diff --git a/README.md b/README.md
index 0b3dacc29..0ad7765c5 100644
--- a/README.md
+++ b/README.md
@@ -658,7 +658,7 @@ it. The usual fix is to re-run setup from that row's source for that host, e.g.
 A project install lives in the project's `.claude/skills/gstack` or
 `.agents/skills/gstack`; run its `setup` from inside the project.
 
-**`/browse` (or `/qa`, `/design-review`) says `NEEDS_ASIDE` or `ASIDE_NOT_RUNNING`?** That's the probe telling you it's about to use the fallback browser. Want Aside? Open the app and sign in — `aside --version` should print a version and `aside repl 'console.log("ok")'` should print `ok` — then re-run. gstack never installs it for you. Want the fallback on purpose while Aside is open? `GSTACK_SKIP_ASIDE=1` makes every skill, the renderer, and `./setup` treat Aside as absent.
+**`/browse` (or `/qa`, `/design-review`) says `NEEDS_ASIDE` or `ASIDE_NOT_RUNNING`?** That's the probe telling you it's about to use the fallback browser. Want Aside? Open the app and sign in — `aside --version` should print a version and `aside repl 'console.log("ok")'` should print `ok` — then re-run. gstack never installs it for you. Want the fallback on purpose while Aside is open? `GSTACK_SKIP_ASIDE=1` makes every skill, the renderer, and `./setup` treat Aside as absent. When Aside is absent the probe prints `NEEDS_ASIDE: <OS>` and skills trust that line for the macOS-only download pitch; `GSTACK_PLATFORM` overrides the OS it names, for tests and unusual hosts (set it in your shell — gstack never reads it from a project `.env`).
 
 **`/browse` fails on the fallback browser?** `cd ~/.claude/skills/gstack && bun install && bun run build`
 
diff --git a/benchmark/SKILL.md b/benchmark/SKILL.md
index be46080d2..e0c575bc7 100644
--- a/benchmark/SKILL.md
+++ b/benchmark/SKILL.md
@@ -162,7 +162,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -176,8 +176,8 @@ else
 fi
 ```
 
-1. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. `READY`: continue (a printed path runs in place of `aside`). `aside --help` and `aside <command> --help` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/browse/SKILL.md b/browse/SKILL.md
index 05d5f9673..60558ac65 100644
--- a/browse/SKILL.md
+++ b/browse/SKILL.md
@@ -167,7 +167,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -181,8 +181,8 @@ else
 fi
 ```
 
-1. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. `READY`: continue (a printed path runs in place of `aside`). `aside --help` and `aside <command> --help` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/canary/SKILL.md b/canary/SKILL.md
index 79dd17f05..f3c69664e 100644
--- a/canary/SKILL.md
+++ b/canary/SKILL.md
@@ -356,7 +356,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -370,8 +370,8 @@ else
 fi
 ```
 
-1. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. `READY`: continue (a printed path runs in place of `aside`). `aside --help` and `aside <command> --help` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/design-consultation/SKILL.md b/design-consultation/SKILL.md
index 97716578d..19992d9a8 100644
--- a/design-consultation/SKILL.md
+++ b/design-consultation/SKILL.md
@@ -478,7 +478,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -492,8 +492,8 @@ else
 fi
 ```
 
-1. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. `READY`: continue (a printed path runs in place of `aside`). `aside --help` and `aside <command> --help` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/design-review/SKILL.md b/design-review/SKILL.md
index 7b8eeb9bd..52cbbd7a9 100644
--- a/design-review/SKILL.md
+++ b/design-review/SKILL.md
@@ -443,7 +443,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -457,8 +457,8 @@ else
 fi
 ```
 
-1. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. `READY`: continue (a printed path runs in place of `aside`). `aside --help` and `aside <command> --help` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/devex-review/SKILL.md b/devex-review/SKILL.md
index e68d6b1ef..4ba861a82 100644
--- a/devex-review/SKILL.md
+++ b/devex-review/SKILL.md
@@ -431,7 +431,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -445,8 +445,8 @@ else
 fi
 ```
 
-1. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. `READY`: continue (a printed path runs in place of `aside`). `aside --help` and `aside <command> --help` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/investigate/SKILL.md b/investigate/SKILL.md
index 66c9fc273..7cc3e1633 100644
--- a/investigate/SKILL.md
+++ b/investigate/SKILL.md
@@ -522,7 +522,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
diff --git a/land-and-deploy/SKILL.md b/land-and-deploy/SKILL.md
index 7f06a2229..79f6280fa 100644
--- a/land-and-deploy/SKILL.md
+++ b/land-and-deploy/SKILL.md
@@ -380,14 +380,14 @@ Skills that run plan reviews (`/plan-*-review`, `/codex review`) include the EXI
 
 Some steps require action on a site the user controls: registering an API key, creating a vendor or developer account, configuring a dashboard, webhook, OAuth app, billing plan, or domain verification. This contract governs that moment. It grants no new browsing authority — the AskUserQuestion format and one-way-door rules remain binding, including approval before anything that spends money.
