test(cli): fail when the prewarm hold gives up

The bounded wait let the turn proceed after its guard expired, so a probe that
arrived late still left the count at 1 and the test passed. That proves the
probe was eventually received, not that it preceded the turn, which is the only
thing this test claims. Raised by CodeRabbit.

The expiry is now recorded and checked before the count, since the count cannot
tell the two apart.

Verified by suppressing the probe, which makes the guard expire: the assertion
fires with its own message rather than the count assertion, and the run takes
the full guard duration.

internal/agent/loop.go

@@ -1617,15 +1617,9 @@ func sandboxRestrictedShellRetryCandidate(call ToolCall, args map[string]any, re
 
 func sandboxDeniedShellResult(result tools.Result) bool {
 	if result.ExecutionOutcome != nil {
-		// Only a typed platform denial that explicitly requests unrestricted
-		// recovery may enter the legacy retry path. Narrow capability denials
-		// remain on their exact capability path.
-		denial := result.ExecutionOutcome.Denial
-		return denial != nil &&
-			denial.Source == execution.DenialSourcePlatformSandbox &&
-			denial.Capability.Kind == execution.CapabilityUnrestricted &&
-			denial.Recoverable &&
-			denial.NextAction == execution.DenialNextActionRequestApproval
+		// Typed denials must be handled by their exact capability path. Never
+		// turn a structured narrow denial into the legacy unrestricted retry.
+		return false
 	}
 	return result.Status == tools.StatusError && result.Meta[tools.SandboxLikelyDeniedMeta] == "true"
 }

internal/agent/loop_test.go

@@ -64,22 +64,6 @@ func TestTypedExecutionOutcomeOverridesLegacySandboxHeuristics(t *testing.T) {
 		t.Fatal("narrow protected-metadata denial must not become an unrestricted retry")
 	}
 
-	nonRecoverableDenial := protectedDenial
-	nonRecoverableDenial.ExecutionOutcome = &execution.Outcome{
-		State: execution.StateDenied,
-		Kind:  execution.OutcomeEnforcementDenied,
-		Denial: &execution.Denial{
-			Capability:  execution.Capability{Kind: execution.CapabilityUnrestricted, Scope: "host"},
-			Source:      execution.DenialSourcePlatformSandbox,
-			Reason:      "sandbox enforcement failed closed",
-			Recoverable: false,
-			NextAction:  execution.DenialNextActionRequestApproval,
-		},
-	}
-	if sandboxRestrictedShellRetryCandidate(call, nil, nonRecoverableDenial, options) {
-		t.Fatal("non-recoverable sandbox denial must not become an unrestricted retry")
-	}
-
 	networkDenial := protectedDenial
 	networkDenial.ExecutionOutcome = &execution.Outcome{
 		State: execution.StateDenied,
@@ -304,18 +288,6 @@ func (tool *sandboxDeniedRetryTool) Run(_ context.Context, args map[string]any)
 	return tools.Result{
 		Status: tools.StatusError,
 		Output: "touch: cannot touch '/home/user/.npm/cache': Read-only file system",
-		ExecutionOutcome: &execution.Outcome{
-			State: execution.StateDenied,
-			Kind:  execution.OutcomeEnforcementDenied,
-			Exit:  &execution.Exit{Code: 1},
-			Denial: &execution.Denial{
-				Capability:  execution.Capability{Kind: execution.CapabilityUnrestricted, Scope: "host"},
-				Source:      execution.DenialSourcePlatformSandbox,
-				Reason:      "sandbox blocked command execution",
-				Recoverable: true,
-				NextAction:  execution.DenialNextActionRequestApproval,
-			},
-		},
 		Meta: map[string]string{
 			"exit_code":                    "1",
 			tools.SandboxLikelyDeniedMeta:  "true",

internal/cli/exec_turn_session_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -24,12 +25,47 @@ func TestRunExecOptimizedSessionUnderGate(t *testing.T) {
 	cwd := t.TempDir()
 
 	var heads, posts atomic.Int64
+	// Closed when the prewarm probe lands, so the turn can be held open until it
+	// does. See the POST handler for why that ordering has to be forced.
+	headSeen := make(chan struct{})
+	var headOnce sync.Once
+	var prewarmWaitTimedOut atomic.Bool
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch {
 		case r.Method == http.MethodHead:
 			heads.Add(1)
+			headOnce.Do(func() { close(headSeen) })
 			w.WriteHeader(http.StatusMethodNotAllowed)
 		case r.Method == http.MethodPost && strings.HasSuffix(r.URL.Path, "/chat/completions"):
+			// Hold the turn open until the prewarm probe arrives. The probe is
+			// issued on the run's context, and runExec cancels that context the
+			// moment it returns, because the stop function signalContext hands
+			// back is a CancelFunc. A probe that has not reached the wire by the
+			// end of the run therefore never reaches it at all. That is why the
+			// poll this replaced could not work at any deadline: once the run is
+			// over the probe is cancelled, not merely slow.
+			//
+			// This widens the window, it does not close it. Once the goroutine is
+			// scheduled it still has only prewarmTimeout to dial loopback and
+			// write the request, and that timeout is armed inside the goroutine
+			// itself, so holding the turn here cannot extend it. If this test
+			// ever fails again, prewarmTimeout is where to look, not this hold.
+			//
+			// No self-deadlock: the pinned transport leaves MaxConnsPerHost at 0,
+			// so the HEAD dials its own connection instead of queueing behind
+			// this held POST. Do not set a per-host connection limit there.
+			//
+			// Bounded, so a probe that genuinely never fires fails the assertion
+			// below with a useful message instead of hanging the test.
+			select {
+			case <-headSeen:
+			case <-time.After(10 * time.Second):
+				// Record it. A probe that shows up after this gave up would still
+				// leave heads at 1, so the count alone proves the probe was
+				// eventually received, not that it was ordered before the turn,
+				// which is the whole claim of this test.
+				prewarmWaitTimedOut.Store(true)
+			}
 			posts.Add(1)
 			w.Header().Set("Content-Type", "text/event-stream")
 			_, _ = w.Write([]byte("data: {\"choices\":[{\"delta\":{\"content\":\"done\"}}]}\n\n"))
@@ -75,14 +111,13 @@ func TestRunExecOptimizedSessionUnderGate(t *testing.T) {
 	if got := posts.Load(); got < 1 {
 		t.Fatalf("server saw %d chat-completions POSTs, want >= 1", got)
 	}
-	// The prewarm probe is asynchronous; it fires well before the model turn
-	// finishes, but poll rather than assuming scheduling order. The deadline
-	// exceeds the production prewarmTimeout (3s) so a slow probe cannot flake
-	// this assertion.
-	deadline := time.Now().Add(5 * time.Second)
-	for heads.Load() == 0 && time.Now().Before(deadline) {
-		time.Sleep(10 * time.Millisecond)
+	// Checked before the count, because the count cannot tell the two apart: a
+	// probe that arrived only after the guard expired still leaves heads at 1.
+	if prewarmWaitTimedOut.Load() {
+		t.Fatal("the turn was not held until the prewarm probe arrived; the probe did not precede it")
 	}
+	// No polling: the turn above could not complete until the probe landed, so
+	// the count is settled by this point.
 	if got := heads.Load(); got != 1 {
 		t.Fatalf("server saw %d prewarm HEAD probes, want exactly 1", got)
 	}

