diff --git a/tests/audio-effects-executor.test.js b/tests/audio-effects-executor.test.js
index 8104c15..613a5a9 100644
--- a/tests/audio-effects-executor.test.js
+++ b/tests/audio-effects-executor.test.js
@@ -376,8 +376,11 @@ test('audio-effects executor rejects coerced parameter indices', async () => {
 });
 
 test('preload exposes the trusted audio-effects executor surface', () => {
-    const preload = fs.readFileSync(path.join(ROOT, 'src', 'main', 'preload.ts'), 'utf8');
-    const bridge = fs.readFileSync(path.join(ROOT, 'src', 'main', 'audio-bridge.ts'), 'utf8');
+    // Normalize line endings: the multi-line snippet assertion below uses
+    // \n, but a Windows checkout with core.autocrlf reads these files as
+    // \r\n — the test must not depend on the developer's git config.
+    const preload = fs.readFileSync(path.join(ROOT, 'src', 'main', 'preload.ts'), 'utf8').replace(/\r\n/g, '\n');
+    const bridge = fs.readFileSync(path.join(ROOT, 'src', 'main', 'audio-bridge.ts'), 'utf8').replace(/\r\n/g, '\n');
 
     assert.equal(preload.includes('audioEffects: {'), true);
     for (const method of ['loadChainPlan', 'releaseRoute', 'inspectRoute', 'activateSegment', 'setStageBypass', 'setStageParameter', 'setRouteGain']) {
diff --git a/tests/config-paths.test.js b/tests/config-paths.test.js
index c194811..2e195d1 100644
--- a/tests/config-paths.test.js
+++ b/tests/config-paths.test.js
@@ -111,17 +111,23 @@ test('SAFETY: song library, installed plugins and ML caches are ONLY in optInExt
             ...cats.pluginStateAndPyDeps,
             ...cats.configDbsAndState,
         ];
-        // None of the safe categories may equal or be a child of the protected dirs.
+        // None of the safe categories may equal or be a child of the protected
+        // dirs. Use the env's RESOLVED fields (exactly what production
+        // returns) rather than rebuilding them with host-native path.join —
+        // on Windows that produced backslash paths that never matched the
+        // forward-slash simulated envs, failing the mlCaches equality AND
+        // silently vacuous-passing these child checks. The simulated env
+        // paths are forward-slash on every platform, so '/' is the separator.
         const protectedRoots = [
             env.dlcDir,
             env.pluginsDir,
-            path.join(env.cacheBase, 'torch'),
-            path.join(env.cacheBase, 'huggingface'),
+            env.torchHome,
+            env.hfHome,
         ];
         for (const root of protectedRoots) {
             assert.ok(!safe.includes(root), `${name}: ${root} leaked into a safe category`);
             assert.ok(
-                !safe.some((p) => p === root || p.startsWith(root + path.sep)),
+                !safe.some((p) => p === root || p.startsWith(root + '/')),
                 `${name}: a safe path lives under protected ${root}`,
             );
         }
@@ -130,7 +136,7 @@ test('SAFETY: song library, installed plugins and ML caches are ONLY in optInExt
         assert.deepEqual(cats.optInExtras.installedPlugins, [env.pluginsDir], `${name}: installedPlugins`);
         assert.deepEqual(
             cats.optInExtras.mlCaches,
-            [path.join(env.cacheBase, 'torch'), path.join(env.cacheBase, 'huggingface')],
+            [env.torchHome, env.hfHome],
             `${name}: mlCaches`,
         );
     }