 
-1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it at runtime, every task, with the /browse skill's readiness probe:
+1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it every task with the /browse skill's readiness probe:
 
    ```bash
    _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
    elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
    _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
    if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-     echo "NEEDS_ASIDE"
+     echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
    else
      _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
      case "$_rc" in
@@ -401,7 +401,7 @@ Some steps require action on a site the user controls: registering an API key, c
    fi
    ```
 
-   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. User installs only: NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
+   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
 
 2. **One explicit question before any browsing.** Name the site and action. When Aside is detected, offer: A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer. When Aside is not detected, offer only the gstack drive / manual / defer options. Until a probe actually returns `READY`, omit the Aside drive option entirely; even a conditional offer is premature. The selection is per-task consent; never persist it as standing permission and never infer it from an earlier task.
 
@@ -420,7 +420,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -434,8 +434,8 @@ else
 fi
 ```
 
-1. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. `READY`: continue (a printed path runs in place of `aside`). `aside --help` and `aside <command> --help` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/office-hours/SKILL.md b/office-hours/SKILL.md
index b0380bf1f..49f509b0a 100644
--- a/office-hours/SKILL.md
+++ b/office-hours/SKILL.md
@@ -428,14 +428,14 @@ Skills that run plan reviews (`/plan-*-review`, `/codex review`) include the EXI
 
 Some steps require action on a site the user controls: registering an API key, creating a vendor or developer account, configuring a dashboard, webhook, OAuth app, billing plan, or domain verification. This contract governs that moment. It grants no new browsing authority — the AskUserQuestion format and one-way-door rules remain binding, including approval before anything that spends money.
 
-1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it at runtime, every task, with the /browse skill's readiness probe:
+1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it every task with the /browse skill's readiness probe:
 
    ```bash
    _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
    elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
    _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
    if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-     echo "NEEDS_ASIDE"
+     echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
    else
      _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
      case "$_rc" in
@@ -449,7 +449,7 @@ Some steps require action on a site the user controls: registering an API key, c
    fi
    ```
 
-   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. User installs only: NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
+   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
 
 2. **One explicit question before any browsing.** Name the site and action. When Aside is detected, offer: A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer. When Aside is not detected, offer only the gstack drive / manual / defer options. Until a probe actually returns `READY`, omit the Aside drive option entirely; even a conditional offer is premature. The selection is per-task consent; never persist it as standing permission and never infer it from an earlier task.
 
@@ -659,7 +659,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
diff --git a/plan-ceo-review/SKILL.md b/plan-ceo-review/SKILL.md
index b20dc59c7..ed339797d 100644
--- a/plan-ceo-review/SKILL.md
+++ b/plan-ceo-review/SKILL.md
@@ -488,7 +488,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
diff --git a/plan-devex-review/SKILL.md b/plan-devex-review/SKILL.md
index 33b5caf4c..e25a1a8f8 100644
--- a/plan-devex-review/SKILL.md
+++ b/plan-devex-review/SKILL.md
@@ -652,7 +652,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
diff --git a/plan-eng-review/SKILL.md b/plan-eng-review/SKILL.md
index 46dfa6b4a..552f92c44 100644
--- a/plan-eng-review/SKILL.md
+++ b/plan-eng-review/SKILL.md
@@ -512,7 +512,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
diff --git a/qa/sections/browser-setup.md b/qa/sections/browser-setup.md
index 1770453a3..5c3b3b426 100644
--- a/qa/sections/browser-setup.md
+++ b/qa/sections/browser-setup.md
@@ -31,7 +31,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -45,8 +45,8 @@ else
 fi
 ```
 
-1. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. `READY`: continue (a printed path runs in place of `aside`). `aside --help` and `aside <command> --help` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/review/SKILL.md b/review/SKILL.md
index 3b8d78ec1..435b1bc82 100644
--- a/review/SKILL.md
+++ b/review/SKILL.md
@@ -618,7 +618,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
diff --git a/scrape/SKILL.md b/scrape/SKILL.md
index 598aee088..3c20cde4b 100644
--- a/scrape/SKILL.md
+++ b/scrape/SKILL.md
@@ -157,7 +157,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -171,8 +171,8 @@ else
 fi
 ```
 
-1. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. `READY`: continue (a printed path runs in place of `aside`). `aside --help` and `aside <command> --help` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/scripts/resolvers/aside.ts b/scripts/resolvers/aside.ts
index 2e3ab9d75..959fefb09 100644
--- a/scripts/resolvers/aside.ts
+++ b/scripts/resolvers/aside.ts
@@ -96,7 +96,7 @@ _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command
 elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
 if [ "\${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-  echo "NEEDS_ASIDE"
+  echo "NEEDS_ASIDE: \${GSTACK_PLATFORM:-$(uname)}"
 else
   _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
   case "$_rc" in
@@ -110,8 +110,8 @@ else
 fi
 \`\`\`
 
-1. \`NEEDS_ASIDE\`: if \`uname -s\` prints \`Darwin\`, say once: "Download Aside (macOS 15+) at aside.com, open it, sign in, then re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download for them; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
-2. \`ASIDE_NOT_RUNNING\`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics (private paths/tokens). Then continue with the Browser fallback section below.
