ci(windows): qualify the native Windows settlement Turn rendering

.github/workflows/python-tests.yml

@@ -890,6 +890,14 @@ jobs:
           python -m pytest -q
           tests/canary/test_repository_root.py::test_plan_renders_repository_paths_in_canonical_posix_form
 
+      - name: Qualify native Windows quota settlement Turn rendering
+        # The settlement plan renders the Turn reference for the host shell, so
+        # only a native Windows host can check that the generated command
+        # forwards $LOOPX_TURN instead of the POSIX-only ${LOOPX_TURN:?}.
+        run: >-
+          python -m pytest -q
+          tests/control_plane/test_quota_settlement.py::test_codex_app_windows_settlement_command_substitutes_powershell_turn
+
       - name: Qualify TypeScript shard paths on native Windows
         run: python -m pytest -q tests/test_python_ci_workflow.py::test_typescript_shards_select_every_test_file_exactly_once
 

tests/test_python_ci_workflow.py

@@ -355,6 +355,45 @@ def test_windows_lifecycle_suite_references_existing_tests() -> None:
     }
 
 
+# The settlement plan renders the Turn reference for the shell that runs it,
+# so only a native Windows host can observe that the generated command
+# forwards $LOOPX_TURN instead of the POSIX-only ${LOOPX_TURN:?}. The case is
+# guarded by ``skipif(os.name != "nt")``, so a lane that does not run the file
+# reports green while the Windows-only rendering stays unqualified.
+SETTLEMENT_TURN_SUITE = "tests/control_plane/test_quota_settlement.py"
+SETTLEMENT_TURN_NODE_ID = (
+    SETTLEMENT_TURN_SUITE
+    + "::test_codex_app_windows_settlement_command_substitutes_powershell_turn"
+)
+
+
+def test_windows_lane_qualifies_the_host_native_settlement_turn_rendering() -> None:
+    suite = WORKFLOW_ROOT / SETTLEMENT_TURN_SUITE
+    assert suite.is_file(), f"{SETTLEMENT_TURN_SUITE} is not a suite in this checkout"
+    assert 'skipif(os.name != "nt"' in suite.read_text(encoding="utf-8"), (
+        "the settlement Turn rendering case must stay native Windows only"
+    )
+
+    steps = yaml.safe_load(WORKFLOW)["jobs"]["windows-powershell"]["steps"]
+    step = next(
+        (
+            candidate
+            for candidate in steps
+            if candidate.get("name") == "Qualify native Windows quota settlement Turn rendering"
+        ),
+        None,
+    )
+    assert step is not None, "the native Windows settlement step is missing"
+    assert "if" not in step, "the native Windows settlement step must not be skipped"
+    assert "continue-on-error" not in step, (
+        "the native Windows settlement step must block the lane"
+    )
+    arguments = shlex.split(step["run"])
+    assert SETTLEMENT_TURN_NODE_ID in arguments, (
+        "the native Windows lane must run the exact settlement rendering case"
+    )
+
+
 def test_six_shards_execute_each_test_once_and_merge_portable_coverage(
     tmp_path: Path,
 ) -> None: