diff --git a/cli.py b/cli.py
index 0683838d84b2..6e5052fc20e4 100644
--- a/cli.py
+++ b/cli.py
@@ -2749,10 +2749,12 @@ def _termux_example_image_path(filename: str = "cat.png") -> str:
         "/storage/emulated/0",
         "/storage/self/primary",
     ]
+    # Termux/Android roots are POSIX paths — join with literal forward
+    # slashes so the hint stays correct even when this renders on Windows.
     for root in candidates:
         if os.path.isdir(root):
-            return os.path.join(root, "Pictures", filename)
-    return os.path.join("~/storage/shared", "Pictures", filename)
+            return f"{root}/Pictures/{filename}"
+    return f"~/storage/shared/Pictures/{filename}"
 
 
 def _split_path_input(raw: str) -> tuple[str, str]:
@@ -2823,6 +2825,16 @@ def _resolve_attachment_path(raw_path: str) -> Path | None:
                 expanded = unquote(parsed.path or "")
                 if parsed.netloc and os.name == "nt":
                     expanded = f"//{parsed.netloc}{expanded}"
+                elif (
+                    os.name == "nt"
+                    and len(expanded) >= 3
+                    and expanded[0] == "/"
+                    and expanded[1].isalpha()
+                    and expanded[2] == ":"
+                ):
+                    # file:///C:/... parses to path "/C:/..." — drop the
+                    # leading slash so it resolves as a drive-letter path.
+                    expanded = expanded[1:]
         except Exception:
             expanded = token
     expanded = os.path.expandvars(os.path.expanduser(expanded))
diff --git a/gateway/status.py b/gateway/status.py
index 9b8a1b6f83c2..23ff8c41ea54 100644
--- a/gateway/status.py
+++ b/gateway/status.py
@@ -337,9 +337,12 @@ def _command_line_belongs_to_profile(command: str, profile_home: Path) -> bool:
     explicit ``HERMES_HOME=<path>``) on its argv; the default/root gateway runs
     bare with no profile flag.
     """
-    command_lc = command.lower()
+    # Normalize separators before the substring match: on Windows,
+    # str(Path) renders backslashes while a HERMES_HOME= value on the argv
+    # may carry forward slashes (Git Bash, JSON configs) — and vice versa.
+    command_lc = command.lower().replace("\\", "/")
     profile_name = _profile_name_for_home(profile_home)
-    home_lc = str(profile_home).lower()
+    home_lc = str(profile_home).lower().replace("\\", "/")
 
     if profile_name is not None and profile_name != "default":
         profile_lc = profile_name.lower()
diff --git a/hermes_cli/banner.py b/hermes_cli/banner.py
index 217eb2bb9656..e2782db5b225 100644
--- a/hermes_cli/banner.py
+++ b/hermes_cli/banner.py
@@ -41,7 +41,14 @@ def cprint(text: str):
     """Print ANSI-colored text through prompt_toolkit's renderer."""
     from prompt_toolkit import print_formatted_text as _pt_print
     from prompt_toolkit.formatted_text import ANSI as _PT_ANSI
-    _pt_print(_PT_ANSI(text))
+    try:
+        _pt_print(_PT_ANSI(text))
+    except Exception:
+        # prompt_toolkit needs a real console. On Windows, a redirected or
+        # absent stdout (pythonw.exe, CI, `hermes ... > file`) raises
+        # NoConsoleScreenBufferError from its Win32Output — display helpers
+        # must never crash the caller over that, so degrade to plain print.
+        print(text)
 