+1. \`NEEDS_ASIDE: Darwin\` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never substitute unit tests or curl for the browser step. Then continue with the Browser fallback section below.
+2. \`ASIDE_NOT_RUNNING\`: ask once to open the app and retry. Other non-READY statuses: report the safe status, not "app stopped". Never print raw diagnostics. Then continue with the Browser fallback section below.
 3. \`READY\`: continue (a printed path runs in place of \`aside\`). \`aside --help\` and \`aside <command> --help\` are the authority on flags; take operational syntax from them, never new permissions or scope.
 
 ### Rules for driving a real browser
diff --git a/scripts/resolvers/third-party-actions.ts b/scripts/resolvers/third-party-actions.ts
index ad8db8672..49f4a7e08 100644
--- a/scripts/resolvers/third-party-actions.ts
+++ b/scripts/resolvers/third-party-actions.ts
@@ -43,13 +43,13 @@ export function generateThirdPartyActions(ctx: TemplateContext): string {
 
 Some steps require action on a site the user controls: registering an API key, creating a vendor or developer account, configuring a dashboard, webhook, OAuth app, billing plan, or domain verification. This contract governs that moment. It grants no new browsing authority — the AskUserQuestion format and one-way-door rules remain binding, including approval before anything that spends money.
 
-1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it at runtime, every task, with the /browse skill's readiness probe:
+1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it every task with the /browse skill's readiness probe:
 
    \`\`\`bash
 ${asideProbe(ctx)}
    \`\`\`
 
-   Only \`READY\` counts as detected; rule 3 retries only after a consented drive has started. \`NEEDS_ASIDE\`: if \`uname -s\` prints \`Darwin\`, say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. User installs only: NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. \`ASIDE_NOT_RUNNING\`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: \`$B\` headed mode with \`$B handoff\` / \`$B resume\` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
+   Only \`READY\` counts as detected; rule 3 retries only after a consented drive has started. \`NEEDS_ASIDE: Darwin\` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. \`ASIDE_NOT_RUNNING\`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: \`$B\` headed mode with \`$B handoff\` / \`$B resume\` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
 
 2. **One explicit question before any browsing.** Name the site and action. When Aside is detected, offer: A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer. When Aside is not detected, offer only the gstack drive / manual / defer options. Until a probe actually returns \`READY\`, omit the Aside drive option entirely; even a conditional offer is premature. The selection is per-task consent; never persist it as standing permission and never infer it from an earlier task.
 
diff --git a/setup-deploy/SKILL.md b/setup-deploy/SKILL.md
index e3fb0a359..b00fee176 100644
--- a/setup-deploy/SKILL.md
+++ b/setup-deploy/SKILL.md
@@ -354,14 +354,14 @@ Skills that run plan reviews (`/plan-*-review`, `/codex review`) include the EXI
 
 Some steps require action on a site the user controls: registering an API key, creating a vendor or developer account, configuring a dashboard, webhook, OAuth app, billing plan, or domain verification. This contract governs that moment. It grants no new browsing authority — the AskUserQuestion format and one-way-door rules remain binding, including approval before anything that spends money.
 
-1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it at runtime, every task, with the /browse skill's readiness probe:
+1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it every task with the /browse skill's readiness probe:
 
    ```bash
    _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
    elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
    _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
    if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-     echo "NEEDS_ASIDE"
+     echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
    else
      _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
      case "$_rc" in
@@ -375,7 +375,7 @@ Some steps require action on a site the user controls: registering an API key, c
    fi
    ```
 
-   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. User installs only: NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
+   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
 
 2. **One explicit question before any browsing.** Name the site and action. When Aside is detected, offer: A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer. When Aside is not detected, offer only the gstack drive / manual / defer options. Until a probe actually returns `READY`, omit the Aside drive option entirely; even a conditional offer is premature. The selection is per-task consent; never persist it as standing permission and never infer it from an earlier task.
 
diff --git a/ship/SKILL.md b/ship/SKILL.md
index 4984fb1d0..0cca3fe07 100644
--- a/ship/SKILL.md
+++ b/ship/SKILL.md
@@ -385,14 +385,14 @@ Skills that run plan reviews (`/plan-*-review`, `/codex review`) include the EXI
 
 Some steps require action on a site the user controls: registering an API key, creating a vendor or developer account, configuring a dashboard, webhook, OAuth app, billing plan, or domain verification. This contract governs that moment. It grants no new browsing authority — the AskUserQuestion format and one-way-door rules remain binding, including approval before anything that spends money.
 
-1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it at runtime, every task, with the /browse skill's readiness probe:
+1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it every task with the /browse skill's readiness probe:
 
    ```bash
    _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
    elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
    _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
    if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-     echo "NEEDS_ASIDE"
+     echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
    else
      _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
      case "$_rc" in
@@ -406,7 +406,7 @@ Some steps require action on a site the user controls: registering an API key, c
    fi
    ```
 
-   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. User installs only: NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
+   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
 
 2. **One explicit question before any browsing.** Name the site and action. When Aside is detected, offer: A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer. When Aside is not detected, offer only the gstack drive / manual / defer options. Until a probe actually returns `READY`, omit the Aside drive option entirely; even a conditional offer is premature. The selection is per-task consent; never persist it as standing permission and never infer it from an earlier task.
