" };
+	const tarball = { url: "https://github.com/Gentleman-Programming/engram/releases/download/v3.5.2/engram_3.5.2_linux_amd64.tar.gz" };
+	const zipped = { url: "https://github.com/Gentleman-Programming/engram/releases/download/v3.5.2/engram_3.5.2_windows_amd64.zip" };
 	assert.deepEqual(engramExecutable(engramArchive, tarball), engramBytes);
 	const exe = Buffer.from("MZ engram");
 	assert.deepEqual(engramExecutable(zip([["tools/cloud-sync-projects.ps1", Buffer.from("x")], ["engram.exe", exe]]), zipped), exe);

package/tests/clipboard-image.test.ts

@@ -0,0 +1,114 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { isWsl, readClipboardImage, sniffImageMimeType, type ClipboardCommandRunner } from "../lib/clipboard-image.ts";
+
+// A 2×1 PNG header: signature, IHDR length/type, width 2, height 1.
+const PNG_2X1 = new Uint8Array([
+	0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a,
+	0x00, 0x00, 0x00, 0x0d, 0x49, 0x48, 0x44, 0x52,
+	0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01,
+	0x08, 0x06, 0x00, 0x00, 0x00,
+]);
+
+type Call = { command: string; args: readonly string[] };
+type Reply = Buffer | undefined | ((call: Call) => Buffer | undefined);
+
+// Scripted backends keyed by `command firstArg`; anything unscripted is "not installed".
+function runner(replies: Record<string, Reply>): { run: ClipboardCommandRunner; calls: Call[] } {
+	const calls: Call[] = [];
+	const run: ClipboardCommandRunner = async (command, args) => {
+		const call = { command, args };
+		calls.push(call);
+		const reply = replies[`${command} ${args[0] ?? ""}`.trim()] ?? replies[command];
+		return typeof reply === "function" ? reply(call) : reply;
+	};
+	return { run, calls };
+}
+
+const BMP = new Uint8Array([0x42, 0x4d, 0x00, 0x00]);
+const noProc = () => undefined;
+
+test("WSL reads a Windows screenshot through PowerShell when the Linux clipboard has none", async () => {
+	const { run, calls } = runner({
+		"wl-paste --list-types": Buffer.from("text/plain\n"),
+		"powershell.exe": Buffer.from(`${Buffer.from(PNG_2X1).toString("base64")}\r\n`),
+	});
+	const image = await readClipboardImage({ env: { WSL_DISTRO_NAME: "Ubuntu" }, platform: "linux", run, native: () => undefined, procVersion: noProc });
+	assert.deepEqual(image && { mimeType: image.mimeType, bytes: [...image.bytes] }, { mimeType: "image/png", bytes: [...PNG_2X1] });
+	const powershell = calls.find((call) => call.command === "powershell.exe");
+	assert.ok(powershell, "PowerShell was consulted");
+	// The image travels on stdout as base64: no temp file path is ever passed.
+	const script = powershell.args.at(-1) ?? "";
+	assert.match(script, /ToBase64String/);
+	assert.doesNotMatch(script, /\$path|Save\('|tmp/i);
+});
+
+test("WSL falls back to PowerShell when wl-paste and xclip are not installed", async () => {
+	const { run, calls } = runner({ "powershell.exe": Buffer.from(Buffer.from(PNG_2X1).toString("base64")) });
+	const image = await readClipboardImage({ env: { WSL_INTEROP: "/run/WSL/1_interop" }, platform: "linux", run, native: () => undefined, procVersion: noProc });
+	assert.equal(image?.mimeType, "image/png");
+	assert.deepEqual(calls.map((call) => call.command), ["wl-paste", "xclip", "powershell.exe"]);
+});
+
+test("Wayland prefers PNG and never asks Windows on a native Linux desktop", async () => {
+	const { run, calls } = runner({
+		"wl-paste --list-types": Buffer.from("image/jpeg\nimage/png\ntext/plain\n"),
+		"wl-paste --type": (call) => call.args[1] === "image/png" ? Buffer.from(PNG_2X1) : undefined,
+	});
