v2.4.0-rc.7 — Truthful exits, exact authority

What to test

• In a root-commit repository with committed-only review scope, ask STATUS with the root commit as --base-ref. It must stop with the empty-base-diff bootstrap result before offering START; it must not create a lineage or send the operator into a preflight rejection loop (#3102).
• Create a candidate whose frozen reviewer evidence exceeds the deterministic context limit, start its review, then ask STATUS. It must terminate with lens_context_budget_exceeded, create no retry artifact or receipt mutation, and tell the operator to reduce scope or start a new review (#2773).
• Leave an immutable reviewer slot occupied, then ask for its next action. The result must say the slot is occupied and direct the operator to negotiated STATUS. It must not retry context collection or recommend disposing of or preserving the slot as a workaround (#3103).
• Start with a historical clone-local review-mode authority record and make its first exact-revision mutation. The record must migrate while preserving stale-CAS behavior, the global-off kill switch, and the legacy forensic bytes (#3061, #2831).
• On Windows, run the legacy-migration fixture and confirm the secure DACL path succeeds. This is a regression check for #3036.
• Run review status on Git installations with different merge-tree capability shapes. Capability detection must select the supported form and fail clearly when no supported form exists (#2927).

The riskiest field-unproven change is migration of a real historical legacy clone-local authority record on a tester machine. Tests, race coverage, and the Windows secure-DACL proof establish the mechanics; published field use is the measurement.

What the previous candidate taught us

v2.4.0-rc.6 taught us that green source checks were not sufficient. Exact current builds found gaps in truthful continuation, immutable-slot classification, and legacy-root handling. This candidate closes those gaps while staying within the 2.4.0 line. It does not widen the public Go API.

Truthful exits

An empty committed base diff previously reached a status path that could still offer START even though START had nothing valid to inspect. STATUS now stops at that boundary and names the bootstrap condition. An oversized immutable reviewer context likewise now ends deterministically instead of offering work that cannot complete, without consuming a retry, artifact, or receipt transition.

Exact authority

Occupied reviewer slots are classified as occupied state rather than as context failures, so the operator is routed to the negotiated status that owns the transition. Historical clone-local authority records migrate at their first exact-revision mutation, preserving their stale-CAS protection, global-off behavior, and original forensic bytes. The Windows fixture now exercises that migration through the secure DACL path.

Portable capability handling

Review status now handles the Git merge-tree capability shapes identified in #2927 rather than assuming one invocation is universally available. The candidate also carries the corresponding test and benchmark coverage for the new truthful boundaries.

Also in this candidate

The range includes hardening across review state, command-line continuations, benchmark coverage, Windows filesystem behavior, updater argument handling, runtime configuration, and TUI model selection. These are fixes and tests around existing behavior, not a claim of broader public API surface.

Install

go install github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai@v2.4.0-rc.7

Binary assets: gentle-ai_2.4.0-rc.7_linux_amd64, gentle-ai_2.4.0-rc.7_linux_arm64, gentle-ai_2.4.0-rc.7_darwin_amd64, gentle-ai_2.4.0-rc.7_darwin_arm64, and gentle-ai_2.4.0-rc.7_windows_amd64.exe; verify the selected binary with SHA256SUMS.txt.