 
 # =========================================================================
diff --git a/hermes_cli/browser_connect.py b/hermes_cli/browser_connect.py
index 7ed4f2e4da46..71fd6783bb94 100644
--- a/hermes_cli/browser_connect.py
+++ b/hermes_cli/browser_connect.py
@@ -4,6 +4,7 @@
 
 import os
 import platform
+import posixpath
 import shlex
 import shutil
 import subprocess
@@ -90,7 +91,10 @@ def add_windows_install_paths(
         for _, group in install_groups:
             for base in filter(None, bases):
                 for parts in group:
-                    add(os.path.join(base, *parts))
+                    # Only called with WSL ``/mnt/c/...`` bases — those are
+                    # POSIX paths regardless of the host OS, so join with
+                    # posixpath (os.path.join would emit backslashes on nt).
+                    add(posixpath.join(base, *parts))
 
     if system == "Darwin":
         for app in _DARWIN_APPS:
diff --git a/hermes_cli/gateway.py b/hermes_cli/gateway.py
index 10b638d8e834..c74c9e764a5e 100644
--- a/hermes_cli/gateway.py
+++ b/hermes_cli/gateway.py
@@ -346,7 +346,9 @@ def _scan_gateway_pids(
         looks_like_gateway_runtime_command_line,
     )
     current_home = str(get_hermes_home().resolve())
-    current_home_lc = current_home.lower()
+    # Forward slashes on both sides of the HERMES_HOME= match — see
+    # gateway.status._command_line_belongs_to_profile, which this mirrors.
+    current_home_lc = current_home.lower().replace("\\", "/")
     current_profile_arg = _profile_arg(current_home)
     current_profile_name = (
         current_profile_arg.split()[-1] if current_profile_arg else ""
@@ -354,7 +356,7 @@ def _scan_gateway_pids(
     current_profile_name_lc = current_profile_name.lower()
 
     def _matches_current_profile(command: str) -> bool:
-        command_lc = command.lower()
+        command_lc = command.lower().replace("\\", "/")
         if current_profile_name:
             return (
                 f"--profile {current_profile_name_lc}" in command_lc
@@ -2655,7 +2657,15 @@ def generate_systemd_unit(system: bool = False, run_as_user: str | None = None)
     path_entries = _build_service_path_dirs()
     resolved_node = shutil.which("node")
     if resolved_node:
-        resolved_node_dir = str(Path(resolved_node).resolve().parent)
+        # Use the directory where ``node`` is *found on PATH*, NOT the
+        # symlink's resolved target. ``~/.local/bin/node`` is often a symlink
+        # into a specific profile's node install (e.g. profiles/jarvis/node/
+        # bin/node); calling .resolve() here would chase that symlink and bake
+        # one profile's node path into *every* profile's service unit. That
+        # cross-profile leak makes systemd_unit_is_current() perpetually false,
+        # so each gateway rewrites its unit + daemon-reload on every boot. Using
+        # the symlink's own parent keeps the generated unit profile-agnostic.
+        resolved_node_dir = str(Path(resolved_node).parent)
         if resolved_node_dir not in path_entries:
             path_entries.append(resolved_node_dir)
 
@@ -3588,6 +3598,86 @@ def _launchctl_bootstrap(
         )
 
