@gaborbernat Added tests and an additional fix. Here's what I found and changed:

Tests added:

• test_setenv_path_not_overwritten — verifies that setenv PATH = {env:PATH}:/custom/test/path results in /custom/test/path appearing in the final PATH
• test_setenv_path_venv_paths_first — verifies that virtual environment paths (.tox/.../bin) appear before the trailing user-appended paths

Additional fix in environment_variables property:
While writing the tests, I discovered that {env:PATH} in set_env self-references and resolves to os.environ["PATH"] (the system PATH), not the tox-managed PATH. This means PATH = {env:PATH}:/test was replacing the entire tox-managed PATH with just <system PATH>:/test, dropping the virtual environment bin paths.

Fixed by re-prepending the virtual environment paths (self._paths) after set_env processing. The final PATH order is now:

1. Virtual environment paths (from self._paths) — always first
2. System PATH entries and any user modifications from set_env — deduplicated

All 17 tests in test_tox_env_api.py and all 33 tests in test_set_env.py pass.

Thanks for the review! Addressed both points:

1. Dedup preserved: Extracted _make_path_with(existing) which uses the same dict.fromkeys pattern as _make_path(). The original _make_path() now delegates to it.

2. Still using _make_path(): Yes — line 386 still calls self._make_path() to set the initial PATH. The new code only runs after set_env, and only when set_env actually modified PATH ("PATH" in set_env). It calls self._make_path_with(result["PATH"]) to re-prepend the venv paths using the same dedup logic.

3. Comment aligned to 120 chars.

Good point — inlined _make_path_with into _make_path with an optional existing parameter. No separate method needed.

Comment condensed per feedback. The type and type-min CI failures are pre-existing on main — ty can't resolve argcomplete (optional dep). All test, dev, docs, and pkg_meta checks pass.

Rebased on main, all tests pass. The only failures are type/type-min which also fail on main. Marked ready for re-review.

Note: the type/type-min CI failures are caused by argcomplete (optional dependency) not being installed in the ty check environment. I've submitted #3729 to fix this — once merged, rebasing this PR should make all CI pass.

Rebased on main (which now includes #3728). All CI checks pass — including type/type-min which were previously failing. Marking ready for review.