diff --git a/docs/flutter-upgrade.md b/docs/flutter-upgrade.md
index 2dd7bea..c2038d7 100644
--- a/docs/flutter-upgrade.md
+++ b/docs/flutter-upgrade.md
@@ -47,7 +47,7 @@ version and leaves it absent.
 Execute in Bash,
 
 ```bash
-find ~/.vfox/cache/flutter/v-3.47.0 -name .vfox-manifest -print -delete
+rm "$(vfox info --format '{{.Path}}' flutter@3.47.0)/.vfox-manifest"
 ```
 
 ### Windows 11
@@ -55,6 +55,5 @@ find ~/.vfox/cache/flutter/v-3.47.0 -name .vfox-manifest -print -delete
 Assume that PowerShell 7 is already installed. Execute in PowerShell 7,
 
 ```powershell
-Get-ChildItem "$env:USERPROFILE\.vfox\cache\flutter\v-3.47.0" -Recurse -Force -Filter .vfox-manifest |
-    Remove-Item
+Remove-Item "$(vfox info --format '{{.Path}}' flutter@3.47.0)/.vfox-manifest"
 ```
diff --git a/metadata.lua b/metadata.lua
index bb11cca..5a6a01e 100644
--- a/metadata.lua
+++ b/metadata.lua
@@ -24,5 +24,5 @@ NOTE:
 PLUGIN.minRuntimeVersion = "0.3.0"
 -- Some things that need user to be attention!
 PLUGIN.notes = {
-    "Do NOT run `flutter upgrade` (or `flutter downgrade`, `flutter channel`, or any in-place git operation) inside a vfox-managed Flutter SDK. It mutates the SDK in place and vfox will silently hand you the wrong version on the next `vfox use`. Change versions with `vfox install flutter@<version>` and `vfox use flutter@<version>`. This plugin detects such drift and prints a warning with the restore commands on the next `vfox use`.",
+    "See https://github.com/version-fox/vfox-flutter/blob/main/README.md for documentation.",
 }
diff --git a/tests/e2e/linux/Dockerfile b/tests/e2e/linux/Dockerfile
index df39f76..569f50d 100644
--- a/tests/e2e/linux/Dockerfile
+++ b/tests/e2e/linux/Dockerfile
@@ -3,14 +3,13 @@ FROM ubuntu:26.04
 ENV DEBIAN_FRONTEND=noninteractive
 
 RUN <<EOF
-set -eux
+set -o errexit -o nounset -o xtrace
 apt-get update
 apt-get install --assume-yes \
     curl \
     git \
     golang \
-    libglu1-mesa \
-    unzip \
+    jq \
     zip
 EOF
 
diff --git a/tests/e2e/linux/config.sh b/tests/e2e/linux/config.sh
new file mode 100644
index 0000000..c86ad99
--- /dev/null
+++ b/tests/e2e/linux/config.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Single source of truth for matrix defaults. Sourced, not executed:
+#   source "$here/config.sh"
+#
+# NOTE: tests/e2e/windows/lib.ps1 duplicates DEFAULT_OFFICIAL_VERSION and
+# DEFAULT_OHOS_VERSION (bash and PowerShell share no config format).
+# Bump both sides together.
+
+if [[ -n "${VFOX_E2E_CONFIG_SH:-}" ]]; then
+    return 0 2>/dev/null || exit 0
+fi
+VFOX_E2E_CONFIG_SH=1
+
+DEFAULT_OFFICIAL_VERSION="3.47.4"
+DEFAULT_OHOS_VERSION="3.41.10-ohos-1.0.0"
+DEFAULT_MIRROR_CN="https://storage.flutter-io.cn"
+
+# resolve_flutter_version <official|ohos> honours $FLUTTER_VERSION / $OHOS_VERSION.
+resolve_flutter_version() {
+    local flavor="$1"
+    local version=""
+    case "$flavor" in
+        official) version="${FLUTTER_VERSION:-$DEFAULT_OFFICIAL_VERSION}" ;;
+        ohos) version="${OHOS_VERSION:-$DEFAULT_OHOS_VERSION}" ;;
+        *)
+            echo "FAIL unknown flavor $flavor" >&2
+            return 1
+            ;;
+    esac
+    printf '%s' "$version"
+}
+
+# default_flavours <amd64|arm64>: ohos has no arm64 artefacts, so arm64 runs
+# official only (same rule as the Windows matrix).
+default_flavours() {
+    if [[ "$1" == "arm64" ]]; then
+        echo "official"
+    else
+        echo "official ohos"
+    fi
+}
+
+default_mirrors() {
+    if [[ "$1" == "arm64" ]]; then
+        echo "default"
+    else
+        echo "default $DEFAULT_MIRROR_CN"
+    fi
+}
+
+# releases_index_for_mirror <mirror> <linux|windows>
+releases_index_for_mirror() {
+    printf '%s/flutter_infra_release/releases/releases_%s.json' "${1%/}" "$2"
+}
diff --git a/tests/e2e/linux/e2e.sh b/tests/e2e/linux/e2e.sh
index eae451c..48febb5 100755
--- a/tests/e2e/linux/e2e.sh
+++ b/tests/e2e/linux/e2e.sh
@@ -1,66 +1,70 @@
 #!/usr/bin/env bash
-set -euo pipefail
+# Host-side matrix runner: build the image once, then fan out one container
+# per (vfox version x flavor x mirror) combination, at most $max_jobs at a
+# time. Logs are prefixed so parallel runs stay readable.
+set -o errexit -o nounset -o pipefail
 
-here="$(dirname "${BASH_SOURCE[0]}")"
-repo="$(cd "$here/../../.." && pwd)"
-
-host_arch="$(uname -m)"
-case "$host_arch" in
-    x86_64) host_arch="amd64" ;;
-    aarch64|arm64) host_arch="arm64" ;;
-esac
-arch="${ARCH:-$host_arch}"
-platform="linux/$arch"
-image="vfox-flutter-e2e:linux-$arch"
-
-docker build --pull --platform "$platform" -f "$here/Dockerfile" -t "$image" "$repo"
-
-foxes="${VFOX_VERSION:-latest main}"
-default_flavours="official ohos"
-default_mirrors="default https://storage.flutter-io.cn"
-if [ "$arch" = arm64 ]; then
-    default_flavours="official"
-    default_mirrors="default"
-fi
-flavours="${FLAVOR:-$default_flavours}"
-mirrors="${MIRROR:-$default_mirrors}"
-mirror_explicit="${MIRROR:-}"
-
-max_jobs=3
-failed=0
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib.sh
+source "$here/lib.sh"
+# shellcheck source=config.sh
+source "$here/config.sh"
 
 run_one() {
-    local vfox="$1"
-    local flavor="$2"
-    local mirror="$3"
+    local image="$1"
+    local platform="$2"
+    local vfox="$3"
+    local flavor="$4"
+    local mirror="$5"
     local prefix="vfox $vfox, $flavor, mirror $mirror, $platform"
-    local env=("-e" "VFOX_VERSION=$vfox" "-e" "FLAVOR=$flavor")
-    if [ "$mirror" != default ]; then
-        env+=("-e" "FLUTTER_STORAGE_BASE_URL=$mirror")
+    local env=(--env "VFOX_VERSION=$vfox" --env "FLAVOR=$flavor")
+    if [[ "$mirror" != "default" ]]; then
+        env+=(--env "FLUTTER_STORAGE_BASE_URL=$mirror")
     fi
-    docker run --rm --platform "$platform" "${env[@]}" "$image" 2>&1 | sed -e "s|^|[$prefix] |"
+    docker run --rm --platform "$platform" "${env[@]}" "$image" 2>&1 | sed --expression "s|^|[$prefix] |"
 }
 
