diff --git a/.agents/skills/drive-pr/SKILL.md b/.agents/skills/drive-pr/SKILL.md
index d207bb11..04e6a905 100644
--- a/.agents/skills/drive-pr/SKILL.md
+++ b/.agents/skills/drive-pr/SKILL.md
@@ -251,4 +251,4 @@ instance's outcome is context for the new one, never a standing answer to reuse
   each escalate per pr-review-conduct's own list, restated there, not duplicated here.
 - A part of the review the digest prints under `UNPLACED ON THE HEAD` holds the gate until its
   outcomes are acknowledged per pr-review-conduct's Merge Gate item 4. Never guess what the new
-  wording probably meant. Only an item that cannot be told to be a finding goes to the maintainer.
+  wording probably meant. Only an item that cannot be told to be a finding or not goes to the maintainer.
diff --git a/.agents/skills/python-codestyle/references/profiles.md b/.agents/skills/python-codestyle/references/profiles.md
index 2d2f5424..ac6fe2ba 100644
--- a/.agents/skills/python-codestyle/references/profiles.md
+++ b/.agents/skills/python-codestyle/references/profiles.md
@@ -61,9 +61,9 @@ configuration alone marks the lint-only one:
   README, and CI all run the unpinned latest here. `.py` files follow the repo's LF line-ending
   default (per GOVERNANCE.md's "Line Endings" section). There is no pytest suite, and `unittest` is
   the runner instead. The directory still owes tests, written with the standard
-  library's `unittest` so they run under bare `python3` with nothing installed, as
-  `test_<script>.py` under a `tests/` directory beside the scripts it exercises and their
-  `pyproject.toml` (`<scripts-dir>/tests/`), where the validator looks for it, kept apart so a
+  library's `unittest` so they need no test runner installed. Each is a `test_<script>.py`
+  under a `tests/` directory beside the scripts it exercises and their `pyproject.toml`
+  (`<scripts-dir>/tests/`), where the validator looks for it. That directory stays apart so a
   test never reads as a tool. Within the scripts directory the name carries the kind: a gate
   that checks and exits non-zero on a finding takes a `_lint` or `_gate` suffix, and a utility
   that does work takes none. Any repo carrying Python
diff --git a/.claude-plugin/fleet-skills/.source-digests/drive-pr b/.claude-plugin/fleet-skills/.source-digests/drive-pr
index f4bceea6..4680a0c6 100644
--- a/.claude-plugin/fleet-skills/.source-digests/drive-pr
+++ b/.claude-plugin/fleet-skills/.source-digests/drive-pr
@@ -1 +1 @@
-3609c8c27e9db5e7
+0e583630d68d27b2
diff --git a/.claude-plugin/fleet-skills/.source-digests/python-codestyle b/.claude-plugin/fleet-skills/.source-digests/python-codestyle
index e9f853b0..813652a2 100644
--- a/.claude-plugin/fleet-skills/.source-digests/python-codestyle
+++ b/.claude-plugin/fleet-skills/.source-digests/python-codestyle
@@ -1 +1 @@
-d3467a4f6fb7020f
+480cb314e13d2c78
diff --git a/.claude-plugin/fleet-skills/skills/drive-pr/SKILL.md b/.claude-plugin/fleet-skills/skills/drive-pr/SKILL.md
index d207bb11..04e6a905 100644
--- a/.claude-plugin/fleet-skills/skills/drive-pr/SKILL.md
+++ b/.claude-plugin/fleet-skills/skills/drive-pr/SKILL.md
@@ -251,4 +251,4 @@ instance's outcome is context for the new one, never a standing answer to reuse
   each escalate per pr-review-conduct's own list, restated there, not duplicated here.
 - A part of the review the digest prints under `UNPLACED ON THE HEAD` holds the gate until its
   outcomes are acknowledged per pr-review-conduct's Merge Gate item 4. Never guess what the new
-  wording probably meant. Only an item that cannot be told to be a finding goes to the maintainer.