internal/config/command_test.go

@@ -151,6 +151,33 @@ func TestLoadProviderCommandTerminatesBackgroundChildOnFailure(t *testing.T) {
 	assertProcessTerminated(t, pidFile)
 }
 
+func TestAssertProcessTerminatedWaitsForDelayedPIDFile(t *testing.T) {
+	pidFile := filepath.Join(t.TempDir(), "delayed.pid")
+	firstMissing := make(chan struct{})
+	writeDone := make(chan error, 1)
+	go func() {
+		<-firstMissing
+		tempFile := pidFile + ".tmp"
+		if err := os.WriteFile(tempFile, []byte("2147483647\n"), 0o600); err != nil {
+			writeDone <- err
+			return
+		}
+		writeDone <- os.Rename(tempFile, pidFile)
+	}()
+
+	missingObserved := false
+	assertProcessTerminatedAfterMissing(t, pidFile, func() {
+		missingObserved = true
+		close(firstMissing)
+	})
+	if !missingObserved {
+		t.Fatal("PID file existed before the missing-file polling path was exercised")
+	}
+	if err := <-writeDone; err != nil {
+		t.Fatalf("write delayed pid file: %v", err)
+	}
+}
+
 func assertProcessTerminatedIfStarted(t *testing.T, pidFile string) {
 	t.Helper()
 
@@ -167,16 +194,41 @@ func assertProcessTerminatedIfStarted(t *testing.T, pidFile string) {
 func assertProcessTerminated(t *testing.T, pidFile string) {
 	t.Helper()
 
-	data, err := os.ReadFile(pidFile)
+	assertProcessTerminatedAfterMissing(t, pidFile, nil)
+}
+
+func assertProcessTerminatedAfterMissing(t *testing.T, pidFile string, onMissing func()) {
+	t.Helper()
+
+	deadline := time.Now().Add(3 * time.Second)
+	var data []byte
+	var err error
+	missingObserved := false
+	for time.Now().Before(deadline) {
+		data, err = os.ReadFile(pidFile)
+		if err == nil {
+			break
+		}
+		if !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("read sleeper pid file: %v", err)
+		}
+		if !missingObserved {
+			missingObserved = true
+			if onMissing != nil {
+				onMissing()
+			}
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
 	if err != nil {
-		t.Fatalf("read sleeper pid file: %v", err)
+		t.Fatalf("read sleeper pid file before timeout: %v", err)
 	}
 	pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
 	if err != nil {
 		t.Fatalf("parse sleeper pid %q: %v", data, err)
 	}
 
-	deadline := time.Now().Add(3 * time.Second)
+	deadline = time.Now().Add(3 * time.Second)
 	for time.Now().Before(deadline) {
 		if !processAlive(pid) {
 			return

internal/sandbox/engine_test.go

@@ -2,6 +2,7 @@ package sandbox
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -485,6 +486,28 @@ func TestEngineDeniesOutOfWorkspacePaths(t *testing.T) {
 	}
 }
 
+func TestEnginePromptsForOutOfWorkspaceReadWithReadSpecificReason(t *testing.T) {
+	root := t.TempDir()
+	outside := outsideDefaultTempPath(root, "external")
+	engine := NewEngine(EngineOptions{WorkspaceRoot: root, Policy: DefaultPolicy()})
+
+	decision := engine.Evaluate(context.Background(), Request{
+		ToolName:      "list_directory",
+		SideEffect:    SideEffectRead,
+		Permission:    PermissionAllow,
+		WorkspaceRoot: root,
+		Args:          map[string]any{"path": outside},
+	})
+
+	want := fmt.Sprintf("Reading %s requires access outside the workspace.", outside)
+	if decision.Action != ActionPrompt || decision.Block == nil || !decision.Block.Recoverable {
+		t.Fatalf("outside read decision = %#v, want recoverable prompt", decision)
+	}
+	if decision.Reason != want || decision.Block.Reason != want {
+		t.Fatalf("outside read reasons = decision %q, block %q; want %q", decision.Reason, decision.Block.Reason, want)
+	}
+}
+
 func TestEnginePrecheckReportsBlocksBeforeExecution(t *testing.T) {
 	root := t.TempDir()
 	outside := outsideDefaultTempPath(root, "escape.txt")

internal/sandbox/manager_test.go

@@ -6,7 +6,6 @@ import (
 	"path/filepath"
 	"reflect"
 	"runtime"
-	"strings"
 	"testing"
 )
 