-for vfox in $foxes; do
-    for flavor in $flavours; do
-        for mirror in $mirrors; do
-            if [ -z "$mirror_explicit" ] && [ "$mirror" != default ] && [ "$vfox" != latest ]; then
-                continue
-            fi
-            run_one "$vfox" "$flavor" "$mirror" &
-            while [ "$(jobs -p | wc -l)" -ge "$max_jobs" ]; do
-                if ! wait -n; then
-                    failed=1
+main() {
+    local repo arch platform image
+    repo="$(cd "$here/../../.." && pwd)"
+    arch="$(normalize_arch "${ARCH:-$(uname --machine)}")"
+    platform="linux/$arch"
+    image="vfox-flutter-e2e:linux-$arch"
+
+    docker build --pull --platform "$platform" --file "$here/Dockerfile" --tag "$image" "$repo"
+
+    # Space-separated env lists (e.g. FLAVOR="official ohos") are split
+    # into arrays up front, so the loops below need no word splitting.
+    # (read is a bash builtin with no long-option form for -r/-a.)
+    local -a foxes flavours mirrors
+    read -ra foxes <<< "${VFOX_VERSION:-latest main}"
+    read -ra flavours <<< "${FLAVOR:-$(default_flavours "$arch")}"
+    read -ra mirrors <<< "${MIRROR:-$(default_mirrors "$arch")}"
+    local mirror_explicit="${MIRROR:-}"
+    local max_jobs="${E2E_MAX_JOBS:-3}"
+    local failed=0
+
+    for vfox in "${foxes[@]}"; do
+        for flavor in "${flavours[@]}"; do
+            for mirror in "${mirrors[@]}"; do
+                # The mirror matrix only runs against latest vfox unless the
+                # caller explicitly pins MIRROR, to keep CI time bounded.
+                if [[ -z "$mirror_explicit" && "$mirror" != "default" && "$vfox" != "latest" ]]; then
+                    continue
                 fi
+                run_one "$image" "$platform" "$vfox" "$flavor" "$mirror" &
+                while [[ "$(jobs -p | wc --lines)" -ge "$max_jobs" ]]; do
+                    wait -n || failed=1
+                done
             done
         done
     done
-done
 
-while [ "$(jobs -p | wc -l)" -gt 0 ]; do
-    if ! wait -n; then
-        failed=1
-    fi
-done
+    while [[ "$(jobs -p | wc --lines)" -gt 0 ]]; do
+        wait -n || failed=1
+    done
+
+    return "$failed"
+}
 
-exit "$failed"
+main "$@"
diff --git a/tests/e2e/linux/install.sh b/tests/e2e/linux/install.sh
index 854df0c..0e3d5dd 100755
--- a/tests/e2e/linux/install.sh
+++ b/tests/e2e/linux/install.sh
@@ -1,28 +1,23 @@
 #!/usr/bin/env bash
-set -eu
+# Install and activate one Flutter version: `bash install.sh <version>`.
+# Runs standalone (called as a subprocess by run.sh, like install.ps1).
+set -o errexit -o nounset -o pipefail
 
-version="${1:?missing version}"
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib.sh
+source "$here/lib.sh"
 
-eval "$(vfox activate bash)"
-
-install_code=1
-for attempt in 1 2 3; do
-    if vfox install flutter@"$version"; then
-        install_code=0
-        break
-    else
-        install_code=$?
-    fi
-    if [ "$attempt" -lt 3 ]; then
-        echo "retrying vfox install flutter@${version}, attempt ${attempt} exited ${install_code}"
-        sleep $((10 * attempt))
+install_flutter_version() {
+    local version="$1"
+    activate_vfox
+    if ! retry "vfox install flutter@${version}" vfox install flutter@"$version"; then
+        die "vfox install flutter@${version} failed after ${E2E_RETRY_ATTEMPTS:-3} attempts"
     fi
-done
+    vfox use --global flutter@"$version"
+    activate_vfox
+}
 
-if [ "$install_code" -ne 0 ]; then
-    echo "FAIL vfox install flutter@${version} exited with code ${install_code}" >&2
-    exit 1
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    version="${1:?usage: install.sh <flutter-version>}"
+    install_flutter_version "$version"
 fi
-
-vfox use --global flutter@"$version"
-eval "$(vfox activate bash)"
diff --git a/tests/e2e/linux/lib.sh b/tests/e2e/linux/lib.sh
new file mode 100644
index 0000000..c9a60cc
--- /dev/null
+++ b/tests/e2e/linux/lib.sh
@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+# Shared helpers for the Linux container E2E suite. Sourced, not executed:
+#   source "$here/lib.sh"
+#
+# Layout (mirrors tests/e2e/windows):
+#   lib.sh     - generic helpers (this file; no side effects when sourced)
+#   config.sh  - default versions / flavours / mirrors
+#   setup.sh   - install vfox and register the local flutter plugin
+#   install.sh - install one Flutter version with retries
+#   verify.sh  - assert on the installed SDK (layout, drift, toolchain)
+#   run.sh     - thin in-container orchestrator: setup -> install -> verify
+#   e2e.sh     - host-side matrix runner (builds the image, fans out containers)
+
+if [[ -n "${VFOX_E2E_LIB_SH:-}" ]]; then
+    return 0 2>/dev/null || exit 0
+fi
+VFOX_E2E_LIB_SH=1
+
+die() {
+    echo "FAIL $*" >&2
+    exit 1
+}
+
+pass() {
+    echo "PASS $*"
+}
+
+# assert_contains <actual> <expected> <label>
+# Prints PASS and returns 0 on match, prints FAIL and returns 1 otherwise.
+# Callers running under `set -o errexit` abort on failure; callers that need to
+# continue must guard the call with `if` / `||`.
+assert_contains() {
+    local actual="$1"
+    local expected="$2"
+    local label="$3"
+    if [[ -z "$expected" ]]; then
+        echo "FAIL $label : the expected value is empty" >&2
+        return 1
+    fi
+    if printf '%s' "$actual" | grep --quiet --fixed-strings -- "$expected"; then
+        echo "PASS $label contains $expected"
+        return 0
+    fi
+    {
+        echo "FAIL $label is missing $expected"
+        echo "--- actual ---"
+        echo "$actual"
+    } >&2
+    return 1
+}
+
+# retry <label> <command...>
+# Runs the command streaming its output (so `out=$(retry ...)` still
+# captures it) and retries up to $E2E_RETRY_ATTEMPTS times with linear
+# backoff. Progress notices go to stderr to stay out of captures.
+retry() {
+    local label="$1"
+    shift
+    local max="${E2E_RETRY_ATTEMPTS:-3}"
+    local attempt=1
+    local code=1
+    while ((attempt <= max)); do
+        if "$@"; then
+            return 0
+        else
+            # NB: $code must be captured in the else branch. Reading $? after
+            # the whole `if` would yield the if-statement's own status (0).
+            code=$?
+        fi
+        if ((attempt < max)); then
+            echo "retrying ${label}, attempt ${attempt} exited ${code}" >&2
+            sleep $((10 * attempt))
+        fi
+        attempt=$((attempt + 1))
+    done
+    return "$code"
+}
+
+# require_env <NAME> prints the value or aborts; keeps "missing X" errors uniform.
+require_env() {
+    local name="$1"
+    if [[ -z "${!name:-}" ]]; then
+        die "$name is not set"
+    fi
+    printf '%s' "${!name}"
+}
+
+# normalize_arch <uname -m | $ARCH alias> prints amd64|arm64 or fails.
+normalize_arch() {
+    case "$1" in
+        x86_64 | amd64) echo amd64 ;;
+        aarch64 | arm64) echo arm64 ;;
+        *)
+            echo "FAIL unknown architecture $1" >&2
+            return 1
+            ;;
+    esac
+}
+
+activate_vfox() {
+    # SC1090 cannot be fixed: vfox prints shell code at runtime, so there
+    # is no static file for shellcheck to follow.
+    # shellcheck disable=SC1090
+    eval "$(vfox activate bash)"
+}
+
+# sdk_dir prints the SDK root for the active flutter on PATH.
+sdk_dir() {
+    (cd "$(dirname "$(command -v flutter)")"/.. && pwd)
+}
diff --git a/tests/e2e/linux/run.sh b/tests/e2e/linux/run.sh
index 1393fa5..c7cd517 100755
--- a/tests/e2e/linux/run.sh
+++ b/tests/e2e/linux/run.sh
@@ -1,194 +1,64 @@
 #!/usr/bin/env bash
-set -eu
+# In-container E2E entrypoint (see Dockerfile CMD). Thin orchestrator only:
+# resolve config -> probe mirror -> setup -> bogus-mirror guard ->
+# install -> verify. Stage logic lives in setup.sh / install.sh / verify.sh.
+set -o errexit -o nounset -o pipefail
 