 
+def _launchd_reload_log_path() -> Path:
+    """Path the launchd reload watchdog tails for persistent-orphan detection."""
+    return get_hermes_home() / "logs" / "launchd-reload.log"
+
+
+def _append_launchd_reload_log(message: str) -> None:
+    """Append a timestamped line to the launchd reload log (best-effort)."""
+    path = _launchd_reload_log_path()
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        from datetime import datetime as _dt
+
+        stamp = _dt.now().astimezone().strftime("%Y-%m-%d %H:%M:%S %z")
+        with path.open("a", encoding="utf-8") as fh:
+            fh.write(f"[{stamp}] {message}\n")
+    except OSError:
+        pass
+
+
+def _launchctl_label_registered(label: str) -> bool:
+    """True when ``launchctl list <label>`` reports the job as registered."""
+    try:
+        result = subprocess.run(
+            ["launchctl", "list", label],
+            check=False,
+            timeout=10,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        return result.returncode == 0
+    except (subprocess.TimeoutExpired, OSError):
+        return False
+
+
+def _retry_launchctl_bootstrap_until_registered(
+    domain: str, plist_path, label: str, *, deadline: float
+) -> bool:
+    """Bootstrap with retry until the label is registered or ``deadline`` passes.
+
+    Wraps :func:`_launchctl_bootstrap` (which already recovers the EIO
+    "already loaded" case) in a wall-clock retry loop for the *transient*
+    failure mode: under high load or a launchd race the bootstrap can fail
+    even after ``bootout`` already tore down the prior registration, leaving
+    the service orphaned from ``KeepAlive`` supervision. The reported incident
+    happened during a graceful drain (default ``agent.restart_drain_timeout``
+    = 180s), so a fixed ~10s window is too short — retry until ``deadline``.
+
+    Both ``CalledProcessError`` and ``TimeoutExpired`` are treated as
+    retryable: a ``bootstrap`` that times out after ``bootout`` still leaves
+    the service unloaded, so it must be retried, not allowed to escape. On
+    each failure a timestamped line is appended to the reload log; success is
+    confirmed with ``launchctl list`` (not merely a zero bootstrap exit).
+    Returns True once the label is registered, False if the deadline is hit.
+    """
+    attempt = 0
+    while True:
+        attempt += 1
+        try:
+            _launchctl_bootstrap(domain, plist_path, label, timeout=30)
+            if _launchctl_label_registered(label):
+                return True
+            _append_launchd_reload_log(
+                f"bootstrap attempt {attempt} exited 0 but {domain}/{label} "
+                f"is not registered (launchctl list) — retrying"
+            )
+        except subprocess.CalledProcessError as exc:
+            _append_launchd_reload_log(
+                f"bootstrap attempt {attempt} failed (rc={exc.returncode}) "
+                f"for {domain}/{label} — retrying"
+            )
+        except subprocess.TimeoutExpired:
+            _append_launchd_reload_log(
+                f"bootstrap attempt {attempt} timed out for {domain}/{label} "
+                f"— retrying"
+            )
+        if time.monotonic() >= deadline:
+            return False
+        time.sleep(2)
+
+
 # ── launchd unsupported marker ─────────────────────────────────────────────
 # When launchd can't manage the domain on this host (error 5/125, macOS 26+),
 # we write a persistent marker so `launchd_status()` can explain that launchd
@@ -3727,7 +3817,13 @@ def generate_launchd_plist() -> str:
     priority_dirs = _build_service_path_dirs()
     resolved_node = shutil.which("node")
     if resolved_node:
-        resolved_node_dir = str(Path(resolved_node).resolve().parent)
+        # Use the directory where ``node`` is *found on PATH*, NOT the symlink's
+        # resolved target. ``~/.local/bin/node`` is often a symlink into a
+        # specific profile's node install; calling .resolve() would chase it and
+        # bake one profile's path into every profile's service definition,
+        # breaking profile isolation and causing perpetual unit rewrites. See
+        # the matching fix in generate_systemd_unit().
+        resolved_node_dir = str(Path(resolved_node).parent)
         if resolved_node_dir not in priority_dirs:
             priority_dirs.append(resolved_node_dir)
     sane_path = ":".join(
@@ -3855,11 +3951,42 @@ def refresh_launchd_plist_if_needed() -> bool:
         # Delegate to a new session: `start_new_session=True` detaches the
         # helper from the gateway's process group, so the bootout that kills
         # the gateway (and us) does not kill the helper before it bootstraps.
+        #
+        # The bootstrap is retried up to 5 times with verification: under
+        # high load (loadavg observed >= 9) or a launchd race, the bootout
+        # can succeed (removing the service from launchd) while the
+        # follow-up bootstrap fails silently. Without retry+verify the
+        # service stays unregistered — KeepAlive can't revive a service
+        # launchd no longer knows about, so the gateway stays dark until a
+        # manual `launchctl bootstrap`. Failures append a timestamped line
+        # to ~/.hermes/logs/launchd-reload.log, which the health watchdog
+        # can tail to detect a persistent orphan. See hermes-restart
+        # rootcause handoff (2026-06-26 incident).
+        reload_log_path = get_hermes_home() / "logs" / "launchd-reload.log"
+        try:
+            reload_log_path.parent.mkdir(parents=True, exist_ok=True)
+        except OSError:
+            pass
+        # Retry until launchctl LISTS the label (not merely a zero bootstrap
+        # exit) or the drain window elapses. The failure happens while the old
+        # gateway is still draining (default agent.restart_drain_timeout=180s),
+        # so a fixed ~10s window is too short — bound by that budget instead.
+        _reload_budget = int(max(30.0, _get_restart_drain_timeout()))
         reload_script = (
             f"sleep 2; "
             f"launchctl bootout {shlex.quote(target)} 2>/dev/null; "
             f"sleep 1; "
-            f"launchctl bootstrap {shlex.quote(domain)} {shlex.quote(str(plist_path))} 2>/dev/null"
+            f"_deadline=$(($(date +%s) + {_reload_budget})); "
+            f"while :; do "
+            f"  launchctl bootstrap {shlex.quote(domain)} {shlex.quote(str(plist_path))} 2>/dev/null; "
+            f"  if launchctl list {shlex.quote(label)} >/dev/null 2>&1; then break; fi; "
+            f"  echo \"[$(date '+%Y-%m-%d %H:%M:%S %z')] bootstrap not yet registered for {shlex.quote(target)} — retrying\" >> {shlex.quote(str(reload_log_path))}; "
+            f"  if [ $(date +%s) -ge $_deadline ]; then break; fi; "
+            f"  sleep 2; "
+            f"done; "
+            f"if ! launchctl list {shlex.quote(label)} >/dev/null 2>&1; then "
+            f"  echo \"[$(date '+%Y-%m-%d %H:%M:%S %z')] FAILED launchd reload for {shlex.quote(target)} — service NOT registered after {_reload_budget}s of retries\" >> {shlex.quote(str(reload_log_path))}; "
+            f"fi"
         )
         try:
             subprocess.Popen(
@@ -3877,17 +4004,39 @@ def refresh_launchd_plist_if_needed() -> bool:
         )
         return True
 