+	const image = await readClipboardImage({ env: { WAYLAND_DISPLAY: "wayland-0" }, platform: "linux", run, native: () => undefined, procVersion: noProc });
+	assert.equal(image?.mimeType, "image/png");
+	assert.ok(!calls.some((call) => call.command === "powershell.exe"));
+});
+
+test("an empty Windows clipboard, an unsupported format, or Termux leave the paste to Pi", async () => {
+	const empty = runner({ "powershell.exe": Buffer.from("\r\n") });
+	assert.equal(await readClipboardImage({ env: { WSL_DISTRO_NAME: "Ubuntu" }, platform: "linux", run: empty.run, native: () => undefined, procVersion: noProc }), null);
+	const bmp = runner({ "xclip -selection": (call) => call.args.includes("TARGETS") ? Buffer.from("image/png\n") : Buffer.from(BMP) });
+	assert.equal(await readClipboardImage({ env: {}, platform: "linux", run: bmp.run, native: () => undefined, procVersion: noProc }), null);
+	const termux = runner({});
+	assert.equal(await readClipboardImage({ env: { TERMUX_VERSION: "0.118" }, platform: "linux", run: termux.run, procVersion: noProc }), null);
+	assert.equal(termux.calls.length, 0);
+});
+
+test("macOS reads the native clipboard but leaves copied files to Pi", async () => {
+	const native = (files: string[] | null) => () => ({
+		getText: async () => null,
+		getImage: async () => PNG_2X1,
+		getFilePaths: async () => files,
+	});
+	const image = await readClipboardImage({ env: {}, platform: "darwin", native: native(null) });
+	assert.equal(image?.mimeType, "image/png");
+	assert.equal(await readClipboardImage({ env: {}, platform: "darwin", native: native(["/Users/me/shot.png"]) }), null);
+	assert.equal(await readClipboardImage({ env: {}, platform: "win32", native: () => undefined }), null);
+});
+
+test("a failed wl-paste read falls through to xclip, as Pi does", async () => {
+	const { run, calls } = runner({
+		"wl-paste --list-types": Buffer.from("image/png\n"),
+		"xclip -selection": (call) => call.args.includes("TARGETS") ? Buffer.from("image/png\n") : Buffer.from(PNG_2X1),
+	});
+	const image = await readClipboardImage({ env: { WAYLAND_DISPLAY: "wayland-0" }, platform: "linux", run, native: () => undefined, procVersion: noProc });
+	assert.equal(image?.mimeType, "image/png");
+	assert.deepEqual(calls.map((call) => call.command), ["wl-paste", "wl-paste", "xclip", "xclip"]);
+});
+
+test("files copied in a Linux file manager stay Pi's even when an image is offered too", async () => {
+	const { run, calls } = runner({ "wl-paste --list-types": Buffer.from("image/png\ntext/uri-list\n") });
+	const native = () => ({ getText: async () => null, getImage: async () => PNG_2X1, getFilePaths: async () => ["/home/me/shot.png"] });
+	assert.equal(await readClipboardImage({ env: { WAYLAND_DISPLAY: "wayland-0" }, platform: "linux", run, native, procVersion: noProc }), null);
+	assert.equal(calls.length, 0);
+});
+
+test("image formats are identified by signature", () => {
+	assert.equal(sniffImageMimeType(PNG_2X1), "image/png");
+	assert.equal(sniffImageMimeType(new Uint8Array([0xff, 0xd8, 0xff, 0xe0])), "image/jpeg");
+	assert.equal(sniffImageMimeType(new Uint8Array([0x47, 0x49, 0x46, 0x38, 0x39, 0x61])), "image/gif");
+	assert.equal(sniffImageMimeType(new Uint8Array([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x45, 0x42, 0x50])), "image/webp");
+	assert.equal(sniffImageMimeType(BMP), undefined);
+});
+
+test("WSL is detected from its environment or the kernel version", () => {
+	assert.equal(isWsl({ WSL_DISTRO_NAME: "Ubuntu" }, noProc), true);
+	assert.equal(isWsl({}, () => "Linux version 6.6.87.2-microsoft-standard-WSL2"), true);
+	assert.equal(isWsl({}, () => "Linux version 6.8.0-generic"), false);
+});