 
diff --git a/spec/SKILL.md b/spec/SKILL.md
index 4a18fe5c1..758be4b00 100644
--- a/spec/SKILL.md
+++ b/spec/SKILL.md
@@ -383,14 +383,14 @@ Skills that run plan reviews (`/plan-*-review`, `/codex review`) include the EXI
 
 Some steps require action on a site the user controls: registering an API key, creating a vendor or developer account, configuring a dashboard, webhook, OAuth app, billing plan, or domain verification. This contract governs that moment. It grants no new browsing authority — the AskUserQuestion format and one-way-door rules remain binding, including approval before anything that spends money.
 
-1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it at runtime, every task, with the /browse skill's readiness probe:
+1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it every task with the /browse skill's readiness probe:
 
    ```bash
    _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
    elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
    _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
    if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-     echo "NEEDS_ASIDE"
+     echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
    else
      _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
      case "$_rc" in
@@ -404,7 +404,7 @@ Some steps require action on a site the user controls: registering an API key, c
    fi
    ```
 
-   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. User installs only: NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
+   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
 
 2. **One explicit question before any browsing.** Name the site and action. When Aside is detected, offer: A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer. When Aside is not detected, offer only the gstack drive / manual / defer options. Until a probe actually returns `READY`, omit the Aside drive option entirely; even a conditional offer is premature. The selection is per-task consent; never persist it as standing permission and never infer it from an earlier task.
 
diff --git a/test/aside-driver.test.ts b/test/aside-driver.test.ts
index 35a833ef5..53b4c88d8 100644
--- a/test/aside-driver.test.ts
+++ b/test/aside-driver.test.ts
@@ -59,7 +59,7 @@ describe('Aside driver contract ({{ASIDE_SETUP}})', () => {
     expect(section).toContain('NEVER run an installer');
     expect(section).toContain('never substitute unit tests or curl for the browser step');
     // The pitch is macOS-only; both non-READY outcomes continue into the fallback instead of stopping.
-    expect(section).toContain('`uname -s` prints `Darwin`');
+    expect(section).toContain("`NEEDS_ASIDE: Darwin` (trust it; don't re-probe)");
     expect(section).toContain('Off macOS, do not pitch it');
     expect(section.match(/continue with the Browser fallback section below/g)).toHaveLength(2);
     expect(section).not.toContain('or a headless browser for the browser step');
@@ -124,7 +124,7 @@ describe('Aside driver contract ({{ASIDE_SETUP}})', () => {
     // Opt-out short-circuits to NEEDS_ASIDE before `command -v aside` is even consulted.
     // E7 (#2902): the installer's ~/.local/bin is not on the default macOS PATH, so the probe falls back to it.
     expect(setupProbe).toContain('_A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)');
-    expect(setupProbe).toMatch(/if \[ "\$\{GSTACK_SKIP_ASIDE:-\}" = "1" \] \|\| \[ -z "\$_A" \]; then\n\s*echo "NEEDS_ASIDE"/);
+    expect(setupProbe).toMatch(/if \[ "\$\{GSTACK_SKIP_ASIDE:-\}" = "1" \] \|\| \[ -z "\$_A" \]; then\n\s*echo "NEEDS_ASIDE: \$\{GSTACK_PLATFORM:-\$\(uname\)\}"/);
     // Deadline chain: gtimeout (coreutils on macOS) → timeout (Linux) → perl alarm (stock macOS ships neither).
     expect(setupProbe).toContain('gtimeout 30 "$@"');
     expect(setupProbe).toContain('timeout 30 "$@"');
@@ -215,10 +215,10 @@ describe('Aside driver contract ({{ASIDE_SETUP}})', () => {
       }
       // Both ways out stay reachable: opted out, and Aside not installed (empty PATH dir).
       const sh = shells[0];
-      const optOut = spawnSync(sh, ['-c', setupProbe], { env: { PATH: base, GSTACK_SKIP_ASIDE: '1' }, encoding: 'utf8', timeout: 30_000 });
-      expect(optOut.stdout.trim()).toBe('NEEDS_ASIDE');
-      const noAside = spawnSync(sh, ['-c', setupProbe], { env: { PATH: shellPath(path.join(dir, 'gt')) }, encoding: 'utf8', timeout: 30_000 });
-      expect(noAside.stdout.trim()).toBe('NEEDS_ASIDE');
+      const optOut = spawnSync(sh, ['-c', setupProbe], { env: { PATH: base, GSTACK_SKIP_ASIDE: '1', GSTACK_PLATFORM: 'Darwin' }, encoding: 'utf8', timeout: 30_000 });
+      expect(optOut.stdout.trim()).toBe('NEEDS_ASIDE: Darwin');
+      const noAside = spawnSync(sh, ['-c', setupProbe], { env: { PATH: shellPath(path.join(dir, 'gt')), GSTACK_PLATFORM: 'Linux' }, encoding: 'utf8', timeout: 30_000 });
+      expect(noAside.stdout.trim()).toBe('NEEDS_ASIDE: Linux');
       // E7 (#2902): installed only at ~/.local/bin (not on the macOS login PATH) is still found, and named.