@@ -379,31 +378,7 @@ func TestCredentialDenyReadPathsIn(t *testing.T) {
 	home := t.TempDir()
 	awsDir := filepath.Join(home, ".aws")
 	gcloudDir := filepath.Join(home, ".config", "gcloud")
-	npmrc := filepath.Join(home, ".npmrc")
-	ghHosts := filepath.Join(home, ".config", "gh", "hosts.yml")
-	netrc := filepath.Join(home, ".netrc")
-	dockerConfig := filepath.Join(home, ".docker", "config.json")
-	kubeConfig := filepath.Join(home, ".kube", "config")
-	zeroConfig := filepath.Join(home, ".config", "zero")
-	if err := mkdirAll(
-		awsDir,
-		gcloudDir,
-		filepath.Dir(ghHosts),
-		filepath.Dir(dockerConfig),
-		filepath.Dir(kubeConfig),
-		filepath.Dir(zeroConfig),
-	); err != nil {
-		t.Fatal(err)
-	}
-	for _, path := range []string{npmrc, ghHosts, netrc, dockerConfig, kubeConfig, zeroConfig} {
-		if path == zeroConfig {
-			continue
-		}
-		if err := os.WriteFile(path, []byte("{}"), 0o600); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := os.MkdirAll(zeroConfig, 0o755); err != nil {
+	if err := mkdirAll(awsDir, gcloudDir); err != nil {
 		t.Fatal(err)
 	}
 	keyFile := filepath.Join(home, "sa-key.json")
@@ -412,17 +387,7 @@ func TestCredentialDenyReadPathsIn(t *testing.T) {
 	}
 
 	paths := credentialDenyReadPathsIn(home, keyFile, nil)
-	for _, want := range normalizeProfilePaths([]string{
-		awsDir,
-		gcloudDir,
-		keyFile,
-		npmrc,
-		ghHosts,
-		netrc,
-		dockerConfig,
-		kubeConfig,
-		zeroConfig,
-	}) {
+	for _, want := range normalizeProfilePaths([]string{awsDir, gcloudDir, keyFile}) {
 		if !stringSliceContains(paths, want) {
 			t.Errorf("credential deny paths = %#v, want %q included", paths, want)
 		}
@@ -453,58 +418,3 @@ func TestCredentialDenyReadPathsIn(t *testing.T) {
 		t.Errorf("credential deny paths without home = %#v, want key file included", homeless)
 	}
 }
-
-func TestCredentialDenyReadPathsForEnvironmentHonorsConfigOverrides(t *testing.T) {
-	root := t.TempDir()
-	configHome := filepath.Join(root, "xdg")
-	npmrc := filepath.Join(root, "npm", "userconfig")
-	ghConfigDir := filepath.Join(root, "gh")
-	cloudSDKConfig := filepath.Join(root, "gcloud")
-	netrc := filepath.Join(root, "netrc")
-	dockerConfigDir := filepath.Join(root, "docker")
-	kubeConfigA := filepath.Join(root, "kube", "a")
-	kubeConfigB := filepath.Join(root, "kube", "b")
-	zeroConfig := filepath.Join(configHome, "zero")
-	filePaths := []string{
-		npmrc,
-		filepath.Join(ghConfigDir, "hosts.yml"),
-		netrc,
-		filepath.Join(dockerConfigDir, "config.json"),
-		kubeConfigA,
-		kubeConfigB,
-		zeroConfig,
-	}
-	if err := os.MkdirAll(cloudSDKConfig, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	for _, path := range filePaths {
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatal(err)
-		}
-		if path == zeroConfig {
-			if err := os.MkdirAll(path, 0o755); err != nil {
-				t.Fatal(err)
-			}
-			continue
-		}
-		if err := os.WriteFile(path, []byte("{}"), 0o600); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	got := credentialDenyReadPathsForEnvironment(credentialPathEnvironment{
-		ConfigHome:      configHome,
-		CloudSDKConfig:  cloudSDKConfig,
-		NPMUserConfig:   npmrc,
-		GHConfigDir:     ghConfigDir,
-		Netrc:           netrc,
-		DockerConfigDir: dockerConfigDir,
-		KubeConfig:      strings.Join([]string{kubeConfigA, kubeConfigB}, string(filepath.ListSeparator)),
-	}, nil)
-	wantPaths := append(filePaths, cloudSDKConfig)
-	for _, want := range normalizeProfilePaths(wantPaths) {
-		if !stringSliceContains(got, want) {
-			t.Errorf("credential deny paths = %#v, want override %q included", got, want)
-		}
-	}
-}

internal/sandbox/profile.go

@@ -145,10 +145,9 @@ func permissionProfileReadRoots(workspaceRoot string, policy Policy, scope *Scop
 }
 
 // credentialDenyReadPaths returns default deny-read entries for well-known
-// credential stores so sandboxed commands cannot read secrets under the
-// read-all workspace posture. This includes tool configuration files that can
-// carry credentials and are now discoverable through the preserved caller
-// environment. Two deliberate limits:
+// credential stores (~/.aws, ~/.config/gcloud, ~/.azure, and the file
+// GOOGLE_APPLICATION_CREDENTIALS points to) so sandboxed commands cannot read
+// cloud secrets under the read-all workspace posture. Two deliberate limits:
 //
 //   - Windows is skipped: a non-empty profile DenyRead switches the Windows
 //     runner onto the capability-SID/ACL deny path and away from the
@@ -167,100 +166,23 @@ func credentialDenyReadPaths(policy Policy) []string {
 	// A failed home lookup only drops the home-based candidates; the
 	// GOOGLE_APPLICATION_CREDENTIALS target must be protected regardless.
 	home, _ := os.UserHomeDir()
-	return credentialDenyReadPathsForEnvironment(credentialPathEnvironment{
-		Home:              home,
-		ConfigHome:        os.Getenv("XDG_CONFIG_HOME"),
-		CloudSDKConfig:    os.Getenv("CLOUDSDK_CONFIG"),
-		GoogleCredentials: os.Getenv("GOOGLE_APPLICATION_CREDENTIALS"),
-		NPMUserConfig:     firstNonEmpty(os.Getenv("NPM_CONFIG_USERCONFIG"), os.Getenv("npm_config_userconfig")),
-		GHConfigDir:       os.Getenv("GH_CONFIG_DIR"),
-		Netrc:             os.Getenv("NETRC"),
-		DockerConfigDir:   os.Getenv("DOCKER_CONFIG"),
-		KubeConfig:        os.Getenv("KUBECONFIG"),
-	}, policy.AllowRead)
+	return credentialDenyReadPathsIn(home, os.Getenv("GOOGLE_APPLICATION_CREDENTIALS"), policy.AllowRead)
 }
 
