--- coverage-probe-strict.original.ps1
+++ coverage-probe-strict.ps1
@@ -5,22 +5,30 @@
-$exe = (Resolve-Path -LiteralPath $ServerExe).Path
-$runRoot = Join-Path $taskRoot 'rest-strict'
-$storePath = Join-Path $runRoot 'store'
-New-Item -ItemType Directory -Path $runRoot,$storePath | Out-Null
-$payload = Get-Content -LiteralPath (Join-Path $PSScriptRoot 'coverage-probe.json') -Raw | ConvertFrom-Json -AsHashtable
-$testToken = 'release-coverage-probe-20260906-local-only'
-$tokenPath = Join-Path $runRoot 'synthetic-token.txt'
-[IO.File]::WriteAllText($tokenPath,$testToken)
-$listener = [Net.Sockets.TcpListener]::new([Net.IPAddress]::Loopback,0)
-$listener.Start()
-$probePort = $listener.LocalEndpoint.Port
-$listener.Stop()
-$base = "http://127.0.0.1:$probePort"
-$script:probeProcess = $null
-$script:sequence = 0
-$script:launch = 0
-$codes = @($payload.expected | ForEach-Object { $_.code })
-function Assert-Probe($condition,[string]$message) { if (-not $condition) { throw $message } }
-function Start-ProbeServer {
-    $script:launch++
-    # PowerShell startup prepends PSHOME; reset only this process before launching.
-    $env:PATH = 'C:/Windows/System32;C:/Windows;C:\Users\User\Documents\Git\ARCADIA-Studio\.local\native-865483b\extracted\ArcadiaStudio-0.2.0-preview.lifecycle-childwork.20260911-x86_64-pc-windows-gnullvm'
+$expectedExe = 'C:\Users\User\Documents\Git\ARCADIA-Studio\.local\native-repair-union-33e30c1-r2\extracted\ArcadiaStudio-0.2.0-preview.canvas-repair.20260912-x86_64-pc-windows-gnullvm\arcadia-server.exe'
+$exe = (Resolve-Path -LiteralPath $ServerExe).Path
+if ($exe -ine $expectedExe) { throw 'Unexpected package executable path' }
+if ((Get-FileHash -LiteralPath $exe -Algorithm SHA256).Hash -ne 'ABA87A5FB795DEB995029A737C2EBB9D2B44C8D274EDAA2295363B226D9AF6BE') { throw 'Server hash mismatch' }
+$dll = Join-Path (Split-Path $exe) 'libunwind.dll'
+if ((Get-FileHash -LiteralPath $dll -Algorithm SHA256).Hash -ne 'AA282FA47BB2C4E210CEA5E470CDBDCA58568F0BE0BC73E404D86AB9CD95EF6A') { throw 'Runtime hash mismatch' }
+if ((Get-FileHash -LiteralPath (Join-Path $taskRoot 'coverage-probe.json') -Algorithm SHA256).Hash -ne '88008CA881B80DAD77AD0EC25C146646E3A875E2967D8E55925906578E6AA3B3') { throw 'Fixture hash mismatch' }
+$runRoot = Join-Path $taskRoot 'rest-strict'
+$storePath = Join-Path $runRoot 'store'
+$unrelatedCwd = Join-Path $taskRoot 'unrelated-cwd'
+if ((Test-Path -LiteralPath $runRoot) -or (Test-Path -LiteralPath $unrelatedCwd)) { throw 'Refusing to overwrite an existing run or working directory' }
+New-Item -ItemType Directory -Path $runRoot,$storePath,$unrelatedCwd | Out-Null
+$payload = Get-Content -LiteralPath (Join-Path $PSScriptRoot 'coverage-probe.json') -Raw | ConvertFrom-Json -AsHashtable
+$testToken = 'release-coverage-probe-20260906-local-only'
+$tokenPath = Join-Path $runRoot 'synthetic-token.txt'
+[IO.File]::WriteAllText($tokenPath,$testToken)
+$listener = [Net.Sockets.TcpListener]::new([Net.IPAddress]::Loopback,0)
+$listener.Start()
+$probePort = $listener.LocalEndpoint.Port
+$listener.Stop()
+$base = "http://127.0.0.1:$probePort"
+$script:probeProcess = $null
+$script:sequence = 0
+$script:launch = 0
+$codes = @($payload.expected | ForEach-Object { $_.code })
+function Assert-Probe($condition,[string]$message) { if (-not $condition) { throw $message } }
+function Start-ProbeServer {
+    $script:launch++
+    # PowerShell startup prepends PSHOME; reset only this process before launching.
+    $env:PATH = 'C:/Windows/System32;C:/Windows;C:\Users\User\Documents\Git\ARCADIA-Studio\.local\native-repair-union-33e30c1-r2\extracted\ArcadiaStudio-0.2.0-preview.canvas-repair.20260912-x86_64-pc-windows-gnullvm'