       const home = path.join(dir, 'home');
       write(path.join(home, '.local', 'bin', 'aside'), '#!/bin/sh\necho "ASIDE_READY /tmp/x"\n');
diff --git a/test/aside-probe-shell.test.ts b/test/aside-probe-shell.test.ts
index 64f9d48a9..27dec03ff 100644
--- a/test/aside-probe-shell.test.ts
+++ b/test/aside-probe-shell.test.ts
@@ -15,7 +15,7 @@ const launchers = {
   perl: Bun.which('perl'),
 };
 
-function run(shell: string, arm: keyof typeof launchers | 'none', mode = 'ready', skip = false) {
+function run(shell: string, arm: keyof typeof launchers | 'none', mode = 'ready', skip = false, platform = 'Darwin') {
   const root = mkdtempSync(join(tmpdir(), 'aside-probe-'));
   const bin = join(root, 'bin');
   mkdirSync(bin);
@@ -23,6 +23,7 @@ function run(shell: string, arm: keyof typeof launchers | 'none', mode = 'ready'
     const executable = Bun.which(shell);
     if (!executable) throw new Error(`Required shell unavailable: ${shell}`);
     symlinkSync(Bun.which('grep')!, join(bin, 'grep'));
+    symlinkSync(Bun.which('uname')!, join(bin, 'uname'));
     if (arm !== 'none') symlinkSync(launchers[arm]!, join(bin, arm));
     if (mode !== 'absent') writeFileSync(join(bin, 'aside'), `#!/bin/sh
 printf '%s\\n' "$@" >> "$CALLS"
@@ -40,7 +41,7 @@ esac
     const script = mode === 'hang' ? probe.replaceAll('30 "$@"', '1 "$@"') : probe;
     const result = spawnSync(executable, ['-c', script], {
       encoding: 'utf8', timeout: 5000,
-      env: { HOME: root, PATH: bin, MODE: mode, CALLS: join(root, 'calls'), GSTACK_SKIP_ASIDE: skip ? '1' : '' },
+      env: { HOME: root, PATH: bin, MODE: mode, CALLS: join(root, 'calls'), GSTACK_SKIP_ASIDE: skip ? '1' : '', ...(platform ? { GSTACK_PLATFORM: platform } : {}) },
     });
     let calls = '';
     try { calls = readFileSync(join(root, 'calls'), 'utf8'); } catch {}
@@ -62,10 +63,15 @@ describe('emitted Aside readiness probe', () => {
         expect(result.calls).toBe('');
       }
       for (const result of [run(shell, 'none', 'absent'), run(shell, 'none', 'ready', true)]) {
-        expect(result.output).toBe('NEEDS_ASIDE\n');
+        expect(result.output).toBe('NEEDS_ASIDE: Darwin\n');
         expect(result.calls).toBe('');
       }
     });
+    shellTest(`${shell}: NEEDS_ASIDE names GSTACK_PLATFORM, else the kernel uname reports`, () => {
+      expect(run(shell, 'none', 'absent', false, 'Linux').output).toBe('NEEDS_ASIDE: Linux\n');
+      const kernel = spawnSync('uname', [], { encoding: 'utf8' }).stdout.trim();
+      expect(run(shell, 'none', 'absent', false, '').output).toBe(`NEEDS_ASIDE: ${kernel}\n`);
+    });
     for (const arm of ['gtimeout', 'timeout', 'perl'] as const) {
       const armTest = Bun.which(shell) && launchers[arm] ? test : test.skip;
       armTest(`${shell}/${arm}: forwards the complete script as one argument`, () => {
@@ -81,7 +87,7 @@ describe('emitted Aside readiness probe', () => {
       });
       armTest(`${shell}/${arm}: absent and skipped never invoke Aside`, () => {
         for (const result of [run(shell, arm, 'absent'), run(shell, arm, 'ready', true)]) {
-          expect(result.output).toBe('NEEDS_ASIDE\n');
+          expect(result.output).toBe('NEEDS_ASIDE: Darwin\n');
           expect(result.calls).toBe('');
         }
       });
diff --git a/test/fixtures/context-budget.json b/test/fixtures/context-budget.json
index b50ac9434..fad4bb89e 100644
--- a/test/fixtures/context-budget.json
+++ b/test/fixtures/context-budget.json
@@ -3,22 +3,22 @@
   "alwaysOnTotal": 6892,
   "eagerPerInvocation": {
     "autoplan": 16511,
-    "benchmark": 7702,
+    "benchmark": 7701,
     "benchmark-models": 3825,
-    "browse": 8168,
+    "browse": 8166,
     "browser-skills/hackernews-frontpage": 371,
-    "canary": 13358,
+    "canary": 13356,
     "careful": 976,
     "codex": 15204,
     "context-restore": 10531,
     "context-save": 10376,
     "cso": 4702,
-    "design-consultation": 15728,
+    "design-consultation": 15726,
     "design-html": 14387,
-    "design-review": 34745,
+    "design-review": 34744,
     "design-shotgun": 14419,
     "deslop-shared-libs": 3419,
-    "devex-review": 19363,
+    "devex-review": 19362,
     "diagram": 4271,
     "document-generate": 11696,
     "document-release": 10059,
@@ -27,37 +27,37 @@
     "gstack-upgrade": 5708,
     "guard": 963,
     "health": 11408,
-    "investigate": 12122,
+    "investigate": 12130,
     "ios-clean": 8167,
     "ios-design-review": 8364,
     "ios-fix": 8056,
     "ios-qa": 10874,
     "ios-sync": 8182,
-    "land-and-deploy": 18840,
+    "land-and-deploy": 18839,
     "landing-report": 8879,
     "learn": 8595,
     "make-pdf": 5274,
-    "office-hours": 23428,
+    "office-hours": 23436,
     "open-gstack-browser": 4863,
     "openclaw/skills/gstack-openclaw-ceo-review": 2764,
     "openclaw/skills/gstack-openclaw-investigate": 1429,
     "openclaw/skills/gstack-openclaw-office-hours": 4433,
     "openclaw/skills/gstack-openclaw-retro": 2542,