 // credentialDenyReadPathsIn is the pure core of credentialDenyReadPaths,
 // separated so tests can exercise it against a synthetic home directory.
 func credentialDenyReadPathsIn(home string, googleCredentials string, allowRead []string) []string {
-	return credentialDenyReadPathsForEnvironment(credentialPathEnvironment{
-		Home:              home,
-		GoogleCredentials: googleCredentials,
-	}, allowRead)
-}
-
-type credentialPathEnvironment struct {
-	Home              string
-	ConfigHome        string
-	CloudSDKConfig    string
-	GoogleCredentials string
-	NPMUserConfig     string
-	GHConfigDir       string
-	Netrc             string
-	DockerConfigDir   string
-	KubeConfig        string
-}
-
-func credentialDenyReadPathsForEnvironment(env credentialPathEnvironment, allowRead []string) []string {
 	var candidates []string
-	home := strings.TrimSpace(env.Home)
-	configHome := strings.TrimSpace(env.ConfigHome)
-	if configHome == "" && home != "" {
-		configHome = filepath.Join(home, ".config")
-	}
-	if home != "" {
+	if home = strings.TrimSpace(home); home != "" {
 		candidates = append(candidates,
 			filepath.Join(home, ".aws"),
+			filepath.Join(home, ".config", "gcloud"),
 			filepath.Join(home, ".azure"),
 		)
 	}
-	npmUserConfig := strings.TrimSpace(env.NPMUserConfig)
-	if npmUserConfig == "" && home != "" {
-		npmUserConfig = filepath.Join(home, ".npmrc")
-	}
-	netrc := strings.TrimSpace(env.Netrc)
-	if netrc == "" && home != "" {
-		netrc = filepath.Join(home, ".netrc")
-	}
-	dockerConfigDir := strings.TrimSpace(env.DockerConfigDir)
-	if dockerConfigDir == "" && home != "" {
-		dockerConfigDir = filepath.Join(home, ".docker")
-	}
-	candidates = append(candidates, npmUserConfig, netrc)
-	if dockerConfigDir != "" {
-		candidates = append(candidates, filepath.Join(dockerConfigDir, "config.json"))
-	}
-	if configHome != "" {
-		candidates = append(candidates,
-			filepath.Join(configHome, "zero"),
-		)
-	}
-	cloudSDKConfig := strings.TrimSpace(env.CloudSDKConfig)
-	if cloudSDKConfig == "" && configHome != "" {
-		cloudSDKConfig = filepath.Join(configHome, "gcloud")
-	}
-	if cloudSDKConfig != "" {
-		candidates = append(candidates, cloudSDKConfig)
-	}
-	ghConfigDir := strings.TrimSpace(env.GHConfigDir)
-	if ghConfigDir == "" && configHome != "" {
-		ghConfigDir = filepath.Join(configHome, "gh")
-	}
-	if ghConfigDir != "" {
-		candidates = append(candidates, filepath.Join(ghConfigDir, "hosts.yml"))
-	}
-	if target := strings.TrimSpace(env.GoogleCredentials); target != "" {
+	if target := strings.TrimSpace(googleCredentials); target != "" {
 		candidates = append(candidates, target)
 	}
-	kubeConfig := strings.TrimSpace(env.KubeConfig)
-	if kubeConfig == "" && home != "" {
-		kubeConfig = filepath.Join(home, ".kube", "config")
-	}
-	for _, path := range filepath.SplitList(kubeConfig) {
-		if path = strings.TrimSpace(path); path != "" {
-			candidates = append(candidates, path)
-		}
-	}
 	allowRoots := normalizeProfilePaths(allowRead)
 	out := make([]string, 0, len(candidates))
 	for _, path := range normalizeProfilePaths(candidates) {
@@ -284,12 +206,11 @@ func credentialDenyReadPathsForEnvironment(env credentialPathEnvironment, allowR
 
 // userGitConfigReadPaths returns the user's global git config FILES so a
 // sandboxed git can read identity and config (user.name/email, aliases) instead
-// of failing with "unable to access ~/.gitconfig". On macOS, where reads are
-// allow-listed, granting only these files avoids exposing the surrounding
-// configuration directory. Linux uses a read-all profile with explicit
-// credential deny rules. The paths are granted at the macOS seatbelt read rule
-// rather than the cross-platform PermissionProfile so HOME-dependent paths
-// don't leak into the platform-agnostic policy snapshot.
+// of failing with "unable to access ~/.gitconfig". It is deliberately the config
+// files only — not the ~/.config/git directory, which can hold an XDG credential
+// store — so credentials and the rest of HOME stay unreadable. Granted at the
+// macOS-seatbelt read rule (not the cross-platform PermissionProfile) so the
+// HOME-dependent paths don't leak into the platform-agnostic policy snapshot.
 func userGitConfigReadPaths() []string {
 	home, err := os.UserHomeDir()
 	if err != nil || strings.TrimSpace(home) == "" {

internal/sandbox/runtime_state.go

@@ -27,10 +27,13 @@ var fallbackSandboxRuntimes = struct {
 }{roots: make(map[string]string)}
 
 type SandboxRuntime struct {
-	Root  string `json:"root,omitempty"`
-	Cache string `json:"cache,omitempty"`
-	Data  string `json:"data,omitempty"`
-	Temp  string `json:"temp,omitempty"`
+	Root   string `json:"root,omitempty"`
+	Home   string `json:"home,omitempty"`
+	Cache  string `json:"cache,omitempty"`
+	Config string `json:"config,omitempty"`
+	Data   string `json:"data,omitempty"`
+	State  string `json:"state,omitempty"`
+	Temp   string `json:"temp,omitempty"`
 }
 