package/tests/command-palette.test.ts

@@ -374,7 +374,7 @@ test("COMMAND_PALETTE_CATALOG matches the curated command set, in order", () =>
 		"gentle:telemetry",
 		"gentle:dev-binary",
 	]);
-	assert.deepEqual(byTitle("Session"), ["gentle:yolo", "gentle:changes", "gentle:agents", "gentle:jobs", "gentle:usage", "gentle:review-session-permission"]);
+	assert.deepEqual(byTitle("Session"), ["gentle:yolo", "gentle:changes", "gentle:agents", "gentle:jobs", "gentle:usage", "gentle:review-session-permission", "gentle:voice", "gentle:design"]);
 	assert.deepEqual(byTitle("Diagnostics"), ["gentle:status", "gentle:doctor"]);
 	assert.equal(byTitle("SDD"), undefined);
 	assert.deepEqual(byTitle("Skills"), ["skill-registry:refresh"]);

package/tests/context-backstop.test.ts

@@ -11,6 +11,8 @@ import {
 	CONTEXT_BACKSTOP_TOKENS_ENV,
 	contextBackstopReached,
 	contextBackstopThreshold,
+	createThrottledContextMeasure,
+	type MeasuredContext,
 } from "../lib/context-backstop.ts";
 
 // Harness roadmap R1: the parent-context backstop was a fixed "~150k tokens" in prompt text, so the model had to
@@ -63,7 +65,7 @@ test("unknown tokens never count as reaching the backstop", () => {
 type Handler = (event: unknown, ctx: ExtensionContext) => unknown;
 type Patch = { content?: Array<{ type: string; text?: string }>; structuredContent?: unknown; isError?: boolean } | undefined;
 
-function session(t: TestContext, child: boolean) {
+function session(t: TestContext, child: boolean, options: { now?: () => number; minIntervalMs?: number } = {}) {
 	const cwd = realpathSync(mkdtempSync(join(tmpdir(), "context-backstop-")));
 	const configHome = mkdtempSync(join(tmpdir(), "context-backstop-config-"));
 	const previous = process.env.GENTLE_PI_CONFIG_HOME;
@@ -76,10 +78,19 @@ function session(t: TestContext, child: boolean) {
 	});
 	const handlers = new Map<string, Handler>();
 	const pi = { on: (name: string, handler: Handler) => { handlers.set(name, handler); }, events: { on() {}, emit() {} }, registerCommand() {}, registerTool() {} } as unknown as ExtensionAPI;
-	createGentleAiExtension({ nativeReviewCli: null, processEnv: { GENTLE_PI_AGENTS_CHILD: child ? "1" : "0", GENTLE_AI_TELEMETRY: "0" } })(pi);
+	// Semantic tests without options keep per-call measuring (minIntervalMs 0); callers that pass
+	// options (a fake clock) keep the production window resolution.
+	const measureOptions = Object.keys(options).length === 0 ? { minIntervalMs: 0 } : options;
+	createGentleAiExtension({
+		nativeReviewCli: null,
+		processEnv: { GENTLE_PI_AGENTS_CHILD: child ? "1" : "0", GENTLE_AI_TELEMETRY: "0" },
+		contextBackstopMeasure: measureOptions,
+	})(pi);
 	let usage: ContextUsage | undefined = { tokens: 10_000, contextWindow: 1_000_000, percent: 1 };
+	let measures = 0;
 	const sessionManager = { getSessionId: () => "session-backstop", getCwd: () => cwd, getEntries: () => [], getBranch: () => [] };
-	const ctx = { cwd, hasUI: false, ui: { notify() {} }, sessionManager, getContextUsage: () => usage } as unknown as ExtensionContext;
+	const ctx = { cwd, hasUI: false, ui: { notify() {} }, sessionManager, getContextUsage: () => { measures++; return usage; } } as unknown as ExtensionContext;
+	const measureCount = () => measures;
 	const setTokens = (tokens: number | null, contextWindow = 1_000_000) => {
 		usage = { tokens, contextWindow, percent: tokens === null ? null : (tokens / contextWindow) * 100 };
 	};
@@ -87,7 +98,7 @@ function session(t: TestContext, child: boolean) {
 		toolName: "read", toolCallId: "call-read", isError: false, input: { path: "a.ts" },
 		content: [{ type: "text", text: "file body" }], structuredContent: { lines: 1 }, ...overrides,
 	}, ctx) as Promise<Patch>;
-	return { cwd, ctx, handlers, setTokens, read };
+	return { cwd, ctx, handlers, setTokens, read, measureCount, options };
 }
 