-here="$(dirname "${BASH_SOURCE[0]}")"
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib.sh
+source "$here/lib.sh"
+# shellcheck source=config.sh
+source "$here/config.sh"
+# shellcheck source=setup.sh
+source "$here/setup.sh"
 
-assert_contains() {
-    local actual="$1"
-    local expected="$2"
-    local label="$3"
-    if [ -z "$expected" ]; then
-        echo "FAIL $label : the expected value is empty" >&2
-        exit 1
-    fi
-    if echo "$actual" | grep -qF -- "$expected"; then
-        echo "PASS $label contains $expected"
+# Official flavours download from $FLUTTER_STORAGE_BASE_URL when set; fail
+# fast with a clear message if the mirror does not serve the release index.
+check_mirror_reachable() {
+    local flavor="$1"
+    local mirror="$2"
+    if [[ "$flavor" != "official" || "$mirror" == "default" ]]; then
         return 0
     fi
-    echo "FAIL $label is missing $expected" >&2
-    echo "--- actual ---" >&2
-    echo "$actual" >&2
-    exit 1
-}
-
-retry() {
-    local label="$1"
-    shift
-    local output=""
-    local code=1
-    set +e
-    for attempt in 1 2 3; do
-        output="$("$@" 2>&1)"
-        code=$?
-        set -e
-        if [ "$code" -eq 0 ]; then
-            printf '%s' "$output"
-            return 0
-        fi
-        if [ "$attempt" -lt 3 ]; then
-            echo "retrying ${label}, attempt ${attempt} exited ${code}" >&2
-            sleep $((10 * attempt))
-            set +e
-        fi
-    done
-    set -e
-    printf '%s' "$output"
-    return "$code"
-}
-
-flavor="${FLAVOR:?missing flavor}"
-mirror="${FLUTTER_STORAGE_BASE_URL:-default}"
-if [ "$flavor" = official ]; then
-    version="${FLUTTER_VERSION:-3.47.4}"
-elif [ "$flavor" = ohos ]; then
-    version="${OHOS_VERSION:-3.41.10-ohos-1.0.0}"
-else
-    echo "FAIL unknown flavor $flavor" >&2
-    exit 1
-fi
-
-echo "=== vfox ${VFOX_VERSION:-latest}, flutter $version, $flavor, mirror $mirror, $(uname -m) ==="
-if [ "$flavor" = official ] && [ "$mirror" != default ]; then
-    mirror_index="${mirror%/}/flutter_infra_release/releases/releases_linux.json"
-    if retry "mirror $mirror_index" curl -fsSL --max-time 20 -o /dev/null "$mirror_index" >/dev/null; then
-        echo "PASS mirror $mirror serves the releases index"
+    local index
+    index="$(releases_index_for_mirror "$mirror" linux)"
+    if retry "mirror $index" curl --fail --silent --show-error --location --max-time 20 --output /dev/null "$index" >/dev/null; then
+        pass "mirror $mirror serves the releases index"
     else
-        echo "FAIL mirror $mirror is unreachable ($mirror_index)" >&2
-        exit 1
+        die "mirror $mirror is unreachable ($index)"
     fi
-fi
-source "$here/setup.sh"
-if [ "$flavor" = official ]; then
-    bogus_mirror="https://invalid.example.invalid"
-    set +e
-    bogus_output="$(FLUTTER_STORAGE_BASE_URL="$bogus_mirror" vfox install flutter@"$version" 2>&1)"
-    bogus_code=$?
-    set -e
-    if [ "$bogus_code" -eq 0 ]; then
-        echo 'FAIL bogus mirror install unexpectedly succeeded' >&2
-        exit 1
+}
+
+# A bogus mirror must fail with an error naming the host, proving the
+# plugin really honours $FLUTTER_STORAGE_BASE_URL instead of falling back.
+check_bogus_mirror_rejected() {
+    local flavor="$1"
+    local version="$2"
+    if [[ "$flavor" != "official" ]]; then
+        return 0
     fi
+    local bogus_mirror="https://invalid.example.invalid"
+    local bogus_output bogus_code=0
+    bogus_output="$(FLUTTER_STORAGE_BASE_URL="$bogus_mirror" vfox install flutter@"$version" 2>&1)" || bogus_code=$?
+    ((bogus_code != 0)) || die "bogus mirror install unexpectedly succeeded"
     assert_contains "$bogus_output" "invalid.example.invalid" 'bogus mirror error'
-fi
-bash "$here/install.sh" "$version"
-eval "$(vfox activate bash)"
-sdk="$(cd "$(dirname "$(command -v flutter)")"/.. && pwd)"
-if [ "$flavor" = official ]; then
-    if git -C "$sdk" log -1 --format=%s | grep -qF 'vfox install'; then
-        echo 'FAIL the official SDK carries a vfox commit' >&2
-        exit 1
-    fi
-    echo 'PASS the official SDK carries no vfox commit'
-else
-    if [ ! -d "$sdk/.git" ]; then
-        echo 'FAIL the OpenHarmony SDK is not a git checkout' >&2
-        exit 1
-    fi
-    if [ -z "$(git -C "$sdk" ls-files bin/internal/engine.version)" ]; then
-        echo 'FAIL the OpenHarmony engine version pin is not tracked' >&2
-        exit 1
-    fi
-    echo 'PASS the OpenHarmony SDK is a git checkout with its engine pins tracked'
-fi
-
-# --- in-place `flutter upgrade` drift detection ---------------------------
-manifest="$sdk/.vfox-manifest"
-if [ ! -f "$manifest" ]; then
-    echo 'FAIL the SDK has no .vfox-manifest, so its installed version cannot be anchored' >&2
-    exit 1
-fi
-echo 'PASS the SDK carries a .vfox-manifest'
-
-installed_head="$(git -C "$sdk" rev-parse HEAD)"
-anchor="$(sed -n 's/.*"expected_head"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' "$manifest")"
-if [ -z "$anchor" ]; then
-    echo 'FAIL the .vfox-manifest has no expected_head' >&2
-    exit 1
-fi
-if [ "$anchor" != "$installed_head" ]; then
-    echo "FAIL the .vfox-manifest anchor $anchor does not match the installed git HEAD $installed_head" >&2
-    exit 1
-fi
-echo 'PASS the .vfox-manifest anchor matches the installed git HEAD'
+}
 
-set +e
-clean_output="$(vfox use --global flutter@"$version" 2>&1)"
-clean_code=$?
-set -e
-if [ "$clean_code" -ne 0 ]; then
-    echo "FAIL vfox use exited with code ${clean_code}" >&2
-    exit 1
-fi
-if echo "$clean_output" | grep -qF 'has drifted'; then
-    echo 'FAIL a freshly installed SDK reports drift' >&2
-    echo "--- actual ---" >&2
-    echo "$clean_output" >&2
-    exit 1
-fi
-echo 'PASS a freshly installed SDK reports no drift'
+main() {
+    local flavor mirror version
+    flavor="$(require_env FLAVOR)"
+    mirror="${FLUTTER_STORAGE_BASE_URL:-default}"
+    version="$(resolve_flutter_version "$flavor")"
 
-if ! GIT_AUTHOR_NAME=e2e GIT_AUTHOR_EMAIL=e2e@vfox.flutter \
-    GIT_COMMITTER_NAME=e2e GIT_COMMITTER_EMAIL=e2e@vfox.flutter \
-    git -C "$sdk" commit --allow-empty -q -m 'simulated flutter upgrade'; then
-    echo 'FAIL failed to record a simulated flutter upgrade commit' >&2
-    exit 1
-fi
-drifted_head="$(git -C "$sdk" rev-parse HEAD)"
+    echo "=== vfox ${VFOX_VERSION:-latest}, flutter $version, $flavor, mirror $mirror, $(uname --machine) ==="
 