 func prepareSandboxRuntime(workspaceRoot string) (SandboxRuntime, func(), error) {
@@ -72,15 +75,21 @@ func prepareSandboxRuntime(workspaceRoot string) (SandboxRuntime, func(), error)
 		}
 	}()
 	runtimeState := SandboxRuntime{
-		Root:  root,
-		Cache: filepath.Join(root, "cache"),
-		Data:  filepath.Join(root, "data"),
-		Temp:  filepath.Join(root, "tmp"),
+		Root:   root,
+		Home:   filepath.Join(root, "home"),
+		Cache:  filepath.Join(root, "cache"),
+		Config: filepath.Join(root, "config"),
+		Data:   filepath.Join(root, "data"),
+		State:  filepath.Join(root, "state"),
+		Temp:   filepath.Join(root, "tmp"),
 	}
 	directories := []string{
 		runtimeState.Root,
+		runtimeState.Home,
 		runtimeState.Cache,
+		runtimeState.Config,
 		runtimeState.Data,
+		runtimeState.State,
 		runtimeState.Temp,
 		filepath.Join(runtimeState.Cache, "npm"),
 		filepath.Join(runtimeState.Cache, "yarn"),
@@ -198,11 +207,16 @@ func sandboxRuntimeEnvironment(env []string, runtimeState *SandboxRuntime) []str
 		return env
 	}
 	overrides := []string{
+		"HOME=" + runtimeState.Home,
 		"XDG_CACHE_HOME=" + runtimeState.Cache,
+		"XDG_CONFIG_HOME=" + runtimeState.Config,
+		"XDG_DATA_HOME=" + runtimeState.Data,
+		"XDG_STATE_HOME=" + runtimeState.State,
 		"TMPDIR=" + runtimeState.Temp,
 		"TMP=" + runtimeState.Temp,
 		"TEMP=" + runtimeState.Temp,
 		"npm_config_cache=" + filepath.Join(runtimeState.Cache, "npm"),
+		"NPM_CONFIG_USERCONFIG=" + filepath.Join(runtimeState.Config, "npmrc"),
 		"YARN_CACHE_FOLDER=" + filepath.Join(runtimeState.Cache, "yarn"),
 		"COREPACK_HOME=" + filepath.Join(runtimeState.Cache, "corepack"),
 		"PIP_CACHE_DIR=" + filepath.Join(runtimeState.Cache, "pip"),

internal/sandbox/runtime_state_test.go

@@ -2,9 +2,7 @@ package sandbox
 
 import (
 	"os"
-	"os/exec"
 	"path/filepath"
-	"strings"
 	"testing"
 	"time"
 )
@@ -24,18 +22,12 @@ func TestPrepareSandboxRuntimeStaysOutsideWorkspace(t *testing.T) {
 	if pathWithinRoot(workspace, runtimeState.Root) {
 		t.Fatalf("runtime root %q must stay outside workspace %q", runtimeState.Root, workspace)
 	}
-	for _, path := range []string{runtimeState.Cache, runtimeState.Data, runtimeState.Temp, filepath.Join(runtimeState.Data, "cargo")} {
+	for _, path := range []string{runtimeState.Home, runtimeState.Cache, runtimeState.Config, runtimeState.Data, runtimeState.State, runtimeState.Temp} {
 		info, err := os.Stat(path)
 		if err != nil || !info.IsDir() {
 			t.Fatalf("managed runtime directory %q was not prepared: %v", path, err)
 		}
 	}
-	for _, name := range []string{"home", "config", "state"} {
-		path := filepath.Join(runtimeState.Root, name)
-		if _, err := os.Stat(path); !os.IsNotExist(err) {
-			t.Fatalf("obsolete synthetic runtime directory %q exists: %v", path, err)
-		}
-	}
 }
 
 func TestPrepareSandboxRuntimeCleansExpiredSibling(t *testing.T) {
@@ -124,63 +116,34 @@ func TestCleanupSandboxRuntimeSkipsActiveLease(t *testing.T) {
 	}
 }
 
-func TestSandboxRuntimeEnvironmentPreservesUserConfiguration(t *testing.T) {
+func TestSandboxRuntimeEnvironmentUsesManagedState(t *testing.T) {
 	root := filepath.Join(t.TempDir(), "runtime")
 	runtimeState := SandboxRuntime{
-		Root:  root,
-		Cache: filepath.Join(root, "cache"),
-		Data:  filepath.Join(root, "data"),
-		Temp:  filepath.Join(root, "tmp"),
+		Root:   root,
+		Home:   filepath.Join(root, "home"),
+		Cache:  filepath.Join(root, "cache"),
+		Config: filepath.Join(root, "config"),
+		Data:   filepath.Join(root, "data"),
+		State:  filepath.Join(root, "state"),
+		Temp:   filepath.Join(root, "tmp"),
 	}
 	env := sandboxRuntimeEnvironment([]string{
-		"HOME=/home/user",
+		"HOME=/workspace",
 		"XDG_CACHE_HOME=/host/cache",
-		"XDG_CONFIG_HOME=/home/user/.config",
-		"XDG_DATA_HOME=/home/user/.local/share",
-		"XDG_STATE_HOME=/home/user/.local/state",
-		"NPM_CONFIG_USERCONFIG=/home/user/.npmrc",
 		"PATH=/usr/bin",
 	}, &runtimeState)
 
 	for key, want := range map[string]string{
-		"HOME":                  "/home/user",
-		"XDG_CONFIG_HOME":       "/home/user/.config",
-		"XDG_DATA_HOME":         "/home/user/.local/share",
-		"XDG_STATE_HOME":        "/home/user/.local/state",
-		"NPM_CONFIG_USERCONFIG": "/home/user/.npmrc",
-	} {
-		if got := envListValue(env, key, ""); got != want {
-			t.Fatalf("%s = %q, want %q; env=%#v", key, got, want, env)
-		}
-	}
-}
-
-func TestSandboxRuntimeEnvironmentUsesManagedWritableState(t *testing.T) {
-	root := filepath.Join(t.TempDir(), "runtime")
-	runtimeState := SandboxRuntime{
-		Root:  root,
-		Cache: filepath.Join(root, "cache"),
-		Data:  filepath.Join(root, "data"),
-		Temp:  filepath.Join(root, "tmp"),
-	}
-	env := sandboxRuntimeEnvironment([]string{
-		"XDG_CACHE_HOME=/host/cache",
-		"TMPDIR=/host/tmp",
-		"PATH=/usr/bin",
-	}, &runtimeState)
-
-	for key, want := range map[string]string{
-		"XDG_CACHE_HOME":    runtimeState.Cache,
-		"TMPDIR":            runtimeState.Temp,
-		"TMP":               runtimeState.Temp,
-		"TEMP":              runtimeState.Temp,
-		"npm_config_cache":  filepath.Join(runtimeState.Cache, "npm"),
-		"YARN_CACHE_FOLDER": filepath.Join(runtimeState.Cache, "yarn"),
-		"COREPACK_HOME":     filepath.Join(runtimeState.Cache, "corepack"),
-		"PIP_CACHE_DIR":     filepath.Join(runtimeState.Cache, "pip"),
-		"GOCACHE":           filepath.Join(runtimeState.Cache, "go-build"),
-		"GOMODCACHE":        filepath.Join(runtimeState.Data, "go-mod"),
-		"CARGO_HOME":        filepath.Join(runtimeState.Data, "cargo"),
+		"HOME":                  runtimeState.Home,
+		"XDG_CACHE_HOME":        runtimeState.Cache,
+		"XDG_CONFIG_HOME":       runtimeState.Config,
+		"XDG_DATA_HOME":         runtimeState.Data,
+		"XDG_STATE_HOME":        runtimeState.State,
+		"TMPDIR":                runtimeState.Temp,
+		"npm_config_cache":      filepath.Join(runtimeState.Cache, "npm"),
+		"NPM_CONFIG_USERCONFIG": filepath.Join(runtimeState.Config, "npmrc"),
+		"YARN_CACHE_FOLDER":     filepath.Join(runtimeState.Cache, "yarn"),
+		"COREPACK_HOME":         filepath.Join(runtimeState.Cache, "corepack"),
 	} {
 		if got := envListValue(env, key, ""); got != want {
 			t.Fatalf("%s = %q, want %q; env=%#v", key, got, want, env)
@@ -191,93 +154,9 @@ func TestSandboxRuntimeEnvironmentUsesManagedWritableState(t *testing.T) {
 	}
 }
 
