From 9bb5a8bee1402108fc4d2fe5a162318b7cdf2fe6 Mon Sep 17 00:00:00 2001
From: "courtmanr@gmail.com" <courtmanr@gmail.com>
Date: Sun, 26 Jul 2026 20:45:20 +0100
Subject: [PATCH] Isolate Windows native lifecycle self-test state

---
 .github/workflows/unified-agent-native.yml    |  5 ++++-
 .../v6/internal/subsystems/agent-lifecycle.md |  5 ++++-
 scripts/installtests/install_ps1_test.go      | 19 +++++++++++++++++++
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/unified-agent-native.yml b/.github/workflows/unified-agent-native.yml
index 040ad1b122..791f81c149 100644
--- a/.github/workflows/unified-agent-native.yml
+++ b/.github/workflows/unified-agent-native.yml
@@ -111,7 +111,10 @@ jobs:
         run: |
           go build -o pulse-agent-native.exe ./cmd/pulse-agent
           .\pulse-agent-native.exe --version
-          .\pulse-agent-native.exe --self-test
+          $selfTestStateDir = Join-Path $env:RUNNER_TEMP 'pulse-agent-self-test'
+          $selfTestLogFile = Join-Path $selfTestStateDir 'pulse-agent.log'
+          New-Item -ItemType Directory -Path $selfTestStateDir -Force | Out-Null
+          .\pulse-agent-native.exe --self-test --state-dir $selfTestStateDir --log-file $selfTestLogFile
           $errors = $null
           [System.Management.Automation.Language.Parser]::ParseFile(
             (Resolve-Path 'scripts/install.ps1'),
diff --git a/docs/release-control/v6/internal/subsystems/agent-lifecycle.md b/docs/release-control/v6/internal/subsystems/agent-lifecycle.md
index 5ce5035db0..f4a87b52b7 100644
--- a/docs/release-control/v6/internal/subsystems/agent-lifecycle.md
+++ b/docs/release-control/v6/internal/subsystems/agent-lifecycle.md
@@ -4956,7 +4956,10 @@ Native support evidence is governed by
 `.github/workflows/unified-agent-native.yml`. Cross-compilation and archive
 presence are build evidence only; platform support claims must name native CI,
 native installed-lifecycle, appliance-lab, and platform code-signing evidence
-separately.
+separately. The native Windows binary self-test must use runner-temporary state
+and logging paths so it cannot create the machine-global `ProgramData\Pulse`
+directory before the same job exercises the clean install, update, service
+recovery, and uninstall lifecycle.
 
 Normal release promotion requires platform-native identity for desktop agent
 binaries. macOS agents must be Developer ID signed, submitted successfully to
diff --git a/scripts/installtests/install_ps1_test.go b/scripts/installtests/install_ps1_test.go
index 668b375bac..4a8f6adffb 100644
--- a/scripts/installtests/install_ps1_test.go
+++ b/scripts/installtests/install_ps1_test.go
@@ -102,6 +102,25 @@ func TestWindowsAgentLifecycleHarnessPinsCompleteServiceProof(t *testing.T) {
 	}
 }
 
+func TestNativeWindowsSelfTestDoesNotPreseedLifecycleState(t *testing.T) {
+	content, err := os.ReadFile(repoFile(".github", "workflows", "unified-agent-native.yml"))
+	if err != nil {
+		t.Fatalf("read native agent workflow: %v", err)
+	}
+
+	workflow := string(content)
+	required := []string{
+		`$selfTestStateDir = Join-Path $env:RUNNER_TEMP 'pulse-agent-self-test'`,
+		`$selfTestLogFile = Join-Path $selfTestStateDir 'pulse-agent.log'`,
+		`--self-test --state-dir $selfTestStateDir --log-file $selfTestLogFile`,
+	}
+	for _, needle := range required {
+		if !strings.Contains(workflow, needle) {
+			t.Fatalf("native Windows self-test must keep lifecycle state isolated: %s", needle)
+		}
+	}
+}
+
 func TestInstallPS1OwnsWindowsServiceLoggingAndRecovery(t *testing.T) {
 	content, err := os.ReadFile(repoFile("scripts", "install.ps1"))
 	if err != nil {