+  wording probably meant. Only an item that cannot be told to be a finding or not goes to the maintainer.
diff --git a/.claude-plugin/fleet-skills/skills/python-codestyle/references/profiles.md b/.claude-plugin/fleet-skills/skills/python-codestyle/references/profiles.md
index 2d2f5424..ac6fe2ba 100644
--- a/.claude-plugin/fleet-skills/skills/python-codestyle/references/profiles.md
+++ b/.claude-plugin/fleet-skills/skills/python-codestyle/references/profiles.md
@@ -61,9 +61,9 @@ configuration alone marks the lint-only one:
   README, and CI all run the unpinned latest here. `.py` files follow the repo's LF line-ending
   default (per GOVERNANCE.md's "Line Endings" section). There is no pytest suite, and `unittest` is
   the runner instead. The directory still owes tests, written with the standard
-  library's `unittest` so they run under bare `python3` with nothing installed, as
-  `test_<script>.py` under a `tests/` directory beside the scripts it exercises and their
-  `pyproject.toml` (`<scripts-dir>/tests/`), where the validator looks for it, kept apart so a
+  library's `unittest` so they need no test runner installed. Each is a `test_<script>.py`
+  under a `tests/` directory beside the scripts it exercises and their `pyproject.toml`
+  (`<scripts-dir>/tests/`), where the validator looks for it. That directory stays apart so a
   test never reads as a tool. Within the scripts directory the name carries the kind: a gate
   that checks and exits non-zero on a finding takes a `_lint` or `_gate` suffix, and a utility
   that does work takes none. Any repo carrying Python
diff --git a/.github/skills/drive-pr/SKILL.md b/.github/skills/drive-pr/SKILL.md
index d207bb11..04e6a905 100644
--- a/.github/skills/drive-pr/SKILL.md
+++ b/.github/skills/drive-pr/SKILL.md
@@ -251,4 +251,4 @@ instance's outcome is context for the new one, never a standing answer to reuse
   each escalate per pr-review-conduct's own list, restated there, not duplicated here.
 - A part of the review the digest prints under `UNPLACED ON THE HEAD` holds the gate until its
   outcomes are acknowledged per pr-review-conduct's Merge Gate item 4. Never guess what the new
-  wording probably meant. Only an item that cannot be told to be a finding goes to the maintainer.
+  wording probably meant. Only an item that cannot be told to be a finding or not goes to the maintainer.
diff --git a/.github/skills/python-codestyle/references/profiles.md b/.github/skills/python-codestyle/references/profiles.md
index 2d2f5424..ac6fe2ba 100644
--- a/.github/skills/python-codestyle/references/profiles.md
+++ b/.github/skills/python-codestyle/references/profiles.md
@@ -61,9 +61,9 @@ configuration alone marks the lint-only one:
   README, and CI all run the unpinned latest here. `.py` files follow the repo's LF line-ending
   default (per GOVERNANCE.md's "Line Endings" section). There is no pytest suite, and `unittest` is
   the runner instead. The directory still owes tests, written with the standard
-  library's `unittest` so they run under bare `python3` with nothing installed, as
-  `test_<script>.py` under a `tests/` directory beside the scripts it exercises and their
-  `pyproject.toml` (`<scripts-dir>/tests/`), where the validator looks for it, kept apart so a
+  library's `unittest` so they need no test runner installed. Each is a `test_<script>.py`
+  under a `tests/` directory beside the scripts it exercises and their `pyproject.toml`
+  (`<scripts-dir>/tests/`), where the validator looks for it. That directory stays apart so a
   test never reads as a tool. Within the scripts directory the name carries the kind: a gate
   that checks and exits non-zero on a finding takes a `_lint` or `_gate` suffix, and a utility
   that does work takes none. Any repo carrying Python
diff --git a/docs/host-setup.md b/docs/host-setup.md
index 8a596b7e..b8bee55c 100644
--- a/docs/host-setup.md
+++ b/docs/host-setup.md
@@ -26,7 +26,7 @@ This section is the **contract**: which tools a host needs and which repo proced
 
 The **Floor** column exists because presence and sufficiency are different questions and the answer to the first was being read as the answer to the second. A tool below its floor still answers `--version`, so every other column reports it as fine while `scripts/host_gate.py` fails it. The kind is named beside the number, since a **measured** floor sits above a version known to break a documented procedure and gives a failing host a defect to point at, where a **target** floor names the version the repo's toolchain is configured for and does not. The next section carries the reasoning behind each one.