-func TestSandboxRuntimeEnvironmentPreservesGitGlobalIgnore(t *testing.T) {
-	git, err := exec.LookPath("git")
-	if err != nil {
-		t.Skip("git is unavailable")
-	}
-	root := t.TempDir()
-	home := filepath.Join(root, "home")
-	configHome := filepath.Join(home, ".config")
-	repository := filepath.Join(root, "repository")
-	runtimeRoot := filepath.Join(root, "runtime")
-	for _, directory := range []string{
-		filepath.Join(configHome, "git"),
-		repository,
-		filepath.Join(runtimeRoot, "cache"),
-		filepath.Join(runtimeRoot, "data"),
-		filepath.Join(runtimeRoot, "tmp"),
-	} {
-		if err := os.MkdirAll(directory, 0o700); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if err := os.WriteFile(filepath.Join(configHome, "git", "ignore"), []byte("ignored.txt\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(repository, "ignored.txt"), []byte("ignored\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(repository, "visible.txt"), []byte("visible\n"), 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	runtimeState := SandboxRuntime{
-		Root:  runtimeRoot,
-		Cache: filepath.Join(runtimeRoot, "cache"),
-		Data:  filepath.Join(runtimeRoot, "data"),
-		Temp:  filepath.Join(runtimeRoot, "tmp"),
-	}
-	inherited := append(os.Environ(),
-		"GIT_CONFIG_GLOBAL="+filepath.Join(root, "missing-global-config"),
-		"GIT_DIR="+filepath.Join(root, "wrong-repository"),
-		"GIT_CONFIG_COUNT=1",
-		"GIT_CONFIG_KEY_0=core.excludesFile",
-		"GIT_CONFIG_VALUE_0="+filepath.Join(root, "missing-ignore"),
-	)
-	env := sandboxRuntimeEnvironment(upsertEnvList(withoutGitEnvironmentOverrides(inherited),
-		"HOME="+home,
-		"XDG_CONFIG_HOME="+configHome,
-		"GIT_CONFIG_NOSYSTEM=1",
-		"GIT_TERMINAL_PROMPT=0",
-	), &runtimeState)
-	runGit := func(args ...string) string {
-		t.Helper()
-		command := exec.Command(git, args...)
-		command.Dir = repository
-		command.Env = env
-		output, err := command.CombinedOutput()
-		if err != nil {
-			t.Fatalf("git %s: %v\n%s", strings.Join(args, " "), err, output)
-		}
-		return string(output)
-	}
-	runGit("init", "--quiet")
-	status := runGit("status", "--short", "--untracked-files=all")
-	if strings.Contains(status, "ignored.txt") {
-		t.Fatalf("global ignore was not honored:\n%s", status)
-	}
-	if !strings.Contains(status, "visible.txt") {
-		t.Fatalf("non-ignored file is missing from status:\n%s", status)
-	}
-}
-
-func withoutGitEnvironmentOverrides(env []string) []string {
-	out := make([]string, 0, len(env))
-	for _, value := range env {
-		key, _, ok := strings.Cut(value, "=")
-		if ok && strings.HasPrefix(strings.ToUpper(key), "GIT_") {
-			continue
-		}
-		out = append(out, value)
-	}
-	return out
-}
-
 func TestEngineCommandPlanCarriesManagedRuntime(t *testing.T) {
 	workspace := t.TempDir()
 	cacheRoot := t.TempDir()
-	t.Setenv("HOME", filepath.Join(t.TempDir(), "home"))
 	original := sandboxUserCacheDir
 	sandboxUserCacheDir = func() (string, error) { return cacheRoot, nil }
 	t.Cleanup(func() { sandboxUserCacheDir = original })
@@ -310,8 +189,8 @@ func TestEngineCommandPlanCarriesManagedRuntime(t *testing.T) {
 	} else if !inUse {
 		t.Fatal("command plan runtime must be marked in use")
 	}
-	if got := envListValue(plan.Env, "HOME", ""); got != os.Getenv("HOME") {
-		t.Fatalf("HOME = %q, want caller home %q", got, os.Getenv("HOME"))
+	if got := envListValue(plan.Env, "HOME", ""); got != plan.PermissionProfile.Runtime.Home {
+		t.Fatalf("HOME = %q, want managed home %q", got, plan.PermissionProfile.Runtime.Home)
 	}
 	foundWriteRoot := false
 	for _, root := range plan.PermissionProfile.FileSystem.WriteRoots {

internal/sandbox/scope.go

@@ -203,11 +203,24 @@ func dedupeScopeRoots(roots []string) []string {
 // only on outside_workspace results. The returned block always carries
 // the caller's original requestedPath.
 func (s *Scope) validate(requestedPath string) *pathBlock {
-	return s.validateAgainstRoots(requestedPath, s.Roots())
+	return withOutsideWorkspaceAccessReason(s.validateAgainstRoots(requestedPath, s.Roots()), requestedPath, SideEffectWrite)
 }
 