     "pair-agent": 10990,
-    "plan-ceo-review": 20303,
+    "plan-ceo-review": 20311,
     "plan-design-review": 21019,
-    "plan-devex-review": 17108,
-    "plan-eng-review": 12904,
+    "plan-devex-review": 17116,
+    "plan-eng-review": 12912,
     "plan-tune": 14585,
     "qa": 13273,
     "qa-only": 11346,
     "retro": 18694,
-    "review": 19301,
-    "scrape": 6903,
+    "review": 19309,
+    "scrape": 6901,
     "setup-browser-cookies": 3510,
     "setup-deploy": 11219,
     "setup-gbrain": 15279,
-    "ship": 20458,
+    "ship": 20459,
     "skillify": 11535,
     "spec": 14423,
     "sync-gbrain": 14937,
diff --git a/test/fixtures/golden/claude-ship-SKILL.md b/test/fixtures/golden/claude-ship-SKILL.md
index 4984fb1d0..0cca3fe07 100644
--- a/test/fixtures/golden/claude-ship-SKILL.md
+++ b/test/fixtures/golden/claude-ship-SKILL.md
@@ -385,14 +385,14 @@ Skills that run plan reviews (`/plan-*-review`, `/codex review`) include the EXI
 
 Some steps require action on a site the user controls: registering an API key, creating a vendor or developer account, configuring a dashboard, webhook, OAuth app, billing plan, or domain verification. This contract governs that moment. It grants no new browsing authority — the AskUserQuestion format and one-way-door rules remain binding, including approval before anything that spends money.
 
-1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it at runtime, every task, with the /browse skill's readiness probe:
+1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it every task with the /browse skill's readiness probe:
 
    ```bash
    _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
    elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
    _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
    if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-     echo "NEEDS_ASIDE"
+     echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
    else
      _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
      case "$_rc" in
@@ -406,7 +406,7 @@ Some steps require action on a site the user controls: registering an API key, c
    fi
    ```
 
-   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. User installs only: NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
+   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
 
 2. **One explicit question before any browsing.** Name the site and action. When Aside is detected, offer: A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer. When Aside is not detected, offer only the gstack drive / manual / defer options. Until a probe actually returns `READY`, omit the Aside drive option entirely; even a conditional offer is premature. The selection is per-task consent; never persist it as standing permission and never infer it from an earlier task.
 
diff --git a/test/fixtures/golden/codex-ship-SKILL.md b/test/fixtures/golden/codex-ship-SKILL.md
index d395cd454..228888ba6 100644
--- a/test/fixtures/golden/codex-ship-SKILL.md
+++ b/test/fixtures/golden/codex-ship-SKILL.md
@@ -400,14 +400,14 @@ Skills that run plan reviews (`/plan-*-review`, `/codex review`) include the EXI
 
 Some steps require action on a site the user controls: registering an API key, creating a vendor or developer account, configuring a dashboard, webhook, OAuth app, billing plan, or domain verification. This contract governs that moment. It grants no new browsing authority — the AskUserQuestion format and one-way-door rules remain binding, including approval before anything that spends money.
 
-1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it at runtime, every task, with the /browse skill's readiness probe:
+1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it every task with the /browse skill's readiness probe:
 
    ```bash
    _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
    elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
    _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
    if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-     echo "NEEDS_ASIDE"
+     echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
    else
      _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
      case "$_rc" in
@@ -421,7 +421,7 @@ Some steps require action on a site the user controls: registering an API key, c
    fi
    ```
 
-   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. User installs only: NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
+   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
 
 2. **One explicit question before any browsing.** Name the site and action. When Aside is detected, offer: A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer. When Aside is not detected, offer only the gstack drive / manual / defer options. Until a probe actually returns `READY`, omit the Aside drive option entirely; even a conditional offer is premature. The selection is per-task consent; never persist it as standing permission and never infer it from an earlier task.
