[rappdw]

Summary

Integration runs inherited host features that blocked unrelated launches, rejected successful answers prefixed by terminal control sequences, and selected an OpenCode provider without the matching credential. The corrected tests also exposed a real Gemini OAuth refresh failure: its private credential copy was mounted read-only.

• Isolate integration SANDY_HOME using the existing build-cache seeding helper. Discover credentials before isolation, preserve HOME for OAuth discovery, and clean up fixture state on failure.
• Strip OSC terminal sequences as well as CSI styling before comparing answer lines. Still require exit zero and the requested answer; prompts, hidden control payloads, and failed processes cannot pass.
• Configure the OpenCode smoke project's model for an available API key, honor explicit OPENCODE_MODEL, and reference the Google key through config without writing the secret into the project.
• Allow Gemini to refresh its private ephemeral OAuth copy. Each launch gets a separate 0600 file in a 0700 directory, discarded on exit; the host credential stays unchanged and ADC remains read-only.
• Report concise launch failure causes and resolve the commit footer independently of the current scratch directory. Update credential documentation, including the overbroad claim that all personal Google OAuth accounts are unsupported.

Linked issue

Related to #21. This does not resolve Google's account/client eligibility rejection.

Checklist

• Ran both complete suites on the host. Focused host runs and the remaining known failure are detailed below; the entire integration suite is not claimed green.
• Ran test/regen-config-docs.sh --check and test/regen-template.sh --check — no drift.
• Updated SPECIFICATION.md, README.md, CLAUDE.md, and the agent guide.
• Config metadata/tier changes: not applicable; no keys added or re-tiered.
• sandy remains a single self-contained file with no new production runtime dependency.
• Focused commit branched from main.

Notes for the reviewer

Validation:

• Isolated Linux checks: 18 harness tests, 11 production contracts, and 2,889 host checks passed, with three expected host skips. Bash 3.2 portability lint, shell syntax, and diff checks passed.
• macOS host: SANDY_INTEG_ONLY=5,7,8,11 bash test/run-integration-tests.sh passed, confirming the answer-parser and OpenCode fixture fixes.
• macOS Docker host: bash test/run-tests.sh --only container passed. The new credential-free probes use production credential-loading and mount-assembly code, prove an EROFS negative control, exercise refresh writes and rename fallback for both Gemini credential filenames, and verify separate launch copies, unchanged host credentials, and cleanup.
• Regression mutations were detected for removal of state isolation/cleanup, relative-path provenance, and restoration of Gemini's read-only OAuth mount.

Remaining external failure: the host rerun of integration §10 exits 1 with Google's UNSUPPORTED_CLIENT for tierId: free-tier. The former EROFS refresh error is gone. This remains a reported OAuth failure; the test does not silently switch credentials or billing modes to pass.