 func (s *Scope) validateRead(requestedPath string) *pathBlock {
-	return s.validateAgainstRoots(requestedPath, s.ReadRoots())
+	return withOutsideWorkspaceAccessReason(s.validateAgainstRoots(requestedPath, s.ReadRoots()), requestedPath, SideEffectRead)
+}
+
+func withOutsideWorkspaceAccessReason(block *pathBlock, requestedPath string, sideEffect SideEffect) *pathBlock {
+	if block == nil || block.Code != BlockOutsideWorkspace || !strings.Contains(block.Reason, " is outside the workspace") {
+		return block
+	}
+	switch sideEffect {
+	case SideEffectRead:
+		block.Reason = fmt.Sprintf("Reading %s requires access outside the workspace.", requestedPath)
+	case SideEffectWrite, SideEffectOutOfWorkspace:
+		block.Reason = fmt.Sprintf("Writing to %s requires access outside the workspace. Use /add-dir or --add-dir to allow writes there.", requestedPath)
+	}
+	return block
 }
 
 func (s *Scope) validateAgainstRoots(requestedPath string, roots []string) *pathBlock {

internal/sandbox/scope_test.go

@@ -1,6 +1,7 @@
 package sandbox
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -279,6 +280,45 @@ func TestScopeValidateAllowsAnyRootButRelativeOnlyWorkspace(t *testing.T) {
 	}
 }
 
+func TestScopeValidateReadExplainsReadAccessOutsideWorkspace(t *testing.T) {
+	workspace := t.TempDir()
+	scope, err := NewScope(workspace, nil)
+	if err != nil {
+		t.Fatalf("NewScope: %v", err)
+	}
+
+	outside := outsideDefaultTempPath(workspace, "elsewhere.txt")
+	block := scope.validateRead(outside)
+	if block == nil {
+		t.Fatal("validateRead(outside workspace) = nil, want block")
+	}
+	want := fmt.Sprintf("Reading %s requires access outside the workspace.", outside)
+	if block.Reason != want {
+		t.Fatalf("block.Reason = %q, want %q", block.Reason, want)
+	}
+	if strings.Contains(block.Reason, "--add-dir") || strings.Contains(block.Reason, "writes") {
+		t.Fatalf("read block reason must not suggest write access: %q", block.Reason)
+	}
+}
+
+func TestScopeValidateWriteExplainsWriteAccessOutsideWorkspace(t *testing.T) {
+	workspace := t.TempDir()
+	scope, err := NewScope(workspace, nil)
+	if err != nil {
+		t.Fatalf("NewScope: %v", err)
+	}
+
+	outside := outsideDefaultTempPath(workspace, "elsewhere.txt")
+	block := scope.validate(outside)
+	if block == nil {
+		t.Fatal("validate(outside workspace) = nil, want block")
+	}
+	want := fmt.Sprintf("Writing to %s requires access outside the workspace. Use /add-dir or --add-dir to allow writes there.", outside)
+	if block.Reason != want {
+		t.Fatalf("block.Reason = %q, want %q", block.Reason, want)
+	}
+}
+
 func TestScopeValidateKeepsSymlinkTraversalProtection(t *testing.T) {
 	workspace := t.TempDir()
 	outside := outsideDefaultTempPath(workspace, "symlink-target")

internal/tools/exec_command_test.go

@@ -316,26 +316,6 @@ func TestExecCommandUsesStructuredAdapterDenial(t *testing.T) {
 	}
 }
 
-func TestExecCommandDoesNotInferNativeSandboxDenialFromOutput(t *testing.T) {
-	result := execToolResult(execToolResultInput{
-		commandText: "touch \"$HOME/probe\"",
-		output:      "touch: cannot touch '/home/user/probe': Read-only file system",
-		exited:      true,
-		exitCode:    1,
-		enforcement: execution.Enforcement{Backend: string(sandbox.BackendLinuxBwrap), Level: string(sandbox.EnforcementNative)},
-	})
-
-	if result.ExecutionOutcome == nil || result.ExecutionOutcome.State != execution.StateFailed || result.ExecutionOutcome.Kind != execution.OutcomeApplicationFailure {
-		t.Fatalf("execution outcome = %#v, want failed/application_failure", result.ExecutionOutcome)
-	}
-	if result.ExecutionOutcome.Denial != nil {
-		t.Fatalf("command output created a typed denial: %#v", result.ExecutionOutcome.Denial)
-	}
-	if result.Meta[SandboxLikelyDeniedMeta] == "true" {
-		t.Fatalf("command output created sandbox-denial metadata: %#v", result.Meta)
-	}
-}
-
 func executionRequestHasCapability(request execution.Request, kind execution.CapabilityKind, scope string) bool {
 	for _, capability := range request.Capabilities {
 		if capability.Kind == kind && (scope == "" || capability.Scope == scope) {

internal/tui/model.go

@@ -2212,7 +2212,16 @@ func (m model) updateModel(msg tea.Msg) (tea.Model, tea.Cmd) {
 			}
 			return m, nil
 		}
-		promptRow := permissionTranscriptRow(permissionEventFromRequest(msg.request))
+		promptEvent := permissionEventFromRequest(msg.request)
+		promptRow := permissionTranscriptRow(promptEvent)
+		// The focused modal owns the actionable reason while the decision is
+		// pending. Keep only structured block context in the transcript row so
+		// the same explanation is not shown immediately above the card.
+		if promptEvent.Block == nil {
+			promptRow.detail = ""
+		} else {
+			promptRow.detail = permissionBlockDetail(promptEvent)
+		}
 		promptRow.runID = msg.runID
 		m.transcript = appendTranscriptRow(m.transcript, promptRow)
 		m.pendingPermission = &pendingPermissionPrompt{
@@ -4807,6 +4816,7 @@ func (m model) beginRun(cancel context.CancelFunc) model {
 	// suppressed by a stale preference.
 	m.sidebarHidden = false
 	m.turnStartedAt = m.now()
+	m.lastStreamActivity = m.turnStartedAt
 	m.turnStreamedRunes = 0
 	m.spinnerTicking = true
 	return m

internal/tui/model_test.go

@@ -1606,6 +1606,9 @@ func TestPermissionRequestShowsFocusedPrompt(t *testing.T) {
 	if strings.Contains(view, "risk:") || strings.Contains(view, "risk=") {
 		t.Fatalf("focused permission prompt must not render risk labels, got %q", view)
 	}
+	if count := strings.Count(view, request.Reason); count != 1 {
+		t.Fatalf("focused permission reason rendered %d times, want once:\n%s", count, view)
+	}
 }
 
 func TestPermissionPromptChoicesResolveDecision(t *testing.T) {
@@ -1720,6 +1723,34 @@ func TestPermissionRowRendersSandboxBlocks(t *testing.T) {
 	}
 }
 