-    # Bootout/bootstrap so launchd picks up the new definition
+    # Bootout/bootstrap so launchd picks up the new definition. The reported
+    # incident (2026-06-26) happened when bootout succeeded but bootstrap
+    # failed silently under load (loadavg 9.48) during a graceful /restart
+    # drain, leaving the service unregistered — KeepAlive can't revive a job
+    # launchd no longer knows about. Retry the bootstrap (via the shared
+    # _launchctl_bootstrap EIO-recovery helper) until the label is actually
+    # registered or the drain window elapses, verify with `launchctl list`,
+    # and log exhaustion so the reload watchdog can detect a persistent orphan.
     subprocess.run(
         ["launchctl", "bootout", target],
         check=False,
         timeout=90,
     )
-    subprocess.run(
-        ["launchctl", "bootstrap", domain, str(plist_path)],
-        check=False,
-        timeout=30,
-    )
+    # Size the retry window to the restart drain timeout (default 180s), not a
+    # fixed ~10s: the failure mode occurs while the old gateway is still
+    # draining, so a short window can exhaust before launchd settles.
+    _reload_budget = max(30.0, _get_restart_drain_timeout())
+    _deadline = time.monotonic() + _reload_budget
+    if not _retry_launchctl_bootstrap_until_registered(
+        domain, plist_path, label, deadline=_deadline
+    ):
+        _append_launchd_reload_log(
+            f"FAILED launchd reload of {target} — service NOT registered after "
+            f"retrying for {int(_reload_budget)}s (refresh ran outside gateway "
+            f"process tree)"
+        )
+        logger.error(
+            "launchd reload of %s failed — service not registered after %ds of "
+            "retries; see %s",
+            target,
+            int(_reload_budget),
+            _launchd_reload_log_path(),
+        )
     print(
         "↻ Updated gateway launchd service definition to match the current Hermes install"
     )
diff --git a/tests/cli/conftest.py b/tests/cli/conftest.py
new file mode 100644
index 000000000000..d45835e10de1
--- /dev/null
+++ b/tests/cli/conftest.py
@@ -0,0 +1,30 @@
+"""Shared fixtures for tests/cli.
+
+Several test modules here build a HermesCLI via ``importlib.reload(cli)``
+with prompt_toolkit stubbed out in ``sys.modules`` (the ``_make_cli``
+pattern from test_cli_init.py). ``importlib.reload()`` re-executes cli.py
+into the SAME module dict, so those MagicMock bindings (``_pt_print``,
+``_PT_ANSI``, ...) survive the ``patch.dict`` context and silently break
+any later test that needs cli's real prompt_toolkit machinery — e.g.
+``cli._cprint`` output vanishes into a MagicMock and capsys sees nothing.
+
+The autouse fixture below restores the real bindings at each module
+boundary by re-reloading cli (with the real prompt_toolkit back in
+sys.modules) whenever the pollution is detected.
+"""
+
+import importlib
+import sys
+from unittest.mock import MagicMock
+
+import pytest
+
+
+@pytest.fixture(autouse=True, scope="module")
+def _unpollute_cli_module():
+    yield
+    cli_mod = sys.modules.get("cli")
+    if cli_mod is not None and isinstance(
+        getattr(cli_mod, "_pt_print", None), MagicMock
+    ):
+        importlib.reload(cli_mod)
diff --git a/tests/cli/test_cli_file_drop.py b/tests/cli/test_cli_file_drop.py
index 4109ade9f3d1..9a635497d430 100644
--- a/tests/cli/test_cli_file_drop.py
+++ b/tests/cli/test_cli_file_drop.py
@@ -7,6 +7,21 @@
 from cli import _detect_file_drop
 