-set +e
-drift_output="$(vfox use --global flutter@"$version" 2>&1)"
-drift_code=$?
-set -e
-if [ "$drift_code" -ne 0 ]; then
-    echo "FAIL vfox use exited with code ${drift_code}" >&2
-    exit 1
-fi
-assert_contains "$drift_output" 'has drifted from the version vfox installed' 'drift warning'
-assert_contains "$drift_output" "$anchor" 'drift warning expected head'
-assert_contains "$drift_output" "$drifted_head" 'drift warning current head'
-assert_contains "$drift_output" "vfox uninstall flutter@$version" 'drift warning restore command'
-assert_contains "$drift_output" "vfox install  flutter@$version" 'drift warning restore command'
-assert_contains "$drift_output" "vfox use      flutter@$version" 'drift warning restore command'
-assert_contains "$drift_output" 'vfox install flutter@<new-version>' 'drift warning upgrade command'
+    check_mirror_reachable "$flavor" "$mirror"
+    setup_vfox
+    check_bogus_mirror_rejected "$flavor" "$version"
 
-git -C "$sdk" reset -q --hard "$anchor"
-set +e
-restored_output="$(vfox use --global flutter@"$version" 2>&1)"
-restored_code=$?
-set -e
-if [ "$restored_code" -ne 0 ]; then
-    echo "FAIL vfox use exited with code ${restored_code}" >&2
-    exit 1
-fi
-if echo "$restored_output" | grep -qF 'has drifted'; then
-    echo 'FAIL a restored SDK still reports drift' >&2
-    echo "--- actual ---" >&2
-    echo "$restored_output" >&2
-    exit 1
-fi
-echo 'PASS a restored SDK reports no drift'
+    bash "$here/install.sh" "$version"
+    activate_vfox
+    bash "$here/verify.sh" "$flavor" "$version"
+}
 
-if ! retry 'pub.dev' curl -fsSL --max-time 20 -o /dev/null 'https://pub.dev/api/packages/args' >/dev/null; then
-    echo 'FAIL pub.dev is unreachable, the Flutter tool cannot bootstrap' >&2
-    exit 1
-fi
-if ! dart="$(retry 'dart --version' dart --version)"; then
-    echo 'FAIL dart --version did not run' >&2
-    exit 1
-fi
-if ! flutter="$(retry 'flutter --version' flutter --version --no-version-check)"; then
-    echo 'FAIL flutter --version did not run' >&2
-    exit 1
-fi
-assert_contains "$flutter" "$(git -C "$sdk" rev-parse HEAD | cut -c1-10)" 'flutter --version revision'
-assert_contains "$dart" "$(echo "$flutter" | awk '/Tools/ { print $4 }')" 'dart --version'
+main "$@"
diff --git a/tests/e2e/linux/setup.sh b/tests/e2e/linux/setup.sh
index c71bf2d..3982852 100644
--- a/tests/e2e/linux/setup.sh
+++ b/tests/e2e/linux/setup.sh
@@ -1,13 +1,54 @@
-VFOX_VERSION="${VFOX_VERSION:-latest}"
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
-WORK="$(mktemp -d)"
-
-if [ "$VFOX_VERSION" = main ]; then
-    git clone --depth 1 https://github.com/version-fox/vfox "$WORK/src"
-    (cd "$WORK/src" && CGO_ENABLED=0 go build -trimpath -o /usr/local/bin/vfox .)
-else
-    curl -sSL https://raw.githubusercontent.com/version-fox/vfox/main/install.sh | bash
+#!/usr/bin/env bash
+# Install vfox and register the local flutter plugin.
+# Sourced by run.sh (`setup_vfox`), or executed directly for debugging:
+#   bash tests/e2e/linux/setup.sh
+set -o errexit -o nounset -o pipefail
+
+if [[ -n "${VFOX_E2E_SETUP_SH:-}" ]]; then
+    return 0 2>/dev/null || exit 0
 fi
+VFOX_E2E_SETUP_SH=1
+
+install_vfox_release() {
+    curl --fail --silent --show-error --location https://raw.githubusercontent.com/version-fox/vfox/main/install.sh | bash
+}
+
+install_vfox_main() {
+    local work="$1"
+    git clone --depth 1 https://github.com/version-fox/vfox "$work/src"
+    (cd "$work/src" && CGO_ENABLED=0 go build -trimpath -o /usr/local/bin/vfox .)
+}
+
+add_flutter_plugin() {
+    local repo_root="$1"
+    local work="$2"
+    (cd "$repo_root" && zip -qr "$work/flutter.zip" metadata.lua hooks lib)
+    vfox add flutter --source "$work/flutter.zip"
+}
 
