diff --git a/make-pdf/test/e2e/diagram-gate.test.ts b/make-pdf/test/e2e/diagram-gate.test.ts
index 459172b0e..a3473592a 100644
--- a/make-pdf/test/e2e/diagram-gate.test.ts
+++ b/make-pdf/test/e2e/diagram-gate.test.ts
@@ -164,7 +164,10 @@ describe("diagram render gate", () => {
 
   if (!avail.ok) {
     test("diagram gate prerequisites are present (hard-required in CI)", () => {
-      if (process.env.CI) {
+      // Hard-require only where the binary is expected: the make-pdf gate
+      // workflow is macOS-only (path-filtered) and builds dist/pdf first.
+      // The Linux free lane deliberately doesn't build it — warn-skip there.
+      if (process.env.CI && process.platform === 'darwin') {
         throw new Error(`diagram gate prerequisites missing in CI: ${avail.reason}`);
       }
       console.warn(`[skip] ${avail.reason}`);
diff --git a/make-pdf/test/e2e/emoji-gate.test.ts b/make-pdf/test/e2e/emoji-gate.test.ts
index 0e3a42c29..794d25f8b 100644
--- a/make-pdf/test/e2e/emoji-gate.test.ts
+++ b/make-pdf/test/e2e/emoji-gate.test.ts
@@ -188,7 +188,10 @@ describe("emoji render gate", () => {
     // In CI, missing prerequisites are a hard failure — a silent skip would let
     // the Linux tofu regression ship behind a green build. Locally, just warn.
     test("emoji gate prerequisites are present (hard-required in CI)", () => {
-      if (process.env.CI) {
+      // Hard-require only where the binary is expected: the make-pdf gate
+      // workflow is macOS-only (path-filtered) and builds dist/pdf first.
+      // The Linux free lane deliberately doesn't build it — warn-skip there.
+      if (process.env.CI && process.platform === 'darwin') {
         throw new Error(`emoji gate prerequisites missing in CI: ${avail.reason}`);
       }
       console.warn(`[skip] ${avail.reason}`);
diff --git a/make-pdf/test/e2e/format-gate.test.ts b/make-pdf/test/e2e/format-gate.test.ts
index e5f399b8f..37e41837b 100644
--- a/make-pdf/test/e2e/format-gate.test.ts
+++ b/make-pdf/test/e2e/format-gate.test.ts
@@ -122,7 +122,10 @@ describe("output format gate", () => {
 
   if (!avail.ok) {
     test("format gate prerequisites are present (hard-required in CI)", () => {
-      if (process.env.CI) {
+      // Hard-require only where the binary is expected: the make-pdf gate
+      // workflow is macOS-only (path-filtered) and builds dist/pdf first.
+      // The Linux free lane deliberately doesn't build it — warn-skip there.
+      if (process.env.CI && process.platform === 'darwin') {
         throw new Error(`format gate prerequisites missing in CI: ${avail.reason}`);
       }
       console.warn(`[skip] ${avail.reason}`);
diff --git a/make-pdf/test/e2e/landscape-gate.test.ts b/make-pdf/test/e2e/landscape-gate.test.ts
index 949a7fed6..91c4f645d 100644
--- a/make-pdf/test/e2e/landscape-gate.test.ts
+++ b/make-pdf/test/e2e/landscape-gate.test.ts
@@ -127,7 +127,10 @@ describe("landscape promotion gate", () => {
 
   if (!avail.ok) {
     test("landscape gate prerequisites are present (hard-required in CI)", () => {
-      if (process.env.CI) {
+      // Hard-require only where the binary is expected: the make-pdf gate
+      // workflow is macOS-only (path-filtered) and builds dist/pdf first.
+      // The Linux free lane deliberately doesn't build it — warn-skip there.
+      if (process.env.CI && process.platform === 'darwin') {
         throw new Error(`landscape gate prerequisites missing in CI: ${avail.reason}`);
       }
       console.warn(`[skip] ${avail.reason}`);
diff --git a/test/gbrain-detect-install.test.ts b/test/gbrain-detect-install.test.ts
index b9c82c155..725eb9bdc 100644
--- a/test/gbrain-detect-install.test.ts
+++ b/test/gbrain-detect-install.test.ts
@@ -25,7 +25,16 @@ const INSTALL = path.join(ROOT, 'bin', 'gstack-gbrain-install');
 // dirs — this keeps `gbrain` out of PATH deterministically across dev machines
 // while still finding jq, git, curl, sed, cat, etc. Each test can prepend a
 // fake-gbrain dir when it wants to simulate presence.
-const SAFE_PATH = '/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin:/usr/local/bin';
+// Deterministic PATH for spawned children — but it must still contain the
+// bun runtime itself: the bin's `#!/usr/bin/env -S bun run` shebang resolves
+// bun from PATH, and CI installs bun outside the standard dirs (~/.bun/bin),
+// which made every spawn exit 127 on the first Linux run. Appending bun's
+// REAL dir would leak its siblings (a dev box keeps gbrain in ~/.bun/bin
+// too, breaking every "no gbrain on PATH" case) — so a scratch dir holds a
+// symlink to bun and nothing else.
+const BUN_ONLY_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'bun-only-'));
+fs.symlinkSync(process.execPath, path.join(BUN_ONLY_DIR, 'bun'));
+const SAFE_PATH = `/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin:/usr/local/bin:${BUN_ONLY_DIR}`;
 
 let tmpHome: string;
 let tmpHomeReal: string;
diff --git a/test/host-config.test.ts b/test/host-config.test.ts
index 6b05ce3ca..ffdf5353a 100644
--- a/test/host-config.test.ts
+++ b/test/host-config.test.ts
@@ -401,7 +401,9 @@ describe('host-config-export.ts CLI', () => {
     expect(exitCode).toBe(1);
   });
 
-  test('detect finds claude (since we are running in claude)', () => {
+  // Gated: the secretless free-tests CI lane deliberately installs no claude
+  // CLI, so "we are running in claude" is false there by design.
+  test.skipIf(!Bun.which('claude'))('detect finds claude (since we are running in claude)', () => {
     const { stdout, exitCode } = run('detect');
     expect(exitCode).toBe(0);
     // claude binary should be on PATH in this environment