Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/aube-lockfile/src/merge.rs`:
- Around line 267-284: The runtime merge loop in merge.rs (the for (name,
incoming) in src.runtimes and Entry::Occupied branch) only checks
slot.get().version against incoming.version and therefore misses conflicts in
other fields; update the Occupied branch to compare all relevant Runtime fields
(specifier, dev, has_bin, variants, and version) between slot.get() and
incoming, and if any of those differ push a clear conflict message (e.g.,
"runtime `{}`: kept <existing> over <incoming> (diffs: ...)" or list which
fields differ) while still retaining the existing entry; ensure equality across
all fields avoids reporting a conflict.

In `@crates/aube-runtime/src/discover.rs`:
- Around line 117-123: The discovery currently accepts any regular file at
node_bin (node_paths_in) which lets non-executable/corrupt extracts pass
validate_install and enter the installed-runtime set; update the check that
currently uses node_bin.is_file() to also verify the file is executable
(platform-appropriate permission check) so validate_install() rejects files
without execute bits before selecting the runtime. Locate the node_paths_in /
discovery branch in discover.rs and replace the simple is_file() test with a
combined is_file() && is_executable check (using
std::os::unix::fs::PermissionsExt or equivalent on Windows) so non-executable
node binaries are filtered out.

In `@crates/aube-runtime/src/error.rs`:
- Around line 57-74: The Error::Io variant is currently mapped to
errors::ERR_AUBE_RUNTIME_DOWNLOAD_FAILED in impl Error::code(), which
misclassifies lock/acquire, mkdir, archive-open, and publish/rename I/O
failures; change this by either (A) adding a new stable code constant (e.g.
errors::ERR_AUBE_RUNTIME_IO) and return it from Error::Io in Error::code(), or
(B) split Error::Io into narrower variants (e.g. IoLock, IoCreateDir,
IoOpenArchive, IoPublishRename) and map each new variant to its own ERR_AUBE_*
constant; update the errors module to declare any new ERR_AUBE_* identifiers and
adjust any tests or places that pattern-match on Error::Io or expect the old
code.

In `@crates/aube-runtime/src/index.rs`:
- Around line 86-173: The code in load_index (and similarly install /
download_verify_extract) performs blocking std::fs I/O on async paths (e.g.,
std::fs::read, std::fs::create_dir_all, aube_util::fs_atomic::atomic_write)
which can block Tokio workers; change those to async-aware operations by either
using tokio::fs equivalents or moving the blocking sections into
tokio::task::spawn_blocking closures that return the same results, e.g., wrap
the initial cache read/deserialization, the cache write/parent-dir creation, and
any other std::fs usages in spawn_blocking (or replace with
tokio::fs::read/to_vec/create_dir_all and an async atomic-write helper) so
load_index, install, and download_verify_extract no longer perform blocking
filesystem calls on the async runtime.
- Around line 45-46: The is_lts method currently only treats
LtsField::Codename(_) as LTS, so LtsField::Flag(true) values from mirrors are
ignored; update is_lts (in the implementation for LtsField/where NodeSpec::Lts
flows through) to also return true for LtsField::Flag(true) (or remove the Flag
variant if you intend not to support boolean flags) — locate the is_lts function
and the LtsField enum and add a match arm for LtsField::Flag(true) (or remove
references to Flag and adjust callers like NodeSpec::Lts accordingly) so boolean
LTS indicators are handled consistently.

In `@crates/aube-runtime/src/self_install.rs`:
- Around line 50-53: The self_dir function currently treats an empty
AUBE_SELF_DIR value as a valid path (resolving to the working directory); update
self_dir to ignore empty environment values by checking the OsString returned
from std::env::var_os("AUBE_SELF_DIR") and returning None if it is empty (i.e.,
treat empty AUBE_SELF_DIR as unset) before converting to a PathBuf; adjust the
early-return logic in self_dir accordingly so only non-empty values are turned
into PathBufs.
- Around line 135-137: The current find call that assigns exe (the array of
dir.join(exe_name) and dir.join("bin").join(exe_name)) uses only p.is_file() so
it can pick non-executable files; change the predicate to p.is_file() &&
is_executable(p). Implement a small helper is_executable(path: &Path) -> bool
and use it in the closure passed to find: on Unix (cfg(unix)) check
metadata().permissions().mode() & 0o111 != 0 via
std::os::unix::fs::PermissionsExt, and on Windows (cfg(windows)) treat files
with executable extensions (e.g. .exe, .bat, .cmd) as executable (or call
appropriate WinAPI/MetadataExt if preferred). Ensure the new predicate is used
where exe is selected so only usable binaries are returned.

