Record native ESO result and prepare scoped self-token amendment

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

tests/test_informed_decision_requester_metadata.py

@@ -82,6 +82,24 @@ class MetadataTests(unittest.TestCase):
         self.assertEqual(set(saved), {'sys/policies/acl/' + m.POLICY, m.ROLE})
         self.assertEqual([args[0] for args in calls], ['read', 'read', 'write', 'write', 'read', 'read'])
 
+    def test_exact_legacy_policy_upgrade_preserves_role(self):
+        saved, writes = [m.LEGACY_POLICY], []
+        def command(args, payload=None, **kwargs):
+            if args[0] == 'write':
+                writes.append(args[2]); saved[0] = json.loads(payload)['policy']; return {}
+            return {'data': {'policy': saved[0]}} if args[-1].startswith('sys/') else {'data': role()}
+        m.apply(m.EXPECTED_POLICY, {}, command=command)
+        self.assertEqual(writes, ['sys/policies/acl/' + m.POLICY])
+        self.assertEqual(saved[0], m.EXPECTED_POLICY)
+
+    def test_legacy_policy_upgrade_refuses_different_role_before_write(self):
+        calls = []
+        def command(args, **kwargs):
+            calls.append(args)
+            return {'data': {'policy': m.LEGACY_POLICY}} if args[-1].startswith('sys/') else {'data': dict(role(), audience='wrong')}
+        with self.assertRaises(m.Refused): m.apply(m.EXPECTED_POLICY, {}, command=command)
+        self.assertTrue(all(args[0] == 'read' for args in calls))
+
     def test_postwrite_role_drift_fails_verification(self):
         calls = []
         def command(args, payload=None, **kwargs):