-(cd "$REPO_ROOT" && zip -qr "$WORK/flutter.zip" metadata.lua hooks lib)
-vfox add flutter --source "$WORK/flutter.zip"
+setup_vfox() {
+    local vfox_version="${VFOX_VERSION:-latest}"
+    local here repo_root work
+    here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+    repo_root="$(cd "$here/../../.." && pwd)"
+    work="$(mktemp --directory)"
+    # The container is ephemeral (--rm), but still clean up after ourselves
+    # so repeated local runs don't leak /tmp. Expanded now: the trap must
+    # not reference the function-local $work after it goes out of scope.
+    # SC2064 is a false positive here: expanding now is required, because
+    # the function-local $work is already out of scope when the EXIT trap
+    # fires. Single quotes would defer expansion and hand rm an empty path.
+    # shellcheck disable=SC2064
+    trap "rm --recursive --force '${work}'" EXIT
+
+    if [[ "$vfox_version" == "main" ]]; then
+        install_vfox_main "$work"
+    else
+        install_vfox_release
+    fi
+    add_flutter_plugin "$repo_root" "$work"
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    setup_vfox "$@"
+fi
diff --git a/tests/e2e/linux/verify.sh b/tests/e2e/linux/verify.sh
new file mode 100755
index 0000000..de6e374
--- /dev/null
+++ b/tests/e2e/linux/verify.sh
@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+# Assert on an installed SDK: `bash verify.sh <flavor> <version>`.
+# Runs standalone (called as a subprocess by run.sh, like verify.ps1).
+#
+# NOTE: the drift-warning strings asserted here are part of the plugin's
+# user-facing contract (see hooks/ / lib/). If the Lua side rewords them,
+# update both this file and tests/e2e/windows/verify.Tests.ps1 together.
+set -o errexit -o nounset -o pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib.sh
+source "$here/lib.sh"
+
+# The official SDK must be pristine; the OpenHarmony SDK must be a git
+# checkout with its engine pins tracked.
+verify_sdk_layout() {
+    local flavor="$1"
+    local sdk="$2"
+    if [[ "$flavor" == "official" ]]; then
+        local subject
+        subject="$(git -C "$sdk" log --max-count=1 --format=%s)"
+        if printf '%s' "$subject" | grep --quiet --fixed-strings 'vfox install'; then
+            die "the official SDK carries a vfox commit"
+        fi
+        pass "the official SDK carries no vfox commit"
+    else
+        [[ -d "$sdk/.git" ]] || die "the OpenHarmony SDK is not a git checkout"
+        [[ -n "$(git -C "$sdk" ls-files bin/internal/engine.version)" ]] \
+            || die "the OpenHarmony engine version pin is not tracked"
+        pass "the OpenHarmony SDK is a git checkout with its engine pins tracked"
+    fi
+}
+
+# Anchor the installed HEAD via .vfox-manifest, then prove `vfox use`
+# reports drift exactly when the SDK moves (simulated `flutter upgrade`)
+# and goes quiet again once restored.
+verify_manifest_drift() {
+    local version="$1"
+    local sdk="$2"
+    local manifest="$sdk/.vfox-manifest"
+    [[ -f "$manifest" ]] \
+        || die "the SDK has no .vfox-manifest, so its installed version cannot be anchored"
+    pass "the SDK carries a .vfox-manifest"
+
+    local installed_head anchor
+    installed_head="$(git -C "$sdk" rev-parse HEAD)"
+    if ! anchor="$(jq --raw-output '.expected_head // empty' "$manifest")"; then
+        die "the .vfox-manifest is not valid JSON"
+    fi
+    [[ -n "$anchor" ]] || die "the .vfox-manifest has no expected_head"
+    [[ "$anchor" == "$installed_head" ]] \
+        || die "the .vfox-manifest anchor $anchor does not match the installed git HEAD $installed_head"
+    pass "the .vfox-manifest anchor matches the installed git HEAD"
+
+    local clean_output clean_code=0
+    clean_output="$(vfox use --global flutter@"$version" 2>&1)" || clean_code=$?
+    ((clean_code == 0)) || die "vfox use exited with code ${clean_code}"
+    if printf '%s' "$clean_output" | grep --quiet --fixed-strings 'has drifted'; then
+        {
+            echo "FAIL a freshly installed SDK reports drift"
+            echo "--- actual ---"
+            echo "$clean_output"
+        } >&2
+        exit 1
+    fi
+    pass "a freshly installed SDK reports no drift"
+
+    if ! GIT_AUTHOR_NAME=e2e GIT_AUTHOR_EMAIL=e2e@vfox.flutter \
+        GIT_COMMITTER_NAME=e2e GIT_COMMITTER_EMAIL=e2e@vfox.flutter \
+        git -C "$sdk" commit --allow-empty --quiet -m 'simulated flutter upgrade'; then
+        die "failed to record a simulated flutter upgrade commit"
+    fi
+    local drifted_head drift_output drift_code=0
+    drifted_head="$(git -C "$sdk" rev-parse HEAD)"
+
+    drift_output="$(vfox use --global flutter@"$version" 2>&1)" || drift_code=$?
+    ((drift_code == 0)) || die "vfox use exited with code ${drift_code}"
+    assert_contains "$drift_output" 'has drifted from the version vfox installed' 'drift warning'
+    assert_contains "$drift_output" "$anchor" 'drift warning expected head'
+    assert_contains "$drift_output" "$drifted_head" 'drift warning current head'
+    assert_contains "$drift_output" "vfox uninstall flutter@$version" 'drift warning restore command'
+    assert_contains "$drift_output" "vfox install  flutter@$version" 'drift warning restore command'
+    assert_contains "$drift_output" "vfox use      flutter@$version" 'drift warning restore command'
+    assert_contains "$drift_output" 'vfox install flutter@<new-version>' 'drift warning upgrade command'
+
+    git -C "$sdk" reset --quiet --hard "$anchor"
+    local restored_output restored_code=0
+    restored_output="$(vfox use --global flutter@"$version" 2>&1)" || restored_code=$?
+    ((restored_code == 0)) || die "vfox use exited with code ${restored_code}"
+    if printf '%s' "$restored_output" | grep --quiet --fixed-strings 'has drifted'; then
+        {
+            echo "FAIL a restored SDK still reports drift"
+            echo "--- actual ---"
+            echo "$restored_output"
+        } >&2
+        exit 1
+    fi
+    pass "a restored SDK reports no drift"
+}
+
+# The installed toolchain must bootstrap (pub.dev reachable) and the
+# dart/flutter versions must agree with each other and the SDK checkout.
+verify_toolchain() {
+    local sdk="$1"
+    if ! retry 'pub.dev' curl --fail --silent --show-error --location --max-time 20 --output /dev/null 'https://pub.dev/api/packages/args' >/dev/null; then
+        die "pub.dev is unreachable, the Flutter tool cannot bootstrap"
+    fi
+    local dart flutter
+    # dart --version reports on stderr, so merge streams like the old retry did.
+    if ! dart="$(retry 'dart --version' dart --version 2>&1)"; then
+        die "dart --version did not run"
+    fi
+    if ! flutter="$(retry 'flutter --version' flutter --version --no-version-check 2>&1)"; then
+        die "flutter --version did not run"
+    fi
+    assert_contains "$flutter" "$(git -C "$sdk" rev-parse HEAD | cut --characters=1-10)" 'flutter --version revision'
+    assert_contains "$dart" "$(printf '%s' "$flutter" | awk '/Tools/ { print $4 }')" 'dart --version'
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+    flavor="${1:?usage: verify.sh <flavor> <version>}"
+    version="${2:?usage: verify.sh <flavor> <version>}"
+    activate_vfox
+    sdk="$(sdk_dir)"
+    verify_sdk_layout "$flavor" "$sdk"
+    verify_manifest_drift "$version" "$sdk"
+    verify_toolchain "$sdk"
+fi
diff --git a/tests/e2e/windows/bootstrap-tools.ps1 b/tests/e2e/windows/bootstrap-tools.ps1
index 06c75af..b8a9ced 100644
--- a/tests/e2e/windows/bootstrap-tools.ps1
+++ b/tests/e2e/windows/bootstrap-tools.ps1
@@ -20,3 +20,11 @@ if (-not (Test-Path 'C:\Program Files\PowerShell\7\pwsh.exe')) { throw 'FAIL pws
 if (-not (Test-Path 'C:\Program Files\Git\cmd\git.exe')) { throw 'FAIL git.exe is missing after the Git installer' }
 Invoke-Native { & 'C:\Program Files\Git\cmd\git.exe' config --system core.longpaths true } 'enable system-wide git long paths'
 New-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem' -Name 'LongPathsEnabled' -Value 1 -PropertyType DWORD -Force | Out-Null
+
+# Pester 5 runs the *.Tests.ps1 suites (see run.ps1). Pinned, because the
+# container image must stay reproducible; run.ps1 only requires v5 or newer.
+$PesterVersion = '5.7.1'
+$pwsh = 'C:\Program Files\PowerShell\7\pwsh.exe'
+Invoke-Native { & $pwsh -NoProfile -Command "Set-PSRepository -Name 'PSGallery' -InstallationPolicy 'Trusted'" } 'trust the PSGallery repository'
+Invoke-Native { & $pwsh -NoProfile -Command "Install-Module -Name 'Pester' -RequiredVersion '$PesterVersion' -Scope 'AllUsers' -Force -SkipPublisherCheck" } "the Pester $PesterVersion module install"
+Invoke-Native { & $pwsh -NoProfile -Command "& { Import-Module 'Pester' -RequiredVersion '$PesterVersion'; (Get-Module 'Pester').Version.ToString() }" } "importing Pester $PesterVersion"
diff --git a/tests/e2e/windows/install.ps1 b/tests/e2e/windows/install.ps1
index 950db24..784677d 100644
--- a/tests/e2e/windows/install.ps1
+++ b/tests/e2e/windows/install.ps1
@@ -6,17 +6,5 @@ $ErrorActionPreference = 'Stop'
 $PSNativeCommandUseErrorActionPreference = $true
 . "$PSScriptRoot\lib.ps1"
 
-$installCode = 1
-for ($attempt = 1; $attempt -le 3; $attempt++) {
-    $PSNativeCommandUseErrorActionPreference = $false
-    vfox install flutter@$Version
-    $installCode = $LASTEXITCODE
-    $PSNativeCommandUseErrorActionPreference = $true
-    if ($installCode -eq 0) { break }
-    if ($attempt -lt 3) {
-        Write-Output "retrying vfox install flutter@$Version, attempt $attempt exited $installCode"
-        Start-Sleep -Seconds (10 * $attempt)
-    }
-}
-if ($installCode -ne 0) { throw "FAIL vfox install flutter@$Version exited with code $installCode" }
+Invoke-WithRetry { vfox install flutter@$Version } "vfox install flutter@$Version"
 Invoke-Native { vfox use --global flutter@$Version } "vfox use --global flutter@$Version"
diff --git a/tests/e2e/windows/lib.ps1 b/tests/e2e/windows/lib.ps1
index 2ce440a..afbbe97 100644
--- a/tests/e2e/windows/lib.ps1
+++ b/tests/e2e/windows/lib.ps1
@@ -1,3 +1,18 @@
+# NOTE: the default versions below duplicate tests/e2e/linux/config.sh
+# (PowerShell and bash share no config format). Bump both sides together.
+function Resolve-FlutterVersion {
+    param(
+        [Parameter(Mandatory)] [string] $Flavor
+    )
+    if ($Flavor -eq 'official') {
+        if ($env:FLUTTER_VERSION) { $env:FLUTTER_VERSION } else { '3.47.4' }
+    } elseif ($Flavor -eq 'ohos') {
+        if ($env:OHOS_VERSION) { $env:OHOS_VERSION } else { '3.41.10-ohos-1.0.0' }
+    } else {
+        throw "FAIL unknown flavor $Flavor"
+    }
+}
+
 function Invoke-Native {
     param(
         [Parameter(Mandatory)] [scriptblock] $Cmd,
@@ -12,3 +27,29 @@ function Invoke-Native {
     if ($null -eq $code) { throw "FAIL $What did not run" }
     if ($code -notin $Ok) { throw "FAIL $What exited with code $code" }
 }
+
+# Invoke-WithRetry runs a native command streaming its output (so callers
+# can still capture it) and retries up to $Attempts times with linear
+# backoff. Progress notices go to stderr to stay out of captures.
+function Invoke-WithRetry {
+    param(
+        [Parameter(Mandatory)] [scriptblock] $Cmd,
+        [Parameter(Mandatory)] [string] $What,
+        [int] $Attempts = 3,
+        [int] $BackoffSeconds = 10
+    )
+    $code = 1
+    for ($attempt = 1; $attempt -le $Attempts; $attempt++) {
+        $prev = $PSNativeCommandUseErrorActionPreference
+        $PSNativeCommandUseErrorActionPreference = $false
+        & $Cmd
+        $code = $LASTEXITCODE
+        $PSNativeCommandUseErrorActionPreference = $prev
+        if ($code -eq 0) { return }
+        if ($attempt -lt $Attempts) {
+            [Console]::Error.WriteLine("retrying $What, attempt $attempt exited $code")
+            Start-Sleep -Seconds ($BackoffSeconds * $attempt)
+        }
+    }
+    throw "FAIL $What failed after $Attempts attempts (exit $code)"
+}
diff --git a/tests/e2e/windows/preflight.Tests.ps1 b/tests/e2e/windows/preflight.Tests.ps1
new file mode 100644
index 0000000..cb50158
--- /dev/null
+++ b/tests/e2e/windows/preflight.Tests.ps1
@@ -0,0 +1,43 @@
+# Pre-install guards: mirror reachability and proof that the plugin really
+# honours $env:FLUTTER_STORAGE_BASE_URL. Runs via Invoke-Pester after
+# setup.ps1 but before install.ps1 (see run.ps1).
+
+$ErrorActionPreference = 'Stop'
+$PSNativeCommandUseErrorActionPreference = $true
+
+Describe 'mirror preflight' {
+    BeforeAll {
+        # NB: $PSScriptRoot must be used directly here. A $here variable set
+        # at file top-level is NOT visible inside BeforeAll/It: Pester runs
+        # discovery and execution in different sessions.
+        . "$PSScriptRoot\lib.ps1"
+        $Flavor = if ($env:FLAVOR) { $env:FLAVOR } else { throw 'FAIL FLAVOR is not set' }
+        $Mirror = if ($env:FLUTTER_STORAGE_BASE_URL) { $env:FLUTTER_STORAGE_BASE_URL } else { 'default' }
+    }
+
+    It 'serves the releases index' {
+        if (($Flavor -ne 'official') -or ($Mirror -eq 'default')) {
+            Set-ItResult -Skipped -Because 'only official flavours with a configured mirror probe the index'
+        }
+        $index = $Mirror.TrimEnd('/') + '/flutter_infra_release/releases/releases_windows.json'
+        Invoke-WithRetry { & curl.exe -fsSL --max-time 20 -o NUL $index } "mirror $index"
+    }
+
+    It 'rejects a bogus mirror naming the host' {
+        if ($Flavor -ne 'official') {
+            Set-ItResult -Skipped -Because 'only the official flavour honours the download mirror'
+        }
+        $origMirror = $env:FLUTTER_STORAGE_BASE_URL
+        try {
+            $env:FLUTTER_STORAGE_BASE_URL = 'https://invalid.example.invalid'
+            $PSNativeCommandUseErrorActionPreference = $false
+            $bogusOutput = (& vfox install "flutter@$(Resolve-FlutterVersion $Flavor)" 2>&1 | Out-String)
+            $bogusCode = $LASTEXITCODE
+            $PSNativeCommandUseErrorActionPreference = $true
+        } finally {
+            if ($null -eq $origMirror) { Remove-Item Env:\FLUTTER_STORAGE_BASE_URL } else { $env:FLUTTER_STORAGE_BASE_URL = $origMirror }
+        }
+        $bogusCode | Should -Not -Be 0
+        $bogusOutput | Should -Match ([regex]::Escape('invalid.example.invalid'))
+    }
+}
diff --git a/tests/e2e/windows/run.ps1 b/tests/e2e/windows/run.ps1
index 3e1f915..019eb4c 100644
--- a/tests/e2e/windows/run.ps1
+++ b/tests/e2e/windows/run.ps1
@@ -1,49 +1,32 @@
 $ErrorActionPreference = 'Stop'
 $PSNativeCommandUseErrorActionPreference = $true
+# CI hygiene: container stdout is redirected, where PowerShell would otherwise
+# serialize progress records (e.g. "Preparing modules for first use" on the
+# first Pester import) as CLIXML noise into the log. Our code uses no
+# Write-Progress, so silencing it loses nothing.
+$ProgressPreference = 'SilentlyContinue'
 . "$PSScriptRoot\lib.ps1"
 
-$vfox = if ($env:VFOX_VERSION) { $env:VFOX_VERSION } else { 'latest' }
+function Invoke-E2EFixture {
+    param(
+        [Parameter(Mandatory)] [string] $Name
+    )
+    $result = Invoke-Pester -Path "$PSScriptRoot\$Name.Tests.ps1" -Output Detailed -PassThru
+    if ($result.FailedCount -gt 0) {
+        throw "FAIL $Name.Tests.ps1: $($result.FailedCount) test(s) failed ($($result.PassedCount) passed, $($result.SkippedCount) skipped)"
+    }
+}
+
 $flavor = if ($env:FLAVOR) { $env:FLAVOR } else { throw 'FAIL FLAVOR is not set' }
 $mirror = if ($env:FLUTTER_STORAGE_BASE_URL) { $env:FLUTTER_STORAGE_BASE_URL } else { 'default' }
-$version = if ($flavor -eq 'official') {
-    if ($env:FLUTTER_VERSION) { $env:FLUTTER_VERSION } else { '3.47.4' }
-} elseif ($flavor -eq 'ohos') {
-    if ($env:OHOS_VERSION) { $env:OHOS_VERSION } else { '3.41.10-ohos-1.0.0' }
-} else {
-    throw "FAIL unknown flavor $flavor"
-}
+$version = Resolve-FlutterVersion $flavor
+$vfox = if ($env:VFOX_VERSION) { $env:VFOX_VERSION } else { 'latest' }
 