 test("the primary session gets one notice when its measured context first reaches the backstop", async (t) => {
@@ -157,3 +168,58 @@ test("a parent write result carries the notice after its own bookkeeping", async
 	assert.equal(result?.content?.[0]?.text, "Wrote src/a.ts");
 	assert.match(result?.content?.[1]?.text ?? "", /Context backstop/);
 });
+
+// The measurement behind the backstop (ctx.getContextUsage()) rebuilds the whole session
+// projection, so it is sampled at most once per window per session instead of once per
+// tool result. The window never decides the notice: it only decides when the context is
+// looked at again.
+test("the throttled measure samples once per window and the first sample of a session is immediate", () => {
+	let clock = 1_000;
+	const measure = createThrottledContextMeasure({ now: () => clock });
+	let calls = 0;
+	const sample = (value: MeasuredContext | undefined) => measure("session-a", () => { calls++; return value; });
+	assert.deepEqual(sample({ tokens: 10_000 }), { tokens: 10_000 }, "the first sample of a session measures immediately");
+	assert.equal(calls, 1);
+	clock = 2_000;
+	sample({ tokens: 10_000 });
+	assert.equal(calls, 1, "a sample inside the window skips the measurement");
+	clock = 6_001;
+	sample({ tokens: 10_000 });
+	assert.equal(calls, 2, "the window expired: measure again");
+	clock = 6_002;
+	sample({ tokens: 10_000 });
+	assert.equal(calls, 2, "the window restarts at every measurement");
+});
+
+test("the throttled measure is per session and a throwing measure never poisons the window", () => {
+	let clock = 0;
+	const measure = createThrottledContextMeasure({ now: () => clock });
+	assert.ok(measure("session-a", () => ({ tokens: 1 })), "session a measures");
+	assert.ok(measure("session-b", () => ({ tokens: 2 })), "session b inside the same window still measures");
+	assert.equal(measure("session-a", () => ({ tokens: 3 })), undefined, "session a inside its own window skips");
+	clock = 5_001;
+	let boom = false;
+	assert.equal(measure("session-a", () => { boom = true; throw new Error("boom"); }), undefined, "a throwing measure returns undefined");
+	assert.equal(boom, true, "the measure itself actually ran");
+	assert.equal(measure("session-a", () => ({ tokens: 4 }))?.tokens, undefined, "the failed measurement still consumed its window");
+	clock = 10_002;
+	assert.equal(measure("session-a", () => ({ tokens: 4 }))?.tokens, 4, "the next window measures again");
+});
+
+test("the extension samples the backstop context at most once per window per session", async (t) => {
+	let clock = 0;
+	const s = session(t, false, { now: () => clock });
+	assert.equal(s.measureCount(), 0);
+	await s.read();
+	assert.equal(s.measureCount(), 1, "the first tool result measures immediately");
+	await s.read();
+	await s.read();
+	assert.equal(s.measureCount(), 1, "tool results inside the window skip the measurement");
+	clock = 5_001;
+	s.setTokens(160_000);
+	const crossed = await s.read();
+	assert.equal(s.measureCount(), 2, "the window expired: measure again");
+	assert.match(crossed?.content?.[1]?.text ?? "", /Context backstop/, "a crossing is announced on the next sampled result");
+	await s.read();
+	assert.equal(s.measureCount(), 2, "and the window restarts after that sample");
+});

package/tests/delegate-for-reason-contract.test.ts

@@ -244,9 +244,10 @@ test("T11/S4: the parent hands verify the whole spec, authorizes its probes and
 // names every line that admits it. The pin still guards against accidental drift.
 test("AC4/S4: the normative verification rule text is unchanged by the review protocol", () => {
 	const normative = sectionFrom(verification, "## Verification rule (normative)");
+	// Re-pinned on purpose: the runtime admission now also accepts a `Risk: item N` sentence (verifier-admission.ts).
 	assert.equal(
 		createHash("sha256").update(normative).digest("hex"),
-		"b159829cad24a31e23d6309b3bfe0e4cc71eec2316775ba07314fecd1fb6a63f",
+		"f052518b2905e4560d629397876057079aa71b45352272646261a611fb4a1e17",
 		"the normative Verification rule section changed",
 	);
 	assert.ok(verification.includes("or a delegated writer returns"), "the module must still load when a delegated writer returns");