 
+def _can_symlink():
+    """Check if we can create symlinks (needs admin/dev-mode on Windows)."""
+    import tempfile
+    from pathlib import Path
+    try:
+        with tempfile.TemporaryDirectory() as d:
+            src = Path(d) / "src"
+            src.write_text("x")
+            lnk = Path(d) / "lnk"
+            lnk.symlink_to(src)
+            return True
+    except OSError:
+        return False
+
+
 # ---------------------------------------------------------------------------
 # Fixtures
 # ---------------------------------------------------------------------------
@@ -212,6 +227,8 @@ def test_tilde_prefixed_path(self, tmp_path, monkeypatch):
         img.parent.mkdir(parents=True, exist_ok=True)
         img.write_bytes(b"\x89PNG\r\n\x1a\n")
         monkeypatch.setenv("HOME", str(home))
+        # ntpath.expanduser ignores HOME (Python 3.8+) — it wants USERPROFILE.
+        monkeypatch.setenv("USERPROFILE", str(home))
 
         result = _detect_file_drop("~/storage/shared/Pictures/cat.png what is this?")
 
@@ -241,6 +258,7 @@ def test_path_that_looks_like_command_but_is_file(self, tmp_path):
         assert result is not None
         assert result["is_image"] is False
 
+    @pytest.mark.skipif(not _can_symlink(), reason="Symlinks need elevated privileges")
     def test_symlink_to_file(self, tmp_image, tmp_path):
         link = tmp_path / "link.png"
         link.symlink_to(tmp_image)
diff --git a/tests/cli/test_cli_image_command.py b/tests/cli/test_cli_image_command.py
index 45bdfa7e1bfc..e004ddb54553 100644
--- a/tests/cli/test_cli_image_command.py
+++ b/tests/cli/test_cli_image_command.py
@@ -74,6 +74,8 @@ def test_collect_query_images_supports_tilde_paths(self, tmp_path, monkeypatch):
         home = tmp_path / "home"
         img = _make_image(home / "storage" / "shared" / "Pictures" / "cat.png")
         monkeypatch.setenv("HOME", str(home))
+        # ntpath.expanduser ignores HOME (Python 3.8+) — it wants USERPROFILE.
+        monkeypatch.setenv("USERPROFILE", str(home))
 
         message, images = _collect_query_images("describe this", "~/storage/shared/Pictures/cat.png")
 
diff --git a/tests/cli/test_resume_quiet_stderr.py b/tests/cli/test_resume_quiet_stderr.py
index df82ce4dda95..56d4a6a6cba8 100644
--- a/tests/cli/test_resume_quiet_stderr.py
+++ b/tests/cli/test_resume_quiet_stderr.py
@@ -58,7 +58,16 @@ def test_session_not_found_goes_to_stderr_in_quiet_mode(self, capsys):
         assert "Session not found" in captured.err
         assert "hermes sessions list" in captured.err
 
