[ss-o]

Summary

• The native test tier (test-native.yml), make bin/zunit and the image (docker/Dockerfile) installed ZUnit, and in two of them revolver and color, from repositories outside the organization. All three now build ZUnit from z-shell/zunit at bce183c, the 0.8.2 release commit CI and the image already used, and take revolver and color.zsh from z-shell/src at 9335c8c1, the revision the image already used. The Makefile previously built ZUnit from the default branch head instead (a later build whose run re-evaluates its arguments), so local make test now uses the same ZUnit as CI.
• z-shell/zunit's own v0.8.2 tag is a later tree whose run re-evaluates its arguments; with it, two suites (shell-state unload, snippets PZTM archive) fail because tests/helpers.zsh builds its command string for the old behaviour. Moving to that release needs those quotes adapted first, so this change keeps the released commit.
• bin/color and bin/revolver are no longer tracked next to the product bin/zd; both install steps overwrite them anyway. /bin/color, /bin/revolver, /bin/zunit and the install stamp are ignored.
• make test now installs the tools when the stamp bin/.tools-<zunit commit>-<src commit> is missing, not only when bin/zunit is: a checkout that ran make test before this change keeps an untracked bin/zunit after the helpers stop being tracked, and the old rule then skipped the install and ZUnit failed on the missing revolver. The pins are Makefile variables, so changing either reinstalls.
• docs/writing-tests.md links z-shell/zunit.

Closes #142

Verification

• make bin/zunit installs all three tools; the built zunit is byte-identical to the one CI and the image built before (sha256 8169b4df...), and the Dockerfile's new steps, run in an Alpine container, build the same file.
• In a copy with a stale bin/zunit and no helpers or stamp, make bin/zunit reinstalls all three and writes the stamp; a second run does nothing.
• Every tests/*.zunit with these tools, zi main b6d16ad and an isolated HOME: annexes, compat, packages, shell-state, snippets and utils pass. ice (sbin ice) and plugins (zi direnv installation) fail locally with both the previous and the new tools, from this machine's network and build environment, so they are not attributed to the change; CI is the reference for those two.
• actionlint .github/workflows/test-native.yml (1.7.12) passes with the repository's .github/actionlint.yaml; without that config it reports the pre-existing job.workflow_sha at line 64, which this change does not touch.

Known limit: deleting one of the installed tools while the stamp stays makes make test skip the install; rm -f bin/.tools-* forces a reinstall. A future SRC_COMMIT bump also needs the helper URLs updated, since z-shell/src moved them out of lib/zsh/snippets/.

Agent handoff

No handoff needed.

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on 05d5e3e

Sole-maintainer exception (ADR-0035). zd is Class 1 and Copilot is configured. A Copilot request at 2026-10-15T05:25:54Z (on 730fe67) and a new request at 05:50:25Z on this head both returned no requested reviewer; there is no Copilot review_requested event or review. The cause is unconfirmed. The maintainer declared that no second human reviewer is available and elected the sole-maintainer exception for #143 at 05d5e3e; the earlier election on 730fe67 was voided by the push. The maintainer separately approved the image publication that the merge triggers (below).

Verdict: no blocking findings. One low finding is tracked outside this pull request.

Note

This review was executed by the agent workflow that authored the change. It and the separate review below are not a second human review or proof of independent judgment.

Separate review of this head. A separate read-only reviewing session reviewed exactly 05d5e3e against the code-review checklist and approved it with one low finding: deleting one installed tool while bin/.tools-* remains makes make test skip the reinstall. Disposition: rm -f bin/.tools-* forces a reinstall (stated in the description), and per-file rules or a docs line are tracked as a follow-up. It also noted that z-shell/src moved the helpers out of lib/zsh/snippets/ after 9335c8c, so a future SRC_COMMIT bump must change the URLs in the Makefile, test-native.yml and docker/Dockerfile together.

Checklist

• Supply chain: ZUnit is built from z-shell/zunit at the full commit bce183c (the 0.8.2 release commit CI and the image already used), fetched by commit, not by tag or branch; the built zunit is byte-identical to the previous build (sha256 8169b4df...). revolver and color.zsh come from z-shell/src at the full commit 9335c8c1, the revision the image already used. No repository outside the organization remains in the test path.
• Source contracts: make test installs when the stamp for the current pins is missing, so a checkout with a stale untracked bin/zunit from before this change reinstalls the helpers instead of failing on a missing revolver. Changing either pin reinstalls. bin/zd is untouched; bin/color and bin/revolver are no longer tracked and are ignored with bin/zunit and the stamp.
• Failure paths: each download uses curl -fsSL and the recipe stops on the first failure; the stamp is written last, so an interrupted install is retried.
• Image behavior: the Dockerfile's new fetch steps, run in an Alpine container, build the same zunit. The PR run on this head built the amd64 images; arm64 legs are skipped on pull requests by design.
• Workflow: test-native.yml uses the same pins; actionlint passes with the repository config.

Checks on this head: 52 succeed, 3 skipped by design, none failing.

Verification limits. Locally the annexes, compat, packages, shell-state, snippets and utils suites pass with these tools; ice and plugins fail locally with both the previous and the new tools (local network and build environment), so CI is the reference for those two. The first arm64 build of this Dockerfile is the main run after merge.

Deployment and recovery. The merge pushes to main with a docker/** change, so docker.yml rebuilds and publishes the zsh-* and latest images from the merged commit; the maintainer approved that. A failed build pushes nothing for that leg, and the joined tags update only when both architectures succeed. That run is the build validation on the exact merged commit and will be checked. Recovery: revert the squash commit, which restores the previous Dockerfile and tracked helpers and republishes; earlier image digests remain in the registry.