 Write-Output ("=== vfox {0}, flutter {1}, {2}, mirror {3}, {4} ===" -f $vfox, $version, $flavor, $mirror, $env:PROCESSOR_ARCHITECTURE)
-if (($flavor -eq 'official') -and ($mirror -ne 'default')) {
-    $mirrorIndex = $mirror.TrimEnd('/') + '/flutter_infra_release/releases/releases_windows.json'
-    $mirrorOk = $false
-    $PSNativeCommandUseErrorActionPreference = $false
-    for ($attempt = 1; $attempt -le 3; $attempt++) {
-        & curl.exe -fsSL --max-time 20 -o NUL $mirrorIndex
-        if ($LASTEXITCODE -eq 0) {
-            $mirrorOk = $true
-            break
-        }
-        Start-Sleep -Seconds 10
-    }
-    $PSNativeCommandUseErrorActionPreference = $true
-    if (-not $mirrorOk) { throw "FAIL mirror $mirror is unreachable ($mirrorIndex)" }
-    Write-Output "PASS mirror $mirror serves the releases index"
-}
+
 . "$PSScriptRoot\setup.ps1"
-if ($flavor -eq 'official') {
-    $bogusMirror = 'https://invalid.example.invalid'
-    $origMirror = $env:FLUTTER_STORAGE_BASE_URL
-    $env:FLUTTER_STORAGE_BASE_URL = $bogusMirror
-    $PSNativeCommandUseErrorActionPreference = $false
-    $bogusOutput = (& vfox install "flutter@$version" 2>&1 | Out-String)
-    $bogusCode = $LASTEXITCODE
-    $PSNativeCommandUseErrorActionPreference = $true
-    if ($null -eq $origMirror) { Remove-Item Env:\FLUTTER_STORAGE_BASE_URL } else { $env:FLUTTER_STORAGE_BASE_URL = $origMirror }
-    if ($bogusCode -eq 0) { throw 'FAIL bogus mirror install unexpectedly succeeded' }
-    if ($bogusOutput -notmatch [regex]::Escape('invalid.example.invalid')) { throw ("FAIL bogus mirror error is missing invalid.example.invalid`n--- actual ---`n{0}" -f $bogusOutput) }
-    Write-Output 'PASS bogus mirror error contains invalid.example.invalid'
-}
+Invoke-E2EFixture 'preflight'
+
 Invoke-Native { & pwsh -NoProfile -File "$PSScriptRoot\install.ps1" -Version $version } "install.ps1 (flutter $version)"
 
 $PSNativeCommandUseErrorActionPreference = $false
@@ -51,6 +34,15 @@ $activation = @(vfox activate pwsh) -join "`r`n"
 $activationCode = $LASTEXITCODE
 $PSNativeCommandUseErrorActionPreference = $true
 if ($activationCode -ne 0) { throw "FAIL vfox activate pwsh exited with code $activationCode" }
-Invoke-Expression $activation
+# Dot-source via a temp file instead of Invoke-Expression: same effect
+# (runs vfox's assignments in this scope), but auditable on disk and
+# PSScriptAnalyzer-clean.
+$activationFile = Join-Path ([System.IO.Path]::GetTempPath()) "vfox-activate-$([System.Guid]::NewGuid()).ps1"
+try {
+    $activation | Set-Content -Path $activationFile
+    . $activationFile
+} finally {
+    Remove-Item $activationFile -ErrorAction SilentlyContinue
+}
 