-    def test_session_not_found_goes_to_stdout_in_full_mode(self, capsys):
+    def test_session_not_found_goes_to_stdout_in_full_mode(self, capsys, monkeypatch):
+        # The full-mode path prints through prompt_toolkit, which caches its
+        # output object on the AppSession at first use. If an earlier test
+        # already created it bound to the real console (Win32Output writes
+        # via console API, invisible to capsys), this test sees empty stdout.
+        # Reset the cache so output creation happens under capsys.
+        from prompt_toolkit.application.current import get_app_session
+
+        monkeypatch.setattr(get_app_session(), "_output", None)
+
         db = MagicMock()
         db.get_session.return_value = None
         cli = _make_cli(quiet=False, db=db)
diff --git a/tests/cli/test_worktree.py b/tests/cli/test_worktree.py
index 221903e0e96e..7ad54dd36867 100644
--- a/tests/cli/test_worktree.py
+++ b/tests/cli/test_worktree.py
@@ -508,6 +508,21 @@ def test_ten_concurrent_worktrees(self, git_repo):
             assert not Path(info["path"]).exists()
 
 
+def _can_symlink():
+    """Check if we can create symlinks (needs admin/dev-mode on Windows)."""
+    import tempfile
+    try:
+        with tempfile.TemporaryDirectory() as d:
+            src = Path(d) / "src"
+            src.write_text("x")
+            lnk = Path(d) / "lnk"
+            lnk.symlink_to(src)
+            return True
+    except OSError:
+        return False
+
+
+@pytest.mark.skipif(not _can_symlink(), reason="Symlinks need elevated privileges")
 class TestWorktreeDirectorySymlink:
     """Test .worktreeinclude with directories (symlinked)."""
 