In `@crates/aube-runtime/src/shasums.rs`:
- Around line 70-76: The cached SHASUMS read path uses Shasums::parse and
returns immediately even when the parsed result contains no valid entries;
change the logic after calling Shasums::parse to validate the parsed object has
at least one entry (e.g. check a entries/len/is_empty accessor) and only return
Ok(parsed) if non-empty; otherwise treat it as a cache miss (optionally delete
the corrupted cache_path) so the code falls through to the network fetch logic
that already rejects empty responses. Ensure the same validation is applied to
the cached-path branch and mirrors the non-empty check used around the network
handling (the code near the existing network-response rejection).

In `@crates/aube-settings/settings.toml`:
- Around line 2000-2010: Update the docs for managePackageManagerVersions to
clarify that self-version switching of the aube binary is performed by aube
itself (mise/installer logic) and that runtimeInstaller refers only to the Node
runtime installer policy; adjust the paragraph mentioning runtimeInstaller so it
does not imply ownership of downloading pinned aube binaries, and explicitly
state how packageManager (pins like `aube@…`), packageManagerStrict and
packageManagerStrictVersion behave with respect to validation vs switching and
who performs the download/re-exec.

In `@crates/aube/src/commands/install/mod.rs`:
- Around line 397-415: Root-level preinstall hooks are run before the project's
Node runtime is resolved; move the runtime resolution so lifecycle scripts run
with the correct switched runtime. Relocate the crate::runtime::ensure(...) call
(passing &cwd, Some(&manifest), RuntimeSettings::from_ctx(&settings_ctx), and
lockfile_pre_parse...runtimes.get("node")) and the subsequent
super::configure_script_settings(&settings_ctx) so they execute before the
run_root_lifecycle(...) invocation, ensuring the runtime is resolved and script
settings are updated prior to running root lifecycle hooks.

In `@crates/aube/src/commands/runtime.rs`:
- Around line 175-196: The current branch uses
NodeRuntime::new(cfg).resolve(&request, None, ...) which still applies
PATH-first and reuse logic; when installer is aube (cfg.installer ==
aube_runtime::InstallerMode::Aube) you must force aube-managed install instead
of letting resolve pick an ambient/node reuse. Change the call so it bypasses
PATH/reuse — e.g., set the RuntimeConfig or request flags that disable reuse (a
"force" or allow_reuse = false / prefer_download = true option) or call the API
variant that mandates download/install rather than standard resolve; update the
construction around aube_runtime::RuntimeConfig, aube_runtime::NodeRequest, and
the NodeRuntime::resolve invocation to use that force-install path when
InstallerMode::Aube is selected.

In `@crates/aube/src/runtime.rs`:
- Around line 92-93: The process-global RUNTIME can be initialized without a
lockfile pin by runtime::ensure_for_cwd(...) which wins over a later
install::run that wants to call runtime::ensure(..., lock_pin=Some(...)); fix by
changing call order in callers (crate::commands::run.rs and
crate::commands::exec.rs) to invoke ensure_installed(no_install).await? (which
may run install::run and thus call runtime::ensure with a lockfile pin) before
calling crate::runtime::ensure_for_cwd(&crate::dirs::cwd()?) so the
lockfile-pinned ensure runs first and initializes static RUNTIME with the pinned
version.

In `@crates/aube/src/self_version.rs`:
- Around line 64-75: The current check uses
std::env::var_os(REEXEC_GUARD_ENV).is_some() which treats any re-exec marker as
"already switched"; instead read the guard value
(std::env::var_os(REEXEC_GUARD_ENV)), compare it against the target version/pin
(use pin.raw or the exact version string produced by reexec()), and only skip
switching when they are equal; if the values differ, clear/unset the guard or
proceed to reexec; apply the same fix to the other occurrence referenced (around
lines 222-224) so REEXEC_GUARD_ENV/AUBE_SELF_SWITCHED is scoped to the requested
version rather than presence alone.
- Around line 77-109: When resolving range pins in this block (match on
pin.spec) avoid calling aube_runtime::latest_aube_version() before honoring the
pin.on_fail policy: if no installed version matches (result of
aube_runtime::list_installed_aube() filtering), check pin.on_fail and perform
the fallback (warn/ignore/error) immediately for non-download modes instead of
fetching from the network; only call aube_runtime::latest_aube_version(2).await
when pin.on_fail indicates a download/remote resolution path. Update the logic
around pin, pin.spec, best_installed, aube_runtime::latest_aube_version, and the
self_pin_unsatisfied returns so that on_fail is consulted first and triggers the
correct self_pin_unsatisfied behavior or fallback before any remote network
call.