-Invoke-Native { & pwsh -NoProfile -File "$PSScriptRoot\verify.ps1" -Flavor $flavor -Version $version } "verify.ps1 ($flavor)"
+Invoke-E2EFixture 'verify'
diff --git a/tests/e2e/windows/verify.Tests.ps1 b/tests/e2e/windows/verify.Tests.ps1
new file mode 100644
index 0000000..ede25ea
--- /dev/null
+++ b/tests/e2e/windows/verify.Tests.ps1
@@ -0,0 +1,103 @@
+# Assert on an installed SDK, run via Invoke-Pester after install.ps1
+# (see run.ps1). Self-contained: BeforeAll re-derives config and SDK state,
+# so the file also runs standalone for debugging a live container.
+#
+# NOTE: the drift-warning strings asserted here are part of the plugin's
+# user-facing contract (see hooks/ / lib/). If the Lua side rewords them,
+# update both this file and tests/e2e/linux/verify.bats together.
+# (Pester runs tests in file order; the drift test below still keeps its
+# commit + reset inside one test so it never leaks state to neighbours.)
+
+$ErrorActionPreference = 'Stop'
+$PSNativeCommandUseErrorActionPreference = $true
+
+Describe 'installed SDK' {
+    BeforeAll {
+        # NB: $PSScriptRoot must be used directly here. A $here variable set
+        # at file top-level is NOT visible inside BeforeAll/It: Pester runs
+        # discovery and execution in different sessions.
+        . "$PSScriptRoot\lib.ps1"
+        $Flavor = if ($env:FLAVOR) { $env:FLAVOR } else { throw 'FAIL FLAVOR is not set' }
+        $Version = Resolve-FlutterVersion $Flavor
+        $Sdk = Split-Path (Split-Path ((Get-Command flutter -CommandType Application | Select-Object -First 1).Source))
+    }
+
+    It 'carries no vfox commit on the official flavour' {
+        if ($Flavor -ne 'official') { Set-ItResult -Skipped -Because 'official-only check' }
+        $subject = git -C $Sdk log -1 --format=%s
+        $subject | Should -Not -Match 'vfox install'
+    }
+
+    It 'is a git checkout with its engine pins tracked on the ohos flavour' {
+        if ($Flavor -ne 'ohos') { Set-ItResult -Skipped -Because 'ohos-only check' }
+        Test-Path "$Sdk\.git" | Should -BeTrue
+        git -C $Sdk ls-files bin/internal/engine.version | Should -Match ([regex]::Escape('bin/internal/engine.version'))
+    }
+
+    It 'carries a .vfox-manifest anchored at the installed HEAD' {
+        $manifestPath = Join-Path $Sdk '.vfox-manifest'
+        Test-Path $manifestPath | Should -BeTrue
+        $installedHead = @(git -C $Sdk rev-parse HEAD)[0]
+        $anchorMatch = [regex]::Match((Get-Content $manifestPath -Raw), '"expected_head"\s*:\s*"([^"]+)"')
+        $anchorMatch.Success | Should -BeTrue
+        $anchorMatch.Groups[1].Value | Should -Be $installedHead
+    }
+
+    It 'reports no drift when freshly installed' {
+        $PSNativeCommandUseErrorActionPreference = $false
+        $cleanOutput = (& vfox use --global "flutter@$Version" 2>&1 | Out-String)
+        $cleanCode = $LASTEXITCODE
+        $PSNativeCommandUseErrorActionPreference = $true
+        $cleanCode | Should -Be 0
+        $cleanOutput | Should -Not -Match 'has drifted'
+    }
+
+    It 'detects an in-place upgrade and goes quiet after restore' {
+        $manifestPath = Join-Path $Sdk '.vfox-manifest'
+        $anchor = [regex]::Match((Get-Content $manifestPath -Raw), '"expected_head"\s*:\s*"([^"]+)"').Groups[1].Value
+        $anchor | Should -Not -BeNullOrEmpty
+
+        $env:GIT_AUTHOR_NAME = 'e2e'
+        $env:GIT_AUTHOR_EMAIL = 'e2e@vfox.flutter'
+        $env:GIT_COMMITTER_NAME = 'e2e'
+        $env:GIT_COMMITTER_EMAIL = 'e2e@vfox.flutter'
+        try {
+            $PSNativeCommandUseErrorActionPreference = $false
+            git -C $Sdk commit --allow-empty -q -m 'simulated flutter upgrade'
+            if ($LASTEXITCODE -ne 0) { throw "FAIL failed to record a simulated flutter upgrade commit (git exit $LASTEXITCODE)" }
+
+            $driftedHead = @(git -C $Sdk rev-parse HEAD)[0]
+            $driftOutput = (& vfox use --global "flutter@$Version" 2>&1 | Out-String)
+            $driftCode = $LASTEXITCODE
+            $PSNativeCommandUseErrorActionPreference = $true
+            $driftCode | Should -Be 0
+            $driftOutput | Should -Match ([regex]::Escape('has drifted from the version vfox installed'))
+            $driftOutput | Should -Match ([regex]::Escape($anchor))
+            $driftOutput | Should -Match ([regex]::Escape($driftedHead))
+            $driftOutput | Should -Match ([regex]::Escape("vfox uninstall flutter@$Version"))
+            $driftOutput | Should -Match ([regex]::Escape("vfox install  flutter@$Version"))
+            $driftOutput | Should -Match ([regex]::Escape("vfox use      flutter@$Version"))
+            $driftOutput | Should -Match ([regex]::Escape('vfox install flutter@<new-version>'))
+        } finally {
+            $PSNativeCommandUseErrorActionPreference = $true
+            git -C $Sdk reset -q --hard $anchor
+        }
+
+        $PSNativeCommandUseErrorActionPreference = $false
+        $restoredOutput = (& vfox use --global "flutter@$Version" 2>&1 | Out-String)
+        $restoredCode = $LASTEXITCODE
+        $PSNativeCommandUseErrorActionPreference = $true
+        $restoredCode | Should -Be 0
+        $restoredOutput | Should -Not -Match 'has drifted'
+    }
+
+    It 'bootstraps the toolchain with agreeing dart/flutter versions' {
+        Invoke-WithRetry { & curl.exe -fsSL --max-time 20 -o NUL 'https://pub.dev/api/packages/args' } 'pub.dev'
+        $dart = (dart --version 2>&1 | Out-String)
+        $flutter = (flutter --version --no-version-check 2>&1 | Out-String)
+        $flutter | Should -Match ([regex]::Escape((git -C $Sdk rev-parse HEAD).Substring(0, 10)))
+        $dartVersion = (($flutter -split "`n" | Where-Object { $_ -like '*Tools*' }) -split ' ')[3]
+        $dartVersion | Should -Not -BeNullOrEmpty
+        $dart | Should -Match ([regex]::Escape($dartVersion))
+    }
+}
diff --git a/tests/e2e/windows/verify.ps1 b/tests/e2e/windows/verify.ps1
deleted file mode 100644
index e35b222..0000000
--- a/tests/e2e/windows/verify.ps1
+++ /dev/null
@@ -1,96 +0,0 @@
-param(
-    [Parameter(Mandatory = $true)] [string] $Flavor,
-    [Parameter(Mandatory = $true)] [string] $Version
-)
-
-$ErrorActionPreference = 'Stop'
-$PSNativeCommandUseErrorActionPreference = $true
-
-function Assert-Contains {
-    param(
-        [Parameter(Mandatory = $true)] [string] $Actual,
-        [Parameter(Mandatory = $true)] [string] $Expected,
-        [Parameter(Mandatory = $true)] [string] $Label
-    )
-    if ($Expected -eq '') { throw "FAIL $Label : the expected value is empty" }
-    if ($Actual -match [regex]::Escape($Expected)) {
-        Write-Output ("PASS {0} contains {1}" -f $Label, $Expected)
-        return
-    }
-    throw ("FAIL {0} is missing {1}`n--- actual ---`n{2}" -f $Label, $Expected, $Actual)
-}
-
-$sdk = Split-Path (Split-Path ((Get-Command flutter -CommandType Application | Select-Object -First 1).Source))
-if ($Flavor -eq 'official') {
-    $subject = git -C $sdk log -1 --format=%s
-    if ($subject -like '*vfox install*') { throw 'FAIL the official SDK carries a vfox commit' }
-    Write-Output 'PASS the official SDK carries no vfox commit'
-} else {
-    if (-not (Test-Path "$sdk\.git")) { throw 'FAIL the OpenHarmony SDK is not a git checkout' }
-    if (-not (git -C $sdk ls-files bin/internal/engine.version)) { throw 'FAIL the OpenHarmony engine version pin is not tracked' }
-    Write-Output 'PASS the OpenHarmony SDK is a git checkout with its engine pins tracked'
-}
-
-# --- in-place `flutter upgrade` drift detection ---------------------------
-$manifestPath = Join-Path $sdk '.vfox-manifest'
-if (-not (Test-Path $manifestPath)) { throw 'FAIL the SDK has no .vfox-manifest, so its installed version cannot be anchored' }
-Write-Output 'PASS the SDK carries a .vfox-manifest'
-
-$installedHead = @(git -C $sdk rev-parse HEAD)[0]
-$anchorMatch = [regex]::Match((Get-Content $manifestPath -Raw), '"expected_head"\s*:\s*"([^"]+)"')
-if (-not $anchorMatch.Success) { throw 'FAIL the .vfox-manifest has no expected_head' }
-$anchor = $anchorMatch.Groups[1].Value
-if ($anchor -ne $installedHead) { throw "FAIL the .vfox-manifest anchor $anchor does not match the installed git HEAD $installedHead" }
-Write-Output 'PASS the .vfox-manifest anchor matches the installed git HEAD'
-
-$PSNativeCommandUseErrorActionPreference = $false
-$cleanOutput = (& vfox use --global "flutter@$Version" 2>&1) -join "`n"
-$cleanCode = $LASTEXITCODE
-$PSNativeCommandUseErrorActionPreference = $true
-if ($cleanCode -ne 0) { throw "FAIL vfox use exited with code $cleanCode" }
-if ($cleanOutput -match [regex]::Escape('has drifted')) { throw "FAIL a freshly installed SDK reports drift`n--- actual ---`n$cleanOutput" }
-Write-Output 'PASS a freshly installed SDK reports no drift'
-
-$env:GIT_AUTHOR_NAME = 'e2e'
-$env:GIT_AUTHOR_EMAIL = 'e2e@vfox.flutter'
-$env:GIT_COMMITTER_NAME = 'e2e'
-$env:GIT_COMMITTER_EMAIL = 'e2e@vfox.flutter'
-$PSNativeCommandUseErrorActionPreference = $false
-git -C $sdk commit --allow-empty -q -m 'simulated flutter upgrade'
-$commitCode = $LASTEXITCODE
-$PSNativeCommandUseErrorActionPreference = $true
-if ($commitCode -ne 0) { throw "FAIL failed to record a simulated flutter upgrade commit (git exit $commitCode)" }
-
-$driftedHead = @(git -C $sdk rev-parse HEAD)[0]
-$PSNativeCommandUseErrorActionPreference = $false
-$driftOutput = (& vfox use --global "flutter@$Version" 2>&1) -join "`n"
-$driftCode = $LASTEXITCODE
-$PSNativeCommandUseErrorActionPreference = $true
-if ($driftCode -ne 0) { throw "FAIL vfox use exited with code $driftCode" }
-Assert-Contains $driftOutput 'has drifted from the version vfox installed' 'drift warning'
-Assert-Contains $driftOutput $anchor 'drift warning expected head'
-Assert-Contains $driftOutput $driftedHead 'drift warning current head'
-Assert-Contains $driftOutput "vfox uninstall flutter@$Version" 'drift warning restore command'
-Assert-Contains $driftOutput "vfox install  flutter@$Version" 'drift warning restore command'
-Assert-Contains $driftOutput "vfox use      flutter@$Version" 'drift warning restore command'
-Assert-Contains $driftOutput 'vfox install flutter@<new-version>' 'drift warning upgrade command'
-
-git -C $sdk reset -q --hard $anchor
-$PSNativeCommandUseErrorActionPreference = $false
-$restoredOutput = (& vfox use --global "flutter@$Version" 2>&1) -join "`n"
-$restoredCode = $LASTEXITCODE
-$PSNativeCommandUseErrorActionPreference = $true
-if ($restoredCode -ne 0) { throw "FAIL vfox use exited with code $restoredCode" }
-if ($restoredOutput -match [regex]::Escape('has drifted')) { throw "FAIL a restored SDK still reports drift`n--- actual ---`n$restoredOutput" }
-Write-Output 'PASS a restored SDK reports no drift'
-
-try {
-    & curl.exe -fsSL --max-time 20 -o NUL 'https://pub.dev/api/packages/args'
-} catch {
-    throw 'FAIL pub.dev is unreachable, the Flutter tool cannot bootstrap'
-}
-$dart = (dart --version) -join "`n"
-$flutter = (flutter --version --no-version-check) -join "`n"
-Assert-Contains $flutter ((git -C $sdk rev-parse HEAD).Substring(0, 10)) 'flutter --version revision'
-$dartVersion = (($flutter -split "`n" | Where-Object { $_ -like '*Tools*' }) -split ' ')[3]
-Assert-Contains $dart $dartVersion 'dart --version'