What to test

Start with the paths this candidate fixed against written reproductions rather than real use:

• Recover a review after a rebase. Approve a review, commit the candidate, rebase it across an unrelated parent advance, and follow exactly what negotiated STATUS tells you. STATUS with an explicit lineage that owns no authority now advertises the decision START will actually make instead of a fresh start that START then reinterprets. The staged-predecessor RECOVER leg of the same report is pinned by a guarded property test but was not reproducible on main; if you can make STATUS render a RECOVER that its own preflight refuses, that transcript is the most valuable thing you can send.
• Correction-only delivery after a post-merge review. Review an already-merged candidate, let it find a real defect, apply the one bounded correction, and publish only the correction as a PR over the merged base. pre-pr now recognizes that receipt-derived projection; any other base or an unreviewed commit on top must still deny.
• OpenCode background subagents. On OpenCode 1.15.11 or newer, enable --opencode-background-subagents=on at install or sync, restart through the managed launcher, and watch that only independent read-only work runs in the background while writers, RDD actors, and Judgment Day stay foreground. Turning it off must remove only Gentle-owned launchers.
• The provider contract bundle. This candidate ships gentle-ai-review-provider-contract-1.0.0.tar.gz as a release asset. Verify it from the tagged source with go run ./internal/providercontractbundlecmd verify --archive <bundle> and inspect its inventory with tar -tzf <bundle>.
• Windows, all of it. This candidate is the first whose full review-transaction surface actually executed on Windows before shipping. If you run Windows, ordinary negotiated reviews, captures, and finalizes are the test.

The one change whose argument is verified in tests and unproven in the field: the unified provider transport. Every reviewer, refuter, and validator invocation now crosses one generic Go boundary with immutable role slots — exercised end to end in CI against real OpenCode, and never yet by a fleet of real operators. Finding a provider flow it mishandles is the most useful thing this candidate can learn.

A known risk ships unresolved and named: under full-shard Windows load, the authority-lock waiter can time out a healthy queue of slow publishers (#3239). The fix exists, is property-tested on Linux, and is deliberately held out of this candidate until its own Windows execution is clean.

What rc.7 taught us

rc.7's field reports were convergence reports: STATUS advertising transitions that RECOVER and START then refused or reinterpreted, and a Windows suite that had never actually executed the surfaces it claimed to cover. This candidate stays within the same line as rc.7 — no public Go API change, fail-closed admission everywhere — and spends its weight making the advertised transition and the executed transition the same decision, and making Windows execution real instead of assumed.

One provider transport under the Go contract

Provider reviewer, refuter, and validator invocations ran through per-client shims that each interpreted the contract on their own. They now route through one generic invocation boundary with provider roles persisted in immutable slots, conformance hardened at admission, and the review provider contract published as a versioned release asset (1.0.0) that downstream clients verify instead of re-deriving.

Durable effects and the repository context that survives processes

A committed repository-context event used to live only as long as the process that created it. The compact authority now records effect intents at START, publishes durable markers with monotonic states, and reconciles the committed context across fresh STATUS, START, and recovery processes — replaying idempotently instead of re-deriving. The record revision stays a pure function of state, so every existing re-deriver keeps verifying lineages that carry intents.

STATUS, START, and RECOVER answer from one decision

An explicit lineage that owned no authority made STATUS classify the live target as fresh while START's discovery resolved the byte-identical approved authority and answered reuse-receipt on another lineage. The classification now falls back to unrestricted discovery when the requested lineage owns nothing, so the rendered transition replays against the same decision. The correction-only publication over an already-merged candidate — approved by the receipt, denied by the gate since v2.2.2 — is now recognized as the one receipt-derived pair it is, with everything else still denied.

Windows execution became real

Six review-transaction surfaces reached main having only ever compiled on Windows: fixtures faked the runtime POSIX-only, asserted permissions Windows cannot represent, read locator artifacts with the strict private-RAR bar, and resolved $HOME where Windows resolves %USERPROFILE%. All are fixed, the RAR effects family now executes in the PR-side Windows Runtime job before merge, and the diagnostics run that proved the production engines correct on Windows is part of the record. The one Windows red left standing is the load-dependent authority-lock contention, tracked and named rather than papered over.

Managed background subagents for OpenCode

OpenCode gains an auto|on|off background-subagent policy across install, sync, environment, and TUI, delivered through a Gentle-owned launcher with an ownership marker, a reversible activation transaction, and rollback that participates in the install pipeline's compensation. The orchestrator addendum keeps dependency-bearing, decision-bearing, and review-bearing work foreground, and degrades to foreground wherever the runtime cannot prove support.

Also in this candidate

The AI contribution policy landed as documentation-only governance with proportional disclosure and no attribution to tools. Issue-creation authority collapsed to the embedded skill that discovers labels instead of promising them. The explore agent gained the read-only CodeGraph tool with the wildcard explicitly forbidden. Codex model discovery went asynchronous with a curated fallback. Persona output-style resources derive from one plan. Defect reporting routes by the installed build's evidence channel and never recommends switching channels. The journey corpus is manifest-derived, ending the counter collisions that turned main red when two green PRs met.

Numbers

589 issues open now against roughly 581 at rc.7: 19 opened and 11 closed in the interval. Inflow exceeded outflow; this candidate does not call that progress.

Install

go install github.com/gentleman-programming/gentle-ai/v2/cmd/gentle-ai@v2.4.0-rc.8

Or the platform binaries below: linux_amd64, linux_arm64, darwin_amd64, darwin_arm64, windows_amd64.exe, plus gentle-ai-review-provider-contract-1.0.0.tar.gz. SHA256SUMS.txt covers all six payload artifacts.