@@ -1011,3 +1026,138 @@ def test_prompt_note_format(self, git_repo):
         assert info["repo_root"] in wt_note
         assert "isolated git worktree" in wt_note
         assert "commit and push" in wt_note
+
+
+class TestWorktreeLockReaping:
+    """Exercise the REAL cli._prune_stale_worktrees lock/dirty/unpushed logic.
+
+    Unlike the reimplementation-based tests above, these import the actual
+    production functions so the behavior contract is enforced against the
+    shipped code:
+
+    - live-locked (owning pid running)  -> never reaped, any age
+    - dead-locked clean (owning pid gone) -> unlocked + reaped (fixes the
+      accumulation bug: `git worktree remove --force` refuses a locked tree)
+    - dirty (uncommitted) at >72h        -> preserved
+    - unpushed commits at any age        -> preserved
+    - clean/unlocked stale               -> reaped (aggressive cleanup intact)
+    """
+
+    @staticmethod
+    def _age(path, hours):
+        import time
+        t = time.time() - (hours * 3600)
+        os.utime(path, (t, t))
+
+    @staticmethod
+    def _mk(cli, repo, name, pid=None, dirty=False, unpushed=False, age_h=100):
+        p = repo / ".worktrees" / name
+        (repo / ".worktrees").mkdir(exist_ok=True)
+        subprocess.run(
+            ["git", "worktree", "add", str(p), "-b", f"hermes/{name}", "HEAD"],
+            cwd=repo, capture_output=True,
+        )
+        if pid is not None:
+            subprocess.run(
+                ["git", "worktree", "lock", "--reason", f"hermes pid={pid}", str(p)],
+                cwd=repo, capture_output=True,
+            )
+        if unpushed:
+            (p / "work.txt").write_text("x")
+            subprocess.run(["git", "add", "work.txt"], cwd=p, capture_output=True)
+            subprocess.run(["git", "commit", "-m", "wip"], cwd=p, capture_output=True)
+        if dirty:
+            (p / "dirty.txt").write_text("uncommitted")
+        TestWorktreeLockReaping._age(p, age_h)
+        return p
+
+    def test_live_locked_survives_at_any_age(self, git_repo):
+        import cli
+        wt = self._mk(cli, git_repo, "hermes-live", pid=os.getpid())
+        cli._prune_stale_worktrees(str(git_repo))
+        assert wt.exists(), "live-locked worktree (this pid) must never be reaped"
+
+    def test_dead_locked_clean_is_reaped(self, git_repo):
+        import cli
+        wt = self._mk(cli, git_repo, "hermes-dead", pid=999999)
+        # sanity: this is the accumulation bug — remove --force alone can't do it
+        assert cli._worktree_lock_is_live(str(git_repo), str(wt)) == "dead"
+        cli._prune_stale_worktrees(str(git_repo))
+        assert not wt.exists(), "dead-locked clean worktree should be unlocked + reaped"
+
+    def test_dead_locked_dirty_survives(self, git_repo):
+        import cli
+        wt = self._mk(cli, git_repo, "hermes-deaddirty", pid=999999, dirty=True)
+        cli._prune_stale_worktrees(str(git_repo))
+        assert wt.exists(), "dead-locked worktree with uncommitted work must survive"
+
+    def test_dead_locked_unpushed_survives(self, git_repo):
+        import cli
+        wt = self._mk(cli, git_repo, "hermes-deadunp", pid=999999, unpushed=True)
+        cli._prune_stale_worktrees(str(git_repo))
+        assert wt.exists(), "dead-locked worktree with unpushed commits must survive"
+
+    def test_unlocked_clean_stale_is_reaped(self, git_repo):
+        import cli
+        wt = self._mk(cli, git_repo, "hermes-nolock", pid=None)
+        cli._prune_stale_worktrees(str(git_repo))
+        assert not wt.exists(), "clean unlocked stale worktree should be reaped"
+
+    def test_dirty_survives_over_72h(self, git_repo):
+        import cli
+        wt = self._mk(cli, git_repo, "hermes-dirty72", pid=None, dirty=True, age_h=100)
+        cli._prune_stale_worktrees(str(git_repo))
+        assert wt.exists(), "dirty worktree must survive even past the 72h tier"
+
+    def test_recent_worktree_untouched(self, git_repo):
+        import cli
+        wt = self._mk(cli, git_repo, "hermes-fresh", pid=None, age_h=1)
+        cli._prune_stale_worktrees(str(git_repo))
+        assert wt.exists(), "worktree under 24h must never be pruned"
+
+
+class TestWorktreeLockPredicate:
+    """_worktree_lock_is_live classification (real cli helper)."""
+
+    def _mk_locked(self, repo, name, reason):
+        p = repo / ".worktrees" / name
+        (repo / ".worktrees").mkdir(exist_ok=True)
+        subprocess.run(
+            ["git", "worktree", "add", str(p), "-b", f"hermes/{name}", "HEAD"],
+            cwd=repo, capture_output=True,
+        )
+        subprocess.run(
+            ["git", "worktree", "lock", "--reason", reason, str(p)],
+            cwd=repo, capture_output=True,
+        )
+        return p
+
+    def test_unlocked_returns_none(self, git_repo):
+        import cli
+        p = git_repo / ".worktrees" / "hermes-x"
+        (git_repo / ".worktrees").mkdir(exist_ok=True)
+        subprocess.run(
+            ["git", "worktree", "add", str(p), "-b", "hermes/hermes-x", "HEAD"],
+            cwd=git_repo, capture_output=True,
+        )
+        assert cli._worktree_lock_is_live(str(git_repo), str(p)) is None
+
+    def test_live_pid_returns_live(self, git_repo):
+        import cli
+        p = self._mk_locked(git_repo, "hermes-live", f"hermes pid={os.getpid()}")
+        assert cli._worktree_lock_is_live(str(git_repo), str(p)) == "live"
+
+    def test_dead_pid_returns_dead(self, git_repo):
+        import cli
+        p = self._mk_locked(git_repo, "hermes-dead", "hermes pid=999999")
+        assert cli._worktree_lock_is_live(str(git_repo), str(p)) == "dead"
+
+    def test_foreign_lock_reason_returns_dead(self, git_repo):
+        import cli
+        p = self._mk_locked(git_repo, "hermes-foreign", "some other tool")
+        assert cli._worktree_lock_is_live(str(git_repo), str(p)) == "dead"
+
+    def test_bad_repo_root_fails_safe_to_live(self, tmp_path):
+        import cli
+        # Not a git repo -> git query fails -> must report "live" (never delete)
+        assert cli._worktree_lock_is_live(str(tmp_path), str(tmp_path / "x")) == "live"
diff --git a/tests/cli/test_worktree_security.py b/tests/cli/test_worktree_security.py
index 73a242e0fdaa..119ceb478636 100644
--- a/tests/cli/test_worktree_security.py
+++ b/tests/cli/test_worktree_security.py
@@ -6,6 +6,20 @@
 import pytest
 