 
-Two consequences worth reading off the table rather than discovering later. **Python 3 needs no packages installed**, because a script needing a library declares it inline and runs through `uv`, so a bare interpreter beside `uv` is enough. And **the linters need only `docker`**, not `node`, `dotnet` or a local `markdownlint`, since each runs as a pinned image, which is what keeps a local run and CI the same check.
+Two consequences worth reading off the table rather than discovering later. **Python 3 needs no packages installed.** A script needing a library declares it inline, and the test suite names its libraries in `tests/requirements.txt`. `uv` resolves both, so a bare interpreter beside `uv` is enough. And **the linters need only `docker`**, not `node`, `dotnet` or a local `markdownlint`, since each runs as a pinned image, which is what keeps a local run and CI the same check.
 
 **The interpreter is called `python3` everywhere, and on native Windows that is something the tooling provides rather than something the platform ships.** Windows registers `python` and `py` through the interpreter's own installer, and gives `python3` by default to an *app execution alias stub*, a zero-byte reparse point in the WindowsApps directory belonging to App Installer, which only ever offers to open the Microsoft Store. A Microsoft Store Python registers aliases under those same two names carrying the same reparse tag, and those reach a real interpreter somebody chose, so the target package rather than the tag is what tells a placeholder from a working setup. The installer removes only the placeholder and reports anything else. Measured on a fleet Windows host, that stub writes its `Python was not found` message to **stderr** and exits **9009**, so it fails loudly and a `&&` chain does stop on it. What it does instead is occupy the name: WindowsApps is on `PATH` by default, so wherever it sits ahead of the install directory the stub answers and the installed interpreter cannot be reached under that name at all. [`host-setup/windows/install-tools.ps1`][install-tools-windows] fixes both halves when it manages the `python` tool: it removes those stubs, and it puts a real `python3` beside the interpreter it installed. Stock Debian is the mirror image, carrying `python3` and no bare `python`, so `python3` is the one name that is correct on all three platforms and is what every script and brief should use.
 
@@ -384,7 +384,7 @@ Verified on Windows 11 Pro 10.0.26200 with PowerShell 7.6.4, where `python3 scri
 | --- | --- |
 | Stand up a new repo through [`STANDUP.md`][standup] | step 0 verifies identity and signing, and its window closes at the first commit |
 | Run the four linters locally, matching CI | `docker` runs each as the same pinned image CI uses |
-| Run the repo's own gates and tests | Python 3 and `uv` cover `scripts/` and `spec/` with no packages to install |
+| Run the repo's own gates and tests | Python 3 and `uv` cover `scripts/`, `spec/`, and `tests/` with no packages to install, `uv` supplying `tests/requirements.txt` |
 | Drive the PR and Copilot review loop | `gh` and an authenticated session |
 | Let an agent work with the `gh` credentials live | the host-safety kit is installed |
 | Have the fleet skills surface in every agent session | the skills snapshot is current per `skills_install.py --report` |
diff --git a/tests/test_release_guards.py b/tests/test_release_guards.py
index f5d35ec3..6c6d865a 100755
--- a/tests/test_release_guards.py
+++ b/tests/test_release_guards.py
@@ -1538,7 +1538,7 @@ def test_validator_python_leg_reaches_a_pip_dependency_repo(self) -> None:
         # Each dependency shape reaches its own runner, the lint-only one included.
         for arm in ("              uv)\n", "              pip)\n", "              lint-only)\n"):
             self.assertIn(arm, job)
-        self.assertIn("coverage@latest run -m unittest discover -s tests", job)
+        self.assertIn('uvx "${extra[@]}" coverage@latest run -m unittest discover -s tests', job)
         self.assertIn("--with-requirements tests/requirements.txt", job)
         self.assertIn("has no Python files under tests/", job)
         self.assertIn("cannot install its dependencies", job)