In `@README.md`:
- Line 261: The README has inconsistent pnpm compatibility claims: update either
the lockfile table (the `pnpm-lock.yaml v9` entry) to indicate support for pnpm
11 lockfiles or narrow the sentence that claims "aube also matches pnpm 11's
runtime surface" so it only refers to the runtime surface (e.g., "matches pnpm
11's runtime surface but uses pnpm-lock.yaml v9") to avoid conflict; locate the
sentence that begins "aube also matches pnpm 11's runtime surface" and the
lockfile table entry `pnpm-lock.yaml v9` and make them consistent.

---

Outside diff comments:
In @.rules:
- Around line 26-38: The crate inventory block labeled "crates[12]{name,role}"
is missing the aube-util entry (Cargo.toml still references aube-util), so
either add an entry for "aube-util" with its short role description into that
list or update the cardinality to "crates[13]" and append the new line; locate
the inventory block (the header "crates[12]{name,role}" and the following crate
lines) and insert a concise "aube-util,..." line describing its role or
increment the index and include the aube-util entry to keep the workspace
inventory consistent with Cargo.toml.

In `@crates/aube-scripts/src/lib.rs`:
- Around line 887-920: The node execpath env vars (npm_node_execpath and NODE)
are set on cmd before apply_jail_env(), but apply_jail_env() calls env_clear()
which removes them for jailed scripts; update the code so the node execpath is
preserved for jailed scripts by moving the logic that sets
npm_node_execpath/NODE to after apply_jail_env() is invoked (or alternatively,
modify apply_jail_env() to re-add these vars when settings.node_exe is present).
Specifically adjust the block that references settings.node_exe and node_exe so
it runs after apply_jail_env(&mut cmd, ...), or ensure apply_jail_env preserves
or re-inserts those env vars when jail is Some.

In `@crates/aube/src/commands/dlx.rs`:
- Around line 149-167: The local-bin fast path can return before runtime
resolution runs, so move the call to
crate::runtime::ensure_for_cwd(&crate::dirs::cwd()?).await? to occur before the
early return branch: call ensure_for_cwd right after computing initial_cwd (or
at the top of the block guarded by !explicit_package && !shell_mode &&
can_use_local_bin(&command)) and before checking project root / bin_path and
before invoking super::exec::exec_bin, so that the runtime is resolved for the
user's project (respecting .nvmrc/devEngines) regardless of whether exec_bin
returns early.

In `@crates/aube/src/commands/exec.rs`:
- Around line 296-315: The non-status exec branch that builds the
tokio::process::Command (created via resolve_exec_shim) currently skips the
runtime PATH injection and environment adjustments; update that branch so it
mirrors the status/parallel path by computing bin_dir =
super::project_modules_dir(cwd).join(".bin"), combining it with
crate::runtime::path_entries(), building new_path via
aube_scripts::prepend_paths(&path_dirs), setting cmd.env("PATH", &new_path), and
then calling the same apply_child_env(command) (or the appropriate function used
elsewhere to inject runtime env) on the built Command before returning; keep the
existing cmd.args(args) and ensure you reference resolve_exec_shim,
project_modules_dir, crate::runtime::path_entries, aube_scripts::prepend_paths,
and apply_child_env to locate where to apply these changes.

In `@crates/aube/src/commands/install/fetch.rs`:
- Around line 91-103: The spawn error message for the Command created via
tokio::process::Command::new(crate::runtime::node_program()) is misleading
because it hardcodes "from PATH"; update the miette! error construction in the
.map_err closure to be runtime-source agnostic by either removing "from PATH" or
including the resolved program path (crate::runtime::node_program() or a local
variable holding it) in the message so it accurately reflects whether Node was
taken from PATH or a pinned runtime; adjust the miette! invocation that
references local.specifier() accordingly.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/aube-lockfile/src/merge.rs`:
- Around line 298-306: The variant-union check misuses .any(), causing an
incoming Variant (variable name variant) to be skipped if any one of its targets
is present in dst_pin.variants; change the predicate so we only skip the
incoming variant when all of its targets are already present in dst_pin (i.e.,
replace the .any() check with an .all() style check over variant.targets against
dst_pin.variants/dv.targets), so dst_pin.variants.push(variant) only happens
when at least one target in variant is uncovered.