 
diff --git a/test/fixtures/golden/factory-ship-SKILL.md b/test/fixtures/golden/factory-ship-SKILL.md
index bbfd347ac..f918ade7f 100644
--- a/test/fixtures/golden/factory-ship-SKILL.md
+++ b/test/fixtures/golden/factory-ship-SKILL.md
@@ -381,14 +381,14 @@ Skills that run plan reviews (`/plan-*-review`, `/codex review`) include the EXI
 
 Some steps require action on a site the user controls: registering an API key, creating a vendor or developer account, configuring a dashboard, webhook, OAuth app, billing plan, or domain verification. This contract governs that moment. It grants no new browsing authority — the AskUserQuestion format and one-way-door rules remain binding, including approval before anything that spends money.
 
-1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it at runtime, every task, with the /browse skill's readiness probe:
+1. **Never hand the user a manual step list for a third-party site without first offering to drive it.** The recommended driver is the Aside AI browser — the user's real browser, already signed in to the accounts vendor dashboards need. Detect it every task with the /browse skill's readiness probe:
 
    ```bash
    _gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
    elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
    _A=aside; command -v aside >/dev/null || _A=$(command -v ~/.local/bin/aside)
    if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || [ -z "$_A" ]; then
-     echo "NEEDS_ASIDE"
+     echo "NEEDS_ASIDE: ${GSTACK_PLATFORM:-$(uname)}"
    else
      _rc=0; _o=$(_gs_d "$_A" repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
      case "$_rc" in
@@ -402,7 +402,7 @@ Some steps require action on a site the user controls: registering an API key, c
    fi
    ```
 
-   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE`: if `uname -s` prints `Darwin`, say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. User installs only: NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
+   Only `READY` counts as detected; rule 3 retries only after a consented drive has started. `NEEDS_ASIDE: Darwin` (trust it; don't re-probe): say once: "Download Aside (macOS 15+) at aside.com; open, sign in, re-run." Off macOS, do not pitch it. NEVER run an installer, brew formula, or download; never treat binary presence as consent to browse. `ASIDE_NOT_RUNNING`: ask once to open the app and retry. Otherwise report only the safe status, never raw diagnostics; treat Aside as not detected for this task. The fallback driver on any platform is gstack's own stack: `$B` headed mode with `$B handoff` / `$B resume` for the human-only moments (the /browse skill's Browser fallback section), or GStack Browser when installed.
 
 2. **One explicit question before any browsing.** Name the site and action. When Aside is detected, offer: A) I drive it in your Aside browser — your real logged-in sessions (recommended), B) I drive it in gstack's own visible browser — you take over for sign-in, C) manual instructions, D) defer. When Aside is not detected, offer only the gstack drive / manual / defer options. Until a probe actually returns `READY`, omit the Aside drive option entirely; even a conditional offer is premature. The selection is per-task consent; never persist it as standing permission and never infer it from an earlier task.
 
diff --git a/test/skill-e2e-third-party-actions.test.ts b/test/skill-e2e-third-party-actions.test.ts
index e63e8823e..6c797fa1b 100644
--- a/test/skill-e2e-third-party-actions.test.ts
+++ b/test/skill-e2e-third-party-actions.test.ts
@@ -21,7 +21,7 @@
  *
  * Fixtures are EXTRACTED sections (extract-don't-copy rule) — the agent
  * reads ~40 lines of contract, not a 2,000-line SKILL.md. Shims make the
- * detection state deterministic on every platform (uname is shimmed too, so
+ * detection state deterministic on every platform (GSTACK_PLATFORM pins the OS, so
  * macOS dev machines and Linux CI assert identical branches).