 
+def _can_symlink():
+    """Check if we can create symlinks (needs admin/dev-mode on Windows)."""
+    import tempfile
+    try:
+        with tempfile.TemporaryDirectory() as d:
+            src = Path(d) / "src"
+            src.write_text("x")
+            lnk = Path(d) / "lnk"
+            lnk.symlink_to(src)
+            return True
+    except OSError:
+        return False
+
+
 @pytest.fixture
 def git_repo(tmp_path):
     """Create a temporary git repo for testing real cli._setup_worktree behavior."""
@@ -76,6 +90,7 @@ def test_rejects_parent_directory_directory_traversal(self, git_repo):
         finally:
             _force_remove_worktree(info)
 
+    @pytest.mark.skipif(not _can_symlink(), reason="Symlinks need elevated privileges")
     def test_rejects_symlink_that_resolves_outside_repo(self, git_repo):
         import cli as cli_mod
 
@@ -110,6 +125,7 @@ def test_allows_valid_file_include(self, git_repo):
         finally:
             _force_remove_worktree(info)
 
+    @pytest.mark.skipif(not _can_symlink(), reason="Symlinks need elevated privileges")
     def test_allows_valid_directory_include(self, git_repo):
         import cli as cli_mod
 
diff --git a/tests/gateway/test_status.py b/tests/gateway/test_status.py
index ab4c94157437..ab3005c9fc0b 100644
--- a/tests/gateway/test_status.py
+++ b/tests/gateway/test_status.py
@@ -454,6 +454,14 @@ def test_runtime_status_running_pid_accepts_matching_profile_cmdline(self, monke
                 == 139
             ), cmdline
 
+    def test_command_line_belongs_to_profile_normalizes_separators(self):
+        """A Windows argv renders HERMES_HOME with backslashes while the
+        profile's Path may carry forward slashes (and, on Windows, vice
+        versa).  The separator difference must not defeat the match."""
+        home = Path("c:/opt/data/profiles/coder")
+        cmdline = r"hermes_home=c:\opt\data\profiles\coder hermes gateway run --replace"
+        assert status._command_line_belongs_to_profile(cmdline, home) is True
+
     def test_runtime_status_running_pid_default_profile_rejects_named_cmdline(self, monkeypatch):
         """The default/root profile runs a bare gateway (no profile flag).  A
         recycled PID now hosting a *named* profile gateway must not be reported
diff --git a/tests/tools/test_windows_native_support.py b/tests/tools/test_windows_native_support.py
index 2e6606ead5b8..b8d958df4e09 100644
--- a/tests/tools/test_windows_native_support.py
+++ b/tests/tools/test_windows_native_support.py
@@ -50,10 +50,10 @@ def _reset_configured(self, monkeypatch):
         yield
         sys.modules.pop("hermes_cli.stdio", None)
 
-    def test_no_op_on_posix(self):
+    def test_no_op_on_posix(self, monkeypatch):
         from hermes_cli import stdio
 
-        assert stdio.is_windows() is False
+        monkeypatch.setattr(stdio, "is_windows", lambda: False)
         result = stdio.configure_windows_stdio()
         assert result is False
 
@@ -285,6 +285,9 @@ def test_getattr_fallback_works_when_sigkill_missing(self, monkeypatch):
         result = getattr(fake_signal, "SIGKILL", fake_signal.SIGTERM)
         assert result == 15
 
+    @pytest.mark.skipif(
+        sys.platform == "win32", reason="signal.SIGKILL does not exist on Windows"
+    )
     def test_getattr_fallback_prefers_sigkill_when_present(self):
         """On POSIX the fallback is a no-op: real SIGKILL wins."""
         result = getattr(signal, "SIGKILL", signal.SIGTERM)