---

Duplicate comments:
In `@crates/aube-runtime/src/self_install.rs`:
- Around line 58-61: The current self_dir() accepts an empty AUBE_SELF_DIR value
which std::env::var_os returns as Some("") and then PathBuf::from("") resolves
to the current working directory; modify self_dir() to treat empty or
all-whitespace AUBE_SELF_DIR as unset by checking the OsString value (e.g.,
convert to string lossily or check is_empty on OsStr) before returning
Some(PathBuf), and only return Some(PathBuf::from(dir)) when the variable is
non-empty; otherwise continue to fall through to the non-env resolution path.
- Around line 143-145: The current finder lets non-executable files pass because
it only checks is_file(); create and use an is_executable(path: &Path) helper
and change the find closure used when computing exe to require both is_file()
and is_executable(). Implement is_executable to, on Unix (use
std::os::unix::fs::PermissionsExt), check metadata()?.permissions().mode() &
0o111 != 0, and on Windows check common executable extensions (e.g.,
"exe","bat","cmd") or use Windows-specific metadata if preferred; update the
code that computes exe (the let exe = ... .find(|p| ... )?) to call this helper
so only truly executable candidates are selected.

In `@crates/aube/src/runtime.rs`:
- Around line 92-93: The process-global static RUNTIME
(tokio::sync::OnceCell<RuntimeContext>) allows a first-write to silently fix the
lock pin, so when run/exec call ensure_for_cwd(lock_pin=None) before
auto-install calls install::run(..., lock_pin=Some(...)) the real pin is
ignored; change initialization so the RuntimeContext creation path honors a
later-provided lock_pin instead of being permanently set by the first writer:
update the code paths that set RUNTIME (the OnceCell initializer and the
function that constructs RuntimeContext) to accept and propagate an optional
lock_pin, and replace the current blind OnceCell::set usage with a
compare-and-update or lazy initializer that merges or prefers non-None lock_pin
(e.g., try_insert/update the existing RuntimeContext to inject the lock_pin when
a prior empty/None pin exists) so ensure_for_cwd, install::run, and
RuntimeContext all consistently observe the correct lock_pin.

In `@crates/aube/src/self_version.rs`:
- Around line 67-75: The re-exec guard currently only checks presence via
std::env::var_os(REEXEC_GUARD_ENV).is_some() and should instead compare the
guard's value to the intended target version; change the logic so after you've
resolved the target pin (use pin.raw or the resolved identifier you choose) you
read std::env::var(REEXEC_GUARD_ENV) and only early-return if the env value
equals that target string, otherwise proceed with switching; alternatively, set
REEXEC_GUARD_ENV to the requested pin (pin.raw) when spawning the nested aube so
the existing presence check remains valid, and update references around
REEXEC_GUARD_ENV, pin.raw, and running_version() accordingly.

---

Nitpick comments:
In `@crates/aube-lockfile/src/merge.rs`:
- Around line 273-282: When merging runtime entries in Entry::Occupied, detect
and report conflicts if slot.get().dev != incoming.dev or slot.get().has_bin !=
incoming.has_bin even when versions match; update the block handling the
occupied slot (where slot.get() and incoming are compared and report.conflicts
is pushed for version mismatches) to also push descriptive conflict messages for
dev and has_bin differences (similar style to the existing specifier conflict
reporting) before continuing to the specifier check so the conflict log records
these differing flags while still keeping dst's values.

In `@crates/aube-lockfile/src/pnpm/tests.rs`:
- Around line 3317-3389: Add two focused tests next to
runtime_pin_merge_unions_variants to cover multi-target and overlapping-target
cases: (1) a test named runtime_pin_merge_handles_multi_target_variants that
creates a dst RuntimePin with a RuntimeVariant containing targets [darwin/arm64]
and an incoming RuntimePin whose RuntimeVariant contains targets [darwin/arm64,
darwin/x64], then runs merge_branch_lockfiles and asserts the merged
LockfileGraph retains darwin/x64 (no silent drop); (2) a test named
runtime_pin_merge_reports_conflict_on_target_collision that creates dst and
incoming RuntimePins both targeting darwin/arm64 but with differing
archive/url/integrity or differing dev/has_bin flags, then runs
merge_branch_lockfiles and asserts the merged graph keeps dst’s variant while
the returned report contains a conflict entry for the runtime pin; reference the
RuntimePin, RuntimeVariant, RuntimeTarget types and use
parse/write/merge_branch_lockfiles as in the existing test to exercise the code
path around the .any() logic in merge.rs so overlapping-target logic and
dev/has_bin flag disagreements are asserted.