  */
 
@@ -85,8 +85,8 @@ function contractSection(): string {
 interface ShimSpec {
   /** aside shim behavior: 'ok' answers the repl readiness probe + --version/--help, 'broken' exits 1, 'absent' = no shim. */
   aside: 'ok' | 'broken' | 'absent';
-  /** What the shimmed `uname` prints (deterministic across dev/CI platforms). */
-  uname: 'Darwin' | 'Linux';
+  /** GSTACK_PLATFORM for the probe's NEEDS_ASIDE line (deterministic across dev/CI hosts). */
+  platform: 'Darwin' | 'Linux';
 }
 
 /** Build a shim dir + workDir with the extracted contract; returns paths + env. */
@@ -110,14 +110,6 @@ function setupCase(spec: ShimSpec, extraDocs: Record<string, string> = {}) {
         : '#!/bin/sh\necho "aside: daemon not reachable — make sure Aside Browser is running" >&2\nexit 1\n';
       fs.writeFileSync(path.join(shimDir, 'aside'), body, { mode: 0o755 });
     }
-    const kernel = spec.uname === 'Darwin'
-      ? { release: '24.6.0', machine: 'arm64' }
-      : { release: '6.8.0-79-generic', machine: 'x86_64' };
-    fs.writeFileSync(
-      path.join(shimDir, 'uname'),
-      `#!/bin/sh\ncase "$1" in\n  -r) echo "${kernel.release}" ;;\n  -m|-p) echo "${kernel.machine}" ;;\n  -n) echo "devbox" ;;\n  -a) echo "${spec.uname} devbox ${kernel.release} ${kernel.machine}" ;;\n  *) echo "${spec.uname}" ;;\nesac\n`,
-      { mode: 0o755 },
-    );
 
     fs.writeFileSync(path.join(workDir, 'third-party-actions.md'), contractSection());
     for (const [name, content] of Object.entries(extraDocs)) {
@@ -151,7 +143,9 @@ function setupCase(spec: ShimSpec, extraDocs: Record<string, string> = {}) {
 
     return {
       workDir,
-      env: { PATH: childPath },
+      // The probe's NEEDS_ASIDE line names this platform; a uname shim was
+      // checked against /proc/version and the real kernel (census 37179171083).
+      env: { PATH: childPath, GSTACK_PLATFORM: spec.platform },
       cleanup: removeAll,
     };
   } catch (error) {
@@ -191,7 +185,7 @@ describeIfSelected('third-party-actions consent gate', [
 ], () => {
   // aside present → the consent question offers the Aside drive.
   testIfSelected('tpa-present', async () => recordAttempt('tpa-present', async run => {
-    const { workDir, env, cleanup } = setupCase({ aside: 'ok', uname: 'Darwin' });
+    const { workDir, env, cleanup } = setupCase({ aside: 'ok', platform: 'Darwin' });
     try {
       const result = await run({
         ...COMMON, env, prompt: CONSENT_PROMPT, workingDirectory: workDir,
@@ -212,7 +206,7 @@ describeIfSelected('third-party-actions consent gate', [
 
   // aside absent on Linux → gstack drive / manual / defer, ZERO download pitch.
   testIfSelected('tpa-absent-linux', async () => recordAttempt('tpa-absent-linux', async run => {
-    const { workDir, env, cleanup } = setupCase({ aside: 'absent', uname: 'Linux' });
+    const { workDir, env, cleanup } = setupCase({ aside: 'absent', platform: 'Linux' });
     try {
       const result = await run({
         ...COMMON, env, prompt: CONSENT_PROMPT, workingDirectory: workDir,
@@ -238,7 +232,7 @@ describeIfSelected('third-party-actions consent gate', [
   // treats Aside as not detected (gstack drive / manual / defer). Never an
   // Aside drive offer.
   testIfSelected('tpa-broken', async () => recordAttempt('tpa-broken', async run => {
-    const { workDir, env, cleanup } = setupCase({ aside: 'broken', uname: 'Linux' });
+    const { workDir, env, cleanup } = setupCase({ aside: 'broken', platform: 'Linux' });
     try {
       const result = await run({
         ...COMMON, env, prompt: CONSENT_PROMPT, workingDirectory: workDir,
@@ -259,10 +253,10 @@ describeIfSelected('third-party-actions consent gate', [
     } finally { cleanup(); }
   }), 6 * 60_000);
 
-  // aside absent, uname says Darwin → the download pitch appears exactly
+  // aside absent, platform Darwin → the download pitch appears exactly
   // once and names the macOS 15+ floor.
   testIfSelected('tpa-absent-darwin', async () => recordAttempt('tpa-absent-darwin', async run => {
-    const { workDir, env, cleanup } = setupCase({ aside: 'absent', uname: 'Darwin' });
+    const { workDir, env, cleanup } = setupCase({ aside: 'absent', platform: 'Darwin' });
     try {
       const result = await run({
         ...COMMON, env, prompt: CONSENT_PROMPT, workingDirectory: workDir,
@@ -288,7 +282,7 @@ describeIfSelected('third-party-actions consent gate', [
       path.join(ROOT, 'ship', 'sections', 'apple-release.md'), 'utf-8',
     );
     const { workDir, env, cleanup } = setupCase(
-      { aside: 'ok', uname: 'Darwin' },
+      { aside: 'ok', platform: 'Darwin' },
       { 'apple-release.md': appleRelease },
     );
     try {
diff --git a/test/third-party-actions.test.ts b/test/third-party-actions.test.ts
index c227207bf..8c0d0ce16 100644
--- a/test/third-party-actions.test.ts
+++ b/test/third-party-actions.test.ts
@@ -194,7 +194,7 @@ describe("THIRD_PARTY_ACTIONS contract pins", () => {
     // conditional, never a bare `timeout N aside` invocation.
     expect(section).toContain("command -v gtimeout");
     expect(section).not.toMatch(/\btimeout \d+ aside/);
-    expect(section).toContain("`uname -s` prints `Darwin`");
+    expect(section).toContain("`NEEDS_ASIDE: Darwin` (trust it; don't re-probe)");
     expect(section).toContain("Off macOS, do not pitch it");
   });