+func TestPermissionRowRendersIdenticalEventAndBlockReasonOnce(t *testing.T) {
+	const reason = "Reading /home/dev/.nvm requires access outside the workspace."
+	event := agent.PermissionEvent{
+		ToolCallID:     "call_read",
+		ToolName:       "list_directory",
+		Action:         agent.PermissionActionDeny,
+		DecisionAction: agent.PermissionDecisionDeny,
+		SideEffect:     "read",
+		Reason:         reason,
+		Scope:          "/home/dev/.nvm",
+		Block: &sandbox.Block{
+			Code:   sandbox.BlockOutsideWorkspace,
+			Path:   "/home/dev/.nvm",
+			Reason: reason,
+		},
+	}
+
+	row := permissionTranscriptRow(event)
+	if count := strings.Count(event.Reason+"\n"+row.detail, reason); count != 1 {
+		t.Fatalf("permission reason represented %d times, want once: detail=%q", count, row.detail)
+	}
+	for _, want := range []string{"denied by user", "outside workspace", "path: /home/dev/.nvm"} {
+		if !strings.Contains(row.detail, want) {
+			t.Fatalf("permission detail missing %q: %q", want, row.detail)
+		}
+	}
+}
+
 func TestAppendTranscriptRowDedupesRuntimeRowsByID(t *testing.T) {
 	event := agent.PermissionEvent{
 		ToolCallID: "call_1",

internal/tui/permission_prompt_test.go

@@ -126,6 +126,29 @@ func TestPermissionPromptMapsEscalatedSandboxReason(t *testing.T) {
 	}
 }
 
+func TestPermissionPromptWrapsLongReasonWithoutTruncating(t *testing.T) {
+	request := agent.PermissionRequest{
+		ToolName:   "list_directory",
+		SideEffect: "read",
+		Reason:     "Reading /home/dev/projects/a-very-long-directory-name/with/nested/configuration requires access outside the workspace.",
+		AvailableDecisions: []agent.PermissionDecisionAction{
+			agent.PermissionDecisionAllow,
+			agent.PermissionDecisionDeny,
+		},
+	}
+
+	card, _ := renderFocusedPermissionPrompt(request, 0, false, "", 60)
+	got := plainRender(t, card)
+	for _, want := range []string{"Reading", "/home/dev/projects", "requires access outside the workspace."} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("permission card truncated reason; missing %q:\n%s", want, got)
+		}
+	}
+	if strings.Contains(got, "…") {
+		t.Fatalf("permission card must wrap the decision reason instead of truncating it:\n%s", got)
+	}
+}
+
 func TestPermissionOptionsExposePersistentCommandPrefixApproval(t *testing.T) {
 	request := agent.PermissionRequest{
 		ToolName:      "bash",

internal/tui/rendering.go

@@ -1131,7 +1131,13 @@ func renderFocusedPermissionPrompt(request agent.PermissionRequest, cursor int,
 	}
 	lines := []string{top, body}
 	if reason := permissionDisplayReason(request.Reason); reason != "" {
-		lines = append(lines, fill(zeroTheme.muted).Render(reason))
+		reasonWidth := width
+		if widthTier(width) != tierTiny {
+			reasonWidth = maxInt(1, width-4)
+		}
+		for _, line := range wrapPlainText(reason, reasonWidth) {
+			lines = append(lines, fill(zeroTheme.muted).Render(line))
+		}
 	}
 	// Surface exactly what the grant covers (file/dir/host) so "always" is a
 	// clear, bounded choice rather than a blind tool-wide yes.

internal/tui/transcript.go

@@ -398,8 +398,10 @@ func permissionDetailText(event agent.PermissionEvent) string {
 	if event.GrantMatched {
 		parts = append(parts, "approved by saved permission")
 	}
-	if event.Reason != "" {
-		parts = append(parts, permissionDisplayReason(event.Reason))
+	if event.Action == agent.PermissionActionPrompt {
+		if reason := permissionDisplayReason(event.Reason); reason != "" {
+			parts = append(parts, reason)
+		}
 	}
 	if event.Block != nil {
 		parts = append(parts, permissionBlockDetail(event))
@@ -438,7 +440,9 @@ func permissionBlockDetail(event agent.PermissionEvent) string {
 	if path := strings.TrimSpace(event.Block.Path); path != "" {
 		parts = append(parts, "path: "+path)
 	}
-	if reason := permissionDisplayReason(event.Block.Reason); reason != "" {
+	reason := permissionDisplayReason(event.Block.Reason)
+	eventReason := permissionDisplayReason(event.Reason)
+	if reason != "" && reason != eventReason {
 		parts = append(parts, reason)
 	}
 	return strings.Join(parts, "  ")

internal/tui/working_status_test.go

@@ -106,6 +106,20 @@ func TestQuietGenerationHint(t *testing.T) {
 	}
 }
 
+func TestBeginRunResetsQuietGenerationClock(t *testing.T) {
+	now := time.Date(2026, 7, 24, 12, 0, 0, 0, time.UTC)
+	m := model{
+		now:                func() time.Time { return now },
+		lastStreamActivity: now.Add(-time.Minute),
+	}
+
+	m = m.beginRun(nil)
+
+	if got := m.quietGenerationHint(); got != "" {
+		t.Fatalf("new run inherited a stale quiet-generation warning: %q", got)
+	}
+}
+
 // TestQuietGenerationHintEscalatesPastHalfIdleTimeout: a heartbeating-but-
 // silent stream (chatgpt/gpt-5.x, ollama reasoning models — see
 // providerio.ErrStreamStalled) and a genuinely healthy-but-slow one look